@flowselections/admin-installatietechniek 1.0.3 → 1.0.5

package/dist-lib/lib/admin.functions.js

@@ -3,83 +3,121 @@ import { getRequestHost } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireSupabaseAuth } from "../integrations/supabase/auth-middleware";
 import { requireAdmin, requireUserAdmin } from "../lib/admin.server";
-const APP_ROLES = ["admin", "planner", "monteur", "administratie"];
-const roleSchema = z.enum(["admin", "planner", "monteur", "administratie"]);
-const permissionSchema = z.enum(["none", "view", "edit"]);
+const featureSchema = z.object({
+    id: z.string().trim().min(1).max(200),
+    name: z.string().trim().min(1).max(200),
+});
 const syncModulesInput = z.object({
     shellId: z.string().trim().min(1).max(100).optional(),
     modules: z
         .array(z.object({
         id: z.string().trim().min(1).max(100),
         name: z.string().trim().min(1).max(120),
+        features: z.array(featureSchema).max(200).optional(),
     }))
         .max(200),
 });
+const permissionSchema = z.enum(["none", "view", "edit"]);
 const setUserPermissionInput = z.object({
     userId: z.string().uuid(),
     moduleId: z.string().min(1),
+    featureId: z.string().max(200).default(""),
     permission: z.union([permissionSchema, z.literal("inherit")]),
 });
 const userPermissionsInput = z.object({
     userId: z.string().uuid(),
 });
-const moduleOrderInput = z.object({
-    moduleIds: z.array(z.string().trim().min(1).max(100)).max(200),
-});
+const roleIdInput = z.object({ roleId: z.string().uuid() });
 const assignRoleInput = z.object({
     userId: z.string().uuid(),
-    role: roleSchema,
+    roleId: z.string().uuid(),
 });
-const removeRoleInput = z.object({
-    userId: z.string().uuid(),
-    role: roleSchema,
+const rolePermissionsSchema = z
+    .array(z.object({
+    moduleId: z.string().trim().min(1).max(100),
+    featureId: z.string().trim().max(200).default(""),
+    canView: z.boolean(),
+    canEdit: z.boolean(),
+}))
+    .max(2000);
+const createRoleInput = z.object({
+    name: z.string().trim().min(1).max(80),
+    permissions: rolePermissionsSchema.default([]),
 });
-const setPermissionInput = z.object({
-    role: roleSchema,
-    moduleId: z.string().min(1),
-    permission: permissionSchema,
+const updateRoleInput = z.object({
+    roleId: z.string().uuid(),
+    name: z.string().trim().min(1).max(80),
+    permissions: rolePermissionsSchema.default([]),
 });
 const inviteUserInput = z.object({
     email: z.string().trim().email().max(255),
     displayName: z.string().trim().min(1).max(100),
-    role: roleSchema,
+    roleId: z.string().uuid(),
 });
 const deleteUserInput = z.object({
     userId: z.string().uuid(),
 });
+const updateUserNameInput = z.object({
+    userId: z.string().uuid(),
+    displayName: z.string().trim().min(1).max(100),
+});
 const createTestUserInput = z.object({
     displayName: z.string().trim().min(1).max(100),
-    role: roleSchema,
+    roleId: z.string().uuid(),
     email: z.string().trim().email().max(255).optional(),
 });
-function uniqueRoles(roles) {
-    return Array.from(new Set(roles));
+function slugify(value) {
+    return (value
+        .toLowerCase()
+        .normalize("NFD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 60) || `rol-${Date.now()}`);
+}
+async function fetchRole(supabase, roleId) {
+    const { data, error } = await supabase
+        .from("roles")
+        .select("id, key, name, is_protected")
+        .eq("id", roleId)
+        .maybeSingle();
+    if (error)
+        throw error;
+    if (!data)
+        throw new Error("Rol bestaat niet.");
+    return data;
+}
+async function assertMayUseRole(supabase, roleId, isAdmin) {
+    const role = await fetchRole(supabase, roleId);
+    if (!isAdmin && role.key === "admin") {
+        throw new Error("Alleen een admin kan de adminrol gebruiken.");
+    }
+    return role;
 }
 export const getUsersWithRoles = createServerFn({ method: "GET" })
     .middleware([requireSupabaseAuth])
     .handler(async ({ context }) => {
     const { isAdmin } = await requireUserAdmin(context);
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const [{ data: profiles, error: profilesError }, { data: roles, error: rolesError }, { data: authList, error: authError }] = await Promise.all([
-        supabaseAdmin
-            .from("profiles")
-            .select("id, email, display_name")
-            .order("email", { ascending: true }),
-        supabaseAdmin
-            .from("user_roles")
-            .select("id, user_id, role")
-            .order("created_at", { ascending: false }),
+    const [{ data: profiles, error: profilesError }, { data: assignments, error: assignmentsError }, { data: roles, error: rolesError }, { data: authList, error: authError },] = await Promise.all([
+        supabaseAdmin.from("profiles").select("id, email, display_name").order("email", { ascending: true }),
+        supabaseAdmin.from("role_assignments").select("user_id, role_id"),
+        supabaseAdmin.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
         supabaseAdmin.auth.admin.listUsers({ page: 1, perPage: 1000 }),
     ]);
     if (profilesError)
         throw profilesError;
+    if (assignmentsError)
+        throw assignmentsError;
     if (rolesError)
         throw rolesError;
     if (authError)
         throw authError;
     const safeProfiles = Array.isArray(profiles) ? profiles : [];
+    const safeAssignments = Array.isArray(assignments) ? assignments : [];
     const safeRoles = Array.isArray(roles) ? roles : [];
     const safeAuthUsers = Array.isArray(authList?.users) ? authList.users : [];
+    const roleById = new Map(safeRoles.map((r) => [r.id, r]));
     const confirmedById = new Map();
     const isTestById = new Map();
     for (const u of safeAuthUsers) {
@@ -88,21 +126,28 @@ export const getUsersWithRoles = createServerFn({ method: "GET" })
         isTestById.set(u.id, Boolean(meta.is_test_account));
     }
     const rolesByUser = new Map();
-    for (const role of safeRoles) {
-        const list = rolesByUser.get(role.user_id) ?? [];
-        list.push(role);
-        rolesByUser.set(role.user_id, list);
+    for (const a of safeAssignments) {
+        const role = roleById.get(a.role_id);
+        if (!role)
+            continue;
+        const list = rolesByUser.get(a.user_id) ?? [];
+        if (!list.some((r) => r.id === role.id)) {
+            list.push({ id: role.id, key: role.key, name: role.name });
+        }
+        rolesByUser.set(a.user_id, list);
     }
     return {
         users: safeProfiles.map((profile) => ({
             id: profile.id,
             email: profile.email ?? "-",
             displayName: profile.display_name ?? "-",
-            roles: uniqueRoles((rolesByUser.get(profile.id)?.map((r) => r.role) ?? [])),
+            roles: rolesByUser.get(profile.id) ?? [],
             emailConfirmed: confirmedById.get(profile.id) ?? false,
             isTestAccount: isTestById.get(profile.id) ?? false,
         })),
-        availableRoles: isAdmin ? APP_ROLES : APP_ROLES.filter((r) => r !== "admin"),
+        availableRoles: safeRoles
+            .filter((r) => isAdmin || r.key !== "admin")
+            .map((r) => ({ id: r.id, key: r.key, name: r.name, isProtected: r.is_protected })),
         isAdmin,
     };
 });
@@ -111,53 +156,208 @@ export const assignRole = createServerFn({ method: "POST" })
     .inputValidator((data) => assignRoleInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
-    if (!isAdmin && data.role === "admin") {
-        throw new Error("Alleen een admin kan de adminrol toekennen.");
-    }
-    // Schrijft via de user-scoped client: RLS op user_roles is nu de echte gate.
+    await assertMayUseRole(context.supabase, data.roleId, isAdmin);
     const { data: existing, error: checkError } = await context.supabase
-        .from("user_roles")
+        .from("role_assignments")
         .select("id")
         .eq("user_id", data.userId)
-        .eq("role", data.role)
+        .eq("role_id", data.roleId)
         .maybeSingle();
     if (checkError)
         throw checkError;
-    if (existing) {
-        throw new Error(`Gebruiker heeft de rol '${data.role}' al.`);
-    }
+    if (existing)
+        throw new Error("Gebruiker heeft deze rol al.");
     const { error } = await context.supabase
-        .from("user_roles")
-        .insert({ user_id: data.userId, role: data.role });
+        .from("role_assignments")
+        .insert({ user_id: data.userId, role_id: data.roleId });
     if (error)
         throw error;
     return { ok: true };
 });
 export const removeRole = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
-    .inputValidator((data) => removeRoleInput.parse(data))
+    .inputValidator((data) => assignRoleInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
-    if (!isAdmin && data.role === "admin") {
-        throw new Error("Alleen een admin kan de adminrol verwijderen.");
-    }
-    if (data.role === "admin" && data.userId === context.userId) {
+    const role = await assertMayUseRole(context.supabase, data.roleId, isAdmin);
+    if (role.key === "admin" && data.userId === context.userId) {
         throw new Error("Je kunt je eigen adminrol niet verwijderen.");
     }
-    // Delete via user-scoped client (RLS gate). De DB-trigger
-    // `prevent_last_admin_delete` is het definitieve vangnet voor de laatste admin.
     const { error } = await context.supabase
-        .from("user_roles")
+        .from("role_assignments")
         .delete()
         .eq("user_id", data.userId)
-        .eq("role", data.role);
+        .eq("role_id", data.roleId);
+    if (error)
+        throw error;
+    return { ok: true };
+});
+/** Alle rollen met hun rechten, plus de geregistreerde modules en onderdelen. */
+export const getRoles = createServerFn({ method: "GET" })
+    .middleware([requireSupabaseAuth])
+    .handler(async ({ context }) => {
+    await requireUserAdmin(context);
+    const [{ data: roles, error: rolesError }, { data: perms, error: permsError }, { data: registry, error: registryError }, { data: featureRows, error: featuresError },] = await Promise.all([
+        context.supabase.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
+        context.supabase.from("role_permissions").select("role_id, module_id, feature_id, can_view, can_edit"),
+        context.supabase.from("module_registry").select("module_id, name, is_active, enforce").order("name", { ascending: true }),
+        context.supabase.from("module_features").select("module_id, feature_id, name, is_active").order("name", { ascending: true }),
+    ]);
+    if (rolesError)
+        throw rolesError;
+    if (permsError)
+        throw permsError;
+    if (registryError)
+        throw registryError;
+    if (featuresError)
+        throw featuresError;
+    const safeRoles = Array.isArray(roles) ? roles : [];
+    const safePerms = Array.isArray(perms) ? perms : [];
+    const safeRegistry = Array.isArray(registry) ? registry : [];
+    const safeFeatures = Array.isArray(featureRows) ? featureRows : [];
+    return {
+        roles: safeRoles.map((r) => ({
+            id: r.id,
+            key: r.key,
+            name: r.name,
+            isProtected: r.is_protected,
+        })),
+        modules: safeRegistry
+            .filter((m) => m.is_active)
+            .map((m) => ({
+            id: m.module_id,
+            name: m.name,
+            enforce: Boolean(m.enforce),
+            features: safeFeatures
+                .filter((f) => f.is_active && f.module_id === m.module_id)
+                .map((f) => ({ id: f.feature_id, name: f.name })),
+        })),
+        permissions: safePerms.map((p) => ({
+            roleId: p.role_id,
+            moduleId: p.module_id,
+            featureId: p.feature_id ?? "",
+            canView: Boolean(p.can_view),
+            canEdit: Boolean(p.can_edit),
+        })),
+    };
+});
+async function writeRolePermissions(supabase, roleId, permissions) {
+    const { error: delError } = await supabase.from("role_permissions").delete().eq("role_id", roleId);
+    if (delError)
+        throw delError;
+    const rows = permissions
+        .filter((p) => p.canView || p.canEdit)
+        .map((p) => ({
+        role_id: roleId,
+        module_id: p.moduleId,
+        feature_id: p.featureId ?? "",
+        can_view: p.canView || p.canEdit,
+        can_edit: p.canEdit,
+        updated_at: new Date().toISOString(),
+    }));
+    if (rows.length === 0)
+        return;
+    const { error } = await supabase.from("role_permissions").insert(rows);
+    if (error)
+        throw error;
+}
+export const createRole = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => createRoleInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const baseKey = slugify(data.name);
+    let key = baseKey;
+    for (let i = 2; i < 50; i++) {
+        const { data: taken, error } = await context.supabase
+            .from("roles")
+            .select("id")
+            .eq("key", key)
+            .maybeSingle();
+        if (error)
+            throw error;
+        if (!taken)
+            break;
+        key = `${baseKey}-${i}`;
+    }
+    const { data: created, error } = await context.supabase
+        .from("roles")
+        .insert({ key, name: data.name, is_protected: false })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    await writeRolePermissions(context.supabase, created.id, data.permissions);
+    return { ok: true, roleId: created.id };
+});
+export const updateRole = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => updateRoleInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { error } = await context.supabase
+        .from("roles")
+        .update({ name: data.name, updated_at: new Date().toISOString() })
+        .eq("id", data.roleId);
+    if (error)
+        throw error;
+    await writeRolePermissions(context.supabase, data.roleId, data.permissions);
+    return { ok: true };
+});
+export const duplicateRole = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => roleIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const role = await fetchRole(context.supabase, data.roleId);
+    const { data: perms, error: permsError } = await context.supabase
+        .from("role_permissions")
+        .select("module_id, feature_id, can_view, can_edit")
+        .eq("role_id", data.roleId);
+    if (permsError)
+        throw permsError;
+    const name = `${role.name} (kopie)`;
+    const baseKey = slugify(name);
+    let key = baseKey;
+    for (let i = 2; i < 50; i++) {
+        const { data: taken } = await context.supabase.from("roles").select("id").eq("key", key).maybeSingle();
+        if (!taken)
+            break;
+        key = `${baseKey}-${i}`;
+    }
+    const { data: created, error } = await context.supabase
+        .from("roles")
+        .insert({ key, name, is_protected: false })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    const safePerms = Array.isArray(perms) ? perms : [];
+    await writeRolePermissions(context.supabase, created.id, safePerms.map((p) => ({
+        moduleId: p.module_id,
+        featureId: p.feature_id ?? "",
+        canView: Boolean(p.can_view),
+        canEdit: Boolean(p.can_edit),
+    })));
+    return { ok: true, roleId: created.id };
+});
+export const deleteRole = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => roleIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const role = await fetchRole(context.supabase, data.roleId);
+    if (role.is_protected) {
+        throw new Error("Deze rol is beschermd en kan niet verwijderd worden.");
+    }
+    const { error } = await context.supabase.from("roles").delete().eq("id", data.roleId);
     if (error)
         throw error;
     return { ok: true };
 });
 /**
- * Registreert de modules die de shell heeft geladen. Modules die niet in de
- * lijst voorkomen blijven bestaan maar worden op inactief gezet.
+ * Registreert de modules (en hun onderdelen) die de shell heeft geladen.
+ * Wat niet meer voorkomt blijft bestaan maar wordt op inactief gezet.
  */
 export const syncModuleRegistry = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
@@ -177,7 +377,6 @@ export const syncModuleRegistry = createServerFn({ method: "POST" })
     })), { onConflict: "module_id" });
     if (error)
         throw error;
-    // Modules van deze shell die niet meer geleverd worden → inactief.
     if (data.shellId) {
         const ids = modules.map((m) => m.id);
         const { error: deactivateError } = await context.supabase
@@ -188,117 +387,88 @@ export const syncModuleRegistry = createServerFn({ method: "POST" })
         if (deactivateError)
             throw deactivateError;
     }
+    // Onderdelen (subpagina's) synchroniseren.
+    const featureRows = modules.flatMap((m) => (m.features ?? []).map((f) => ({
+        module_id: m.id,
+        feature_id: f.id,
+        name: f.name,
+        is_active: true,
+        last_seen_at: now,
+    })));
+    if (featureRows.length > 0) {
+        const { error: featError } = await context.supabase
+            .from("module_features")
+            .upsert(featureRows, { onConflict: "module_id,feature_id" });
+        if (featError)
+            throw featError;
+    }
+    for (const m of modules) {
+        const ids = (m.features ?? []).map((f) => f.id);
+        let query = context.supabase
+            .from("module_features")
+            .update({ is_active: false })
+            .eq("module_id", m.id);
+        if (ids.length > 0) {
+            query = query.not("feature_id", "in", `(${ids.map((i) => `"${i}"`).join(",")})`);
+        }
+        const { error: deactivateFeatError } = await query;
+        if (deactivateFeatError)
+            throw deactivateFeatError;
+    }
     return { ok: true, count: modules.length };
 });
-/**
- * Volgorde van modules in de zijbalk. Leesbaar voor elke ingelogde gebruiker,
- * zodat de shell hem kan toepassen.
- */
-export const getModuleOrder = createServerFn({ method: "GET" })
-    .middleware([requireSupabaseAuth])
-    .handler(async ({ context }) => {
-    const { data, error } = await context.supabase
-        .from("module_registry")
-        .select("module_id, name, sort_order, is_active")
-        .eq("is_active", true);
-    if (error)
-        throw error;
-    const safe = Array.isArray(data) ? data : [];
-    // Rijen zonder sort_order blijven `null`: de client bepaalt hun plek op
-    // basis van de bronvolgorde van de shell (geen alfabetische fallback).
-    return {
-        modules: safe
-            .map((row) => ({
-            id: row.module_id,
-            name: row.name,
-            sortOrder: typeof row.sort_order === "number" ? row.sort_order : null,
-        }))
-            .sort((a, b) => {
-            const ao = a.sortOrder ?? Number.MAX_SAFE_INTEGER;
-            const bo = b.sortOrder ?? Number.MAX_SAFE_INTEGER;
-            return ao - bo;
-        }),
-    };
+const setModuleEnforceInput = z.object({
+    moduleId: z.string().trim().min(1).max(100),
+    enforce: z.boolean(),
 });
-/** Slaat de volgorde op: index in de aangeleverde lijst wordt sort_order. */
-export const setModuleOrder = createServerFn({ method: "POST" })
+export const setModuleEnforce = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
-    .inputValidator((data) => moduleOrderInput.parse(data))
+    .inputValidator((data) => setModuleEnforceInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
-    const ids = Array.isArray(data.moduleIds) ? data.moduleIds : [];
-    for (let i = 0; i < ids.length; i++) {
-        const { error } = await context.supabase
-            .from("module_registry")
-            .update({ sort_order: i })
-            .eq("module_id", ids[i]);
-        if (error)
-            throw error;
-    }
-    return { ok: true, count: ids.length };
-});
-export const getModulePermissions = createServerFn({ method: "GET" })
-    .middleware([requireSupabaseAuth])
-    .handler(async ({ context }) => {
-    await requireAdmin(context);
-    const [{ data, error }, { data: registry, error: registryError }] = await Promise.all([
-        context.supabase.from("module_permissions").select("role, module_id, permission"),
-        context.supabase
-            .from("module_registry")
-            .select("module_id, name, is_active")
-            .order("name", { ascending: true }),
-    ]);
+    const { error } = await context.supabase
+        .from("module_registry")
+        .update({ enforce: data.enforce })
+        .eq("module_id", data.moduleId);
     if (error)
         throw error;
-    if (registryError)
-        throw registryError;
-    const safe = Array.isArray(data) ? data : [];
-    const safeRegistry = Array.isArray(registry) ? registry : [];
-    return {
-        roles: APP_ROLES,
-        modules: safeRegistry
-            .filter((row) => row.is_active)
-            .map((row) => ({
-            id: row.module_id,
-            name: row.name,
-        })),
-        permissions: safe.map((row) => ({
-            role: row.role,
-            moduleId: row.module_id,
-            permission: row.permission,
-        })),
-    };
+    return { ok: true };
 });
 export const getUserModulePermissions = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
     .inputValidator((data) => userPermissionsInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireUserAdmin(context);
-    const [{ data: overrides, error }, { data: registry, error: registryError }] = await Promise.all([
+    const [{ data: overrides, error }, { data: registry, error: registryError }, { data: featureRows, error: featuresError },] = await Promise.all([
         context.supabase
             .from("user_module_permissions")
-            .select("module_id, permission")
+            .select("module_id, feature_id, permission")
             .eq("user_id", data.userId),
-        context.supabase
-            .from("module_registry")
-            .select("module_id, name, is_active")
-            .order("name", { ascending: true }),
+        context.supabase.from("module_registry").select("module_id, name, is_active").order("name", { ascending: true }),
+        context.supabase.from("module_features").select("module_id, feature_id, name, is_active").order("name", { ascending: true }),
     ]);
     if (error)
         throw error;
     if (registryError)
         throw registryError;
+    if (featuresError)
+        throw featuresError;
     const safeOverrides = Array.isArray(overrides) ? overrides : [];
     const safeRegistry = Array.isArray(registry) ? registry : [];
+    const safeFeatures = Array.isArray(featureRows) ? featureRows : [];
     return {
         modules: safeRegistry
             .filter((row) => row.is_active)
             .map((row) => ({
             id: row.module_id,
             name: row.name,
+            features: safeFeatures
+                .filter((f) => f.is_active && f.module_id === row.module_id)
+                .map((f) => ({ id: f.feature_id, name: f.name })),
         })),
         overrides: safeOverrides.map((row) => ({
             moduleId: row.module_id,
+            featureId: row.feature_id ?? "",
             permission: row.permission,
         })),
     };
@@ -308,12 +478,14 @@ export const setUserModulePermission = createServerFn({ method: "POST" })
     .inputValidator((data) => setUserPermissionInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireUserAdmin(context);
+    const featureId = data.featureId ?? "";
     if (data.permission === "inherit") {
         const { error } = await context.supabase
             .from("user_module_permissions")
             .delete()
             .eq("user_id", data.userId)
-            .eq("module_id", data.moduleId);
+            .eq("module_id", data.moduleId)
+            .eq("feature_id", featureId);
         if (error)
             throw error;
         return { ok: true };
@@ -321,27 +493,10 @@ export const setUserModulePermission = createServerFn({ method: "POST" })
     const { error } = await context.supabase.from("user_module_permissions").upsert({
         user_id: data.userId,
         module_id: data.moduleId,
+        feature_id: featureId,
         permission: data.permission,
         updated_at: new Date().toISOString(),
-    }, { onConflict: "user_id,module_id" });
-    if (error)
-        throw error;
-    return { ok: true };
-});
-export const setModulePermission = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => setPermissionInput.parse(data))
-    .handler(async ({ context, data }) => {
-    await requireAdmin(context);
-    // Upsert via user-scoped client — RLS write-policy op module_permissions
-    // vereist admin (via JWT-claim of has_role-fallback).
-    const { error } = await context.supabase
-        .from("module_permissions")
-        .upsert({
-        role: data.role,
-        module_id: data.moduleId,
-        permission: data.permission,
-    }, { onConflict: "role,module_id" });
+    }, { onConflict: "user_id,module_id,feature_id" });
     if (error)
         throw error;
     return { ok: true };
@@ -351,9 +506,7 @@ export const inviteUser = createServerFn({ method: "POST" })
     .inputValidator((data) => inviteUserInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
-    if (!isAdmin && data.role === "admin") {
-        throw new Error("Alleen een admin kan een account met de adminrol aanmaken.");
-    }
+    await assertMayUseRole(context.supabase, data.roleId, isAdmin);
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
     let redirectTo;
     try {
@@ -366,10 +519,7 @@ export const inviteUser = createServerFn({ method: "POST" })
     catch {
         redirectTo = undefined;
     }
-    const { data: invited, error: inviteError } = await supabaseAdmin.auth.admin.inviteUserByEmail(data.email, {
-        data: { display_name: data.displayName },
-        redirectTo,
-    });
+    const { data: invited, error: inviteError } = await supabaseAdmin.auth.admin.inviteUserByEmail(data.email, { data: { display_name: data.displayName }, redirectTo });
     if (inviteError || !invited?.user) {
         const msg = inviteError?.message ?? "Uitnodigen mislukt";
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
@@ -381,8 +531,8 @@ export const inviteUser = createServerFn({ method: "POST" })
     if (profileError)
         throw profileError;
     const { error: roleError } = await supabaseAdmin
-        .from("user_roles")
-        .upsert({ user_id: userId, role: data.role }, { onConflict: "user_id,role", ignoreDuplicates: true });
+        .from("role_assignments")
+        .upsert({ user_id: userId, role_id: data.roleId }, { onConflict: "user_id,role_id", ignoreDuplicates: true });
     if (roleError)
         throw roleError;
     return { ok: true, userId };
@@ -397,13 +547,13 @@ export const deleteUser = createServerFn({ method: "POST" })
     }
     if (!isAdmin) {
         const { data: targetRoles, error: targetError } = await context.supabase
-            .from("user_roles")
-            .select("role")
+            .from("role_assignments")
+            .select("roles(key)")
             .eq("user_id", data.userId);
         if (targetError)
             throw targetError;
         const safeTargetRoles = Array.isArray(targetRoles) ? targetRoles : [];
-        if (safeTargetRoles.some((r) => r.role === "admin")) {
+        if (safeTargetRoles.some((r) => r?.roles?.key === "admin")) {
             throw new Error("Alleen een admin kan een adminaccount verwijderen.");
         }
     }
@@ -413,6 +563,37 @@ export const deleteUser = createServerFn({ method: "POST" })
         throw error;
     return { ok: true };
 });
+export const updateUserName = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => updateUserNameInput.parse(data))
+    .handler(async ({ context, data }) => {
+    const { isAdmin } = await requireUserAdmin(context);
+    if (!isAdmin && data.userId !== context.userId) {
+        const { data: targetRoles, error: targetError } = await context.supabase
+            .from("role_assignments")
+            .select("roles(key)")
+            .eq("user_id", data.userId);
+        if (targetError)
+            throw targetError;
+        const safeTargetRoles = Array.isArray(targetRoles) ? targetRoles : [];
+        if (safeTargetRoles.some((r) => r?.roles?.key === "admin")) {
+            throw new Error("Alleen een admin kan een adminaccount aanpassen.");
+        }
+    }
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const { error: authError } = await supabaseAdmin.auth.admin.updateUserById(data.userId, {
+        user_metadata: { display_name: data.displayName },
+    });
+    if (authError)
+        throw authError;
+    const { error } = await supabaseAdmin
+        .from("profiles")
+        .update({ display_name: data.displayName })
+        .eq("id", data.userId);
+    if (error)
+        throw error;
+    return { ok: true };
+});
 function generatePassword(length = 16) {
     const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789!@#$%*";
     const bytes = new Uint8Array(length);
@@ -427,12 +608,9 @@ export const createTestUser = createServerFn({ method: "POST" })
     .inputValidator((data) => createTestUserInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
-    if (!isAdmin && data.role === "admin") {
-        throw new Error("Alleen een admin kan een account met de adminrol aanmaken.");
-    }
+    await assertMayUseRole(context.supabase, data.roleId, isAdmin);
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const email = data.email?.trim() ||
-        `test-${Date.now()}-${Math.floor(Math.random() * 1000)}@test.local`;
+    const email = data.email?.trim() || `test-${Date.now()}-${Math.floor(Math.random() * 1000)}@test.local`;
     const password = generatePassword(16);
     const { data: created, error: createError } = await supabaseAdmin.auth.admin.createUser({
         email,
@@ -445,15 +623,14 @@ export const createTestUser = createServerFn({ method: "POST" })
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
     }
     const userId = created.user.id;
-    // Trigger vult profiles al; toch upsert voor zekerheid (idempotent).
     const { error: profileError } = await supabaseAdmin
         .from("profiles")
         .upsert({ id: userId, email, display_name: data.displayName }, { onConflict: "id" });
     if (profileError)
         throw profileError;
     const { error: roleError } = await supabaseAdmin
-        .from("user_roles")
-        .upsert({ user_id: userId, role: data.role }, { onConflict: "user_id,role", ignoreDuplicates: true });
+        .from("role_assignments")
+        .upsert({ user_id: userId, role_id: data.roleId }, { onConflict: "user_id,role_id", ignoreDuplicates: true });
     if (roleError)
         throw roleError;
     return { ok: true, userId, email, password };