@infuro/cms-core 1.0.8 → 1.0.10

package/dist/auth.cjs

@@ -30,19 +30,93 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/auth/index.ts
 var auth_exports = {};
 __export(auth_exports, {
+  ADMIN_GROUP_NAME: () => ADMIN_GROUP_NAME,
   OPEN_ENDPOINTS: () => OPEN_ENDPOINTS,
   PERMISSION_REQUIRED_ENDPOINTS: () => PERMISSION_REQUIRED_ENDPOINTS,
+  RBAC_ADMIN_ONLY_ENTITIES: () => RBAC_ADMIN_ONLY_ENTITIES,
+  canManageRoles: () => canManageRoles,
   createAuthHelpers: () => createAuthHelpers,
   createCmsMiddleware: () => createCmsMiddleware,
   defaultPublicApiMethods: () => defaultPublicApiMethods,
   getNextAuthOptions: () => getNextAuthOptions,
+  getPermissionableEntityKeys: () => getPermissionableEntityKeys,
   getRequiredPermission: () => getRequiredPermission,
+  hasEntityPermission: () => hasEntityPermission,
   isOpenEndpoint: () => isOpenEndpoint,
-  isPublicMethod: () => isPublicMethod
+  isPublicMethod: () => isPublicMethod,
+  isSuperAdminGroupName: () => isSuperAdminGroupName,
+  permissionRowsToRecord: () => permissionRowsToRecord,
+  seedAdministratorPermissions: () => seedAdministratorPermissions,
+  sessionHasEntityAccess: () => sessionHasEntityAccess
 });
 module.exports = __toCommonJS(auth_exports);
 
+// src/auth/permission-entities.ts
+var PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
+  "users",
+  "password_reset_tokens",
+  "user_groups",
+  "permissions",
+  "comments",
+  "form_fields",
+  "configs",
+  "knowledge_base_chunks",
+  "carts",
+  "cart_items",
+  "wishlists",
+  "wishlist_items"
+]);
+var PERMISSION_LOGICAL_ENTITIES = [
+  "users",
+  "forms",
+  "form_submissions",
+  "dashboard",
+  "upload",
+  "settings",
+  "analytics",
+  "chat"
+];
+var ADMIN_GROUP_NAME = "Administrator";
+function isSuperAdminGroupName(name) {
+  return name === ADMIN_GROUP_NAME;
+}
+function getPermissionableEntityKeys(entityMap) {
+  const fromMap = Object.keys(entityMap).filter((k) => !PERMISSION_ENTITY_INTERNAL_EXCLUDE.has(k));
+  const logical = PERMISSION_LOGICAL_ENTITIES.filter((k) => !fromMap.includes(k));
+  return [...fromMap.sort(), ...logical].filter((k, i, a) => a.indexOf(k) === i);
+}
+function permissionRowsToRecord(rows) {
+  const out = {};
+  if (!rows?.length) return out;
+  for (const p of rows) {
+    out[p.entity] = {
+      c: !!p.canCreate,
+      r: !!p.canRead,
+      u: !!p.canUpdate,
+      d: !!p.canDelete
+    };
+  }
+  return out;
+}
+function hasEntityPermission(record, entity, action) {
+  const p = record?.[entity];
+  if (!p) return false;
+  if (action === "create") return p.c;
+  if (action === "read") return p.r;
+  if (action === "update") return p.u;
+  return p.d;
+}
+
 // src/auth/helpers.ts
+var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set(["users", "user_groups", "permissions"]);
+function sessionHasEntityAccess(user, entity, action) {
+  if (!user?.email) return false;
+  if (user.isRBACAdmin && RBAC_ADMIN_ONLY_ENTITIES.has(entity)) return true;
+  return hasEntityPermission(user.entityPerms, entity, action);
+}
+function canManageRoles(user) {
+  return !!(user?.email && user.isRBACAdmin);
+}
 var OPEN_ENDPOINTS = [
   { "/api/contacts": ["POST"] },
   { "/api/form-submissions": ["POST"] },
@@ -78,6 +152,25 @@ function createAuthHelpers(getSession, NextResponse) {
       }
       return null;
     },
+    async requireEntityPermission(_req, entity, action) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      const u = session.user;
+      if (sessionHasEntityAccess(u, entity, action)) return null;
+      return NextResponse.json({ error: "Forbidden", entity, action }, { status: 403 });
+    },
+    async requireAdminAccess() {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      const u = session.user;
+      if (u.isRBACAdmin) return null;
+      if (u.adminAccess === false) return NextResponse.json({ error: "Forbidden", reason: "admin_access" }, { status: 403 });
+      return null;
+    },
     async getAuthenticatedUser() {
       const session = await getSession();
       return session?.user ?? null;
@@ -85,6 +178,36 @@ function createAuthHelpers(getSession, NextResponse) {
   };
 }
 
+// src/auth/seed-permissions.ts
+async function seedAdministratorPermissions(dataSource, entityMap) {
+  const entities = getPermissionableEntityKeys(entityMap);
+  const groupRepo = dataSource.getRepository(entityMap.user_groups);
+  const permRepo = dataSource.getRepository(entityMap.permissions);
+  const adminGroup = await groupRepo.findOne({ where: { name: ADMIN_GROUP_NAME, deleted: false } });
+  if (!adminGroup) return;
+  const fullCrud = { canCreate: true, canRead: true, canUpdate: true, canDelete: true };
+  for (const entity of entities) {
+    const existing = await permRepo.findOne({
+      where: { groupId: adminGroup.id, entity }
+    });
+    if (existing) {
+      existing.canCreate = true;
+      existing.canRead = true;
+      existing.canUpdate = true;
+      existing.canDelete = true;
+      await permRepo.save(existing);
+    } else {
+      await permRepo.save(
+        permRepo.create({
+          groupId: adminGroup.id,
+          entity,
+          ...fullCrud
+        })
+      );
+    }
+  }
+}
+
 // src/auth/middleware.ts
 var defaultPublicApiMethods = {
   "/api/contacts": ["POST"],
@@ -159,12 +282,18 @@ function getNextAuthOptions(config) {
             if (!user || user.blocked || user.deleted || !user.password) return null;
             const valid = await comparePassword(credentials.password, user.password);
             if (!valid) return null;
+            const g = user.group;
+            const isRBACAdmin = isSuperAdminGroupName(g?.name);
+            const entityPerms = permissionRowsToRecord(g?.permissions);
+            const adminAccess = user.adminAccess === true;
             return {
               id: user.id.toString(),
               email: user.email,
               name: user.name,
               groupId: user.groupId ?? void 0,
-              permissions: ["admin"]
+              isRBACAdmin,
+              entityPerms,
+              adminAccess
             };
           } catch {
             return null;
@@ -188,17 +317,23 @@ function getNextAuthOptions(config) {
     callbacks: {
       async jwt({ token, user }) {
         if (user) {
-          token.id = user.id;
-          token.groupId = user.groupId;
-          token.permissions = user.permissions;
+          const u = user;
+          token.id = u.id;
+          token.groupId = u.groupId;
+          token.isRBACAdmin = u.isRBACAdmin;
+          token.entityPerms = u.entityPerms;
+          token.adminAccess = u.adminAccess;
         }
         return token;
       },
       async session({ session, token }) {
         if (session.user) {
-          session.user.id = token.id;
-          session.user.groupId = token.groupId;
-          session.user.permissions = token.permissions;
+          const t = token;
+          session.user.id = t.id;
+          session.user.groupId = t.groupId;
+          session.user.isRBACAdmin = t.isRBACAdmin;
+          session.user.entityPerms = t.entityPerms;
+          session.user.adminAccess = t.adminAccess;
         }
         return session;
       }
@@ -208,14 +343,23 @@ function getNextAuthOptions(config) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ADMIN_GROUP_NAME,
   OPEN_ENDPOINTS,
   PERMISSION_REQUIRED_ENDPOINTS,
+  RBAC_ADMIN_ONLY_ENTITIES,
+  canManageRoles,
   createAuthHelpers,
   createCmsMiddleware,
   defaultPublicApiMethods,
   getNextAuthOptions,
+  getPermissionableEntityKeys,
   getRequiredPermission,
+  hasEntityPermission,
   isOpenEndpoint,
-  isPublicMethod
+  isPublicMethod,
+  isSuperAdminGroupName,
+  permissionRowsToRecord,
+  seedAdministratorPermissions,
+  sessionHasEntityAccess
 });
 //# sourceMappingURL=auth.cjs.map

package/dist/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/index.ts","../src/auth/helpers.ts","../src/auth/middleware.ts","../src/auth/nextauth-options.ts"],"sourcesContent":["export {\n  createAuthHelpers,\n  OPEN_ENDPOINTS,\n  PERMISSION_REQUIRED_ENDPOINTS,\n  isOpenEndpoint,\n  isPublicMethod,\n  getRequiredPermission,\n} from './helpers';\nexport type { SessionUser, GetSession, AuthHelpers } from './helpers';\nexport { createCmsMiddleware, defaultPublicApiMethods } from './middleware';\nexport type { CmsMiddlewareConfig } from './middleware';\nexport { getNextAuthOptions } from './nextauth-options';\nexport type { NextAuthOptionsConfig, NextAuthUser } from './nextauth-options';\n","export interface SessionUser {\n  id?: string;\n  email?: string | null;\n  name?: string | null;\n  groupId?: number;\n  permissions?: string[];\n}\n\nexport type GetSession = () => Promise<{ user?: SessionUser } | null>;\n\nexport const OPEN_ENDPOINTS: Array<Record<string, string[]>> = [\n  { '/api/contacts': ['POST'] },\n  { '/api/form-submissions': ['POST'] },\n  { '/api/blogs': ['GET'] },\n];\n\nexport const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]> = {};\n\nexport function isOpenEndpoint(pathname: string): boolean {\n  return OPEN_ENDPOINTS.some((endpoint) => pathname.startsWith(Object.keys(endpoint)[0]));\n}\n\nexport function getRequiredPermission(pathname: string): string[] | null {\n  return null;\n}\n\nexport function isPublicMethod(pathname: string, method: string): boolean {\n  for (const endpoint of OPEN_ENDPOINTS) {\n    const key = Object.keys(endpoint)[0];\n    if (pathname.startsWith(key) && endpoint[key].includes(method)) return true;\n  }\n  return false;\n}\n\nexport interface AuthHelpers {\n  requireAuth(req: Request): Promise<Response | null>;\n  requirePermission(req: Request, permission: string): Promise<Response | null>;\n  getAuthenticatedUser(): Promise<SessionUser | null>;\n}\n\nexport function createAuthHelpers(getSession: GetSession, NextResponse: { json: (body: unknown, init?: { status?: number }) => Response }): AuthHelpers {\n  return {\n    async requireAuth() {\n      const session = await getSession();\n      if (!session?.user?.email) {\n        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n      }\n      return null;\n    },\n    async requirePermission() {\n      const session = await getSession();\n      if (!session?.user?.email) {\n        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n      }\n      return null;\n    },\n    async getAuthenticatedUser() {\n      const session = await getSession();\n      return session?.user ?? null;\n    },\n  };\n}\n","export interface CmsMiddlewareConfig {\n  publicAdminPaths?: string[];\n  publicApiPaths?: string[];\n  /** path -> allowed methods */\n  publicApiMethods?: Record<string, string[]>;\n  signInPath?: string;\n  getSessionToken?: (request: { cookies: { get: (name: string) => { value?: string } | undefined } }) => string | undefined;\n}\n\n/** Default public API paths (no auth). Sites should extend this with their own routes. */\nexport const defaultPublicApiMethods: Record<string, string[]> = {\n  '/api/contacts': ['POST'],\n  '/api/form-submissions': ['POST'],\n  '/api/blogs': ['GET'],\n  '/api/forms': ['GET'],\n  '/api/auth': ['GET', 'POST'],\n  '/api/health': ['GET'],\n  '/api/users/forgot-password': ['POST'],\n  '/api/users/set-password': ['POST'],\n  '/api/users/invite': ['POST'],\n};\n\nfunction defaultGetSessionToken(request: { cookies: { get: (name: string) => { value?: string } | undefined } }): string | undefined {\n  return (\n    request.cookies.get('__Secure-next-auth.session-token')?.value ??\n    request.cookies.get('next-auth.session-token')?.value\n  );\n}\n\nfunction isPublicMethod(pathname: string, method: string, publicApiMethods: Record<string, string[]>): boolean {\n  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {\n    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;\n  }\n  return false;\n}\n\n/**\n * Returns middleware logic. Use from Next.js middleware:\n *   import { createCmsMiddleware } from '@infuro/cms-core';\n *   export const middleware = createCmsMiddleware({ ... });\n *   export const config = { matcher: ['/admin/:path*', '/api/:path*'] };\n */\nexport function createCmsMiddleware(config: CmsMiddlewareConfig = {}) {\n  const {\n    publicAdminPaths = ['/admin/signin', '/admin/forgot-password', '/admin/reset-password', '/admin/invite'],\n    publicApiMethods = defaultPublicApiMethods,\n    signInPath = '/admin/signin',\n    getSessionToken = defaultGetSessionToken,\n  } = config;\n\n  return function cmsMiddleware(request: {\n    nextUrl: { pathname: string };\n    url: string;\n    method: string;\n    cookies: { get: (name: string) => { value?: string } | undefined };\n  }): { type: 'next' } | { type: 'redirect'; url: string } | { type: 'json'; status: number; body: unknown } {\n    const pathname = request.nextUrl.pathname;\n    const method = request.method;\n\n    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + '/'))) {\n      return { type: 'next' };\n    }\n\n    if (pathname.startsWith('/admin')) {\n      const token = getSessionToken(request);\n      if (!token) {\n        return { type: 'redirect', url: new URL(signInPath, request.url).toString() };\n      }\n    }\n\n    if (pathname.startsWith('/api')) {\n      if (isPublicMethod(pathname, method, publicApiMethods)) {\n        return { type: 'next' };\n      }\n      const token = getSessionToken(request);\n      if (!token) {\n        return { type: 'json', status: 401, body: { error: 'Unauthorized' } };\n      }\n    }\n\n    return { type: 'next' };\n  };\n}\n","/**\n * Build NextAuth options for credentials auth. App can extend/override via extend().\n */\nimport type { NextAuthOptions } from 'next-auth';\nimport _CredentialsProvider from 'next-auth/providers/credentials';\nconst CredentialsProvider = (_CredentialsProvider as unknown as { default: typeof _CredentialsProvider }).default ?? _CredentialsProvider;\n\nexport interface NextAuthUser {\n  id: number;\n  email: string;\n  name: string | null;\n  password: string | null;\n  blocked?: boolean;\n  deleted?: boolean;\n  groupId?: number | null;\n  group?: { permissions?: unknown[] };\n}\n\nexport interface NextAuthOptionsConfig {\n  /** Resolve user by email (e.g. from TypeORM). Return null if not found. */\n  getUserByEmail: (email: string) => Promise<NextAuthUser | null>;\n  comparePassword: (plain: string, hash: string) => Promise<boolean>;\n  signInPage?: string;\n  secret?: string;\n  extend?: (options: NextAuthOptions) => NextAuthOptions;\n}\n\nexport function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions {\n  const { getUserByEmail, comparePassword, signInPage = '/admin/signin', secret, extend } = config;\n\n  const options: NextAuthOptions = {\n    secret: secret ?? process.env.NEXTAUTH_SECRET,\n    providers: [\n      CredentialsProvider({\n        name: 'credentials',\n        credentials: {\n          email: { label: 'Email', type: 'email' },\n          password: { label: 'Password', type: 'password' },\n        },\n        async authorize(credentials) {\n          if (!credentials?.email || !credentials?.password) return null;\n          try {\n            const user = await getUserByEmail(credentials.email);\n            if (!user || user.blocked || (user as { deleted?: boolean }).deleted || !user.password) return null;\n            const valid = await comparePassword(credentials.password, user.password);\n            if (!valid) return null;\n            return {\n              id: user.id.toString(),\n              email: user.email,\n              name: user.name,\n              groupId: user.groupId ?? undefined,\n              permissions: ['admin'],\n            };\n          } catch {\n            return null;\n          }\n        },\n      }),\n    ],\n    session: { strategy: 'jwt' },\n    pages: { signIn: signInPage },\n    cookies: {\n      sessionToken: {\n        name: process.env.NEXTAUTH_URL?.startsWith('https')\n          ? '__Secure-next-auth.session-token'\n          : 'next-auth.session-token',\n        options: {\n          httpOnly: true,\n          sameSite: 'lax',\n          path: '/',\n          secure: process.env.NEXTAUTH_URL?.startsWith('https') ?? false,\n        },\n      },\n    },\n    callbacks: {\n      async jwt({ token, user }) {\n        if (user) {\n          (token as Record<string, unknown>).id = user.id;\n          (token as Record<string, unknown>).groupId = (user as { groupId?: number }).groupId;\n          (token as Record<string, unknown>).permissions = (user as { permissions?: string[] }).permissions;\n        }\n        return token;\n      },\n      async session({ session, token }) {\n        if (session.user) {\n          (session.user as Record<string, unknown>).id = (token as Record<string, unknown>).id;\n          (session.user as Record<string, unknown>).groupId = (token as Record<string, unknown>).groupId;\n          (session.user as Record<string, unknown>).permissions = (token as Record<string, unknown>).permissions;\n        }\n        return session;\n      },\n    },\n  };\n\n  return extend ? extend(options) : options;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACUO,IAAM,iBAAkD;AAAA,EAC7D,EAAE,iBAAiB,CAAC,MAAM,EAAE;AAAA,EAC5B,EAAE,yBAAyB,CAAC,MAAM,EAAE;AAAA,EACpC,EAAE,cAAc,CAAC,KAAK,EAAE;AAC1B;AAEO,IAAM,gCAA0D,CAAC;AAEjE,SAAS,eAAe,UAA2B;AACxD,SAAO,eAAe,KAAK,CAAC,aAAa,SAAS,WAAW,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxF;AAEO,SAAS,sBAAsB,UAAmC;AACvE,SAAO;AACT;AAEO,SAAS,eAAe,UAAkB,QAAyB;AACxE,aAAW,YAAY,gBAAgB;AACrC,UAAM,MAAM,OAAO,KAAK,QAAQ,EAAE,CAAC;AACnC,QAAI,SAAS,WAAW,GAAG,KAAK,SAAS,GAAG,EAAE,SAAS,MAAM,EAAG,QAAO;AAAA,EACzE;AACA,SAAO;AACT;AAQO,SAAS,kBAAkB,YAAwB,cAA8F;AACtJ,SAAO;AAAA,IACL,MAAM,cAAc;AAClB,YAAM,UAAU,MAAM,WAAW;AACjC,UAAI,CAAC,SAAS,MAAM,OAAO;AACzB,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,oBAAoB;AACxB,YAAM,UAAU,MAAM,WAAW;AACjC,UAAI,CAAC,SAAS,MAAM,OAAO;AACzB,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,uBAAuB;AAC3B,YAAM,UAAU,MAAM,WAAW;AACjC,aAAO,SAAS,QAAQ;AAAA,IAC1B;AAAA,EACF;AACF;;;ACnDO,IAAM,0BAAoD;AAAA,EAC/D,iBAAiB,CAAC,MAAM;AAAA,EACxB,yBAAyB,CAAC,MAAM;AAAA,EAChC,cAAc,CAAC,KAAK;AAAA,EACpB,cAAc,CAAC,KAAK;AAAA,EACpB,aAAa,CAAC,OAAO,MAAM;AAAA,EAC3B,eAAe,CAAC,KAAK;AAAA,EACrB,8BAA8B,CAAC,MAAM;AAAA,EACrC,2BAA2B,CAAC,MAAM;AAAA,EAClC,qBAAqB,CAAC,MAAM;AAC9B;AAEA,SAAS,uBAAuB,SAAqG;AACnI,SACE,QAAQ,QAAQ,IAAI,kCAAkC,GAAG,SACzD,QAAQ,QAAQ,IAAI,yBAAyB,GAAG;AAEpD;AAEA,SAASA,gBAAe,UAAkB,QAAgB,kBAAqD;AAC7G,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,gBAAgB,GAAG;AAClE,QAAI,SAAS,WAAW,QAAQ,KAAK,QAAQ,SAAS,MAAM,EAAG,QAAO;AAAA,EACxE;AACA,SAAO;AACT;AAQO,SAAS,oBAAoB,SAA8B,CAAC,GAAG;AACpE,QAAM;AAAA,IACJ,mBAAmB,CAAC,iBAAiB,0BAA0B,yBAAyB,eAAe;AAAA,IACvG,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,kBAAkB;AAAA,EACpB,IAAI;AAEJ,SAAO,SAAS,cAAc,SAK6E;AACzG,UAAM,WAAW,QAAQ,QAAQ;AACjC,UAAM,SAAS,QAAQ;AAEvB,QAAI,iBAAiB,KAAK,CAAC,MAAM,aAAa,KAAK,SAAS,WAAW,IAAI,GAAG,CAAC,GAAG;AAChF,aAAO,EAAE,MAAM,OAAO;AAAA,IACxB;AAEA,QAAI,SAAS,WAAW,QAAQ,GAAG;AACjC,YAAM,QAAQ,gBAAgB,OAAO;AACrC,UAAI,CAAC,OAAO;AACV,eAAO,EAAE,MAAM,YAAY,KAAK,IAAI,IAAI,YAAY,QAAQ,GAAG,EAAE,SAAS,EAAE;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,MAAM,GAAG;AAC/B,UAAIA,gBAAe,UAAU,QAAQ,gBAAgB,GAAG;AACtD,eAAO,EAAE,MAAM,OAAO;AAAA,MACxB;AACA,YAAM,QAAQ,gBAAgB,OAAO;AACrC,UAAI,CAAC,OAAO;AACV,eAAO,EAAE,MAAM,QAAQ,QAAQ,KAAK,MAAM,EAAE,OAAO,eAAe,EAAE;AAAA,MACtE;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,OAAO;AAAA,EACxB;AACF;;;AC9EA,yBAAiC;AACjC,IAAM,sBAAuB,mBAAAC,QAA6E,WAAW,mBAAAA;AAsB9G,SAAS,mBAAmB,QAAgD;AACjF,QAAM,EAAE,gBAAgB,iBAAiB,aAAa,iBAAiB,QAAQ,OAAO,IAAI;AAE1F,QAAM,UAA2B;AAAA,IAC/B,QAAQ,UAAU,QAAQ,IAAI;AAAA,IAC9B,WAAW;AAAA,MACT,oBAAoB;AAAA,QAClB,MAAM;AAAA,QACN,aAAa;AAAA,UACX,OAAO,EAAE,OAAO,SAAS,MAAM,QAAQ;AAAA,UACvC,UAAU,EAAE,OAAO,YAAY,MAAM,WAAW;AAAA,QAClD;AAAA,QACA,MAAM,UAAU,aAAa;AAC3B,cAAI,CAAC,aAAa,SAAS,CAAC,aAAa,SAAU,QAAO;AAC1D,cAAI;AACF,kBAAM,OAAO,MAAM,eAAe,YAAY,KAAK;AACnD,gBAAI,CAAC,QAAQ,KAAK,WAAY,KAA+B,WAAW,CAAC,KAAK,SAAU,QAAO;AAC/F,kBAAM,QAAQ,MAAM,gBAAgB,YAAY,UAAU,KAAK,QAAQ;AACvE,gBAAI,CAAC,MAAO,QAAO;AACnB,mBAAO;AAAA,cACL,IAAI,KAAK,GAAG,SAAS;AAAA,cACrB,OAAO,KAAK;AAAA,cACZ,MAAM,KAAK;AAAA,cACX,SAAS,KAAK,WAAW;AAAA,cACzB,aAAa,CAAC,OAAO;AAAA,YACvB;AAAA,UACF,QAAQ;AACN,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,SAAS,EAAE,UAAU,MAAM;AAAA,IAC3B,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC5B,SAAS;AAAA,MACP,cAAc;AAAA,QACZ,MAAM,QAAQ,IAAI,cAAc,WAAW,OAAO,IAC9C,qCACA;AAAA,QACJ,SAAS;AAAA,UACP,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,cAAc,WAAW,OAAO,KAAK;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,KAAK,GAAG;AACzB,YAAI,MAAM;AACR,UAAC,MAAkC,KAAK,KAAK;AAC7C,UAAC,MAAkC,UAAW,KAA8B;AAC5E,UAAC,MAAkC,cAAe,KAAoC;AAAA,QACxF;AACA,eAAO;AAAA,MACT;AAAA,MACA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAChC,YAAI,QAAQ,MAAM;AAChB,UAAC,QAAQ,KAAiC,KAAM,MAAkC;AAClF,UAAC,QAAQ,KAAiC,UAAW,MAAkC;AACvF,UAAC,QAAQ,KAAiC,cAAe,MAAkC;AAAA,QAC7F;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,SAAS,OAAO,OAAO,IAAI;AACpC;","names":["isPublicMethod","_CredentialsProvider"]}
+{"version":3,"sources":["../src/auth/index.ts","../src/auth/permission-entities.ts","../src/auth/helpers.ts","../src/auth/seed-permissions.ts","../src/auth/middleware.ts","../src/auth/nextauth-options.ts"],"sourcesContent":["export {\n  createAuthHelpers,\n  OPEN_ENDPOINTS,\n  PERMISSION_REQUIRED_ENDPOINTS,\n  isOpenEndpoint,\n  isPublicMethod,\n  getRequiredPermission,\n} from './helpers';\nexport type { SessionUser, GetSession, AuthHelpers } from './helpers';\nexport { sessionHasEntityAccess, canManageRoles, RBAC_ADMIN_ONLY_ENTITIES } from './helpers';\nexport {\n  getPermissionableEntityKeys,\n  ADMIN_GROUP_NAME,\n  isSuperAdminGroupName,\n  permissionRowsToRecord,\n  hasEntityPermission,\n} from './permission-entities';\nexport { seedAdministratorPermissions } from './seed-permissions';\nexport type { EntityCrudAction, EntityPermissionFlags } from './permission-entities';\nexport { createCmsMiddleware, defaultPublicApiMethods } from './middleware';\nexport type { CmsMiddlewareConfig } from './middleware';\nexport { getNextAuthOptions } from './nextauth-options';\nexport type { NextAuthOptionsConfig, NextAuthUser } from './nextauth-options';\n","/** API resource keys excluded from the permission matrix (internal / not admin-CRUD). */\nexport const PERMISSION_ENTITY_INTERNAL_EXCLUDE = new Set([\n  'users',\n  'password_reset_tokens',\n  'user_groups',\n  'permissions',\n  'comments',\n  'form_fields',\n  'configs',\n  'knowledge_base_chunks',\n  'carts',\n  'cart_items',\n  'wishlists',\n  'wishlist_items',\n]);\n\n/** Non-CRUD admin surfaces mapped to entity keys for RBAC. */\nexport const PERMISSION_LOGICAL_ENTITIES = [\n  'users',\n  'forms',\n  'form_submissions',\n  'dashboard',\n  'upload',\n  'settings',\n  'analytics',\n  'chat',\n] as const;\n\n/** Canonical name for new installs / migrations */\nexport const ADMIN_GROUP_NAME = 'Administrator';\n\n/** System administrator group (roles UI + users / user_groups / permissions bypass). */\nexport function isSuperAdminGroupName(name: string | null | undefined): boolean {\n  return name === ADMIN_GROUP_NAME;\n}\n\nexport type EntityCrudAction = 'create' | 'read' | 'update' | 'delete';\n\nexport type EntityPermissionFlags = { c: boolean; r: boolean; u: boolean; d: boolean };\n\nexport function getPermissionableEntityKeys(entityMap: Record<string, unknown>): string[] {\n  const fromMap = Object.keys(entityMap).filter((k) => !PERMISSION_ENTITY_INTERNAL_EXCLUDE.has(k));\n  const logical = PERMISSION_LOGICAL_ENTITIES.filter((k) => !fromMap.includes(k));\n  return [...fromMap.sort(), ...logical].filter((k, i, a) => a.indexOf(k) === i);\n}\n\nexport function permissionRowsToRecord(\n  rows: Array<{ entity: string; canCreate: boolean; canRead: boolean; canUpdate: boolean; canDelete: boolean }> | undefined\n): Record<string, EntityPermissionFlags> {\n  const out: Record<string, EntityPermissionFlags> = {};\n  if (!rows?.length) return out;\n  for (const p of rows) {\n    out[p.entity] = {\n      c: !!p.canCreate,\n      r: !!p.canRead,\n      u: !!p.canUpdate,\n      d: !!p.canDelete,\n    };\n  }\n  return out;\n}\n\nexport function hasEntityPermission(\n  record: Record<string, EntityPermissionFlags> | undefined,\n  entity: string,\n  action: EntityCrudAction\n): boolean {\n  const p = record?.[entity];\n  if (!p) return false;\n  if (action === 'create') return p.c;\n  if (action === 'read') return p.r;\n  if (action === 'update') return p.u;\n  return p.d;\n}\n","import type { EntityCrudAction, EntityPermissionFlags } from './permission-entities';\nimport { hasEntityPermission } from './permission-entities';\n\n/** isRBACAdmin bypasses entity checks only for these (users / roles plumbing). */\nexport const RBAC_ADMIN_ONLY_ENTITIES = new Set(['users', 'user_groups', 'permissions']);\n\nexport interface SessionUser {\n  id?: string;\n  email?: string | null;\n  name?: string | null;\n  groupId?: number;\n  /** @deprecated use entityPerms / isRBACAdmin */\n  permissions?: string[];\n  /** Administrator group: full access only for users, user_groups, permissions */\n  isRBACAdmin?: boolean;\n  entityPerms?: Record<string, EntityPermissionFlags>;\n  /** When false and not isRBACAdmin, admin API/UI is denied. */\n  adminAccess?: boolean;\n}\n\nexport function sessionHasEntityAccess(\n  user: SessionUser | null | undefined,\n  entity: string,\n  action: EntityCrudAction\n): boolean {\n  if (!user?.email) return false;\n  if (user.isRBACAdmin && RBAC_ADMIN_ONLY_ENTITIES.has(entity)) return true;\n  return hasEntityPermission(user.entityPerms, entity, action);\n}\n\nexport function canManageRoles(user: SessionUser | null | undefined): boolean {\n  return !!(user?.email && user.isRBACAdmin);\n}\n\nexport type GetSession = () => Promise<{ user?: SessionUser } | null>;\n\nexport const OPEN_ENDPOINTS: Array<Record<string, string[]>> = [\n  { '/api/contacts': ['POST'] },\n  { '/api/form-submissions': ['POST'] },\n  { '/api/blogs': ['GET'] },\n];\n\nexport const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]> = {};\n\nexport function isOpenEndpoint(pathname: string): boolean {\n  return OPEN_ENDPOINTS.some((endpoint) => pathname.startsWith(Object.keys(endpoint)[0]));\n}\n\nexport function getRequiredPermission(pathname: string): string[] | null {\n  return null;\n}\n\nexport function isPublicMethod(pathname: string, method: string): boolean {\n  for (const endpoint of OPEN_ENDPOINTS) {\n    const key = Object.keys(endpoint)[0];\n    if (pathname.startsWith(key) && endpoint[key].includes(method)) return true;\n  }\n  return false;\n}\n\nexport interface AuthHelpers {\n  requireAuth(req: Request): Promise<Response | null>;\n  requirePermission(req: Request, permission: string): Promise<Response | null>;\n  requireEntityPermission(req: Request, entity: string, action: EntityCrudAction): Promise<Response | null>;\n  requireAdminAccess(req: Request): Promise<Response | null>;\n  getAuthenticatedUser(): Promise<SessionUser | null>;\n}\n\nexport function createAuthHelpers(getSession: GetSession, NextResponse: { json: (body: unknown, init?: { status?: number }) => Response }): AuthHelpers {\n  return {\n    async requireAuth() {\n      const session = await getSession();\n      if (!session?.user?.email) {\n        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n      }\n      return null;\n    },\n    async requirePermission() {\n      const session = await getSession();\n      if (!session?.user?.email) {\n        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n      }\n      return null;\n    },\n    async requireEntityPermission(_req: Request, entity: string, action: EntityCrudAction) {\n      const session = await getSession();\n      if (!session?.user?.email) {\n        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n      }\n      const u = session.user as SessionUser;\n      if (sessionHasEntityAccess(u, entity, action)) return null;\n      return NextResponse.json({ error: 'Forbidden', entity, action }, { status: 403 });\n    },\n    async requireAdminAccess() {\n      const session = await getSession();\n      if (!session?.user?.email) {\n        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n      }\n      const u = session.user as SessionUser;\n      if (u.isRBACAdmin) return null;\n      if (u.adminAccess === false) return NextResponse.json({ error: 'Forbidden', reason: 'admin_access' }, { status: 403 });\n      return null;\n    },\n    async getAuthenticatedUser() {\n      const session = await getSession();\n      return (session?.user as SessionUser) ?? null;\n    },\n  };\n}\n","import type { DataSource } from 'typeorm';\nimport type { EntityTarget } from 'typeorm';\nimport type { ObjectLiteral } from 'typeorm';\nimport { getPermissionableEntityKeys, ADMIN_GROUP_NAME } from './permission-entities';\n\n/**\n * Ensures the Administrator group has full CRUD on every permissionable entity\n * for the given entity map. Idempotent: upserts per entity.\n */\nexport async function seedAdministratorPermissions(\n  dataSource: DataSource,\n  entityMap: Record<string, unknown>\n): Promise<void> {\n  const entities = getPermissionableEntityKeys(entityMap);\n  const groupRepo = dataSource.getRepository(entityMap.user_groups as EntityTarget<ObjectLiteral>);\n  const permRepo = dataSource.getRepository(entityMap.permissions as EntityTarget<ObjectLiteral>);\n\n  const adminGroup = await groupRepo.findOne({ where: { name: ADMIN_GROUP_NAME, deleted: false } });\n  if (!adminGroup) return;\n\n  const fullCrud = { canCreate: true, canRead: true, canUpdate: true, canDelete: true };\n\n  for (const entity of entities) {\n    const existing = await permRepo.findOne({\n      where: { groupId: adminGroup.id, entity },\n    });\n    if (existing) {\n      existing.canCreate = true;\n      existing.canRead = true;\n      existing.canUpdate = true;\n      existing.canDelete = true;\n      await permRepo.save(existing);\n    } else {\n      await permRepo.save(\n        permRepo.create({\n          groupId: adminGroup.id,\n          entity,\n          ...fullCrud,\n        })\n      );\n    }\n  }\n}\n","export interface CmsMiddlewareConfig {\n  publicAdminPaths?: string[];\n  publicApiPaths?: string[];\n  /** path -> allowed methods */\n  publicApiMethods?: Record<string, string[]>;\n  signInPath?: string;\n  getSessionToken?: (request: { cookies: { get: (name: string) => { value?: string } | undefined } }) => string | undefined;\n}\n\n/** Default public API paths (no auth). Sites should extend this with their own routes. */\nexport const defaultPublicApiMethods: Record<string, string[]> = {\n  '/api/contacts': ['POST'],\n  '/api/form-submissions': ['POST'],\n  '/api/blogs': ['GET'],\n  '/api/forms': ['GET'],\n  '/api/auth': ['GET', 'POST'],\n  '/api/health': ['GET'],\n  '/api/users/forgot-password': ['POST'],\n  '/api/users/set-password': ['POST'],\n  '/api/users/invite': ['POST'],\n};\n\nfunction defaultGetSessionToken(request: { cookies: { get: (name: string) => { value?: string } | undefined } }): string | undefined {\n  return (\n    request.cookies.get('__Secure-next-auth.session-token')?.value ??\n    request.cookies.get('next-auth.session-token')?.value\n  );\n}\n\nfunction isPublicMethod(pathname: string, method: string, publicApiMethods: Record<string, string[]>): boolean {\n  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {\n    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;\n  }\n  return false;\n}\n\n/**\n * Returns middleware logic. Use from Next.js middleware:\n *   import { createCmsMiddleware } from '@infuro/cms-core';\n *   export const middleware = createCmsMiddleware({ ... });\n *   export const config = { matcher: ['/admin/:path*', '/api/:path*'] };\n */\nexport function createCmsMiddleware(config: CmsMiddlewareConfig = {}) {\n  const {\n    publicAdminPaths = ['/admin/signin', '/admin/forgot-password', '/admin/reset-password', '/admin/invite'],\n    publicApiMethods = defaultPublicApiMethods,\n    signInPath = '/admin/signin',\n    getSessionToken = defaultGetSessionToken,\n  } = config;\n\n  return function cmsMiddleware(request: {\n    nextUrl: { pathname: string };\n    url: string;\n    method: string;\n    cookies: { get: (name: string) => { value?: string } | undefined };\n  }): { type: 'next' } | { type: 'redirect'; url: string } | { type: 'json'; status: number; body: unknown } {\n    const pathname = request.nextUrl.pathname;\n    const method = request.method;\n\n    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + '/'))) {\n      return { type: 'next' };\n    }\n\n    if (pathname.startsWith('/admin')) {\n      const token = getSessionToken(request);\n      if (!token) {\n        return { type: 'redirect', url: new URL(signInPath, request.url).toString() };\n      }\n    }\n\n    if (pathname.startsWith('/api')) {\n      if (isPublicMethod(pathname, method, publicApiMethods)) {\n        return { type: 'next' };\n      }\n      const token = getSessionToken(request);\n      if (!token) {\n        return { type: 'json', status: 401, body: { error: 'Unauthorized' } };\n      }\n    }\n\n    return { type: 'next' };\n  };\n}\n","/**\n * Build NextAuth options for credentials auth. App can extend/override via extend().\n */\nimport type { NextAuthOptions } from 'next-auth';\nimport _CredentialsProvider from 'next-auth/providers/credentials';\nconst CredentialsProvider = (_CredentialsProvider as unknown as { default: typeof _CredentialsProvider }).default ?? _CredentialsProvider;\nimport { isSuperAdminGroupName, permissionRowsToRecord } from './permission-entities';\n\nexport interface NextAuthUser {\n  id: number;\n  email: string;\n  name: string | null;\n  password: string | null;\n  blocked?: boolean;\n  deleted?: boolean;\n  groupId?: number | null;\n  adminAccess?: boolean;\n  group?: {\n    name?: string;\n    permissions?: Array<{\n      entity: string;\n      canCreate: boolean;\n      canRead: boolean;\n      canUpdate: boolean;\n      canDelete: boolean;\n    }>;\n  };\n}\n\nexport interface NextAuthOptionsConfig {\n  /** Resolve user by email (e.g. from TypeORM). Return null if not found. */\n  getUserByEmail: (email: string) => Promise<NextAuthUser | null>;\n  comparePassword: (plain: string, hash: string) => Promise<boolean>;\n  signInPage?: string;\n  secret?: string;\n  extend?: (options: NextAuthOptions) => NextAuthOptions;\n}\n\nexport function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions {\n  const { getUserByEmail, comparePassword, signInPage = '/admin/signin', secret, extend } = config;\n\n  const options: NextAuthOptions = {\n    secret: secret ?? process.env.NEXTAUTH_SECRET,\n    providers: [\n      CredentialsProvider({\n        name: 'credentials',\n        credentials: {\n          email: { label: 'Email', type: 'email' },\n          password: { label: 'Password', type: 'password' },\n        },\n        async authorize(credentials) {\n          if (!credentials?.email || !credentials?.password) return null;\n          try {\n            const user = await getUserByEmail(credentials.email);\n            if (!user || user.blocked || (user as { deleted?: boolean }).deleted || !user.password) return null;\n            const valid = await comparePassword(credentials.password, user.password);\n            if (!valid) return null;\n            const g = user.group;\n            const isRBACAdmin = isSuperAdminGroupName(g?.name);\n            const entityPerms = permissionRowsToRecord(g?.permissions);\n            const adminAccess = (user as NextAuthUser & { adminAccess?: boolean }).adminAccess === true;\n            return {\n              id: user.id.toString(),\n              email: user.email,\n              name: user.name,\n              groupId: user.groupId ?? undefined,\n              isRBACAdmin,\n              entityPerms,\n              adminAccess,\n            };\n          } catch {\n            return null;\n          }\n        },\n      }),\n    ],\n    session: { strategy: 'jwt' },\n    pages: { signIn: signInPage },\n    cookies: {\n      sessionToken: {\n        name: process.env.NEXTAUTH_URL?.startsWith('https')\n          ? '__Secure-next-auth.session-token'\n          : 'next-auth.session-token',\n        options: {\n          httpOnly: true,\n          sameSite: 'lax',\n          path: '/',\n          secure: process.env.NEXTAUTH_URL?.startsWith('https') ?? false,\n        },\n      },\n    },\n    callbacks: {\n      async jwt({ token, user }) {\n        if (user) {\n          const u = user as unknown as Record<string, unknown>;\n          (token as Record<string, unknown>).id = u.id;\n          (token as Record<string, unknown>).groupId = u.groupId;\n          (token as Record<string, unknown>).isRBACAdmin = u.isRBACAdmin;\n          (token as Record<string, unknown>).entityPerms = u.entityPerms;\n          (token as Record<string, unknown>).adminAccess = u.adminAccess;\n        }\n        return token;\n      },\n      async session({ session, token }) {\n        if (session.user) {\n          const t = token as Record<string, unknown>;\n          (session.user as Record<string, unknown>).id = t.id;\n          (session.user as Record<string, unknown>).groupId = t.groupId;\n          (session.user as Record<string, unknown>).isRBACAdmin = t.isRBACAdmin;\n          (session.user as Record<string, unknown>).entityPerms = t.entityPerms;\n          (session.user as Record<string, unknown>).adminAccess = t.adminAccess;\n        }\n        return session;\n      },\n    },\n  };\n\n  return extend ? extend(options) : options;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACCO,IAAM,qCAAqC,oBAAI,IAAI;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,mBAAmB;AAGzB,SAAS,sBAAsB,MAA0C;AAC9E,SAAO,SAAS;AAClB;AAMO,SAAS,4BAA4B,WAA8C;AACxF,QAAM,UAAU,OAAO,KAAK,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,mCAAmC,IAAI,CAAC,CAAC;AAC/F,QAAM,UAAU,4BAA4B,OAAO,CAAC,MAAM,CAAC,QAAQ,SAAS,CAAC,CAAC;AAC9E,SAAO,CAAC,GAAG,QAAQ,KAAK,GAAG,GAAG,OAAO,EAAE,OAAO,CAAC,GAAG,GAAG,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;AAC/E;AAEO,SAAS,uBACd,MACuC;AACvC,QAAM,MAA6C,CAAC;AACpD,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,aAAW,KAAK,MAAM;AACpB,QAAI,EAAE,MAAM,IAAI;AAAA,MACd,GAAG,CAAC,CAAC,EAAE;AAAA,MACP,GAAG,CAAC,CAAC,EAAE;AAAA,MACP,GAAG,CAAC,CAAC,EAAE;AAAA,MACP,GAAG,CAAC,CAAC,EAAE;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,oBACd,QACA,QACA,QACS;AACT,QAAM,IAAI,SAAS,MAAM;AACzB,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,WAAW,SAAU,QAAO,EAAE;AAClC,MAAI,WAAW,OAAQ,QAAO,EAAE;AAChC,MAAI,WAAW,SAAU,QAAO,EAAE;AAClC,SAAO,EAAE;AACX;;;ACrEO,IAAM,2BAA2B,oBAAI,IAAI,CAAC,SAAS,eAAe,aAAa,CAAC;AAgBhF,SAAS,uBACd,MACA,QACA,QACS;AACT,MAAI,CAAC,MAAM,MAAO,QAAO;AACzB,MAAI,KAAK,eAAe,yBAAyB,IAAI,MAAM,EAAG,QAAO;AACrE,SAAO,oBAAoB,KAAK,aAAa,QAAQ,MAAM;AAC7D;AAEO,SAAS,eAAe,MAA+C;AAC5E,SAAO,CAAC,EAAE,MAAM,SAAS,KAAK;AAChC;AAIO,IAAM,iBAAkD;AAAA,EAC7D,EAAE,iBAAiB,CAAC,MAAM,EAAE;AAAA,EAC5B,EAAE,yBAAyB,CAAC,MAAM,EAAE;AAAA,EACpC,EAAE,cAAc,CAAC,KAAK,EAAE;AAC1B;AAEO,IAAM,gCAA0D,CAAC;AAEjE,SAAS,eAAe,UAA2B;AACxD,SAAO,eAAe,KAAK,CAAC,aAAa,SAAS,WAAW,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxF;AAEO,SAAS,sBAAsB,UAAmC;AACvE,SAAO;AACT;AAEO,SAAS,eAAe,UAAkB,QAAyB;AACxE,aAAW,YAAY,gBAAgB;AACrC,UAAM,MAAM,OAAO,KAAK,QAAQ,EAAE,CAAC;AACnC,QAAI,SAAS,WAAW,GAAG,KAAK,SAAS,GAAG,EAAE,SAAS,MAAM,EAAG,QAAO;AAAA,EACzE;AACA,SAAO;AACT;AAUO,SAAS,kBAAkB,YAAwB,cAA8F;AACtJ,SAAO;AAAA,IACL,MAAM,cAAc;AAClB,YAAM,UAAU,MAAM,WAAW;AACjC,UAAI,CAAC,SAAS,MAAM,OAAO;AACzB,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,oBAAoB;AACxB,YAAM,UAAU,MAAM,WAAW;AACjC,UAAI,CAAC,SAAS,MAAM,OAAO;AACzB,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,wBAAwB,MAAe,QAAgB,QAA0B;AACrF,YAAM,UAAU,MAAM,WAAW;AACjC,UAAI,CAAC,SAAS,MAAM,OAAO;AACzB,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,YAAM,IAAI,QAAQ;AAClB,UAAI,uBAAuB,GAAG,QAAQ,MAAM,EAAG,QAAO;AACtD,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,QAAQ,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AAAA,IACA,MAAM,qBAAqB;AACzB,YAAM,UAAU,MAAM,WAAW;AACjC,UAAI,CAAC,SAAS,MAAM,OAAO;AACzB,eAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,YAAM,IAAI,QAAQ;AAClB,UAAI,EAAE,YAAa,QAAO;AAC1B,UAAI,EAAE,gBAAgB,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,aAAa,QAAQ,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACrH,aAAO;AAAA,IACT;AAAA,IACA,MAAM,uBAAuB;AAC3B,YAAM,UAAU,MAAM,WAAW;AACjC,aAAQ,SAAS,QAAwB;AAAA,IAC3C;AAAA,EACF;AACF;;;ACnGA,eAAsB,6BACpB,YACA,WACe;AACf,QAAM,WAAW,4BAA4B,SAAS;AACtD,QAAM,YAAY,WAAW,cAAc,UAAU,WAA0C;AAC/F,QAAM,WAAW,WAAW,cAAc,UAAU,WAA0C;AAE9F,QAAM,aAAa,MAAM,UAAU,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,SAAS,MAAM,EAAE,CAAC;AAChG,MAAI,CAAC,WAAY;AAEjB,QAAM,WAAW,EAAE,WAAW,MAAM,SAAS,MAAM,WAAW,MAAM,WAAW,KAAK;AAEpF,aAAW,UAAU,UAAU;AAC7B,UAAM,WAAW,MAAM,SAAS,QAAQ;AAAA,MACtC,OAAO,EAAE,SAAS,WAAW,IAAI,OAAO;AAAA,IAC1C,CAAC;AACD,QAAI,UAAU;AACZ,eAAS,YAAY;AACrB,eAAS,UAAU;AACnB,eAAS,YAAY;AACrB,eAAS,YAAY;AACrB,YAAM,SAAS,KAAK,QAAQ;AAAA,IAC9B,OAAO;AACL,YAAM,SAAS;AAAA,QACb,SAAS,OAAO;AAAA,UACd,SAAS,WAAW;AAAA,UACpB;AAAA,UACA,GAAG;AAAA,QACL,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;AChCO,IAAM,0BAAoD;AAAA,EAC/D,iBAAiB,CAAC,MAAM;AAAA,EACxB,yBAAyB,CAAC,MAAM;AAAA,EAChC,cAAc,CAAC,KAAK;AAAA,EACpB,cAAc,CAAC,KAAK;AAAA,EACpB,aAAa,CAAC,OAAO,MAAM;AAAA,EAC3B,eAAe,CAAC,KAAK;AAAA,EACrB,8BAA8B,CAAC,MAAM;AAAA,EACrC,2BAA2B,CAAC,MAAM;AAAA,EAClC,qBAAqB,CAAC,MAAM;AAC9B;AAEA,SAAS,uBAAuB,SAAqG;AACnI,SACE,QAAQ,QAAQ,IAAI,kCAAkC,GAAG,SACzD,QAAQ,QAAQ,IAAI,yBAAyB,GAAG;AAEpD;AAEA,SAASA,gBAAe,UAAkB,QAAgB,kBAAqD;AAC7G,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,gBAAgB,GAAG;AAClE,QAAI,SAAS,WAAW,QAAQ,KAAK,QAAQ,SAAS,MAAM,EAAG,QAAO;AAAA,EACxE;AACA,SAAO;AACT;AAQO,SAAS,oBAAoB,SAA8B,CAAC,GAAG;AACpE,QAAM;AAAA,IACJ,mBAAmB,CAAC,iBAAiB,0BAA0B,yBAAyB,eAAe;AAAA,IACvG,mBAAmB;AAAA,IACnB,aAAa;AAAA,IACb,kBAAkB;AAAA,EACpB,IAAI;AAEJ,SAAO,SAAS,cAAc,SAK6E;AACzG,UAAM,WAAW,QAAQ,QAAQ;AACjC,UAAM,SAAS,QAAQ;AAEvB,QAAI,iBAAiB,KAAK,CAAC,MAAM,aAAa,KAAK,SAAS,WAAW,IAAI,GAAG,CAAC,GAAG;AAChF,aAAO,EAAE,MAAM,OAAO;AAAA,IACxB;AAEA,QAAI,SAAS,WAAW,QAAQ,GAAG;AACjC,YAAM,QAAQ,gBAAgB,OAAO;AACrC,UAAI,CAAC,OAAO;AACV,eAAO,EAAE,MAAM,YAAY,KAAK,IAAI,IAAI,YAAY,QAAQ,GAAG,EAAE,SAAS,EAAE;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,MAAM,GAAG;AAC/B,UAAIA,gBAAe,UAAU,QAAQ,gBAAgB,GAAG;AACtD,eAAO,EAAE,MAAM,OAAO;AAAA,MACxB;AACA,YAAM,QAAQ,gBAAgB,OAAO;AACrC,UAAI,CAAC,OAAO;AACV,eAAO,EAAE,MAAM,QAAQ,QAAQ,KAAK,MAAM,EAAE,OAAO,eAAe,EAAE;AAAA,MACtE;AAAA,IACF;AAEA,WAAO,EAAE,MAAM,OAAO;AAAA,EACxB;AACF;;;AC9EA,yBAAiC;AACjC,IAAM,sBAAuB,mBAAAC,QAA6E,WAAW,mBAAAA;AAiC9G,SAAS,mBAAmB,QAAgD;AACjF,QAAM,EAAE,gBAAgB,iBAAiB,aAAa,iBAAiB,QAAQ,OAAO,IAAI;AAE1F,QAAM,UAA2B;AAAA,IAC/B,QAAQ,UAAU,QAAQ,IAAI;AAAA,IAC9B,WAAW;AAAA,MACT,oBAAoB;AAAA,QAClB,MAAM;AAAA,QACN,aAAa;AAAA,UACX,OAAO,EAAE,OAAO,SAAS,MAAM,QAAQ;AAAA,UACvC,UAAU,EAAE,OAAO,YAAY,MAAM,WAAW;AAAA,QAClD;AAAA,QACA,MAAM,UAAU,aAAa;AAC3B,cAAI,CAAC,aAAa,SAAS,CAAC,aAAa,SAAU,QAAO;AAC1D,cAAI;AACF,kBAAM,OAAO,MAAM,eAAe,YAAY,KAAK;AACnD,gBAAI,CAAC,QAAQ,KAAK,WAAY,KAA+B,WAAW,CAAC,KAAK,SAAU,QAAO;AAC/F,kBAAM,QAAQ,MAAM,gBAAgB,YAAY,UAAU,KAAK,QAAQ;AACvE,gBAAI,CAAC,MAAO,QAAO;AACnB,kBAAM,IAAI,KAAK;AACf,kBAAM,cAAc,sBAAsB,GAAG,IAAI;AACjD,kBAAM,cAAc,uBAAuB,GAAG,WAAW;AACzD,kBAAM,cAAe,KAAkD,gBAAgB;AACvF,mBAAO;AAAA,cACL,IAAI,KAAK,GAAG,SAAS;AAAA,cACrB,OAAO,KAAK;AAAA,cACZ,MAAM,KAAK;AAAA,cACX,SAAS,KAAK,WAAW;AAAA,cACzB;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF,QAAQ;AACN,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,SAAS,EAAE,UAAU,MAAM;AAAA,IAC3B,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC5B,SAAS;AAAA,MACP,cAAc;AAAA,QACZ,MAAM,QAAQ,IAAI,cAAc,WAAW,OAAO,IAC9C,qCACA;AAAA,QACJ,SAAS;AAAA,UACP,UAAU;AAAA,UACV,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ,QAAQ,IAAI,cAAc,WAAW,OAAO,KAAK;AAAA,QAC3D;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,MAAM,IAAI,EAAE,OAAO,KAAK,GAAG;AACzB,YAAI,MAAM;AACR,gBAAM,IAAI;AACV,UAAC,MAAkC,KAAK,EAAE;AAC1C,UAAC,MAAkC,UAAU,EAAE;AAC/C,UAAC,MAAkC,cAAc,EAAE;AACnD,UAAC,MAAkC,cAAc,EAAE;AACnD,UAAC,MAAkC,cAAc,EAAE;AAAA,QACrD;AACA,eAAO;AAAA,MACT;AAAA,MACA,MAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAChC,YAAI,QAAQ,MAAM;AAChB,gBAAM,IAAI;AACV,UAAC,QAAQ,KAAiC,KAAK,EAAE;AACjD,UAAC,QAAQ,KAAiC,UAAU,EAAE;AACtD,UAAC,QAAQ,KAAiC,cAAc,EAAE;AAC1D,UAAC,QAAQ,KAAiC,cAAc,EAAE;AAC1D,UAAC,QAAQ,KAAiC,cAAc,EAAE;AAAA,QAC5D;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,SAAS,OAAO,OAAO,IAAI;AACpC;","names":["isPublicMethod","_CredentialsProvider"]}

package/dist/auth.d.cts

@@ -1,30 +1,12 @@
+export { A as ADMIN_GROUP_NAME, a as AuthHelpers, E as EntityCrudAction, b as EntityPermissionFlags, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, S as SessionUser, c as canManageRoles, d as createAuthHelpers, g as getPermissionableEntityKeys, e as getRequiredPermission, h as hasEntityPermission, i as isOpenEndpoint, f as isPublicMethod, j as isSuperAdminGroupName, p as permissionRowsToRecord, s as sessionHasEntityAccess } from './helpers-dlrF_49e.cjs';
+import { DataSource } from 'typeorm';
 import { NextAuthOptions } from 'next-auth';
 
-interface SessionUser {
-    id?: string;
-    email?: string | null;
-    name?: string | null;
-    groupId?: number;
-    permissions?: string[];
-}
-type GetSession = () => Promise<{
-    user?: SessionUser;
-} | null>;
-declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
-declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
-declare function isOpenEndpoint(pathname: string): boolean;
-declare function getRequiredPermission(pathname: string): string[] | null;
-declare function isPublicMethod(pathname: string, method: string): boolean;
-interface AuthHelpers {
-    requireAuth(req: Request): Promise<Response | null>;
-    requirePermission(req: Request, permission: string): Promise<Response | null>;
-    getAuthenticatedUser(): Promise<SessionUser | null>;
-}
-declare function createAuthHelpers(getSession: GetSession, NextResponse: {
-    json: (body: unknown, init?: {
-        status?: number;
-    }) => Response;
-}): AuthHelpers;
+/**
+ * Ensures the Administrator group has full CRUD on every permissionable entity
+ * for the given entity map. Idempotent: upserts per entity.
+ */
+declare function seedAdministratorPermissions(dataSource: DataSource, entityMap: Record<string, unknown>): Promise<void>;
 
 interface CmsMiddlewareConfig {
     publicAdminPaths?: string[];
@@ -82,8 +64,16 @@ interface NextAuthUser {
     blocked?: boolean;
     deleted?: boolean;
     groupId?: number | null;
+    adminAccess?: boolean;
     group?: {
-        permissions?: unknown[];
+        name?: string;
+        permissions?: Array<{
+            entity: string;
+            canCreate: boolean;
+            canRead: boolean;
+            canUpdate: boolean;
+            canDelete: boolean;
+        }>;
     };
 }
 interface NextAuthOptionsConfig {
@@ -96,4 +86,4 @@ interface NextAuthOptionsConfig {
 }
 declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
 
-export { type AuthHelpers, type CmsMiddlewareConfig, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, type SessionUser, createAuthHelpers, createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getRequiredPermission, isOpenEndpoint, isPublicMethod };
+export { type CmsMiddlewareConfig, type NextAuthOptionsConfig, type NextAuthUser, createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, seedAdministratorPermissions };

package/dist/auth.d.ts

@@ -1,30 +1,12 @@
+export { A as ADMIN_GROUP_NAME, a as AuthHelpers, E as EntityCrudAction, b as EntityPermissionFlags, G as GetSession, O as OPEN_ENDPOINTS, P as PERMISSION_REQUIRED_ENDPOINTS, R as RBAC_ADMIN_ONLY_ENTITIES, S as SessionUser, c as canManageRoles, d as createAuthHelpers, g as getPermissionableEntityKeys, e as getRequiredPermission, h as hasEntityPermission, i as isOpenEndpoint, f as isPublicMethod, j as isSuperAdminGroupName, p as permissionRowsToRecord, s as sessionHasEntityAccess } from './helpers-dlrF_49e.js';
+import { DataSource } from 'typeorm';
 import { NextAuthOptions } from 'next-auth';
 
-interface SessionUser {
-    id?: string;
-    email?: string | null;
-    name?: string | null;
-    groupId?: number;
-    permissions?: string[];
-}
-type GetSession = () => Promise<{
-    user?: SessionUser;
-} | null>;
-declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
-declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
-declare function isOpenEndpoint(pathname: string): boolean;
-declare function getRequiredPermission(pathname: string): string[] | null;
-declare function isPublicMethod(pathname: string, method: string): boolean;
-interface AuthHelpers {
-    requireAuth(req: Request): Promise<Response | null>;
-    requirePermission(req: Request, permission: string): Promise<Response | null>;
-    getAuthenticatedUser(): Promise<SessionUser | null>;
-}
-declare function createAuthHelpers(getSession: GetSession, NextResponse: {
-    json: (body: unknown, init?: {
-        status?: number;
-    }) => Response;
-}): AuthHelpers;
+/**
+ * Ensures the Administrator group has full CRUD on every permissionable entity
+ * for the given entity map. Idempotent: upserts per entity.
+ */
+declare function seedAdministratorPermissions(dataSource: DataSource, entityMap: Record<string, unknown>): Promise<void>;
 
 interface CmsMiddlewareConfig {
     publicAdminPaths?: string[];
@@ -82,8 +64,16 @@ interface NextAuthUser {
     blocked?: boolean;
     deleted?: boolean;
     groupId?: number | null;
+    adminAccess?: boolean;
     group?: {
-        permissions?: unknown[];
+        name?: string;
+        permissions?: Array<{
+            entity: string;
+            canCreate: boolean;
+            canRead: boolean;
+            canUpdate: boolean;
+            canDelete: boolean;
+        }>;
     };
 }
 interface NextAuthOptionsConfig {
@@ -96,4 +86,4 @@ interface NextAuthOptionsConfig {
 }
 declare function getNextAuthOptions(config: NextAuthOptionsConfig): NextAuthOptions;
 
-export { type AuthHelpers, type CmsMiddlewareConfig, type GetSession, type NextAuthOptionsConfig, type NextAuthUser, OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, type SessionUser, createAuthHelpers, createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getRequiredPermission, isOpenEndpoint, isPublicMethod };
+export { type CmsMiddlewareConfig, type NextAuthOptionsConfig, type NextAuthUser, createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, seedAdministratorPermissions };

package/dist/auth.js

@@ -1,4 +1,69 @@
+// src/auth/permission-entities.ts
+var PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
+  "users",
+  "password_reset_tokens",
+  "user_groups",
+  "permissions",
+  "comments",
+  "form_fields",
+  "configs",
+  "knowledge_base_chunks",
+  "carts",
+  "cart_items",
+  "wishlists",
+  "wishlist_items"
+]);
+var PERMISSION_LOGICAL_ENTITIES = [
+  "users",
+  "forms",
+  "form_submissions",
+  "dashboard",
+  "upload",
+  "settings",
+  "analytics",
+  "chat"
+];
+var ADMIN_GROUP_NAME = "Administrator";
+function isSuperAdminGroupName(name) {
+  return name === ADMIN_GROUP_NAME;
+}
+function getPermissionableEntityKeys(entityMap) {
+  const fromMap = Object.keys(entityMap).filter((k) => !PERMISSION_ENTITY_INTERNAL_EXCLUDE.has(k));
+  const logical = PERMISSION_LOGICAL_ENTITIES.filter((k) => !fromMap.includes(k));
+  return [...fromMap.sort(), ...logical].filter((k, i, a) => a.indexOf(k) === i);
+}
+function permissionRowsToRecord(rows) {
+  const out = {};
+  if (!rows?.length) return out;
+  for (const p of rows) {
+    out[p.entity] = {
+      c: !!p.canCreate,
+      r: !!p.canRead,
+      u: !!p.canUpdate,
+      d: !!p.canDelete
+    };
+  }
+  return out;
+}
+function hasEntityPermission(record, entity, action) {
+  const p = record?.[entity];
+  if (!p) return false;
+  if (action === "create") return p.c;
+  if (action === "read") return p.r;
+  if (action === "update") return p.u;
+  return p.d;
+}
+
 // src/auth/helpers.ts
+var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set(["users", "user_groups", "permissions"]);
+function sessionHasEntityAccess(user, entity, action) {
+  if (!user?.email) return false;
+  if (user.isRBACAdmin && RBAC_ADMIN_ONLY_ENTITIES.has(entity)) return true;
+  return hasEntityPermission(user.entityPerms, entity, action);
+}
+function canManageRoles(user) {
+  return !!(user?.email && user.isRBACAdmin);
+}
 var OPEN_ENDPOINTS = [
   { "/api/contacts": ["POST"] },
   { "/api/form-submissions": ["POST"] },
@@ -34,6 +99,25 @@ function createAuthHelpers(getSession, NextResponse) {
       }
       return null;
     },
+    async requireEntityPermission(_req, entity, action) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      const u = session.user;
+      if (sessionHasEntityAccess(u, entity, action)) return null;
+      return NextResponse.json({ error: "Forbidden", entity, action }, { status: 403 });
+    },
+    async requireAdminAccess() {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      const u = session.user;
+      if (u.isRBACAdmin) return null;
+      if (u.adminAccess === false) return NextResponse.json({ error: "Forbidden", reason: "admin_access" }, { status: 403 });
+      return null;
+    },
     async getAuthenticatedUser() {
       const session = await getSession();
       return session?.user ?? null;
@@ -41,6 +125,36 @@ function createAuthHelpers(getSession, NextResponse) {
   };
 }
 
+// src/auth/seed-permissions.ts
+async function seedAdministratorPermissions(dataSource, entityMap) {
+  const entities = getPermissionableEntityKeys(entityMap);
+  const groupRepo = dataSource.getRepository(entityMap.user_groups);
+  const permRepo = dataSource.getRepository(entityMap.permissions);
+  const adminGroup = await groupRepo.findOne({ where: { name: ADMIN_GROUP_NAME, deleted: false } });
+  if (!adminGroup) return;
+  const fullCrud = { canCreate: true, canRead: true, canUpdate: true, canDelete: true };
+  for (const entity of entities) {
+    const existing = await permRepo.findOne({
+      where: { groupId: adminGroup.id, entity }
+    });
+    if (existing) {
+      existing.canCreate = true;
+      existing.canRead = true;
+      existing.canUpdate = true;
+      existing.canDelete = true;
+      await permRepo.save(existing);
+    } else {
+      await permRepo.save(
+        permRepo.create({
+          groupId: adminGroup.id,
+          entity,
+          ...fullCrud
+        })
+      );
+    }
+  }
+}
+
 // src/auth/middleware.ts
 var defaultPublicApiMethods = {
   "/api/contacts": ["POST"],
@@ -115,12 +229,18 @@ function getNextAuthOptions(config) {
             if (!user || user.blocked || user.deleted || !user.password) return null;
             const valid = await comparePassword(credentials.password, user.password);
             if (!valid) return null;
+            const g = user.group;
+            const isRBACAdmin = isSuperAdminGroupName(g?.name);
+            const entityPerms = permissionRowsToRecord(g?.permissions);
+            const adminAccess = user.adminAccess === true;
             return {
               id: user.id.toString(),
               email: user.email,
               name: user.name,
               groupId: user.groupId ?? void 0,
-              permissions: ["admin"]
+              isRBACAdmin,
+              entityPerms,
+              adminAccess
             };
           } catch {
             return null;
@@ -144,17 +264,23 @@ function getNextAuthOptions(config) {
     callbacks: {
       async jwt({ token, user }) {
         if (user) {
-          token.id = user.id;
-          token.groupId = user.groupId;
-          token.permissions = user.permissions;
+          const u = user;
+          token.id = u.id;
+          token.groupId = u.groupId;
+          token.isRBACAdmin = u.isRBACAdmin;
+          token.entityPerms = u.entityPerms;
+          token.adminAccess = u.adminAccess;
         }
         return token;
       },
       async session({ session, token }) {
         if (session.user) {
-          session.user.id = token.id;
-          session.user.groupId = token.groupId;
-          session.user.permissions = token.permissions;
+          const t = token;
+          session.user.id = t.id;
+          session.user.groupId = t.groupId;
+          session.user.isRBACAdmin = t.isRBACAdmin;
+          session.user.entityPerms = t.entityPerms;
+          session.user.adminAccess = t.adminAccess;
         }
         return session;
       }
@@ -163,14 +289,23 @@ function getNextAuthOptions(config) {
   return extend ? extend(options) : options;
 }
 export {
+  ADMIN_GROUP_NAME,
   OPEN_ENDPOINTS,
   PERMISSION_REQUIRED_ENDPOINTS,
+  RBAC_ADMIN_ONLY_ENTITIES,
+  canManageRoles,
   createAuthHelpers,
   createCmsMiddleware,
   defaultPublicApiMethods,
   getNextAuthOptions,
+  getPermissionableEntityKeys,
   getRequiredPermission,
+  hasEntityPermission,
   isOpenEndpoint,
-  isPublicMethod
+  isPublicMethod,
+  isSuperAdminGroupName,
+  permissionRowsToRecord,
+  seedAdministratorPermissions,
+  sessionHasEntityAccess
 };
 //# sourceMappingURL=auth.js.map