@flowselections/admin-installatietechniek 1.0.5 → 1.0.6

package/dist-lib/lib/admin.functions.js

@@ -53,6 +53,7 @@ const inviteUserInput = z.object({
     email: z.string().trim().email().max(255),
     displayName: z.string().trim().min(1).max(100),
     roleId: z.string().uuid(),
+    profileId: z.string().uuid().optional(),
 });
 const deleteUserInput = z.object({
     userId: z.string().uuid(),
@@ -65,6 +66,7 @@ const createTestUserInput = z.object({
     displayName: z.string().trim().min(1).max(100),
     roleId: z.string().uuid(),
     email: z.string().trim().email().max(255).optional(),
+    profileId: z.string().uuid().optional(),
 });
 function slugify(value) {
     return (value
@@ -94,13 +96,45 @@ async function assertMayUseRole(supabase, roleId, isAdmin) {
     }
     return role;
 }
-export const getUsersWithRoles = createServerFn({ method: "GET" })
+const profileScopeInput = z
+    .object({ profileId: z.string().uuid().optional() })
+    .optional();
+/** Tenant + rol-/module-scope van een bedrijfsprofiel (of het actieve profiel). */
+async function loadProfileScope(supabase, profileId) {
+    let query = supabase.from("profiles_org").select("id, name, tenant_id, is_default");
+    query = profileId ? query.eq("id", profileId) : query.eq("is_default", true);
+    const { data, error } = await query.maybeSingle();
+    if (error)
+        throw error;
+    if (!data)
+        return null;
+    const [{ data: roleRows }, { data: moduleRows }] = await Promise.all([
+        supabase.from("profile_roles").select("role_id").eq("profile_id", data.id),
+        supabase.from("profile_modules").select("module_id").eq("profile_id", data.id),
+    ]);
+    return {
+        id: data.id,
+        name: data.name,
+        tenantId: (data.tenant_id ?? null),
+        roleIds: (Array.isArray(roleRows) ? roleRows : []).map((r) => r.role_id),
+        moduleIds: (Array.isArray(moduleRows) ? moduleRows : []).map((m) => m.module_id),
+    };
+}
+export const getUsersWithRoles = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
-    .handler(async ({ context }) => {
+    .inputValidator((data) => profileScopeInput.parse(data))
+    .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const scope = await loadProfileScope(supabaseAdmin, data?.profileId);
+    let profilesQuery = supabaseAdmin
+        .from("profiles")
+        .select("id, email, display_name, tenant_id")
+        .order("email", { ascending: true });
+    if (scope?.tenantId)
+        profilesQuery = profilesQuery.eq("tenant_id", scope.tenantId);
     const [{ data: profiles, error: profilesError }, { data: assignments, error: assignmentsError }, { data: roles, error: rolesError }, { data: authList, error: authError },] = await Promise.all([
-        supabaseAdmin.from("profiles").select("id, email, display_name").order("email", { ascending: true }),
+        profilesQuery,
         supabaseAdmin.from("role_assignments").select("user_id, role_id"),
         supabaseAdmin.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
         supabaseAdmin.auth.admin.listUsers({ page: 1, perPage: 1000 }),
@@ -115,9 +149,12 @@ export const getUsersWithRoles = createServerFn({ method: "GET" })
         throw authError;
     const safeProfiles = Array.isArray(profiles) ? profiles : [];
     const safeAssignments = Array.isArray(assignments) ? assignments : [];
-    const safeRoles = Array.isArray(roles) ? roles : [];
+    const allRoles = Array.isArray(roles) ? roles : [];
+    const safeRoles = scope && scope.roleIds.length > 0
+        ? allRoles.filter((r) => scope.roleIds.includes(r.id))
+        : allRoles;
     const safeAuthUsers = Array.isArray(authList?.users) ? authList.users : [];
-    const roleById = new Map(safeRoles.map((r) => [r.id, r]));
+    const roleById = new Map(allRoles.map((r) => [r.id, r]));
     const confirmedById = new Map();
     const isTestById = new Map();
     for (const u of safeAuthUsers) {
@@ -149,6 +186,7 @@ export const getUsersWithRoles = createServerFn({ method: "GET" })
             .filter((r) => isAdmin || r.key !== "admin")
             .map((r) => ({ id: r.id, key: r.key, name: r.name, isProtected: r.is_protected })),
         isAdmin,
+        activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
 export const assignRole = createServerFn({ method: "POST" })
@@ -193,10 +231,12 @@ export const removeRole = createServerFn({ method: "POST" })
     return { ok: true };
 });
 /** Alle rollen met hun rechten, plus de geregistreerde modules en onderdelen. */
-export const getRoles = createServerFn({ method: "GET" })
+export const getRoles = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
-    .handler(async ({ context }) => {
+    .inputValidator((data) => profileScopeInput.parse(data))
+    .handler(async ({ context, data }) => {
     await requireUserAdmin(context);
+    const scope = await loadProfileScope(context.supabase, data?.profileId);
     const [{ data: roles, error: rolesError }, { data: perms, error: permsError }, { data: registry, error: registryError }, { data: featureRows, error: featuresError },] = await Promise.all([
         context.supabase.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
         context.supabase.from("role_permissions").select("role_id, module_id, feature_id, can_view, can_edit"),
@@ -211,9 +251,15 @@ export const getRoles = createServerFn({ method: "GET" })
         throw registryError;
     if (featuresError)
         throw featuresError;
-    const safeRoles = Array.isArray(roles) ? roles : [];
+    const allRoles = Array.isArray(roles) ? roles : [];
+    const safeRoles = scope && scope.roleIds.length > 0
+        ? allRoles.filter((r) => scope.roleIds.includes(r.id))
+        : allRoles;
     const safePerms = Array.isArray(perms) ? perms : [];
-    const safeRegistry = Array.isArray(registry) ? registry : [];
+    const allRegistry = Array.isArray(registry) ? registry : [];
+    const safeRegistry = scope && scope.moduleIds.length > 0
+        ? allRegistry.filter((m) => scope.moduleIds.includes(m.module_id))
+        : allRegistry;
     const safeFeatures = Array.isArray(featureRows) ? featureRows : [];
     return {
         roles: safeRoles.map((r) => ({
@@ -239,6 +285,7 @@ export const getRoles = createServerFn({ method: "GET" })
             canView: Boolean(p.can_view),
             canEdit: Boolean(p.can_edit),
         })),
+        activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
 async function writeRolePermissions(supabase, roleId, permissions) {
@@ -525,9 +572,13 @@ export const inviteUser = createServerFn({ method: "POST" })
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
     }
     const userId = invited.user.id;
-    const { error: profileError } = await supabaseAdmin
-        .from("profiles")
-        .upsert({ id: userId, email: data.email, display_name: data.displayName }, { onConflict: "id" });
+    const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+    const { error: profileError } = await supabaseAdmin.from("profiles").upsert({
+        id: userId,
+        email: data.email,
+        display_name: data.displayName,
+        ...(scope?.tenantId ? { tenant_id: scope.tenantId } : {}),
+    }, { onConflict: "id" });
     if (profileError)
         throw profileError;
     const { error: roleError } = await supabaseAdmin
@@ -623,9 +674,13 @@ export const createTestUser = createServerFn({ method: "POST" })
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
     }
     const userId = created.user.id;
-    const { error: profileError } = await supabaseAdmin
-        .from("profiles")
-        .upsert({ id: userId, email, display_name: data.displayName }, { onConflict: "id" });
+    const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+    const { error: profileError } = await supabaseAdmin.from("profiles").upsert({
+        id: userId,
+        email,
+        display_name: data.displayName,
+        ...(scope?.tenantId ? { tenant_id: scope.tenantId } : {}),
+    }, { onConflict: "id" });
     if (profileError)
         throw profileError;
     const { error: roleError } = await supabaseAdmin
@@ -635,3 +690,206 @@ export const createTestUser = createServerFn({ method: "POST" })
         throw roleError;
     return { ok: true, userId, email, password };
 });
+// ============================================================================
+// Bedrijfsprofielen: bundelen rollen + modules per organisatie (tenant)
+// ============================================================================
+const profileIdInput = z.object({ profileId: z.string().uuid() });
+const profileBodySchema = {
+    name: z.string().trim().min(1).max(120),
+    tenantId: z.string().uuid().nullable().optional(),
+    roleIds: z.array(z.string().uuid()).max(200).default([]),
+    moduleIds: z.array(z.string().trim().min(1).max(100)).max(200).default([]),
+};
+const createProfileInput = z.object(profileBodySchema);
+const updateProfileInput = z.object({ profileId: z.string().uuid(), ...profileBodySchema });
+async function writeProfileLinks(supabase, profileId, roleIds, moduleIds) {
+    const { error: delRoles } = await supabase.from("profile_roles").delete().eq("profile_id", profileId);
+    if (delRoles)
+        throw delRoles;
+    const { error: delModules } = await supabase.from("profile_modules").delete().eq("profile_id", profileId);
+    if (delModules)
+        throw delModules;
+    const uniqueRoles = Array.from(new Set(roleIds));
+    if (uniqueRoles.length > 0) {
+        const { error } = await supabase
+            .from("profile_roles")
+            .insert(uniqueRoles.map((roleId) => ({ profile_id: profileId, role_id: roleId })));
+        if (error)
+            throw error;
+    }
+    const uniqueModules = Array.from(new Set(moduleIds));
+    if (uniqueModules.length > 0) {
+        const { error } = await supabase
+            .from("profile_modules")
+            .insert(uniqueModules.map((moduleId) => ({ profile_id: profileId, module_id: moduleId })));
+        if (error)
+            throw error;
+    }
+}
+/** Alle bedrijfsprofielen met hun rollen, modules en tellingen. */
+export const getProfiles = createServerFn({ method: "GET" })
+    .middleware([requireSupabaseAuth])
+    .handler(async ({ context }) => {
+    await requireUserAdmin(context);
+    const [{ data: profilesOrg, error: profilesError }, { data: profileRoles, error: profileRolesError }, { data: profileModules, error: profileModulesError }, { data: tenants, error: tenantsError },] = await Promise.all([
+        context.supabase
+            .from("profiles_org")
+            .select("id, name, tenant_id, is_default")
+            .order("name", { ascending: true }),
+        context.supabase.from("profile_roles").select("profile_id, role_id"),
+        context.supabase.from("profile_modules").select("profile_id, module_id"),
+        context.supabase.from("tenants").select("id, name").order("name", { ascending: true }),
+    ]);
+    if (profilesError)
+        throw profilesError;
+    if (profileRolesError)
+        throw profileRolesError;
+    if (profileModulesError)
+        throw profileModulesError;
+    if (tenantsError)
+        throw tenantsError;
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const { data: userRows, error: userError } = await supabaseAdmin
+        .from("profiles")
+        .select("id, tenant_id");
+    if (userError)
+        throw userError;
+    const safeProfiles = Array.isArray(profilesOrg) ? profilesOrg : [];
+    const safeProfileRoles = Array.isArray(profileRoles) ? profileRoles : [];
+    const safeProfileModules = Array.isArray(profileModules) ? profileModules : [];
+    const safeTenants = Array.isArray(tenants) ? tenants : [];
+    const safeUsers = Array.isArray(userRows) ? userRows : [];
+    const usersByTenant = new Map();
+    for (const u of safeUsers) {
+        if (!u.tenant_id)
+            continue;
+        usersByTenant.set(u.tenant_id, (usersByTenant.get(u.tenant_id) ?? 0) + 1);
+    }
+    const tenantName = new Map(safeTenants.map((t) => [t.id, t.name]));
+    return {
+        profiles: safeProfiles.map((p) => ({
+            id: p.id,
+            name: p.name,
+            tenantId: (p.tenant_id ?? null),
+            tenantName: p.tenant_id ? tenantName.get(p.tenant_id) ?? null : null,
+            isDefault: Boolean(p.is_default),
+            roleIds: safeProfileRoles.filter((r) => r.profile_id === p.id).map((r) => r.role_id),
+            moduleIds: safeProfileModules
+                .filter((m) => m.profile_id === p.id)
+                .map((m) => m.module_id),
+            userCount: p.tenant_id ? usersByTenant.get(p.tenant_id) ?? 0 : 0,
+        })),
+        tenants: safeTenants.map((t) => ({ id: t.id, name: t.name })),
+    };
+});
+export const createProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => createProfileInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { data: created, error } = await context.supabase
+        .from("profiles_org")
+        .insert({ name: data.name, tenant_id: data.tenantId ?? null })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    await writeProfileLinks(context.supabase, created.id, data.roleIds, data.moduleIds);
+    return { ok: true, profileId: created.id };
+});
+export const updateProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => updateProfileInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { error } = await context.supabase
+        .from("profiles_org")
+        .update({ name: data.name, tenant_id: data.tenantId ?? null, updated_at: new Date().toISOString() })
+        .eq("id", data.profileId);
+    if (error)
+        throw error;
+    await writeProfileLinks(context.supabase, data.profileId, data.roleIds, data.moduleIds);
+    return { ok: true };
+});
+export const duplicateProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => profileIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { data: source, error: sourceError } = await context.supabase
+        .from("profiles_org")
+        .select("name, tenant_id")
+        .eq("id", data.profileId)
+        .maybeSingle();
+    if (sourceError)
+        throw sourceError;
+    if (!source)
+        throw new Error("Profiel bestaat niet.");
+    const [{ data: roleRows }, { data: moduleRows }] = await Promise.all([
+        context.supabase.from("profile_roles").select("role_id").eq("profile_id", data.profileId),
+        context.supabase.from("profile_modules").select("module_id").eq("profile_id", data.profileId),
+    ]);
+    const { data: created, error } = await context.supabase
+        .from("profiles_org")
+        .insert({ name: `${source.name} (kopie)`, tenant_id: source.tenant_id })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    await writeProfileLinks(context.supabase, created.id, (Array.isArray(roleRows) ? roleRows : []).map((r) => r.role_id), (Array.isArray(moduleRows) ? moduleRows : []).map((m) => m.module_id));
+    return { ok: true, profileId: created.id };
+});
+export const deleteProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => profileIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { data: profile, error: profileError } = await context.supabase
+        .from("profiles_org")
+        .select("id, tenant_id, is_default")
+        .eq("id", data.profileId)
+        .maybeSingle();
+    if (profileError)
+        throw profileError;
+    if (!profile)
+        throw new Error("Profiel bestaat niet.");
+    if (profile.is_default)
+        throw new Error("Het actieve profiel kan niet verwijderd worden.");
+    if (profile.tenant_id) {
+        const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+        const { count, error: countError } = await supabaseAdmin
+            .from("profiles")
+            .select("id", { count: "exact", head: true })
+            .eq("tenant_id", profile.tenant_id);
+        if (countError)
+            throw countError;
+        if ((count ?? 0) > 0) {
+            throw new Error("Er zijn nog gebruikers aan dit bedrijf gekoppeld.");
+        }
+    }
+    const { error } = await context.supabase.from("profiles_org").delete().eq("id", data.profileId);
+    if (error)
+        throw error;
+    return { ok: true };
+});
+/** Zet precies één profiel als actief (is_default). */
+export const setActiveProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => profileIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { error: clearError } = await context.supabase
+        .from("profiles_org")
+        .update({ is_default: false })
+        .eq("is_default", true)
+        .neq("id", data.profileId);
+    if (clearError)
+        throw clearError;
+    const { error } = await context.supabase
+        .from("profiles_org")
+        .update({ is_default: true, updated_at: new Date().toISOString() })
+        .eq("id", data.profileId);
+    if (error)
+        throw error;
+    return { ok: true };
+});

package/dist-lib/lib/permission-types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Losse types voor de check-laag (lezen/afdwingen van moduletoegang).
+ * Bewust zonder imports uit de rest van deze module, zodat de check-laag
+ * later 1-op-1 naar @flowselections/core kan verhuizen.
+ */
+export type ModulePermission = "none" | "view" | "edit";
+//# sourceMappingURL=permission-types.d.ts.map

package/dist-lib/lib/permission-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-types.d.ts","sourceRoot":"","sources":["../../src/lib/permission-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC"}

package/dist-lib/lib/permission-types.js

@@ -0,0 +1 @@
+export {};

package/dist-lib/lib/permissions.server.d.ts

@@ -1,4 +1,4 @@
-import type { ModulePermission } from "../hooks/useModulePermission";
+import type { ModulePermission } from "../lib/permission-types";
 interface PermissionContext {
     supabase: any;
     userId: string;

package/dist-lib/lib/permissions.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.server.d.ts","sourceRoot":"","sources":["../../src/lib/permissions.server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,UAAU,iBAAiB;IACzB,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAK,EACd,KAAK,GAAE,MAAM,GAAG,MAAe,6BA0BhC"}
+{"version":3,"file":"permissions.server.d.ts","sourceRoot":"","sources":["../../src/lib/permissions.server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,UAAU,iBAAiB;IACzB,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAK,EACd,KAAK,GAAE,MAAM,GAAG,MAAe,6BA0BhC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/admin-installatietechniek",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "flowselections": {
     "moduleId": "admin-installatietechniek",
     "pages": [
@@ -55,7 +55,7 @@
   "devDependencies": {
     "@cloudflare/vite-plugin": "^1.25.5",
     "@eslint/js": "^9.32.0",
-    "@flowselections/core": "1.0.16",
+    "@flowselections/core": "1.0.18",
     "@lovable.dev/vite-tanstack-config": "2.13.1",
     "@rsbuild/core": "^1.0.0",
     "@tailwindcss/vite": "^4.2.1",