@flowselections/admin-installatietechniek 1.0.6 → 1.0.7

package/dist-lib/lib/admin.functions.js

@@ -31,6 +31,7 @@ const roleIdInput = z.object({ roleId: z.string().uuid() });
 const assignRoleInput = z.object({
     userId: z.string().uuid(),
     roleId: z.string().uuid(),
+    profileId: z.string().uuid().optional(),
 });
 const rolePermissionsSchema = z
     .array(z.object({
@@ -99,11 +100,18 @@ async function assertMayUseRole(supabase, roleId, isAdmin) {
 const profileScopeInput = z
     .object({ profileId: z.string().uuid().optional() })
     .optional();
-/** Tenant + rol-/module-scope van een bedrijfsprofiel (of het actieve profiel). */
+/**
+ * Tenant + rol-/module-scope van een bedrijfsprofiel.
+ * Zonder `profileId` is er geen scope (= overzicht: alles zichtbaar).
+ */
 async function loadProfileScope(supabase, profileId) {
-    let query = supabase.from("profiles_org").select("id, name, tenant_id, is_default");
-    query = profileId ? query.eq("id", profileId) : query.eq("is_default", true);
-    const { data, error } = await query.maybeSingle();
+    if (!profileId)
+        return null;
+    const { data, error } = await supabase
+        .from("profiles_org")
+        .select("id, name, tenant_id, is_default")
+        .eq("id", profileId)
+        .maybeSingle();
     if (error)
         throw error;
     if (!data)
@@ -120,19 +128,60 @@ async function loadProfileScope(supabase, profileId) {
         moduleIds: (Array.isArray(moduleRows) ? moduleRows : []).map((m) => m.module_id),
     };
 }
+/**
+ * Bepaalt op welk bedrijfsprofiel deze aanvraag draait.
+ * - Admin: vrije keuze (leeg = overzicht met alles).
+ * - Niet-admin (administratie): altijd vastgezet op het eigen profiel,
+ *   afgeleid uit de tenant van de gebruiker of anders uit de profielen
+ *   waaraan een van zijn rollen gekoppeld is.
+ */
+async function resolveEffectiveProfileId(admin, userId, requestedProfileId, isAdmin) {
+    if (isAdmin)
+        return { profileId: requestedProfileId, locked: false };
+    const { data: me } = await admin
+        .from("profiles")
+        .select("tenant_id")
+        .eq("id", userId)
+        .maybeSingle();
+    if (me?.tenant_id) {
+        const { data: byTenant } = await admin
+            .from("profiles_org")
+            .select("id")
+            .eq("tenant_id", me.tenant_id)
+            .limit(1);
+        const first = Array.isArray(byTenant) ? byTenant[0] : null;
+        if (first?.id)
+            return { profileId: first.id, locked: true };
+    }
+    const { data: myRoles } = await admin
+        .from("role_assignments")
+        .select("role_id")
+        .eq("user_id", userId);
+    const roleIds = (Array.isArray(myRoles) ? myRoles : []).map((r) => r.role_id);
+    if (roleIds.length > 0) {
+        const { data: links } = await admin
+            .from("profile_roles")
+            .select("profile_id")
+            .in("role_id", roleIds)
+            .limit(1);
+        const link = Array.isArray(links) ? links[0] : null;
+        if (link?.profile_id)
+            return { profileId: link.profile_id, locked: true };
+    }
+    return { profileId: undefined, locked: true };
+}
 export const getUsersWithRoles = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
     .inputValidator((data) => profileScopeInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const scope = await loadProfileScope(supabaseAdmin, data?.profileId);
-    let profilesQuery = supabaseAdmin
+    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, data?.profileId, isAdmin);
+    const scope = await loadProfileScope(supabaseAdmin, effective.profileId);
+    const profilesQuery = supabaseAdmin
         .from("profiles")
         .select("id, email, display_name, tenant_id")
         .order("email", { ascending: true });
-    if (scope?.tenantId)
-        profilesQuery = profilesQuery.eq("tenant_id", scope.tenantId);
     const [{ data: profiles, error: profilesError }, { data: assignments, error: assignmentsError }, { data: roles, error: rolesError }, { data: authList, error: authError },] = await Promise.all([
         profilesQuery,
         supabaseAdmin.from("role_assignments").select("user_id, role_id"),
@@ -173,19 +222,51 @@ export const getUsersWithRoles = createServerFn({ method: "POST" })
         }
         rolesByUser.set(a.user_id, list);
     }
+    // Binnen een profiel horen gebruikers erbij via de tenant OF via een rol
+    // die aan het profiel gekoppeld is. Zonder profiel: iedereen.
+    const scopedRoleIds = new Set(scope?.roleIds ?? []);
+    const usersViaRole = new Set();
+    if (scope && scopedRoleIds.size > 0) {
+        for (const a of safeAssignments) {
+            if (scopedRoleIds.has(a.role_id))
+                usersViaRole.add(a.user_id);
+        }
+    }
+    // Vastgezette gebruiker zonder gekoppeld profiel: niets tonen.
+    const noProfileLock = effective.locked && !scope;
+    const scopedProfiles = noProfileLock
+        ? []
+        : !scope
+            ? safeProfiles
+            : safeProfiles.filter((p) => {
+                const viaTenant = Boolean(scope.tenantId) && p.tenant_id === scope.tenantId;
+                return viaTenant || usersViaRole.has(p.id);
+            });
     return {
-        users: safeProfiles.map((profile) => ({
-            id: profile.id,
-            email: profile.email ?? "-",
-            displayName: profile.display_name ?? "-",
-            roles: rolesByUser.get(profile.id) ?? [],
-            emailConfirmed: confirmedById.get(profile.id) ?? false,
-            isTestAccount: isTestById.get(profile.id) ?? false,
-        })),
-        availableRoles: safeRoles
+        users: scopedProfiles.map((profile) => {
+            const viaTenant = Boolean(scope?.tenantId) && profile.tenant_id === scope?.tenantId;
+            const viaRole = usersViaRole.has(profile.id);
+            return {
+                id: profile.id,
+                email: profile.email ?? "-",
+                displayName: profile.display_name ?? "-",
+                roles: rolesByUser.get(profile.id) ?? [],
+                emailConfirmed: confirmedById.get(profile.id) ?? false,
+                isTestAccount: isTestById.get(profile.id) ?? false,
+                matchedVia: !scope
+                    ? null
+                    : viaTenant && viaRole
+                        ? "both"
+                        : viaTenant
+                            ? "tenant"
+                            : "role",
+            };
+        }),
+        availableRoles: (noProfileLock ? [] : safeRoles)
             .filter((r) => isAdmin || r.key !== "admin")
             .map((r) => ({ id: r.id, key: r.key, name: r.name, isProtected: r.is_protected })),
         isAdmin,
+        profileLocked: effective.locked,
         activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
@@ -210,6 +291,19 @@ export const assignRole = createServerFn({ method: "POST" })
         .insert({ user_id: data.userId, role_id: data.roleId });
     if (error)
         throw error;
+    // Binnen een actief bedrijfsprofiel: koppel de gebruiker aan de tenant van
+    // dat profiel als die nog leeg is, zodat de koppeling vanzelf dichtgroeit.
+    if (data.profileId) {
+        const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+        const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+        if (scope?.tenantId) {
+            await supabaseAdmin
+                .from("profiles")
+                .update({ tenant_id: scope.tenantId })
+                .eq("id", data.userId)
+                .is("tenant_id", null);
+        }
+    }
     return { ok: true };
 });
 export const removeRole = createServerFn({ method: "POST" })
@@ -235,8 +329,10 @@ export const getRoles = createServerFn({ method: "POST" })
     .middleware([requireSupabaseAuth])
     .inputValidator((data) => profileScopeInput.parse(data))
     .handler(async ({ context, data }) => {
-    await requireUserAdmin(context);
-    const scope = await loadProfileScope(context.supabase, data?.profileId);
+    const { isAdmin } = await requireUserAdmin(context);
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, data?.profileId, isAdmin);
+    const scope = await loadProfileScope(supabaseAdmin, effective.profileId);
     const [{ data: roles, error: rolesError }, { data: perms, error: permsError }, { data: registry, error: registryError }, { data: featureRows, error: featuresError },] = await Promise.all([
         context.supabase.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
         context.supabase.from("role_permissions").select("role_id, module_id, feature_id, can_view, can_edit"),
@@ -251,12 +347,13 @@ export const getRoles = createServerFn({ method: "POST" })
         throw registryError;
     if (featuresError)
         throw featuresError;
-    const allRoles = Array.isArray(roles) ? roles : [];
+    const noProfileLock = effective.locked && !scope;
+    const allRoles = noProfileLock ? [] : Array.isArray(roles) ? roles : [];
     const safeRoles = scope && scope.roleIds.length > 0
         ? allRoles.filter((r) => scope.roleIds.includes(r.id))
         : allRoles;
     const safePerms = Array.isArray(perms) ? perms : [];
-    const allRegistry = Array.isArray(registry) ? registry : [];
+    const allRegistry = noProfileLock ? [] : Array.isArray(registry) ? registry : [];
     const safeRegistry = scope && scope.moduleIds.length > 0
         ? allRegistry.filter((m) => scope.moduleIds.includes(m.module_id))
         : allRegistry;
@@ -285,6 +382,7 @@ export const getRoles = createServerFn({ method: "POST" })
             canView: Boolean(p.can_view),
             canEdit: Boolean(p.can_edit),
         })),
+        profileLocked: effective.locked,
         activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
@@ -415,12 +513,22 @@ export const syncModuleRegistry = createServerFn({ method: "POST" })
     if (modules.length === 0)
         return { ok: true, count: 0 };
     const now = new Date().toISOString();
+    const { data: existingRows, error: existingError } = await context.supabase
+        .from("module_registry")
+        .select("module_id")
+        .in("module_id", modules.map((m) => m.id));
+    if (existingError)
+        throw existingError;
+    const knownIds = new Set((Array.isArray(existingRows) ? existingRows : []).map((r) => r.module_id));
     const { error } = await context.supabase.from("module_registry").upsert(modules.map((m) => ({
         module_id: m.id,
         name: m.name,
         shell_id: data.shellId ?? null,
         is_active: true,
         last_seen_at: now,
+        // Nieuwe modules komen standaard met afdwingen aan binnen; bestaande
+        // modules behouden hun eigen instelling.
+        ...(knownIds.has(m.id) ? {} : { enforce: true }),
     })), { onConflict: "module_id" });
     if (error)
         throw error;
@@ -697,11 +805,51 @@ const profileIdInput = z.object({ profileId: z.string().uuid() });
 const profileBodySchema = {
     name: z.string().trim().min(1).max(120),
     tenantId: z.string().uuid().nullable().optional(),
+    /** Naam van het bedrijf; maakt een nieuw bedrijf aan of hernoemt het gekozen bedrijf. */
+    tenantName: z.string().trim().max(120).optional(),
     roleIds: z.array(z.string().uuid()).max(200).default([]),
     moduleIds: z.array(z.string().trim().min(1).max(100)).max(200).default([]),
 };
 const createProfileInput = z.object(profileBodySchema);
 const updateProfileInput = z.object({ profileId: z.string().uuid(), ...profileBodySchema });
+/**
+ * Bepaalt het tenant-id voor een profiel:
+ * - bestaand bedrijf + gewijzigde naam -> hernoemen
+ * - geen bedrijf + naam -> nieuw bedrijf aanmaken
+ */
+async function resolveTenant(supabase, tenantId, tenantName) {
+    const name = (tenantName ?? "").trim();
+    if (tenantId) {
+        if (name) {
+            const { data: current, error: readError } = await supabase
+                .from("tenants")
+                .select("name")
+                .eq("id", tenantId)
+                .maybeSingle();
+            if (readError)
+                throw readError;
+            if (current && current.name !== name) {
+                const { error } = await supabase
+                    .from("tenants")
+                    .update({ name, updated_at: new Date().toISOString() })
+                    .eq("id", tenantId);
+                if (error)
+                    throw error;
+            }
+        }
+        return tenantId;
+    }
+    if (!name)
+        return null;
+    const { data: created, error } = await supabase
+        .from("tenants")
+        .insert({ name })
+        .select("id")
+        .single();
+    if (error)
+        throw error;
+    return created.id;
+}
 async function writeProfileLinks(supabase, profileId, roleIds, moduleIds) {
     const { error: delRoles } = await supabase.from("profile_roles").delete().eq("profile_id", profileId);
     if (delRoles)
@@ -730,7 +878,9 @@ async function writeProfileLinks(supabase, profileId, roleIds, moduleIds) {
 export const getProfiles = createServerFn({ method: "GET" })
     .middleware([requireSupabaseAuth])
     .handler(async ({ context }) => {
-    await requireUserAdmin(context);
+    const { isAdmin } = await requireUserAdmin(context);
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, undefined, isAdmin);
     const [{ data: profilesOrg, error: profilesError }, { data: profileRoles, error: profileRolesError }, { data: profileModules, error: profileModulesError }, { data: tenants, error: tenantsError },] = await Promise.all([
         context.supabase
             .from("profiles_org")
@@ -738,7 +888,9 @@ export const getProfiles = createServerFn({ method: "GET" })
             .order("name", { ascending: true }),
         context.supabase.from("profile_roles").select("profile_id, role_id"),
         context.supabase.from("profile_modules").select("profile_id, module_id"),
-        context.supabase.from("tenants").select("id, name").order("name", { ascending: true }),
+        // `tenants` is via RLS beperkt tot de eigen tenant; namen tonen mag hier
+        // omdat de aanvrager al is geverifieerd als admin/administratie.
+        supabaseAdmin.from("tenants").select("id, name").order("name", { ascending: true }),
     ]);
     if (profilesError)
         throw profilesError;
@@ -748,13 +900,16 @@ export const getProfiles = createServerFn({ method: "GET" })
         throw profileModulesError;
     if (tenantsError)
         throw tenantsError;
-    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
     const { data: userRows, error: userError } = await supabaseAdmin
         .from("profiles")
         .select("id, tenant_id");
     if (userError)
         throw userError;
-    const safeProfiles = Array.isArray(profilesOrg) ? profilesOrg : [];
+    const allProfilesOrg = Array.isArray(profilesOrg) ? profilesOrg : [];
+    // Niet-admin: alleen het eigen (vastgezette) profiel.
+    const safeProfiles = effective.locked
+        ? allProfilesOrg.filter((p) => p.id === effective.profileId)
+        : allProfilesOrg;
     const safeProfileRoles = Array.isArray(profileRoles) ? profileRoles : [];
     const safeProfileModules = Array.isArray(profileModules) ? profileModules : [];
     const safeTenants = Array.isArray(tenants) ? tenants : [];
@@ -780,6 +935,8 @@ export const getProfiles = createServerFn({ method: "GET" })
             userCount: p.tenant_id ? usersByTenant.get(p.tenant_id) ?? 0 : 0,
         })),
         tenants: safeTenants.map((t) => ({ id: t.id, name: t.name })),
+        profileLocked: effective.locked,
+        lockedProfileId: effective.locked ? effective.profileId ?? null : null,
     };
 });
 export const createProfile = createServerFn({ method: "POST" })
@@ -787,9 +944,13 @@ export const createProfile = createServerFn({ method: "POST" })
     .inputValidator((data) => createProfileInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
+    // `tenants` heeft geen insert-policy voor admins; na de adminguard mag dit
+    // veilig via de serverclient.
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const tenantId = await resolveTenant(supabaseAdmin, data.tenantId, data.tenantName);
     const { data: created, error } = await context.supabase
         .from("profiles_org")
-        .insert({ name: data.name, tenant_id: data.tenantId ?? null })
+        .insert({ name: data.name, tenant_id: tenantId })
         .select("id")
         .single();
     if (error)
@@ -802,9 +963,11 @@ export const updateProfile = createServerFn({ method: "POST" })
     .inputValidator((data) => updateProfileInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const tenantId = await resolveTenant(supabaseAdmin, data.tenantId, data.tenantName);
     const { error } = await context.supabase
         .from("profiles_org")
-        .update({ name: data.name, tenant_id: data.tenantId ?? null, updated_at: new Date().toISOString() })
+        .update({ name: data.name, tenant_id: tenantId, updated_at: new Date().toISOString() })
         .eq("id", data.profileId);
     if (error)
         throw error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/admin-installatietechniek",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "flowselections": {
     "moduleId": "admin-installatietechniek",
     "pages": [
@@ -40,7 +40,7 @@
     "lint": "eslint ."
   },
   "peerDependencies": {
-    "@flowselections/core": "*",
+    "@flowselections/core": ">=1.0.18",
     "@tanstack/react-query": "^5.0.0",
     "@tanstack/react-router": "^1.0.0",
     "@tanstack/react-start": "^1.0.0",