@flowselections/core 1.0.22 → 1.0.24

package/README.md

@@ -4,6 +4,25 @@ Fundament-module: authenticatie, shell-layout (sidebar/header), instellingen en
 gedeelde UI-componenten. Elke module heeft core als `peerDependency`; de shell
 bepaalt welke core-versie draait.
 
+## Gebruik 1.0.23 niet
+
+**Core 1.0.23 breekt de clientbuild van elke shell** (`"Readable"/"AsyncLocalStorage" is not exported by "__vite-browser-external"`): de handoverpagina trok via een serverfunctie servercode in de clientbundel. Gebruik **1.0.24 of hoger**.
+
+Vanaf 1.0.24 wisselt `HandoverPage` de code in via een server-route in de shell. Het dashboard genereert daarvoor `src/routes/api/public/auth/handover.ts`:
+
+```ts
+import { createFileRoute } from "@tanstack/react-router";
+import { handoverExchangeHandler } from "@flowselections/core/server";
+
+export const Route = createFileRoute("/api/public/auth/handover")({
+  server: { handlers: { POST: handoverExchangeHandler() } },
+});
+```
+
+Ander pad? Geef `exchangePath` mee aan `HandoverPage` of `handoverRoute`. Zonder dit bestand mislukt alleen de handover (neutrale foutmelding); `/login` blijft werken.
+
+`build:pkg` controleert met `scripts/check-client-graph.mjs` dat de hoofdbarrel en `./routes` geen servercode importeren. `npm run verify:consumer` bouwt een minimale consumer-app tegen het gepakte pakket.
+
 ## Modulecontract
 
 ```ts
@@ -111,3 +130,64 @@ retry-storm veroorzaken.
 De browser-client is env-gedreven en lazy (`VITE_SUPABASE_URL` /
 `VITE_SUPABASE_PUBLISHABLE_KEY`, met `SUPABASE_*` fallback voor SSR). Er staat
 geen projectref of key in de code, ook niet als fallback.
+
+## Rechten in 1.0.23
+
+> **Zichtbaarheid, geen beveiliging.** Alles hieronder verbergt of toont UI. De
+> data wordt afgeschermd door RLS en serverfuncties (`requireModulePermission`).
+
+- **Automatisch via `AuthenticatedLayout` + `requireAuth`** — het gegenereerde
+  `_authenticated.tsx` hoeft niet te veranderen.
+  - Zijbalk: eerst het rechtenfilter, dan extensie-transforms (ordening). Uit met
+    `permissions={false}`. Tijdens het eerste laden een skeleton; na een fout of
+    3 s time-out de volledige lijst (fail-open).
+  - `requireAuth` geeft `{ moduleAccess }` terug uit `beforeLoad` (context wordt
+    niet gemuteerd). Bij `none` toont de layout "Geen toegang". Wacht max. 3 s.
+  - Werkt zonder `QueryClientProvider` (gedeelde store, `useSyncExternalStore`).
+- `useCan(module, feature?, level?)` / `<Can>` — niveaus `none < view < edit`.
+- `NavItem.featureId` (anders `featureKey(href)`); groepen zonder zichtbare
+  kinderen verdwijnen, tenzij de module een eigen link heeft.
+- `SettingsCard.moduleId/featureId`: kaarten erven het recht van hun module.
+- Footer: `ShellExtensionsProvider useFooter` kan Instellingen verbergen;
+  Uitloggen is nooit te verbergen.
+- `useIsSuperadmin()` (claim `user_roles`, terugval tabel); server:
+  `getRoleFlags(claims)`, `isSuperadminServer()`. Nooit voor moduletoegang.
+- `useShell()` / `useShellModules()` — ruwe modulelijst + `shellId`.
+- Admin en superadmin zien altijd alles.
+
+### Gedragswijziging `requireModulePermission`
+
+**Vóór 1.0.23 liet deze functie alles door**: de RPC werd zonder `_user_id`
+aangeroepen, werd niet gevonden, en dat gold als "add-on ontbreekt" →
+toegestaan. Sinds 1.0.23 roept hij de 3-argumentversie aan; `_user_id` komt
+uitsluitend uit het geverifieerde token van het verzoek, moduleniveau is
+`_feature_id ''`. Zonder geldige sessie: 401. Controleer serverfuncties die
+erop leunen: ze kunnen nu echt 403 geven.
+
+### Huisstijl
+
+Tokens staan op één plek: `src/core/styles.css`, ook als
+`@flowselections/core/styles.css`. Logo: `logoSrc`-prop, anders `logo` uit
+`/huisstijl.json`, anders `/logo.png`.
+
+## Systeemroutes (`@flowselections/core/routes`, vanaf 1.0.23)
+
+Shells houden per systeemroute een dun omhulsel; core levert de opties:
+
+```tsx
+// src/routes/login.tsx
+import { createFileRoute } from "@tanstack/react-router";
+import { loginRoute } from "@flowselections/core/routes";
+export const Route = createFileRoute("/login")(loginRoute({ landing: "/voorraad" }));
+```
+
+Ook: `resetPasswordRoute({ landing })` (`/reset-wachtwoord`), `landingRoute({ landing })` (`/`),
+`handoverRoute({ landing })` (`/auth/handover`, `ssr: false`). Bij `loginRoute` wint een veilig `?redirect`
+(same-site pad) van `landing`, ook als je al ingelogd bent. Shells met eigen routebestanden blijven werken.
+
+## Publiceren
+
+`vite build` (preview/hosting) schrijft verplicht naar `dist/` en overschrijft dan het pakket. Daarom:
+`prepublishOnly` draait `build:pkg`, dat `dist/` eerst leegmaakt, opnieuw bouwt en met
+`scripts/check-pkg.mjs` controleert dat `dist/` precies het pakket bevat. `npm publish` publiceert dus nooit
+een preview-build.

package/dist/auth/redirect.d.ts

@@ -1,3 +1,4 @@
+import { type PermissionLevel } from "../permissions/resolve.js";
 /**
  * Accepteert alleen een same-site pad: begint met "/", niet met "//",
  * geen backslash, geen schema en geen stuurtekens. Anders `fallback`.
@@ -12,12 +13,40 @@ export interface RequireAuthArgs {
     context: unknown;
     location: {
         href: string;
+        pathname?: string;
     };
 }
+/** Sinds 1.0.23: wat `requireAuth` aan de routecontext toevoegt. */
+export interface ModuleAccessContext {
+    moduleAccess: PermissionLevel;
+}
+/**
+ * Sinds 1.0.23. Moduletoegang voor een pad. Wacht max. 3 s; fout, time-out,
+ * vrijgesteld pad of geen modulerij → `edit` (fail-open).
+ * Zichtbaarheid, geen beveiliging.
+ */
+export declare function resolveModuleAccess(path: string, opts?: {
+    userId?: string | null;
+    accessToken?: string | null;
+    roles?: string[];
+}): Promise<PermissionLevel>;
+/** Sinds 1.0.23. `true` tenzij het niveau `none` is. Zichtbaarheid, geen beveiliging. */
+export declare function canAccessModule(path: string, opts?: {
+    userId?: string | null;
+    accessToken?: string | null;
+    roles?: string[];
+}): Promise<boolean>;
 /**
- * Guard voor de `_authenticated`-route (gebruik in beforeLoad, met ssr: false).
- * Zolang auth laadt: geen redirect; de root invalideert de router zodra auth
- * geladen is, waarna deze guard opnieuw draait.
+ * Guard voor de `_authenticated`-route (beforeLoad, met ssr: false).
+ *
+ * - Zolang auth laadt: niets (de root invalideert de router daarna).
+ * - Geen sessie: synchrone redirect naar `loginPath` met `?redirect=`.
+ * - Sinds 1.0.23: geeft `{ moduleAccess }` terug (TanStack voegt dat samen in
+ *   de routecontext; de context wordt niet gemuteerd). Bij `none` rendert
+ *   AuthenticatedLayout "Geen toegang". Fail-open na 3 s of bij een fout.
+ *
+ * Zichtbaarheid, geen beveiliging: data wordt afgeschermd door RLS en
+ * serverfuncties.
  */
-export declare function requireAuth({ context, location }: RequireAuthArgs, loginPath?: string): void;
+export declare function requireAuth({ context, location }: RequireAuthArgs, loginPath?: string): void | ModuleAccessContext | Promise<ModuleAccessContext>;
 //# sourceMappingURL=redirect.d.ts.map

package/dist/auth/redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/core/auth/redirect.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAezE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,EAAE,SAAS,SAAW,GAAG,IAAI,CAI9F"}
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/core/auth/redirect.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAazE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,eAAe,CAAC;CAC/B;AAUD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GACnF,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,yFAAyF;AACzF,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC/E,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,EACtC,SAAS,SAAW,GACnB,IAAI,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuB3D"}

package/dist/auth/redirect.js

@@ -1,4 +1,7 @@
 import { redirect } from "@tanstack/react-router";
+import { navKey } from "../types/module.js";
+import { EXEMPT_KEYS, resolveLevel } from "../permissions/resolve.js";
+import { getPermissionSnapshot, waitForPermissions } from "../permissions/store.js";
 /**
  * Accepteert alleen een same-site pad: begint met "/", niet met "//",
  * geen backslash, geen schema en geen stuurtekens. Anders `fallback`.
@@ -13,8 +16,6 @@ export function safeRedirectPath(value, fallback) {
     // eslint-disable-next-line no-control-regex
     if (/[\u0000-\u001f\u007f]/.test(value))
         return fallback;
-    // Schema vóór het eerste "/", "?" of "#" (bijv. "/javascript:..." is ok, "javascript:" niet;
-    // dat laatste valt al af op de "/"-regel, dit vangt varianten als "/\t//").
     try {
         const url = new URL(value, "http://same.invalid");
         if (url.origin !== "http://same.invalid")
@@ -34,14 +35,64 @@ export function readRedirectParam(fallback) {
         return fallback;
     return safeRedirectPath(new URLSearchParams(window.location.search).get("redirect"), fallback);
 }
+function pathOf(location) {
+    return location.pathname ?? location.href.split("?")[0].split("#")[0];
+}
+function isAdminRoles(roles) {
+    return Array.isArray(roles) && (roles.includes("admin") || roles.includes("superadmin"));
+}
+/**
+ * Sinds 1.0.23. Moduletoegang voor een pad. Wacht max. 3 s; fout, time-out,
+ * vrijgesteld pad of geen modulerij → `edit` (fail-open).
+ * Zichtbaarheid, geen beveiliging.
+ */
+export async function resolveModuleAccess(path, opts = {}) {
+    const key = navKey(path);
+    if (EXEMPT_KEYS.has(key) || isAdminRoles(opts.roles))
+        return "edit";
+    const snap = await waitForPermissions(opts.userId ?? null, opts.accessToken);
+    if (snap.status !== "ready" || isAdminRoles(snap.roles))
+        return "edit";
+    return resolveLevel(snap.rows, key);
+}
+/** Sinds 1.0.23. `true` tenzij het niveau `none` is. Zichtbaarheid, geen beveiliging. */
+export async function canAccessModule(path, opts) {
+    return (await resolveModuleAccess(path, opts)) !== "none";
+}
 /**
- * Guard voor de `_authenticated`-route (gebruik in beforeLoad, met ssr: false).
- * Zolang auth laadt: geen redirect; de root invalideert de router zodra auth
- * geladen is, waarna deze guard opnieuw draait.
+ * Guard voor de `_authenticated`-route (beforeLoad, met ssr: false).
+ *
+ * - Zolang auth laadt: niets (de root invalideert de router daarna).
+ * - Geen sessie: synchrone redirect naar `loginPath` met `?redirect=`.
+ * - Sinds 1.0.23: geeft `{ moduleAccess }` terug (TanStack voegt dat samen in
+ *   de routecontext; de context wordt niet gemuteerd). Bij `none` rendert
+ *   AuthenticatedLayout "Geen toegang". Fail-open na 3 s of bij een fout.
+ *
+ * Zichtbaarheid, geen beveiliging: data wordt afgeschermd door RLS en
+ * serverfuncties.
  */
 export function requireAuth({ context, location }, loginPath = "/login") {
     const auth = context?.auth;
-    if (!auth || auth.loading || auth.isAuthenticated)
+    if (!auth || auth.loading)
         return;
-    throw redirect({ to: loginPath, search: { redirect: location.href } });
+    if (!auth.isAuthenticated) {
+        throw redirect({ to: loginPath, search: { redirect: location.href } });
+    }
+    const path = pathOf(location);
+    const key = navKey(path);
+    const roles = Array.isArray(auth.roles) ? auth.roles : [];
+    if (EXEMPT_KEYS.has(key) || isAdminRoles(roles))
+        return { moduleAccess: "edit" };
+    const userId = auth.user?.id ?? null;
+    const snap = getPermissionSnapshot();
+    if (snap.userId === userId && snap.status !== "loading") {
+        // Synchroon antwoord als de cache al bekend is (geen wachttijd bij navigatie).
+        const level = snap.status === "ready" && !isAdminRoles(snap.roles) ? resolveLevel(snap.rows, key) : "edit";
+        return { moduleAccess: level };
+    }
+    return resolveModuleAccess(path, {
+        userId,
+        accessToken: auth.session?.access_token ?? null,
+        roles,
+    }).then((moduleAccess) => ({ moduleAccess }));
 }

package/dist/auth/roles.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Sinds 1.0.23. Rolvlaggen uit geverifieerde claims (bijv. `context.claims` uit
+ * requireSupabaseAuth). superadmin ⇒ admin. Zichtbaarheid, geen beveiliging.
+ */
+export declare function getRoleFlags(claims: Record<string, unknown> | undefined | null): {
+    roles: string[];
+    isSuperadmin: boolean;
+    isAdmin: boolean;
+};
+//# sourceMappingURL=roles.d.ts.map

package/dist/auth/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/core/auth/roles.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI;;;;EAK9E"}

package/dist/auth/roles.js

@@ -0,0 +1,11 @@
+// Pure rollogica, zonder server- of browserimports: veilig voor client én server.
+/**
+ * Sinds 1.0.23. Rolvlaggen uit geverifieerde claims (bijv. `context.claims` uit
+ * requireSupabaseAuth). superadmin ⇒ admin. Zichtbaarheid, geen beveiliging.
+ */
+export function getRoleFlags(claims) {
+    const raw = claims?.["user_roles"];
+    const roles = Array.isArray(raw) ? raw.map(String) : [];
+    const isSuperadmin = roles.includes("superadmin");
+    return { roles, isSuperadmin, isAdmin: isSuperadmin || roles.includes("admin") };
+}

package/dist/auth/useAuth.d.ts

@@ -1,5 +1,5 @@
 import { User, Session } from "@supabase/supabase-js";
-export type AppRole = "admin" | "manager" | "warehouse" | "sales" | "developer";
+export type AppRole = "admin" | "manager" | "warehouse" | "sales" | "developer" | "superadmin" | "administratie" | "ai_admin" | "monteur" | "planner" | "receptie";
 export interface AuthState {
     user: User | null;
     session: Session | null;

package/dist/auth/useAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/core/auth/useAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,WAAW,CAAC;AAEhF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACnE,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAElD,wBAAgB,YAAY,IAAI,WAAW,CAsE1C;AACD,wBAAgB,OAAO,IAAI,WAAW,CAErC"}
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../../src/core/auth/useAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,MAAM,OAAO,GACf,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,WAAW,GACzD,YAAY,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAErF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACnE,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAElD,wBAAgB,YAAY,IAAI,WAAW,CAsE1C;AACD,wBAAgB,OAAO,IAAI,WAAW,CAErC"}

package/dist/auth/useAuth.js

@@ -1,5 +1,5 @@
 import { useState, useEffect, useCallback } from "react";
-import { supabase } from "../supabase/client";
+import { supabase } from "../supabase/client.js";
 export function useAuthState() {
     const [user, setUser] = useState(null);
     const [session, setSession] = useState(null);

package/dist/auth/useIsSuperadmin.d.ts

@@ -0,0 +1,19 @@
+/** Pure: superadmin ⇒ admin (contract §4). */
+export declare function roleFlags(roles: string[]): {
+    isSuperadmin: boolean;
+    isAdmin: boolean;
+    roles: string[];
+};
+/**
+ * Sinds 1.0.23. Rollen uit de JWT-claim `user_roles`, terugval op tabel
+ * `user_roles`. Nooit gebruiken voor moduletoegang (daarvoor
+ * `my_module_permissions`). Werkt zonder QueryClientProvider.
+ * Zichtbaarheid, geen beveiliging.
+ */
+export declare function useIsSuperadmin(): {
+    isLoading: boolean;
+    isSuperadmin: boolean;
+    isAdmin: boolean;
+    roles: string[];
+};
+//# sourceMappingURL=useIsSuperadmin.d.ts.map

package/dist/auth/useIsSuperadmin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useIsSuperadmin.d.ts","sourceRoot":"","sources":["../../src/core/auth/useIsSuperadmin.ts"],"names":[],"mappings":"AAEA,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;;;;EAGxC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe;;;;;EAG9B"}

package/dist/auth/useIsSuperadmin.js

@@ -0,0 +1,16 @@
+import { usePermissionSnapshot } from "../permissions/store.js";
+/** Pure: superadmin ⇒ admin (contract §4). */
+export function roleFlags(roles) {
+    const isSuperadmin = roles.includes("superadmin");
+    return { isSuperadmin, isAdmin: isSuperadmin || roles.includes("admin"), roles };
+}
+/**
+ * Sinds 1.0.23. Rollen uit de JWT-claim `user_roles`, terugval op tabel
+ * `user_roles`. Nooit gebruiken voor moduletoegang (daarvoor
+ * `my_module_permissions`). Werkt zonder QueryClientProvider.
+ * Zichtbaarheid, geen beveiliging.
+ */
+export function useIsSuperadmin() {
+    const snap = usePermissionSnapshot();
+    return { ...roleFlags(snap.roles), isLoading: !snap.rolesLoaded };
+}

package/dist/components/instellingen/NotificationSettingsCard.js

@@ -1,9 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState, useEffect } from "react";
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "../ui/card";
-import { Switch } from "../ui/switch";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "../ui/card.js";
+import { Switch } from "../ui/switch.js";
 import { Bell, Loader2 } from "lucide-react";
-import { supabase } from "../../supabase/client";
+import { supabase } from "../../supabase/client.js";
 import { toast } from "sonner";
 export function NotificationSettingsCard() {
     const [prefs, setPrefs] = useState({ email_notifications: true });

package/dist/components/layout/AuthenticatedLayout.d.ts

@@ -1,20 +1,29 @@
 import type { ReactNode } from "react";
-import type { SidebarProps } from "./Sidebar";
-/**
- * Alle Sidebar-props (auth, modules, shellId, ...) plus optionele children.
- * Zo verliest een shell bij migratie naar AuthenticatedLayout geen enkele
- * prop die hij voorheen rechtstreeks aan <Sidebar /> gaf.
- */
+import type { SidebarProps } from "./Sidebar.js";
 export type AuthenticatedLayoutProps = SidebarProps & {
     /** Optioneel; standaard rendert de layout <Outlet />. */
     children?: ReactNode;
     /** Toon de gedeelde paginakop. Standaard ingeschakeld. */
     header?: boolean;
 };
+type MatchLike = {
+    staticData?: unknown;
+    context?: unknown;
+};
+/** Sinds 1.0.23: diepste match met een niet-lege titel. */
+export declare function pickTitle(matches: MatchLike[]): string;
+/** Sinds 1.0.23: `moduleAccess` uit de diepste routecontext die hem heeft. */
+export declare function pickModuleAccess(matches: MatchLike[]): string | undefined;
+export declare function NoAccess(): import("react/jsx-runtime").JSX.Element;
 /**
- * Zijbalk + content-offset + mobiele topbalk. Desktop: ml-64 (gelijk aan de
- * oude shell-layout). Mobiel: geen marge, pt-14 onder de topbalk; de sticky
- * Header schuift via --core-topbar-h onder de topbalk.
+ * Zijbalk + content-offset + mobiele topbalk + paginakop.
+ *
+ * Sinds 1.0.23: filtert de zijbalk standaard op rechten (eerst rechten, dan
+ * extensie-transforms; uit met `permissions={false}`), toont "Geen toegang"
+ * als `requireAuth` `moduleAccess: "none"` teruggaf, en levert `useShell()`.
+ * Zichtbaarheid, geen beveiliging: data wordt afgeschermd door RLS en
+ * serverfuncties.
  */
-export declare function AuthenticatedLayout({ children, header, ...sidebarProps }: AuthenticatedLayoutProps): import("react/jsx-runtime").JSX.Element;
+export declare function AuthenticatedLayout({ children, header, permissions, ...sidebarProps }: AuthenticatedLayoutProps): import("react/jsx-runtime").JSX.Element;
+export {};
 //# sourceMappingURL=AuthenticatedLayout.d.ts.map

package/dist/components/layout/AuthenticatedLayout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticatedLayout.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/AuthenticatedLayout.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAGvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG9C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG;IACpD,yDAAyD;IACzD,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,QAAQ,EAAE,MAAa,EAAE,GAAG,YAAY,EAAE,EAAE,wBAAwB,2CAkBzG"}
+{"version":3,"file":"AuthenticatedLayout.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/AuthenticatedLayout.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAGvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIjD,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG;IACpD,yDAAyD;IACzD,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,KAAK,SAAS,GAAG;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7D,2DAA2D;AAC3D,wBAAgB,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,CAMtD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,SAAS,CAMzE;AAED,wBAAgB,QAAQ,4CAWvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,QAAQ,EACR,MAAa,EACb,WAAkB,EAClB,GAAG,YAAY,EAChB,EAAE,wBAAwB,2CA6B1B"}

package/dist/components/layout/AuthenticatedLayout.js

@@ -1,15 +1,49 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useMemo } from "react";
 import { Outlet, useMatches } from "@tanstack/react-router";
-import { Sidebar } from "./Sidebar";
-import { Header } from "./Header";
+import { Sidebar, useSidebarModules } from "./Sidebar.js";
+import { Header } from "./Header.js";
+import { ShellContext } from "../../shell/ShellContext.js";
+/** Sinds 1.0.23: diepste match met een niet-lege titel. */
+export function pickTitle(matches) {
+    for (let i = matches.length - 1; i >= 0; i--) {
+        const t = matches[i].staticData?.title;
+        if (typeof t === "string" && t.trim() !== "")
+            return t;
+    }
+    return "";
+}
+/** Sinds 1.0.23: `moduleAccess` uit de diepste routecontext die hem heeft. */
+export function pickModuleAccess(matches) {
+    for (let i = matches.length - 1; i >= 0; i--) {
+        const v = matches[i].context?.moduleAccess;
+        if (typeof v === "string")
+            return v;
+    }
+    return undefined;
+}
+export function NoAccess() {
+    return (_jsx("div", { className: "flex min-h-[60vh] items-center justify-center p-8", children: _jsxs("div", { className: "max-w-md text-center", children: [_jsx("h1", { className: "text-lg font-semibold text-foreground", children: "Geen toegang" }), _jsx("p", { className: "mt-2 text-sm text-muted-foreground", children: "Je hebt geen rechten voor deze module. Vraag een beheerder om toegang." })] }) }));
+}
 /**
- * Zijbalk + content-offset + mobiele topbalk. Desktop: ml-64 (gelijk aan de
- * oude shell-layout). Mobiel: geen marge, pt-14 onder de topbalk; de sticky
- * Header schuift via --core-topbar-h onder de topbalk.
+ * Zijbalk + content-offset + mobiele topbalk + paginakop.
+ *
+ * Sinds 1.0.23: filtert de zijbalk standaard op rechten (eerst rechten, dan
+ * extensie-transforms; uit met `permissions={false}`), toont "Geen toegang"
+ * als `requireAuth` `moduleAccess: "none"` teruggaf, en levert `useShell()`.
+ * Zichtbaarheid, geen beveiliging: data wordt afgeschermd door RLS en
+ * serverfuncties.
  */
-export function AuthenticatedLayout({ children, header = true, ...sidebarProps }) {
+export function AuthenticatedLayout({ children, header = true, permissions = true, ...sidebarProps }) {
     const matches = useMatches();
-    const titleMatch = [...matches].reverse().find((match) => typeof match.staticData?.title === "string");
-    const title = titleMatch?.staticData?.title ?? "";
-    return (_jsxs("div", { className: "min-h-screen bg-background [--core-topbar-h:3.5rem] md:[--core-topbar-h:0px]", children: [_jsx(Sidebar, { ...sidebarProps }), _jsxs("div", { className: "flex min-h-dvh flex-col pt-14 md:ml-64 md:pt-0", children: [header && _jsx(Header, { title: title }), _jsx("main", { className: "flex-1", children: children ?? _jsx(Outlet, {}) })] })] }));
+    const title = pickTitle(matches);
+    const access = pickModuleAccess(matches);
+    const { visibleModules, loading } = useSidebarModules(sidebarProps.modules, permissions);
+    const shell = useMemo(() => ({
+        shellId: sidebarProps.shellId,
+        modules: sidebarProps.modules,
+        visibleModules,
+        permissionsLoading: loading,
+    }), [sidebarProps.shellId, sidebarProps.modules, visibleModules, loading]);
+    return (_jsx(ShellContext.Provider, { value: shell, children: _jsxs("div", { className: "min-h-screen bg-background [--core-topbar-h:3.5rem] md:[--core-topbar-h:0px]", children: [_jsx(Sidebar, { ...sidebarProps, permissions: permissions, visibleModules: visibleModules, loading: loading }), _jsxs("div", { className: "flex min-h-dvh flex-col pt-14 md:ml-64 md:pt-0", children: [header && _jsx(Header, { title: title }), _jsx("main", { className: "flex-1", children: permissions && access === "none" ? _jsx(NoAccess, {}) : (children ?? _jsx(Outlet, {})) })] })] }) }));
 }

package/dist/components/layout/BugsDialog.js

@@ -1,17 +1,17 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect, useRef } from "react";
-import { Dialog, DialogContent, DialogHeader, DialogTitle } from "../ui/dialog";
-import { Button } from "../ui/button";
-import { Input } from "../ui/input";
-import { Textarea } from "../ui/textarea";
-import { Label } from "../ui/label";
-import { Badge } from "../ui/badge";
-import { Select, SelectContent, SelectItem, SelectTrigger } from "../ui/select";
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "../ui/tabs";
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from "../ui/dialog.js";
+import { Button } from "../ui/button.js";
+import { Input } from "../ui/input.js";
+import { Textarea } from "../ui/textarea.js";
+import { Label } from "../ui/label.js";
+import { Badge } from "../ui/badge.js";
+import { Select, SelectContent, SelectItem, SelectTrigger } from "../ui/select.js";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "../ui/tabs.js";
 import { Plus, Loader2, CheckCircle, Trash2, Paperclip, X, FileText } from "lucide-react";
-import { supabase } from "../../supabase/client";
+import { supabase } from "../../supabase/client.js";
 import { toast } from "sonner";
-import { bugReportSchema, validateFileUpload, ALLOWED_FILE_TYPES } from "../../lib/validationSchemas";
+import { bugReportSchema, validateFileUpload, ALLOWED_FILE_TYPES } from "../../lib/validationSchemas.js";
 const statusConfig = {
     open: { label: "Open", variant: "destructive" },
     in_progress: { label: "In behandeling", variant: "default" },

package/dist/components/layout/HandoverPage.d.ts

@@ -3,6 +3,10 @@ export interface HandoverPageProps {
     redirectTo?: string;
     /** Pad van de (centrale) inlogpagina voor de foutknop. */
     loginPath?: string;
+    /** Server-route die de code inwisselt. Standaard "/api/public/auth/handover". */
+    exchangePath?: string;
 }
-export declare function HandoverPage({ redirectTo, loginPath }: HandoverPageProps): import("react/jsx-runtime").JSX.Element;
+/** Sinds 1.0.24: standaardpad van de handover-server-route in de shell. */
+export declare const DEFAULT_HANDOVER_EXCHANGE_PATH = "/api/public/auth/handover";
+export declare function HandoverPage({ redirectTo, loginPath, exchangePath, }: HandoverPageProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=HandoverPage.d.ts.map

package/dist/components/layout/HandoverPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HandoverPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/HandoverPage.tsx"],"names":[],"mappings":"AAQA,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,wBAAgB,YAAY,CAAC,EAAE,UAAgB,EAAE,SAAoB,EAAE,EAAE,iBAAiB,2CA0FzF"}
+{"version":3,"file":"HandoverPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/HandoverPage.tsx"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAoB1E,wBAAgB,YAAY,CAAC,EAC3B,UAAgB,EAChB,SAAoB,EACpB,YAA6C,GAC9C,EAAE,iBAAiB,2CA0FnB"}

package/dist/components/layout/HandoverPage.js

@@ -1,13 +1,30 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect, useRef, useState } from "react";
 import { useRouter } from "@tanstack/react-router";
-import { Button } from "../ui/button";
-import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "../ui/card";
-import { supabase } from "../../supabase/client";
-import { readRedirectParam } from "../../auth/redirect";
-import { exchangeHandover } from "../../auth/handover.functions.js";
+import { Button } from "../ui/button.js";
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "../ui/card.js";
+import { supabase } from "../../supabase/client.js";
+import { readRedirectParam } from "../../auth/redirect.js";
+/** Sinds 1.0.24: standaardpad van de handover-server-route in de shell. */
+export const DEFAULT_HANDOVER_EXCHANGE_PATH = "/api/public/auth/handover";
+async function exchangeHandover(exchangePath, code) {
+    const res = await fetch(exchangePath, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        credentials: "same-origin",
+        cache: "no-store",
+        body: JSON.stringify({ code }),
+    });
+    if (!res.ok)
+        throw new Error("handover_failed");
+    const body = (await res.json());
+    if (typeof body.accessToken !== "string" || typeof body.refreshToken !== "string") {
+        throw new Error("handover_failed");
+    }
+    return { accessToken: body.accessToken, refreshToken: body.refreshToken };
+}
 const FOUTMELDING = "Inloggen is niet gelukt. Probeer het opnieuw vanaf de inlogpagina.";
-export function HandoverPage({ redirectTo = "/", loginPath = "/login" }) {
+export function HandoverPage({ redirectTo = "/", loginPath = "/login", exchangePath = DEFAULT_HANDOVER_EXCHANGE_PATH, }) {
     const router = useRouter();
     const [failed, setFailed] = useState(false);
     const started = useRef(false);
@@ -39,7 +56,7 @@ export function HandoverPage({ redirectTo = "/", loginPath = "/login" }) {
             const cleanUrl = window.location.pathname + window.location.hash;
             window.history.replaceState(null, "", cleanUrl);
             try {
-                const result = await exchangeHandover({ data: { code } });
+                const result = await exchangeHandover(exchangePath, code);
                 const { error } = await supabase.auth.setSession({
                     access_token: result.accessToken,
                     refresh_token: result.refreshToken,

package/dist/components/layout/Header.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState } from "react";
 import { Bug, Search } from "lucide-react";
-import { Input } from "../ui/input";
-import { Button } from "../ui/button";
-import { BugsDialog } from "./BugsDialog";
-import { NotificationBell } from "./NotificationBell";
+import { Input } from "../ui/input.js";
+import { Button } from "../ui/button.js";
+import { BugsDialog } from "./BugsDialog.js";
+import { NotificationBell } from "./NotificationBell.js";
 export function Header({ title }) {
     const [bugsDialogOpen, setBugsDialogOpen] = useState(false);
     return (_jsxs(_Fragment, { children: [_jsxs("header", { className: "sticky top-[var(--core-topbar-h,0px)] md:top-0 z-30 flex h-16 items-center justify-between border-b border-border bg-card px-6", children: [_jsx("h1", { className: "text-xl font-semibold text-foreground", children: title }), _jsxs("div", { className: "flex items-center gap-4", children: [_jsxs("div", { className: "relative hidden md:block", children: [_jsx(Search, { className: "absolute left-3 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground" }), _jsx(Input, { placeholder: "Zoeken...", className: "w-64 pl-9" })] }), _jsxs(Button, { variant: "outline", size: "sm", onClick: () => setBugsDialogOpen(true), children: [_jsx(Bug, { className: "mr-2 h-4 w-4" }), "Bugs melden"] }), _jsx(NotificationBell, {})] })] }), _jsx(BugsDialog, { open: bugsDialogOpen, onOpenChange: setBugsDialogOpen })] }));

package/dist/components/layout/InstellingenPage.d.ts

@@ -1,4 +1,4 @@
-import type { FlowModule } from "../../types/module";
+import type { FlowModule } from "../../types/module.js";
 export declare function InstellingenPage({ modules }: {
     modules: FlowModule[];
 }): import("react/jsx-runtime").JSX.Element;

package/dist/components/layout/InstellingenPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InstellingenPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/InstellingenPage.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,oBAAoB,CAAC;AAqInE,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,UAAU,EAAE,CAAA;CAAE,2CAWtE"}
+{"version":3,"file":"InstellingenPage.d.ts","sourceRoot":"","sources":["../../../src/core/components/layout/InstellingenPage.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,uBAAuB,CAAC;AAwItE,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,UAAU,EAAE,CAAA;CAAE,2CAsBtE"}

package/dist/components/layout/InstellingenPage.js

@@ -1,13 +1,16 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { moduleKey } from "../../types/module.js";
+import { resolveLevel } from "../../permissions/resolve.js";
+import { usePermissionSnapshot } from "../../permissions/store.js";
 import { useState } from "react";
-import { Button } from "../ui/button";
-import { Input } from "../ui/input";
-import { Label } from "../ui/label";
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "../ui/card";
-import { supabase } from "../../supabase/client";
+import { Button } from "../ui/button.js";
+import { Input } from "../ui/input.js";
+import { Label } from "../ui/label.js";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "../ui/card.js";
+import { supabase } from "../../supabase/client.js";
 import { toast } from "sonner";
 import { Loader2, User } from "lucide-react";
-import { NotificationSettingsCard } from "../instellingen/NotificationSettingsCard";
+import { NotificationSettingsCard } from "../instellingen/NotificationSettingsCard.js";
 // ─── Profile Card ─────────────────────────────────────────────────────────────
 function ProfileCard() {
     const [displayName, setDisplayName] = useState("");
@@ -72,7 +75,12 @@ const coreCards = [
 ];
 // ─── Main export ──────────────────────────────────────────────────────────────
 export function InstellingenPage({ modules }) {
-    const moduleCards = modules.flatMap((m) => m.settingsCards);
+    // Sinds 1.0.23: modulekaarten erven het recht van hun module (of featureId).
+    // Core-kaarten altijd. Laden/fout/admin → tonen. Zichtbaarheid, geen beveiliging.
+    const snap = usePermissionSnapshot();
+    const filterOn = snap.status === "ready" && !snap.roles.includes("admin") && !snap.roles.includes("superadmin");
+    const moduleCards = modules.flatMap((m) => m.settingsCards.filter((card) => !filterOn ||
+        resolveLevel(snap.rows, card.moduleId ?? moduleKey(m), card.featureId ?? null) !== "none"));
     const allCards = [...coreCards, ...moduleCards].sort((a, b) => a.order - b.order);
     return (_jsx("div", { className: "p-6", children: _jsx("div", { className: "grid gap-6 lg:grid-cols-2", children: allCards.map((card, i) => _jsx(card.component, {}, i)) }) }));
 }