@iqauth/sdk 2.6.4 → 2.8.1

package/dist/react-permissions.mjs

@@ -0,0 +1,98 @@
+import {
+  __useIQAuthInternal
+} from "./chunk-WHT6WKTY.mjs";
+import "./chunk-4V7FKOTG.mjs";
+import "./chunk-GN37E64I.mjs";
+import "./chunk-C2ZTBOAC.mjs";
+import "./chunk-JRDVUWAL.mjs";
+import {
+  expandPermissions,
+  hasPermission
+} from "./chunk-GLXSIGVS.mjs";
+import "./chunk-HVHNYPDC.mjs";
+import "./chunk-TLET552H.mjs";
+import "./chunk-6PJRLRB4.mjs";
+import "./chunk-Y6FXYEAI.mjs";
+
+// src/react/permissions.tsx
+import { useCallback, useMemo } from "react";
+import { useQuery } from "@tanstack/react-query";
+var DEFAULT_PERMS_STALE_MS = 5 * 60 * 1e3;
+function projectAllowedScopes(rows) {
+  if (!Array.isArray(rows)) return [];
+  const allowed = [];
+  const denied = /* @__PURE__ */ new Set();
+  for (const r of rows) {
+    if (!r || typeof r.scope !== "string" || !r.scope) continue;
+    if (r.effect === "deny") denied.add(r.scope);
+    else allowed.push(r.scope);
+  }
+  return expandPermissions(allowed.filter((s) => !denied.has(s)));
+}
+function useEffectivePermissions(opts) {
+  const { manager, snapshot } = __useIQAuthInternal();
+  const { appKey, enabled = true, staleTime = DEFAULT_PERMS_STALE_MS, issuer } = opts;
+  const claims = snapshot.claims;
+  const isPlatformAdmin = Array.isArray(claims?.roles) && claims.roles.includes("platform_admin");
+  const userId = snapshot.user?.sub ?? null;
+  const tenantId = snapshot.tenantId ?? claims?.tenantId ?? null;
+  const issuerUrl = (issuer ?? manager.issuerUrl).replace(/\/$/, "");
+  const queryEnabled = enabled && !!userId && !!tenantId && !!appKey && !isPlatformAdmin;
+  const query = useQuery({
+    queryKey: ["iqauth", "effective-permissions", issuerUrl, tenantId, userId, appKey],
+    queryFn: async () => {
+      const url = `${issuerUrl}/api/v1/tenants/${encodeURIComponent(tenantId)}/users/${encodeURIComponent(userId)}/permissions/effective?appKey=${encodeURIComponent(appKey)}`;
+      const res = await manager.fetch(url);
+      const json = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        const code = json?.error?.code || `HTTP_${res.status}`;
+        const message = json?.error?.message || `HTTP ${res.status}`;
+        const e = { code, message };
+        throw e;
+      }
+      const rows = Array.isArray(json) ? json : json?.data ?? [];
+      return projectAllowedScopes(rows);
+    },
+    enabled: queryEnabled,
+    staleTime,
+    refetchOnWindowFocus: false,
+    retry: false
+  });
+  const refetch = useCallback(async () => {
+    if (!queryEnabled) return;
+    await query.refetch();
+  }, [query, queryEnabled]);
+  return useMemo(() => {
+    if (isPlatformAdmin) {
+      return {
+        permissions: ["*"],
+        hasPermission: () => true,
+        isLoading: false,
+        error: null,
+        refetch
+      };
+    }
+    const fetched = query.data;
+    const perms = fetched ?? expandPermissions(claims?.entitlements ?? []);
+    const isLoading = queryEnabled && query.isLoading;
+    const error = query.error ? "code" in query.error && typeof query.error.code === "string" ? query.error : { code: "PERMISSIONS_FETCH_FAILED", message: query.error.message || "Failed to fetch permissions" } : null;
+    return {
+      permissions: perms,
+      hasPermission: (id) => hasPermission(perms, id),
+      isLoading,
+      error,
+      refetch
+    };
+  }, [
+    isPlatformAdmin,
+    queryEnabled,
+    query.data,
+    query.isLoading,
+    query.error,
+    claims?.entitlements,
+    refetch
+  ]);
+}
+export {
+  useEffectivePermissions
+};