@optifye/dashboard-core 6.10.47 → 6.10.48

package/dist/index.js

@@ -3947,6 +3947,10 @@ var AuthService = class {
       email: enrichedUser.email,
       role: enrichedUser.role,
       role_level: enrichedUser.role,
+      scope_mode: enrichedUser.scope_mode,
+      scope_generated_at: enrichedUser.scope_generated_at,
+      scope_ttl_seconds: enrichedUser.scope_ttl_seconds,
+      access_scope: enrichedUser.access_scope,
       company_id: enrichedUser.company_id,
       first_login_completed: enrichedUser.profile.first_login_completed,
       properties: {
@@ -8153,6 +8157,8 @@ var AuthProvider = ({ children }) => {
   const isFetchingRef = React26.useRef(false);
   const lastProcessedSessionRef = React26.useRef(null);
   const hasAuthenticatedRef = React26.useRef(false);
+  const scopeFetchedAtRef = React26.useRef(0);
+  const scopeTtlSecondsRef = React26.useRef(300);
   const fetchSession = React26.useCallback(async (supabaseSession, isReauth = false, allowRetry = true) => {
     if (isFetchingRef.current) {
       console.log("[AuthContext] Already fetching, skipping duplicate request");
@@ -8165,6 +8171,9 @@ var AuthProvider = ({ children }) => {
     }
     try {
       const enrichedUser = await AuthService.getSession(supabaseSession.access_token);
+      const parsedScopeGeneratedAt = enrichedUser.scope_generated_at ? Date.parse(enrichedUser.scope_generated_at) : NaN;
+      scopeFetchedAtRef.current = Number.isFinite(parsedScopeGeneratedAt) ? parsedScopeGeneratedAt : Date.now();
+      scopeTtlSecondsRef.current = enrichedUser.scope_ttl_seconds || 300;
       const authUser = AuthService.toAuthUser(enrichedUser);
       setUser(authUser);
       setSession(supabaseSession);
@@ -8254,6 +8263,8 @@ var AuthProvider = ({ children }) => {
       setError(null);
       setShowOnboarding(false);
       hasAuthenticatedRef.current = false;
+      scopeFetchedAtRef.current = 0;
+      scopeTtlSecondsRef.current = 300;
       router$1.push("/login");
     } catch (err) {
       console.error("[AuthContext] Sign out error:", err);
@@ -8316,6 +8327,44 @@ var AuthProvider = ({ children }) => {
       clearInterval(intervalId);
     };
   }, [session, supabase]);
+  React26.useEffect(() => {
+    if (!session || !user) {
+      return;
+    }
+    const refreshScopeIfExpired = async () => {
+      if (!session || isFetchingRef.current) {
+        return;
+      }
+      const ttlSeconds = user.scope_ttl_seconds || scopeTtlSecondsRef.current || 300;
+      const fetchedAt = scopeFetchedAtRef.current || 0;
+      const shouldRefresh = fetchedAt === 0 || Date.now() - fetchedAt >= ttlSeconds * 1e3;
+      if (!shouldRefresh) {
+        return;
+      }
+      try {
+        console.log("[AuthContext] Scope TTL expired, refreshing session scope");
+        await fetchSession(session, true);
+      } catch (err) {
+        console.error("[AuthContext] Scope refresh failed:", err);
+      }
+    };
+    refreshScopeIfExpired();
+    const intervalId = setInterval(refreshScopeIfExpired, 6e4);
+    return () => clearInterval(intervalId);
+  }, [session, user?.id, user?.scope_ttl_seconds, fetchSession]);
+  React26.useEffect(() => {
+    if (typeof window === "undefined") {
+      return;
+    }
+    const handleScopeRefresh = () => {
+      if (!session) {
+        return;
+      }
+      void fetchSession(session, true);
+    };
+    window.addEventListener("rbac:refresh-scope", handleScopeRefresh);
+    return () => window.removeEventListener("rbac:refresh-scope", handleScopeRefresh);
+  }, [session, fetchSession]);
   React26.useEffect(() => {
     if (!supabase) {
       console.log("[AuthContext] No Supabase client, skipping auth initialization");
@@ -8384,7 +8433,8 @@ var AuthProvider = ({ children }) => {
       } else if (event === "TOKEN_REFRESHED") {
         console.log("[AuthContext] Token refreshed automatically");
         if (currentSession) {
-          setSession(currentSession);
+          const isReauth = hasAuthenticatedRef.current;
+          await fetchSession(currentSession, isReauth);
           const expiresAt = currentSession.expires_at;
           if (expiresAt) {
             const minutesUntilExpiry = Math.floor((expiresAt * 1e3 - Date.now()) / 6e4);
@@ -10532,12 +10582,16 @@ var useDashboardMetrics = ({ onLineMetricsUpdate, lineId, userAccessibleLineIds
   const configuredLineIds = React26.useMemo(() => {
     return getConfiguredLineIds(entityConfig);
   }, [entityConfig]);
+  const targetFactoryLineIds = React26.useMemo(() => {
+    const sourceLineIds = userAccessibleLineIds !== void 0 ? userAccessibleLineIds : configuredLineIds;
+    return Array.from(new Set((sourceLineIds || []).filter(Boolean)));
+  }, [userAccessibleLineIds, configuredLineIds]);
   const { shiftConfig: staticShiftConfig } = useDashboardConfig();
   const {
     shiftConfigMap: multiLineShiftConfigMap,
     isLoading: isMultiLineShiftConfigLoading
   } = useMultiLineShiftConfigs(
-    isFactoryView ? configuredLineIds : [],
+    isFactoryView ? targetFactoryLineIds : [],
     staticShiftConfig
   );
   const {
@@ -10632,7 +10686,7 @@ var useDashboardMetrics = ({ onLineMetricsUpdate, lineId, userAccessibleLineIds
       return;
     }
     const isFactory = currentLineIdToUse === factoryViewId;
-    const targetLineIds = isFactory ? userAccessibleLineIds || configuredLineIds : [currentLineIdToUse];
+    const targetLineIds = isFactory ? targetFactoryLineIds : [currentLineIdToUse];
     const targetLineIdsKey = targetLineIds.slice().sort().join(",");
     const usesShiftGroups = isFactory && shiftGroups.length > 0;
     const singleShiftDetails = usesShiftGroups ? null : shiftConfig ? getCurrentShift(defaultTimezone, shiftConfig) : shiftGroups.length === 1 ? { date: shiftGroups[0].date, shiftId: shiftGroups[0].shiftId } : getCurrentShift(defaultTimezone, staticShiftConfig);
@@ -10681,7 +10735,16 @@ var useDashboardMetrics = ({ onLineMetricsUpdate, lineId, userAccessibleLineIds
         throw new Error("Backend URL is not configured. Please set NEXT_PUBLIC_BACKEND_URL in your environment.");
       }
       if (targetLineIds.length === 0) {
-        throw new Error("No target line IDs available for fetching metrics.");
+        logDebug("[useDashboardMetrics] Skipping fetch: no target line IDs after scope filtering");
+        setMetrics({
+          workspaceMetrics: [],
+          lineMetrics: [],
+          metadata: void 0,
+          efficiencyLegend: DEFAULT_EFFICIENCY_LEGEND
+        });
+        setMetricsLineId(requestLineId);
+        lastFetchKeyRef.current = inFlightFetchKeyRef.current;
+        return;
       }
       let allWorkspaceMetrics = [];
       let allLineMetrics = [];
@@ -10699,11 +10762,16 @@ var useDashboardMetrics = ({ onLineMetricsUpdate, lineId, userAccessibleLineIds
             lineCount: group.lineIds.length
           }))
         });
+        const targetLineIdSet = new Set(targetLineIds);
         const metricsPromises = shiftGroups.map(async (group) => {
-          const lineIdsParam = `line_ids=${group.lineIds.join(",")}`;
+          const groupLineIds = group.lineIds.filter((lineGroupId) => targetLineIdSet.has(lineGroupId));
+          if (groupLineIds.length === 0) {
+            return null;
+          }
+          const lineIdsParam = `line_ids=${groupLineIds.join(",")}`;
           const url = `${apiUrl}/api/dashboard/metrics?${lineIdsParam}&date=${group.date}&shift_id=${group.shiftId}&company_id=${companyId}${forceParam}`;
           logDebug(`[useDashboardMetrics] \u{1F4CA} Fetching for shift ${group.shiftId} (${group.shiftName}):`, {
-            lineIds: group.lineIds,
+            lineIds: groupLineIds,
             date: group.date
           });
           const response = await fetch(url, {
@@ -10727,7 +10795,7 @@ var useDashboardMetrics = ({ onLineMetricsUpdate, lineId, userAccessibleLineIds
             throw new Error(`Invalid JSON response from backend`);
           }
         });
-        const results = await Promise.all(metricsPromises);
+        const results = (await Promise.all(metricsPromises)).filter((result) => !!result);
         hasFlowBuffers = results.some((result) => result?.metadata?.has_flow_buffers);
         results.forEach((result) => {
           const idleMap = result?.metadata?.idle_time_vlm_by_line;
@@ -10905,6 +10973,7 @@ var useDashboardMetrics = ({ onLineMetricsUpdate, lineId, userAccessibleLineIds
     shiftGroups,
     shiftGroupsKey,
     configuredLineIds,
+    targetFactoryLineIds,
     isFactoryView,
     multiLineShiftConfigMap,
     staticShiftConfig,
@@ -10997,8 +11066,14 @@ var useDashboardMetrics = ({ onLineMetricsUpdate, lineId, userAccessibleLineIds
       logDebug("[useDashboardMetrics] Setting up group subscriptions:", {
         groupCount: currentShiftGroups.length
       });
+      const targetFactoryLineIdsForSubscriptions = currentUserAccessibleLineIds !== void 0 ? currentUserAccessibleLineIds : currentConfiguredLineIds;
+      const targetFactoryLineIdSet = new Set(
+        (targetFactoryLineIdsForSubscriptions || []).filter(Boolean)
+      );
       currentShiftGroups.forEach((group, index) => {
-        const groupLineIds = group.lineIds.filter((id3) => id3 && id3 !== factoryViewIdentifier);
+        const groupLineIds = group.lineIds.filter(
+          (id3) => id3 && id3 !== factoryViewIdentifier && targetFactoryLineIdSet.has(id3)
+        );
         if (groupLineIds.length === 0) {
           logDebug("[useDashboardMetrics] Skipping group subscription: no line IDs after filtering", {
             groupIndex: index,
@@ -16177,6 +16252,7 @@ function useAccessControl() {
 function useTeamManagementPermissions() {
   const { user } = useAuth();
   const currentRole = user?.role_level;
+  const isSuperAdminOptifye = currentRole === "optifye" && (user?.scope_mode === "SUPER_ADMIN" || !!user?.access_scope?.is_super_admin);
   return {
     /**
      * Can the current user assign lines to this user?
@@ -16232,7 +16308,10 @@ function useTeamManagementPermissions() {
     availableRolesToAssign: () => {
       if (!currentRole) return [];
       if (currentRole === "optifye") {
-        return ["owner", "it", "plant_head", "supervisor"];
+        if (isSuperAdminOptifye) {
+          return ["owner", "it", "plant_head", "supervisor"];
+        }
+        return ["it", "plant_head", "supervisor"];
       }
       if (currentRole === "owner") {
         return ["it", "plant_head", "supervisor"];
@@ -16250,7 +16329,12 @@ function useTeamManagementPermissions() {
      */
     canInviteRole: (role) => {
       if (!currentRole) return false;
-      if (currentRole === "optifye") return true;
+      if (currentRole === "optifye") {
+        if (role === "owner") {
+          return isSuperAdminOptifye;
+        }
+        return true;
+      }
       if (currentRole === "owner") {
         return ["it", "plant_head", "supervisor"].includes(role);
       }
@@ -16284,40 +16368,133 @@ function useTeamManagementPermissions() {
 }
 function useUserLineAccess(configLineIds) {
   const { user } = useAuth();
+  const { lines: dbLines } = useLines();
   const { accessibleLineIds, defaultLineId } = React26.useMemo(() => {
+    const dbLineIds = dbLines.map((line) => line.id);
+    const dbLineIdSet = new Set(dbLineIds);
+    const fallbackAllLineIds = configLineIds && configLineIds.length > 0 ? configLineIds : dbLineIds;
+    const normalizeIds = (value) => {
+      if (Array.isArray(value)) {
+        return value.filter((id3) => typeof id3 === "string" && !!id3);
+      }
+      if (typeof value === "string" && value) {
+        return [value];
+      }
+      return [];
+    };
+    const uniqueIds = (ids) => Array.from(new Set(ids.filter(Boolean)));
+    const filterToEnabledDb = (lineIds, options = {}) => {
+      const deduped = uniqueIds(lineIds);
+      if (dbLineIdSet.size === 0) {
+        return options.allowWhenDbUnavailable ? deduped : [];
+      }
+      return deduped.filter((lineId) => dbLineIdSet.has(lineId));
+    };
     if (!user) {
-      return { accessibleLineIds: configLineIds || [], defaultLineId: configLineIds?.[0] };
-    }
-    if (user.role_level === "supervisor") {
-      const assignedLineIds = user.properties?.line_id || user.properties?.line_ids || [];
-      if (Array.isArray(assignedLineIds) && assignedLineIds.length > 0) {
-        console.log("[useUserLineAccess] Supervisor has assigned lines:", assignedLineIds);
-        return {
-          accessibleLineIds: assignedLineIds,
-          defaultLineId: assignedLineIds[0]
-        };
+      const fallback = filterToEnabledDb(fallbackAllLineIds, { allowWhenDbUnavailable: true });
+      return { accessibleLineIds: fallback, defaultLineId: fallback[0] };
+    }
+    const configSet = new Set(configLineIds || []);
+    const hasScopePayload = !!user.access_scope || !!user.scope_mode;
+    const role = user.role_level || user.role;
+    const scopedLineIds = normalizeIds(user.access_scope?.line_ids);
+    const scopedFactoryIds = normalizeIds(user.access_scope?.factory_ids);
+    const properties = user.properties || {};
+    const propertyLineIds = normalizeIds(properties?.line_ids || properties?.line_id);
+    const propertyFactoryIds = normalizeIds(properties?.factory_ids || properties?.factory_id);
+    const propertyCompanyId = typeof properties?.company_id === "string" ? properties.company_id : user.company_id;
+    const scopedCompanyId = user.access_scope?.company_id || propertyCompanyId;
+    const isExplicitSuperAdmin = user.scope_mode === "SUPER_ADMIN" || !!user.access_scope?.is_super_admin;
+    const isLegacyOptifyeGlobal = !hasScopePayload && role === "optifye" && propertyLineIds.length === 0 && propertyFactoryIds.length === 0 && !propertyCompanyId;
+    const lineFactoryMap = /* @__PURE__ */ new Map();
+    dbLines.forEach((line) => {
+      lineFactoryMap.set(line.id, line.factory_id);
+    });
+    const applyConfigFilter = (lineIds) => {
+      const dedupedLineIds = uniqueIds(lineIds);
+      if (!configLineIds || configLineIds.length === 0) {
+        return dedupedLineIds;
       }
-      console.warn("[useUserLineAccess] Supervisor has NO assigned lines!", {
-        properties: user.properties,
-        hasLineId: !!user.properties?.line_id,
-        hasLineIds: !!user.properties?.line_ids
+      const filtered = dedupedLineIds.filter((id3) => configSet.has(id3));
+      return filtered.length > 0 ? filtered : dedupedLineIds;
+    };
+    const resolveFactoryScopedLines = (factoryIds) => {
+      const factorySet = new Set(factoryIds);
+      const baseLineIds = configLineIds && configLineIds.length > 0 ? configLineIds : dbLineIds;
+      const filtered = baseLineIds.filter((lineId) => {
+        const factoryId = lineFactoryMap.get(lineId);
+        return !!factoryId && factorySet.has(factoryId);
       });
+      if (filtered.length > 0) {
+        return uniqueIds(filtered);
+      }
+      const fromDb = dbLines.filter((line) => !!line.factory_id && factorySet.has(line.factory_id)).map((line) => line.id);
+      if (fromDb.length > 0) {
+        return uniqueIds(fromDb);
+      }
+      return [];
+    };
+    if (isExplicitSuperAdmin || isLegacyOptifyeGlobal) {
+      const all = filterToEnabledDb(fallbackAllLineIds, { allowWhenDbUnavailable: true });
       return {
-        accessibleLineIds: [],
-        defaultLineId: void 0
+        accessibleLineIds: all,
+        defaultLineId: all[0]
       };
     }
-    if (user.role_level === "plant_head") {
+    if (scopedLineIds.length > 0) {
+      const filtered = applyConfigFilter(scopedLineIds);
+      const scoped = filterToEnabledDb(filtered.length > 0 ? filtered : uniqueIds(scopedLineIds));
       return {
-        accessibleLineIds: configLineIds || [],
-        defaultLineId: configLineIds?.[0]
+        accessibleLineIds: scoped,
+        defaultLineId: scoped[0]
       };
     }
-    return {
-      accessibleLineIds: configLineIds || [],
-      defaultLineId: configLineIds?.[0]
-    };
-  }, [user, configLineIds]);
+    if (scopedFactoryIds.length > 0) {
+      const scoped = filterToEnabledDb(resolveFactoryScopedLines(scopedFactoryIds));
+      return {
+        accessibleLineIds: scoped,
+        defaultLineId: scoped[0]
+      };
+    }
+    if (scopedCompanyId) {
+      const dbCompanyLineIds = dbLines.filter((line) => !line.company_id || line.company_id === scopedCompanyId).map((line) => line.id);
+      const companyScopedLines = configLineIds && configLineIds.length > 0 ? (() => {
+        const dbCompanySet = new Set(dbCompanyLineIds);
+        const filtered = configLineIds.filter((lineId) => dbCompanySet.has(lineId));
+        if (filtered.length > 0) return filtered;
+        return dbCompanyLineIds;
+      })() : dbCompanyLineIds;
+      const scoped = filterToEnabledDb(companyScopedLines);
+      return {
+        accessibleLineIds: scoped,
+        defaultLineId: scoped[0]
+      };
+    }
+    if (propertyLineIds.length > 0) {
+      const filtered = applyConfigFilter(propertyLineIds);
+      const scoped = filterToEnabledDb(filtered);
+      return {
+        accessibleLineIds: scoped,
+        defaultLineId: scoped[0]
+      };
+    }
+    if (propertyFactoryIds.length > 0) {
+      const scoped = filterToEnabledDb(resolveFactoryScopedLines(propertyFactoryIds));
+      return {
+        accessibleLineIds: scoped,
+        defaultLineId: scoped[0]
+      };
+    }
+    if (role === "owner" || role === "it" || role === "optifye") {
+      const companyScopedLines = scopedCompanyId ? dbLines.filter((line) => !line.company_id || line.company_id === scopedCompanyId).map((line) => line.id) : [];
+      const scoped = filterToEnabledDb(companyScopedLines);
+      return {
+        accessibleLineIds: scoped,
+        defaultLineId: scoped[0]
+      };
+    }
+    return { accessibleLineIds: [], defaultLineId: void 0 };
+  }, [user, configLineIds, dbLines]);
   return { accessibleLineIds, defaultLineId, user };
 }
 function useActiveLineId(queryLineId, configLineIds) {
@@ -16509,12 +16686,7 @@ var useSupervisorsByLineIds = (lineIds, options) => {
       const nextSupervisorsByLineId = /* @__PURE__ */ new Map();
       const nextAllSupervisorsMap = /* @__PURE__ */ new Map();
       if (useBackend && resolvedCompanyId) {
-        const searchParams = new URLSearchParams({
-          company_id: resolvedCompanyId
-        });
-        if (lineIdsKey) {
-          searchParams.set("line_ids", lineIdsKey);
-        }
+        const searchParams = new URLSearchParams({ company_id: resolvedCompanyId });
         const data = await fetchBackendJson(supabase, `/api/dashboard/line-supervisors?${searchParams.toString()}`);
         (data?.supervisors || []).forEach((row) => {
           const assignedLineIds = Array.isArray(row.line_ids) ? row.line_ids : [];
@@ -28334,8 +28506,52 @@ function withAccessControl(WrappedComponent2, options = {}) {
   const WithAccessControlComponent = (props) => {
     const router$1 = router.useRouter();
     const { user, loading: authLoading } = useAuth();
-    const { canAccessPage, userRole } = useAccessControl();
-    requiredPath || router$1.pathname;
+    const role = user?.role_level;
+    const scope = user?.access_scope;
+    const isSuperAdmin = !!scope?.is_super_admin || user?.scope_mode === "SUPER_ADMIN";
+    const getBasePath = (path) => {
+      const firstSegment = path.split("?")[0].split("/").filter(Boolean)[0];
+      return firstSegment ? `/${firstSegment}` : "/";
+    };
+    const getIdFromPath = (path, key) => {
+      const queryValue = router$1.query[key];
+      if (typeof queryValue === "string") return queryValue;
+      if (Array.isArray(queryValue) && queryValue.length > 0) return queryValue[0];
+      const segments = path.split("?")[0].split("/").filter(Boolean);
+      const keyIndex = segments.findIndex((segment) => segment.toLowerCase() === key.toLowerCase());
+      if (keyIndex >= 0 && keyIndex < segments.length - 1) return segments[keyIndex + 1];
+      return null;
+    };
+    const roleAccessMap = {
+      optifye: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/improvement-center", "/tickets"],
+      owner: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/improvement-center", "/tickets"],
+      it: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/improvement-center", "/tickets"],
+      plant_head: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/improvement-center", "/tickets"],
+      supervisor: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/skus", "/help", "/health", "/profile", "/workspace", "/improvement-center", "/tickets"]
+    };
+    const canAccessPath = (path) => {
+      if (!user || !role) return false;
+      if (isSuperAdmin) return true;
+      const basePath = getBasePath(path);
+      const allowed = roleAccessMap[role] || [];
+      if (!allowed.includes(basePath)) {
+        return false;
+      }
+      const workspaceId = getIdFromPath(path, "workspace");
+      if (workspaceId && scope?.workspace_ids?.length) {
+        return scope.workspace_ids.includes(workspaceId);
+      }
+      const lineId = getIdFromPath(path, "kpis") || getIdFromPath(path, "line");
+      if (lineId && scope?.line_ids?.length) {
+        return scope.line_ids.includes(lineId);
+      }
+      const factoryId = getIdFromPath(path, "factory");
+      if (factoryId && scope?.factory_ids?.length) {
+        return scope.factory_ids.includes(factoryId);
+      }
+      return true;
+    };
+    const pathToCheck = requiredPath || router$1.asPath || router$1.pathname;
     if (authLoading) {
       return /* @__PURE__ */ jsxRuntime.jsx("div", { className: "flex h-screen w-full items-center justify-center", children: /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "text-center", children: [
         /* @__PURE__ */ jsxRuntime.jsx("div", { className: "animate-spin rounded-full h-8 w-8 border-b-2 border-blue-600 mx-auto mb-4" }),
@@ -28345,6 +28561,24 @@ function withAccessControl(WrappedComponent2, options = {}) {
     if (!user) {
       return /* @__PURE__ */ jsxRuntime.jsx("div", { className: "flex h-screen w-full items-center justify-center", children: /* @__PURE__ */ jsxRuntime.jsx("div", { className: "text-center", children: /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-gray-600 mb-4", children: "Please log in to continue" }) }) });
     }
+    const hasAccess = canAccessPath(pathToCheck);
+    if (!hasAccess) {
+      if (UnauthorizedComponent) {
+        return /* @__PURE__ */ jsxRuntime.jsx(UnauthorizedComponent, {});
+      }
+      if (typeof window !== "undefined") {
+        router$1.replace(redirectTo);
+      }
+      return /* @__PURE__ */ jsxRuntime.jsx("div", { className: "flex h-screen w-full items-center justify-center", children: /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "text-center", children: [
+        /* @__PURE__ */ jsxRuntime.jsx("h2", { className: "text-2xl font-bold text-gray-900 mb-2", children: "Access Denied" }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-gray-600 mb-4", children: "You don't have permission to access this page." }),
+        /* @__PURE__ */ jsxRuntime.jsxs("p", { className: "text-sm text-gray-500", children: [
+          "Your role: ",
+          /* @__PURE__ */ jsxRuntime.jsx("span", { className: "font-medium", children: role || "Unknown" })
+        ] }),
+        /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-gray-500 mt-2", children: "Redirecting to home page..." })
+      ] }) });
+    }
     return /* @__PURE__ */ jsxRuntime.jsx(WrappedComponent2, { ...props });
   };
   WithAccessControlComponent.displayName = `withAccessControl(${WrappedComponent2.displayName || WrappedComponent2.name || "Component"})`;
@@ -48658,9 +48892,29 @@ var SideNavBar = React26.memo(({
 }) => {
   const router$1 = router.useRouter();
   const { navigate } = useNavigation();
-  const { signOut } = useAuth();
+  const { signOut, user } = useAuth();
   const entityConfig = useEntityConfig();
   const dashboardConfig = useDashboardConfig();
+  const isSuperAdmin = user?.scope_mode === "SUPER_ADMIN" || !!user?.access_scope?.is_super_admin;
+  const role = user?.role_level;
+  const roleAccessMap = {
+    optifye: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/tickets", "/improvement-center"],
+    owner: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/tickets", "/improvement-center"],
+    it: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/tickets", "/improvement-center"],
+    plant_head: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/supervisor-management", "/skus", "/help", "/health", "/profile", "/workspace", "/factory-view", "/team-management", "/tickets", "/improvement-center"],
+    supervisor: ["/", "/leaderboard", "/kpis", "/targets", "/shifts", "/skus", "/help", "/health", "/profile", "/workspace", "/tickets", "/improvement-center"]
+  };
+  const getBasePath = React26.useCallback((path) => {
+    const firstSegment = path.split("?")[0].split("/").filter(Boolean)[0];
+    return firstSegment ? `/${firstSegment}` : "/";
+  }, []);
+  const canAccessPath = React26.useCallback((path) => {
+    if (!role) return false;
+    if (isSuperAdmin) return true;
+    const basePath = getBasePath(path);
+    const allowedPaths = roleAccessMap[role] || [];
+    return allowedPaths.includes(basePath);
+  }, [role, isSuperAdmin, getBasePath]);
   const lineId = entityConfig.defaultLineId || LINE_1_UUID;
   const skuEnabled = dashboardConfig?.skuConfig?.enabled || false;
   dashboardConfig?.supervisorConfig?.enabled || false;
@@ -48826,7 +49080,7 @@ var SideNavBar = React26.memo(({
   const settingsTriggerRef = React26.useRef(null);
   const settingsItems = React26.useMemo(() => {
     const items = [
-      {
+      ...canAccessPath("/targets") ? [{
         key: "targets",
         label: "Targets",
         icon: outline.AdjustmentsHorizontalIcon,
@@ -48835,8 +49089,8 @@ var SideNavBar = React26.memo(({
           setIsSettingsOpen(false);
         },
         isActive: pathname === "/targets" || pathname.startsWith("/targets/")
-      },
-      {
+      }] : [],
+      ...canAccessPath("/shifts") ? [{
         key: "shifts",
         label: "Shifts",
         icon: outline.ClockIcon,
@@ -48845,8 +49099,8 @@ var SideNavBar = React26.memo(({
           setIsSettingsOpen(false);
         },
         isActive: pathname === "/shifts" || pathname.startsWith("/shifts/")
-      },
-      {
+      }] : [],
+      ...canAccessPath("/team-management") ? [{
         key: "teams",
         label: "Teams",
         icon: outline.UsersIcon,
@@ -48855,8 +49109,8 @@ var SideNavBar = React26.memo(({
           setIsSettingsOpen(false);
         },
         isActive: pathname === "/team-management" || pathname.startsWith("/team-management/")
-      },
-      {
+      }] : [],
+      ...canAccessPath("/profile") ? [{
         key: "profile",
         label: "Profile",
         icon: outline.UserCircleIcon,
@@ -48865,9 +49119,9 @@ var SideNavBar = React26.memo(({
           setIsSettingsOpen(false);
         },
         isActive: pathname === "/profile" || pathname.startsWith("/profile/")
-      }
+      }] : []
     ];
-    if (ticketsEnabled) {
+    if (ticketsEnabled && canAccessPath("/tickets")) {
       items.push({
         key: "tickets",
         label: "Tickets",
@@ -48879,18 +49133,20 @@ var SideNavBar = React26.memo(({
         isActive: pathname === "/tickets" || pathname.startsWith("/tickets/")
       });
     }
-    items.push({
-      key: "help",
-      label: "Help",
-      icon: outline.QuestionMarkCircleIcon,
-      onClick: () => {
-        handleHelpClick();
-        setIsSettingsOpen(false);
-      },
-      isActive: pathname === "/help" || pathname.startsWith("/help/")
-    });
+    if (canAccessPath("/help")) {
+      items.push({
+        key: "help",
+        label: "Help",
+        icon: outline.QuestionMarkCircleIcon,
+        onClick: () => {
+          handleHelpClick();
+          setIsSettingsOpen(false);
+        },
+        isActive: pathname === "/help" || pathname.startsWith("/help/")
+      });
+    }
     return items;
-  }, [handleTargetsClick, handleShiftsClick, handleTeamManagementClick, handleProfileClick, handleTicketsClick, handleHelpClick, pathname, ticketsEnabled]);
+  }, [handleTargetsClick, handleShiftsClick, handleTeamManagementClick, handleProfileClick, handleTicketsClick, handleHelpClick, pathname, ticketsEnabled, canAccessPath]);
   const handleLogout = React26.useCallback(async () => {
     setIsSettingsOpen(false);
     try {
@@ -48928,7 +49184,7 @@ var SideNavBar = React26.memo(({
       }
     ) }),
     /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex-1 w-full py-6 px-4 overflow-y-auto", children: [
-      /* @__PURE__ */ jsxRuntime.jsx("div", { className: "mb-6", children: /* @__PURE__ */ jsxRuntime.jsxs(
+      /* @__PURE__ */ jsxRuntime.jsx("div", { className: "mb-6", children: canAccessPath("/") && /* @__PURE__ */ jsxRuntime.jsxs(
         "button",
         {
           onClick: handleHomeClick,
@@ -48944,7 +49200,7 @@ var SideNavBar = React26.memo(({
         }
       ) }),
       /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-4", children: [
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/leaderboard") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleLeaderboardClick,
@@ -48959,7 +49215,7 @@ var SideNavBar = React26.memo(({
             ]
           }
         ),
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/kpis") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleKPIsClick,
@@ -48974,7 +49230,7 @@ var SideNavBar = React26.memo(({
             ]
           }
         ),
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/improvement-center") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleImprovementClick,
@@ -48990,7 +49246,7 @@ var SideNavBar = React26.memo(({
           }
         ),
         showSupervisorManagement,
-        skuEnabled && true && /* @__PURE__ */ jsxRuntime.jsxs(
+        skuEnabled && canAccessPath("/skus") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleSKUsClick,
@@ -49005,7 +49261,7 @@ var SideNavBar = React26.memo(({
             ]
           }
         ),
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/health") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleHealthClick,
@@ -49022,7 +49278,7 @@ var SideNavBar = React26.memo(({
         )
       ] })
     ] }),
-    /* @__PURE__ */ jsxRuntime.jsx("div", { className: "w-full py-5 px-4 border-t border-gray-100 flex-shrink-0", children: /* @__PURE__ */ jsxRuntime.jsxs(
+    settingsItems.length > 0 && /* @__PURE__ */ jsxRuntime.jsx("div", { className: "w-full py-5 px-4 border-t border-gray-100 flex-shrink-0", children: /* @__PURE__ */ jsxRuntime.jsxs(
       "button",
       {
         ref: settingsTriggerRef,
@@ -49060,7 +49316,7 @@ var SideNavBar = React26.memo(({
       };
     };
     return /* @__PURE__ */ jsxRuntime.jsxs("nav", { className: "px-5 py-6", children: [
-      /* @__PURE__ */ jsxRuntime.jsxs(
+      canAccessPath("/") && /* @__PURE__ */ jsxRuntime.jsxs(
         "button",
         {
           onClick: handleMobileNavClick(handleHomeClick),
@@ -49073,7 +49329,7 @@ var SideNavBar = React26.memo(({
         }
       ),
       /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "mt-6 space-y-2", children: [
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/leaderboard") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleMobileNavClick(handleLeaderboardClick),
@@ -49085,7 +49341,7 @@ var SideNavBar = React26.memo(({
             ]
           }
         ),
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/kpis") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleMobileNavClick(handleKPIsClick),
@@ -49097,7 +49353,7 @@ var SideNavBar = React26.memo(({
             ]
           }
         ),
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/improvement-center") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleMobileNavClick(handleImprovementClick),
@@ -49110,7 +49366,7 @@ var SideNavBar = React26.memo(({
           }
         ),
         showSupervisorManagement,
-        skuEnabled && true && /* @__PURE__ */ jsxRuntime.jsxs(
+        skuEnabled && canAccessPath("/skus") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleMobileNavClick(handleSKUsClick),
@@ -49122,7 +49378,7 @@ var SideNavBar = React26.memo(({
             ]
           }
         ),
-        /* @__PURE__ */ jsxRuntime.jsxs(
+        canAccessPath("/health") && /* @__PURE__ */ jsxRuntime.jsxs(
           "button",
           {
             onClick: handleMobileNavClick(handleHealthClick),
@@ -49135,10 +49391,10 @@ var SideNavBar = React26.memo(({
           }
         )
       ] }),
-      /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "mt-8 pt-6 border-t border-gray-100", children: [
+      settingsItems.length > 0 && /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "mt-8 pt-6 border-t border-gray-100", children: [
         /* @__PURE__ */ jsxRuntime.jsx("h3", { className: "px-5 mb-3 text-[10px] font-bold text-gray-400 uppercase tracking-widest", children: "Settings & Support" }),
         /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-1", children: [
-          /* @__PURE__ */ jsxRuntime.jsxs(
+          canAccessPath("/targets") && /* @__PURE__ */ jsxRuntime.jsxs(
             "button",
             {
               onClick: handleMobileNavClick(handleTargetsClick),
@@ -49150,7 +49406,7 @@ var SideNavBar = React26.memo(({
               ]
             }
           ),
-          /* @__PURE__ */ jsxRuntime.jsxs(
+          canAccessPath("/shifts") && /* @__PURE__ */ jsxRuntime.jsxs(
             "button",
             {
               onClick: handleMobileNavClick(handleShiftsClick),
@@ -49162,7 +49418,7 @@ var SideNavBar = React26.memo(({
               ]
             }
           ),
-          /* @__PURE__ */ jsxRuntime.jsxs(
+          canAccessPath("/team-management") && /* @__PURE__ */ jsxRuntime.jsxs(
             "button",
             {
               onClick: handleMobileNavClick(handleTeamManagementClick),
@@ -49174,7 +49430,7 @@ var SideNavBar = React26.memo(({
               ]
             }
           ),
-          /* @__PURE__ */ jsxRuntime.jsxs(
+          canAccessPath("/profile") && /* @__PURE__ */ jsxRuntime.jsxs(
             "button",
             {
               onClick: handleMobileNavClick(handleProfileClick),
@@ -49186,7 +49442,7 @@ var SideNavBar = React26.memo(({
               ]
             }
           ),
-          ticketsEnabled && /* @__PURE__ */ jsxRuntime.jsxs(
+          ticketsEnabled && canAccessPath("/tickets") && /* @__PURE__ */ jsxRuntime.jsxs(
             "button",
             {
               onClick: handleMobileNavClick(handleTicketsClick),
@@ -49198,7 +49454,7 @@ var SideNavBar = React26.memo(({
               ]
             }
           ),
-          /* @__PURE__ */ jsxRuntime.jsxs(
+          canAccessPath("/help") && /* @__PURE__ */ jsxRuntime.jsxs(
             "button",
             {
               onClick: handleMobileNavClick(handleHelpClick),
@@ -51458,9 +51714,19 @@ var InviteUserDialog = ({
   const [factorySearch, setFactorySearch] = React26.useState("");
   const [isSubmitting, setIsSubmitting] = React26.useState(false);
   const [error, setError] = React26.useState(null);
+  const isSuperAdminOptifye = user?.role_level === "optifye" && (user?.scope_mode === "SUPER_ADMIN" || !!user?.access_scope?.is_super_admin);
+  const canInviteOwner = isSuperAdminOptifye;
   const canInviteIT = user?.role_level === "owner" || user?.role_level === "optifye";
   const canInvitePlantHead = user?.role_level === "owner" || user?.role_level === "it" || user?.role_level === "optifye";
   const canInviteSupervisor = ["owner", "it", "plant_head", "optifye"].includes(user?.role_level || "");
+  const invitableRoles = React26.useMemo(() => {
+    const roles = [];
+    if (canInviteOwner) roles.push("owner");
+    if (canInviteIT) roles.push("it");
+    if (canInvitePlantHead) roles.push("plant_head");
+    if (canInviteSupervisor) roles.push("supervisor");
+    return roles;
+  }, [canInviteOwner, canInviteIT, canInvitePlantHead, canInviteSupervisor]);
   const filteredLines = React26.useMemo(() => {
     const search = lineSearch.trim().toLowerCase();
     if (!search) return availableLines;
@@ -51492,6 +51758,14 @@ var InviteUserDialog = ({
       setError(null);
     }
   }, [isOpen]);
+  React26.useEffect(() => {
+    if (!isOpen || invitableRoles.length === 0) {
+      return;
+    }
+    if (!invitableRoles.includes(selectedRole)) {
+      setSelectedRole(invitableRoles[0]);
+    }
+  }, [isOpen, invitableRoles, selectedRole]);
   const validateEmail = (email2) => {
     const emailRegex = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}$/;
     return emailRegex.test(email2);
@@ -51521,6 +51795,14 @@ var InviteUserDialog = ({
       setError("Please enter a valid email address");
       return;
     }
+    if (!invitableRoles.includes(selectedRole)) {
+      setError("You do not have permission to assign this role.");
+      return;
+    }
+    if (selectedRole === "owner" && !canInviteOwner) {
+      setError("Only super-admin Optifye users can create owner users.");
+      return;
+    }
     const companyId = entityConfig?.companyId || user?.properties?.company_id;
     if (!companyId) {
       setError("Company ID not found. Please refresh and try again.");
@@ -51701,6 +51983,33 @@ var InviteUserDialog = ({
                     /* @__PURE__ */ jsxRuntime.jsx("span", { className: "text-red-500", children: "*" })
                   ] }),
                   /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "space-y-2", children: [
+                    canInviteOwner && /* @__PURE__ */ jsxRuntime.jsxs(
+                      "label",
+                      {
+                        className: cn(
+                          "flex items-start gap-3 p-4 border-2 rounded-lg cursor-pointer transition-all duration-200",
+                          selectedRole === "owner" ? "border-amber-500 bg-amber-50" : "border-gray-200 hover:border-gray-300 hover:bg-gray-50"
+                        ),
+                        children: [
+                          /* @__PURE__ */ jsxRuntime.jsx(
+                            "input",
+                            {
+                              type: "radio",
+                              name: "role",
+                              value: "owner",
+                              checked: selectedRole === "owner",
+                              onChange: (e) => setSelectedRole(e.target.value),
+                              className: "mt-1",
+                              disabled: isSubmitting
+                            }
+                          ),
+                          /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex-1", children: [
+                            /* @__PURE__ */ jsxRuntime.jsx("div", { className: "flex items-center gap-2 mb-1", children: /* @__PURE__ */ jsxRuntime.jsx(RoleBadge_default, { role: "owner", size: "sm" }) }),
+                            /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-gray-600", children: "Company owner access. Full management permissions for the selected company dashboard." })
+                          ] })
+                        ]
+                      }
+                    ),
                     canInviteIT && /* @__PURE__ */ jsxRuntime.jsxs(
                       "label",
                       {
@@ -53572,11 +53881,32 @@ var UserManagementTable = ({
       setSortDirection("asc");
     }
   };
+  const getFactoryIdsFromUser = (user) => {
+    const properties = user.properties || {};
+    const rawFactoryIds = properties.factory_ids ?? properties.factory_id;
+    if (Array.isArray(rawFactoryIds)) {
+      return rawFactoryIds.filter((factoryId) => typeof factoryId === "string" && factoryId.length > 0);
+    }
+    if (typeof rawFactoryIds === "string" && rawFactoryIds.length > 0) {
+      return [rawFactoryIds];
+    }
+    return [];
+  };
   const formatAssignments = (user) => {
     if (user.role_level === "owner" || user.role_level === "it") return "Company-wide";
     if (user.role_level === "optifye") return "All companies";
-    if (user.role_level === "plant_head" && user.assigned_factories) {
-      return user.assigned_factories.join(", ") || "No factories assigned";
+    if (user.role_level === "plant_head") {
+      if (user.assigned_factories && user.assigned_factories.length > 0) {
+        return user.assigned_factories.join(", ");
+      }
+      const assignedFactoryIds = getFactoryIdsFromUser(user);
+      if (assignedFactoryIds.length === 1) {
+        return "1 factory assigned";
+      }
+      if (assignedFactoryIds.length > 1) {
+        return `${assignedFactoryIds.length} factories assigned`;
+      }
+      return "No factories assigned";
     }
     if (user.role_level === "supervisor" && user.assigned_lines) {
       return user.assigned_lines.join(", ") || "No lines assigned";
@@ -53768,22 +54098,28 @@ var UserManagementTable = ({
                     onUpdate: onLineAssignmentUpdate || (async () => {
                     })
                   }
-                ) : user.role_level === "plant_head" ? /* @__PURE__ */ jsxRuntime.jsx(
-                  FactoryAssignmentDropdown,
-                  {
-                    userId: user.user_id,
-                    currentFactoryIds: user.properties?.factory_ids || [],
-                    availableFactories: (
-                      // Filter factories to only show those from the target user's company
-                      user.properties?.company_id ? availableFactories.filter(
-                        (factory) => factory.company_id === user.properties?.company_id
-                      ) : availableFactories
-                    ),
-                    canEdit: permissions.canAssignFactories(user) && !!onFactoryAssignmentUpdate,
-                    onUpdate: onFactoryAssignmentUpdate || (async () => {
-                    })
+                ) : user.role_level === "plant_head" ? (() => {
+                  const canEditFactoryAssignments = permissions.canAssignFactories(user) && !!onFactoryAssignmentUpdate;
+                  if (!canEditFactoryAssignments) {
+                    return /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-gray-900", children: formatAssignments(user) });
                   }
-                ) : /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-gray-900", children: formatAssignments(user) }) }),
+                  return /* @__PURE__ */ jsxRuntime.jsx(
+                    FactoryAssignmentDropdown,
+                    {
+                      userId: user.user_id,
+                      currentFactoryIds: getFactoryIdsFromUser(user),
+                      availableFactories: (
+                        // Filter factories to only show those from the target user's company
+                        user.properties?.company_id ? availableFactories.filter(
+                          (factory) => factory.company_id === user.properties?.company_id
+                        ) : availableFactories
+                      ),
+                      canEdit: canEditFactoryAssignments,
+                      onUpdate: onFactoryAssignmentUpdate || (async () => {
+                      })
+                    }
+                  );
+                })() : /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-gray-900", children: formatAssignments(user) }) }),
                 showUsageStats && /* @__PURE__ */ jsxRuntime.jsx("td", { className: "px-6 py-4", children: user.role_level === "plant_head" || user.role_level === "supervisor" ? /* @__PURE__ */ jsxRuntime.jsx(
                   "button",
                   {
@@ -54948,52 +55284,18 @@ function HomeView({
     });
     return merged;
   }, [lineNames, dbLines]);
-  const isOwner = user?.role_level === "owner";
-  const isPlantHead = user?.role_level === "plant_head";
+  const enabledLineIdSet = React26.useMemo(
+    () => new Set(dbLines.filter((line) => line.enable).map((line) => line.id)),
+    [dbLines]
+  );
   const isSupervisor = user?.role_level === "supervisor";
-  const assignedLineIds = React26.useMemo(() => {
-    const rawLineIds = user?.properties?.line_id || user?.properties?.line_ids || [];
-    return Array.isArray(rawLineIds) ? rawLineIds : [];
-  }, [user]);
-  const assignedLineIdsInConfig = React26.useMemo(() => {
-    if (assignedLineIds.length === 0) {
-      return [];
-    }
-    return assignedLineIds.filter((id3) => allLineIds.includes(id3));
-  }, [assignedLineIds, allLineIds]);
-  const assignedFactoryIds = React26.useMemo(() => {
-    const rawFactoryIds = user?.properties?.factory_id || user?.properties?.factory_ids || [];
-    return Array.isArray(rawFactoryIds) ? rawFactoryIds : [];
-  }, [user]);
-  const lineFactoryMap = React26.useMemo(() => {
-    const map = /* @__PURE__ */ new Map();
-    dbLines.forEach((line) => {
-      map.set(line.id, line.factory_id);
-    });
-    return map;
-  }, [dbLines]);
-  const plantHeadLineIds = React26.useMemo(() => {
-    if (!isPlantHead || assignedFactoryIds.length === 0) {
-      return [];
-    }
-    const assignedFactoryIdSet = new Set(assignedFactoryIds);
-    return allLineIds.filter((lineId) => assignedFactoryIdSet.has(lineFactoryMap.get(lineId) || ""));
-  }, [isPlantHead, assignedFactoryIds, allLineIds, lineFactoryMap]);
   const visibleLineIds = React26.useMemo(() => {
-    if (isOwner) {
-      return allLineIds;
+    const scoped = Array.from(new Set(allLineIds.filter(Boolean)));
+    if (enabledLineIdSet.size === 0) {
+      return scoped;
     }
-    if (isPlantHead) {
-      const combinedLineIds = /* @__PURE__ */ new Set();
-      plantHeadLineIds.forEach((lineId) => combinedLineIds.add(lineId));
-      assignedLineIdsInConfig.forEach((lineId) => combinedLineIds.add(lineId));
-      return Array.from(combinedLineIds);
-    }
-    if (isSupervisor) {
-      return assignedLineIdsInConfig;
-    }
-    return allLineIds;
-  }, [isOwner, isPlantHead, isSupervisor, allLineIds, plantHeadLineIds, assignedLineIdsInConfig]);
+    return scoped.filter((lineId) => enabledLineIdSet.has(lineId));
+  }, [allLineIds, enabledLineIdSet]);
   const fallbackLineId = visibleLineIds[0] || defaultLineId;
   const defaultHomeLineId = fallbackLineId;
   const availableLineIds = React26.useMemo(() => {
@@ -55020,7 +55322,7 @@ function HomeView({
     return defaultHomeLineId;
   });
   React26.useEffect(() => {
-    if (!user || !isSupervisor && !isPlantHead || availableLineIds.length === 0) {
+    if (!user || availableLineIds.length === 0) {
       return;
     }
     try {
@@ -55034,13 +55336,14 @@ function HomeView({
     } catch (error) {
       console.warn("Failed to read line filter from sessionStorage:", error);
     }
+    if (availableLineIds.includes(selectedLineId)) {
+      return;
+    }
     if (defaultHomeLineId !== selectedLineId) {
       setSelectedLineId(defaultHomeLineId);
     }
   }, [
     user,
-    isSupervisor,
-    isPlantHead,
     availableLineIds,
     defaultHomeLineId,
     selectedLineId,
@@ -55059,14 +55362,14 @@ function HomeView({
   const [diagnoses, setDiagnoses] = React26.useState([]);
   const timezone = useAppTimezone();
   const { shiftConfigMap: lineShiftConfigs } = useMultiLineShiftConfigs(
-    allLineIds,
+    visibleLineIds,
     dashboardConfig?.shiftConfig
   );
   React26.useEffect(() => {
     const initDisplayNames = async () => {
       try {
         if (selectedLineId === factoryViewId) {
-          for (const lineId of allLineIds) {
+          for (const lineId of visibleLineIds) {
             await preInitializeWorkspaceDisplayNames(lineId);
           }
         } else {
@@ -55079,7 +55382,7 @@ function HomeView({
       }
     };
     initDisplayNames();
-  }, [selectedLineId, factoryViewId, allLineIds]);
+  }, [selectedLineId, factoryViewId, visibleLineIds]);
   const displayNameLineId = selectedLineId === factoryViewId ? void 0 : selectedLineId;
   const {
     displayNames: workspaceDisplayNames,
@@ -58830,8 +59133,32 @@ var KPIsOverviewView = ({
   const dbTimezone = useAppTimezone();
   const configuredTimezone = dbTimezone || dateTimeConfig.defaultTimezone || "UTC";
   const { startDate: monthStartDate, endDate: monthEndDateKey, monthEndDate } = getMonthDateInfo(configuredTimezone);
-  const isSupervisor = user?.role_level === "supervisor";
-  const assignedLineIdsForLeaderboard = isSupervisor ? lineIds : void 0;
+  const isSuperAdmin = user?.scope_mode === "SUPER_ADMIN" || !!user?.access_scope?.is_super_admin;
+  const scopedLineIds = React26__namespace.default.useMemo(
+    () => Array.isArray(user?.access_scope?.line_ids) ? user.access_scope.line_ids.filter((lineId) => typeof lineId === "string" && lineId.length > 0) : [],
+    [user?.access_scope?.line_ids]
+  );
+  const hasCanonicalScope = !!user?.scope_mode || !!user?.access_scope;
+  const scopeRole = (user?.role_level || user?.role || "").toLowerCase();
+  const isStrictLineScopedRole = scopeRole === "supervisor" || scopeRole === "plant_head";
+  const resolvedAssignedLineIds = React26__namespace.default.useMemo(() => {
+    if (isSuperAdmin) return [];
+    if (scopedLineIds.length > 0) return scopedLineIds;
+    if (lineIds && lineIds.length > 0) return lineIds;
+    if (isStrictLineScopedRole && hasCanonicalScope) return [];
+    return [];
+  }, [isSuperAdmin, scopedLineIds, lineIds, isStrictLineScopedRole, hasCanonicalScope]);
+  const assignedLineIdSet = React26__namespace.default.useMemo(
+    () => new Set(resolvedAssignedLineIds),
+    [resolvedAssignedLineIds]
+  );
+  const metricsLineIds = React26__namespace.default.useMemo(() => {
+    if (isSuperAdmin) {
+      return lineIds ?? [];
+    }
+    return resolvedAssignedLineIds;
+  }, [isSuperAdmin, lineIds, resolvedAssignedLineIds]);
+  const assignedLineIdsForLeaderboard = isSuperAdmin ? void 0 : resolvedAssignedLineIds;
   const leaderboardLinesForView = React26__namespace.default.useMemo(() => {
     const targetMode = viewType === "machine" ? "uptime" : "output";
     return leaderboardLines.filter((line) => (line.monitoring_mode ?? "output") === targetMode);
@@ -58883,7 +59210,7 @@ var KPIsOverviewView = ({
     error: metricsError
   } = useDashboardMetrics({
     lineId: factoryViewId,
-    userAccessibleLineIds: lineIds
+    userAccessibleLineIds: metricsLineIds
   });
   const defaultKPIs = React26__namespace.default.useMemo(() => createDefaultKPIs(), []);
   const kpisByLineId = React26__namespace.default.useMemo(() => {
@@ -58937,16 +59264,16 @@ var KPIsOverviewView = ({
         console.log("[KPIsOverviewView] Fetching lines with lineIds filter:", lineIds);
         const allLines = await dashboardService.getAllLines();
         let filteredLines = allLines;
-        if (lineIds && lineIds.length > 0) {
-          filteredLines = allLines.filter((line) => lineIds.includes(line.id));
-          console.log("[KPIsOverviewView] Filtered lines:", {
+        if (!isSuperAdmin) {
+          filteredLines = allLines.filter((line) => assignedLineIdSet.has(line.id));
+          console.log("[KPIsOverviewView] Applied scoped line filter:", {
             total: allLines.length,
             filtered: filteredLines.length,
-            lineIds,
+            allowedLineIds: resolvedAssignedLineIds,
             filteredLineIds: filteredLines.map((l) => l.id)
           });
         } else {
-          console.log("[KPIsOverviewView] No lineIds filter, showing all lines:", allLines.length);
+          console.log("[KPIsOverviewView] Super admin view, showing all lines:", allLines.length);
         }
         setLines(filteredLines);
       } catch (err) {
@@ -58957,34 +59284,36 @@ var KPIsOverviewView = ({
       }
     };
     fetchLines();
-  }, [supabase, dashboardConfig, lineIds]);
+  }, [supabase, dashboardConfig, lineIds, isSuperAdmin, assignedLineIdSet, resolvedAssignedLineIds]);
   React26.useEffect(() => {
     let isMounted = true;
     const fetchLeaderboardLines = async () => {
       if (!supabase || !resolvedCompanyId) {
-        setLeaderboardLines(lines);
+        setLeaderboardLines(lines.filter((line) => line.enable !== false));
         return;
       }
       setLeaderboardLinesLoading(true);
       try {
-        const linesService2 = new LinesService(supabase);
-        const companyLines = await linesService2.getLinesByCompanyId(resolvedCompanyId);
+        const data = await fetchBackendJson(
+          supabase,
+          `/api/dashboard/leaderboard-lines?company_id=${encodeURIComponent(resolvedCompanyId)}`
+        );
         if (!isMounted) return;
-        const transformed = companyLines.map((line) => ({
+        const transformed = (data.lines || []).filter((line) => line.enable !== false).map((line) => ({
           id: line.id,
-          line_name: line.name,
-          factory_id: line.factoryId || "",
+          line_name: line.line_name,
+          factory_id: line.factory_id || "",
           factory_name: "N/A",
-          company_id: line.companyId,
+          company_id: line.company_id,
           company_name: "",
-          enable: line.isActive ?? true,
-          monitoring_mode: line.monitoringMode ?? "output"
+          enable: line.enable ?? true,
+          monitoring_mode: line.monitoring_mode ?? "output"
         }));
         setLeaderboardLines(transformed);
       } catch (err) {
         console.error("[KPIsOverviewView] Failed to load leaderboard lines:", err);
         if (!isMounted) return;
-        setLeaderboardLines(lines);
+        setLeaderboardLines(lines.filter((line) => line.enable !== false));
       } finally {
         if (isMounted) setLeaderboardLinesLoading(false);
       }
@@ -59065,11 +59394,10 @@ var KPIsOverviewView = ({
         lineMode: viewType === "machine" ? "uptime" : "output"
       });
       const nextMap = /* @__PURE__ */ new Map();
+      targetLineIds.forEach((lineId) => nextMap.set(lineId, 0));
       entries.forEach((entry) => {
         const value = Number(entry.avg_efficiency);
-        if (Number.isFinite(value)) {
-          nextMap.set(entry.line_id, value);
-        }
+        nextMap.set(entry.line_id, Number.isFinite(value) ? value : 0);
       });
       setTodayEfficiencyByLineId(nextMap);
     } catch (err) {
@@ -59152,6 +59480,9 @@ var KPIsOverviewView = ({
     };
   };
   const handleLineClick = (line, kpis) => {
+    if (!isSuperAdmin && !assignedLineIdSet.has(line.id)) {
+      return;
+    }
     const trackProps = {
       line_id: line.id,
       line_name: line.line_name,
@@ -59664,6 +59995,7 @@ var MobileWorkspaceCard = React26.memo(({
   workspace,
   rank,
   cardClass,
+  isClickable,
   onWorkspaceClick,
   getMedalIcon,
   efficiencyLabel
@@ -59676,8 +60008,8 @@ var MobileWorkspaceCard = React26.memo(({
     transition: {
       layout: { duration: 0.3, ease: "easeInOut" }
     },
-    onClick: () => onWorkspaceClick(workspace, rank),
-    className: `${cardClass} p-3 rounded-lg border shadow-sm active:scale-[0.98] cursor-pointer`,
+    onClick: isClickable ? () => onWorkspaceClick(workspace, rank) : void 0,
+    className: `${cardClass} p-3 rounded-lg border shadow-sm active:scale-[0.98] ${isClickable ? "cursor-pointer" : "cursor-not-allowed opacity-75"}`,
     children: /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex items-center justify-between mb-2", children: [
       /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex items-center gap-3", children: [
         /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex items-center gap-2", children: [
@@ -59699,13 +60031,14 @@ var MobileWorkspaceCard = React26.memo(({
     ] })
   }
 ), (prevProps, nextProps) => {
-  return prevProps.efficiencyLabel === nextProps.efficiencyLabel && prevProps.rank === nextProps.rank && prevProps.cardClass === nextProps.cardClass && prevProps.workspace.workspace_uuid === nextProps.workspace.workspace_uuid && prevProps.workspace.efficiency === nextProps.workspace.efficiency && prevProps.workspace.action_count === nextProps.workspace.action_count && prevProps.workspace.action_threshold === nextProps.workspace.action_threshold && prevProps.workspace.avg_cycle_time === nextProps.workspace.avg_cycle_time && prevProps.workspace.displayName === nextProps.workspace.displayName && prevProps.workspace.lineName === nextProps.workspace.lineName;
+  return prevProps.efficiencyLabel === nextProps.efficiencyLabel && prevProps.rank === nextProps.rank && prevProps.cardClass === nextProps.cardClass && prevProps.isClickable === nextProps.isClickable && prevProps.workspace.workspace_uuid === nextProps.workspace.workspace_uuid && prevProps.workspace.efficiency === nextProps.workspace.efficiency && prevProps.workspace.action_count === nextProps.workspace.action_count && prevProps.workspace.action_threshold === nextProps.workspace.action_threshold && prevProps.workspace.avg_cycle_time === nextProps.workspace.avg_cycle_time && prevProps.workspace.displayName === nextProps.workspace.displayName && prevProps.workspace.lineName === nextProps.workspace.lineName;
 });
 MobileWorkspaceCard.displayName = "MobileWorkspaceCard";
 var DesktopWorkspaceRow = React26.memo(({
   workspace,
   index,
   rowClass,
+  isClickable,
   onWorkspaceClick,
   getMedalIcon
 }) => /* @__PURE__ */ jsxRuntime.jsxs(
@@ -59715,8 +60048,8 @@ var DesktopWorkspaceRow = React26.memo(({
     layoutId: `row-${workspace.workspace_uuid}`,
     initial: false,
     transition: { layout: { duration: 0.3, ease: "easeInOut" } },
-    onClick: () => onWorkspaceClick(workspace, index + 1),
-    className: `${rowClass} hover:bg-gray-50/90 transition-colors duration-150 cursor-pointer group`,
+    onClick: isClickable ? () => onWorkspaceClick(workspace, index + 1) : void 0,
+    className: `${rowClass} transition-colors duration-150 ${isClickable ? "hover:bg-gray-50/90 cursor-pointer group" : "cursor-not-allowed opacity-75"}`,
     children: [
       /* @__PURE__ */ jsxRuntime.jsx("td", { className: "px-3 py-2.5 sm:p-4 text-sm sm:text-base whitespace-nowrap group-hover:font-medium", children: /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex items-center gap-2", children: [
         /* @__PURE__ */ jsxRuntime.jsx("span", { children: index + 1 }),
@@ -59728,7 +60061,7 @@ var DesktopWorkspaceRow = React26.memo(({
     ]
   }
 ), (prevProps, nextProps) => {
-  return prevProps.index === nextProps.index && prevProps.rowClass === nextProps.rowClass && prevProps.workspace.workspace_uuid === nextProps.workspace.workspace_uuid && prevProps.workspace.efficiency === nextProps.workspace.efficiency && prevProps.workspace.displayName === nextProps.workspace.displayName && prevProps.workspace.lineName === nextProps.workspace.lineName;
+  return prevProps.index === nextProps.index && prevProps.rowClass === nextProps.rowClass && prevProps.isClickable === nextProps.isClickable && prevProps.workspace.workspace_uuid === nextProps.workspace.workspace_uuid && prevProps.workspace.efficiency === nextProps.workspace.efficiency && prevProps.workspace.displayName === nextProps.workspace.displayName && prevProps.workspace.lineName === nextProps.workspace.lineName;
 });
 DesktopWorkspaceRow.displayName = "DesktopWorkspaceRow";
 var LeaderboardDetailView = React26.memo(({
@@ -59888,6 +60221,16 @@ var LeaderboardDetailView = React26.memo(({
     }
     return allLineIds;
   }, [entityConfig, userAccessibleLineIds]);
+  const accessibleLineIdSet = React26.useMemo(
+    () => new Set((userAccessibleLineIds || []).filter(Boolean)),
+    [userAccessibleLineIds]
+  );
+  const canOpenWorkspace = React26.useCallback((workspaceLineId) => {
+    if (!workspaceLineId) return false;
+    if (!userAccessibleLineIds) return true;
+    if (accessibleLineIdSet.size === 0) return false;
+    return accessibleLineIdSet.has(workspaceLineId);
+  }, [accessibleLineIdSet, userAccessibleLineIds]);
   const { hasUptime: lineModeHasUptime, hasOutput: lineModeHasOutput } = React26.useMemo(() => {
     if (!lines || lines.length === 0) {
       return { hasUptime: false, hasOutput: false };
@@ -60285,6 +60628,9 @@ var LeaderboardDetailView = React26.memo(({
     return `${startDate.toLocaleDateString("en-US", { month: "short", day: "numeric" })} - ${endDate.toLocaleDateString("en-US", { month: "short", day: "numeric", year: "numeric" })}`;
   }, [normalizedRange]);
   const handleWorkspaceClick = React26.useCallback((workspace, rank) => {
+    if (!canOpenWorkspace(workspace.line_id)) {
+      return;
+    }
     trackCoreEvent("Workspace from Leaderboard Clicked", {
       workspace_name: workspace.workspace_name,
       workspace_id: workspace.workspace_uuid,
@@ -60317,7 +60663,7 @@ var LeaderboardDetailView = React26.memo(({
       const combinedParams = navParams ? `${navParams}&${contextParamString}` : `?${contextParamString}`;
       navigation.navigate(`/workspace/${workspace.workspace_uuid}${combinedParams}`);
     }
-  }, [onWorkspaceClick, navigation, date, shiftId]);
+  }, [canOpenWorkspace, onWorkspaceClick, navigation, date, shiftId]);
   React26.useEffect(() => {
     workspacesLengthRef.current = activeEntries.length || 0;
   }, [activeEntries.length]);
@@ -60608,6 +60954,7 @@ var LeaderboardDetailView = React26.memo(({
           workspace: ws,
           rank,
           cardClass,
+          isClickable: canOpenWorkspace(ws.line_id),
           onWorkspaceClick: stableHandleWorkspaceClick,
           getMedalIcon: stableGetMedalIcon,
           efficiencyLabel
@@ -60632,6 +60979,7 @@ var LeaderboardDetailView = React26.memo(({
               workspace: ws,
               index,
               rowClass,
+              isClickable: canOpenWorkspace(ws.line_id),
               onWorkspaceClick: stableHandleWorkspaceClick,
               getMedalIcon: stableGetMedalIcon
             },
@@ -60642,7 +60990,7 @@ var LeaderboardDetailView = React26.memo(({
     ) })
   ] });
 }, (prevProps, nextProps) => {
-  return prevProps.lineId === nextProps.lineId && prevProps.date === nextProps.date && prevProps.shift === nextProps.shift && prevProps.line1Id === nextProps.line1Id && prevProps.line2Id === nextProps.line2Id && JSON.stringify(prevProps.lineNames) === JSON.stringify(nextProps.lineNames) && prevProps.className === nextProps.className;
+  return prevProps.lineId === nextProps.lineId && prevProps.date === nextProps.date && prevProps.shift === nextProps.shift && prevProps.line1Id === nextProps.line1Id && prevProps.line2Id === nextProps.line2Id && JSON.stringify(prevProps.lineNames) === JSON.stringify(nextProps.lineNames) && JSON.stringify(prevProps.userAccessibleLineIds) === JSON.stringify(nextProps.userAccessibleLineIds) && prevProps.className === nextProps.className;
 });
 LeaderboardDetailView.displayName = "LeaderboardDetailView";
 var LeaderboardDetailViewWithDisplayNames = withAllWorkspaceDisplayNames(LeaderboardDetailView);
@@ -66403,9 +66751,38 @@ var TeamManagementView = ({
     optifye: 0
   });
   const [isAddUserDialogOpen, setIsAddUserDialogOpen] = React26.useState(false);
+  const normalizeIds = React26.useCallback((value) => {
+    if (Array.isArray(value)) {
+      return value.filter((id3) => typeof id3 === "string" && id3.length > 0);
+    }
+    if (typeof value === "string" && value.length > 0) {
+      return [value];
+    }
+    return [];
+  }, []);
+  const plantHeadFactoryIds = React26.useMemo(() => {
+    if (user?.role_level !== "plant_head") return [];
+    const scopedFactoryIds = normalizeIds(user?.access_scope?.factory_ids);
+    if (scopedFactoryIds.length > 0) {
+      return Array.from(new Set(scopedFactoryIds));
+    }
+    const propertyFactoryIds = normalizeIds(
+      user?.properties?.factory_ids ?? user?.properties?.factory_id
+    );
+    if (propertyFactoryIds.length > 0) {
+      return Array.from(new Set(propertyFactoryIds));
+    }
+    return entityConfig?.factoryId ? [entityConfig.factoryId] : [];
+  }, [user, entityConfig?.factoryId, normalizeIds]);
+  const notifyScopeRefresh = React26.useCallback(() => {
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(new Event("rbac:refresh-scope"));
+    }
+  }, []);
   const canAddUsers = user?.role_level === "owner" || user?.role_level === "it" || user?.role_level === "plant_head" || user?.role_level === "optifye";
   const canViewUsageStats = user?.role_level === "owner" || user?.role_level === "it" || user?.role_level === "optifye";
-  const companyIdForUsage = entityConfig?.companyId || user?.properties?.company_id;
+  const pageCompanyId = entityConfig?.companyId || user?.properties?.company_id;
+  const companyIdForUsage = pageCompanyId;
   const usageDateRange = React26.useMemo(() => {
     const today = /* @__PURE__ */ new Date();
     const dayOfWeek = today.getDay();
@@ -66436,8 +66813,8 @@ var TeamManagementView = ({
       return acc;
     }, {});
   }, [usageData, usageDateRange.daysElapsed]);
-  const pageTitle = user?.role_level === "optifye" ? "Platform Users" : "Team Management";
-  const pageDescription = user?.role_level === "optifye" ? "Manage users across all companies" : user?.role_level === "owner" || user?.role_level === "it" ? "Manage team members and view their daily usage" : "Manage supervisors in your factory";
+  const pageTitle = "Team Management";
+  const pageDescription = user?.role_level === "owner" || user?.role_level === "it" || user?.role_level === "optifye" ? "Manage team members and view their daily usage" : "Manage supervisors in your factory";
   const hasAccess = user ? user.role_level === void 0 || ["optifye", "owner", "it", "plant_head"].includes(user.role_level) : false;
   const loadData = React26.useCallback(async () => {
     if (!supabase) {
@@ -66445,20 +66822,16 @@ var TeamManagementView = ({
       setIsLoading(false);
       return;
     }
-    const isOptifyeUser = user?.role_level === "optifye";
-    if (!isOptifyeUser) {
-      const companyId2 = entityConfig?.companyId || user?.properties?.company_id;
-      if (!companyId2) {
-        setError("Company not found. Please contact your administrator.");
-        setIsLoading(false);
-        return;
-      }
+    const companyId = pageCompanyId;
+    if (!companyId) {
+      setError("Company not found. Please contact your administrator.");
+      setIsLoading(false);
+      return;
     }
-    const companyId = entityConfig?.companyId || user?.properties?.company_id;
     console.log("[TeamManagementView] Loading data:", {
       role: user?.role_level,
-      isOptifye: isOptifyeUser,
-      companyId: isOptifyeUser ? "ALL" : companyId
+      isOptifye: user?.role_level === "optifye",
+      companyId
     });
     setIsLoading(true);
     setError(void 0);
@@ -66473,23 +66846,7 @@ var TeamManagementView = ({
       if (!backendUrl) {
         throw new Error("Backend URL is not configured. Please set NEXT_PUBLIC_BACKEND_URL in your environment.");
       }
-      if (isOptifyeUser) {
-        const { data: factories } = await supabase.from("factories").select("id, factory_name, company_id").order("factory_name");
-        const linesResponse = await fetch(`${backendUrl}/api/lines`, {
-          headers: {
-            "Authorization": `Bearer ${token}`,
-            "Content-Type": "application/json"
-          }
-        });
-        if (!linesResponse.ok) {
-          throw new Error(`Failed to fetch lines: ${linesResponse.statusText}`);
-        }
-        const linesData = await linesResponse.json();
-        const lines = linesData.lines || [];
-        setAvailableFactories(factories || []);
-        setAvailableLines(lines);
-        console.log("[TeamManagementView] Optifye - Loaded factories:", factories?.length, "lines:", lines?.length, "Sample lines:", lines?.slice(0, 3));
-      } else if ((user?.role_level === "owner" || user?.role_level === "it") && companyId) {
+      if ((user?.role_level === "optifye" || user?.role_level === "owner" || user?.role_level === "it") && companyId) {
         const { data: factories } = await supabase.from("factories").select("id, factory_name, company_id").eq("company_id", companyId).order("factory_name");
         const linesResponse = await fetch(`${backendUrl}/api/lines?company_id=${companyId}`, {
           headers: {
@@ -66504,9 +66861,8 @@ var TeamManagementView = ({
         const lines = linesData.lines || [];
         setAvailableFactories(factories || []);
         setAvailableLines(lines);
-        console.log("[TeamManagementView] Owner/IT - Company:", companyId, "Loaded factories:", factories?.length, "lines:", lines?.length);
+        console.log("[TeamManagementView] Company-scoped team view - Company:", companyId, "Loaded factories:", factories?.length, "lines:", lines?.length);
       } else if (user?.role_level === "plant_head") {
-        const plantHeadFactoryIds = user?.properties?.factory_ids || [];
         if (plantHeadFactoryIds.length > 0) {
           if (companyId) {
             const linesResponse = await fetch(`${backendUrl}/api/lines?company_id=${companyId}`, {
@@ -66559,35 +66915,46 @@ var TeamManagementView = ({
         setAvailableFactories([]);
         console.log("[TeamManagementView] Fallback - Company:", companyId, "Loaded lines:", lines?.length);
       }
-      if (isOptifyeUser) {
-        const [usersData, userStats] = await Promise.all([
-          userManagementService.getAllUsers(),
-          userManagementService.getAllUserStats()
-        ]);
-        setUsers(usersData);
-        setStats({
-          totalUsers: userStats.total,
-          owners: userStats.owners,
-          it: userStats.it,
-          plantHeads: userStats.plant_heads,
-          supervisors: userStats.supervisors,
-          optifye: userStats.optifye
-        });
-      } else {
-        const [usersData, userStats] = await Promise.all([
-          user?.role_level === "plant_head" && entityConfig?.factoryId ? userManagementService.getFactoryUsers(entityConfig.factoryId) : userManagementService.getCompanyUsers(companyId),
-          userManagementService.getUserStats(companyId)
-        ]);
-        setUsers(usersData);
-        setStats({
-          totalUsers: userStats.total,
-          owners: userStats.owners,
-          it: userStats.it,
-          plantHeads: userStats.plant_heads,
-          supervisors: userStats.supervisors,
-          optifye: 0
-        });
-      }
+      const usersPromise = user?.role_level === "plant_head" ? (async () => {
+        if (plantHeadFactoryIds.length === 0) {
+          return [];
+        }
+        const results = await Promise.allSettled(
+          plantHeadFactoryIds.map((factoryId) => userManagementService.getFactoryUsers(factoryId))
+        );
+        const successful = results.filter(
+          (result) => result.status === "fulfilled"
+        ).flatMap((result) => result.value || []);
+        if (successful.length > 0) {
+          const byUserId = /* @__PURE__ */ new Map();
+          successful.forEach((u) => {
+            if (u?.user_id) {
+              byUserId.set(u.user_id, u);
+            }
+          });
+          return Array.from(byUserId.values());
+        }
+        const firstRejected = results.find(
+          (result) => result.status === "rejected"
+        );
+        if (firstRejected) {
+          throw firstRejected.reason;
+        }
+        return [];
+      })() : userManagementService.getCompanyUsers(companyId);
+      const [usersData, userStats] = await Promise.all([
+        usersPromise,
+        userManagementService.getUserStats(companyId)
+      ]);
+      setUsers(usersData);
+      setStats({
+        totalUsers: userStats.total,
+        owners: userStats.owners,
+        it: userStats.it,
+        plantHeads: userStats.plant_heads,
+        supervisors: userStats.supervisors,
+        optifye: 0
+      });
     } catch (err) {
       console.error("Error loading team management data:", err);
       setError(err instanceof Error ? err.message : "Failed to load data");
@@ -66595,16 +66962,16 @@ var TeamManagementView = ({
     } finally {
       setIsLoading(false);
     }
-  }, [supabase, user, entityConfig]);
+  }, [supabase, user, pageCompanyId, entityConfig?.factoryId, plantHeadFactoryIds]);
   React26.useEffect(() => {
-    const companyId = entityConfig?.companyId || user?.properties?.company_id;
-    const canLoad = hasAccess && user && (user.role_level === "optifye" || !!companyId);
+    const companyId = pageCompanyId;
+    const canLoad = hasAccess && user && !!companyId;
     if (canLoad) {
       loadData();
     } else if (!user) {
       setIsLoading(true);
     }
-  }, [hasAccess, loadData, user, entityConfig?.companyId]);
+  }, [hasAccess, loadData, user, pageCompanyId]);
   const handleUserAdded = React26.useCallback(() => {
     loadData();
   }, [loadData]);
@@ -66618,12 +66985,13 @@ var TeamManagementView = ({
         updated_by: user.id
       });
       sonner.toast.success("User role updated successfully");
+      notifyScopeRefresh();
       loadData();
     } catch (err) {
       console.error("Error updating user role:", err);
       sonner.toast.error("Failed to update user role");
     }
-  }, [supabase, user, loadData]);
+  }, [supabase, user, loadData, notifyScopeRefresh]);
   const handleRemoveUser = React26.useCallback(async (userId) => {
     if (!supabase || !user) return;
     try {
@@ -66646,12 +67014,13 @@ var TeamManagementView = ({
         assigned_by: user.id
       });
       sonner.toast.success("Line assignments updated successfully");
+      notifyScopeRefresh();
       loadData();
     } catch (err) {
       console.error("Error updating line assignments:", err);
       sonner.toast.error("Failed to update line assignments");
     }
-  }, [supabase, user, loadData]);
+  }, [supabase, user, loadData, notifyScopeRefresh]);
   const handleFactoryAssignmentUpdate = React26.useCallback(async (userId, factoryIds) => {
     if (!supabase || !user) return;
     try {
@@ -66662,12 +67031,13 @@ var TeamManagementView = ({
         assigned_by: user.id
       });
       sonner.toast.success("Factory assignments updated successfully");
+      notifyScopeRefresh();
       loadData();
     } catch (err) {
       console.error("Error updating factory assignments:", err);
       sonner.toast.error("Failed to update factory assignments");
     }
-  }, [supabase, user, loadData]);
+  }, [supabase, user, loadData, notifyScopeRefresh]);
   const handleProfileUpdate = React26.useCallback(async (userId, firstName, lastName, profilePhotoUrl) => {
     if (!supabase || !user) return;
     try {