@flowselections/core 1.0.22 → 1.0.23

package/dist/extensions/ShellExtensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ShellExtensions.d.ts","sourceRoot":"","sources":["../../src/core/extensions/ShellExtensions.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,uFAAuF;AACvF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAAG,MAAM,mBAAmB,CAAC;AAS/D,MAAM,WAAW,4BAA4B;IAC3C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAAC;IAClE,kFAAkF;IAClF,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAC/C,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CAAC,EACtC,aAAa,EACb,KAAK,EACL,QAAQ,GACT,EAAE,4BAA4B,2CAY9B;AAED,wBAAgB,aAAa,IAAI,aAAa,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAAC,GAAG,SAAS,CAElF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAuB1E"}
+{"version":3,"file":"ShellExtensions.d.ts","sourceRoot":"","sources":["../../src/core/extensions/ShellExtensions.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,uFAAuF;AACvF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAAG,MAAM,mBAAmB,CAAC;AAE/D;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;CACnB;AACD,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW,CAAC;AAClE,MAAM,MAAM,kBAAkB,GAAG,MAAM,eAAe,CAAC;AAYvD,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAc7D;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAAC;IAClE,kFAAkF;IAClF,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;IAC/C,+FAA+F;IAC/F,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CAAC,EACtC,aAAa,EACb,KAAK,EACL,SAAS,EACT,QAAQ,GACT,EAAE,4BAA4B,2CAY9B;AAED,wBAAgB,aAAa,IAAI,aAAa,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAAC,GAAG,SAAS,CAElF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAuB1E"}

package/dist/extensions/ShellExtensions.js

@@ -1,13 +1,32 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useContext, useMemo } from "react";
 const ShellExtensionsContext = createContext({ transforms: [] });
-export function ShellExtensionsProvider({ useModuleList, guard, children, }) {
+const identityFooter = () => (items) => items;
+/** Sinds 1.0.23. Past de footer-transform toe; fout → ongewijzigd. Zichtbaarheid, geen beveiliging. */
+export function useFooterItems(base) {
+    const useF = useContext(ShellExtensionsContext).useFooter ?? identityFooter;
+    let t = (i) => i;
+    try {
+        t = useF();
+    }
+    catch {
+        /* fail-open */
+    }
+    try {
+        const next = t(base);
+        return { settings: typeof next?.settings === "boolean" ? next.settings : base.settings };
+    }
+    catch {
+        return base;
+    }
+}
+export function ShellExtensionsProvider({ useModuleList, guard, useFooter, children, }) {
     const transforms = useMemo(() => (Array.isArray(useModuleList) ? useModuleList : useModuleList ? [useModuleList] : []), 
     // Bewust op de referentie(s): de hooks moeten stabiel zijn, zodat de
     // hook-volgorde tussen renders nooit verandert.
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [useModuleList]);
-    const value = useMemo(() => ({ transforms, guard }), [transforms, guard]);
+    const value = useMemo(() => ({ transforms, guard, useFooter }), [transforms, guard, useFooter]);
     return _jsx(ShellExtensionsContext.Provider, { value: value, children: children });
 }
 export function useShellGuard() {

package/dist/hooks/useLogoSrc.d.ts

@@ -0,0 +1,7 @@
+export declare const DEFAULT_LOGO_SRC = "/logo.png";
+/**
+ * Sinds 1.0.23. Logopad: prop wint, dan `logo` uit `/huisstijl.json`, dan
+ * `/logo.png`.
+ */
+export declare function useLogoSrc(prop?: string): string;
+//# sourceMappingURL=useLogoSrc.d.ts.map

package/dist/hooks/useLogoSrc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useLogoSrc.d.ts","sourceRoot":"","sources":["../../src/core/hooks/useLogoSrc.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAa5C;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAWhD"}

package/dist/hooks/useLogoSrc.js

@@ -0,0 +1,29 @@
+import { useEffect, useState } from "react";
+export const DEFAULT_LOGO_SRC = "/logo.png";
+let huisstijlLogo = null;
+function loadHuisstijlLogo() {
+    if (!huisstijlLogo) {
+        huisstijlLogo = fetch("/huisstijl.json")
+            .then((r) => (r.ok ? r.json() : null))
+            .then((j) => (j && typeof j.logo === "string" && j.logo ? j.logo : null))
+            .catch(() => null);
+    }
+    return huisstijlLogo;
+}
+/**
+ * Sinds 1.0.23. Logopad: prop wint, dan `logo` uit `/huisstijl.json`, dan
+ * `/logo.png`.
+ */
+export function useLogoSrc(prop) {
+    const [fromFile, setFromFile] = useState(null);
+    useEffect(() => {
+        if (prop || typeof window === "undefined")
+            return;
+        let alive = true;
+        loadHuisstijlLogo().then((v) => alive && setFromFile(v));
+        return () => {
+            alive = false;
+        };
+    }, [prop]);
+    return prop || fromFile || DEFAULT_LOGO_SRC;
+}

package/dist/index.d.ts

@@ -4,7 +4,9 @@ export { supabase } from "./supabase/client";
 export type { Database } from "./supabase/types";
 export { LoginPage } from "./components/layout/LoginPage";
 export { requireAuth, safeRedirectPath, readRedirectParam } from "./auth/redirect";
-export type { RequireAuthArgs } from "./auth/redirect";
+export { resolveModuleAccess, canAccessModule } from "./auth/redirect";
+export type { RequireAuthArgs, ModuleAccessContext } from "./auth/redirect";
+export { useIsSuperadmin, roleFlags } from "./auth/useIsSuperadmin.js";
 export { HandoverPage } from "./components/layout/HandoverPage";
 export type { HandoverPageProps } from "./components/layout/HandoverPage";
 export { ResetWachtwoordPage } from "./components/layout/ResetWachtwoordPage";
@@ -12,7 +14,11 @@ export { Header } from "./components/layout/Header";
 export { InstellingenPage } from "./components/layout/InstellingenPage";
 export { Sidebar } from "./components/layout/Sidebar";
 export type { SidebarProps } from "./components/layout/Sidebar";
-export { AuthenticatedLayout } from "./components/layout/AuthenticatedLayout";
+export { AuthenticatedLayout, NoAccess } from "./components/layout/AuthenticatedLayout";
+export { useSidebarModules } from "./components/layout/Sidebar";
+export { useShell, useShellModules } from "./shell/ShellContext.js";
+export type { ShellContextValue } from "./shell/ShellContext.js";
+export { useLogoSrc } from "./hooks/useLogoSrc.js";
 export type { AuthenticatedLayoutProps } from "./components/layout/AuthenticatedLayout";
 export { Toaster } from "./components/ui/sonner";
 export { Button } from "./components/ui/button";
@@ -37,13 +43,16 @@ export { cn } from "./lib/utils";
 export { validateFileUpload, ALLOWED_FILE_TYPES, loginSchema } from "./lib/validationSchemas";
 export { useIsMobile } from "./hooks/use-mobile";
 export { useHuisstijl } from "./hooks/useHuisstijl";
-export type { FlowModule, NavItem, SettingsCard } from "./types/module";
-export { moduleKey, navKey } from "./types/module.js";
-export { ShellExtensionsProvider, useModuleListTransform } from "./extensions/ShellExtensions.js";
-export type { ModuleListTransform, UseModuleListTransform, ShellExtensionsProviderProps, } from "./extensions/ShellExtensions.js";
+export type { FlowModule, NavItem, SettingsCard, FeatureDefinition } from "./types/module";
+export { moduleKey, navKey, featureKey, moduleFeatures } from "./types/module.js";
+export { ShellExtensionsProvider, useModuleListTransform, useFooterItems } from "./extensions/ShellExtensions.js";
+export type { ModuleListTransform, UseModuleListTransform, ShellExtensionsProviderProps, FooterItems, FooterTransform, UseFooterTransform, } from "./extensions/ShellExtensions.js";
 export { ModuleGuardSlot } from "./extensions/ModuleGuardSlot.js";
-export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, } from "./permissions/useModulePermission.js";
-export type { PermissionLevel, ModulePermissionRow } from "./permissions/useModulePermission.js";
+export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, useCan, Can, usePermissionFilteredModules, } from "./permissions/useModulePermission.js";
+export type { PermissionLevel, ModulePermissionRow, CanProps } from "./permissions/useModulePermission.js";
+export { filterModules, resolveLevel } from "./permissions/resolve.js";
+export { usePermissionSnapshot } from "./permissions/store.js";
+export type { PermissionSnapshot, PermissionStatus } from "./permissions/store.js";
 export { ModuleAccessGuard } from "./permissions/ModuleAccessGuard.js";
 export type { ModuleAccessGuardProps } from "./permissions/ModuleAccessGuard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGnF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAClG,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/core/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAGnF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC7G,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EACnE,aAAa,EAAE,YAAY,EAAE,WAAW,GACzC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EACrE,sBAAsB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5D,gBAAgB,EAAE,kBAAkB,GACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,GAC9D,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,GAC9D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EACxE,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,EAClE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAC9D,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,EAC3D,sBAAsB,EAAE,sBAAsB,GAC/C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGlF,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAClH,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,WAAW,EACX,eAAe,EACf,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,MAAM,EACN,GAAG,EACH,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAC3G,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -5,12 +5,17 @@ export { supabase } from "./supabase/client";
 // Layout
 export { LoginPage } from "./components/layout/LoginPage";
 export { requireAuth, safeRedirectPath, readRedirectParam } from "./auth/redirect";
+export { resolveModuleAccess, canAccessModule } from "./auth/redirect";
+export { useIsSuperadmin, roleFlags } from "./auth/useIsSuperadmin.js";
 export { HandoverPage } from "./components/layout/HandoverPage";
 export { ResetWachtwoordPage } from "./components/layout/ResetWachtwoordPage";
 export { Header } from "./components/layout/Header";
 export { InstellingenPage } from "./components/layout/InstellingenPage";
 export { Sidebar } from "./components/layout/Sidebar";
-export { AuthenticatedLayout } from "./components/layout/AuthenticatedLayout";
+export { AuthenticatedLayout, NoAccess } from "./components/layout/AuthenticatedLayout";
+export { useSidebarModules } from "./components/layout/Sidebar";
+export { useShell, useShellModules } from "./shell/ShellContext.js";
+export { useLogoSrc } from "./hooks/useLogoSrc.js";
 export { Toaster } from "./components/ui/sonner";
 // UI components
 export { Button } from "./components/ui/button";
@@ -36,10 +41,12 @@ export { cn } from "./lib/utils";
 export { validateFileUpload, ALLOWED_FILE_TYPES, loginSchema } from "./lib/validationSchemas";
 export { useIsMobile } from "./hooks/use-mobile";
 export { useHuisstijl } from "./hooks/useHuisstijl";
-export { moduleKey, navKey } from "./types/module.js";
+export { moduleKey, navKey, featureKey, moduleFeatures } from "./types/module.js";
 // Shell-extensiepunten (allemaal optioneel; zonder provider ongewijzigd gedrag)
-export { ShellExtensionsProvider, useModuleListTransform } from "./extensions/ShellExtensions.js";
+export { ShellExtensionsProvider, useModuleListTransform, useFooterItems } from "./extensions/ShellExtensions.js";
 export { ModuleGuardSlot } from "./extensions/ModuleGuardSlot.js";
 // Rechten (leeskant; fail-open, zie README)
-export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, } from "./permissions/useModulePermission.js";
+export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, useCan, Can, usePermissionFilteredModules, } from "./permissions/useModulePermission.js";
+export { filterModules, resolveLevel } from "./permissions/resolve.js";
+export { usePermissionSnapshot } from "./permissions/store.js";
 export { ModuleAccessGuard } from "./permissions/ModuleAccessGuard.js";

package/dist/permissions/resolve.d.ts

@@ -0,0 +1,22 @@
+import type { FlowModule } from "../types/module.js";
+export type PermissionLevel = "none" | "view" | "edit";
+export interface ModulePermissionRow {
+    moduleId: string;
+    featureId: string | null;
+    permission: PermissionLevel;
+}
+export declare const RANK: Record<PermissionLevel, number>;
+export declare function normalizeLevel(value: unknown): PermissionLevel;
+/** RPC-rijen → genormaliseerd. Moduleniveau is `feature_id = ''` → `null`. */
+export declare function normalizeRows(data: unknown): ModulePermissionRow[];
+/** Feature-rij, anders modulerij, anders default-allow. */
+export declare function resolveLevel(rows: ModulePermissionRow[], moduleId: string, featureId?: string | null): PermissionLevel;
+/**
+ * Pure zijbalkfilter. `none` weg; groep zonder zichtbare kinderen verdwijnt,
+ * tenzij de module een eigen link heeft (nav.href niet tussen de kinderen) en
+ * zelf toegankelijk is — dan blijft hij als gewone link staan.
+ */
+export declare function filterModules(modules: FlowModule[], rows: ModulePermissionRow[]): FlowModule[];
+/** Paden die nooit door de route-guard worden beperkt. */
+export declare const EXEMPT_KEYS: Set<string>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/permissions/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/core/permissions/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAiC,CAAC;AAEnF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAI9D;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,EAAE,CAalE;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EAAE,EAC3B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,eAAe,CAajB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,UAAU,EAAE,CAyB9F;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,aAAsF,CAAC"}

package/dist/permissions/resolve.js

@@ -0,0 +1,76 @@
+import { featureKey, moduleKey, navKey } from "../types/module.js";
+export const RANK = { none: 0, view: 1, edit: 2 };
+export function normalizeLevel(value) {
+    const v = typeof value === "string" ? value.toLowerCase() : "";
+    if (v === "none" || v === "view" || v === "edit")
+        return v;
+    return "edit"; // onbekend → fail-open
+}
+/** RPC-rijen → genormaliseerd. Moduleniveau is `feature_id = ''` → `null`. */
+export function normalizeRows(data) {
+    if (!Array.isArray(data))
+        return [];
+    return data.map((raw) => {
+        const row = (raw ?? {});
+        const rawModule = String(row["module_id"] ?? row["moduleId"] ?? "");
+        const rawFeature = row["feature_id"] ?? row["featureId"] ?? null;
+        const feature = typeof rawFeature === "string" && rawFeature !== "" ? rawFeature : null;
+        return {
+            moduleId: navKey(rawModule),
+            featureId: feature,
+            permission: normalizeLevel(row["permission"] ?? row["level"] ?? row["permission_level"]),
+        };
+    });
+}
+/** Feature-rij, anders modulerij, anders default-allow. */
+export function resolveLevel(rows, moduleId, featureId) {
+    const key = navKey(moduleId) || moduleId;
+    const forModule = rows.filter((r) => r.moduleId === key);
+    if (forModule.length === 0)
+        return "edit";
+    if (featureId) {
+        const feature = forModule.find((r) => r.featureId === featureId);
+        if (feature)
+            return feature.permission;
+    }
+    const moduleLevel = forModule.find((r) => !r.featureId);
+    if (moduleLevel)
+        return moduleLevel.permission;
+    if (forModule.some((r) => r.permission === "edit"))
+        return "edit";
+    if (forModule.some((r) => r.permission === "view"))
+        return "view";
+    return "none";
+}
+/**
+ * Pure zijbalkfilter. `none` weg; groep zonder zichtbare kinderen verdwijnt,
+ * tenzij de module een eigen link heeft (nav.href niet tussen de kinderen) en
+ * zelf toegankelijk is — dan blijft hij als gewone link staan.
+ */
+export function filterModules(modules, rows) {
+    if (rows.length === 0)
+        return modules;
+    const result = [];
+    for (const mod of modules) {
+        const children = mod.nav.children;
+        if (children?.length) {
+            const allowed = children.filter((child) => resolveLevel(rows, navKey(child.href), child.featureId ?? (featureKey(child.href) || null)) !==
+                "none");
+            if (allowed.length > 0) {
+                result.push({ ...mod, nav: { ...mod.nav, children: allowed } });
+                continue;
+            }
+            const ownLink = !children.some((c) => c.href === mod.nav.href);
+            if (ownLink && resolveLevel(rows, moduleKey(mod)) !== "none") {
+                result.push({ ...mod, nav: { ...mod.nav, children: undefined } });
+            }
+            continue;
+        }
+        if (resolveLevel(rows, moduleKey(mod), mod.nav.featureId ?? null) === "none")
+            continue;
+        result.push(mod);
+    }
+    return result;
+}
+/** Paden die nooit door de route-guard worden beperkt. */
+export const EXEMPT_KEYS = new Set(["", "instellingen", "login", "logout", "auth", "reset-wachtwoord", "api"]);

package/dist/permissions/store.d.ts

@@ -0,0 +1,38 @@
+import { type ModulePermissionRow } from "./resolve.js";
+export type PermissionStatus = "loading" | "ready" | "error" | "timeout";
+export interface PermissionSnapshot {
+    userId: string | null;
+    status: PermissionStatus;
+    rows: ModulePermissionRow[];
+    /** Rollen uit de JWT-claim `user_roles`, terugval tabel `user_roles`. */
+    roles: string[];
+    rolesLoaded: boolean;
+}
+export declare const PERMISSION_TIMEOUT_MS = 3000;
+type Fetcher = () => Promise<unknown>;
+type RolesFetcher = (userId: string) => Promise<string[]>;
+export declare function subscribePermissions(listener: () => void): () => boolean;
+export declare function getPermissionSnapshot(): PermissionSnapshot;
+/** Rollen uit een JWT (claim `user_roles`). Geen verificatie: alleen UI. */
+export declare function rolesFromAccessToken(token: string | undefined | null): string[] | null;
+/**
+ * Laadt rechten (en rollen) voor `userId`. Dedupliceert en cachet 5 min.
+ * Na 3 s zonder antwoord gaat de status op `timeout` (fail-open); komt het
+ * antwoord later alsnog, dan wordt het `ready`.
+ */
+export declare function loadPermissions(userId: string | null, accessToken?: string | null, force?: boolean): Promise<void>;
+/** Wacht maximaal `ms` op rechten. Resolvet altijd (fail-open). */
+export declare function waitForPermissions(userId: string | null, accessToken?: string | null, ms?: number): Promise<PermissionSnapshot>;
+/** Koppelt de store eenmalig aan de Supabase-sessie (alleen in de browser). */
+export declare function ensureSessionWiring(): void;
+/** React-hook op de store. Werkt zonder QueryClientProvider. */
+export declare function usePermissionSnapshot(): PermissionSnapshot;
+export declare function __setPermissionFetchers(next: {
+    rows?: Fetcher;
+    roles?: RolesFetcher;
+}): void;
+export declare function __resetPermissionStore(): void;
+/** Markeert de wiring als gedaan (tests/preview met een mock). */
+export declare function __disableSessionWiring(): void;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/permissions/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/core/permissions/store.ts"],"names":[],"mappings":"AASA,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC5B,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAG1C,KAAK,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;AACtC,KAAK,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AA8B1D,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,IAAI,iBAGxD;AACD,wBAAgB,qBAAqB,uBAEpC;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,GAAG,IAAI,CAetF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAC3B,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,SAAwB,+BAchH;AAGD,+EAA+E;AAC/E,wBAAgB,mBAAmB,SAmBlC;AAED,gEAAgE;AAChE,wBAAgB,qBAAqB,IAAI,kBAAkB,CAM1D;AAID,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,CAAA;CAAE,QAGrF;AACD,wBAAgB,sBAAsB,SAQrC;AACD,kEAAkE;AAClE,wBAAgB,sBAAsB,SAErC"}

package/dist/permissions/store.js

@@ -0,0 +1,180 @@
+/**
+ * Gedeelde rechten- en rollencache zonder React Query (sinds 1.0.23).
+ *
+ * De automatische paden (zijbalkfilter, route-guard, useIsSuperadmin) lezen
+ * hier via useSyncExternalStore. Werkt dus ook in shells zonder
+ * QueryClientProvider. Zichtbaarheid, geen beveiliging.
+ */
+import { useEffect, useSyncExternalStore } from "react";
+import { supabase } from "../supabase/client.js";
+import { normalizeRows } from "./resolve.js";
+export const PERMISSION_TIMEOUT_MS = 3000;
+const STALE_MS = 5 * 60 * 1000;
+const defaultFetcher = async () => {
+    const { data, error } = await supabase.rpc("my_module_permissions");
+    if (error)
+        throw error;
+    return data;
+};
+const defaultRolesFetcher = async (userId) => {
+    const { data, error } = await supabase.from("user_roles").select("role").eq("user_id", userId);
+    if (error || !Array.isArray(data))
+        return [];
+    return data.map((r) => String(r.role));
+};
+let fetcher = defaultFetcher;
+let rolesFetcher = defaultRolesFetcher;
+let snapshot = { userId: null, status: "loading", rows: [], roles: [], rolesLoaded: false };
+let fetchedAt = 0;
+let inflight = null;
+let inflightUser;
+const listeners = new Set();
+function set(next) {
+    snapshot = { ...snapshot, ...next };
+    listeners.forEach((l) => l());
+}
+export function subscribePermissions(listener) {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+}
+export function getPermissionSnapshot() {
+    return snapshot;
+}
+/** Rollen uit een JWT (claim `user_roles`). Geen verificatie: alleen UI. */
+export function rolesFromAccessToken(token) {
+    if (!token)
+        return null;
+    try {
+        const part = token.split(".")[1];
+        if (!part)
+            return null;
+        const json = typeof atob === "function"
+            ? atob(part.replace(/-/g, "+").replace(/_/g, "/"))
+            : Buffer.from(part, "base64").toString("utf8");
+        const claims = JSON.parse(json);
+        const roles = claims["user_roles"];
+        return Array.isArray(roles) ? roles.map(String) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Laadt rechten (en rollen) voor `userId`. Dedupliceert en cachet 5 min.
+ * Na 3 s zonder antwoord gaat de status op `timeout` (fail-open); komt het
+ * antwoord later alsnog, dan wordt het `ready`.
+ */
+export function loadPermissions(userId, accessToken, force = false) {
+    if (!userId) {
+        fetchedAt = Date.now();
+        set({ userId: null, status: "ready", rows: [], roles: [], rolesLoaded: true });
+        return Promise.resolve();
+    }
+    const fresh = snapshot.userId === userId && snapshot.status === "ready" && Date.now() - fetchedAt < STALE_MS;
+    if (!force && fresh)
+        return Promise.resolve();
+    if (!force && inflight && inflightUser === userId)
+        return inflight;
+    if (snapshot.userId !== userId) {
+        const claimRoles = rolesFromAccessToken(accessToken);
+        set({ userId, status: "loading", rows: [], roles: claimRoles ?? [], rolesLoaded: !!claimRoles });
+    }
+    else if (snapshot.status !== "ready") {
+        set({ status: "loading" });
+    }
+    inflightUser = userId;
+    const timer = setTimeout(() => {
+        if (snapshot.userId === userId && snapshot.status === "loading")
+            set({ status: "timeout" });
+    }, PERMISSION_TIMEOUT_MS);
+    const p = (async () => {
+        const [perm, roles] = await Promise.allSettled([
+            fetcher(),
+            snapshot.rolesLoaded ? Promise.resolve(snapshot.roles) : rolesFetcher(userId),
+        ]);
+        clearTimeout(timer);
+        if (snapshot.userId !== userId)
+            return;
+        const roleList = roles.status === "fulfilled" ? roles.value : snapshot.roles;
+        if (perm.status === "fulfilled") {
+            fetchedAt = Date.now();
+            set({ status: "ready", rows: normalizeRows(perm.value), roles: roleList, rolesLoaded: true });
+        }
+        else {
+            // Ontbrekende RPC of andere fout: fail-open, geen retry.
+            set({ status: "error", rows: [], roles: roleList, rolesLoaded: true });
+        }
+    })().finally(() => {
+        if (inflight === p)
+            inflight = null;
+    });
+    inflight = p;
+    return p;
+}
+/** Wacht maximaal `ms` op rechten. Resolvet altijd (fail-open). */
+export function waitForPermissions(userId, accessToken, ms = PERMISSION_TIMEOUT_MS) {
+    return new Promise((resolve) => {
+        const t = setTimeout(() => resolve(snapshot), ms);
+        loadPermissions(userId, accessToken).then(() => {
+            clearTimeout(t);
+            resolve(snapshot);
+        }, () => {
+            clearTimeout(t);
+            resolve(snapshot);
+        });
+    });
+}
+let sessionWired = false;
+/** Koppelt de store eenmalig aan de Supabase-sessie (alleen in de browser). */
+export function ensureSessionWiring() {
+    if (sessionWired || typeof window === "undefined")
+        return;
+    sessionWired = true;
+    try {
+        supabase.auth.getSession().then(({ data }) => {
+            loadPermissions(data.session?.user.id ?? null, data.session?.access_token);
+        }, () => set({ status: "error" }));
+        supabase.auth.onAuthStateChange((event, session) => {
+            if (event === "SIGNED_OUT")
+                return void loadPermissions(null);
+            if (event === "SIGNED_IN" || event === "USER_UPDATED" || event === "TOKEN_REFRESHED") {
+                const id = session?.user.id ?? null;
+                const claim = rolesFromAccessToken(session?.access_token);
+                if (id && id === snapshot.userId && claim)
+                    set({ roles: claim, rolesLoaded: true });
+                void loadPermissions(id, session?.access_token, event === "USER_UPDATED");
+            }
+        });
+    }
+    catch {
+        set({ status: "error", rolesLoaded: true });
+    }
+}
+/** React-hook op de store. Werkt zonder QueryClientProvider. */
+export function usePermissionSnapshot() {
+    useEffect(() => {
+        ensureSessionWiring();
+    }, []);
+    // Server-snapshot = huidige snapshot: de _authenticated-tree draait met ssr:false.
+    return useSyncExternalStore(subscribePermissions, getPermissionSnapshot, getPermissionSnapshot);
+}
+// ─── Test- en preview-haken (niet in de hoofdbarrel) ──────────────────────────
+export function __setPermissionFetchers(next) {
+    if (next.rows)
+        fetcher = next.rows;
+    if (next.roles)
+        rolesFetcher = next.roles;
+}
+export function __resetPermissionStore() {
+    fetcher = defaultFetcher;
+    rolesFetcher = defaultRolesFetcher;
+    snapshot = { userId: null, status: "loading", rows: [], roles: [], rolesLoaded: false };
+    fetchedAt = 0;
+    inflight = null;
+    inflightUser = undefined;
+    listeners.forEach((l) => l());
+}
+/** Markeert de wiring als gedaan (tests/preview met een mock). */
+export function __disableSessionWiring() {
+    sessionWired = true;
+}