@jmruthers/pace-core 0.6.9 → 0.6.11

package/dist/chunk-YYTWKVHO.js

@@ -0,0 +1,1334 @@
+import { AccessDenied } from './chunk-PCSHBLPB.js';
+import { useResolvedScope, scopeEqual, useCan, Alert, AlertTitle, useMultiplePermissions } from './chunk-V7FTM2LU.js';
+import { useEvents } from './chunk-WY6Y7KC3.js';
+import { useUnifiedAuth, useOrganisations } from './chunk-4R3T5ENU.js';
+import { setPrintTitle } from './chunk-D6BMFMQZ.js';
+import { getRBACLogger, isSuperAdmin } from './chunk-7A6IMHH2.js';
+import { cn, LoadingSpinner } from './chunk-UZNAFKGW.js';
+import { createLogger } from './chunk-BTHN5MKC.js';
+import React, { useEffect, useRef, useMemo, useState, useCallback } from 'react';
+import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+
+// src/rbac/types/functions.ts
+var RPCFunction = /* @__PURE__ */ ((RPCFunction2) => {
+  RPCFunction2["RBAC_PERMISSION_CHECK"] = "rbac_permission_check";
+  RPCFunction2["RBAC_PERMISSIONS_GET"] = "rbac_permissions_get";
+  RPCFunction2["RBAC_ACCESS_VALIDATE"] = "rbac_access_validate";
+  RPCFunction2["RBAC_PAGE_ACCESS_CHECK"] = "rbac_page_access_check";
+  RPCFunction2["RBAC_ROLE_GRANT"] = "rbac_role_grant";
+  RPCFunction2["RBAC_ROLE_REVOKE"] = "rbac_role_revoke";
+  RPCFunction2["RBAC_ROLES_LIST"] = "data_rbac_roles_list";
+  RPCFunction2["RBAC_ROLE_VALIDATE"] = "rbac_role_validate";
+  RPCFunction2["RBAC_SESSION_TRACK"] = "rbac_session_track";
+  RPCFunction2["RBAC_AUDIT_LOG"] = "rbac_audit_log";
+  return RPCFunction2;
+})(RPCFunction || {});
+var RBACErrorCode = /* @__PURE__ */ ((RBACErrorCode2) => {
+  RBACErrorCode2["USER_NOT_FOUND"] = "USER_NOT_FOUND";
+  RBACErrorCode2["INVALID_ROLE_TYPE"] = "INVALID_ROLE_TYPE";
+  RBACErrorCode2["INVALID_ROLE_NAME"] = "INVALID_ROLE_NAME";
+  RBACErrorCode2["MISSING_ORGANISATION_ID"] = "MISSING_ORGANISATION_ID";
+  RBACErrorCode2["MISSING_EVENT_APP_CONTEXT"] = "MISSING_EVENT_APP_CONTEXT";
+  RBACErrorCode2["ORGANISATION_NOT_FOUND"] = "ORGANISATION_NOT_FOUND";
+  RBACErrorCode2["EVENT_NOT_FOUND"] = "EVENT_NOT_FOUND";
+  RBACErrorCode2["APP_NOT_FOUND"] = "APP_NOT_FOUND";
+  RBACErrorCode2["INVALID_SESSION_TYPE"] = "INVALID_SESSION_TYPE";
+  RBACErrorCode2["INVALID_EVENT_TYPE"] = "INVALID_EVENT_TYPE";
+  RBACErrorCode2["DATABASE_ERROR"] = "DATABASE_ERROR";
+  RBACErrorCode2["ROLE_NOT_FOUND"] = "ROLE_NOT_FOUND";
+  RBACErrorCode2["USER_NOT_AUTHENTICATED"] = "USER_NOT_AUTHENTICATED";
+  RBACErrorCode2["INVALID_GLOBAL_ROLE"] = "INVALID_GLOBAL_ROLE";
+  RBACErrorCode2["INVALID_ORGANISATION_ROLE"] = "INVALID_ORGANISATION_ROLE";
+  RBACErrorCode2["INVALID_EVENT_APP_ROLE"] = "INVALID_EVENT_APP_ROLE";
+  RBACErrorCode2["INVALID_EVENT_APP_FORMAT"] = "INVALID_EVENT_APP_FORMAT";
+  RBACErrorCode2["MISSING_CONTEXT"] = "MISSING_CONTEXT";
+  RBACErrorCode2["INVALID_CONTEXT"] = "INVALID_CONTEXT";
+  RBACErrorCode2["GRANTED_BY_NOT_FOUND"] = "GRANTED_BY_NOT_FOUND";
+  return RBACErrorCode2;
+})(RBACErrorCode || {});
+var logger = getRBACLogger();
+function useSuperAdminCheck(userId) {
+  const [isSuperAdmin2, setIsSuperAdmin] = useState(null);
+  useEffect(() => {
+    if (!userId) {
+      setIsSuperAdmin(false);
+      return;
+    }
+    let cancelled = false;
+    const startTime = Date.now();
+    const checkSuperAdmin = async () => {
+      try {
+        const { isSuperAdmin: checkSuperAdmin2 } = await import('./api-BZR2CYXL.js');
+        const timeoutPromise = new Promise((_, reject) => {
+          setTimeout(() => reject(new Error("Super admin check timeout")), 1e4);
+        });
+        const result = await Promise.race([
+          checkSuperAdmin2(userId),
+          timeoutPromise
+        ]);
+        const elapsed = Date.now() - startTime;
+        if (!cancelled) {
+          const isSuper = result.ok && result.data;
+          setIsSuperAdmin(isSuper);
+          if (false) ;
+        }
+      } catch (err) {
+        const elapsed = Date.now() - startTime;
+        if (!cancelled) {
+          logger.error("[PagePermissionGuard] Error checking super admin", {
+            error: err,
+            userId,
+            elapsedMs: elapsed
+          });
+          setIsSuperAdmin(false);
+        }
+      }
+    };
+    checkSuperAdmin();
+    return () => {
+      cancelled = true;
+    };
+  }, [userId]);
+  return { isSuperAdmin: isSuperAdmin2 };
+}
+function usePageGuardScope({
+  supabase,
+  selectedOrganisationId,
+  selectedEventId,
+  selectedEventOrganisationId,
+  scope,
+  contextAppId,
+  appName,
+  isSuperAdmin: isSuperAdmin2
+}) {
+  const { resolvedScope: hookResolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
+    supabase,
+    selectedOrganisationId,
+    selectedEventId,
+    selectedEventOrganisationId
+  });
+  const allowsOptionalContexts = useMemo(() => appName === "PORTAL" || appName === "ADMIN", [appName]);
+  const effectiveScope = useMemo(
+    () => scope || (hookResolvedScope ? {
+      ...hookResolvedScope,
+      appId: hookResolvedScope.appId || (allowsOptionalContexts ? contextAppId : void 0)
+    } : allowsOptionalContexts && contextAppId ? { organisationId: void 0, eventId: void 0, appId: contextAppId } : selectedEventId ? { organisationId: void 0, eventId: selectedEventId, appId: contextAppId || void 0 } : null),
+    [scope, hookResolvedScope, allowsOptionalContexts, contextAppId, selectedEventId]
+  );
+  const prevScopeRef = useRef(null);
+  const stableScope = useMemo(() => {
+    if (allowsOptionalContexts && effectiveScope) {
+      const newScope2 = {
+        organisationId: effectiveScope.organisationId,
+        appId: effectiveScope.appId || contextAppId || void 0,
+        eventId: effectiveScope.eventId
+      };
+      if (scopeEqual(prevScopeRef.current, newScope2)) return prevScopeRef.current;
+      prevScopeRef.current = newScope2;
+      return newScope2;
+    }
+    const newScope = effectiveScope && effectiveScope.organisationId ? {
+      organisationId: effectiveScope.organisationId,
+      appId: effectiveScope.appId || contextAppId || void 0,
+      eventId: effectiveScope.eventId || void 0
+    } : {
+      organisationId: effectiveScope?.organisationId || void 0,
+      appId: effectiveScope?.appId || contextAppId || void 0,
+      eventId: effectiveScope?.eventId || selectedEventId || void 0
+    };
+    if (scopeEqual(prevScopeRef.current, newScope)) return prevScopeRef.current;
+    prevScopeRef.current = newScope;
+    return newScope;
+  }, [effectiveScope, contextAppId, selectedEventId, allowsOptionalContexts]);
+  const shouldBypassScopeForSuperAdmin = isSuperAdmin2 === true;
+  const scopeForPermissionCheck = shouldBypassScopeForSuperAdmin && !stableScope?.organisationId ? { organisationId: void 0, appId: contextAppId || void 0, eventId: selectedEventId || void 0 } : stableScope;
+  return {
+    effectiveScope,
+    stableScope,
+    scopeForPermissionCheck,
+    scopeLoading,
+    scopeError: scopeError ?? null,
+    allowsOptionalContexts
+  };
+}
+
+// src/rbac/hooks/usePagePermissionCheck.ts
+var dummyScope = { organisationId: void 0, appId: void 0, eventId: void 0 };
+function usePagePermissionCheck({
+  userId,
+  scopeForPermissionCheck,
+  shouldSkipPermissionCheck,
+  contextAppId,
+  permission,
+  effectivePageId,
+  isSuperAdmin: isSuperAdmin2,
+  appName
+}) {
+  const scope = shouldSkipPermissionCheck ? { ...dummyScope, appId: contextAppId } : scopeForPermissionCheck ?? dummyScope;
+  const { can, isLoading: canIsLoading, error: canError } = useCan(
+    userId,
+    scope,
+    permission,
+    effectivePageId,
+    true,
+    isSuperAdmin2,
+    appName
+  );
+  const effectiveCan = shouldSkipPermissionCheck ? true : can;
+  const effectiveIsLoading = shouldSkipPermissionCheck ? false : canIsLoading;
+  return { can, effectiveCan, canIsLoading: effectiveIsLoading, canError: canError ?? null };
+}
+var logger2 = getRBACLogger();
+function usePageAccessLogging(options) {
+  const {
+    setHasChecked,
+    hasChecked,
+    isLoading,
+    error,
+    effectiveCan,
+    pageName,
+    operation,
+    onDenied,
+    auditLog: _auditLog,
+    userId,
+    effectiveScope,
+    isSuperAdmin: isSuperAdmin2,
+    strictMode,
+    shouldBypassScopeForSuperAdmin,
+    effectivePageId,
+    allowsOptionalContexts,
+    checkError,
+    canError,
+    scopeLoading,
+    canIsLoading,
+    hasValidUser,
+    stableScope,
+    appName
+  } = options;
+  useEffect(() => {
+    if (!isLoading && !error) {
+      setHasChecked(true);
+      if (!effectiveCan && onDenied) onDenied(pageName, operation);
+    } else if (error) {
+      setHasChecked(true);
+    }
+  }, [effectiveCan, isLoading, error, pageName, operation, onDenied, setHasChecked]);
+  useEffect(() => {
+    if (strictMode && hasChecked && !isLoading && !effectiveCan && !shouldBypassScopeForSuperAdmin) {
+      logger2.error("STRICT MODE VIOLATION: User attempted to access protected page without permission", {
+        pageName,
+        operation,
+        permission: `${operation}:page.${pageName}`,
+        pageId: effectivePageId,
+        userId,
+        scope: effectiveScope,
+        scopeValid: allowsOptionalContexts ? true : effectiveScope !== null,
+        checkError,
+        canError,
+        isSuperAdmin: isSuperAdmin2,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+  }, [
+    strictMode,
+    hasChecked,
+    isLoading,
+    effectiveCan,
+    shouldBypassScopeForSuperAdmin,
+    pageName,
+    operation,
+    effectivePageId,
+    userId,
+    effectiveScope,
+    allowsOptionalContexts,
+    checkError,
+    canError,
+    isSuperAdmin2
+  ]);
+  useEffect(() => {
+    if (isLoading && isSuperAdmin2 === null && hasValidUser) {
+      const timeout = setTimeout(() => {
+        logger2.warn("Permission check taking longer than expected", {
+          pageName,
+          userId,
+          isSuperAdmin: isSuperAdmin2,
+          scopeLoading,
+          canIsLoading,
+          hasChecked,
+          stableScope,
+          effectiveScope,
+          appName
+        });
+      }, 5e3);
+      return () => clearTimeout(timeout);
+    }
+  }, [
+    isLoading,
+    isSuperAdmin2,
+    hasValidUser,
+    pageName,
+    userId,
+    scopeLoading,
+    canIsLoading,
+    hasChecked,
+    stableScope,
+    effectiveScope,
+    appName
+  ]);
+  const hasLoggedSuperAdminRef = useRef(false);
+  useEffect(() => {
+    if (isSuperAdmin2 === true && hasValidUser && !hasLoggedSuperAdminRef.current && false) ;
+    if (isSuperAdmin2 !== true) hasLoggedSuperAdminRef.current = false;
+  }, [isSuperAdmin2, hasValidUser, pageName, userId, operation]);
+}
+function getPageGuardView(state) {
+  const { isSuperAdmin: isSuperAdmin2, hasValidUser, isLoading, hasChecked, scopeError, can, effectiveCan, effectiveScope, allowsOptionalContexts, shouldBypassScopeForSuperAdmin } = state;
+  if (isSuperAdmin2 === true && hasValidUser) return "super-admin";
+  if (isLoading || !hasValidUser || !hasChecked || isSuperAdmin2 === null) return "loading";
+  const hasValidScope = shouldBypassScopeForSuperAdmin ? true : allowsOptionalContexts ? true : effectiveScope !== null;
+  const checkComplete = hasChecked && !isLoading;
+  if (scopeError && !can) return "denied";
+  if (checkComplete && hasValidScope && hasValidUser && !scopeError && !effectiveCan) return "denied";
+  if (checkComplete && hasValidScope && hasValidUser && !scopeError && effectiveCan) return "content";
+  return "fallback";
+}
+var PagePermissionGuardComponent = ({
+  pageName,
+  operation,
+  children,
+  fallback = /* @__PURE__ */ jsx(AccessDenied, {}),
+  strictMode = true,
+  auditLog = true,
+  pageId,
+  scope,
+  onDenied,
+  loading = /* @__PURE__ */ jsx(DefaultLoading, {}),
+  printPageOrientation = "portrait",
+  printTitle
+}) => {
+  useEffect(() => {
+    if (printTitle) setPrintTitle(printTitle);
+    return () => {
+      if (typeof document !== "undefined" && document.documentElement) {
+        document.documentElement.style.removeProperty("--print-title");
+      }
+    };
+  }, [printTitle]);
+  const renderCountRef = useRef(0);
+  renderCountRef.current += 1;
+  useMemo(() => Math.random().toString(36).substr(2, 9), []);
+  const { user, selectedOrganisation, selectedEvent, supabase, appId: contextAppId, appName } = useUnifiedAuth();
+  const { isSuperAdmin: isSuperAdmin2 } = useSuperAdminCheck(user?.id);
+  const effectivePageId = useMemo(() => pageId || pageName, [pageId, pageName]);
+  const permission = useMemo(() => `${operation}:page.${pageName}`, [operation, pageName]);
+  const {
+    effectiveScope,
+    stableScope,
+    scopeForPermissionCheck,
+    scopeLoading,
+    scopeError,
+    allowsOptionalContexts
+  } = usePageGuardScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id ?? null,
+    selectedEventId: selectedEvent?.event_id ?? null,
+    selectedEventOrganisationId: selectedEvent?.organisation_id ?? null,
+    scope,
+    contextAppId,
+    appName,
+    isSuperAdmin: isSuperAdmin2
+  });
+  const shouldBypassScopeForSuperAdmin = isSuperAdmin2 === true;
+  const shouldSkipPermissionCheck = isSuperAdmin2 === true;
+  const { can, effectiveCan, canIsLoading, canError } = usePagePermissionCheck({
+    userId: user?.id ?? "",
+    scopeForPermissionCheck,
+    shouldSkipPermissionCheck,
+    contextAppId,
+    permission,
+    effectivePageId,
+    isSuperAdmin: isSuperAdmin2,
+    appName
+  });
+  const isLoading = shouldBypassScopeForSuperAdmin ? canIsLoading : scopeLoading || canIsLoading;
+  const error = scopeError ?? canError;
+  const [hasChecked, setHasChecked] = useState(false);
+  const hasValidUser = Boolean(user?.id);
+  usePageAccessLogging({
+    setHasChecked,
+    hasChecked,
+    isLoading,
+    error,
+    effectiveCan,
+    pageName,
+    operation,
+    onDenied,
+    auditLog,
+    userId: user?.id,
+    effectiveScope,
+    isSuperAdmin: isSuperAdmin2,
+    strictMode,
+    shouldBypassScopeForSuperAdmin,
+    effectivePageId,
+    allowsOptionalContexts,
+    checkError: scopeError,
+    canError,
+    scopeLoading,
+    canIsLoading,
+    hasValidUser,
+    stableScope,
+    appName
+  });
+  const view = getPageGuardView({
+    isSuperAdmin: isSuperAdmin2,
+    hasValidUser,
+    isLoading,
+    hasChecked,
+    scopeError,
+    can,
+    effectiveCan,
+    effectiveScope,
+    allowsOptionalContexts,
+    shouldBypassScopeForSuperAdmin
+  });
+  switch (view) {
+    case "super-admin":
+      return /* @__PURE__ */ jsx(PageGuardLayout, { printPageOrientation, children });
+    case "loading":
+      return loading || /* @__PURE__ */ jsx("p", { children: "Checking permissions..." });
+    case "denied":
+      return fallback;
+    case "content":
+      return /* @__PURE__ */ jsx(PageGuardLayout, { printPageOrientation, withPrintPadding: true, children });
+    default:
+      return fallback;
+  }
+};
+function PageGuardLayout({
+  children,
+  printPageOrientation,
+  withPrintPadding = false
+}) {
+  return /* @__PURE__ */ jsx(
+    "main",
+    {
+      className: cn(
+        "px-4 w-[min(var(--app-width),100%)] mx-auto py-8",
+        withPrintPadding && "print:p-0 print:pb-[40mm]",
+        printPageOrientation === "landscape" && "print-page-landscape",
+        printPageOrientation === "portrait" && "print-page-portrait"
+      ),
+      children
+    }
+  );
+}
+function DefaultLoading() {
+  return /* @__PURE__ */ jsx(Alert, { role: "status", "aria-live": "polite", children: /* @__PURE__ */ jsxs(AlertTitle, { children: [
+    /* @__PURE__ */ jsx(LoadingSpinner, { size: "sm" }),
+    /* @__PURE__ */ jsx("br", {}),
+    "Checking permissions..."
+  ] }) });
+}
+var PagePermissionGuard = React.memo(PagePermissionGuardComponent);
+function NavigationGuard({
+  navigationItem,
+  children,
+  fallback = /* @__PURE__ */ jsx(AccessDenied, {}),
+  strictMode = true,
+  auditLog = true,
+  scope,
+  onDenied,
+  loading = /* @__PURE__ */ jsx(DefaultLoading2, {}),
+  requireAll = true
+}) {
+  const { user, selectedOrganisation, selectedEvent, supabase } = useUnifiedAuth();
+  const [hasChecked, setHasChecked] = useState(false);
+  const { resolvedScope: hookResolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null,
+    selectedEventOrganisationId: selectedEvent?.organisation_id || null
+  });
+  const effectiveScope = scope || hookResolvedScope;
+  const checkError = scopeError;
+  const validPermissions = (navigationItem.permissions || []).filter(
+    (p) => typeof p === "string" && (p.startsWith("read:") || p.startsWith("create:") || p.startsWith("update:") || p.startsWith("delete:"))
+  );
+  const { results: permissionResults, isLoading: permissionsLoading, error: permissionsError } = useMultiplePermissions(
+    user?.id || "",
+    effectiveScope || { eventId: selectedEvent?.event_id || void 0 },
+    validPermissions,
+    true
+    // Use cache
+  );
+  const isLoading = scopeLoading || permissionsLoading;
+  const error = checkError || permissionsError;
+  const hasRequiredPermissions = useMemo(() => {
+    if (!navigationItem.permissions || navigationItem.permissions.length === 0) return true;
+    if (requireAll) {
+      return Object.values(permissionResults).every((result) => result === true);
+    } else {
+      return Object.values(permissionResults).some((result) => result === true);
+    }
+  }, [navigationItem.permissions, permissionResults, requireAll]);
+  useEffect(() => {
+    if (!isLoading && !error) {
+      setHasChecked(true);
+      if (!hasRequiredPermissions && onDenied) {
+        onDenied(navigationItem);
+      }
+    } else if (error) {
+      setHasChecked(true);
+    }
+  }, [hasRequiredPermissions, isLoading, error, navigationItem, onDenied]);
+  useEffect(() => {
+  }, [auditLog, hasChecked, isLoading, navigationItem, user?.id, effectiveScope, hasRequiredPermissions, requireAll]);
+  useEffect(() => {
+    if (strictMode && hasChecked && !isLoading && !hasRequiredPermissions) {
+      const logger4 = getRBACLogger();
+      logger4.error(`STRICT MODE VIOLATION: User attempted to access protected navigation item without permission`, {
+        navigationItem: navigationItem.id,
+        permissions: navigationItem.permissions,
+        userId: user?.id,
+        scope: effectiveScope,
+        requireAll,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+  }, [strictMode, hasChecked, isLoading, hasRequiredPermissions, navigationItem, user?.id, effectiveScope, requireAll]);
+  if (isLoading || !effectiveScope || !hasChecked) {
+    return /* @__PURE__ */ jsx(Fragment, { children: loading });
+  }
+  if (checkError) {
+    const logger4 = getRBACLogger();
+    logger4.error(`Permission check failed for navigation item ${navigationItem.id}:`, checkError);
+    return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+  }
+  if (!hasRequiredPermissions) {
+    return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+  }
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+function DefaultLoading2() {
+  return /* @__PURE__ */ jsx(Alert, { role: "status", "aria-live": "polite", children: /* @__PURE__ */ jsxs(AlertTitle, { children: [
+    /* @__PURE__ */ jsx(LoadingSpinner, { size: "sm" }),
+    /* @__PURE__ */ jsx("br", {}),
+    "Checking..."
+  ] }) });
+}
+function useResourcePermissionsSuperAdmin(userId) {
+  const logger4 = createLogger("ResourcePermissionsSuperAdmin");
+  const [isSuperAdminUser, setIsSuperAdminUser] = useState(null);
+  const [isCheckingSuperAdmin, setIsCheckingSuperAdmin] = useState(() => !!userId);
+  const lastCheckedUserIdRef = useRef(null);
+  const isCheckingRef = useRef(false);
+  useEffect(() => {
+    if (lastCheckedUserIdRef.current === userId && isSuperAdminUser !== null) return;
+    if (isCheckingRef.current) return;
+    const checkSuperAdminStatus = async () => {
+      if (!userId) {
+        setIsSuperAdminUser(false);
+        setIsCheckingSuperAdmin(false);
+        lastCheckedUserIdRef.current = null;
+        return;
+      }
+      isCheckingRef.current = true;
+      lastCheckedUserIdRef.current = userId;
+      const startTime = Date.now();
+      setIsCheckingSuperAdmin(true);
+      const timeoutId = setTimeout(() => {
+        logger4.warn("useResourcePermissions", "Super admin check taking longer than 5 seconds", {
+          userId,
+          elapsedMs: Date.now() - startTime
+        });
+      }, 5e3);
+      try {
+        const result = await isSuperAdmin(userId);
+        setIsSuperAdminUser(result.ok && result.data);
+      } catch (error) {
+        const elapsed = Date.now() - startTime;
+        logger4.error("useResourcePermissions", "Error checking super admin status", {
+          userId,
+          error,
+          elapsedMs: elapsed
+        });
+        setIsSuperAdminUser(false);
+      } finally {
+        clearTimeout(timeoutId);
+        setIsCheckingSuperAdmin(false);
+        isCheckingRef.current = false;
+      }
+    };
+    checkSuperAdminStatus();
+  }, [userId, logger4, isSuperAdminUser]);
+  return { isSuperAdminUser, isCheckingSuperAdmin };
+}
+
+// src/rbac/hooks/useResourcePermissions.ts
+function buildResourcePermissions(params) {
+  const createSuperAdminAwarePermission = (result) => {
+    if (params.isSuperAdminUser === true) return true;
+    return result;
+  };
+  return {
+    canCreate: (res) => res !== params.resource ? false : createSuperAdminAwarePermission(params.canCreateResult),
+    canUpdate: (res) => res !== params.resource ? false : createSuperAdminAwarePermission(params.canUpdateResult),
+    canDelete: (res) => res !== params.resource ? false : createSuperAdminAwarePermission(params.canDeleteResult),
+    canRead: (res) => {
+      if (!params.enableRead) return true;
+      if (res !== params.resource) return false;
+      return createSuperAdminAwarePermission(params.canReadResult);
+    },
+    scope: params.scope,
+    isLoading: params.isCheckingSuperAdmin || params.isLoading,
+    error: params.error
+  };
+}
+function useResourcePermissions(resource, options = {}) {
+  const { enableRead = false, requireScope = true } = options;
+  const { user, supabase } = useUnifiedAuth();
+  const { isSuperAdminUser, isCheckingSuperAdmin } = useResourcePermissionsSuperAdmin(user?.id);
+  const { selectedOrganisation } = useOrganisations();
+  let selectedEvent = null;
+  try {
+    const eventsContext = useEvents();
+    selectedEvent = eventsContext.selectedEvent;
+  } catch (_error) {
+  }
+  const { resolvedScope, isLoading: scopeLoading, error: scopeError } = useResolvedScope({
+    supabase,
+    selectedOrganisationId: selectedOrganisation?.id || null,
+    selectedEventId: selectedEvent?.event_id || null,
+    selectedEventOrganisationId: selectedEvent?.organisation_id || null
+  });
+  const scope = useMemo(() => {
+    return resolvedScope || {
+      organisationId: selectedOrganisation?.id || "",
+      eventId: selectedEvent?.event_id || void 0,
+      appId: void 0
+    };
+  }, [resolvedScope, selectedOrganisation?.id, selectedEvent?.event_id]);
+  const hasAppId = !!resolvedScope?.appId;
+  const pageId = hasAppId ? resource : void 0;
+  const isPagePermission = hasAppId && !!pageId;
+  const createPermission = isPagePermission ? `create:page.${resource}` : `create:${resource}`;
+  const updatePermission = isPagePermission ? `update:page.${resource}` : `update:${resource}`;
+  const deletePermission = isPagePermission ? `delete:page.${resource}` : `delete:${resource}`;
+  const readPermission = isPagePermission ? `read:page.${resource}` : `read:${resource}`;
+  const { can: canCreateResult, isLoading: createLoading, error: createError } = useCan(
+    user?.id || "",
+    scope,
+    createPermission,
+    pageId,
+    // Pass resource name as pageId when appId is available to enable page permission checks
+    true,
+    // useCache
+    isSuperAdminUser,
+    // precomputedSuperAdmin - null if checking, false/true if checked
+    void 0
+    // appName
+  );
+  const { can: canUpdateResult, isLoading: updateLoading, error: updateError } = useCan(
+    user?.id || "",
+    scope,
+    updatePermission,
+    pageId,
+    // Pass resource name as pageId when appId is available to enable page permission checks
+    true,
+    // useCache
+    isSuperAdminUser,
+    // precomputedSuperAdmin - null if checking, false/true if checked
+    void 0
+    // appName
+  );
+  const { can: canDeleteResult, isLoading: deleteLoading, error: deleteError } = useCan(
+    user?.id || "",
+    scope,
+    deletePermission,
+    pageId,
+    // Pass resource name as pageId when appId is available to enable page permission checks
+    true,
+    // useCache
+    isSuperAdminUser,
+    // precomputedSuperAdmin - null if checking, false/true if checked
+    void 0
+    // appName
+  );
+  const { can: canReadResult, isLoading: readLoading, error: readError } = useCan(
+    user?.id || "",
+    scope,
+    readPermission,
+    pageId,
+    // Pass resource name as pageId when appId is available to enable page permission checks
+    true,
+    // useCache
+    isSuperAdminUser,
+    // precomputedSuperAdmin - null if checking, false/true if checked
+    void 0
+    // appName
+  );
+  const isLoading = useMemo(() => {
+    const waitingForScope = requireScope && scopeLoading;
+    const waitingForSuperAdmin = isSuperAdminUser === null && isCheckingSuperAdmin;
+    return waitingForScope || waitingForSuperAdmin || createLoading || updateLoading || deleteLoading || enableRead && readLoading;
+  }, [scopeLoading, requireScope, isSuperAdminUser, isCheckingSuperAdmin, createLoading, updateLoading, deleteLoading, readLoading, enableRead]);
+  const error = useMemo(() => {
+    if (scopeError) return scopeError;
+    if (createError) return createError;
+    if (updateError) return updateError;
+    if (deleteError) return deleteError;
+    if (enableRead && readError) return readError;
+    return null;
+  }, [scopeError, createError, updateError, deleteError, readError, enableRead]);
+  return useMemo(
+    () => buildResourcePermissions({
+      resource,
+      enableRead,
+      isSuperAdminUser,
+      isCheckingSuperAdmin,
+      canCreateResult,
+      canUpdateResult,
+      canDeleteResult,
+      canReadResult,
+      scope,
+      isLoading,
+      error
+    }),
+    [
+      resource,
+      enableRead,
+      isSuperAdminUser,
+      isCheckingSuperAdmin,
+      canCreateResult,
+      canUpdateResult,
+      canDeleteResult,
+      canReadResult,
+      scope,
+      isLoading,
+      error
+    ]
+  );
+}
+
+// src/rbac/utils/roleManagementRpc.ts
+var logger3 = createLogger("roleManagementRpc");
+function logIfDev(message, data) {
+  if (import.meta.env.MODE === "development") {
+    if (data !== void 0) {
+      logger3.debug(message, data);
+    } else {
+      logger3.debug(message);
+    }
+  }
+}
+function formatRpcError(rpcError) {
+  const parts = [
+    rpcError.message,
+    rpcError.details,
+    rpcError.hint,
+    rpcError.code ? `Error code: ${rpcError.code}` : null
+  ].filter(Boolean);
+  return parts.length > 0 ? parts.join(" | ") : "Unknown RPC error";
+}
+function parseRevokeResponse(data) {
+  if (!data || !Array.isArray(data) || data.length === 0) {
+    logIfDev("Empty or null revoke response", { data });
+    return { success: false, error: "No response from database - role revocation may have failed" };
+  }
+  const result = data[0];
+  logIfDev("Revoke RPC result", result);
+  if (!result || result.success !== true) {
+    const errorMessage = result?.message || result?.error_code || "Role revocation failed";
+    return {
+      success: false,
+      message: result?.message,
+      error: errorMessage
+    };
+  }
+  return {
+    success: true,
+    message: result.message ?? "Role revoked successfully",
+    error: void 0
+  };
+}
+async function revokeEventAppRoleRpc(supabase, params, revokedBy) {
+  const contextId = `${params.event_id}:${params.app_id}`;
+  const rpcParams = {
+    p_user_id: params.user_id,
+    p_role_type: "event_app",
+    p_role_name: params.role,
+    p_context_id: contextId,
+    p_revoked_by: params.revoked_by ?? revokedBy ?? void 0
+  };
+  logIfDev("revokeEventAppRole called with", rpcParams);
+  const { data, error: rpcError } = await supabase.rpc("rbac_role_revoke", rpcParams);
+  if (rpcError) {
+    logIfDev("RPC error", { message: rpcError.message, code: rpcError.code });
+    throw new Error(rpcError.message || "Failed to revoke role - unknown RPC error");
+  }
+  logIfDev("RPC response", { dataType: Array.isArray(data) ? "array" : typeof data });
+  return parseRevokeResponse(data);
+}
+async function grantEventAppRoleRpc(supabase, params, grantedBy) {
+  const contextId = `${params.event_id}:${params.app_id}`;
+  const rpcParams = {
+    p_user_id: params.user_id,
+    p_role_type: "event_app",
+    p_role_name: params.role,
+    p_context_id: contextId,
+    p_granted_by: params.granted_by ?? grantedBy ?? void 0
+  };
+  logIfDev("grantEventAppRole called with", rpcParams);
+  const { data, error: rpcError } = await supabase.rpc("rbac_role_grant", rpcParams);
+  if (rpcError) {
+    throw new Error(rpcError.message || "Failed to grant role");
+  }
+  if (!data || !Array.isArray(data) || data.length === 0) {
+    return { success: false, error: "No response from database - role grant may have failed" };
+  }
+  const result = data[0];
+  if (!result || result.success !== true) {
+    const errorMessage = result?.message ?? result?.error_code ?? "Role grant failed";
+    return {
+      success: false,
+      message: result?.message,
+      error: errorMessage
+    };
+  }
+  return {
+    success: true,
+    message: result.message ?? "Role granted successfully",
+    roleId: result.role_id
+  };
+}
+async function revokeRoleByIdRpc(supabase, roleId, revokedBy) {
+  const { data: roleData, error: fetchError } = await supabase.from("rbac_event_app_roles").select("user_id, role, event_id, app_id").eq("id", roleId).single();
+  if (fetchError || !roleData) {
+    throw new Error(fetchError?.message || "Role not found");
+  }
+  const contextId = `${roleData.event_id}:${roleData.app_id}`;
+  const { data, error: rpcError } = await supabase.rpc("rbac_role_revoke", {
+    p_user_id: roleData.user_id,
+    p_role_type: "event_app",
+    p_role_name: roleData.role,
+    p_context_id: contextId,
+    p_revoked_by: revokedBy ?? void 0
+  });
+  if (rpcError) {
+    throw new Error(rpcError.message || "Failed to revoke role - unknown RPC error");
+  }
+  const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
+  if (!result) {
+    return { success: false, error: void 0 };
+  }
+  if (result.success === false) {
+    const errorMessage = result.message || result.error_code || "Role revocation failed";
+    return { success: false, message: result.message, error: errorMessage };
+  }
+  return {
+    success: true,
+    message: result.message ?? "Role revoked successfully",
+    error: void 0
+  };
+}
+function parseGrantResponse(data, fallbackError) {
+  const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
+  if (!result || !result.success) {
+    return {
+      success: false,
+      error: result?.message || result?.error_code || fallbackError,
+      message: result?.message
+    };
+  }
+  return {
+    success: true,
+    message: result.message ?? "Role granted successfully",
+    roleId: result.role_id
+  };
+}
+async function grantGlobalRoleRpc(supabase, params, grantedBy) {
+  const { data, error: rpcError } = await supabase.rpc("rbac_role_grant", {
+    p_user_id: params.user_id,
+    p_role_type: "global",
+    p_role_name: params.role,
+    p_context_id: null,
+    p_granted_by: params.granted_by ?? grantedBy ?? void 0
+  });
+  if (rpcError) {
+    throw new Error(rpcError.message || "Failed to grant role");
+  }
+  return parseGrantResponse(data, "Failed to grant role");
+}
+async function revokeGlobalRoleRpc(supabase, params, revokedBy) {
+  const { data, error: rpcError } = await supabase.rpc("rbac_role_revoke", {
+    p_user_id: params.user_id,
+    p_role_type: "global",
+    p_role_name: params.role,
+    p_context_id: null,
+    p_revoked_by: params.revoked_by ?? revokedBy ?? void 0
+  });
+  if (rpcError) {
+    throw new Error(formatRpcError(rpcError));
+  }
+  const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
+  return {
+    success: result?.success === true,
+    message: result?.message,
+    error: result?.success === false ? result?.message || result?.error_code || "Unknown error" : void 0
+  };
+}
+async function grantOrganisationRoleRpc(supabase, params, grantedBy) {
+  const { data, error: rpcError } = await supabase.rpc("rbac_role_grant", {
+    p_user_id: params.user_id,
+    p_role_type: "organisation",
+    p_role_name: params.role,
+    p_context_id: params.organisation_id,
+    p_granted_by: params.granted_by ?? grantedBy ?? void 0
+  });
+  if (rpcError) {
+    throw new Error(rpcError.message || "Failed to grant role");
+  }
+  return parseGrantResponse(data, "Failed to grant role");
+}
+async function revokeOrganisationRoleRpc(supabase, params, revokedBy) {
+  const { data, error: rpcError } = await supabase.rpc("rbac_role_revoke", {
+    p_user_id: params.user_id,
+    p_role_type: "organisation",
+    p_role_name: params.role,
+    p_context_id: params.organisation_id,
+    p_revoked_by: params.revoked_by ?? revokedBy ?? void 0
+  });
+  if (rpcError) {
+    throw new Error(formatRpcError(rpcError));
+  }
+  const result = Array.isArray(data) && data.length > 0 ? data[0] : null;
+  return {
+    success: result?.success === true,
+    message: result?.message,
+    error: result?.success === false ? result?.message || result?.error_code || "Unknown error" : void 0
+  };
+}
+
+// src/rbac/hooks/useRoleManagement.ts
+function failureResult(errorMessage) {
+  return { success: false, error: errorMessage };
+}
+function useRoleManagement() {
+  const { user, supabase } = useUnifiedAuth();
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState(null);
+  if (!supabase) {
+    throw new Error("useRoleManagement requires a Supabase client. Ensure UnifiedAuthProvider is configured.");
+  }
+  const runWithLoading = useCallback(
+    async (fn) => {
+      setIsLoading(true);
+      setError(null);
+      try {
+        return await fn();
+      } catch (err) {
+        setError(err instanceof Error ? err : new Error(String(err)));
+        throw err;
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    []
+  );
+  const revokeEventAppRole = useCallback(
+    async (params) => {
+      try {
+        return await runWithLoading(
+          () => revokeEventAppRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error occurred";
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+  const grantEventAppRole = useCallback(
+    async (params) => {
+      try {
+        return await runWithLoading(
+          () => grantEventAppRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error occurred";
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+  const revokeRoleById = useCallback(
+    async (roleId) => {
+      try {
+        return await runWithLoading(
+          () => revokeRoleByIdRpc(supabase, roleId, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error occurred";
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+  const grantGlobalRole = useCallback(
+    async (params) => {
+      try {
+        return await runWithLoading(
+          () => grantGlobalRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error occurred";
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+  const revokeGlobalRole = useCallback(
+    async (params) => {
+      try {
+        return await runWithLoading(
+          () => revokeGlobalRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error occurred";
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+  const grantOrganisationRole = useCallback(
+    async (params) => {
+      try {
+        return await runWithLoading(
+          () => grantOrganisationRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error occurred";
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+  const revokeOrganisationRole = useCallback(
+    async (params) => {
+      try {
+        return await runWithLoading(
+          () => revokeOrganisationRoleRpc(supabase, params, user?.id)
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error occurred";
+        return failureResult(msg);
+      }
+    },
+    [supabase, user?.id, runWithLoading]
+  );
+  return {
+    revokeEventAppRole,
+    grantEventAppRole,
+    revokeRoleById,
+    grantGlobalRole,
+    revokeGlobalRole,
+    grantOrganisationRole,
+    revokeOrganisationRole,
+    isLoading,
+    error
+  };
+}
+
+// src/rbac/adapters.tsx
+function withPermissionGuard(config, handler) {
+  return async (...args) => {
+    const [req] = args;
+    const userId = req.user?.id;
+    const organisationId = req.organisationId;
+    const eventId = req.eventId;
+    const appId = req.appId;
+    if (!userId || !organisationId) {
+      throw new Error("User context required for permission check");
+    }
+    const { isPermitted: isPermitted2 } = await import('./api-BZR2CYXL.js');
+    const result = await isPermitted2({
+      userId,
+      scope: { organisationId, eventId, appId },
+      permission: config.permission,
+      pageId: config.pageId
+    });
+    if (!result.ok) {
+      throw new Error(result.error.message);
+    }
+    if (!result.data) {
+      throw new Error(`Permission denied: ${config.permission}`);
+    }
+    return handler(...args);
+  };
+}
+function withAccessLevelGuard(minLevel, handler) {
+  return async (...args) => {
+    const [req] = args;
+    const userId = req.user?.id;
+    const organisationId = req.organisationId;
+    const eventId = req.eventId;
+    const appId = req.appId;
+    if (!userId || !organisationId) {
+      throw new Error("User context required for access level check");
+    }
+    const { getAccessLevel: getAccessLevel2 } = await import('./api-BZR2CYXL.js');
+    const result = await getAccessLevel2({
+      userId,
+      scope: { organisationId, eventId, appId }
+    });
+    if (!result.ok) {
+      throw new Error(result.error.message);
+    }
+    const accessLevel = result.data;
+    const levelHierarchy = ["viewer", "participant", "planner", "admin", "super"];
+    const userLevelIndex = levelHierarchy.indexOf(accessLevel);
+    const requiredLevelIndex = levelHierarchy.indexOf(minLevel);
+    if (userLevelIndex < requiredLevelIndex) {
+      throw new Error(`Access level required: ${minLevel}, got: ${accessLevel}`);
+    }
+    return handler(...args);
+  };
+}
+function withRoleGuard(config, handler) {
+  return async (...args) => {
+    const [req] = args;
+    const userId = req.user?.id;
+    const organisationId = req.organisationId;
+    const eventId = req.eventId;
+    const appId = req.appId;
+    if (!userId || !organisationId) {
+      throw new Error("User context required for role check");
+    }
+    if (config.globalRoles && config.globalRoles.length > 0) {
+      const { isSuperAdmin: isSuperAdmin2 } = await import('./api-BZR2CYXL.js');
+      const superResult = await isSuperAdmin2(userId);
+      if (superResult.ok && superResult.data) {
+        if (organisationId) {
+          const { emitAuditEvent: emitAuditEvent2 } = await import('./audit-HI2DHUVU.js');
+          await emitAuditEvent2({
+            type: "permission_check",
+            userId,
+            organisationId,
+            eventId,
+            appId,
+            permission: "bypass:all",
+            decision: true,
+            source: "api",
+            bypass: true,
+            duration_ms: 0,
+            metadata: {
+              operation: "role_guard",
+              reason: "super_admin_bypass"
+            }
+          });
+        }
+        return handler(...args);
+      }
+    }
+    if (config.organisationRoles && config.organisationRoles.length > 0) {
+      const { isOrganisationAdmin } = await import('./api-BZR2CYXL.js');
+      const orgResult = await isOrganisationAdmin(userId, organisationId);
+      if (!orgResult.ok) {
+        throw new Error(orgResult.error.message);
+      }
+      if (!orgResult.data && config.requireAll !== false) {
+        throw new Error(`Organisation admin role required`);
+      }
+    }
+    if (config.eventAppRoles && config.eventAppRoles.length > 0 && eventId && appId) {
+      const { isEventAdmin } = await import('./api-BZR2CYXL.js');
+      const eventResult = await isEventAdmin(userId, { organisationId, eventId, appId });
+      if (!eventResult.ok) {
+        throw new Error(eventResult.error.message);
+      }
+      if (!eventResult.data && config.requireAll !== false) {
+        throw new Error(`Event admin role required`);
+      }
+    }
+    if (organisationId) {
+      const { emitAuditEvent: emitAuditEvent2 } = await import('./audit-HI2DHUVU.js');
+      await emitAuditEvent2({
+        type: "permission_check",
+        userId,
+        organisationId,
+        eventId,
+        appId,
+        permission: "role:check",
+        decision: true,
+        source: "api",
+        bypass: false,
+        duration_ms: 0,
+        metadata: {
+          operation: "role_guard"
+        }
+      });
+    }
+    return handler(...args);
+  };
+}
+function createRBACMiddleware(config) {
+  return async (req, res, next) => {
+    const { pathname } = req.nextUrl;
+    const userId = req.user?.id;
+    const organisationId = req.organisationId;
+    if (!userId || !organisationId) {
+      return res.redirect(config.fallbackUrl || "/login");
+    }
+    const protectedRoute = config.protectedRoutes.find(
+      (route) => pathname.startsWith(route.path)
+    );
+    if (protectedRoute) {
+      try {
+        const { isPermitted: isPermitted2 } = await import('./api-BZR2CYXL.js');
+        const result = await isPermitted2({
+          userId,
+          scope: { organisationId },
+          permission: protectedRoute.permission,
+          pageId: protectedRoute.pageId
+        });
+        if (!result.ok || !result.data) {
+          return res.redirect(config.fallbackUrl || "/access-denied");
+        }
+      } catch (_error) {
+        return res.redirect(config.fallbackUrl || "/access-denied");
+      }
+    }
+    next();
+  };
+}
+function createRBACExpressMiddleware(config) {
+  return async (req, res, next) => {
+    const userId = req.user?.id;
+    const organisationId = req.organisationId;
+    const eventId = req.eventId;
+    const appId = req.appId;
+    if (!userId || !organisationId) {
+      return res.status(401).json({ error: "User context required" });
+    }
+    try {
+      const { isPermitted: isPermitted2 } = await import('./api-BZR2CYXL.js');
+      const result = await isPermitted2({
+        userId,
+        scope: { organisationId, eventId, appId },
+        permission: config.permission,
+        pageId: config.pageId
+      });
+      if (!result.ok || !result.data) {
+        return res.status(403).json({ error: "Permission denied" });
+      }
+      next();
+    } catch (_error) {
+      return res.status(500).json({ error: "Permission check failed" });
+    }
+  };
+}
+
+// src/rbac/permissions.ts
+var GLOBAL_PERMISSIONS = {
+  READ_ALL: "read:*",
+  CREATE_ALL: "create:*",
+  UPDATE_ALL: "update:*",
+  DELETE_ALL: "delete:*"
+};
+var ORGANISATION_PERMISSIONS = {
+  // Organisation management
+  READ_ORGANISATION: "read:organisation",
+  UPDATE_ORGANISATION: "update:organisation",
+  DELETE_ORGANISATION: "delete:organisation",
+  // User management
+  READ_USERS: "read:users",
+  CREATE_USERS: "create:users",
+  UPDATE_USERS: "update:users",
+  DELETE_USERS: "delete:users",
+  // Role management
+  READ_ROLES: "read:roles",
+  CREATE_ROLES: "create:roles",
+  UPDATE_ROLES: "update:roles",
+  DELETE_ROLES: "delete:roles",
+  // Event management
+  READ_EVENTS: "read:events",
+  CREATE_EVENTS: "create:events",
+  UPDATE_EVENTS: "update:events",
+  DELETE_EVENTS: "delete:events",
+  // App management
+  READ_APPS: "read:apps",
+  CREATE_APPS: "create:apps",
+  UPDATE_APPS: "update:apps",
+  DELETE_APPS: "delete:apps"
+};
+var EVENT_APP_PERMISSIONS = {
+  // Event management
+  READ_EVENT: "read:event",
+  CREATE_EVENT: "create:event",
+  UPDATE_EVENT: "update:event",
+  DELETE_EVENT: "delete:event",
+  // App management
+  READ_APP: "read:app",
+  CREATE_APP: "create:app",
+  UPDATE_APP: "update:app",
+  DELETE_APP: "delete:app",
+  // Team management
+  READ_TEAM: "read:team",
+  CREATE_TEAM: "create:team",
+  UPDATE_TEAM: "update:team",
+  DELETE_TEAM: "delete:team",
+  // Team members
+  READ_TEAM_MEMBERS: "read:team.members",
+  CREATE_TEAM_MEMBERS: "create:team.members",
+  UPDATE_TEAM_MEMBERS: "update:team.members",
+  DELETE_TEAM_MEMBERS: "delete:team.members",
+  // Event content
+  READ_EVENT_CONTENT: "read:event.content",
+  CREATE_EVENT_CONTENT: "create:event.content",
+  UPDATE_EVENT_CONTENT: "update:event.content",
+  DELETE_EVENT_CONTENT: "delete:event.content",
+  // Event settings
+  READ_EVENT_SETTINGS: "read:event.settings",
+  CREATE_EVENT_SETTINGS: "create:event.settings",
+  UPDATE_EVENT_SETTINGS: "update:event.settings",
+  DELETE_EVENT_SETTINGS: "delete:event.settings"
+};
+var PAGE_PERMISSIONS = {
+  // General page access (generic - used for wildcard checks)
+  READ_PAGE: "read:page",
+  CREATE_PAGE: "create:page",
+  UPDATE_PAGE: "update:page",
+  DELETE_PAGE: "delete:page",
+  // Admin pages
+  READ_ADMIN: "read:page.admin",
+  CREATE_ADMIN: "create:page.admin",
+  UPDATE_ADMIN: "update:page.admin",
+  DELETE_ADMIN: "delete:page.admin",
+  // Dashboard pages
+  READ_DASHBOARD: "read:page.dashboard",
+  CREATE_DASHBOARD: "create:page.dashboard",
+  UPDATE_DASHBOARD: "update:page.dashboard",
+  DELETE_DASHBOARD: "delete:page.dashboard",
+  // Settings pages
+  READ_SETTINGS: "read:page.settings",
+  CREATE_SETTINGS: "create:page.settings",
+  UPDATE_SETTINGS: "update:page.settings",
+  DELETE_SETTINGS: "delete:page.settings",
+  // Reports pages
+  READ_REPORTS: "read:page.reports",
+  CREATE_REPORTS: "create:page.reports",
+  UPDATE_REPORTS: "update:page.reports",
+  DELETE_REPORTS: "delete:page.reports"
+};
+function isValidPermission(permission) {
+  const pattern = /^(read|create|update|delete):[a-z0-9]+(\.[a-z0-9]+)*$|^(read|create|update|delete):\*$/;
+  return pattern.test(permission);
+}
+var ALL_PERMISSIONS = {
+  ...GLOBAL_PERMISSIONS,
+  ...ORGANISATION_PERMISSIONS,
+  ...EVENT_APP_PERMISSIONS,
+  ...PAGE_PERMISSIONS
+};
+
+export { ALL_PERMISSIONS, EVENT_APP_PERMISSIONS, GLOBAL_PERMISSIONS, NavigationGuard, ORGANISATION_PERMISSIONS, PAGE_PERMISSIONS, PagePermissionGuard, RBACErrorCode, RPCFunction, createRBACExpressMiddleware, createRBACMiddleware, isValidPermission, useResourcePermissions, useRoleManagement, withAccessLevelGuard, withPermissionGuard, withRoleGuard };