@flowselections/core 1.0.22 → 1.0.24

package/dist/index.js

@@ -1,45 +1,52 @@
 // Auth
-export { useAuth, useAuthState } from "./auth/useAuth";
+export { useAuth, useAuthState } from "./auth/useAuth.js";
 // Supabase
-export { supabase } from "./supabase/client";
+export { supabase } from "./supabase/client.js";
 // Layout
-export { LoginPage } from "./components/layout/LoginPage";
-export { requireAuth, safeRedirectPath, readRedirectParam } from "./auth/redirect";
-export { HandoverPage } from "./components/layout/HandoverPage";
-export { ResetWachtwoordPage } from "./components/layout/ResetWachtwoordPage";
-export { Header } from "./components/layout/Header";
-export { InstellingenPage } from "./components/layout/InstellingenPage";
-export { Sidebar } from "./components/layout/Sidebar";
-export { AuthenticatedLayout } from "./components/layout/AuthenticatedLayout";
-export { Toaster } from "./components/ui/sonner";
+export { LoginPage } from "./components/layout/LoginPage.js";
+export { requireAuth, safeRedirectPath, readRedirectParam } from "./auth/redirect.js";
+export { resolveModuleAccess, canAccessModule } from "./auth/redirect.js";
+export { useIsSuperadmin, roleFlags } from "./auth/useIsSuperadmin.js";
+export { HandoverPage, DEFAULT_HANDOVER_EXCHANGE_PATH } from "./components/layout/HandoverPage.js";
+export { ResetWachtwoordPage } from "./components/layout/ResetWachtwoordPage.js";
+export { Header } from "./components/layout/Header.js";
+export { InstellingenPage } from "./components/layout/InstellingenPage.js";
+export { Sidebar } from "./components/layout/Sidebar.js";
+export { AuthenticatedLayout, NoAccess } from "./components/layout/AuthenticatedLayout.js";
+export { useSidebarModules } from "./components/layout/Sidebar.js";
+export { useShell, useShellModules } from "./shell/ShellContext.js";
+export { useLogoSrc } from "./hooks/useLogoSrc.js";
+export { Toaster } from "./components/ui/sonner.js";
 // UI components
-export { Button } from "./components/ui/button";
-export { Input } from "./components/ui/input";
-export { Label } from "./components/ui/label";
-export { Textarea } from "./components/ui/textarea";
-export { Switch } from "./components/ui/switch";
-export { Badge } from "./components/ui/badge";
-export { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "./components/ui/card";
-export { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle, DialogTrigger, DialogFooter, DialogClose, } from "./components/ui/dialog";
-export { AlertDialog, AlertDialogAction, AlertDialogCancel, AlertDialogContent, AlertDialogDescription, AlertDialogFooter, AlertDialogHeader, AlertDialogTitle, AlertDialogTrigger, } from "./components/ui/alert-dialog";
-export { Table, TableBody, TableCell, TableHead, TableHeader, TableRow, } from "./components/ui/table";
-export { Select, SelectContent, SelectItem, SelectTrigger, SelectValue, } from "./components/ui/select";
-export { Tabs, TabsContent, TabsList, TabsTrigger } from "./components/ui/tabs";
-export { DropdownMenu, DropdownMenuTrigger, DropdownMenuContent, DropdownMenuItem, DropdownMenuCheckboxItem, DropdownMenuRadioItem, DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuGroup, DropdownMenuPortal, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuRadioGroup, } from "./components/ui/dropdown-menu";
-export { Popover, PopoverContent, PopoverTrigger } from "./components/ui/popover";
-export { Checkbox } from "./components/ui/checkbox";
-export { Separator } from "./components/ui/separator";
-export { Skeleton } from "./components/ui/skeleton";
+export { Button } from "./components/ui/button.js";
+export { Input } from "./components/ui/input.js";
+export { Label } from "./components/ui/label.js";
+export { Textarea } from "./components/ui/textarea.js";
+export { Switch } from "./components/ui/switch.js";
+export { Badge } from "./components/ui/badge.js";
+export { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "./components/ui/card.js";
+export { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle, DialogTrigger, DialogFooter, DialogClose, } from "./components/ui/dialog.js";
+export { AlertDialog, AlertDialogAction, AlertDialogCancel, AlertDialogContent, AlertDialogDescription, AlertDialogFooter, AlertDialogHeader, AlertDialogTitle, AlertDialogTrigger, } from "./components/ui/alert-dialog.js";
+export { Table, TableBody, TableCell, TableHead, TableHeader, TableRow, } from "./components/ui/table.js";
+export { Select, SelectContent, SelectItem, SelectTrigger, SelectValue, } from "./components/ui/select.js";
+export { Tabs, TabsContent, TabsList, TabsTrigger } from "./components/ui/tabs.js";
+export { DropdownMenu, DropdownMenuTrigger, DropdownMenuContent, DropdownMenuItem, DropdownMenuCheckboxItem, DropdownMenuRadioItem, DropdownMenuLabel, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuGroup, DropdownMenuPortal, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuRadioGroup, } from "./components/ui/dropdown-menu.js";
+export { Popover, PopoverContent, PopoverTrigger } from "./components/ui/popover.js";
+export { Checkbox } from "./components/ui/checkbox.js";
+export { Separator } from "./components/ui/separator.js";
+export { Skeleton } from "./components/ui/skeleton.js";
 export { toast } from "sonner";
 // Utilities
-export { cn } from "./lib/utils";
-export { validateFileUpload, ALLOWED_FILE_TYPES, loginSchema } from "./lib/validationSchemas";
-export { useIsMobile } from "./hooks/use-mobile";
-export { useHuisstijl } from "./hooks/useHuisstijl";
-export { moduleKey, navKey } from "./types/module.js";
+export { cn } from "./lib/utils.js";
+export { validateFileUpload, ALLOWED_FILE_TYPES, loginSchema } from "./lib/validationSchemas.js";
+export { useIsMobile } from "./hooks/use-mobile.js";
+export { useHuisstijl } from "./hooks/useHuisstijl.js";
+export { moduleKey, navKey, featureKey, moduleFeatures } from "./types/module.js";
 // Shell-extensiepunten (allemaal optioneel; zonder provider ongewijzigd gedrag)
-export { ShellExtensionsProvider, useModuleListTransform } from "./extensions/ShellExtensions.js";
+export { ShellExtensionsProvider, useModuleListTransform, useFooterItems } from "./extensions/ShellExtensions.js";
 export { ModuleGuardSlot } from "./extensions/ModuleGuardSlot.js";
 // Rechten (leeskant; fail-open, zie README)
-export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, } from "./permissions/useModulePermission.js";
+export { useMyModulePermissions, useModulePermission, useModulePermissionTransform, useCan, Can, usePermissionFilteredModules, } from "./permissions/useModulePermission.js";
+export { filterModules, resolveLevel } from "./permissions/resolve.js";
+export { usePermissionSnapshot } from "./permissions/store.js";
 export { ModuleAccessGuard } from "./permissions/ModuleAccessGuard.js";

package/dist/permissions/resolve.d.ts

@@ -0,0 +1,22 @@
+import type { FlowModule } from "../types/module.js";
+export type PermissionLevel = "none" | "view" | "edit";
+export interface ModulePermissionRow {
+    moduleId: string;
+    featureId: string | null;
+    permission: PermissionLevel;
+}
+export declare const RANK: Record<PermissionLevel, number>;
+export declare function normalizeLevel(value: unknown): PermissionLevel;
+/** RPC-rijen → genormaliseerd. Moduleniveau is `feature_id = ''` → `null`. */
+export declare function normalizeRows(data: unknown): ModulePermissionRow[];
+/** Feature-rij, anders modulerij, anders default-allow. */
+export declare function resolveLevel(rows: ModulePermissionRow[], moduleId: string, featureId?: string | null): PermissionLevel;
+/**
+ * Pure zijbalkfilter. `none` weg; groep zonder zichtbare kinderen verdwijnt,
+ * tenzij de module een eigen link heeft (nav.href niet tussen de kinderen) en
+ * zelf toegankelijk is — dan blijft hij als gewone link staan.
+ */
+export declare function filterModules(modules: FlowModule[], rows: ModulePermissionRow[]): FlowModule[];
+/** Paden die nooit door de route-guard worden beperkt. */
+export declare const EXEMPT_KEYS: Set<string>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/permissions/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/core/permissions/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAiC,CAAC;AAEnF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAI9D;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,EAAE,CAalE;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EAAE,EAC3B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,eAAe,CAajB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,UAAU,EAAE,CAyB9F;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,aAAsF,CAAC"}

package/dist/permissions/resolve.js

@@ -0,0 +1,76 @@
+import { featureKey, moduleKey, navKey } from "../types/module.js";
+export const RANK = { none: 0, view: 1, edit: 2 };
+export function normalizeLevel(value) {
+    const v = typeof value === "string" ? value.toLowerCase() : "";
+    if (v === "none" || v === "view" || v === "edit")
+        return v;
+    return "edit"; // onbekend → fail-open
+}
+/** RPC-rijen → genormaliseerd. Moduleniveau is `feature_id = ''` → `null`. */
+export function normalizeRows(data) {
+    if (!Array.isArray(data))
+        return [];
+    return data.map((raw) => {
+        const row = (raw ?? {});
+        const rawModule = String(row["module_id"] ?? row["moduleId"] ?? "");
+        const rawFeature = row["feature_id"] ?? row["featureId"] ?? null;
+        const feature = typeof rawFeature === "string" && rawFeature !== "" ? rawFeature : null;
+        return {
+            moduleId: navKey(rawModule),
+            featureId: feature,
+            permission: normalizeLevel(row["permission"] ?? row["level"] ?? row["permission_level"]),
+        };
+    });
+}
+/** Feature-rij, anders modulerij, anders default-allow. */
+export function resolveLevel(rows, moduleId, featureId) {
+    const key = navKey(moduleId) || moduleId;
+    const forModule = rows.filter((r) => r.moduleId === key);
+    if (forModule.length === 0)
+        return "edit";
+    if (featureId) {
+        const feature = forModule.find((r) => r.featureId === featureId);
+        if (feature)
+            return feature.permission;
+    }
+    const moduleLevel = forModule.find((r) => !r.featureId);
+    if (moduleLevel)
+        return moduleLevel.permission;
+    if (forModule.some((r) => r.permission === "edit"))
+        return "edit";
+    if (forModule.some((r) => r.permission === "view"))
+        return "view";
+    return "none";
+}
+/**
+ * Pure zijbalkfilter. `none` weg; groep zonder zichtbare kinderen verdwijnt,
+ * tenzij de module een eigen link heeft (nav.href niet tussen de kinderen) en
+ * zelf toegankelijk is — dan blijft hij als gewone link staan.
+ */
+export function filterModules(modules, rows) {
+    if (rows.length === 0)
+        return modules;
+    const result = [];
+    for (const mod of modules) {
+        const children = mod.nav.children;
+        if (children?.length) {
+            const allowed = children.filter((child) => resolveLevel(rows, navKey(child.href), child.featureId ?? (featureKey(child.href) || null)) !==
+                "none");
+            if (allowed.length > 0) {
+                result.push({ ...mod, nav: { ...mod.nav, children: allowed } });
+                continue;
+            }
+            const ownLink = !children.some((c) => c.href === mod.nav.href);
+            if (ownLink && resolveLevel(rows, moduleKey(mod)) !== "none") {
+                result.push({ ...mod, nav: { ...mod.nav, children: undefined } });
+            }
+            continue;
+        }
+        if (resolveLevel(rows, moduleKey(mod), mod.nav.featureId ?? null) === "none")
+            continue;
+        result.push(mod);
+    }
+    return result;
+}
+/** Paden die nooit door de route-guard worden beperkt. */
+export const EXEMPT_KEYS = new Set(["", "instellingen", "login", "logout", "auth", "reset-wachtwoord", "api"]);

package/dist/permissions/store.d.ts

@@ -0,0 +1,38 @@
+import { type ModulePermissionRow } from "./resolve.js";
+export type PermissionStatus = "loading" | "ready" | "error" | "timeout";
+export interface PermissionSnapshot {
+    userId: string | null;
+    status: PermissionStatus;
+    rows: ModulePermissionRow[];
+    /** Rollen uit de JWT-claim `user_roles`, terugval tabel `user_roles`. */
+    roles: string[];
+    rolesLoaded: boolean;
+}
+export declare const PERMISSION_TIMEOUT_MS = 3000;
+type Fetcher = () => Promise<unknown>;
+type RolesFetcher = (userId: string) => Promise<string[]>;
+export declare function subscribePermissions(listener: () => void): () => boolean;
+export declare function getPermissionSnapshot(): PermissionSnapshot;
+/** Rollen uit een JWT (claim `user_roles`). Geen verificatie: alleen UI. */
+export declare function rolesFromAccessToken(token: string | undefined | null): string[] | null;
+/**
+ * Laadt rechten (en rollen) voor `userId`. Dedupliceert en cachet 5 min.
+ * Na 3 s zonder antwoord gaat de status op `timeout` (fail-open); komt het
+ * antwoord later alsnog, dan wordt het `ready`.
+ */
+export declare function loadPermissions(userId: string | null, accessToken?: string | null, force?: boolean): Promise<void>;
+/** Wacht maximaal `ms` op rechten. Resolvet altijd (fail-open). */
+export declare function waitForPermissions(userId: string | null, accessToken?: string | null, ms?: number): Promise<PermissionSnapshot>;
+/** Koppelt de store eenmalig aan de Supabase-sessie (alleen in de browser). */
+export declare function ensureSessionWiring(): void;
+/** React-hook op de store. Werkt zonder QueryClientProvider. */
+export declare function usePermissionSnapshot(): PermissionSnapshot;
+export declare function __setPermissionFetchers(next: {
+    rows?: Fetcher;
+    roles?: RolesFetcher;
+}): void;
+export declare function __resetPermissionStore(): void;
+/** Markeert de wiring als gedaan (tests/preview met een mock). */
+export declare function __disableSessionWiring(): void;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/permissions/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/core/permissions/store.ts"],"names":[],"mappings":"AASA,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC5B,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAG1C,KAAK,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;AACtC,KAAK,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AA8B1D,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,IAAI,iBAGxD;AACD,wBAAgB,qBAAqB,uBAEpC;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,GAAG,IAAI,CAetF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAC3B,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,SAAwB,+BAchH;AAGD,+EAA+E;AAC/E,wBAAgB,mBAAmB,SAmBlC;AAED,gEAAgE;AAChE,wBAAgB,qBAAqB,IAAI,kBAAkB,CAM1D;AAID,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,CAAA;CAAE,QAGrF;AACD,wBAAgB,sBAAsB,SAQrC;AACD,kEAAkE;AAClE,wBAAgB,sBAAsB,SAErC"}

package/dist/permissions/store.js

@@ -0,0 +1,180 @@
+/**
+ * Gedeelde rechten- en rollencache zonder React Query (sinds 1.0.23).
+ *
+ * De automatische paden (zijbalkfilter, route-guard, useIsSuperadmin) lezen
+ * hier via useSyncExternalStore. Werkt dus ook in shells zonder
+ * QueryClientProvider. Zichtbaarheid, geen beveiliging.
+ */
+import { useEffect, useSyncExternalStore } from "react";
+import { supabase } from "../supabase/client.js";
+import { normalizeRows } from "./resolve.js";
+export const PERMISSION_TIMEOUT_MS = 3000;
+const STALE_MS = 5 * 60 * 1000;
+const defaultFetcher = async () => {
+    const { data, error } = await supabase.rpc("my_module_permissions");
+    if (error)
+        throw error;
+    return data;
+};
+const defaultRolesFetcher = async (userId) => {
+    const { data, error } = await supabase.from("user_roles").select("role").eq("user_id", userId);
+    if (error || !Array.isArray(data))
+        return [];
+    return data.map((r) => String(r.role));
+};
+let fetcher = defaultFetcher;
+let rolesFetcher = defaultRolesFetcher;
+let snapshot = { userId: null, status: "loading", rows: [], roles: [], rolesLoaded: false };
+let fetchedAt = 0;
+let inflight = null;
+let inflightUser;
+const listeners = new Set();
+function set(next) {
+    snapshot = { ...snapshot, ...next };
+    listeners.forEach((l) => l());
+}
+export function subscribePermissions(listener) {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+}
+export function getPermissionSnapshot() {
+    return snapshot;
+}
+/** Rollen uit een JWT (claim `user_roles`). Geen verificatie: alleen UI. */
+export function rolesFromAccessToken(token) {
+    if (!token)
+        return null;
+    try {
+        const part = token.split(".")[1];
+        if (!part)
+            return null;
+        const json = typeof atob === "function"
+            ? atob(part.replace(/-/g, "+").replace(/_/g, "/"))
+            : Buffer.from(part, "base64").toString("utf8");
+        const claims = JSON.parse(json);
+        const roles = claims["user_roles"];
+        return Array.isArray(roles) ? roles.map(String) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Laadt rechten (en rollen) voor `userId`. Dedupliceert en cachet 5 min.
+ * Na 3 s zonder antwoord gaat de status op `timeout` (fail-open); komt het
+ * antwoord later alsnog, dan wordt het `ready`.
+ */
+export function loadPermissions(userId, accessToken, force = false) {
+    if (!userId) {
+        fetchedAt = Date.now();
+        set({ userId: null, status: "ready", rows: [], roles: [], rolesLoaded: true });
+        return Promise.resolve();
+    }
+    const fresh = snapshot.userId === userId && snapshot.status === "ready" && Date.now() - fetchedAt < STALE_MS;
+    if (!force && fresh)
+        return Promise.resolve();
+    if (!force && inflight && inflightUser === userId)
+        return inflight;
+    if (snapshot.userId !== userId) {
+        const claimRoles = rolesFromAccessToken(accessToken);
+        set({ userId, status: "loading", rows: [], roles: claimRoles ?? [], rolesLoaded: !!claimRoles });
+    }
+    else if (snapshot.status !== "ready") {
+        set({ status: "loading" });
+    }
+    inflightUser = userId;
+    const timer = setTimeout(() => {
+        if (snapshot.userId === userId && snapshot.status === "loading")
+            set({ status: "timeout" });
+    }, PERMISSION_TIMEOUT_MS);
+    const p = (async () => {
+        const [perm, roles] = await Promise.allSettled([
+            fetcher(),
+            snapshot.rolesLoaded ? Promise.resolve(snapshot.roles) : rolesFetcher(userId),
+        ]);
+        clearTimeout(timer);
+        if (snapshot.userId !== userId)
+            return;
+        const roleList = roles.status === "fulfilled" ? roles.value : snapshot.roles;
+        if (perm.status === "fulfilled") {
+            fetchedAt = Date.now();
+            set({ status: "ready", rows: normalizeRows(perm.value), roles: roleList, rolesLoaded: true });
+        }
+        else {
+            // Ontbrekende RPC of andere fout: fail-open, geen retry.
+            set({ status: "error", rows: [], roles: roleList, rolesLoaded: true });
+        }
+    })().finally(() => {
+        if (inflight === p)
+            inflight = null;
+    });
+    inflight = p;
+    return p;
+}
+/** Wacht maximaal `ms` op rechten. Resolvet altijd (fail-open). */
+export function waitForPermissions(userId, accessToken, ms = PERMISSION_TIMEOUT_MS) {
+    return new Promise((resolve) => {
+        const t = setTimeout(() => resolve(snapshot), ms);
+        loadPermissions(userId, accessToken).then(() => {
+            clearTimeout(t);
+            resolve(snapshot);
+        }, () => {
+            clearTimeout(t);
+            resolve(snapshot);
+        });
+    });
+}
+let sessionWired = false;
+/** Koppelt de store eenmalig aan de Supabase-sessie (alleen in de browser). */
+export function ensureSessionWiring() {
+    if (sessionWired || typeof window === "undefined")
+        return;
+    sessionWired = true;
+    try {
+        supabase.auth.getSession().then(({ data }) => {
+            loadPermissions(data.session?.user.id ?? null, data.session?.access_token);
+        }, () => set({ status: "error" }));
+        supabase.auth.onAuthStateChange((event, session) => {
+            if (event === "SIGNED_OUT")
+                return void loadPermissions(null);
+            if (event === "SIGNED_IN" || event === "USER_UPDATED" || event === "TOKEN_REFRESHED") {
+                const id = session?.user.id ?? null;
+                const claim = rolesFromAccessToken(session?.access_token);
+                if (id && id === snapshot.userId && claim)
+                    set({ roles: claim, rolesLoaded: true });
+                void loadPermissions(id, session?.access_token, event === "USER_UPDATED");
+            }
+        });
+    }
+    catch {
+        set({ status: "error", rolesLoaded: true });
+    }
+}
+/** React-hook op de store. Werkt zonder QueryClientProvider. */
+export function usePermissionSnapshot() {
+    useEffect(() => {
+        ensureSessionWiring();
+    }, []);
+    // Server-snapshot = huidige snapshot: de _authenticated-tree draait met ssr:false.
+    return useSyncExternalStore(subscribePermissions, getPermissionSnapshot, getPermissionSnapshot);
+}
+// ─── Test- en preview-haken (niet in de hoofdbarrel) ──────────────────────────
+export function __setPermissionFetchers(next) {
+    if (next.rows)
+        fetcher = next.rows;
+    if (next.roles)
+        rolesFetcher = next.roles;
+}
+export function __resetPermissionStore() {
+    fetcher = defaultFetcher;
+    rolesFetcher = defaultRolesFetcher;
+    snapshot = { userId: null, status: "loading", rows: [], roles: [], rolesLoaded: false };
+    fetchedAt = 0;
+    inflight = null;
+    inflightUser = undefined;
+    listeners.forEach((l) => l());
+}
+/** Markeert de wiring als gedaan (tests/preview met een mock). */
+export function __disableSessionWiring() {
+    sessionWired = true;
+}

package/dist/permissions/useModulePermission.d.ts

@@ -1,22 +1,22 @@
+import type { ReactNode } from "react";
+import type { FlowModule } from "../types/module.js";
 import type { ModuleListTransform } from "../extensions/ShellExtensions.js";
-export type PermissionLevel = "none" | "view" | "edit";
-export interface ModulePermissionRow {
-    moduleId: string;
-    featureId: string | null;
-    permission: PermissionLevel;
-}
+import { type ModulePermissionRow, type PermissionLevel } from "./resolve.js";
+export type { PermissionLevel, ModulePermissionRow } from "./resolve.js";
 /**
- * Leest de rechten van de ingelogde gebruiker via RPC `my_module_permissions()`.
+ * Rechten van de ingelogde gebruiker via RPC `my_module_permissions()`.
  *
- * Ontbreekt de RPC (add-on niet geïnstalleerd) of faalt de call, dan is het
- * resultaat een LEGE lijst zonder zichtbare fout en zonder retry — en dat
- * betekent bij alle consumers default-allow.
+ * Draait op de gedeelde store; gebruikt React Query alleen als er een
+ * QueryClientProvider is, anders een interne client — crasht nooit zonder
+ * provider. Fail-open: fout of ontbrekende RPC → lege lijst → default-allow.
+ * Zichtbaarheid, geen beveiliging.
  */
 export declare function useMyModulePermissions(): {
+    data: ModulePermissionRow[] | undefined;
     permissions: ModulePermissionRow[];
     /** True zolang we niets weten; callers behandelen dit als allow. */
     isUnknown: boolean;
-    data: ModulePermissionRow[];
+    status: import("./store.js").PermissionStatus;
     error: Error;
     isError: true;
     isPending: false;
@@ -25,7 +25,6 @@ export declare function useMyModulePermissions(): {
     isRefetchError: true;
     isSuccess: false;
     isPlaceholderData: false;
-    status: "error";
     dataUpdatedAt: number;
     errorUpdatedAt: number;
     failureCount: number;
@@ -43,10 +42,11 @@ export declare function useMyModulePermissions(): {
     fetchStatus: import("@tanstack/query-core").FetchStatus;
     promise: Promise<ModulePermissionRow[]>;
 } | {
+    data: ModulePermissionRow[] | undefined;
     permissions: ModulePermissionRow[];
     /** True zolang we niets weten; callers behandelen dit als allow. */
     isUnknown: boolean;
-    data: ModulePermissionRow[];
+    status: import("./store.js").PermissionStatus;
     error: null;
     isError: false;
     isPending: false;
@@ -55,7 +55,6 @@ export declare function useMyModulePermissions(): {
     isRefetchError: false;
     isSuccess: true;
     isPlaceholderData: false;
-    status: "success";
     dataUpdatedAt: number;
     errorUpdatedAt: number;
     failureCount: number;
@@ -73,10 +72,11 @@ export declare function useMyModulePermissions(): {
     fetchStatus: import("@tanstack/query-core").FetchStatus;
     promise: Promise<ModulePermissionRow[]>;
 } | {
+    data: ModulePermissionRow[] | undefined;
     permissions: ModulePermissionRow[];
     /** True zolang we niets weten; callers behandelen dit als allow. */
     isUnknown: boolean;
-    data: undefined;
+    status: import("./store.js").PermissionStatus;
     error: Error;
     isError: true;
     isPending: false;
@@ -85,7 +85,6 @@ export declare function useMyModulePermissions(): {
     isRefetchError: false;
     isSuccess: false;
     isPlaceholderData: false;
-    status: "error";
     dataUpdatedAt: number;
     errorUpdatedAt: number;
     failureCount: number;
@@ -103,10 +102,11 @@ export declare function useMyModulePermissions(): {
     fetchStatus: import("@tanstack/query-core").FetchStatus;
     promise: Promise<ModulePermissionRow[]>;
 } | {
+    data: ModulePermissionRow[] | undefined;
     permissions: ModulePermissionRow[];
     /** True zolang we niets weten; callers behandelen dit als allow. */
     isUnknown: boolean;
-    data: undefined;
+    status: import("./store.js").PermissionStatus;
     error: null;
     isError: false;
     isPending: true;
@@ -115,7 +115,6 @@ export declare function useMyModulePermissions(): {
     isRefetchError: false;
     isSuccess: false;
     isPlaceholderData: false;
-    status: "pending";
     dataUpdatedAt: number;
     errorUpdatedAt: number;
     failureCount: number;
@@ -133,10 +132,11 @@ export declare function useMyModulePermissions(): {
     fetchStatus: import("@tanstack/query-core").FetchStatus;
     promise: Promise<ModulePermissionRow[]>;
 } | {
+    data: ModulePermissionRow[] | undefined;
     permissions: ModulePermissionRow[];
     /** True zolang we niets weten; callers behandelen dit als allow. */
     isUnknown: boolean;
-    data: undefined;
+    status: import("./store.js").PermissionStatus;
     error: null;
     isError: false;
     isPending: true;
@@ -144,7 +144,6 @@ export declare function useMyModulePermissions(): {
     isRefetchError: false;
     isSuccess: false;
     isPlaceholderData: false;
-    status: "pending";
     dataUpdatedAt: number;
     errorUpdatedAt: number;
     failureCount: number;
@@ -163,10 +162,11 @@ export declare function useMyModulePermissions(): {
     fetchStatus: import("@tanstack/query-core").FetchStatus;
     promise: Promise<ModulePermissionRow[]>;
 } | {
+    data: ModulePermissionRow[] | undefined;
     permissions: ModulePermissionRow[];
     /** True zolang we niets weten; callers behandelen dit als allow. */
     isUnknown: boolean;
-    data: ModulePermissionRow[];
+    status: import("./store.js").PermissionStatus;
     isError: false;
     error: null;
     isPending: false;
@@ -175,7 +175,6 @@ export declare function useMyModulePermissions(): {
     isRefetchError: false;
     isSuccess: true;
     isPlaceholderData: true;
-    status: "success";
     dataUpdatedAt: number;
     errorUpdatedAt: number;
     failureCount: number;
@@ -194,8 +193,8 @@ export declare function useMyModulePermissions(): {
     promise: Promise<ModulePermissionRow[]>;
 };
 /**
- * Rechtenniveau voor één module (optioneel één feature). Tijdens laden en bij
- * elke fout is het antwoord `edit` (fail-open).
+ * Rechtenniveau voor één module (optioneel één feature). Tijdens laden, bij
+ * een fout en voor admin/superadmin: `edit`. Zichtbaarheid, geen beveiliging.
  */
 export declare function useModulePermission(moduleId: string, featureId?: string | null): {
     level: PermissionLevel;
@@ -204,14 +203,35 @@ export declare function useModulePermission(moduleId: string, featureId?: string
     isLoading: boolean;
 };
 /**
- * ModuleListTransform die zijbalkitems met `none` weglaat.
- *
- * - Tijdens laden / bij fouten: lijst ongewijzigd.
- * - Modules zonder rij in het rechtenschema: default-allow.
- * - Groepen: de kinderen bepalen zichtbaarheid. Blijft er geen kind over, dan
- *   valt de groep weg. Is de parent-sleutel geweigerd maar een kind toegestaan,
- *   dan blijft de groep staan met alleen de toegestane kinderen — de parent-href
- *   van een groep is een uitklapknop, geen bestemming.
+ * Sinds 1.0.23. `allowed` = niveau ≥ `level` (standaard `view`). Laden → true.
+ * Zichtbaarheid, geen beveiliging.
+ */
+export declare function useCan(moduleId: string, featureId?: string | null, level?: PermissionLevel): {
+    allowed: boolean;
+    level: PermissionLevel;
+    isLoading: boolean;
+};
+export interface CanProps {
+    module: string;
+    feature?: string | null;
+    level?: PermissionLevel;
+    fallback?: ReactNode;
+    children: ReactNode;
+}
+/** Sinds 1.0.23. Rendert children als `useCan` toestaat. Zichtbaarheid, geen beveiliging. */
+export declare function Can({ module, feature, level, fallback, children }: CanProps): import("react").FunctionComponentElement<import("react").FragmentProps>;
+/**
+ * ModuleListTransform die zijbalkitems met `none` weglaat. Laden/fout/admin →
+ * ongewijzigd. Zichtbaarheid, geen beveiliging.
  */
 export declare function useModulePermissionTransform(): ModuleListTransform;
+/**
+ * Sinds 1.0.23. Zijbalkfilter met laadstatus: `loading` = eerste laden (toon
+ * skeleton); na fout of 3 s time-out de volledige lijst.
+ * Zichtbaarheid, geen beveiliging.
+ */
+export declare function usePermissionFilteredModules(modules: FlowModule[], enabled?: boolean): {
+    modules: FlowModule[];
+    loading: boolean;
+};
 //# sourceMappingURL=useModulePermission.d.ts.map

package/dist/permissions/useModulePermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useModulePermission.d.ts","sourceRoot":"","sources":["../../src/core/permissions/useModulePermission.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAuCD;;;;;;GAMG;AACH,wBAAgB,sBAAsB;;IA0BlC,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGvE;AAyBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;EAW9E;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CAyBlE"}
+{"version":3,"file":"useModulePermission.d.ts","sourceRoot":"","sources":["../../src/core/permissions/useModulePermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAiBzE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB;;;IAuBlC,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAApE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;EAW9E;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,GAAE,eAAwB;;;;EAGlG;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,6FAA6F;AAC7F,wBAAgB,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAc,EAAE,QAAe,EAAE,QAAQ,EAAE,EAAE,QAAQ,2EAG3F;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CASlE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,UAAO;;;EAQjF"}