@flowselections/admin-installatietechniek 1.0.7 → 1.0.9

package/dist-lib/lib/admin.functions.js

@@ -1,8 +1,8 @@
 import { createServerFn } from "@tanstack/react-start";
-import { getRequestHost } from "@tanstack/react-start/server";
 import { z } from "zod";
 import { requireSupabaseAuth } from "../integrations/supabase/auth-middleware";
-import { requireAdmin, requireUserAdmin } from "../lib/admin.server";
+import { normalizeServerErrors } from "../lib/serverErrors";
+import { isFullAdminRoleKey, requireAdmin, requireUserAdmin, resolveAppBaseUrl, verifyAddressWithGoogle } from "../lib/admin.server";
 const featureSchema = z.object({
     id: z.string().trim().min(1).max(200),
     name: z.string().trim().min(1).max(200),
@@ -31,7 +31,6 @@ const roleIdInput = z.object({ roleId: z.string().uuid() });
 const assignRoleInput = z.object({
     userId: z.string().uuid(),
     roleId: z.string().uuid(),
-    profileId: z.string().uuid().optional(),
 });
 const rolePermissionsSchema = z
     .array(z.object({
@@ -50,11 +49,33 @@ const updateRoleInput = z.object({
     name: z.string().trim().min(1).max(80),
     permissions: rolePermissionsSchema.default([]),
 });
+const CONTACT_REQUIRED_ROLE_KEYS = ["monteur", "planner", "administratie"];
+const phoneRegex = /^[0-9+()\-\s]{8,25}$/;
+const optionalAddress = z.string().trim().max(200).optional().default("");
+const optionalPhone = z
+    .string()
+    .trim()
+    .max(25)
+    .optional()
+    .default("")
+    .refine((v) => v === "" || phoneRegex.test(v), { message: "Ongeldig telefoonnummer" });
+function assertContactForRole(roleKey, address, _phone) {
+    if (!roleKey || !CONTACT_REQUIRED_ROLE_KEYS.includes(roleKey))
+        return;
+    if (address.trim().length < 5)
+        throw new Error("Adres is verplicht voor deze rol (minimaal 5 tekens).");
+}
 const inviteUserInput = z.object({
     email: z.string().trim().email().max(255),
     displayName: z.string().trim().min(1).max(100),
     roleId: z.string().uuid(),
-    profileId: z.string().uuid().optional(),
+    address: optionalAddress,
+    phone: optionalPhone,
+});
+const updateUserContactInput = z.object({
+    userId: z.string().uuid(),
+    address: optionalAddress,
+    phone: optionalPhone,
 });
 const deleteUserInput = z.object({
     userId: z.string().uuid(),
@@ -67,7 +88,6 @@ const createTestUserInput = z.object({
     displayName: z.string().trim().min(1).max(100),
     roleId: z.string().uuid(),
     email: z.string().trim().email().max(255).optional(),
-    profileId: z.string().uuid().optional(),
 });
 function slugify(value) {
     return (value
@@ -92,95 +112,30 @@ async function fetchRole(supabase, roleId) {
 }
 async function assertMayUseRole(supabase, roleId, isAdmin) {
     const role = await fetchRole(supabase, roleId);
-    if (!isAdmin && role.key === "admin") {
+    if (!isAdmin && isFullAdminRoleKey(role.key)) {
         throw new Error("Alleen een admin kan de adminrol gebruiken.");
     }
     return role;
 }
-const profileScopeInput = z
-    .object({ profileId: z.string().uuid().optional() })
-    .optional();
 /**
- * Tenant + rol-/module-scope van een bedrijfsprofiel.
- * Zonder `profileId` is er geen scope (= overzicht: alles zichtbaar).
+ * Eén database = één organisatie. Bestaat er precies één tenant, dan is dat
+ * de tenant voor nieuwe gebruikers; anders wordt er niets gezet.
  */
-async function loadProfileScope(supabase, profileId) {
-    if (!profileId)
-        return null;
-    const { data, error } = await supabase
-        .from("profiles_org")
-        .select("id, name, tenant_id, is_default")
-        .eq("id", profileId)
-        .maybeSingle();
+async function resolveSingleTenantId(admin) {
+    const { data, error } = await admin.from("tenants").select("id").limit(2);
     if (error)
         throw error;
-    if (!data)
-        return null;
-    const [{ data: roleRows }, { data: moduleRows }] = await Promise.all([
-        supabase.from("profile_roles").select("role_id").eq("profile_id", data.id),
-        supabase.from("profile_modules").select("module_id").eq("profile_id", data.id),
-    ]);
-    return {
-        id: data.id,
-        name: data.name,
-        tenantId: (data.tenant_id ?? null),
-        roleIds: (Array.isArray(roleRows) ? roleRows : []).map((r) => r.role_id),
-        moduleIds: (Array.isArray(moduleRows) ? moduleRows : []).map((m) => m.module_id),
-    };
-}
-/**
- * Bepaalt op welk bedrijfsprofiel deze aanvraag draait.
- * - Admin: vrije keuze (leeg = overzicht met alles).
- * - Niet-admin (administratie): altijd vastgezet op het eigen profiel,
- *   afgeleid uit de tenant van de gebruiker of anders uit de profielen
- *   waaraan een van zijn rollen gekoppeld is.
- */
-async function resolveEffectiveProfileId(admin, userId, requestedProfileId, isAdmin) {
-    if (isAdmin)
-        return { profileId: requestedProfileId, locked: false };
-    const { data: me } = await admin
-        .from("profiles")
-        .select("tenant_id")
-        .eq("id", userId)
-        .maybeSingle();
-    if (me?.tenant_id) {
-        const { data: byTenant } = await admin
-            .from("profiles_org")
-            .select("id")
-            .eq("tenant_id", me.tenant_id)
-            .limit(1);
-        const first = Array.isArray(byTenant) ? byTenant[0] : null;
-        if (first?.id)
-            return { profileId: first.id, locked: true };
-    }
-    const { data: myRoles } = await admin
-        .from("role_assignments")
-        .select("role_id")
-        .eq("user_id", userId);
-    const roleIds = (Array.isArray(myRoles) ? myRoles : []).map((r) => r.role_id);
-    if (roleIds.length > 0) {
-        const { data: links } = await admin
-            .from("profile_roles")
-            .select("profile_id")
-            .in("role_id", roleIds)
-            .limit(1);
-        const link = Array.isArray(links) ? links[0] : null;
-        if (link?.profile_id)
-            return { profileId: link.profile_id, locked: true };
-    }
-    return { profileId: undefined, locked: true };
+    const rows = Array.isArray(data) ? data : [];
+    return rows.length === 1 ? rows[0].id : null;
 }
 export const getUsersWithRoles = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => profileScopeInput.parse(data))
-    .handler(async ({ context, data }) => {
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
+    .handler(async ({ context }) => {
     const { isAdmin } = await requireUserAdmin(context);
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, data?.profileId, isAdmin);
-    const scope = await loadProfileScope(supabaseAdmin, effective.profileId);
     const profilesQuery = supabaseAdmin
         .from("profiles")
-        .select("id, email, display_name, tenant_id")
+        .select("id, email, display_name, tenant_id, address, phone")
         .order("email", { ascending: true });
     const [{ data: profiles, error: profilesError }, { data: assignments, error: assignmentsError }, { data: roles, error: rolesError }, { data: authList, error: authError },] = await Promise.all([
         profilesQuery,
@@ -199,15 +154,15 @@ export const getUsersWithRoles = createServerFn({ method: "POST" })
     const safeProfiles = Array.isArray(profiles) ? profiles : [];
     const safeAssignments = Array.isArray(assignments) ? assignments : [];
     const allRoles = Array.isArray(roles) ? roles : [];
-    const safeRoles = scope && scope.roleIds.length > 0
-        ? allRoles.filter((r) => scope.roleIds.includes(r.id))
-        : allRoles;
     const safeAuthUsers = Array.isArray(authList?.users) ? authList.users : [];
     const roleById = new Map(allRoles.map((r) => [r.id, r]));
     const confirmedById = new Map();
     const isTestById = new Map();
+    const authEmailById = new Map();
     for (const u of safeAuthUsers) {
         confirmedById.set(u.id, Boolean(u.email_confirmed_at));
+        if (u.email)
+            authEmailById.set(u.id, u.email);
         const meta = (u.user_metadata ?? {});
         isTestById.set(u.id, Boolean(meta.is_test_account));
     }
@@ -222,56 +177,25 @@ export const getUsersWithRoles = createServerFn({ method: "POST" })
         }
         rolesByUser.set(a.user_id, list);
     }
-    // Binnen een profiel horen gebruikers erbij via de tenant OF via een rol
-    // die aan het profiel gekoppeld is. Zonder profiel: iedereen.
-    const scopedRoleIds = new Set(scope?.roleIds ?? []);
-    const usersViaRole = new Set();
-    if (scope && scopedRoleIds.size > 0) {
-        for (const a of safeAssignments) {
-            if (scopedRoleIds.has(a.role_id))
-                usersViaRole.add(a.user_id);
-        }
-    }
-    // Vastgezette gebruiker zonder gekoppeld profiel: niets tonen.
-    const noProfileLock = effective.locked && !scope;
-    const scopedProfiles = noProfileLock
-        ? []
-        : !scope
-            ? safeProfiles
-            : safeProfiles.filter((p) => {
-                const viaTenant = Boolean(scope.tenantId) && p.tenant_id === scope.tenantId;
-                return viaTenant || usersViaRole.has(p.id);
-            });
     return {
-        users: scopedProfiles.map((profile) => {
-            const viaTenant = Boolean(scope?.tenantId) && profile.tenant_id === scope?.tenantId;
-            const viaRole = usersViaRole.has(profile.id);
-            return {
-                id: profile.id,
-                email: profile.email ?? "-",
-                displayName: profile.display_name ?? "-",
-                roles: rolesByUser.get(profile.id) ?? [],
-                emailConfirmed: confirmedById.get(profile.id) ?? false,
-                isTestAccount: isTestById.get(profile.id) ?? false,
-                matchedVia: !scope
-                    ? null
-                    : viaTenant && viaRole
-                        ? "both"
-                        : viaTenant
-                            ? "tenant"
-                            : "role",
-            };
-        }),
-        availableRoles: (noProfileLock ? [] : safeRoles)
-            .filter((r) => isAdmin || r.key !== "admin")
+        users: safeProfiles.map((profile) => ({
+            id: profile.id,
+            email: profile.email ?? authEmailById.get(profile.id) ?? "-",
+            displayName: profile.display_name ?? "-",
+            address: typeof profile.address === "string" ? profile.address : "",
+            phone: typeof profile.phone === "string" ? profile.phone : "",
+            roles: rolesByUser.get(profile.id) ?? [],
+            emailConfirmed: confirmedById.get(profile.id) ?? false,
+            isTestAccount: isTestById.get(profile.id) ?? false,
+        })),
+        availableRoles: allRoles
+            .filter((r) => isAdmin || !isFullAdminRoleKey(r.key))
             .map((r) => ({ id: r.id, key: r.key, name: r.name, isProtected: r.is_protected })),
         isAdmin,
-        profileLocked: effective.locked,
-        activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
 export const assignRole = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => assignRoleInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
@@ -291,23 +215,21 @@ export const assignRole = createServerFn({ method: "POST" })
         .insert({ user_id: data.userId, role_id: data.roleId });
     if (error)
         throw error;
-    // Binnen een actief bedrijfsprofiel: koppel de gebruiker aan de tenant van
-    // dat profiel als die nog leeg is, zodat de koppeling vanzelf dichtgroeit.
-    if (data.profileId) {
-        const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-        const scope = await loadProfileScope(supabaseAdmin, data.profileId);
-        if (scope?.tenantId) {
-            await supabaseAdmin
-                .from("profiles")
-                .update({ tenant_id: scope.tenantId })
-                .eq("id", data.userId)
-                .is("tenant_id", null);
-        }
+    // Eén organisatie per database: bestaat er precies één tenant, koppel de
+    // gebruiker daaraan als zijn tenant_id nog leeg is.
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const tenantId = await resolveSingleTenantId(supabaseAdmin);
+    if (tenantId) {
+        await supabaseAdmin
+            .from("profiles")
+            .update({ tenant_id: tenantId })
+            .eq("id", data.userId)
+            .is("tenant_id", null);
     }
     return { ok: true };
 });
 export const removeRole = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => assignRoleInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
@@ -326,13 +248,9 @@ export const removeRole = createServerFn({ method: "POST" })
 });
 /** Alle rollen met hun rechten, plus de geregistreerde modules en onderdelen. */
 export const getRoles = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => profileScopeInput.parse(data))
-    .handler(async ({ context, data }) => {
-    const { isAdmin } = await requireUserAdmin(context);
-    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, data?.profileId, isAdmin);
-    const scope = await loadProfileScope(supabaseAdmin, effective.profileId);
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
+    .handler(async ({ context }) => {
+    await requireUserAdmin(context);
     const [{ data: roles, error: rolesError }, { data: perms, error: permsError }, { data: registry, error: registryError }, { data: featureRows, error: featuresError },] = await Promise.all([
         context.supabase.from("roles").select("id, key, name, is_protected").order("name", { ascending: true }),
         context.supabase.from("role_permissions").select("role_id, module_id, feature_id, can_view, can_edit"),
@@ -347,23 +265,21 @@ export const getRoles = createServerFn({ method: "POST" })
         throw registryError;
     if (featuresError)
         throw featuresError;
-    const noProfileLock = effective.locked && !scope;
-    const allRoles = noProfileLock ? [] : Array.isArray(roles) ? roles : [];
-    const safeRoles = scope && scope.roleIds.length > 0
-        ? allRoles.filter((r) => scope.roleIds.includes(r.id))
-        : allRoles;
+    const safeRoles = Array.isArray(roles) ? roles : [];
     const safePerms = Array.isArray(perms) ? perms : [];
-    const allRegistry = noProfileLock ? [] : Array.isArray(registry) ? registry : [];
-    const safeRegistry = scope && scope.moduleIds.length > 0
-        ? allRegistry.filter((m) => scope.moduleIds.includes(m.module_id))
-        : allRegistry;
+    const safeRegistry = Array.isArray(registry) ? registry : [];
     const safeFeatures = Array.isArray(featureRows) ? featureRows : [];
+    // Rollen waarvan de sleutel niet in de app_role-lijst voorkomt: die worden
+    // door de sync-trigger stil overgeslagen en werken nergens.
+    const { data: unmappedRows } = await context.supabase.rpc("roles_without_enum_mapping");
+    const unmappedKeys = new Set((Array.isArray(unmappedRows) ? unmappedRows : []).map((r) => r?.key));
     return {
         roles: safeRoles.map((r) => ({
             id: r.id,
             key: r.key,
             name: r.name,
             isProtected: r.is_protected,
+            unmapped: unmappedKeys.has(r.key),
         })),
         modules: safeRegistry
             .filter((m) => m.is_active)
@@ -382,8 +298,6 @@ export const getRoles = createServerFn({ method: "POST" })
             canView: Boolean(p.can_view),
             canEdit: Boolean(p.can_edit),
         })),
-        profileLocked: effective.locked,
-        activeProfile: scope ? { id: scope.id, name: scope.name, tenantId: scope.tenantId } : null,
     };
 });
 async function writeRolePermissions(supabase, roleId, permissions) {
@@ -407,7 +321,7 @@ async function writeRolePermissions(supabase, roleId, permissions) {
         throw error;
 }
 export const createRole = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => createRoleInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
@@ -436,7 +350,7 @@ export const createRole = createServerFn({ method: "POST" })
     return { ok: true, roleId: created.id };
 });
 export const updateRole = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => updateRoleInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
@@ -450,7 +364,7 @@ export const updateRole = createServerFn({ method: "POST" })
     return { ok: true };
 });
 export const duplicateRole = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => roleIdInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
@@ -487,7 +401,7 @@ export const duplicateRole = createServerFn({ method: "POST" })
     return { ok: true, roleId: created.id };
 });
 export const deleteRole = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => roleIdInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
@@ -505,7 +419,7 @@ export const deleteRole = createServerFn({ method: "POST" })
  * Wat niet meer voorkomt blijft bestaan maar wordt op inactief gezet.
  */
 export const syncModuleRegistry = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => syncModulesInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
@@ -577,7 +491,7 @@ const setModuleEnforceInput = z.object({
     enforce: z.boolean(),
 });
 export const setModuleEnforce = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => setModuleEnforceInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireAdmin(context);
@@ -590,7 +504,7 @@ export const setModuleEnforce = createServerFn({ method: "POST" })
     return { ok: true };
 });
 export const getUserModulePermissions = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => userPermissionsInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireUserAdmin(context);
@@ -629,7 +543,7 @@ export const getUserModulePermissions = createServerFn({ method: "POST" })
     };
 });
 export const setUserModulePermission = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => setUserPermissionInput.parse(data))
     .handler(async ({ context, data }) => {
     await requireUserAdmin(context);
@@ -657,35 +571,36 @@ export const setUserModulePermission = createServerFn({ method: "POST" })
     return { ok: true };
 });
 export const inviteUser = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => inviteUserInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
     await assertMayUseRole(context.supabase, data.roleId, isAdmin);
+    const { data: roleRow, error: roleLookupError } = await context.supabase
+        .from("roles")
+        .select("key")
+        .eq("id", data.roleId)
+        .maybeSingle();
+    if (roleLookupError)
+        throw roleLookupError;
+    assertContactForRole(roleRow?.key ?? null, data.address, data.phone);
+    const verifiedAddress = await verifyAddressWithGoogle(data.address ?? "");
     const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    let redirectTo;
-    try {
-        const host = getRequestHost();
-        if (host) {
-            const proto = host.startsWith("localhost") ? "http" : "https";
-            redirectTo = `${proto}://${host}/reset-wachtwoord`;
-        }
-    }
-    catch {
-        redirectTo = undefined;
-    }
+    const redirectTo = `${resolveAppBaseUrl()}/reset-wachtwoord`;
     const { data: invited, error: inviteError } = await supabaseAdmin.auth.admin.inviteUserByEmail(data.email, { data: { display_name: data.displayName }, redirectTo });
     if (inviteError || !invited?.user) {
         const msg = inviteError?.message ?? "Uitnodigen mislukt";
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
     }
     const userId = invited.user.id;
-    const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+    const tenantId = await resolveSingleTenantId(supabaseAdmin);
     const { error: profileError } = await supabaseAdmin.from("profiles").upsert({
         id: userId,
         email: data.email,
         display_name: data.displayName,
-        ...(scope?.tenantId ? { tenant_id: scope.tenantId } : {}),
+        address: verifiedAddress ? verifiedAddress : null,
+        phone: data.phone ? data.phone.trim() : null,
+        ...(tenantId ? { tenant_id: tenantId } : {}),
     }, { onConflict: "id" });
     if (profileError)
         throw profileError;
@@ -697,7 +612,7 @@ export const inviteUser = createServerFn({ method: "POST" })
     return { ok: true, userId };
 });
 export const deleteUser = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => deleteUserInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
@@ -712,7 +627,7 @@ export const deleteUser = createServerFn({ method: "POST" })
         if (targetError)
             throw targetError;
         const safeTargetRoles = Array.isArray(targetRoles) ? targetRoles : [];
-        if (safeTargetRoles.some((r) => r?.roles?.key === "admin")) {
+        if (safeTargetRoles.some((r) => isFullAdminRoleKey(r?.roles?.key))) {
             throw new Error("Alleen een admin kan een adminaccount verwijderen.");
         }
     }
@@ -723,7 +638,7 @@ export const deleteUser = createServerFn({ method: "POST" })
     return { ok: true };
 });
 export const updateUserName = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => updateUserNameInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
@@ -735,7 +650,7 @@ export const updateUserName = createServerFn({ method: "POST" })
         if (targetError)
             throw targetError;
         const safeTargetRoles = Array.isArray(targetRoles) ? targetRoles : [];
-        if (safeTargetRoles.some((r) => r?.roles?.key === "admin")) {
+        if (safeTargetRoles.some((r) => isFullAdminRoleKey(r?.roles?.key))) {
             throw new Error("Alleen een admin kan een adminaccount aanpassen.");
         }
     }
@@ -753,6 +668,36 @@ export const updateUserName = createServerFn({ method: "POST" })
         throw error;
     return { ok: true };
 });
+export const updateUserContact = createServerFn({ method: "POST" })
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
+    .inputValidator((data) => updateUserContactInput.parse(data))
+    .handler(async ({ context, data }) => {
+    await requireUserAdmin(context);
+    const { data: targetRoles, error: targetError } = await context.supabase
+        .from("role_assignments")
+        .select("roles(key)")
+        .eq("user_id", data.userId);
+    if (targetError)
+        throw targetError;
+    const safeTargetRoles = Array.isArray(targetRoles) ? targetRoles : [];
+    const keys = safeTargetRoles
+        .map((r) => r?.roles?.key)
+        .filter((k) => typeof k === "string");
+    const requiredKey = keys.find((k) => CONTACT_REQUIRED_ROLE_KEYS.includes(k)) ?? null;
+    assertContactForRole(requiredKey, data.address, data.phone);
+    const verifiedAddress = await verifyAddressWithGoogle(data.address ?? "");
+    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
+    const { error } = await supabaseAdmin
+        .from("profiles")
+        .update({
+        address: verifiedAddress ? verifiedAddress : null,
+        phone: data.phone ? data.phone.trim() : null,
+    })
+        .eq("id", data.userId);
+    if (error)
+        throw error;
+    return { ok: true };
+});
 function generatePassword(length = 16) {
     const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789!@#$%*";
     const bytes = new Uint8Array(length);
@@ -763,7 +708,7 @@ function generatePassword(length = 16) {
     return out;
 }
 export const createTestUser = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
+    .middleware([normalizeServerErrors, requireSupabaseAuth])
     .inputValidator((data) => createTestUserInput.parse(data))
     .handler(async ({ context, data }) => {
     const { isAdmin } = await requireUserAdmin(context);
@@ -782,12 +727,12 @@ export const createTestUser = createServerFn({ method: "POST" })
         throw new Error(/already|exists|registered/i.test(msg) ? "Deze gebruiker bestaat al." : msg);
     }
     const userId = created.user.id;
-    const scope = await loadProfileScope(supabaseAdmin, data.profileId);
+    const tenantId = await resolveSingleTenantId(supabaseAdmin);
     const { error: profileError } = await supabaseAdmin.from("profiles").upsert({
         id: userId,
         email,
         display_name: data.displayName,
-        ...(scope?.tenantId ? { tenant_id: scope.tenantId } : {}),
+        ...(tenantId ? { tenant_id: tenantId } : {}),
     }, { onConflict: "id" });
     if (profileError)
         throw profileError;
@@ -798,261 +743,3 @@ export const createTestUser = createServerFn({ method: "POST" })
         throw roleError;
     return { ok: true, userId, email, password };
 });
-// ============================================================================
-// Bedrijfsprofielen: bundelen rollen + modules per organisatie (tenant)
-// ============================================================================
-const profileIdInput = z.object({ profileId: z.string().uuid() });
-const profileBodySchema = {
-    name: z.string().trim().min(1).max(120),
-    tenantId: z.string().uuid().nullable().optional(),
-    /** Naam van het bedrijf; maakt een nieuw bedrijf aan of hernoemt het gekozen bedrijf. */
-    tenantName: z.string().trim().max(120).optional(),
-    roleIds: z.array(z.string().uuid()).max(200).default([]),
-    moduleIds: z.array(z.string().trim().min(1).max(100)).max(200).default([]),
-};
-const createProfileInput = z.object(profileBodySchema);
-const updateProfileInput = z.object({ profileId: z.string().uuid(), ...profileBodySchema });
-/**
- * Bepaalt het tenant-id voor een profiel:
- * - bestaand bedrijf + gewijzigde naam -> hernoemen
- * - geen bedrijf + naam -> nieuw bedrijf aanmaken
- */
-async function resolveTenant(supabase, tenantId, tenantName) {
-    const name = (tenantName ?? "").trim();
-    if (tenantId) {
-        if (name) {
-            const { data: current, error: readError } = await supabase
-                .from("tenants")
-                .select("name")
-                .eq("id", tenantId)
-                .maybeSingle();
-            if (readError)
-                throw readError;
-            if (current && current.name !== name) {
-                const { error } = await supabase
-                    .from("tenants")
-                    .update({ name, updated_at: new Date().toISOString() })
-                    .eq("id", tenantId);
-                if (error)
-                    throw error;
-            }
-        }
-        return tenantId;
-    }
-    if (!name)
-        return null;
-    const { data: created, error } = await supabase
-        .from("tenants")
-        .insert({ name })
-        .select("id")
-        .single();
-    if (error)
-        throw error;
-    return created.id;
-}
-async function writeProfileLinks(supabase, profileId, roleIds, moduleIds) {
-    const { error: delRoles } = await supabase.from("profile_roles").delete().eq("profile_id", profileId);
-    if (delRoles)
-        throw delRoles;
-    const { error: delModules } = await supabase.from("profile_modules").delete().eq("profile_id", profileId);
-    if (delModules)
-        throw delModules;
-    const uniqueRoles = Array.from(new Set(roleIds));
-    if (uniqueRoles.length > 0) {
-        const { error } = await supabase
-            .from("profile_roles")
-            .insert(uniqueRoles.map((roleId) => ({ profile_id: profileId, role_id: roleId })));
-        if (error)
-            throw error;
-    }
-    const uniqueModules = Array.from(new Set(moduleIds));
-    if (uniqueModules.length > 0) {
-        const { error } = await supabase
-            .from("profile_modules")
-            .insert(uniqueModules.map((moduleId) => ({ profile_id: profileId, module_id: moduleId })));
-        if (error)
-            throw error;
-    }
-}
-/** Alle bedrijfsprofielen met hun rollen, modules en tellingen. */
-export const getProfiles = createServerFn({ method: "GET" })
-    .middleware([requireSupabaseAuth])
-    .handler(async ({ context }) => {
-    const { isAdmin } = await requireUserAdmin(context);
-    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const effective = await resolveEffectiveProfileId(supabaseAdmin, context.userId, undefined, isAdmin);
-    const [{ data: profilesOrg, error: profilesError }, { data: profileRoles, error: profileRolesError }, { data: profileModules, error: profileModulesError }, { data: tenants, error: tenantsError },] = await Promise.all([
-        context.supabase
-            .from("profiles_org")
-            .select("id, name, tenant_id, is_default")
-            .order("name", { ascending: true }),
-        context.supabase.from("profile_roles").select("profile_id, role_id"),
-        context.supabase.from("profile_modules").select("profile_id, module_id"),
-        // `tenants` is via RLS beperkt tot de eigen tenant; namen tonen mag hier
-        // omdat de aanvrager al is geverifieerd als admin/administratie.
-        supabaseAdmin.from("tenants").select("id, name").order("name", { ascending: true }),
-    ]);
-    if (profilesError)
-        throw profilesError;
-    if (profileRolesError)
-        throw profileRolesError;
-    if (profileModulesError)
-        throw profileModulesError;
-    if (tenantsError)
-        throw tenantsError;
-    const { data: userRows, error: userError } = await supabaseAdmin
-        .from("profiles")
-        .select("id, tenant_id");
-    if (userError)
-        throw userError;
-    const allProfilesOrg = Array.isArray(profilesOrg) ? profilesOrg : [];
-    // Niet-admin: alleen het eigen (vastgezette) profiel.
-    const safeProfiles = effective.locked
-        ? allProfilesOrg.filter((p) => p.id === effective.profileId)
-        : allProfilesOrg;
-    const safeProfileRoles = Array.isArray(profileRoles) ? profileRoles : [];
-    const safeProfileModules = Array.isArray(profileModules) ? profileModules : [];
-    const safeTenants = Array.isArray(tenants) ? tenants : [];
-    const safeUsers = Array.isArray(userRows) ? userRows : [];
-    const usersByTenant = new Map();
-    for (const u of safeUsers) {
-        if (!u.tenant_id)
-            continue;
-        usersByTenant.set(u.tenant_id, (usersByTenant.get(u.tenant_id) ?? 0) + 1);
-    }
-    const tenantName = new Map(safeTenants.map((t) => [t.id, t.name]));
-    return {
-        profiles: safeProfiles.map((p) => ({
-            id: p.id,
-            name: p.name,
-            tenantId: (p.tenant_id ?? null),
-            tenantName: p.tenant_id ? tenantName.get(p.tenant_id) ?? null : null,
-            isDefault: Boolean(p.is_default),
-            roleIds: safeProfileRoles.filter((r) => r.profile_id === p.id).map((r) => r.role_id),
-            moduleIds: safeProfileModules
-                .filter((m) => m.profile_id === p.id)
-                .map((m) => m.module_id),
-            userCount: p.tenant_id ? usersByTenant.get(p.tenant_id) ?? 0 : 0,
-        })),
-        tenants: safeTenants.map((t) => ({ id: t.id, name: t.name })),
-        profileLocked: effective.locked,
-        lockedProfileId: effective.locked ? effective.profileId ?? null : null,
-    };
-});
-export const createProfile = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => createProfileInput.parse(data))
-    .handler(async ({ context, data }) => {
-    await requireAdmin(context);
-    // `tenants` heeft geen insert-policy voor admins; na de adminguard mag dit
-    // veilig via de serverclient.
-    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const tenantId = await resolveTenant(supabaseAdmin, data.tenantId, data.tenantName);
-    const { data: created, error } = await context.supabase
-        .from("profiles_org")
-        .insert({ name: data.name, tenant_id: tenantId })
-        .select("id")
-        .single();
-    if (error)
-        throw error;
-    await writeProfileLinks(context.supabase, created.id, data.roleIds, data.moduleIds);
-    return { ok: true, profileId: created.id };
-});
-export const updateProfile = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => updateProfileInput.parse(data))
-    .handler(async ({ context, data }) => {
-    await requireAdmin(context);
-    const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-    const tenantId = await resolveTenant(supabaseAdmin, data.tenantId, data.tenantName);
-    const { error } = await context.supabase
-        .from("profiles_org")
-        .update({ name: data.name, tenant_id: tenantId, updated_at: new Date().toISOString() })
-        .eq("id", data.profileId);
-    if (error)
-        throw error;
-    await writeProfileLinks(context.supabase, data.profileId, data.roleIds, data.moduleIds);
-    return { ok: true };
-});
-export const duplicateProfile = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => profileIdInput.parse(data))
-    .handler(async ({ context, data }) => {
-    await requireAdmin(context);
-    const { data: source, error: sourceError } = await context.supabase
-        .from("profiles_org")
-        .select("name, tenant_id")
-        .eq("id", data.profileId)
-        .maybeSingle();
-    if (sourceError)
-        throw sourceError;
-    if (!source)
-        throw new Error("Profiel bestaat niet.");
-    const [{ data: roleRows }, { data: moduleRows }] = await Promise.all([
-        context.supabase.from("profile_roles").select("role_id").eq("profile_id", data.profileId),
-        context.supabase.from("profile_modules").select("module_id").eq("profile_id", data.profileId),
-    ]);
-    const { data: created, error } = await context.supabase
-        .from("profiles_org")
-        .insert({ name: `${source.name} (kopie)`, tenant_id: source.tenant_id })
-        .select("id")
-        .single();
-    if (error)
-        throw error;
-    await writeProfileLinks(context.supabase, created.id, (Array.isArray(roleRows) ? roleRows : []).map((r) => r.role_id), (Array.isArray(moduleRows) ? moduleRows : []).map((m) => m.module_id));
-    return { ok: true, profileId: created.id };
-});
-export const deleteProfile = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => profileIdInput.parse(data))
-    .handler(async ({ context, data }) => {
-    await requireAdmin(context);
-    const { data: profile, error: profileError } = await context.supabase
-        .from("profiles_org")
-        .select("id, tenant_id, is_default")
-        .eq("id", data.profileId)
-        .maybeSingle();
-    if (profileError)
-        throw profileError;
-    if (!profile)
-        throw new Error("Profiel bestaat niet.");
-    if (profile.is_default)
-        throw new Error("Het actieve profiel kan niet verwijderd worden.");
-    if (profile.tenant_id) {
-        const { supabaseAdmin } = await import("../integrations/supabase/client.server");
-        const { count, error: countError } = await supabaseAdmin
-            .from("profiles")
-            .select("id", { count: "exact", head: true })
-            .eq("tenant_id", profile.tenant_id);
-        if (countError)
-            throw countError;
-        if ((count ?? 0) > 0) {
-            throw new Error("Er zijn nog gebruikers aan dit bedrijf gekoppeld.");
-        }
-    }
-    const { error } = await context.supabase.from("profiles_org").delete().eq("id", data.profileId);
-    if (error)
-        throw error;
-    return { ok: true };
-});
-/** Zet precies één profiel als actief (is_default). */
-export const setActiveProfile = createServerFn({ method: "POST" })
-    .middleware([requireSupabaseAuth])
-    .inputValidator((data) => profileIdInput.parse(data))
-    .handler(async ({ context, data }) => {
-    await requireAdmin(context);
-    const { error: clearError } = await context.supabase
-        .from("profiles_org")
-        .update({ is_default: false })
-        .eq("is_default", true)
-        .neq("id", data.profileId);
-    if (clearError)
-        throw clearError;
-    const { error } = await context.supabase
-        .from("profiles_org")
-        .update({ is_default: true, updated_at: new Date().toISOString() })
-        .eq("id", data.profileId);
-    if (error)
-        throw error;
-    return { ok: true };
-});