@flowselections/admin-installatietechniek 1.0.5 → 1.0.7

package/dist-lib/lib/admin.functions.js

@@ -31,6 +31,7 @@ const roleIdInput = z.object({ roleId: z.string().uuid() });
 const assignRoleInput = z.object({
     userId: z.string().uuid(),
     roleId: z.string().uuid(),
+    profileId: z.string().uuid().optional(),
 });
 const rolePermissionsSchema = z
     .array(z.object({
@@ -53,6 +54,7 @@ const inviteUserInput = z.object({
     email: z.string().trim().email().max(255),
     displayName: z.string().trim().min(1).max(100),
     roleId: z.string().uuid(),
+    profileId: z.string().uuid().optional(),
 });
 const deleteUserInput = z.object({
     userId: z.string().uuid(),
@@ -65,6 +67,7 @@ const createTestUserInput = z.object({
     displayName: z.string().trim().min(1).max(100),
     roleId: z.string().uuid(),
     email: z.string().trim().email().max(255).optional(),
+    profileId: z.string().uuid().optional(),
 });
 function slugify(value) {
     return (value
@@ -94,13 +97,93 @@ async function assertMayUseRole(supabase, roleId, isAdmin) {
     }
     return role;
 }
-export const getUsersWithRoles = createServerFn({ method: "GET" })
+const profileScopeInput = z
+    .object({ profileId: z.string().uuid().optional() })
+    .optional();
+/**
+ * Tenant + rol-/module-scope van een bedrijfsprofiel.
+ * Zonder `profileId` is er geen scope (= overzicht: alles zichtbaar).
+ */
+async function loadProfileScope(supabase, profileId) {
+    if (!profileId)
+        return null;
+    const { data, error } = await supabase
+        .from("profiles_org")
+        .select("id, name, tenant_id, is_default")
+        .eq("id", profileId)
+        .maybeSingle();
+    if (error)
+        throw error;
+    if (!data)
+        return null;
+    const [{ data: roleRows }, { data: moduleRows }] = await Promise.all([
+        supabase.from("profile_roles").select("role_id").eq("profile_id", data.id),
+        supabase.from("profile_modules").select("module_id").eq("profile_id", data.id),
+    ]);
+    return {
+        id: data.id,
+        name: data.name,
+        tenantId: (data.tenant_id ?? null),
+        roleIds: (Array.isArray(roleRows) ? roleRows : []).map((r) => r.role_id),
+        moduleIds: (Array.isArray(moduleRows) ? moduleRows : []).map((m) => m.module_id),
+    };
+}
+/**
+ * Bepaalt op welk bedrijfsprofiel deze aanvraag draait.
+ * - Admin: vrije keuze (leeg = overzicht met alles).
+ * - Niet-admin (administratie): altijd vastgezet op het eigen profiel,
+ *   afgeleid uit de tenant van de gebruiker of anders uit de profielen
+ *   waaraan een van zijn rollen gekoppeld is.
+ */
+async function resolveEffectiveProfileId(admin, userId, requestedProfileId, isAdmin) {
+    if (isAdmin)
+        return { profileId: requestedProfileId, locked: false };
+    const { data: me } = await admin
+        .from("profiles")
+        .select("tenant_id")
+        .eq("id", userId)
+        .maybeSingle();
+    if (me?.tenant_id) {
+        const { data: byTenant } = await admin
+            .from("profiles_org")
+            .select("id")
+            .eq("tenant_id", me.tenant_id)
+            .limit(1);
+        const first = Array.isArray(byTenant) ? byTenant[0] : null;
+        if (first?.id)
+            return { profileId: first.id, locked: true };
+    }
+    const { data: myRoles } = await admin
+        .from("role_assignments")
+        .select("role_id")
+        .eq("user_id", userId);
+    const roleIds = (Array.isArray(myRoles) ? myRoles : []).map((r) => r.role_id);
+    if (roleIds.length > 0) {
+        const { data: links } = await admin
+            .from("profile_roles")
+            .select("profile_id")
+            .in("role_id", roleIds)
+            .limit(1);
+        const link = Array.isArray(links) ? links[0] : null;
+        if (link?.profile_id)
+            return { profileId: link.profile_id, locked: true };
+    }
+    return { profileId: undefined, locked: true };
+}
+export const getUsersWithRoles = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
-    .handler(async ({ context }) => {
+    .inputValidator((data) => profileScopeInput.parse(data))
+    .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, data?.profileId, isAdmin);
+    const scope = await loadProfileScope(supabaseAdmin, effective.profileId);
+    const profilesQuery = supabaseAdmin
+        .from("profiles")
+        .select("id, email, display_name, tenant_id")
+        .order("email", { ascending: true });
     const [{ data: profiles, error: profilesError }, { data: assignments, error: assignmentsError }, { data: roles, error: rolesError }, { data: authList, error: authError },] = await Promise.all([
-        supabaseAdmin.from("profiles").select("id, email, display_name").order("email", { ascending: true }),
+        profilesQuery,
         supabaseAdmin.from("role_assignments").select("user_id, role_id"),
         supabaseAdmin.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
         supabaseAdmin.auth.admin.listUsers({ page: 1, perPage: 1000 }),
@@ -115,9 +198,12 @@ export const getUsersWithRoles = createServerFn({ method: "GET" })
         throw authError;
     const safeProfiles = Array.isArray(profiles) ? profiles : [];
     const safeAssignments = Array.isArray(assignments) ? assignments : [];
-    const safeRoles = Array.isArray(roles) ? roles : [];
+    const allRoles = Array.isArray(roles) ? roles : [];
+    const safeRoles = scope && scope.roleIds.length > 0
+        ? allRoles.filter((r) => scope.roleIds.includes(r.id))
+        : allRoles;
     const safeAuthUsers = Array.isArray(authList?.users) ? authList.users : [];
-    const roleById = new Map(safeRoles.map((r) => [r.id, r]));
+    const roleById = new Map(allRoles.map((r) => [r.id, r]));
     const confirmedById = new Map();
     const isTestById = new Map();
     for (const u of safeAuthUsers) {
@@ -136,19 +222,52 @@ export const getUsersWithRoles = createServerFn({ method: "GET" })
         }
         rolesByUser.set(a.user_id, list);
     }
+    // Binnen een profiel horen gebruikers erbij via de tenant OF via een rol
+    // die aan het profiel gekoppeld is. Zonder profiel: iedereen.
+    const scopedRoleIds = new Set(scope?.roleIds ?? []);
+    const usersViaRole = new Set();
+    if (scope && scopedRoleIds.size > 0) {
+        for (const a of safeAssignments) {
+            if (scopedRoleIds.has(a.role_id))
+                usersViaRole.add(a.user_id);
+        }
+    }
+    // Vastgezette gebruiker zonder gekoppeld profiel: niets tonen.
+    const noProfileLock = effective.locked && !scope;
+    const scopedProfiles = noProfileLock
+        ? []
+        : !scope
+            ? safeProfiles
+            : safeProfiles.filter((p) => {
+                const viaTenant = Boolean(scope.tenantId) && p.tenant_id === scope.tenantId;
+                return viaTenant || usersViaRole.has(p.id);
+            });
     return {
-        users: safeProfiles.map((profile) => ({
-            id: profile.id,
-            email: profile.email ?? "-",
-            displayName: profile.display_name ?? "-",
-            roles: rolesByUser.get(profile.id) ?? [],
-            emailConfirmed: confirmedById.get(profile.id) ?? false,
-            isTestAccount: isTestById.get(profile.id) ?? false,
-        })),
-        availableRoles: safeRoles
+        users: scopedProfiles.map((profile) => {
+            const viaTenant = Boolean(scope?.tenantId) && profile.tenant_id === scope?.tenantId;
+            const viaRole = usersViaRole.has(profile.id);
+            return {
+                id: profile.id,
+                email: profile.email ?? "-",
+                displayName: profile.display_name ?? "-",
+                roles: rolesByUser.get(profile.id) ?? [],
+                emailConfirmed: confirmedById.get(profile.id) ?? false,
+                isTestAccount: isTestById.get(profile.id) ?? false,
+                matchedVia: !scope
+                    ? null
+                    : viaTenant && viaRole
+                        ? "both"
+                        : viaTenant
+                            ? "tenant"
+                            : "role",
+            };
+        }),
+        availableRoles: (noProfileLock ? [] : safeRoles)
             .filter((r) => isAdmin || r.key !== "admin")
             .map((r) => ({ id: r.id, key: r.key, name: r.name, isProtected: r.is_protected })),
         isAdmin,
+        profileLocked: effective.locked,
+        activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
 export const assignRole = createServerFn({ method: "POST" })
@@ -172,6 +291,19 @@ export const assignRole = createServerFn({ method: "POST" })
         .insert({ user_id: data.userId, role_id: data.roleId });
     if (error)
         throw error;
+    // Binnen een actief bedrijfsprofiel: koppel de gebruiker aan de tenant van
+    // dat profiel als die nog leeg is, zodat de koppeling vanzelf dichtgroeit.
+    if (data.profileId) {
+        const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+        const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+        if (scope?.tenantId) {
+            await supabaseAdmin
+                .from("profiles")
+                .update({ tenant_id: scope.tenantId })
+                .eq("id", data.userId)
+                .is("tenant_id", null);
+        }
+    }
     return { ok: true };
 });
 export const removeRole = createServerFn({ method: "POST" })
@@ -193,10 +325,14 @@ export const removeRole = createServerFn({ method: "POST" })
     return { ok: true };
 });
 /** Alle rollen met hun rechten, plus de geregistreerde modules en onderdelen. */
-export const getRoles = createServerFn({ method: "GET" })
+export const getRoles = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
-    .handler(async ({ context }) => {
-    await requireUserAdmin(context);
+    .inputValidator((data) => profileScopeInput.parse(data))
+    .handler(async ({ context, data }) => {
+    const { isAdmin } = await requireUserAdmin(context);
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, data?.profileId, isAdmin);
+    const scope = await loadProfileScope(supabaseAdmin, effective.profileId);
     const [{ data: roles, error: rolesError }, { data: perms, error: permsError }, { data: registry, error: registryError }, { data: featureRows, error: featuresError },] = await Promise.all([
         context.supabase.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
         context.supabase.from("role_permissions").select("role_id, module_id, feature_id, can_view, can_edit"),
@@ -211,9 +347,16 @@ export const getRoles = createServerFn({ method: "GET" })
         throw registryError;
     if (featuresError)
         throw featuresError;
-    const safeRoles = Array.isArray(roles) ? roles : [];
+    const noProfileLock = effective.locked && !scope;
+    const allRoles = noProfileLock ? [] : Array.isArray(roles) ? roles : [];
+    const safeRoles = scope && scope.roleIds.length > 0
+        ? allRoles.filter((r) => scope.roleIds.includes(r.id))
+        : allRoles;
     const safePerms = Array.isArray(perms) ? perms : [];
-    const safeRegistry = Array.isArray(registry) ? registry : [];
+    const allRegistry = noProfileLock ? [] : Array.isArray(registry) ? registry : [];
+    const safeRegistry = scope && scope.moduleIds.length > 0
+        ? allRegistry.filter((m) => scope.moduleIds.includes(m.module_id))
+        : allRegistry;
     const safeFeatures = Array.isArray(featureRows) ? featureRows : [];
     return {
         roles: safeRoles.map((r) => ({
@@ -239,6 +382,8 @@ export const getRoles = createServerFn({ method: "GET" })
             canView: Boolean(p.can_view),
             canEdit: Boolean(p.can_edit),
         })),
+        profileLocked: effective.locked,
+        activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
 async function writeRolePermissions(supabase, roleId, permissions) {
@@ -368,12 +513,22 @@ export const syncModuleRegistry = createServerFn({ method: "POST" })
     if (modules.length === 0)
         return { ok: true, count: 0 };
     const now = new Date().toISOString();
+    const { data: existingRows, error: existingError } = await context.supabase
+        .from("module_registry")
+        .select("module_id")
+        .in("module_id", modules.map((m) => m.id));
+    if (existingError)
+        throw existingError;
+    const knownIds = new Set((Array.isArray(existingRows) ? existingRows : []).map((r) => r.module_id));
     const { error } = await context.supabase.from("module_registry").upsert(modules.map((m) => ({
         module_id: m.id,
         name: m.name,
         shell_id: data.shellId ?? null,
         is_active: true,
         last_seen_at: now,
+        // Nieuwe modules komen standaard met afdwingen aan binnen; bestaande
+        // modules behouden hun eigen instelling.
+        ...(knownIds.has(m.id) ? {} : { enforce: true }),
     })), { onConflict: "module_id" });
     if (error)
         throw error;
@@ -525,9 +680,13 @@ export const inviteUser = createServerFn({ method: "POST" })
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
     }
     const userId = invited.user.id;
-    const { error: profileError } = await supabaseAdmin
-        .from("profiles")
-        .upsert({ id: userId, email: data.email, display_name: data.displayName }, { onConflict: "id" });
+    const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+    const { error: profileError } = await supabaseAdmin.from("profiles").upsert({
+        id: userId,
+        email: data.email,
+        display_name: data.displayName,
+        ...(scope?.tenantId ? { tenant_id: scope.tenantId } : {}),
+    }, { onConflict: "id" });
     if (profileError)
         throw profileError;
     const { error: roleError } = await supabaseAdmin
@@ -623,9 +782,13 @@ export const createTestUser = createServerFn({ method: "POST" })
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
     }
     const userId = created.user.id;
-    const { error: profileError } = await supabaseAdmin
-        .from("profiles")
-        .upsert({ id: userId, email, display_name: data.displayName }, { onConflict: "id" });
+    const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+    const { error: profileError } = await supabaseAdmin.from("profiles").upsert({
+        id: userId,
+        email,
+        display_name: data.displayName,
+        ...(scope?.tenantId ? { tenant_id: scope.tenantId } : {}),
+    }, { onConflict: "id" });
     if (profileError)
         throw profileError;
     const { error: roleError } = await supabaseAdmin
@@ -635,3 +798,261 @@ export const createTestUser = createServerFn({ method: "POST" })
         throw roleError;
     return { ok: true, userId, email, password };
 });
+// ============================================================================
+// Bedrijfsprofielen: bundelen rollen + modules per organisatie (tenant)
+// ============================================================================
+const profileIdInput = z.object({ profileId: z.string().uuid() });
+const profileBodySchema = {
+    name: z.string().trim().min(1).max(120),
+    tenantId: z.string().uuid().nullable().optional(),
+    /** Naam van het bedrijf; maakt een nieuw bedrijf aan of hernoemt het gekozen bedrijf. */
+    tenantName: z.string().trim().max(120).optional(),
+    roleIds: z.array(z.string().uuid()).max(200).default([]),
+    moduleIds: z.array(z.string().trim().min(1).max(100)).max(200).default([]),
+};
+const createProfileInput = z.object(profileBodySchema);
+const updateProfileInput = z.object({ profileId: z.string().uuid(), ...profileBodySchema });
+/**
+ * Bepaalt het tenant-id voor een profiel:
+ * - bestaand bedrijf + gewijzigde naam -> hernoemen
+ * - geen bedrijf + naam -> nieuw bedrijf aanmaken
+ */
+async function resolveTenant(supabase, tenantId, tenantName) {
+    const name = (tenantName ?? "").trim();
+    if (tenantId) {
+        if (name) {
+            const { data: current, error: readError } = await supabase
+                .from("tenants")
+                .select("name")
+                .eq("id", tenantId)
+                .maybeSingle();
+            if (readError)
+                throw readError;
+            if (current && current.name !== name) {
+                const { error } = await supabase
+                    .from("tenants")
+                    .update({ name, updated_at: new Date().toISOString() })
+                    .eq("id", tenantId);
+                if (error)
+                    throw error;
+            }
+        }
+        return tenantId;
+    }
+    if (!name)
+        return null;
+    const { data: created, error } = await supabase
+        .from("tenants")
+        .insert({ name })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    return created.id;
+}
+async function writeProfileLinks(supabase, profileId, roleIds, moduleIds) {
+    const { error: delRoles } = await supabase.from("profile_roles").delete().eq("profile_id", profileId);
+    if (delRoles)
+        throw delRoles;
+    const { error: delModules } = await supabase.from("profile_modules").delete().eq("profile_id", profileId);
+    if (delModules)
+        throw delModules;
+    const uniqueRoles = Array.from(new Set(roleIds));
+    if (uniqueRoles.length > 0) {
+        const { error } = await supabase
+            .from("profile_roles")
+            .insert(uniqueRoles.map((roleId) => ({ profile_id: profileId, role_id: roleId })));
+        if (error)
+            throw error;
+    }
+    const uniqueModules = Array.from(new Set(moduleIds));
+    if (uniqueModules.length > 0) {
+        const { error } = await supabase
+            .from("profile_modules")
+            .insert(uniqueModules.map((moduleId) => ({ profile_id: profileId, module_id: moduleId })));
+        if (error)
+            throw error;
+    }
+}
+/** Alle bedrijfsprofielen met hun rollen, modules en tellingen. */
+export const getProfiles = createServerFn({ method: "GET" })
+    .middleware([requireSupabaseAuth])
+    .handler(async ({ context }) => {
+    const { isAdmin } = await requireUserAdmin(context);
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, undefined, isAdmin);
+    const [{ data: profilesOrg, error: profilesError }, { data: profileRoles, error: profileRolesError }, { data: profileModules, error: profileModulesError }, { data: tenants, error: tenantsError },] = await Promise.all([
+        context.supabase
+            .from("profiles_org")
+            .select("id, name, tenant_id, is_default")
+            .order("name", { ascending: true }),
+        context.supabase.from("profile_roles").select("profile_id, role_id"),
+        context.supabase.from("profile_modules").select("profile_id, module_id"),
+        // `tenants` is via RLS beperkt tot de eigen tenant; namen tonen mag hier
+        // omdat de aanvrager al is geverifieerd als admin/administratie.
+        supabaseAdmin.from("tenants").select("id, name").order("name", { ascending: true }),
+    ]);
+    if (profilesError)
+        throw profilesError;
+    if (profileRolesError)
+        throw profileRolesError;
+    if (profileModulesError)
+        throw profileModulesError;
+    if (tenantsError)
+        throw tenantsError;
+    const { data: userRows, error: userError } = await supabaseAdmin
+        .from("profiles")
+        .select("id, tenant_id");
+    if (userError)
+        throw userError;
+    const allProfilesOrg = Array.isArray(profilesOrg) ? profilesOrg : [];
+    // Niet-admin: alleen het eigen (vastgezette) profiel.
+    const safeProfiles = effective.locked
+        ? allProfilesOrg.filter((p) => p.id === effective.profileId)
+        : allProfilesOrg;
+    const safeProfileRoles = Array.isArray(profileRoles) ? profileRoles : [];
+    const safeProfileModules = Array.isArray(profileModules) ? profileModules : [];
+    const safeTenants = Array.isArray(tenants) ? tenants : [];
+    const safeUsers = Array.isArray(userRows) ? userRows : [];
+    const usersByTenant = new Map();
+    for (const u of safeUsers) {
+        if (!u.tenant_id)
+            continue;
+        usersByTenant.set(u.tenant_id, (usersByTenant.get(u.tenant_id) ?? 0) + 1);
+    }
+    const tenantName = new Map(safeTenants.map((t) => [t.id, t.name]));
+    return {
+        profiles: safeProfiles.map((p) => ({
+            id: p.id,
+            name: p.name,
+            tenantId: (p.tenant_id ?? null),
+            tenantName: p.tenant_id ? tenantName.get(p.tenant_id) ?? null : null,
+            isDefault: Boolean(p.is_default),
+            roleIds: safeProfileRoles.filter((r) => r.profile_id === p.id).map((r) => r.role_id),
+            moduleIds: safeProfileModules
+                .filter((m) => m.profile_id === p.id)
+                .map((m) => m.module_id),
+            userCount: p.tenant_id ? usersByTenant.get(p.tenant_id) ?? 0 : 0,
+        })),
+        tenants: safeTenants.map((t) => ({ id: t.id, name: t.name })),
+        profileLocked: effective.locked,
+        lockedProfileId: effective.locked ? effective.profileId ?? null : null,
+    };
+});
+export const createProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => createProfileInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    // `tenants` heeft geen insert-policy voor admins; na de adminguard mag dit
+    // veilig via de serverclient.
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const tenantId = await resolveTenant(supabaseAdmin, data.tenantId, data.tenantName);
+    const { data: created, error } = await context.supabase
+        .from("profiles_org")
+        .insert({ name: data.name, tenant_id: tenantId })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    await writeProfileLinks(context.supabase, created.id, data.roleIds, data.moduleIds);
+    return { ok: true, profileId: created.id };
+});
+export const updateProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => updateProfileInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const tenantId = await resolveTenant(supabaseAdmin, data.tenantId, data.tenantName);
+    const { error } = await context.supabase
+        .from("profiles_org")
+        .update({ name: data.name, tenant_id: tenantId, updated_at: new Date().toISOString() })
+        .eq("id", data.profileId);
+    if (error)
+        throw error;
+    await writeProfileLinks(context.supabase, data.profileId, data.roleIds, data.moduleIds);
+    return { ok: true };
+});
+export const duplicateProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => profileIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { data: source, error: sourceError } = await context.supabase
+        .from("profiles_org")
+        .select("name, tenant_id")
+        .eq("id", data.profileId)
+        .maybeSingle();
+    if (sourceError)
+        throw sourceError;
+    if (!source)
+        throw new Error("Profiel bestaat niet.");
+    const [{ data: roleRows }, { data: moduleRows }] = await Promise.all([
+        context.supabase.from("profile_roles").select("role_id").eq("profile_id", data.profileId),
+        context.supabase.from("profile_modules").select("module_id").eq("profile_id", data.profileId),
+    ]);
+    const { data: created, error } = await context.supabase
+        .from("profiles_org")
+        .insert({ name: `${source.name} (kopie)`, tenant_id: source.tenant_id })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    await writeProfileLinks(context.supabase, created.id, (Array.isArray(roleRows) ? roleRows : []).map((r) => r.role_id), (Array.isArray(moduleRows) ? moduleRows : []).map((m) => m.module_id));
+    return { ok: true, profileId: created.id };
+});
+export const deleteProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => profileIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { data: profile, error: profileError } = await context.supabase
+        .from("profiles_org")
+        .select("id, tenant_id, is_default")
+        .eq("id", data.profileId)
+        .maybeSingle();
+    if (profileError)
+        throw profileError;
+    if (!profile)
+        throw new Error("Profiel bestaat niet.");
+    if (profile.is_default)
+        throw new Error("Het actieve profiel kan niet verwijderd worden.");
+    if (profile.tenant_id) {
+        const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+        const { count, error: countError } = await supabaseAdmin
+            .from("profiles")
+            .select("id", { count: "exact", head: true })
+            .eq("tenant_id", profile.tenant_id);
+        if (countError)
+            throw countError;
+        if ((count ?? 0) > 0) {
+            throw new Error("Er zijn nog gebruikers aan dit bedrijf gekoppeld.");
+        }
+    }
+    const { error } = await context.supabase.from("profiles_org").delete().eq("id", data.profileId);
+    if (error)
+        throw error;
+    return { ok: true };
+});
+/** Zet precies één profiel als actief (is_default). */
+export const setActiveProfile = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((data) => profileIdInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireAdmin(context);
+    const { error: clearError } = await context.supabase
+        .from("profiles_org")
+        .update({ is_default: false })
+        .eq("is_default", true)
+        .neq("id", data.profileId);
+    if (clearError)
+        throw clearError;
+    const { error } = await context.supabase
+        .from("profiles_org")
+        .update({ is_default: true, updated_at: new Date().toISOString() })
+        .eq("id", data.profileId);
+    if (error)
+        throw error;
+    return { ok: true };
+});

package/dist-lib/lib/permission-types.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Losse types voor de check-laag (lezen/afdwingen van moduletoegang).
+ * Bewust zonder imports uit de rest van deze module, zodat de check-laag
+ * later 1-op-1 naar @flowselections/core kan verhuizen.
+ */
+export type ModulePermission = "none" | "view" | "edit";
+//# sourceMappingURL=permission-types.d.ts.map

package/dist-lib/lib/permission-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-types.d.ts","sourceRoot":"","sources":["../../src/lib/permission-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC"}

package/dist-lib/lib/permission-types.js

@@ -0,0 +1 @@
+export {};

package/dist-lib/lib/permissions.server.d.ts

@@ -1,4 +1,4 @@
-import type { ModulePermission } from "../hooks/useModulePermission";
+import type { ModulePermission } from "../lib/permission-types";
 interface PermissionContext {
     supabase: any;
     userId: string;

package/dist-lib/lib/permissions.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.server.d.ts","sourceRoot":"","sources":["../../src/lib/permissions.server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,UAAU,iBAAiB;IACzB,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAK,EACd,KAAK,GAAE,MAAM,GAAG,MAAe,6BA0BhC"}
+{"version":3,"file":"permissions.server.d.ts","sourceRoot":"","sources":["../../src/lib/permissions.server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,UAAU,iBAAiB;IACzB,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAK,EACd,KAAK,GAAE,MAAM,GAAG,MAAe,6BA0BhC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/admin-installatietechniek",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "flowselections": {
     "moduleId": "admin-installatietechniek",
     "pages": [
@@ -40,7 +40,7 @@
     "lint": "eslint ."
   },
   "peerDependencies": {
-    "@flowselections/core": "*",
+    "@flowselections/core": ">=1.0.18",
     "@tanstack/react-query": "^5.0.0",
     "@tanstack/react-router": "^1.0.0",
     "@tanstack/react-start": "^1.0.0",
@@ -55,7 +55,7 @@
   "devDependencies": {
     "@cloudflare/vite-plugin": "^1.25.5",
     "@eslint/js": "^9.32.0",
-    "@flowselections/core": "1.0.16",
+    "@flowselections/core": "1.0.18",
     "@lovable.dev/vite-tanstack-config": "2.13.1",
     "@rsbuild/core": "^1.0.0",
     "@tailwindcss/vite": "^4.2.1",