@mohasinac/appkit 2.1.1 → 2.2.0

package/dist/chunk-EEMSMWIZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/security/csp.ts","../src/security/rate-limit.ts","../src/security/authorization.ts","../src/security/pii-redact.ts","../src/security/pii-encrypt.ts","../src/security/rbac/default-roles.ts","../src/security/rbac/resolver.ts","../src/security/rbac/hook.ts","../src/security/rbac/Can.tsx","../src/security/rbac/server.ts","../src/security/rbac/middleware.ts"],"names":["AuthenticationError","AuthorizationError"],"mappings":";;;;;;;AAcO,SAAS,aAAA,GAAwB;AACtC,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,gBAAgB,KAAK,CAAA;AAC5B,EAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,GAAG,KAAK,CAAC,CAAA;AAC3C;AAGO,SAAS,SAAS,KAAA,EAAuB;AAC9C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA;AACvC,EAAA,OAAO;AAAA,IACL,oBAAA;AAAA,IACA,KAAA,GACI,iDAAA,GACA,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAA;AAAA,IACrC,kCAAA;AAAA,IACA,mCAAA;AAAA,IACA,uBAAA;AAAA,IACA;AAAA,MACE,oBAAA;AAAA,MACA,0BAAA;AAAA,MACA,sBAAA;AAAA,MACA,wBAAA;AAAA,MACA,0BAAA;AAAA,MACA;AAAA,KACF,CAAE,KAAK,GAAG,CAAA;AAAA,IACV,8CAAA;AAAA,IACA,+BAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AACb;;;ACXA,SAAS,YAAY,OAAA,EAAwC;AAC3D,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AACvD,EAAA,IAAI,SAAA,SAAkB,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,EAAE,IAAA,EAAK;AACnD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC9C,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,OAAO,SAAA;AACT;AAIA,IAAI,cAAA,GAEO,IAAA;AAEX,eAAe,iBAAA,GAAoB;AACjC,EAAA,IAAI,gBAAgB,OAAO,cAAA;AAE3B,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,CAAI,sBAAA;AACxB,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,CAAI,wBAAA;AAC1B,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,KAAA,EAAO,OAAO,IAAA;AAE3B,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,OAAO,gBAAgB,CAAA;AAC/C,EAAA,MAAM,EAAE,SAAA,EAAU,GAAI,MAAM,OAAO,oBAAoB,CAAA;AAEvD,EAAA,MAAM,QAAQ,IAAI,KAAA,CAAM,EAAE,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAoD;AAEtE,EAAA,cAAA,GAAiB,OACf,EAAA,EACA,KAAA,EACA,MAAA,KAC6B;AAC7B,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC9B,IAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,MAAA,KAAA,CAAM,GAAA;AAAA,QACJ,GAAA;AAAA,QACA,IAAI,SAAA,CAAU;AAAA,UACZ,KAAA;AAAA,UACA,SAAS,SAAA,CAAU,aAAA,CAAc,KAAA,EAAO,CAAA,EAAG,MAAM,CAAA,EAAA,CAAI,CAAA;AAAA,UACrD,MAAA,EAAQ;AAAA,SACT;AAAA,OACH;AAAA,IACF;AACA,IAAA,MAAM,SAAS,MAAM,KAAA,CAAM,IAAI,GAAG,CAAA,CAAG,MAAM,EAAE,CAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAQ,GAAI,CAAA;AAC3C,IAAA,OAAO;AAAA,MACL,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,KAAA;AAAA,MACA,KAAA,EAAO,MAAA,CAAO,OAAA,GACV,MAAA,GACA,CAAA,kCAAA,EAAqC,IAAI,IAAA,CAAK,KAAA,GAAQ,GAAI,CAAA,CAAE,WAAA,EAAa,CAAA;AAAA,KAC/E;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,cAAA;AACT;AAIA,IAAM,QAAA,uBAAe,GAAA,EAAgD;AAErE,SAAS,aAAA,CACP,UAAA,EACA,KAAA,EACA,MAAA,EACiB;AACjB,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,WAAW,MAAA,GAAS,GAAA;AAC1B,EAAA,IAAI,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,UAAU,CAAA;AACnC,EAAA,IAAI,CAAC,KAAA,IAAS,GAAA,GAAM,KAAA,CAAM,OAAA,EAAS;AACjC,IAAA,KAAA,GAAQ,EAAE,KAAA,EAAO,CAAA,EAAG,OAAA,EAAS,MAAM,QAAA,EAAS;AAC5C,IAAA,QAAA,CAAS,GAAA,CAAI,YAAY,KAAK,CAAA;AAAA,EAChC;AACA,EAAA,KAAA,CAAM,KAAA,EAAA;AACN,EAAA,MAAM,YAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAA,GAAQ,MAAM,KAAK,CAAA;AACjD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,UAAU,GAAI,CAAA;AAC5C,EAAA,IAAI,KAAA,CAAM,QAAQ,KAAA,EAAO;AACvB,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA;AAAA,MACA,SAAA,EAAW,CAAA;AAAA,MACX,KAAA;AAAA,MACA,KAAA,EAAO,qCAAqC,IAAA,CAAK,IAAA,CAAA,CAAM,MAAM,OAAA,GAAU,GAAA,IAAO,GAAI,CAAC,CAAA,QAAA;AAAA,KACrF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAO,WAAW,KAAA,EAAM;AAClD;AAOA,eAAsB,SAAA,CACpB,SACA,MAAA,GAA0B,EAAE,OAAO,EAAA,EAAI,MAAA,EAAQ,IAAG,EACxB;AAC1B,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,UAAA,IAAc,WAAA,CAAY,OAAO,CAAA;AAC3D,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AACxC,EAAA,IAAI,SAAS,OAAO,OAAA,CAAQ,YAAY,MAAA,CAAO,KAAA,EAAO,OAAO,MAAM,CAAA;AACnE,EAAA,OAAO,aAAA,CAAc,UAAA,EAAY,MAAA,CAAO,KAAA,EAAO,OAAO,MAAM,CAAA;AAC9D;AAGO,IAAM,cAAA,GAAiB;AAM9B,eAAsB,qBAAA,CACpB,YACA,MAAA,GAA8C,EAAE,OAAO,EAAA,EAAI,MAAA,EAAQ,IAAG,EAC5C;AAC1B,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AACxC,EAAA,IAAI,SAAS,OAAO,OAAA,CAAQ,YAAY,MAAA,CAAO,KAAA,EAAO,OAAO,MAAM,CAAA;AACnE,EAAA,OAAO,aAAA,CAAc,UAAA,EAAY,MAAA,CAAO,KAAA,EAAO,OAAO,MAAM,CAAA;AAC9D;AAGO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,MAAA,EAAQ,EAAE,KAAA,EAAO,CAAA,EAAG,QAAQ,EAAA,EAAG;AAAA,EAC/B,IAAA,EAAM,EAAE,KAAA,EAAO,EAAA,EAAI,QAAQ,EAAA,EAAG;AAAA,EAC9B,GAAA,EAAK,EAAE,KAAA,EAAO,EAAA,EAAI,QAAQ,EAAA,EAAG;AAAA,EAC7B,QAAA,EAAU,EAAE,KAAA,EAAO,GAAA,EAAK,QAAQ,EAAA,EAAG;AAAA,EACnC,cAAA,EAAgB,EAAE,KAAA,EAAO,CAAA,EAAG,QAAQ,IAAA,EAAK;AAAA,EACzC,kBAAA,EAAoB,EAAE,KAAA,EAAO,CAAA,EAAG,QAAQ,IAAA;AAC1C;AAGO,SAAS,mBAAA,GAA4B;AAC1C,EAAA,QAAA,CAAS,KAAA,EAAM;AACjB;;;ACvJA,IAAM,cAAA,GAA2C;AAAA,EAC/C,KAAA,EAAO,CAAA;AAAA,EACP,SAAA,EAAW,CAAA;AAAA,EACX,MAAA,EAAQ,CAAA;AAAA,EACR,IAAA,EAAM;AACR,CAAA;AAEA,IAAM,GAAA,GAAM;AAAA,EACV,iBAAA,EAAmB,2BAAA;AAAA,EACnB,SAAA,EAAW,mDAAA;AAAA,EACX,kBAAA,EAAoB,oDAAA;AAAA,EACpB,gBAAA,EAAkB;AACpB,CAAA;AAEO,SAAS,YAAY,IAAA,EAAqB;AAC/C,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,IAAI,mBAAA,CAAoB,GAAA,CAAI,iBAAiB,CAAA;AAAA,EACrD;AACF;AAEO,SAAS,WAAA,CACd,MACA,KAAA,EACM;AACN,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,mBAAA,CAAoB,IAAI,iBAAiB,CAAA;AAC9D,EAAA,MAAM,gBAAgB,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAC,KAAK,CAAA;AAC3D,EAAA,MAAM,QAAA,GAAY,KAAK,IAAA,IAAqB,MAAA;AAC5C,EAAA,IAAI,CAAC,aAAA,CAAc,QAAA,CAAS,QAAQ,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,kBAAA,CAAmB,GAAA,CAAI,SAAS,CAAA;AAAA,EAC5C;AACF;AAEO,SAAS,gBAAA,CACd,MACA,eAAA,EACM;AACN,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,mBAAA,CAAoB,IAAI,iBAAiB,CAAA;AAC9D,EAAA,IAAI,IAAA,CAAK,QAAQ,eAAA,EAAiB;AAChC,IAAA,MAAM,IAAI,kBAAA,CAAmB,GAAA,CAAI,SAAS,CAAA;AAAA,EAC5C;AACF;AAEO,SAAS,qBACd,IAAA,EACM;AACN,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,mBAAA,CAAoB,IAAI,iBAAiB,CAAA;AAC9D,EAAA,IAAI,CAAC,IAAA,CAAK,aAAA,QAAqB,IAAI,kBAAA,CAAmB,IAAI,kBAAkB,CAAA;AAC9E;AAEO,SAAS,qBACd,IAAA,EACM;AACN,EAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,mBAAA,CAAoB,IAAI,iBAAiB,CAAA;AAC9D,EAAA,IAAI,KAAK,QAAA,EAAU,MAAM,IAAI,kBAAA,CAAmB,IAAI,gBAAgB,CAAA;AACtE;AAOO,SAAS,aAAA,CACd,eAAA,EACA,iBAAA,EACA,aAAA,EACS;AACT,EAAA,IAAI,eAAA,KAAoB,SAAS,OAAO,IAAA;AACxC,EAAA,IAAI,oBAAoB,WAAA,EAAa;AACnC,IAAA,OAAO,iBAAA,KAAsB,UAAU,aAAA,KAAkB,QAAA;AAAA,EAC3D;AACA,EAAA,OAAO,KAAA;AACT;AAGO,SAAS,aAAa,IAAA,EAAwB;AAzFrD,EAAA,IAAA,EAAA;AA0FE,EAAA,OAAA,CAAO,EAAA,GAAA,cAAA,CAAe,IAAI,CAAA,KAAnB,IAAA,GAAA,EAAA,GAAwB,CAAA;AACjC;;;AC7EA,IAAM,SAAA,GAAY,EAAA;AAGlB,IAAM,WAAA,uBAAkB,GAAA,CAAI;AAAA,EAC1B,UAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,QAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,KAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACA,cAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,IAAM,UAAA,uBAAiB,GAAA,CAAI;AAAA,EACzB,OAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,IAAM,6BAAa,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,aAAA,EAAe,cAAc,CAAC,CAAA;AAGnE,IAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,aAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,IAAM,0BAAU,IAAI,GAAA,CAAI,CAAC,IAAA,EAAM,WAAW,CAAC,CAAA;AAE3C,SAAS,UAAU,KAAA,EAAuB;AACxC,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AACjC,EAAA,IAAI,OAAA,IAAW,GAAG,OAAO,YAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AACpC,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA;AAClC,EAAA,IAAI,KAAA,CAAM,UAAU,CAAA,EAAG,OAAO,GAAG,KAAA,CAAM,CAAC,CAAC,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA;AACrD,EAAA,OAAO,GAAG,KAAA,CAAM,KAAA,CAAM,GAAG,CAAC,CAAC,MAAM,MAAM,CAAA,CAAA;AACzC;AAEA,SAAS,UAAU,KAAA,EAAuB;AACxC,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AACtC,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,OAAO,YAAA;AAC9B,EAAA,OAAO,CAAA,GAAA,EAAM,MAAA,CAAO,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAC/B;AAEA,SAAS,SAAS,KAAA,EAAuB;AACvC,EAAA,IAAI,CAAC,KAAA,IAAS,KAAA,CAAM,MAAA,GAAS,GAAG,OAAO,YAAA;AACvC,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,GAAG,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA,CAAA;AAChE;AAEA,SAAS,OAAO,KAAA,EAAuB;AACrC,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,SAAU,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,YAAA,CAAA;AAC1C,EAAA,OAAO,YAAA;AACT;AAEA,SAAS,iBAAA,CAAkB,KAAa,KAAA,EAAuB;AAC7D,EAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,YAAA;AACjC,EAAA,IAAI,WAAW,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,UAAU,KAAK,CAAA;AAC/C,EAAA,IAAI,WAAW,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,UAAU,KAAK,CAAA;AAC/C,EAAA,IAAI,UAAU,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,SAAS,KAAK,CAAA;AAC7C,EAAA,IAAI,QAAQ,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,OAAO,KAAK,CAAA;AACzC,EAAA,OAAO,KAAA;AACT;AAQO,SAAS,SAAA,CAAU,IAAA,EAAe,KAAA,GAAQ,CAAA,EAAY;AAC3D,EAAA,IAAI,KAAA,GAAQ,WAAW,OAAO,aAAA;AAC9B,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW,OAAO,IAAA;AAChD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AAErC,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,OAAO,IAAA,CAAK,IAAI,CAAC,IAAA,KAAS,UAAU,IAAA,EAAM,KAAA,GAAQ,CAAC,CAAC,CAAA;AAAA,EACtD;AAEA,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA,EAAG;AAC1E,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,iBAAA,CAAkB,GAAA,EAAK,KAAK,CAAA;AAAA,IAC5C,CAAA,MAAA,IAAW,OAAO,KAAA,KAAU,QAAA,IAAY,UAAU,IAAA,EAAM;AACtD,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,SAAA,CAAU,KAAA,EAAO,QAAQ,CAAC,CAAA;AAAA,IAC1C,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,IAChB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AClHA,IAAM,IAAA,GAAO,aAAA;AACN,IAAM,UAAA,GAAa;AACnB,IAAM,WAAA,GAAc;AAE3B,SAAS,SAAA,GAAoB;AAtB7B,EAAA,IAAA,EAAA;AAuBE,EAAA,MAAM,GAAA,GAAA,CAAM,EAAA,GAAA,OAAA,CAAQ,GAAA,CAAI,oBAAoB,MAAhC,IAAA,GAAA,EAAA,GAAqC,EAAA;AACjD,EAAA,IAAI,CAAC,GAAA;AACH,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AACF,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA;AAC/B;AAEA,SAAS,UAAA,GAAqB;AA/B9B,EAAA,IAAA,EAAA,EAAA,EAAA;AAgCE,EAAA,MAAM,GAAA,GAAA,CACJ,EAAA,GAAA,CAAA,EAAA,GAAA,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,KAA1B,YACA,OAAA,CAAQ,GAAA,CAAI,oBAAoB,CAAA,KADhC,IAAA,GAAA,EAAA,GAEA,EAAA;AACF,EAAA,IAAI,CAAC,GAAA;AACH,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AACF,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA;AAC/B;AAGO,SAAS,aAAa,SAAA,EAA2B;AACtD,EAAA,MAAM,MAAM,SAAA,EAAU;AACtB,EAAA,MAAM,EAAA,GAAK,YAAY,EAAE,CAAA;AACzB,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,EAAM,GAAA,EAAK,EAAE,CAAA;AAC3C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AAC5E,EAAA,MAAM,GAAA,GAAM,OAAO,UAAA,EAAW;AAC9B,EAAA,OAAO,GAAG,UAAU,CAAA,EAAG,EAAA,CAAG,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA,EAAI,GAAA,CAAI,QAAA,CAAS,QAAQ,CAAC,CAAA,CAAA;AAClG;AAGO,SAAS,aAAa,UAAA,EAA4B;AACvD,EAAA,IAAI,CAAC,UAAA,CAAW,UAAA,CAAW,UAAU,GAAG,OAAO,UAAA;AAC/C,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAChD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,UAAU,CAAA,CAAE,CAAA;AAC/E,EAAA,MAAM,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAM,CAAA,GAAI,KAAA;AAChC,EAAA,MAAM,MAAM,SAAA,EAAU;AACtB,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,KAAA,EAAO,QAAQ,CAAA;AACtC,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AAC9C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAA;AACxC,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,IAAA,EAAM,GAAA,EAAK,EAAE,CAAA;AAC/C,EAAA,QAAA,CAAS,WAAW,GAAG,CAAA;AACvB,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA,CAAE,QAAA;AAAA,IACnE;AAAA,GACF;AACF;AAMO,SAAS,eAAe,KAAA,EAAuB;AACpD,EAAA,MAAM,MAAM,UAAA,EAAW;AACvB,EAAA,MAAM,IAAA,GAAO,WAAW,QAAA,EAAU,GAAG,EAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACjE,EAAA,OAAO,CAAA,EAAG,WAAW,CAAA,EAAG,IAAI,CAAA,CAAA;AAC9B;AAOO,SAAS,gBAAA,CACd,KACA,SAAA,EACG;AACH,EAAA,MAAM,SAAS,cAAA,CAAA,EAAA,EAAK,GAAA,CAAA;AACpB,EAAA,KAAA,MAAW,SAAS,SAAA,EAAW;AAC7B,IAAA,MAAM,KAAA,GAAQ,IAAI,KAAK,CAAA;AACvB,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,EAAO;AACzC,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,UAAU,CAAA,EAAG;AAClC,IAAA,MAAA,CAAO,KAAK,CAAA,GAAI,YAAA,CAAa,KAAK,CAAA;AAClC,IAAA,MAAA,CAAO,CAAA,EAAG,KAAK,CAAA,KAAA,CAAO,CAAA,GAAI,eAAe,KAAK,CAAA;AAAA,EAChD;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,gBAAA,CACd,KACA,SAAA,EACG;AACH,EAAA,MAAM,SAAS,cAAA,CAAA,EAAA,EAAK,GAAA,CAAA;AACpB,EAAA,KAAA,MAAW,SAAS,SAAA,EAAW;AAC7B,IAAA,MAAM,KAAA,GAAQ,IAAI,KAAK,CAAA;AACvB,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,UAAU,CAAA,EAAG;AAC7D,MAAA,MAAA,CAAO,KAAK,CAAA,GAAI,YAAA,CAAa,KAAK,CAAA;AAAA,IACpC;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;;;AClHO,IAAM,aAAA,GAAgD;AAAA,EAC3D,WAAA,EAAa;AAAA,IACX,KAAA,EAAO,aAAA;AAAA,IACP,WAAA,EAAa,CAAC,GAAG,CAAA;AAAA,IACjB,UAAU;AAAC,GACb;AAAA,EACA,KAAA,EAAO;AAAA,IACL,KAAA,EAAO,OAAA;AAAA,IACP,WAAA,EAAa;AAAA,MACX,cAAA;AAAA,MACA,gBAAA;AAAA,MACA,aAAA;AAAA,MACA,cAAA;AAAA,MACA,qBAAA;AAAA,MACA,gBAAA;AAAA,MACA,eAAA;AAAA,MACA,iBAAA;AAAA,MACA,gBAAA;AAAA,MACA,gBAAA;AAAA,MACA,kBAAA;AAAA,MACA,cAAA;AAAA,MACA,qBAAA;AAAA,MACA,WAAA;AAAA,MACA,eAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,SAAA,EAAW;AAAA,IACT,KAAA,EAAO,WAAA;AAAA,IACP,WAAA,EAAa;AAAA,MACX,cAAA;AAAA,MACA,eAAA;AAAA,MACA,gBAAA;AAAA,MACA,0BAAA;AAAA,MACA,2BAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,UAAU;AAAC,GACb;AAAA,EACA,MAAA,EAAQ;AAAA,IACN,KAAA,EAAO,QAAA;AAAA,IACP,WAAA,EAAa;AAAA,MACX,eAAA;AAAA,MACA,sBAAA;AAAA,MACA,uBAAA;AAAA,MACA,wBAAA;AAAA,MACA,oBAAA;AAAA,MACA,uBAAA;AAAA,MACA,kBAAA;AAAA,MACA,gBAAA;AAAA,MACA,cAAA;AAAA,MACA,qBAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,QAAA,EAAU,CAAC,MAAM;AAAA,GACnB;AAAA,EACA,IAAA,EAAM;AAAA,IACJ,KAAA,EAAO,MAAA;AAAA,IACP,WAAA,EAAa;AAAA,MACX,cAAA;AAAA,MACA,aAAA;AAAA,MACA,oBAAA;AAAA,MACA,cAAA;AAAA,MACA,eAAA;AAAA,MACA,gBAAA;AAAA,MACA,WAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,UAAU;AAAC,GACb;AAAA,EACA,aAAA,EAAe;AAAA,IACb,KAAA,EAAO,eAAA;AAAA,IACP,WAAA,EAAa;AAAA,MACX,cAAA;AAAA,MACA,cAAA;AAAA,MACA,wBAAA;AAAA,MACA;AAAA,KACF;AAAA,IACA,UAAU;AAAC;AAEf;;;AClFO,SAAS,kBAAA,CACd,WACA,MAAA,EACiB;AACjB,EAAA,MAAM,EAAE,KAAA,EAAO,iBAAA,GAAoB,OAAA,EAAQ,GAAI,MAAA;AAE/C,EAAA,SAAS,qBAAA,CACP,OAAA,EACA,OAAA,mBAAU,IAAI,KAAY,EACT;AAZrB,IAAA,IAAA,EAAA;AAaI,IAAA,IAAI,QAAQ,GAAA,CAAI,OAAO,CAAA,EAAG,2BAAW,GAAA,EAAI;AACzC,IAAA,OAAA,CAAQ,IAAI,OAAO,CAAA;AAEnB,IAAA,MAAM,GAAA,GAAM,MAAM,OAAO,CAAA;AACzB,IAAA,IAAI,CAAC,GAAA,EAAK,uBAAO,IAAI,GAAA,EAAI;AAEzB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAgB,GAAA,CAAI,WAAW,CAAA;AAG/C,IAAA,IAAI,GAAA,CAAI,IAAI,GAAG,CAAA,yBAAU,IAAI,GAAA,CAAI,CAAC,GAAG,CAAC,CAAA;AAEtC,IAAA,KAAA,MAAW,SAAA,IAAA,CAAa,EAAA,GAAA,GAAA,CAAI,QAAA,KAAJ,IAAA,GAAA,EAAA,GAAgB,EAAC,EAAG;AAC1C,MAAA,KAAA,MAAW,CAAA,IAAK,qBAAA,CAAsB,SAAA,EAAW,OAAO,CAAA,EAAG;AACzD,QAAA,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,MACX;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG,2BAAW,GAAA,EAAgB;AAEvD,EAAA,MAAM,OAAO,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAM,qBAAA,CAAsB,CAAC,CAAC,CAAA;AAE1D,EAAA,IAAI,sBAAsB,cAAA,EAAgB;AACxC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,MACV,CAAC,GAAA,EAAK,GAAA,KAAQ,IAAI,GAAA,CAAI,CAAC,GAAG,GAAG,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,GAAA,CAAI,GAAA,CAAI,CAAC,CAAC,CAAC;AAAA,KAC1D;AAAA,EACF;AAGA,EAAA,OAAO,IAAA,CAAK,MAAA;AAAA,IACV,CAAC,GAAA,EAAK,GAAA,qBAAQ,IAAI,GAAA,CAAI,CAAC,GAAG,GAAA,EAAK,GAAG,GAAG,CAAC,CAAA;AAAA,wBAClC,GAAA;AAAgB,GACtB;AACF;AAEO,SAAS,aAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,OAAO,YAAY,GAAA,CAAI,GAAG,CAAA,IAAK,WAAA,CAAY,IAAI,QAAQ,CAAA;AACzD;AAEO,SAAS,iBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,OAAO,SAAS,KAAA,CAAM,CAAC,MAAM,aAAA,CAAc,WAAA,EAAa,CAAC,CAAC,CAAA;AAC5D;AAEO,SAAS,gBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,OAAO,SAAS,IAAA,CAAK,CAAC,MAAM,aAAA,CAAc,WAAA,EAAa,CAAC,CAAC,CAAA;AAC3D;ACrCO,SAAS,cAAA,CACd,QACA,YAAA,EACsB;AACtB,EAAA,OAAO,SAAS,OAAA,GAA0B;AAnC5C,IAAA,IAAA,EAAA;AAoCI,IAAA,MAAM,SAAA,GAAA,CAAY,EAAA,GAAA,YAAA,EAAa,KAAb,IAAA,GAAA,EAAA,GAAkB,EAAC;AAErC,IAAA,MAAM,WAAA,GAAc,OAAA;AAAA,MAClB,MAAM,kBAAA,CAAmB,SAAA,EAAW,MAAM,CAAA;AAAA;AAAA,MAE1C,CAAC,SAAA,CAAU,IAAA,CAAK,GAAG,CAAC;AAAA,KACtB;AAEA,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,CAAC,UAAA,KAA2B,aAAA,CAAc,aAAa,UAAU,CAAA;AAAA,MACtE,MAAA,EAAQ,CAAC,KAAA,KAAwB,iBAAA,CAAkB,aAAa,KAAK,CAAA;AAAA,MACrE,MAAA,EAAQ,CAAC,KAAA,KAAwB,gBAAA,CAAiB,aAAa,KAAK,CAAA;AAAA,MACpE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA;AAAA,MACA,OAAA,EAAS,aAAA,CAAc,WAAA,EAAa,cAAc,CAAA;AAAA,MAClD,QAAA,EAAU,aAAA,CAAc,WAAA,EAAa,eAAe;AAAA,KACtD;AAAA,EACF,CAAA;AACF;ACpBO,SAAS,GAAA,CAAI;AAAA,EAClB,UAAA;AAAA,EACA,WAAA;AAAA,EACA,IAAA,GAAO,KAAA;AAAA,EACP,QAAA,GAAW,IAAA;AAAA,EACX,QAAA;AAAA,EACA;AACF,CAAA,EAAwC;AACtC,EAAA,MAAM,UAAU,UAAA,GACZ,IAAA,CAAK,IAAI,UAAU,CAAA,GACnB,SAAS,KAAA,GACP,IAAA,CAAK,MAAA,CAAO,WAAA,IAAA,IAAA,GAAA,WAAA,GAAe,EAAE,CAAA,GAC7B,KAAK,MAAA,CAAO,WAAA,IAAA,IAAA,GAAA,WAAA,GAAe,EAAE,CAAA;AAEnC,EAAA,OAAO,OAAA,mBAAU,GAAA,CAAA,QAAA,EAAA,EAAG,QAAA,EAAS,CAAA,mCAAS,QAAA,EAAA,QAAA,EAAS,CAAA;AACjD;;;ACjCO,SAAS,wBAAwB,MAAA,EAAoB;AAC1D,EAAA,OAAO,eAAe,iBAAA,CACpB,IAAA,EACA,UAAA,EACe;AACf,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,EAAE,mBAAA,EAAAA,oBAAAA,EAAoB,GAAI,MAAM,OAAO,mBAAmB,CAAA;AAChE,MAAA,MAAM,IAAIA,qBAAoB,mBAAmB,CAAA;AAAA,IACnD;AACA,IAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,aAAA,CAAc,KAAA,EAAO,UAAU,CAAA,EAAG;AACrC,MAAA,MAAM,EAAE,kBAAA,EAAAC,mBAAAA,EAAmB,GAAI,MAAM,OAAO,mBAAmB,CAAA;AAC/D,MAAA,MAAM,IAAIA,mBAAAA,CAAmB,CAAA,oBAAA,EAAuB,UAAU,CAAA,CAAE,CAAA;AAAA,IAClE;AAAA,EACF,CAAA;AACF;AAKO,SAAS,4BAA4B,MAAA,EAAoB;AAC9D,EAAA,OAAO,SAAS,iBAAA,CACd,IAAA,EACA,UAAA,EACM;AACN,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,mBAAmB,CAAA,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,IACrE;AACA,IAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,aAAA,CAAc,KAAA,EAAO,UAAU,CAAA,EAAG;AACrC,MAAA,MAAM,OAAO,MAAA,CAAO,IAAI,MAAM,CAAA,oBAAA,EAAuB,UAAU,EAAE,CAAA,EAAG;AAAA,QAClE,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;AC/BA,SAAS,YAAA,CAAa,UAAkB,OAAA,EAA0B;AAEhE,EAAA,MAAM,OAAA,GAAU,OAAA,CACb,OAAA,CAAQ,UAAA,EAAY,OAAO,CAAA,CAC3B,OAAA,CAAQ,SAAA,EAAW,IAAI,CAAA,CACvB,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC3B,EAAA,OAAO,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,OAAO,CAAA,KAAA,CAAO,CAAA,CAAE,KAAK,QAAQ,CAAA;AACrD;AAoBO,SAAS,qBACd,MAAA,EACA,OAAA,EACA,cAAA,EACA,OAAA,GAKI,EAAC,EACL;AAzDF,EAAA,IAAA,EAAA,EAAA,EAAA;AA0DE,EAAA,MAAM,SAAA,GAAA,CAAY,EAAA,GAAA,OAAA,CAAQ,SAAA,KAAR,IAAA,GAAA,EAAA,GAAqB,aAAA;AACvC,EAAA,MAAM,gBAAA,GAAA,CAAmB,EAAA,GAAA,OAAA,CAAQ,gBAAA,KAAR,IAAA,GAAA,EAAA,GAA4B,eAAA;AAErD,EAAA,OAAO,eAAe,cAAA,CACpB,OAAA,EACA,eAAA,EAIuB;AACvB,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,OAAA,CAAQ,OAAA;AAG7B,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CACjC,MAAA,CAAO,CAAC,CAAC,KAAK,CAAA,KAAM,YAAA,CAAa,QAAA,EAAU,KAAK,CAAC,CAAA,CACjD,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA,GAAS,CAAA,CAAE,CAAC,CAAA,CAAE,MAAM,CAAA,CAAE,CAAC,CAAA;AAE9C,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,eAAA,CAAgB,IAAA,EAAK;AAExC,IAAA,MAAM,GAAG,kBAAkB,CAAA,GAAI,KAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,OAAO,CAAA;AAEzC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO,eAAA,CAAgB,QAAA;AAAA,QACrB,IAAI,GAAA;AAAA,UACF,SAAA,GAAY,CAAA,MAAA,EAAS,kBAAA,CAAmB,QAAQ,CAAC,CAAA,CAAA;AAAA,UACjD,OAAA,CAAQ;AAAA;AACV,OACF;AAAA,IACF;AAEA,IAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,aAAA,CAAc,KAAA,EAAO,kBAAkB,CAAA,EAAG;AAC7C,MAAA,OAAO,eAAA,CAAgB,QAAA;AAAA,QACrB,IAAI,GAAA;AAAA,UACF,gBAAA,GACE,CAAA,UAAA,EAAa,kBAAA,CAAmB,kBAAkB,CAAC,CAAA,CAAA;AAAA,UACrD,OAAA,CAAQ;AAAA;AACV,OACF;AAAA,IACF;AAEA,IAAA,OAAO,gBAAgB,IAAA,EAAK;AAAA,EAC9B,CAAA;AACF","file":"chunk-EEMSMWIZ.js","sourcesContent":["/**\n * Content Security Policy helpers.\n * Generates a per-request nonce and builds the CSP header string.\n *\n * @example\n * ```ts\n * const nonce = generateNonce();\n * const csp   = buildCSP(nonce);\n * response.headers.set(\"Content-Security-Policy\", csp);\n * requestHeaders.set(\"x-nonce\", nonce);\n * ```\n */\n\n/** Generate a 16-byte base64 nonce for a single request. */\nexport function generateNonce(): string {\n  const bytes = new Uint8Array(16);\n  crypto.getRandomValues(bytes);\n  return btoa(String.fromCharCode(...bytes));\n}\n\n/** Build the full CSP header value for the given nonce. */\nexport function buildCSP(nonce: string): string {\n  const isDev = process.env.NODE_ENV === \"development\";\n  return [\n    \"default-src 'self'\",\n    isDev\n      ? \"script-src 'self' 'unsafe-eval' 'unsafe-inline'\"\n      : `script-src 'self' 'nonce-${nonce}'`,\n    \"style-src 'self' 'unsafe-inline'\",\n    \"img-src 'self' data: https: blob:\",\n    \"font-src 'self' data:\",\n    [\n      \"connect-src 'self'\",\n      \"https://*.googleapis.com\",\n      \"https://*.google.com\",\n      \"https://*.firebase.com\",\n      \"https://*.firebaseio.com\",\n      \"https://*.cloudfunctions.net\",\n    ].join(\" \"),\n    \"frame-src 'self' https://accounts.google.com\",\n    \"media-src 'self' https: blob:\",\n    \"worker-src 'self' blob:\",\n  ].join(\"; \");\n}\n","/**\n * Rate Limiting\n *\n * Sliding-window rate limiter. Uses Upstash Redis when configured,\n * falls back to in-memory for local development.\n *\n * Required env vars (Upstash):\n *   UPSTASH_REDIS_REST_URL\n *   UPSTASH_REDIS_REST_TOKEN\n */\n\nimport type { NextRequest } from \"next/server.js\";\n\nexport interface RateLimitConfig {\n  /** Maximum requests allowed in the window */\n  limit: number;\n  /** Time window in seconds */\n  window: number;\n  /** Custom identifier (default: IP address) */\n  identifier?: string;\n}\n\nexport interface RateLimitResult {\n  success: boolean;\n  limit: number;\n  remaining: number;\n  reset: number;\n  error?: string;\n}\n\n// ─── IP extraction ────────────────────────────────────────────────────────────\n\nfunction getClientIP(request: NextRequest | Request): string {\n  const forwarded = request.headers.get(\"x-forwarded-for\");\n  if (forwarded) return forwarded.split(\",\")[0].trim();\n  const realIP = request.headers.get(\"x-real-ip\");\n  if (realIP) return realIP;\n  return \"unknown\";\n}\n\n// ─── Upstash-backed limiter ───────────────────────────────────────────────────\n\nlet upstashLimiter:\n  | ((ip: string, limit: number, window: number) => Promise<RateLimitResult>)\n  | null = null;\n\nasync function getUpstashLimiter() {\n  if (upstashLimiter) return upstashLimiter;\n\n  const url = process.env.UPSTASH_REDIS_REST_URL;\n  const token = process.env.UPSTASH_REDIS_REST_TOKEN;\n  if (!url || !token) return null;\n\n  const { Redis } = await import(\"@upstash/redis\");\n  const { Ratelimit } = await import(\"@upstash/ratelimit\");\n\n  const redis = new Redis({ url, token });\n  const cache = new Map<string, import(\"@upstash/ratelimit\").Ratelimit>();\n\n  upstashLimiter = async (\n    ip: string,\n    limit: number,\n    window: number,\n  ): Promise<RateLimitResult> => {\n    const key = `${limit}:${window}`;\n    if (!cache.has(key)) {\n      cache.set(\n        key,\n        new Ratelimit({\n          redis,\n          limiter: Ratelimit.slidingWindow(limit, `${window} s`),\n          prefix: \"mohasinac:rl\",\n        }),\n      );\n    }\n    const result = await cache.get(key)!.limit(ip);\n    const reset = Math.ceil(result.reset / 1000);\n    return {\n      success: result.success,\n      limit: result.limit,\n      remaining: result.remaining,\n      reset,\n      error: result.success\n        ? undefined\n        : `Rate limit exceeded. Try again at ${new Date(reset * 1000).toISOString()}`,\n    };\n  };\n\n  return upstashLimiter;\n}\n\n// ─── In-memory fallback ───────────────────────────────────────────────────────\n\nconst memStore = new Map<string, { count: number; resetAt: number }>();\n\nfunction inMemoryLimit(\n  identifier: string,\n  limit: number,\n  window: number,\n): RateLimitResult {\n  const now = Date.now();\n  const windowMs = window * 1000;\n  let entry = memStore.get(identifier);\n  if (!entry || now > entry.resetAt) {\n    entry = { count: 0, resetAt: now + windowMs };\n    memStore.set(identifier, entry);\n  }\n  entry.count++;\n  const remaining = Math.max(0, limit - entry.count);\n  const reset = Math.ceil(entry.resetAt / 1000);\n  if (entry.count > limit) {\n    return {\n      success: false,\n      limit,\n      remaining: 0,\n      reset,\n      error: `Rate limit exceeded. Try again in ${Math.ceil((entry.resetAt - now) / 1000)} seconds`,\n    };\n  }\n  return { success: true, limit, remaining, reset };\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────────\n\n/**\n * Rate limit by request. Uses Upstash Redis when configured, in-memory otherwise.\n */\nexport async function rateLimit(\n  request: NextRequest | Request,\n  config: RateLimitConfig = { limit: 10, window: 60 },\n): Promise<RateLimitResult> {\n  const identifier = config.identifier || getClientIP(request);\n  const limiter = await getUpstashLimiter();\n  if (limiter) return limiter(identifier, config.limit, config.window);\n  return inMemoryLimit(identifier, config.limit, config.window);\n}\n\n/** Alias */\nexport const applyRateLimit = rateLimit;\n\n/**\n * Rate limit by an explicit identifier string.\n * Use in Server Actions where no Request object is available.\n */\nexport async function rateLimitByIdentifier(\n  identifier: string,\n  config: Omit<RateLimitConfig, \"identifier\"> = { limit: 60, window: 60 },\n): Promise<RateLimitResult> {\n  const limiter = await getUpstashLimiter();\n  if (limiter) return limiter(identifier, config.limit, config.window);\n  return inMemoryLimit(identifier, config.limit, config.window);\n}\n\n/** Presets for common scenarios */\nexport const RateLimitPresets = {\n  STRICT: { limit: 5, window: 60 },\n  AUTH: { limit: 10, window: 60 },\n  API: { limit: 60, window: 60 },\n  GENEROUS: { limit: 100, window: 60 },\n  PASSWORD_RESET: { limit: 3, window: 3600 },\n  EMAIL_VERIFICATION: { limit: 5, window: 3600 },\n} as const;\n\n/** For testing only: clear the in-memory store. */\nexport function clearRateLimitStore(): void {\n  memStore.clear();\n}\n","/**\n * Authorization Guards\n *\n * Pure utility functions that throw AuthenticationError / AuthorizationError.\n * Suitable for API routes, Server Actions, and middleware.\n *\n * Note: getUserFromRequest / requireAuthFromRequest are intentionally omitted —\n * they depend on Firebase Admin and the user repository; implement them in your\n * app layer using these primitives.\n */\n\nimport { AuthenticationError, AuthorizationError } from \"@mohasinac/errors\";\n\nexport type UserRole = \"admin\" | \"moderator\" | \"seller\" | \"user\";\n\nconst ROLE_HIERARCHY: Record<UserRole, number> = {\n  admin: 4,\n  moderator: 3,\n  seller: 2,\n  user: 1,\n};\n\nconst MSG = {\n  NOT_AUTHENTICATED: \"Please log in to continue\",\n  FORBIDDEN: \"You do not have permission to perform this action\",\n  EMAIL_NOT_VERIFIED: \"Please verify your email address before logging in\",\n  ACCOUNT_DISABLED: \"Your account has been disabled. Please contact support\",\n};\n\nexport function requireAuth(user: unknown): void {\n  if (!user) {\n    throw new AuthenticationError(MSG.NOT_AUTHENTICATED);\n  }\n}\n\nexport function requireRole(\n  user: Record<string, unknown> | null | undefined,\n  roles: UserRole | UserRole[],\n): void {\n  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);\n  const requiredRoles = Array.isArray(roles) ? roles : [roles];\n  const userRole = (user.role as UserRole) || \"user\";\n  if (!requiredRoles.includes(userRole)) {\n    throw new AuthorizationError(MSG.FORBIDDEN);\n  }\n}\n\nexport function requireOwnership(\n  user: Record<string, unknown> | null | undefined,\n  resourceOwnerId: string,\n): void {\n  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);\n  if (user.uid !== resourceOwnerId) {\n    throw new AuthorizationError(MSG.FORBIDDEN);\n  }\n}\n\nexport function requireEmailVerified(\n  user: Record<string, unknown> | null | undefined,\n): void {\n  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);\n  if (!user.emailVerified) throw new AuthorizationError(MSG.EMAIL_NOT_VERIFIED);\n}\n\nexport function requireActiveAccount(\n  user: Record<string, unknown> | null | undefined,\n): void {\n  if (!user) throw new AuthenticationError(MSG.NOT_AUTHENTICATED);\n  if (user.disabled) throw new AuthorizationError(MSG.ACCOUNT_DISABLED);\n}\n\n/**\n * Check if currentUserRole is allowed to change a target user's role.\n * - admin:     can change anyone's role\n * - moderator: can only change user → seller\n */\nexport function canChangeRole(\n  currentUserRole: UserRole,\n  targetCurrentRole: UserRole,\n  targetNewRole: UserRole,\n): boolean {\n  if (currentUserRole === \"admin\") return true;\n  if (currentUserRole === \"moderator\") {\n    return targetCurrentRole === \"user\" && targetNewRole === \"seller\";\n  }\n  return false;\n}\n\n/** Return the numeric hierarchy level for a role. */\nexport function getRoleLevel(role: UserRole): number {\n  return ROLE_HIERARCHY[role] ?? 0;\n}\n","/**\r\n * PII Redaction Utility\r\n *\r\n * Recursively sanitizes objects before logging by masking or redacting\r\n * known PII (Personally Identifiable Information) field names.\r\n *\r\n * - Secrets (password, token, apiKey, etc.) → \"[REDACTED]\"\r\n * - Emails → partial mask: \"mo***@gmail.com\"\r\n * - Phones → last 4 digits: \"***9876\"\r\n * - Names → first char + asterisks: \"J********\"\r\n * - Addresses, financial IDs → \"[REDACTED]\"\r\n * - IPs → first octet only: \"192.***.***.***\"\r\n */\r\n\r\nconst MAX_DEPTH = 10;\r\n\r\n/** Keys whose values are fully replaced with \"[REDACTED]\" */\r\nconst REDACT_KEYS = new Set([\r\n  \"password\",\r\n  \"secret\",\r\n  \"apiKey\",\r\n  \"apiSecret\",\r\n  \"token\",\r\n  \"refreshToken\",\r\n  \"accessToken\",\r\n  \"authorization\",\r\n  \"cookie\",\r\n  \"sessionToken\",\r\n  \"accountNumber\",\r\n  \"ifscCode\",\r\n  \"upiId\",\r\n  \"bankAccount\",\r\n  \"pan\",\r\n  \"panNumber\",\r\n  \"aadhar\",\r\n  \"aadhaar\",\r\n  \"ssn\",\r\n  \"gstin\",\r\n  \"gstNumber\",\r\n  \"addressLine1\",\r\n  \"addressLine2\",\r\n  \"address\",\r\n  \"shippingAddress\",\r\n  \"postalCode\",\r\n  \"pincode\",\r\n  \"zipCode\",\r\n]);\r\n\r\n/** Keys whose string values get email masking */\r\nconst EMAIL_KEYS = new Set([\r\n  \"email\",\r\n  \"userEmail\",\r\n  \"sellerEmail\",\r\n  \"shiprocketEmail\",\r\n]);\r\n\r\n/** Keys whose string values get phone masking */\r\nconst PHONE_KEYS = new Set([\"phone\", \"phoneNumber\", \"mobileNumber\"]);\r\n\r\n/** Keys whose string values get name masking */\r\nconst NAME_KEYS = new Set([\r\n  \"displayName\",\r\n  \"fullName\",\r\n  \"firstName\",\r\n  \"lastName\",\r\n  \"userName\",\r\n]);\r\n\r\n/** Keys whose string values get IP masking */\r\nconst IP_KEYS = new Set([\"ip\", \"ipAddress\"]);\r\n\r\nfunction maskEmail(value: string): string {\r\n  const atIndex = value.indexOf(\"@\");\r\n  if (atIndex <= 0) return \"[REDACTED]\";\r\n  const local = value.slice(0, atIndex);\r\n  const domain = value.slice(atIndex);\r\n  if (local.length <= 2) return `${local[0]}***${domain}`;\r\n  return `${local.slice(0, 2)}***${domain}`;\r\n}\r\n\r\nfunction maskPhone(value: string): string {\r\n  const digits = value.replace(/\\D/g, \"\");\r\n  if (digits.length < 4) return \"[REDACTED]\";\r\n  return `***${digits.slice(-4)}`;\r\n}\r\n\r\nfunction maskName(value: string): string {\r\n  if (!value || value.length < 2) return \"[REDACTED]\";\r\n  return `${value[0]}${\"*\".repeat(Math.min(value.length - 1, 8))}`;\r\n}\r\n\r\nfunction maskIp(value: string): string {\r\n  const parts = value.split(\".\");\r\n  if (parts.length === 4) return `${parts[0]}.***.***.***`;\r\n  return \"[REDACTED]\";\r\n}\r\n\r\nfunction redactStringValue(key: string, value: string): string {\r\n  if (REDACT_KEYS.has(key)) return \"[REDACTED]\";\r\n  if (EMAIL_KEYS.has(key)) return maskEmail(value);\r\n  if (PHONE_KEYS.has(key)) return maskPhone(value);\r\n  if (NAME_KEYS.has(key)) return maskName(value);\r\n  if (IP_KEYS.has(key)) return maskIp(value);\r\n  return value;\r\n}\r\n\r\n/**\r\n * Recursively redact PII from a data object before logging.\r\n *\r\n * Returns a new object with sensitive fields masked — the original is\r\n * never mutated.\r\n */\r\nexport function redactPii(data: unknown, depth = 0): unknown {\r\n  if (depth > MAX_DEPTH) return \"[MAX_DEPTH]\";\r\n  if (data === null || data === undefined) return data;\r\n  if (typeof data !== \"object\") return data;\r\n\r\n  if (Array.isArray(data)) {\r\n    return data.map((item) => redactPii(item, depth + 1));\r\n  }\r\n\r\n  const result: Record<string, unknown> = {};\r\n  for (const [key, value] of Object.entries(data as Record<string, unknown>)) {\r\n    if (typeof value === \"string\") {\r\n      result[key] = redactStringValue(key, value);\r\n    } else if (typeof value === \"object\" && value !== null) {\r\n      result[key] = redactPii(value, depth + 1);\r\n    } else {\r\n      result[key] = value;\r\n    }\r\n  }\r\n  return result;\r\n}\r\n","/**\r\n * PII Encryption Utilities — AES-256-GCM with HMAC-SHA256 blind indexes.\r\n *\r\n * Environment variables required (server-side only):\r\n *   PII_ENCRYPTION_KEY — 32-byte hex string (64 chars) for AES-256-GCM\r\n *   PII_HMAC_KEY       — 32-byte hex string (64 chars) for HMAC-SHA256\r\n *                        (defaults to PII_ENCRYPTION_KEY if absent)\r\n *\r\n * Ciphertext format: \"enc:v1:<iv_b64>:<ciphertext_b64>:<authtag_b64>\"\r\n * Blind index format: \"hmac-sha256:<sha256_hex>\"\r\n */\r\nimport {\r\n  createCipheriv,\r\n  createDecipheriv,\r\n  randomBytes,\r\n  createHmac,\r\n} from \"node:crypto\";\r\n\r\nconst ALGO = \"aes-256-gcm\";\r\nexport const ENC_PREFIX = \"enc:v1:\";\r\nexport const HMAC_PREFIX = \"hmac-sha256:\";\r\n\r\nfunction getEncKey(): Buffer {\r\n  const raw = process.env[\"PII_ENCRYPTION_KEY\"] ?? \"\";\r\n  if (!raw)\r\n    throw new Error(\r\n      \"PII_ENCRYPTION_KEY env var is not set — cannot encrypt PII fields\",\r\n    );\r\n  return Buffer.from(raw, \"hex\");\r\n}\r\n\r\nfunction getHmacKey(): Buffer {\r\n  const raw =\r\n    process.env[\"PII_HMAC_KEY\"] ??\r\n    process.env[\"PII_ENCRYPTION_KEY\"] ??\r\n    \"\";\r\n  if (!raw)\r\n    throw new Error(\r\n      \"PII_HMAC_KEY env var is not set — cannot generate blind PII index\",\r\n    );\r\n  return Buffer.from(raw, \"hex\");\r\n}\r\n\r\n/** Encrypt a plaintext string with AES-256-GCM. */\r\nexport function encryptValue(plaintext: string): string {\r\n  const key = getEncKey();\r\n  const iv = randomBytes(12);\r\n  const cipher = createCipheriv(ALGO, key, iv);\r\n  const enc = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\r\n  const tag = cipher.getAuthTag();\r\n  return `${ENC_PREFIX}${iv.toString(\"base64\")}:${enc.toString(\"base64\")}:${tag.toString(\"base64\")}`;\r\n}\r\n\r\n/** Decrypt an AES-256-GCM ciphertext produced by `encryptValue`. */\r\nexport function decryptValue(ciphertext: string): string {\r\n  if (!ciphertext.startsWith(ENC_PREFIX)) return ciphertext;\r\n  const inner = ciphertext.slice(ENC_PREFIX.length);\r\n  const parts = inner.split(\":\");\r\n  if (parts.length !== 3) throw new Error(`Invalid PII ciphertext: ${ciphertext}`);\r\n  const [ivB64, encB64, tagB64] = parts as [string, string, string];\r\n  const key = getEncKey();\r\n  const iv = Buffer.from(ivB64, \"base64\");\r\n  const encrypted = Buffer.from(encB64, \"base64\");\r\n  const tag = Buffer.from(tagB64, \"base64\");\r\n  const decipher = createDecipheriv(ALGO, key, iv);\r\n  decipher.setAuthTag(tag);\r\n  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(\r\n    \"utf8\",\r\n  );\r\n}\r\n\r\n/**\r\n * Produce a deterministic HMAC-SHA256 blind index for a PII value.\r\n * Used for equality lookups without decrypting (e.g. find-by-email).\r\n */\r\nexport function hmacBlindIndex(value: string): string {\r\n  const key = getHmacKey();\r\n  const hash = createHmac(\"sha256\", key).update(value).digest(\"hex\");\r\n  return `${HMAC_PREFIX}${hash}`;\r\n}\r\n\r\n/**\r\n * Encrypt specified PII fields in a Firestore document.\r\n * For each encrypted field, a `<field>Index` blind-index sibling is added.\r\n * Already-encrypted values (prefix `enc:v1:`) are left unchanged.\r\n */\r\nexport function encryptPiiFields<T extends Record<string, unknown>>(\r\n  doc: T,\r\n  piiFields: string[],\r\n): T {\r\n  const result = { ...doc } as Record<string, unknown>;\r\n  for (const field of piiFields) {\r\n    const value = doc[field];\r\n    if (typeof value !== \"string\" || !value) continue;\r\n    if (value.startsWith(ENC_PREFIX)) continue; // already encrypted\r\n    result[field] = encryptValue(value);\r\n    result[`${field}Index`] = hmacBlindIndex(value);\r\n  }\r\n  return result as T;\r\n}\r\n\r\n/**\r\n * Decrypt specified PII fields in a Firestore document.\r\n * Fields that are not encrypted (no `enc:v1:` prefix) are passed through.\r\n */\r\nexport function decryptPiiFields<T extends Record<string, unknown>>(\r\n  doc: T,\r\n  piiFields: string[],\r\n): T {\r\n  const result = { ...doc } as Record<string, unknown>;\r\n  for (const field of piiFields) {\r\n    const value = doc[field];\r\n    if (typeof value === \"string\" && value.startsWith(ENC_PREFIX)) {\r\n      result[field] = decryptValue(value);\r\n    }\r\n  }\r\n  return result as T;\r\n}\r\n","// appkit/src/security/rbac/default-roles.ts\r\nimport type { RoleDefinition } from \"./types\";\r\n\r\nexport const DEFAULT_ROLES: Record<string, RoleDefinition> = {\r\n  super_admin: {\r\n    label: \"Super Admin\",\r\n    permissions: [\"*\"],\r\n    inherits: [],\r\n  },\r\n  admin: {\r\n    label: \"Admin\",\r\n    permissions: [\r\n      \"admin:access\",\r\n      \"admin:settings\",\r\n      \"admin:users\",\r\n      \"admin:orders\",\r\n      \"admin:orders:refund\",\r\n      \"admin:products\",\r\n      \"admin:reviews\",\r\n      \"admin:analytics\",\r\n      \"admin:activity\",\r\n      \"admin:sessions\",\r\n      \"admin:newsletter\",\r\n      \"admin:search\",\r\n      \"admin:feature-flags\",\r\n      \"admin:cms\",\r\n      \"admin:payouts\",\r\n      \"admin:kyc\",\r\n    ],\r\n    inherits: [\"moderator\"],\r\n  },\r\n  moderator: {\r\n    label: \"Moderator\",\r\n    permissions: [\r\n      \"admin:access\",\r\n      \"admin:reviews\",\r\n      \"admin:products\",\r\n      \"content:reviews:moderate\",\r\n      \"content:products:moderate\",\r\n      \"content:orders:support\",\r\n    ],\r\n    inherits: [],\r\n  },\r\n  seller: {\r\n    label: \"Seller\",\r\n    permissions: [\r\n      \"seller:access\",\r\n      \"seller:products:read\",\r\n      \"seller:products:write\",\r\n      \"seller:products:delete\",\r\n      \"seller:orders:read\",\r\n      \"seller:orders:fulfill\",\r\n      \"seller:analytics\",\r\n      \"seller:coupons\",\r\n      \"seller:store\",\r\n      \"seller:payouts:read\",\r\n      \"seller:shipping\",\r\n    ],\r\n    inherits: [\"user\"],\r\n  },\r\n  user: {\r\n    label: \"User\",\r\n    permissions: [\r\n      \"user:profile\",\r\n      \"user:orders\",\r\n      \"user:orders:cancel\",\r\n      \"user:reviews\",\r\n      \"user:wishlist\",\r\n      \"user:addresses\",\r\n      \"user:chat\",\r\n      \"user:offers\",\r\n      \"user:auctions\",\r\n    ],\r\n    inherits: [],\r\n  },\r\n  support_agent: {\r\n    label: \"Support Agent\",\r\n    permissions: [\r\n      \"admin:access\",\r\n      \"admin:orders\",\r\n      \"content:orders:support\",\r\n      \"admin:users\",\r\n    ],\r\n    inherits: [],\r\n  },\r\n};\r\n","// appkit/src/security/rbac/resolver.ts\r\nimport type { Permission, RbacConfig } from \"./types\";\r\n\r\nexport function resolvePermissions(\r\n  userRoles: string[],\r\n  config: RbacConfig,\r\n): Set<Permission> {\r\n  const { roles, multiRoleStrategy = \"union\" } = config;\r\n\r\n  function getPermissionsForRole(\r\n    roleKey: string,\r\n    visited = new Set<string>(),\r\n  ): Set<Permission> {\r\n    if (visited.has(roleKey)) return new Set();\r\n    visited.add(roleKey);\r\n\r\n    const def = roles[roleKey];\r\n    if (!def) return new Set();\r\n\r\n    const own = new Set<Permission>(def.permissions);\r\n\r\n    // Wildcard — super_admin gets everything\r\n    if (own.has(\"*\")) return new Set([\"*\"]);\r\n\r\n    for (const inherited of def.inherits ?? []) {\r\n      for (const p of getPermissionsForRole(inherited, visited)) {\r\n        own.add(p);\r\n      }\r\n    }\r\n    return own;\r\n  }\r\n\r\n  if (userRoles.length === 0) return new Set<Permission>();\r\n\r\n  const sets = userRoles.map((r) => getPermissionsForRole(r));\r\n\r\n  if (multiRoleStrategy === \"intersection\") {\r\n    return sets.reduce(\r\n      (acc, set) => new Set([...acc].filter((p) => set.has(p))),\r\n    );\r\n  }\r\n\r\n  // union (default)\r\n  return sets.reduce(\r\n    (acc, set) => new Set([...acc, ...set]),\r\n    new Set<Permission>(),\r\n  );\r\n}\r\n\r\nexport function hasPermission(\r\n  permissions: Set<Permission>,\r\n  required: Permission,\r\n): boolean {\r\n  return permissions.has(\"*\") || permissions.has(required);\r\n}\r\n\r\nexport function hasAllPermissions(\r\n  permissions: Set<Permission>,\r\n  required: Permission[],\r\n): boolean {\r\n  return required.every((p) => hasPermission(permissions, p));\r\n}\r\n\r\nexport function hasAnyPermission(\r\n  permissions: Set<Permission>,\r\n  required: Permission[],\r\n): boolean {\r\n  return required.some((p) => hasPermission(permissions, p));\r\n}\r\n","// appkit/src/security/rbac/hook.ts\r\n\"use client\";\r\n\r\nimport { useMemo } from \"react\";\r\nimport type { RbacConfig, Permission } from \"./types\";\r\nimport {\r\n  resolvePermissions,\r\n  hasPermission,\r\n  hasAllPermissions,\r\n  hasAnyPermission,\r\n} from \"./resolver\";\r\n\r\nexport interface RbacHookReturn {\r\n  can: (permission: Permission) => boolean;\r\n  canAll: (permissions: Permission[]) => boolean;\r\n  canAny: (permissions: Permission[]) => boolean;\r\n  roles: string[];\r\n  permissions: Set<Permission>;\r\n  isAdmin: boolean;\r\n  isSeller: boolean;\r\n}\r\n\r\n/**\r\n * Factory that creates a typed `useRBAC` hook bound to the given config.\r\n *\r\n * @example\r\n * // src/hooks/useRBAC.ts\r\n * import { createRbacHook } from \"@mohasinac/appkit/security\";\r\n * import { RBAC_CONFIG } from \"@/constants/rbac\";\r\n * export const useRBAC = createRbacHook(RBAC_CONFIG);\r\n */\r\nexport function createRbacHook(\r\n  config: RbacConfig,\r\n  getUserRoles: () => string[] | null | undefined,\r\n): () => RbacHookReturn {\r\n  return function useRBAC(): RbacHookReturn {\r\n    const userRoles = getUserRoles() ?? [];\r\n\r\n    const permissions = useMemo(\r\n      () => resolvePermissions(userRoles, config),\r\n      // eslint-disable-next-line react-hooks/exhaustive-deps\r\n      [userRoles.join(\",\")],\r\n    );\r\n\r\n    return {\r\n      can: (permission: Permission) => hasPermission(permissions, permission),\r\n      canAll: (perms: Permission[]) => hasAllPermissions(permissions, perms),\r\n      canAny: (perms: Permission[]) => hasAnyPermission(permissions, perms),\r\n      roles: userRoles,\r\n      permissions,\r\n      isAdmin: hasPermission(permissions, \"admin:access\"),\r\n      isSeller: hasPermission(permissions, \"seller:access\"),\r\n    };\r\n  };\r\n}\r\n","// appkit/src/security/rbac/Can.tsx\r\n\"use client\";\r\n\r\nimport React from \"react\";\r\nimport type { Permission } from \"./types\";\r\nimport type { RbacHookReturn } from \"./hook\";\r\n\r\ninterface CanProps {\r\n  /** Single required permission */\r\n  permission?: Permission;\r\n  /** Multiple permissions to check */\r\n  permissions?: Permission[];\r\n  /** When multiple permissions are provided: \"all\" (default) or \"any\" */\r\n  mode?: \"all\" | \"any\";\r\n  /** Rendered when the check fails */\r\n  fallback?: React.ReactNode;\r\n  children: React.ReactNode;\r\n  /** The resolved rbac hook return value — pass from useRBAC() */\r\n  rbac: Pick<RbacHookReturn, \"can\" | \"canAll\" | \"canAny\">;\r\n}\r\n\r\n/**\r\n * Conditionally renders children based on RBAC permissions.\r\n *\r\n * The consumer's `useRBAC()` hook must be called in the parent component and\r\n * passed as the `rbac` prop; this avoids coupling `<Can>` to a specific context.\r\n *\r\n * @example\r\n * const rbac = useRBAC();\r\n * <Can rbac={rbac} permission=\"admin:payouts\"><PayoutsTable /></Can>\r\n * <Can rbac={rbac} permissions={[\"seller:products:write\", \"seller:store\"]} mode=\"any\">\r\n *   <SellerActions />\r\n * </Can>\r\n */\r\nexport function Can({\r\n  permission,\r\n  permissions,\r\n  mode = \"all\",\r\n  fallback = null,\r\n  children,\r\n  rbac,\r\n}: CanProps): React.ReactElement | null {\r\n  const allowed = permission\r\n    ? rbac.can(permission)\r\n    : mode === \"all\"\r\n      ? rbac.canAll(permissions ?? [])\r\n      : rbac.canAny(permissions ?? []);\r\n\r\n  return allowed ? <>{children}</> : <>{fallback}</>;\r\n}\r\n","// appkit/src/security/rbac/server.ts\r\nimport type { RbacConfig, Permission } from \"./types\";\r\nimport { resolvePermissions, hasPermission } from \"./resolver\";\r\n\r\n/**\r\n * Factory creating a server-side permission guard for API routes + Server Actions.\r\n *\r\n * @example\r\n * // src/lib/auth/require-permission.ts\r\n * import { createRequirePermission } from \"@mohasinac/appkit/security\";\r\n * import { RBAC_CONFIG } from \"@/constants/rbac\";\r\n * export const requirePermission = createRequirePermission(RBAC_CONFIG);\r\n *\r\n * // In Server Action:\r\n * await requirePermission(authUser, \"admin:payouts\");\r\n */\r\nexport function createRequirePermission(config: RbacConfig) {\r\n  return async function requirePermission(\r\n    user: { uid: string; roles: string[] } | null | undefined,\r\n    permission: Permission,\r\n  ): Promise<void> {\r\n    if (!user) {\r\n      const { AuthenticationError } = await import(\"@mohasinac/errors\");\r\n      throw new AuthenticationError(\"Not authenticated\");\r\n    }\r\n    const perms = resolvePermissions(user.roles, config);\r\n    if (!hasPermission(perms, permission)) {\r\n      const { AuthorizationError } = await import(\"@mohasinac/errors\");\r\n      throw new AuthorizationError(`Missing permission: ${permission}`);\r\n    }\r\n  };\r\n}\r\n\r\n/**\r\n * Synchronous variant — use when errors cannot be imported directly.\r\n */\r\nexport function createRequirePermissionSync(config: RbacConfig) {\r\n  return function requirePermission(\r\n    user: { uid: string; roles: string[] } | null | undefined,\r\n    permission: Permission,\r\n  ): void {\r\n    if (!user) {\r\n      throw Object.assign(new Error(\"Not authenticated\"), { status: 401 });\r\n    }\r\n    const perms = resolvePermissions(user.roles, config);\r\n    if (!hasPermission(perms, permission)) {\r\n      throw Object.assign(new Error(`Missing permission: ${permission}`), {\r\n        status: 403,\r\n      });\r\n    }\r\n  };\r\n}\r\n","// appkit/src/security/rbac/middleware.ts\r\nimport type { RbacConfig, Permission } from \"./types\";\r\nimport { resolvePermissions, hasPermission } from \"./resolver\";\r\n\r\ntype NextRequest = {\r\n  nextUrl: { pathname: string };\r\n  headers: { get: (name: string) => string | null };\r\n  cookies: { get: (name: string) => { value: string } | undefined };\r\n  url: string;\r\n};\r\n\r\ntype NextResponse = {\r\n  redirect: (url: URL | string) => NextResponse;\r\n  next: () => NextResponse;\r\n};\r\n\r\ntype GetSessionUser = (\r\n  request: NextRequest,\r\n) => Promise<{ uid: string; roles: string[] } | null>;\r\n\r\nfunction matchesRoute(pathname: string, pattern: string): boolean {\r\n  // Convert route pattern like \"/admin/:path*\" to a testable form\r\n  const escaped = pattern\r\n    .replace(/\\[.*?\\]/g, \"[^/]+\")\r\n    .replace(/:\\w+\\*/g, \".*\")\r\n    .replace(/:\\w+/g, \"[^/]+\");\r\n  return new RegExp(`^${escaped}(/|$)`).test(pathname);\r\n}\r\n\r\n/**\r\n * Factory that creates a Next.js middleware function for route-level RBAC.\r\n *\r\n * @example\r\n * // letitrip: middleware.ts\r\n * import { createRbacMiddleware } from \"@mohasinac/appkit/security\";\r\n * import { RBAC_CONFIG } from \"@/constants/rbac\";\r\n * import { ADMIN_PAGE_PERMISSIONS } from \"@mohasinac/appkit/features/admin\";\r\n * import { SELLER_PAGE_PERMISSIONS } from \"@mohasinac/appkit/features/seller\";\r\n * import { getSessionUser } from \"@/lib/auth/session\";\r\n *\r\n * export const middleware = createRbacMiddleware(\r\n *   RBAC_CONFIG,\r\n *   { ...ADMIN_PAGE_PERMISSIONS, ...SELLER_PAGE_PERMISSIONS },\r\n *   getSessionUser,\r\n *   { loginPath: \"/auth/login\", unauthorizedPath: \"/unauthorized\" }\r\n * );\r\n */\r\nexport function createRbacMiddleware(\r\n  config: RbacConfig,\r\n  pageMap: Record<string, Permission>,\r\n  getSessionUser: GetSessionUser,\r\n  options: {\r\n    loginPath?: string;\r\n    unauthorizedPath?: string;\r\n    NextURL?: new (url: string, base: string) => URL;\r\n    NextResponse?: NextResponse;\r\n  } = {},\r\n) {\r\n  const loginPath = options.loginPath ?? \"/auth/login\";\r\n  const unauthorizedPath = options.unauthorizedPath ?? \"/unauthorized\";\r\n\r\n  return async function rbacMiddleware(\r\n    request: NextRequest,\r\n    NextResponseLib: {\r\n      redirect: (url: URL | string) => NextResponse;\r\n      next: () => NextResponse;\r\n    },\r\n  ): Promise<NextResponse> {\r\n    const { pathname } = request.nextUrl;\r\n\r\n    // Find the most specific matching route (longest match wins)\r\n    const entry = Object.entries(pageMap)\r\n      .filter(([route]) => matchesRoute(pathname, route))\r\n      .sort((a, b) => b[0].length - a[0].length)[0];\r\n\r\n    if (!entry) return NextResponseLib.next();\r\n\r\n    const [, requiredPermission] = entry;\r\n    const user = await getSessionUser(request);\r\n\r\n    if (!user) {\r\n      return NextResponseLib.redirect(\r\n        new URL(\r\n          loginPath + `?from=${encodeURIComponent(pathname)}`,\r\n          request.url,\r\n        ),\r\n      );\r\n    }\r\n\r\n    const perms = resolvePermissions(user.roles, config);\r\n    if (!hasPermission(perms, requiredPermission)) {\r\n      return NextResponseLib.redirect(\r\n        new URL(\r\n          unauthorizedPath +\r\n            `?required=${encodeURIComponent(requiredPermission)}`,\r\n          request.url,\r\n        ),\r\n      );\r\n    }\r\n\r\n    return NextResponseLib.next();\r\n  };\r\n}\r\n"]}