@kywi-software/core 0.13.0 → 0.15.0

package/dist/admin/surfaces/users/users-detail.js

@@ -14,8 +14,34 @@ import { useCallback, useEffect, useState } from 'react';
 import { useAdminContext } from '../../context.js';
 import { UserForm } from '../../user-form.js';
 import { LoadingState, ErrorState } from '../../primitives.js';
-import { fetchData, loadGroupsWithMembers, loadSites, fullName, KYWI_ROLES, } from './users-data.js';
-const ROLES = [...KYWI_ROLES];
+import { fetchData, loadGroupsWithMembers, loadSites, fullName, assignableRoles, } from './users-data.js';
+/**
+ * What the role control offers for this target, and why it might be locked
+ * (kywi-cms#175).
+ *
+ * The server lets an admin grant up to their own rank and no further, so the
+ * dropdown offers exactly that. The awkward case is a target who ALREADY
+ * outranks the caller: their current role is not in the caller's list, so
+ * rendering the list alone would show the wrong role and invite a save that
+ * reads as a demotion. Show that account's real role, alone and locked,
+ * instead — the API refuses the whole edit anyway (`You cannot edit a user
+ * above your own role`), so there is nothing to offer here but the truth.
+ */
+function roleOptionsFor(callerRole, targetRole) {
+    const grantable = assignableRoles(callerRole);
+    if (grantable.includes(targetRole))
+        return { roles: grantable };
+    return {
+        roles: [targetRole],
+        lockedRoleReason: `This account's role is above your own, so you cannot change it.`,
+    };
+}
+/** Set-equality on two id lists — order and duplicates are not meaningful here. */
+function sameMembership(next, prev) {
+    const a = new Set(next);
+    const b = new Set(prev);
+    return a.size === b.size && [...a].every(id => b.has(id));
+}
 export default function UsersDetailSurface({ params }) {
     const { fetch: adminFetch, user: currentUser, navigate } = useAdminContext();
     const userId = params.id ?? '';
@@ -25,6 +51,10 @@ export default function UsersDetailSurface({ params }) {
     const [loading, setLoading] = useState(true);
     const [loadError, setLoadError] = useState(null);
     const [submitError, setSubmitError] = useState(null);
+    const [notice, setNotice] = useState(null);
+    // Bumped after a successful password change so the form remounts with fresh
+    // initial values — otherwise the typed password stays sitting in the field.
+    const [formEpoch, setFormEpoch] = useState(0);
     const [submitting, setSubmitting] = useState(false);
     const load = useCallback(async () => {
         setLoading(true);
@@ -60,6 +90,8 @@ export default function UsersDetailSurface({ params }) {
             return;
         setSubmitting(true);
         setSubmitError(null);
+        setNotice(null);
+        let passwordChanged = false;
         try {
             const patch = {
                 email: values.email,
@@ -71,6 +103,7 @@ export default function UsersDetailSurface({ params }) {
             if (!isSelf) {
                 patch.role = values.role;
                 patch.isActive = values.isActive;
+                patch.passwordResetRequired = values.forcePasswordReset;
             }
             const res = await adminFetch(`/api/v1/users/${userId}`, {
                 method: 'PUT',
@@ -81,6 +114,44 @@ export default function UsersDetailSurface({ params }) {
                 const body = await res.json().catch(() => null);
                 throw new Error(body?.error?.message ?? `Save failed (${res.status})`);
             }
+            // Membership reconciliation runs AFTER the password step, so a password
+            // failure drops any pending group/site edits with it (kywi-cms#177). The
+            // work is retry-safe — the sets are recomputed from the form on the next
+            // save — but the partial-failure message has to say so rather than imply
+            // everything but the password landed. Compute it here, before the early
+            // return, so the message can name what was actually skipped.
+            const membershipEditsPending = !sameMembership(values.groupIds, data.currentGroupIds) ||
+                !sameMembership(values.siteIds, data.currentSiteIds);
+            // Password is a SEPARATE endpoint — `password` is never accepted on PUT.
+            // Run it only when a new password was actually typed, and treat a failure
+            // as partial success: the profile save stands and we say exactly that.
+            if (values.password !== '') {
+                const pwdBody = { newPassword: values.password };
+                if (isSelf)
+                    pwdBody.currentPassword = values.currentPassword;
+                const pwdRes = await adminFetch(`/api/v1/users/${userId}/password`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(pwdBody),
+                });
+                // A self-change returns a fresh { accessToken, refreshToken } pair,
+                // deliberately ignored here: `adminFetch` authenticates with the
+                // httpOnly session cookie (host-client `adminFetch` sets no
+                // Authorization header), and the host proxy lifts that pair into the
+                // cookies for this path (`isTokenIssuingPath`), so the session already
+                // survives without the UI touching a token.
+                if (!pwdRes.ok) {
+                    const body = await pwdRes.json().catch(() => null);
+                    const detail = body?.error?.message ?? `Password change failed (${pwdRes.status})`;
+                    setNotice(null);
+                    setSubmitError(membershipEditsPending
+                        ? `Name, email and role were saved. The password was not changed — ${detail} — and the group/site membership changes were not applied. Fix the password and save again, or clear the password field to save the memberships on their own.`
+                        : `Name, email and role were saved, but the password was not changed — ${detail}`);
+                    setSubmitting(false);
+                    return;
+                }
+                passwordChanged = true;
+            }
             // Reconcile group memberships
             const nextGroups = new Set(values.groupIds);
             const prevGroups = new Set(data.currentGroupIds);
@@ -106,13 +177,23 @@ export default function UsersDetailSurface({ params }) {
                     siteOps.push(adminFetch(`/api/v1/users/${userId}/sites/${sid}`, { method: 'DELETE' }));
             }
             await Promise.all([...groupOps, ...siteOps]);
+            if (passwordChanged) {
+                // A password change is worth confirming in place rather than dropping
+                // the admin back on the list with no word about it. Reloading clears
+                // the password fields and refreshes the membership baseline.
+                setNotice('Profile saved and password changed.');
+                setFormEpoch(n => n + 1);
+                setSubmitting(false);
+                await load();
+                return;
+            }
             navigate('/admin/users');
         }
         catch (e) {
             setSubmitError(e instanceof Error ? e.message : 'Failed to save user');
             setSubmitting(false);
         }
-    }, [data, isSelf, navigate, userId, adminFetch]);
+    }, [data, isSelf, navigate, userId, adminFetch, load]);
     const handleDelete = useCallback(async () => {
         if (!data)
             return;
@@ -133,7 +214,7 @@ export default function UsersDetailSurface({ params }) {
             setSubmitting(false);
         }
     }, [data, navigate, userId, adminFetch]);
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "kywi-admin-page-header", children: [_jsx("h1", { children: data ? `Edit ${fullName(data.user)}` : 'Edit User' }), data && !isSelf && (_jsx("button", { type: "button", className: "kywi-btn kywi-btn-danger", onClick: handleDelete, disabled: submitting, children: "Delete User" }))] }), loading ? (_jsx(LoadingState, { label: "Loading user\u2026" })) : loadError ? (_jsx(ErrorState, { message: loadError, onRetry: load })) : data ? (_jsxs(_Fragment, { children: [isSelf && (_jsx("div", { className: "kywi-admin-callout kywi-admin-callout-info", children: _jsx("p", { children: "This is your own account. You cannot change your role, deactivate, or delete yourself." }) })), submitError && _jsx(ErrorState, { message: submitError }), _jsx(UserForm, { roles: ROLES, groups: data.groups, sites: data.sites, selfEdit: isSelf, user: {
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "kywi-admin-page-header", children: [_jsx("h1", { children: data ? `Edit ${fullName(data.user)}` : 'Edit User' }), data && !isSelf && (_jsx("button", { type: "button", className: "kywi-btn kywi-btn-danger", onClick: handleDelete, disabled: submitting, children: "Delete User" }))] }), loading ? (_jsx(LoadingState, { label: "Loading user\u2026" })) : loadError ? (_jsx(ErrorState, { message: loadError, onRetry: load })) : data ? (_jsxs(_Fragment, { children: [isSelf && (_jsx("div", { className: "kywi-admin-callout kywi-admin-callout-info", children: _jsx("p", { children: "This is your own account. You cannot change your role, deactivate, or delete yourself." }) })), notice && (_jsx("div", { className: "kywi-admin-callout kywi-admin-callout-success", role: "status", children: notice })), submitError && _jsx(ErrorState, { message: submitError }), _jsx(UserForm, { ...roleOptionsFor(currentUser?.role, data.user.role), groups: data.groups, sites: data.sites, selfEdit: isSelf, user: {
                             id: data.user.id,
                             email: data.user.email,
                             firstName: data.user.firstName,
@@ -142,7 +223,7 @@ export default function UsersDetailSurface({ params }) {
                             isActive: data.user.isActive,
                             groupIds: data.currentGroupIds,
                             siteIds: data.currentSiteIds,
-                            forcePasswordReset: false,
-                        }, onSubmit: handleSubmit, onCancel: () => navigate('/admin/users'), isSubmitting: submitting })] })) : null] }));
+                            forcePasswordReset: data.user.passwordResetRequired ?? false,
+                        }, onSubmit: handleSubmit, onCancel: () => navigate('/admin/users'), isSubmitting: submitting }, formEpoch)] })) : null] }));
 }
 //# sourceMappingURL=users-detail.js.map

package/dist/admin/surfaces/users/users-detail.js.map

@@ -1 +1 @@
-{"version":3,"file":"users-detail.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/users/users-detail.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;GASG;AAEH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAA8D,MAAM,oBAAoB,CAAA;AACzG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,UAAU,GAGX,MAAM,iBAAiB,CAAA;AAExB,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,CAAA;AAU7B,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,EAAE,MAAM,EAAgB;IACjE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,eAAe,EAAE,CAAA;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAA;IAE9B,MAAM,aAAa,GAAG,WAAW,EAAE,EAAE,IAAI,IAAI,CAAA;IAC7C,MAAM,MAAM,GAAG,aAAa,KAAK,MAAM,CAAA;IAEvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAkB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACnE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9D,SAAS,CAAU,UAAU,EAAE,iBAAiB,MAAM,EAAE,CAAC;gBACzD,qBAAqB,CAAC,UAAU,CAAC;gBACjC,SAAS,CAAC,UAAU,CAAC;gBACrB,SAAS,CAA4B,UAAU,EAAE,iBAAiB,MAAM,QAAQ,CAAC;aAClF,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM;iBACrC,MAAM,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBAChF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACjB,OAAO,CAAC;gBACN,IAAI;gBACJ,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnD,eAAe;gBACf,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aAC/C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAA;QACtE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAExB,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,MAAsB,EAAE,EAAE;QAChE,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,aAAa,CAAC,IAAI,CAAC,CAAA;QACnB,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAA4B;gBACrC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAA;YACD,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;gBACxB,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;YAClC,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,iBAAiB,MAAM,EAAE,EAAE;gBACtD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,gBAAgB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YACxE,CAAC;YAED,8BAA8B;YAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAChD,MAAM,QAAQ,GAAwB,EAAE,CAAA;YACxC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,GAAG,YAAY,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YACpH,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,GAAG,YAAY,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;YACtH,CAAC;YAED,6BAA6B;YAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YAC9C,MAAM,OAAO,GAAwB,EAAE,CAAA;YACvC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,MAAM,UAAU,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAC/G,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,MAAM,UAAU,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;YACjH,CAAC;YAED,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;YAC5C,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,cAAc,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAA;YACtE,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAEhD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC;YAAE,OAAM;QACpF,aAAa,CAAC,IAAI,CAAC,CAAA;QACnB,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,iBAAiB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YAC1E,CAAC;YACD,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,cAAc,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAA;YACxE,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAExC,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,wBAAwB,aACrC,uBAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,GAAM,EAC5D,IAAI,IAAI,CAAC,MAAM,IAAI,CAClB,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,0BAA0B,EACpC,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,UAAU,4BAGb,CACV,IACG,EAEL,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,YAAY,IAAC,KAAK,EAAC,oBAAe,GAAG,CACvC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACd,KAAC,UAAU,IAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,GAAI,CAClD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACT,8BACG,MAAM,IAAI,CACT,cAAK,SAAS,EAAC,4CAA4C,YACzD,iHAA6F,GACzF,CACP,EACA,WAAW,IAAI,KAAC,UAAU,IAAC,OAAO,EAAE,WAAW,GAAI,EACpD,KAAC,QAAQ,IACP,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,IAAI,CAAC,MAAM,EACnB,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;4BACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;4BAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;4BACtB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;4BAC9B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;4BAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;4BACpB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;4BAC5B,QAAQ,EAAE,IAAI,CAAC,eAAe;4BAC9B,OAAO,EAAE,IAAI,CAAC,cAAc;4BAC5B,kBAAkB,EAAE,KAAK;yBAC1B,EACD,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EACxC,YAAY,EAAE,UAAU,GACxB,IACD,CACJ,CAAC,CAAC,CAAC,IAAI,IACP,CACJ,CAAA;AACH,CAAC"}
+{"version":3,"file":"users-detail.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/users/users-detail.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;GASG;AAEH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAA8D,MAAM,oBAAoB,CAAA;AACzG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,eAAe,GAGhB,MAAM,iBAAiB,CAAA;AAExB;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CACrB,UAAqC,EACrC,UAAkB;IAElB,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC/D,OAAO;QACL,KAAK,EAAE,CAAC,UAAU,CAAC;QACnB,gBAAgB,EAAE,iEAAiE;KACpF,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,IAAc,EAAE,IAAc;IACpD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AAC3D,CAAC;AAUD,MAAM,CAAC,OAAO,UAAU,kBAAkB,CAAC,EAAE,MAAM,EAAgB;IACjE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,eAAe,EAAE,CAAA;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAA;IAE9B,MAAM,aAAa,GAAG,WAAW,EAAE,EAAE,IAAI,IAAI,CAAA;IAC7C,MAAM,MAAM,GAAG,aAAa,KAAK,MAAM,CAAA;IAEvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAkB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACnE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACzD,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC7C,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9D,SAAS,CAAU,UAAU,EAAE,iBAAiB,MAAM,EAAE,CAAC;gBACzD,qBAAqB,CAAC,UAAU,CAAC;gBACjC,SAAS,CAAC,UAAU,CAAC;gBACrB,SAAS,CAA4B,UAAU,EAAE,iBAAiB,MAAM,QAAQ,CAAC;aAClF,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM;iBACrC,MAAM,CAAC,CAAC,CAAW,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;iBAChF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACjB,OAAO,CAAC;gBACN,IAAI;gBACJ,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnD,eAAe;gBACf,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aAC/C,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAA;QACtE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAExB,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,MAAsB,EAAE,EAAE;QAChE,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,aAAa,CAAC,IAAI,CAAC,CAAA;QACnB,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,SAAS,CAAC,IAAI,CAAC,CAAA;QACf,IAAI,eAAe,GAAG,KAAK,CAAA;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,GAA4B;gBACrC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAA;YACD,iEAAiE;YACjE,qEAAqE;YACrE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;gBACxB,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;gBAChC,KAAK,CAAC,qBAAqB,GAAG,MAAM,CAAC,kBAAkB,CAAA;YACzD,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,iBAAiB,MAAM,EAAE,EAAE;gBACtD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,gBAAgB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YACxE,CAAC;YAED,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,6DAA6D;YAC7D,MAAM,sBAAsB,GAC1B,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC;gBACtD,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;YAEtD,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAA4B,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAA;gBACzE,IAAI,MAAM;oBAAE,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAA;gBAC5D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,MAAM,WAAW,EAAE;oBAClE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;iBAC9B,CAAC,CAAA;gBACF,oEAAoE;gBACpE,iEAAiE;gBACjE,4DAA4D;gBAC5D,qEAAqE;gBACrE,uEAAuE;gBACvE,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;oBAClD,MAAM,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,2BAA2B,MAAM,CAAC,MAAM,GAAG,CAAA;oBAClF,SAAS,CAAC,IAAI,CAAC,CAAA;oBACf,cAAc,CACZ,sBAAsB;wBACpB,CAAC,CAAC,mEAAmE,MAAM,+JAA+J;wBAC1O,CAAC,CAAC,uEAAuE,MAAM,EAAE,CACpF,CAAA;oBACD,aAAa,CAAC,KAAK,CAAC,CAAA;oBACpB,OAAM;gBACR,CAAC;gBACD,eAAe,GAAG,IAAI,CAAA;YACxB,CAAC;YAED,8BAA8B;YAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAChD,MAAM,QAAQ,GAAwB,EAAE,CAAA;YACxC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,GAAG,YAAY,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YACpH,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,GAAG,YAAY,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;YACtH,CAAC;YAED,6BAA6B;YAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YAC9C,MAAM,OAAO,GAAwB,EAAE,CAAA;YACvC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,MAAM,UAAU,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAC/G,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,MAAM,UAAU,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;YACjH,CAAC;YAED,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;YAE5C,IAAI,eAAe,EAAE,CAAC;gBACpB,sEAAsE;gBACtE,qEAAqE;gBACrE,6DAA6D;gBAC7D,SAAS,CAAC,qCAAqC,CAAC,CAAA;gBAChD,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACxB,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,MAAM,IAAI,EAAE,CAAA;gBACZ,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,cAAc,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAA;YACtE,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAA;IAEtD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAM;QACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC;YAAE,OAAM;QACpF,aAAa,CAAC,IAAI,CAAC,CAAA;QACnB,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,iBAAiB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YAC1E,CAAC;YACD,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,cAAc,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAA;YACxE,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAExC,OAAO,CACL,8BACE,eAAK,SAAS,EAAC,wBAAwB,aACrC,uBAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,GAAM,EAC5D,IAAI,IAAI,CAAC,MAAM,IAAI,CAClB,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,0BAA0B,EACpC,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,UAAU,4BAGb,CACV,IACG,EAEL,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,YAAY,IAAC,KAAK,EAAC,oBAAe,GAAG,CACvC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACd,KAAC,UAAU,IAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,GAAI,CAClD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACT,8BACG,MAAM,IAAI,CACT,cAAK,SAAS,EAAC,4CAA4C,YACzD,iHAA6F,GACzF,CACP,EACA,MAAM,IAAI,CACT,cAAK,SAAS,EAAC,+CAA+C,EAAC,IAAI,EAAC,QAAQ,YACzE,MAAM,GACH,CACP,EACA,WAAW,IAAI,KAAC,UAAU,IAAC,OAAO,EAAE,WAAW,GAAI,EACpD,KAAC,QAAQ,OAEH,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACrD,MAAM,EAAE,IAAI,CAAC,MAAM,EACnB,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;4BACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;4BAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;4BACtB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;4BAC9B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;4BAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;4BACpB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;4BAC5B,QAAQ,EAAE,IAAI,CAAC,eAAe;4BAC9B,OAAO,EAAE,IAAI,CAAC,cAAc;4BAC5B,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,IAAI,KAAK;yBAC7D,EACD,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EACxC,YAAY,EAAE,UAAU,IAlBnB,SAAS,CAmBd,IACD,CACJ,CAAC,CAAC,CAAC,IAAI,IACP,CACJ,CAAA;AACH,CAAC"}

package/dist/admin/surfaces/users/users-new.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users-new.d.ts","sourceRoot":"","sources":["../../../../src/admin/surfaces/users/users-new.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AASrD,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,MAAM,EAAE,YAAY,2CAyF3D"}
+{"version":3,"file":"users-new.d.ts","sourceRoot":"","sources":["../../../../src/admin/surfaces/users/users-new.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMrD,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,MAAM,EAAE,YAAY,2CAgG3D"}

package/dist/admin/surfaces/users/users-new.js

@@ -13,11 +13,14 @@ import { useCallback, useEffect, useState } from 'react';
 import { useAdminContext } from '../../context.js';
 import { UserForm } from '../../user-form.js';
 import { LoadingState, ErrorState } from '../../primitives.js';
-import { loadGroups, loadSites } from './users-data.js';
-// Least-privilege first, so a new user defaults to the safest role.
-const CREATE_ROLES = ['reader', 'author', 'editor', 'siteAdmin', 'superAdmin'];
+import { loadGroups, loadSites, assignableRoles } from './users-data.js';
 export default function UsersNewSurface(_props) {
-    const { fetch: adminFetch, navigate } = useAdminContext();
+    const { fetch: adminFetch, user: currentUser, navigate } = useAdminContext();
+    // Only the roles this admin may actually grant (kywi-cms#175) — the server
+    // refuses anything above their own rank, so offering it would just be a 403
+    // in a dropdown. Reversed to least-privilege-FIRST: `UserForm` defaults to
+    // `roles[0]`, so a new user starts at the safest role available.
+    const createRoles = assignableRoles(currentUser?.role).slice().reverse();
     const [groups, setGroups] = useState([]);
     const [sites, setSites] = useState([]);
     const [loading, setLoading] = useState(true);
@@ -53,6 +56,7 @@ export default function UsersNewSurface(_props) {
                     firstName: values.firstName,
                     lastName: values.lastName,
                     role: values.role,
+                    passwordResetRequired: values.forcePasswordReset,
                 }),
             });
             if (!res.ok) {
@@ -73,6 +77,6 @@ export default function UsersNewSurface(_props) {
             setSubmitting(false);
         }
     }, [adminFetch, navigate]);
-    return (_jsxs(_Fragment, { children: [_jsx("div", { className: "kywi-admin-page-header", children: _jsx("h1", { children: "New User" }) }), loading ? (_jsx(LoadingState, { label: "Preparing form\u2026" })) : loadError ? (_jsx(ErrorState, { message: loadError, onRetry: load })) : (_jsxs(_Fragment, { children: [submitError && _jsx(ErrorState, { message: submitError }), _jsx(UserForm, { roles: CREATE_ROLES, groups: groups, sites: sites, onSubmit: handleSubmit, onCancel: () => navigate('/admin/users'), isSubmitting: submitting })] }))] }));
+    return (_jsxs(_Fragment, { children: [_jsx("div", { className: "kywi-admin-page-header", children: _jsx("h1", { children: "New User" }) }), loading ? (_jsx(LoadingState, { label: "Preparing form\u2026" })) : loadError ? (_jsx(ErrorState, { message: loadError, onRetry: load })) : (_jsxs(_Fragment, { children: [submitError && _jsx(ErrorState, { message: submitError }), _jsx(UserForm, { roles: createRoles, groups: groups, sites: sites, onSubmit: handleSubmit, onCancel: () => navigate('/admin/users'), isSubmitting: submitting })] }))] }));
 }
 //# sourceMappingURL=users-new.js.map

package/dist/admin/surfaces/users/users-new.js.map

@@ -1 +1 @@
-{"version":3,"file":"users-new.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/users/users-new.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;GAQG;AAEH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAA8D,MAAM,oBAAoB,CAAA;AACzG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEvD,oEAAoE;AACpE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;AAE9E,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,MAAoB;IAC1D,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,eAAe,EAAE,CAAA;IACzD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAkB,EAAE,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAA;IACtD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACnE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;YACjF,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;QAC3E,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhB,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,MAAsB,EAAE,EAAE;QAChE,aAAa,CAAC,IAAI,CAAC,CAAA;QACnB,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;aACH,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YAC1E,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAsB,CAAA;YAEzD,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC3B,UAAU,CAAC,kBAAkB,GAAG,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC9E;gBACD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC1B,UAAU,CAAC,iBAAiB,OAAO,CAAC,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC3E;aACF,CAAC,CAAA;YAEF,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,cAAc,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAA;YACxE,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;IAE1B,OAAO,CACL,8BACE,cAAK,SAAS,EAAC,wBAAwB,YACrC,oCAAiB,GACb,EAEL,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,YAAY,IAAC,KAAK,EAAC,sBAAiB,GAAG,CACzC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACd,KAAC,UAAU,IAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,GAAI,CAClD,CAAC,CAAC,CAAC,CACF,8BACG,WAAW,IAAI,KAAC,UAAU,IAAC,OAAO,EAAE,WAAW,GAAI,EACpD,KAAC,QAAQ,IACP,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EACxC,YAAY,EAAE,UAAU,GACxB,IACD,CACJ,IACA,CACJ,CAAA;AACH,CAAC"}
+{"version":3,"file":"users-new.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/users/users-new.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;GAQG;AAEH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAA8D,MAAM,oBAAoB,CAAA;AACzG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAExE,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,MAAoB;IAC1D,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,eAAe,EAAE,CAAA;IAE5E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAA;IACxE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAkB,EAAE,CAAC,CAAA;IACzD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,EAAE,CAAC,CAAA;IACtD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACnE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEnD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;YACjF,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;QAC3E,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhB,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEnC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,EAAE,MAAsB,EAAE,EAAE;QAChE,aAAa,CAAC,IAAI,CAAC,CAAA;QACnB,cAAc,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,qBAAqB,EAAE,MAAM,CAAC,kBAAkB;iBACjD,CAAC;aACH,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;YAC1E,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAsB,CAAA;YAEzD,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC3B,UAAU,CAAC,kBAAkB,GAAG,YAAY,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC9E;gBACD,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC1B,UAAU,CAAC,iBAAiB,OAAO,CAAC,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC3E;aACF,CAAC,CAAA;YAEF,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,cAAc,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAA;YACxE,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;IAE1B,OAAO,CACL,8BACE,cAAK,SAAS,EAAC,wBAAwB,YACrC,oCAAiB,GACb,EAEL,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,YAAY,IAAC,KAAK,EAAC,sBAAiB,GAAG,CACzC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CACd,KAAC,UAAU,IAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,GAAI,CAClD,CAAC,CAAC,CAAC,CACF,8BACG,WAAW,IAAI,KAAC,UAAU,IAAC,OAAO,EAAE,WAAW,GAAI,EACpD,KAAC,QAAQ,IACP,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EACxC,YAAY,EAAE,UAAU,GACxB,IACD,CACJ,IACA,CACJ,CAAA;AACH,CAAC"}

package/dist/admin/user-form.d.ts

@@ -9,8 +9,10 @@ export interface UserFormSite {
 export interface UserFormValues {
     id?: string;
     email: string;
-    /** Only collected in create mode; the API requires it when creating a user. */
+    /** Create mode: the initial password (required). Edit mode: the NEW password, '' = leave unchanged. */
     password: string;
+    /** Only collected when you are editing YOUR OWN account and set a new password. */
+    currentPassword: string;
     firstName: string;
     lastName: string;
     role: string;
@@ -34,9 +36,18 @@ export interface UserFormProps {
      * (mirrors the server-side safety rails).
      */
     selfEdit?: boolean;
+    /**
+     * When set, the role control is locked and this explains why.
+     *
+     * Used when the target OUTRANKS the signed-in admin: `roles` is then the
+     * target's own current role alone, so the form shows what the account
+     * actually is instead of silently offering to demote it to whatever the
+     * caller's ceiling allows.
+     */
+    lockedRoleReason?: string;
     onSubmit?: (values: UserFormValues) => void | Promise<void>;
     onCancel?: () => void;
     isSubmitting?: boolean;
 }
-export declare function UserForm({ roles, groups, sites, user, selfEdit, onSubmit, onCancel, isSubmitting, }: UserFormProps): import("react/jsx-runtime").JSX.Element;
+export declare function UserForm({ roles, groups, sites, user, selfEdit, lockedRoleReason, onSubmit, onCancel, isSubmitting, }: UserFormProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=user-form.d.ts.map

package/dist/admin/user-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-form.d.ts","sourceRoot":"","sources":["../../src/admin/user-form.tsx"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,0CAA0C;IAC1C,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,mDAAmD;IACnD,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;IACrB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,wBAAgB,QAAQ,CAAC,EACvB,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,EACJ,QAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,YAAoB,GACrB,EAAE,aAAa,2CAwLf"}
+{"version":3,"file":"user-form.d.ts","sourceRoot":"","sources":["../../src/admin/user-form.tsx"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,uGAAuG;IACvG,QAAQ,EAAE,MAAM,CAAA;IAChB,mFAAmF;IACnF,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,0CAA0C;IAC1C,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,mDAAmD;IACnD,KAAK,EAAE,YAAY,EAAE,CAAA;IACrB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;IACrB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,wBAAgB,QAAQ,CAAC,EACvB,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,EACJ,QAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,YAAoB,GACrB,EAAE,aAAa,2CAgNf"}

package/dist/admin/user-form.js

@@ -1,11 +1,12 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState } from 'react';
-export function UserForm({ roles, groups, sites, user, selfEdit = false, onSubmit, onCancel, isSubmitting = false, }) {
+export function UserForm({ roles, groups, sites, user, selfEdit = false, lockedRoleReason, onSubmit, onCancel, isSubmitting = false, }) {
     const isEdit = user != null;
     const [values, setValues] = useState(() => ({
         email: user?.email ?? '',
         password: '',
+        currentPassword: '',
         firstName: user?.firstName ?? '',
         lastName: user?.lastName ?? '',
         role: user?.role ?? roles[0] ?? '',
@@ -33,6 +34,6 @@ export function UserForm({ roles, groups, sites, user, selfEdit = false, onSubmi
         e.preventDefault();
         onSubmit?.(values);
     }
-    return (_jsxs("form", { className: "kywi-user-form", onSubmit: handleSubmit, children: [_jsxs("div", { className: "kywi-field kywi-field-email", children: [_jsx("label", { htmlFor: "kywi-user-email", className: "kywi-field-label", children: "Email" }), _jsx("input", { id: "kywi-user-email", type: "email", name: "email", className: "kywi-input", value: values.email, onChange: e => setField('email', e.target.value), required: true })] }), !isEdit && (_jsxs("div", { className: "kywi-field kywi-field-password", children: [_jsx("label", { htmlFor: "kywi-user-password", className: "kywi-field-label", children: "Password" }), _jsx("input", { id: "kywi-user-password", type: "password", name: "password", className: "kywi-input", value: values.password, onChange: e => setField('password', e.target.value), minLength: 8, autoComplete: "new-password", required: true }), _jsx("p", { className: "kywi-field-hint", children: "At least 8 characters." })] })), _jsxs("div", { className: "kywi-field kywi-field-firstName", children: [_jsx("label", { htmlFor: "kywi-user-firstName", className: "kywi-field-label", children: "First Name" }), _jsx("input", { id: "kywi-user-firstName", type: "text", name: "firstName", className: "kywi-input", value: values.firstName, onChange: e => setField('firstName', e.target.value) })] }), _jsxs("div", { className: "kywi-field kywi-field-lastName", children: [_jsx("label", { htmlFor: "kywi-user-lastName", className: "kywi-field-label", children: "Last Name" }), _jsx("input", { id: "kywi-user-lastName", type: "text", name: "lastName", className: "kywi-input", value: values.lastName, onChange: e => setField('lastName', e.target.value) })] }), _jsxs("div", { className: "kywi-field kywi-field-role", children: [_jsx("label", { htmlFor: "kywi-user-role", className: "kywi-field-label", children: "Role" }), _jsx("select", { id: "kywi-user-role", name: "role", className: "kywi-select", value: values.role, onChange: e => setField('role', e.target.value), disabled: selfEdit, children: roles.map(role => (_jsx("option", { value: role, children: role }, role))) }), selfEdit && (_jsx("p", { className: "kywi-field-hint", children: "You cannot change your own role." }))] }), _jsxs("fieldset", { className: "kywi-field kywi-field-groups", children: [_jsx("legend", { className: "kywi-field-label", children: "Groups" }), groups.map(group => (_jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", className: "kywi-checkbox", checked: values.groupIds.includes(group.id), onChange: e => toggleMembership('groupIds', group.id, e.target.checked) }), ' ', group.name] }, group.id)))] }), _jsxs("fieldset", { className: "kywi-field kywi-field-sites", children: [_jsx("legend", { className: "kywi-field-label", children: "Sites" }), sites.map(site => (_jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", className: "kywi-checkbox", checked: values.siteIds.includes(site.id), onChange: e => toggleMembership('siteIds', site.id, e.target.checked) }), ' ', site.name] }, site.id)))] }), _jsxs("div", { className: "kywi-field kywi-field-isActive kywi-field-checkbox", children: [_jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", name: "isActive", className: "kywi-checkbox", checked: values.isActive, onChange: e => setField('isActive', e.target.checked), disabled: selfEdit }), ' ', "Active"] }), selfEdit && (_jsx("p", { className: "kywi-field-hint", children: "You cannot deactivate your own account." }))] }), _jsx("div", { className: "kywi-field kywi-field-forcePasswordReset kywi-field-checkbox", children: _jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", name: "forcePasswordReset", className: "kywi-checkbox", checked: values.forcePasswordReset, onChange: e => setField('forcePasswordReset', e.target.checked) }), ' ', "Force password reset on next login"] }) }), _jsxs("div", { className: "kywi-form-actions", children: [_jsx("button", { type: "submit", className: "kywi-btn kywi-btn-primary", disabled: isSubmitting, children: isEdit ? 'Save User' : 'Create User' }), onCancel && (_jsx("button", { type: "button", className: "kywi-btn kywi-btn-secondary", onClick: onCancel, children: "Cancel" }))] })] }));
+    return (_jsxs("form", { className: "kywi-user-form", onSubmit: handleSubmit, children: [_jsxs("div", { className: "kywi-field kywi-field-email", children: [_jsx("label", { htmlFor: "kywi-user-email", className: "kywi-field-label", children: "Email" }), _jsx("input", { id: "kywi-user-email", type: "email", name: "email", className: "kywi-input", value: values.email, onChange: e => setField('email', e.target.value), required: true })] }), isEdit && selfEdit && (_jsxs("div", { className: "kywi-field kywi-field-currentPassword", children: [_jsx("label", { htmlFor: "kywi-user-currentPassword", className: "kywi-field-label", children: "Current password" }), _jsx("input", { id: "kywi-user-currentPassword", type: "password", name: "currentPassword", className: "kywi-input", value: values.currentPassword, onChange: e => setField('currentPassword', e.target.value), autoComplete: "current-password", required: values.password !== '' }), _jsx("p", { className: "kywi-field-hint", children: "Required to change your own password." })] })), _jsxs("div", { className: "kywi-field kywi-field-password", children: [_jsx("label", { htmlFor: "kywi-user-password", className: "kywi-field-label", children: isEdit ? 'New password (leave blank to keep)' : 'Password' }), _jsx("input", { id: "kywi-user-password", type: "password", name: "password", className: "kywi-input", value: values.password, onChange: e => setField('password', e.target.value), minLength: 8, autoComplete: "new-password", required: !isEdit }), _jsx("p", { className: "kywi-field-hint", children: "At least 8 characters." })] }), _jsxs("div", { className: "kywi-field kywi-field-firstName", children: [_jsx("label", { htmlFor: "kywi-user-firstName", className: "kywi-field-label", children: "First Name" }), _jsx("input", { id: "kywi-user-firstName", type: "text", name: "firstName", className: "kywi-input", value: values.firstName, onChange: e => setField('firstName', e.target.value) })] }), _jsxs("div", { className: "kywi-field kywi-field-lastName", children: [_jsx("label", { htmlFor: "kywi-user-lastName", className: "kywi-field-label", children: "Last Name" }), _jsx("input", { id: "kywi-user-lastName", type: "text", name: "lastName", className: "kywi-input", value: values.lastName, onChange: e => setField('lastName', e.target.value) })] }), _jsxs("div", { className: "kywi-field kywi-field-role", children: [_jsx("label", { htmlFor: "kywi-user-role", className: "kywi-field-label", children: "Role" }), _jsx("select", { id: "kywi-user-role", name: "role", className: "kywi-select", value: values.role, onChange: e => setField('role', e.target.value), disabled: selfEdit || lockedRoleReason !== undefined, children: roles.map(role => (_jsx("option", { value: role, children: role }, role))) }), selfEdit ? (_jsx("p", { className: "kywi-field-hint", children: "You cannot change your own role." })) : lockedRoleReason !== undefined ? (_jsx("p", { className: "kywi-field-hint", children: lockedRoleReason })) : null] }), _jsxs("fieldset", { className: "kywi-field kywi-field-groups", children: [_jsx("legend", { className: "kywi-field-label", children: "Groups" }), groups.map(group => (_jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", className: "kywi-checkbox", checked: values.groupIds.includes(group.id), onChange: e => toggleMembership('groupIds', group.id, e.target.checked) }), ' ', group.name] }, group.id)))] }), _jsxs("fieldset", { className: "kywi-field kywi-field-sites", children: [_jsx("legend", { className: "kywi-field-label", children: "Sites" }), sites.map(site => (_jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", className: "kywi-checkbox", checked: values.siteIds.includes(site.id), onChange: e => toggleMembership('siteIds', site.id, e.target.checked) }), ' ', site.name] }, site.id)))] }), _jsxs("div", { className: "kywi-field kywi-field-isActive kywi-field-checkbox", children: [_jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", name: "isActive", className: "kywi-checkbox", checked: values.isActive, onChange: e => setField('isActive', e.target.checked), disabled: selfEdit }), ' ', "Active"] }), selfEdit && (_jsx("p", { className: "kywi-field-hint", children: "You cannot deactivate your own account." }))] }), !selfEdit && (_jsx("div", { className: "kywi-field kywi-field-forcePasswordReset kywi-field-checkbox", children: _jsxs("label", { className: "kywi-checkbox-label", children: [_jsx("input", { type: "checkbox", name: "forcePasswordReset", className: "kywi-checkbox", checked: values.forcePasswordReset, onChange: e => setField('forcePasswordReset', e.target.checked) }), ' ', "Force password reset on next login"] }) })), _jsxs("div", { className: "kywi-form-actions", children: [_jsx("button", { type: "submit", className: "kywi-btn kywi-btn-primary", disabled: isSubmitting, children: isEdit ? 'Save User' : 'Create User' }), onCancel && (_jsx("button", { type: "button", className: "kywi-btn kywi-btn-secondary", onClick: onCancel, children: "Cancel" }))] })] }));
 }
 //# sourceMappingURL=user-form.js.map

package/dist/admin/user-form.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-form.js","sourceRoot":"","sources":["../../src/admin/user-form.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AACZ,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AA8CvC,MAAM,UAAU,QAAQ,CAAC,EACvB,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,EACJ,QAAQ,GAAG,KAAK,EAChB,QAAQ,EACR,QAAQ,EACR,YAAY,GAAG,KAAK,GACN;IACd,MAAM,MAAM,GAAG,IAAI,IAAI,IAAI,CAAA;IAE3B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAiB,GAAG,EAAE,CAAC,CAAC;QAC1D,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;QACxB,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;QAChC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;QAC9B,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAClC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI;QAChC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;QAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;QAC5B,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,IAAI,KAAK;KACtD,CAAC,CAAC,CAAA;IAEH,SAAS,QAAQ,CAAiC,GAAM,EAAE,KAAwB;QAChF,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,SAAS,gBAAgB,CAAC,GAA2B,EAAE,EAAU,EAAE,OAAgB;QACjF,SAAS,CAAC,IAAI,CAAC,EAAE;YACf,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/B,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACd,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACjB,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,YAAY,CAAC,CAAkB;QACtC,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,CACL,gBAAM,SAAS,EAAC,gBAAgB,EAAC,QAAQ,EAAE,YAAY,aACrD,eAAK,SAAS,EAAC,6BAA6B,aAC1C,gBAAO,OAAO,EAAC,iBAAiB,EAAC,SAAS,EAAC,kBAAkB,sBAAc,EAC3E,gBACE,EAAE,EAAC,iBAAiB,EACpB,IAAI,EAAC,OAAO,EACZ,IAAI,EAAC,OAAO,EACZ,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAChD,QAAQ,SACR,IACE,EAEL,CAAC,MAAM,IAAI,CACV,eAAK,SAAS,EAAC,gCAAgC,aAC7C,gBAAO,OAAO,EAAC,oBAAoB,EAAC,SAAS,EAAC,kBAAkB,yBAAiB,EACjF,gBACE,EAAE,EAAC,oBAAoB,EACvB,IAAI,EAAC,UAAU,EACf,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,EACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACnD,SAAS,EAAE,CAAC,EACZ,YAAY,EAAC,cAAc,EAC3B,QAAQ,SACR,EACF,YAAG,SAAS,EAAC,iBAAiB,uCAA2B,IACrD,CACP,EAED,eAAK,SAAS,EAAC,iCAAiC,aAC9C,gBAAO,OAAO,EAAC,qBAAqB,EAAC,SAAS,EAAC,kBAAkB,2BAAmB,EACpF,gBACE,EAAE,EAAC,qBAAqB,EACxB,IAAI,EAAC,MAAM,EACX,IAAI,EAAC,WAAW,EAChB,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,SAAS,EACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GACpD,IACE,EAEN,eAAK,SAAS,EAAC,gCAAgC,aAC7C,gBAAO,OAAO,EAAC,oBAAoB,EAAC,SAAS,EAAC,kBAAkB,0BAAkB,EAClF,gBACE,EAAE,EAAC,oBAAoB,EACvB,IAAI,EAAC,MAAM,EACX,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,EACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GACnD,IACE,EAEN,eAAK,SAAS,EAAC,4BAA4B,aACzC,gBAAO,OAAO,EAAC,gBAAgB,EAAC,SAAS,EAAC,kBAAkB,qBAAa,EACzE,iBACE,EAAE,EAAC,gBAAgB,EACnB,IAAI,EAAC,MAAM,EACX,SAAS,EAAC,aAAa,EACvB,KAAK,EAAE,MAAM,CAAC,IAAI,EAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/C,QAAQ,EAAE,QAAQ,YAEjB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACjB,iBAAmB,KAAK,EAAE,IAAI,YAAG,IAAI,IAAxB,IAAI,CAA8B,CAChD,CAAC,GACK,EACR,QAAQ,IAAI,CACX,YAAG,SAAS,EAAC,iBAAiB,iDAAqC,CACpE,IACG,EAEN,oBAAU,SAAS,EAAC,8BAA8B,aAChD,iBAAQ,SAAS,EAAC,kBAAkB,uBAAgB,EACnD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CACnB,iBAAsB,SAAS,EAAC,qBAAqB,aACnD,gBACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAC3C,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GACvE,EACD,GAAG,EAAE,KAAK,CAAC,IAAI,KAPN,KAAK,CAAC,EAAE,CAQZ,CACT,CAAC,IACO,EAEX,oBAAU,SAAS,EAAC,6BAA6B,aAC/C,iBAAQ,SAAS,EAAC,kBAAkB,sBAAe,EAClD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACjB,iBAAqB,SAAS,EAAC,qBAAqB,aAClD,gBACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EACzC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GACrE,EACD,GAAG,EAAE,IAAI,CAAC,IAAI,KAPL,IAAI,CAAC,EAAE,CAQX,CACT,CAAC,IACO,EAEX,eAAK,SAAS,EAAC,oDAAoD,aACjE,iBAAO,SAAS,EAAC,qBAAqB,aACpC,gBACE,IAAI,EAAC,UAAU,EACf,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,QAAQ,EACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EACrD,QAAQ,EAAE,QAAQ,GAClB,EACD,GAAG,cACE,EACP,QAAQ,IAAI,CACX,YAAG,SAAS,EAAC,iBAAiB,wDAA4C,CAC3E,IACG,EAEN,cAAK,SAAS,EAAC,8DAA8D,YAC3E,iBAAO,SAAS,EAAC,qBAAqB,aACpC,gBACE,IAAI,EAAC,UAAU,EACf,IAAI,EAAC,oBAAoB,EACzB,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,kBAAkB,EAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAC/D,EACD,GAAG,0CACE,GACJ,EAEN,eAAK,SAAS,EAAC,mBAAmB,aAChC,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,2BAA2B,EAAC,QAAQ,EAAE,YAAY,YAC/E,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,GAC9B,EACR,QAAQ,IAAI,CACX,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,6BAA6B,EAAC,OAAO,EAAE,QAAQ,uBAEtE,CACV,IACG,IACD,CACR,CAAA;AACH,CAAC"}
+{"version":3,"file":"user-form.js","sourceRoot":"","sources":["../../src/admin/user-form.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AACZ,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAyDvC,MAAM,UAAU,QAAQ,CAAC,EACvB,KAAK,EACL,MAAM,EACN,KAAK,EACL,IAAI,EACJ,QAAQ,GAAG,KAAK,EAChB,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,YAAY,GAAG,KAAK,GACN;IACd,MAAM,MAAM,GAAG,IAAI,IAAI,IAAI,CAAA;IAE3B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAiB,GAAG,EAAE,CAAC,CAAC;QAC1D,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;QACxB,QAAQ,EAAE,EAAE;QACZ,eAAe,EAAE,EAAE;QACnB,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE;QAChC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;QAC9B,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAClC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI;QAChC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE;QAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;QAC5B,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,IAAI,KAAK;KACtD,CAAC,CAAC,CAAA;IAEH,SAAS,QAAQ,CAAiC,GAAM,EAAE,KAAwB;QAChF,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,SAAS,gBAAgB,CAAC,GAA2B,EAAE,EAAU,EAAE,OAAgB;QACjF,SAAS,CAAC,IAAI,CAAC,EAAE;YACf,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/B,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACd,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACjB,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,YAAY,CAAC,CAAkB;QACtC,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,CACL,gBAAM,SAAS,EAAC,gBAAgB,EAAC,QAAQ,EAAE,YAAY,aACrD,eAAK,SAAS,EAAC,6BAA6B,aAC1C,gBAAO,OAAO,EAAC,iBAAiB,EAAC,SAAS,EAAC,kBAAkB,sBAAc,EAC3E,gBACE,EAAE,EAAC,iBAAiB,EACpB,IAAI,EAAC,OAAO,EACZ,IAAI,EAAC,OAAO,EACZ,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAChD,QAAQ,SACR,IACE,EAEL,MAAM,IAAI,QAAQ,IAAI,CACrB,eAAK,SAAS,EAAC,uCAAuC,aACpD,gBAAO,OAAO,EAAC,2BAA2B,EAAC,SAAS,EAAC,kBAAkB,iCAAyB,EAChG,gBACE,EAAE,EAAC,2BAA2B,EAC9B,IAAI,EAAC,UAAU,EACf,IAAI,EAAC,iBAAiB,EACtB,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,eAAe,EAC7B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC1D,YAAY,EAAC,kBAAkB,EAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,EAAE,GAChC,EACF,YAAG,SAAS,EAAC,iBAAiB,sDAA0C,IACpE,CACP,EAED,eAAK,SAAS,EAAC,gCAAgC,aAC7C,gBAAO,OAAO,EAAC,oBAAoB,EAAC,SAAS,EAAC,kBAAkB,YAC7D,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,UAAU,GACrD,EACR,gBACE,EAAE,EAAC,oBAAoB,EACvB,IAAI,EAAC,UAAU,EACf,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,EACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACnD,SAAS,EAAE,CAAC,EACZ,YAAY,EAAC,cAAc,EAC3B,QAAQ,EAAE,CAAC,MAAM,GACjB,EACF,YAAG,SAAS,EAAC,iBAAiB,uCAA2B,IACrD,EAEN,eAAK,SAAS,EAAC,iCAAiC,aAC9C,gBAAO,OAAO,EAAC,qBAAqB,EAAC,SAAS,EAAC,kBAAkB,2BAAmB,EACpF,gBACE,EAAE,EAAC,qBAAqB,EACxB,IAAI,EAAC,MAAM,EACX,IAAI,EAAC,WAAW,EAChB,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,SAAS,EACvB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GACpD,IACE,EAEN,eAAK,SAAS,EAAC,gCAAgC,aAC7C,gBAAO,OAAO,EAAC,oBAAoB,EAAC,SAAS,EAAC,kBAAkB,0BAAkB,EAClF,gBACE,EAAE,EAAC,oBAAoB,EACvB,IAAI,EAAC,MAAM,EACX,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,EACtB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GACnD,IACE,EAEN,eAAK,SAAS,EAAC,4BAA4B,aACzC,gBAAO,OAAO,EAAC,gBAAgB,EAAC,SAAS,EAAC,kBAAkB,qBAAa,EACzE,iBACE,EAAE,EAAC,gBAAgB,EACnB,IAAI,EAAC,MAAM,EACX,SAAS,EAAC,aAAa,EACvB,KAAK,EAAE,MAAM,CAAC,IAAI,EAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/C,QAAQ,EAAE,QAAQ,IAAI,gBAAgB,KAAK,SAAS,YAEnD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACjB,iBAAmB,KAAK,EAAE,IAAI,YAAG,IAAI,IAAxB,IAAI,CAA8B,CAChD,CAAC,GACK,EACR,QAAQ,CAAC,CAAC,CAAC,CACV,YAAG,SAAS,EAAC,iBAAiB,iDAAqC,CACpE,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,CACnC,YAAG,SAAS,EAAC,iBAAiB,YAAE,gBAAgB,GAAK,CACtD,CAAC,CAAC,CAAC,IAAI,IACJ,EAEN,oBAAU,SAAS,EAAC,8BAA8B,aAChD,iBAAQ,SAAS,EAAC,kBAAkB,uBAAgB,EACnD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CACnB,iBAAsB,SAAS,EAAC,qBAAqB,aACnD,gBACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAC3C,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GACvE,EACD,GAAG,EAAE,KAAK,CAAC,IAAI,KAPN,KAAK,CAAC,EAAE,CAQZ,CACT,CAAC,IACO,EAEX,oBAAU,SAAS,EAAC,6BAA6B,aAC/C,iBAAQ,SAAS,EAAC,kBAAkB,sBAAe,EAClD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACjB,iBAAqB,SAAS,EAAC,qBAAqB,aAClD,gBACE,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EACzC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GACrE,EACD,GAAG,EAAE,IAAI,CAAC,IAAI,KAPL,IAAI,CAAC,EAAE,CAQX,CACT,CAAC,IACO,EAEX,eAAK,SAAS,EAAC,oDAAoD,aACjE,iBAAO,SAAS,EAAC,qBAAqB,aACpC,gBACE,IAAI,EAAC,UAAU,EACf,IAAI,EAAC,UAAU,EACf,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,QAAQ,EACxB,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EACrD,QAAQ,EAAE,QAAQ,GAClB,EACD,GAAG,cACE,EACP,QAAQ,IAAI,CACX,YAAG,SAAS,EAAC,iBAAiB,wDAA4C,CAC3E,IACG,EAIL,CAAC,QAAQ,IAAI,CACZ,cAAK,SAAS,EAAC,8DAA8D,YAC3E,iBAAO,SAAS,EAAC,qBAAqB,aACpC,gBACE,IAAI,EAAC,UAAU,EACf,IAAI,EAAC,oBAAoB,EACzB,SAAS,EAAC,eAAe,EACzB,OAAO,EAAE,MAAM,CAAC,kBAAkB,EAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAC/D,EACD,GAAG,0CACE,GACJ,CACP,EAED,eAAK,SAAS,EAAC,mBAAmB,aAChC,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,2BAA2B,EAAC,QAAQ,EAAE,YAAY,YAC/E,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,GAC9B,EACR,QAAQ,IAAI,CACX,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,6BAA6B,EAAC,OAAO,EAAE,QAAQ,uBAEtE,CACV,IACG,IACD,CACR,CAAA;AACH,CAAC"}

package/dist/api/admin-features-routes.js

@@ -49,7 +49,7 @@ export function registerAdminFeaturesRoutes(router, ctx) {
             return unauthorized();
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const flags = await getAdminFeatureFlags(db, siteId);
@@ -87,7 +87,7 @@ export function registerAdminFeaturesRoutes(router, ctx) {
         }
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
-        const siteDenied = assertSiteAccess(auth.user, siteId);
+        const siteDenied = assertSiteAccess(auth.user, siteId, config.auth);
         if (siteDenied)
             return siteDenied;
         const flags = await setAdminFeatureFlags(db, siteId, parsed.data);

package/dist/api/admin-features-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-features-routes.js","sourceRoot":"","sources":["../../src/api/admin-features-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAE5F;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAA4B,EAAE,GAAW;IAC/D,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAK,OAAO,CAAC,QAAoC,CAAC,GAAG,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC7E,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAQzC,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAA8B;IACxF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAEtC,gFAAgF;IAChF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACxG,CAAC;QAED,2EAA2E;QAC3E,+EAA+E;QAC/E,gFAAgF;QAChF,6EAA6E;QAC7E,8EAA8E;QAC9E,mEAAmE;QACnE,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAChD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CACjE,CAAA;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CACd,eAAe,EACf,wDAAwD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC/E,4EAA4E,EAC9E,GAAG,EACH,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAC9F,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"admin-features-routes.js","sourceRoot":"","sources":["../../src/api/admin-features-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAE5F;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAA4B,EAAE,GAAW;IAC/D,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAK,OAAO,CAAC,QAAoC,CAAC,GAAG,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC7E,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAQzC,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAA8B;IACxF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAEtC,gFAAgF;IAChF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACxG,CAAC;QAED,2EAA2E;QAC3E,+EAA+E;QAC/E,gFAAgF;QAChF,6EAA6E;QAC7E,8EAA8E;QAC9E,mEAAmE;QACnE,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAChD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CACjE,CAAA;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CACd,eAAe,EACf,wDAAwD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC/E,4EAA4E,EAC9E,GAAG,EACH,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAC9F,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/audience-preview-routes.d.ts

@@ -1,10 +1,17 @@
 import type { Router } from './router.js';
 import type { KywiDb } from '../db/client.js';
+import type { SiteAccessPolicy } from './site-context.js';
 interface PreviewRouteContext {
     db: KywiDb;
     authSecret: string;
     previewSecret: string;
     defaultSiteId: string;
+    /**
+     * Per-site authorization policy (kywi-cms#74). This context carries no
+     * `KywiConfig` — routes that have one pass `config.auth` directly — so the
+     * policy is threaded in explicitly. Pass `config.auth`.
+     */
+    siteAuth: SiteAccessPolicy;
 }
 export declare function registerAudiencePreviewRoutes(router: Router, ctx: PreviewRouteContext): void;
 export {};

package/dist/api/audience-preview-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audience-preview-routes.d.ts","sourceRoot":"","sources":["../../src/api/audience-preview-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAU7C,UAAU,mBAAmB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAM9G,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA2E5F"}
+{"version":3,"file":"audience-preview-routes.d.ts","sourceRoot":"","sources":["../../src/api/audience-preview-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAOzD,UAAU,mBAAmB;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,EAAE,gBAAgB,CAAA;CAC3B;AAMD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA2E5F"}

package/dist/api/audience-preview-routes.js

@@ -9,7 +9,7 @@ function createDbDenylist(_db) {
     return { isRevoked(_jti) { return false; }, revoke(_jti) { } };
 }
 export function registerAudiencePreviewRoutes(router, ctx) {
-    const { db, authSecret, previewSecret, defaultSiteId } = ctx;
+    const { db, authSecret, previewSecret, defaultSiteId, siteAuth } = ctx;
     async function authenticate(req) {
         return resolveAuth(req.headers.get('authorization'), authSecret, db);
     }
@@ -22,7 +22,7 @@ export function registerAudiencePreviewRoutes(router, ctx) {
             return forbidden();
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), defaultSiteId);
-        const siteDenied = assertSiteAccess(user, siteId);
+        const siteDenied = assertSiteAccess(user, siteId, siteAuth);
         if (siteDenied)
             return siteDenied;
         const audience = await getAudienceById(db, params.id, siteId);
@@ -46,7 +46,7 @@ export function registerAudiencePreviewRoutes(router, ctx) {
         if (audienceId) {
             const audience = await getAudienceById(db, audienceId);
             if (audience) {
-                const siteDenied = assertSiteAccess(user, audience.siteId);
+                const siteDenied = assertSiteAccess(user, audience.siteId, siteAuth);
                 if (siteDenied)
                     return siteDenied;
             }
@@ -80,7 +80,7 @@ export function registerAudiencePreviewRoutes(router, ctx) {
         const body = await req.json();
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), defaultSiteId);
-        const siteDenied = assertSiteAccess(user, siteId);
+        const siteDenied = assertSiteAccess(user, siteId, siteAuth);
         if (siteDenied)
             return siteDenied;
         const audience = await getAudienceById(db, body.audienceId, siteId);

package/dist/api/audience-preview-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"audience-preview-routes.js","sourceRoot":"","sources":["../../src/api/audience-preview-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAC1F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAK5F,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,EAAE,SAAS,CAAC,IAAY,IAAa,OAAO,KAAK,CAAA,CAAC,CAAC,EAAE,MAAM,CAAC,IAAY,IAAS,CAAC,EAAE,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAwB;IACpF,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,GAAG,CAAA;IAE5D,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,wCAAwC;IACxC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACpE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAA;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAA;QACxC,4EAA4E;QAC5E,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAC1D,IAAI,UAAU;oBAAE,OAAO,UAAU,CAAA;YACnC,CAAC;QACH,CAAC;QACD,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,GAAI,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;QACvF,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAA;QAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACnF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,OAAO;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACrJ,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,+DAA+D;IAC/D,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA8C,CAAA;QACzE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QACpD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;QAC/E,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,EAAE,GAAG,kBAAkB,EAAE,EAAE,GAAI,IAAI,CAAC,OAAmC,EAAE,CAAA;QACzF,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAyB,CAAC,CAAA;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"audience-preview-routes.js","sourceRoot":"","sources":["../../src/api/audience-preview-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAC1F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAgB5F,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,EAAE,SAAS,CAAC,IAAY,IAAa,OAAO,KAAK,CAAA,CAAC,CAAC,EAAE,MAAM,CAAC,IAAY,IAAS,CAAC,EAAE,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAwB;IACpF,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAA;IAEtE,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QAC9D,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,CAAC,CAAA;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,wCAAwC;IACxC,MAAM,CAAC,MAAM,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACpE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAA;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAA;QACxC,4EAA4E;QAC5E,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBACpE,IAAI,UAAU;oBAAE,OAAO,UAAU,CAAA;YACnC,CAAC;QACH,CAAC;QACD,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,GAAI,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;QACvF,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAA;QAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACnF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,OAAO;YAAE,OAAO,SAAS,CAAC,eAAe,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACrJ,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,+DAA+D;IAC/D,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA8C,CAAA;QACzE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QACpD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;QAC/E,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,EAAE,GAAG,kBAAkB,EAAE,EAAE,GAAI,IAAI,CAAC,OAAmC,EAAE,CAAA;QACzF,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAyB,CAAC,CAAA;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/audience-routes.d.ts

@@ -1,9 +1,16 @@
 import type { Router } from './router.js';
 import type { KywiDb } from '../db/client.js';
+import type { SiteAccessPolicy } from './site-context.js';
 interface AudienceRouteContext {
     db: KywiDb;
     authSecret: string;
     defaultSiteId: string;
+    /**
+     * Per-site authorization policy (kywi-cms#74). This context carries no
+     * `KywiConfig` — routes that have one pass `config.auth` directly — so the
+     * policy is threaded in explicitly. Pass `config.auth`.
+     */
+    siteAuth: SiteAccessPolicy;
     /** Field names declared by the site's registered signal adapters (e.g. `crm.leadScore`). */
     adapterFields?: string[];
 }

package/dist/api/audience-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audience-routes.d.ts","sourceRoot":"","sources":["../../src/api/audience-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAyB7C,UAAU,oBAAoB;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,4FAA4F;IAC5F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAqID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,GAAG,IAAI,CAuXtF"}
+{"version":3,"file":"audience-routes.d.ts","sourceRoot":"","sources":["../../src/api/audience-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAuBzD,UAAU,oBAAoB;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,4FAA4F;IAC5F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAqID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,GAAG,IAAI,CA4XtF"}