@eintrek/erp-shell 0.1.24 → 0.1.25

package/dist/index.js

@@ -623,12 +623,19 @@ SidebarMenuSubButton.displayName = "SidebarMenuSubButton";
 
 /**
  * True when the user's child-group segments include at least one of the
- * groups required for `permissionRouteKey`. Missing key / empty required
- * list both fall open (no restriction).
+ * groups required for `permissionRouteKey`.
+ *
+ * Fail-closed:
+ * - Nav item without `permissionRouteKey` → deny (must declare a key)
+ * - Key absent from `rulesMap` → deny (unknown route is not public)
+ * - Key present with `required_child_groups: []` → allow (explicit public)
  */
 function canAccessNavPermissionRoute(permissionRouteKey, rulesMap, userChildSegments) {
     if (!permissionRouteKey)
-        return true;
+        return false;
+    if (!Object.prototype.hasOwnProperty.call(rulesMap, permissionRouteKey)) {
+        return false;
+    }
     const required = rulesMap[permissionRouteKey] ?? [];
     if (required.length === 0)
         return true;
@@ -1216,8 +1223,8 @@ function PermissionRulesProvider({ children, data, isLoading = false, isError =
     return (jsxRuntime.jsx(PermissionRulesContext.Provider, { value: value, children: children }));
 }
 /**
- * Read the permission rules. Returns empty maps when used outside the
- * provider (lets pages render without a hard-fail in tests).
+ * Read the permission rules. Outside the provider, report loading so
+ * fail-closed consumers (nav / gates) do not treat empty maps as "allow all".
  */
 function usePermissionRules() {
     const ctx = React.useContext(PermissionRulesContext);
@@ -1225,7 +1232,7 @@ function usePermissionRules() {
         return {
             rulesMap: {},
             policiesMap: {},
-            isLoading: false,
+            isLoading: true,
             isError: false,
             updatedAt: null,
         };
@@ -1247,20 +1254,22 @@ function normalizePathnameForPermissionRules(pathname) {
     const path = parts.length <= 1 ? "/" : "/" + parts.slice(1).join("/");
     return path.replace(/\/user-role\/(purchase-doc|sales-doc)$/, "/user-role/members");
 }
+function hasRule(rulesMap, routeKey) {
+    return Object.prototype.hasOwnProperty.call(rulesMap, routeKey);
+}
 /**
- * Returns the required child-group segments for a page pathname (the user's
- * JWT must contain at least one matching group). An exact match on the
- * normalized path wins; otherwise the function falls back to a segment-by-
- * segment pattern match where `[param]` placeholders accept any non-empty
- * value. Returns an empty array when no rule covers the path.
+ * Resolve UI route permissions for a pathname.
  *
- * `rulesMap` is the merged map — apps that want a fallback should layer it
- * here (`{ ...fallbackMap, ...liveMap }`) before calling.
+ * - Exact / `[param]` pattern match → matched
+ * - Parent-prefix inherit only when the parent rule has a **non-empty**
+ *   role list (restrictive inherit). Explicitly public parents (`[]`) do
+ *   not open all children.
+ * - No match → `{ matched: false }` (fail closed — never treat as public)
  */
-function getRequiredChildGroups(pathname, rulesMap) {
+function resolveUiRoutePermission(pathname, rulesMap) {
     const normalized = normalizePathnameForPermissionRules(pathname);
-    if (rulesMap[normalized]) {
-        return rulesMap[normalized];
+    if (hasRule(rulesMap, normalized)) {
+        return { matched: true, roles: rulesMap[normalized] ?? [] };
     }
     const pathSegments = normalized.split("/").filter(Boolean);
     for (const [pattern, roles] of Object.entries(rulesMap)) {
@@ -1283,24 +1292,43 @@ function getRequiredChildGroups(pathname, rulesMap) {
             }
         }
         if (matches) {
-            return roles;
+            return { matched: true, roles: roles ?? [] };
         }
     }
-    return [];
+    // Parent-prefix: /leave/types/abc → /leave/types (non-empty roles only)
+    for (let len = pathSegments.length - 1; len >= 1; len--) {
+        const parent = "/" + pathSegments.slice(0, len).join("/");
+        if (hasRule(rulesMap, parent) && (rulesMap[parent]?.length ?? 0) > 0) {
+            return { matched: true, roles: rulesMap[parent] ?? [] };
+        }
+    }
+    return { matched: false, roles: [] };
+}
+/**
+ * Returns the required child-group segments for a page pathname.
+ *
+ * Prefer {@link resolveUiRoutePermission} when you need to distinguish
+ * "explicitly public (`[]`)" from "no rule (deny)". This helper returns
+ * `[]` for both cases and is kept for backward compatibility.
+ */
+function getRequiredChildGroups(pathname, rulesMap) {
+    return resolveUiRoutePermission(pathname, rulesMap).roles;
 }
 
+function DeniedCard() {
+    return (jsxRuntime.jsx(erpTheme.Card, { className: "p-6", children: jsxRuntime.jsxs("div", { className: "flex flex-col items-center justify-center gap-3 text-center", children: [jsxRuntime.jsx(lucideReact.AlertCircle, { className: "h-8 w-8 text-destructive" }), jsxRuntime.jsxs("div", { className: "space-y-1", children: [jsxRuntime.jsx("h3", { className: "text-lg font-semibold text-destructive", children: "\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07" }), jsxRuntime.jsx("p", { className: "text-sm text-muted-foreground", children: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E43\u0E19\u0E01\u0E32\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49 \u0E2B\u0E32\u0E01\u0E04\u0E34\u0E14\u0E27\u0E48\u0E32\u0E04\u0E27\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E44\u0E14\u0E49 \u0E01\u0E23\u0E38\u0E13\u0E32\u0E15\u0E34\u0E14\u0E15\u0E48\u0E2D\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A\u0E02\u0E2D\u0E07\u0E2D\u0E07\u0E04\u0E4C\u0E01\u0E23" })] })] }) }));
+}
 /**
  * Permission gate for a page subtree. Looks up the current pathname in the
  * permission rules map (live rules from `PermissionRulesProvider`, layered
  * over the optional `fallbackRulesMap`), passes the resolved required roles
- * into the host's `usePermission` probe, and renders one of three states:
+ * into the host's `usePermission` probe, and renders one of:
  *
- * 1. while rules or probe are still loading → centered spinner card
- * 2. probe says no access → centered "ไม่มีสิทธิ์" card
- * 3. otherwise → children
- *
- * Role codes are intentionally not shown on the deny screen (they are
- * internal identifiers like `fin_controller` and confuse end users).
+ * 1. rules / probe still loading → `null` (let Suspense / loading.tsx show)
+ * 2. no rule covers this path → deny (fail closed)
+ * 3. rule is explicit public (`[]`) → children
+ * 4. probe says no access → deny card
+ * 5. otherwise → children
  */
 function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
     const pathname = navigation.usePathname();
@@ -1311,31 +1339,27 @@ function PermissionProvider({ children, usePermission, fallbackRulesMap, }) {
         // live rules win over fallback when both define the same key
         return { ...fallbackRulesMap, ...rulesMap };
     }, [rulesMap, fallbackRulesMap]);
-    const requiredRoles = React.useMemo(() => getRequiredChildGroups(pathname, mergedMap), [pathname, mergedMap]);
-    // Hook must run unconditionally (rules of hooks); we just ignore the
-    // result on the fast path below.
+    const lookup = React.useMemo(() => resolveUiRoutePermission(pathname, mergedMap), [pathname, mergedMap]);
+    // Hook must run unconditionally (rules of hooks).
     const { hasPermission, isLoading } = usePermission({
-        requiredRoles,
+        requiredRoles: lookup.roles,
     });
-    // Fast path — no rule covers this pathname, anyone can see it. Skip the
-    // probe UI entirely; flashing "checking permission" or "no access" on an
-    // unrestricted page is pure noise.
-    if (requiredRoles.length === 0) {
+    if (rulesLoading) {
+        return null;
+    }
+    // Unknown route → deny. Only explicit `required_child_groups: []` is public.
+    if (!lookup.matched) {
+        return jsxRuntime.jsx(DeniedCard, {});
+    }
+    if (lookup.roles.length === 0) {
         return jsxRuntime.jsx(jsxRuntime.Fragment, { children: children });
     }
-    // While the answer hasn't settled, render nothing and let the surrounding
-    // Next.js loading.tsx / Suspense fallback show. The old behaviour wrapped
-    // a big "กำลังตรวจสอบสิทธิ์..." card over the top, which both duplicated
-    // the app's own loader and — worse — caused a "ไม่มีสิทธิ์" flash on
-    // fast loads because the probe transiently returned `hasPermission:false,
-    // isLoading:false` before its dependencies (org context, role-segments)
-    // arrived.
-    const isLoadingCombined = rulesLoading || isLoading;
+    const isLoadingCombined = isLoading;
     if (isLoadingCombined) {
         return null;
     }
     if (!hasPermission) {
-        return (jsxRuntime.jsx(erpTheme.Card, { className: "p-6", children: jsxRuntime.jsxs("div", { className: "flex flex-col items-center justify-center gap-3 text-center", children: [jsxRuntime.jsx(lucideReact.AlertCircle, { className: "h-8 w-8 text-destructive" }), jsxRuntime.jsxs("div", { className: "space-y-1", children: [jsxRuntime.jsx("h3", { className: "text-lg font-semibold text-destructive", children: "\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07" }), jsxRuntime.jsx("p", { className: "text-sm text-muted-foreground", children: "\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E21\u0E35\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C\u0E43\u0E19\u0E01\u0E32\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E2B\u0E19\u0E49\u0E32\u0E19\u0E35\u0E49 \u0E2B\u0E32\u0E01\u0E04\u0E34\u0E14\u0E27\u0E48\u0E32\u0E04\u0E27\u0E23\u0E40\u0E02\u0E49\u0E32\u0E16\u0E36\u0E07\u0E44\u0E14\u0E49 \u0E01\u0E23\u0E38\u0E13\u0E32\u0E15\u0E34\u0E14\u0E15\u0E48\u0E2D\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E23\u0E30\u0E1A\u0E1A\u0E02\u0E2D\u0E07\u0E2D\u0E07\u0E04\u0E4C\u0E01\u0E23" })] })] }) }));
+        return jsxRuntime.jsx(DeniedCard, {});
     }
     return jsxRuntime.jsx(jsxRuntime.Fragment, { children: children });
 }
@@ -1877,6 +1901,7 @@ exports.getRequiredChildGroups = getRequiredChildGroups;
 exports.isLikelyTransientNetworkError = isLikelyTransientNetworkError;
 exports.isPathActive = isPathActive;
 exports.normalizePathnameForPermissionRules = normalizePathnameForPermissionRules;
+exports.resolveUiRoutePermission = resolveUiRoutePermission;
 exports.runGlobalRequestPrecheck = runGlobalRequestPrecheck;
 exports.runWithTransientRetry = runWithTransientRetry;
 exports.setOrganizationId = setOrganizationId;