@permitio/permit-strapi 1.0.0

package/dist/admin/App-DGsvV3Vz.mjs

@@ -0,0 +1,1027 @@
+import { jsxs, jsx, Fragment } from "react/jsx-runtime";
+import { useState, useEffect } from "react";
+import { useFetchClient, useNotification, Page } from "@strapi/strapi/admin";
+import { Routes, Route } from "react-router-dom";
+import { Box, Flex, Typography, Status, Divider, Modal, Button, Field, TextInput, Checkbox, Accordion } from "@strapi/design-system";
+import { ExternalLink, Pencil, Information, Cross, Check, Trash, Plus } from "@strapi/icons";
+import styled from "styled-components";
+import { l as logo } from "./index-CUo5x9bE.mjs";
+const Logo$1 = styled.img`
+  width: 40px;
+  height: 40px;
+  border-radius: 6px;
+`;
+const SegButton = styled.button`
+  padding: 6px 16px;
+  font-size: 11px;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+  border: none;
+  cursor: pointer;
+  transition:
+    background 0.15s,
+    color 0.15s;
+  background: ${({ $active, $variant }) => $active ? $variant === "success" ? "#c6f0c2" : "#fce4e4" : "transparent"};
+  color: ${({ $active, $variant }) => $active ? $variant === "success" ? "#2f6846" : "#b72b1a" : "#8e8ea9"};
+  &:not(:last-child) {
+    border-right: 1px solid #dcdce4;
+  }
+  &:hover {
+    background: ${({ $active, $variant }) => $active ? $variant === "success" ? "#c6f0c2" : "#fce4e4" : "#f6f6f9"};
+  }
+`;
+const TextLink = styled.a`
+  color: inherit;
+  text-decoration: underline;
+  &:hover {
+    opacity: 0.8;
+  }
+`;
+const DEFAULT_PDP_URL$1 = "https://cloudpdp.api.permit.io";
+const HomePage = ({ onDisconnect }) => {
+  const [config, setConfig] = useState(null);
+  const [contentTypes, setContentTypes] = useState([]);
+  const [protectedTypes, setProtectedTypes] = useState({});
+  const [savingResources, setSavingResources] = useState(false);
+  const [syncingUsers, setSyncingUsers] = useState(false);
+  const [syncResult, setSyncResult] = useState(null);
+  const [updateApiKey, setUpdateApiKey] = useState("");
+  const [updatePdpUrl, setUpdatePdpUrl] = useState("");
+  const [updateLoading, setUpdateLoading] = useState(false);
+  const [disconnectLoading, setDisconnectLoading] = useState(false);
+  const [disconnectConfirmed, setDisconnectConfirmed] = useState(false);
+  const [rebacConfig, setRebacConfig] = useState({});
+  const [instanceRoles, setInstanceRoles] = useState({});
+  const [savingRebac, setSavingRebac] = useState(false);
+  const [savingInstanceRoles, setSavingInstanceRoles] = useState({});
+  const [syncingInstances, setSyncingInstances] = useState({});
+  const [instanceSyncResults, setInstanceSyncResults] = useState({});
+  const [userFields, setUserFields] = useState([]);
+  const [userAttrMappings, setUserAttrMappings] = useState([]);
+  const [savingUserAttrs, setSavingUserAttrs] = useState(false);
+  const [resourceFieldsMap, setResourceFieldsMap] = useState({});
+  const [resourceAttrMappings, setResourceAttrMappings] = useState({});
+  const [savingResourceAttrs, setSavingResourceAttrs] = useState(false);
+  const { get, post, del } = useFetchClient();
+  const { toggleNotification } = useNotification();
+  useEffect(() => {
+    fetchConfig();
+    fetchContentTypes();
+    fetchAttributeMappings();
+    fetchRebacConfig();
+  }, []);
+  const fetchConfig = async () => {
+    try {
+      const { data } = await get("/permit-strapi/config");
+      setConfig(data);
+      setUpdatePdpUrl(data.pdpUrl);
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to load configuration" });
+    }
+  };
+  const fetchContentTypes = async () => {
+    try {
+      const [{ data: ctData }, { data: exData }] = await Promise.all([
+        get("/permit-strapi/content-types"),
+        get("/permit-strapi/excluded-resources")
+      ]);
+      setContentTypes(ctData.contentTypes);
+      console.log("[permit-strapi] content types fetched:", ctData.contentTypes);
+      const initial = {};
+      ctData.contentTypes.forEach((ct) => {
+        initial[ct.uid] = !exData.excludedResources.includes(ct.uid);
+      });
+      setProtectedTypes(initial);
+      for (const ct of ctData.contentTypes) {
+        fetchContentTypeFields(ct.uid);
+      }
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to load content types" });
+    }
+  };
+  const fetchContentTypeFields = async (uid) => {
+    try {
+      const encodedUid = encodeURIComponent(uid);
+      const { data } = await get(`/permit-strapi/content-type-fields/${encodedUid}`);
+      setResourceFieldsMap((prev) => ({ ...prev, [uid]: data.fields }));
+    } catch {
+    }
+  };
+  const fetchAttributeMappings = async () => {
+    try {
+      const [{ data: userFieldsData }, { data: userMappingsData }, { data: resourceMappingsData }] = await Promise.all([
+        get("/permit-strapi/user-fields"),
+        get("/permit-strapi/user-attribute-mappings"),
+        get("/permit-strapi/resource-attribute-mappings")
+      ]);
+      setUserFields(userFieldsData.fields);
+      setUserAttrMappings(userMappingsData.mappings);
+      setResourceAttrMappings(resourceMappingsData.mappings);
+    } catch {
+    }
+  };
+  const handleUpdateConfig = async () => {
+    if (!updateApiKey.trim()) return;
+    setUpdateLoading(true);
+    try {
+      await post("/permit-strapi/config", {
+        apiKey: updateApiKey.trim(),
+        pdpUrl: updatePdpUrl.trim() || DEFAULT_PDP_URL$1
+      });
+      toggleNotification({ type: "success", message: "Configuration updated successfully" });
+      fetchConfig();
+      setUpdateApiKey("");
+    } catch (error) {
+      const message = error?.response?.data?.error?.message || "Failed to update configuration";
+      toggleNotification({ type: "danger", message });
+    } finally {
+      setUpdateLoading(false);
+    }
+  };
+  const handleDisconnect = async () => {
+    setDisconnectLoading(true);
+    try {
+      await del("/permit-strapi/config");
+      toggleNotification({ type: "success", message: "Disconnected from Permit.io" });
+      setDisconnectConfirmed(false);
+      onDisconnect();
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to disconnect" });
+    } finally {
+      setDisconnectLoading(false);
+    }
+  };
+  const handleSyncAllUsers = async () => {
+    setSyncingUsers(true);
+    setSyncResult(null);
+    try {
+      const { data } = await post("/permit-strapi/sync-users", {});
+      setSyncResult(data);
+      toggleNotification({
+        type: "success",
+        message: `Synced ${data.synced} of ${data.total} users`
+      });
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to sync users" });
+    } finally {
+      setSyncingUsers(false);
+    }
+  };
+  const toggleProtection = (uid) => {
+    setProtectedTypes((prev) => ({ ...prev, [uid]: !prev[uid] }));
+  };
+  const handleSaveResources = async () => {
+    setSavingResources(true);
+    try {
+      const excludedResources = Object.entries(protectedTypes).filter(([, isProtected]) => !isProtected).map(([uid]) => uid);
+      await post("/permit-strapi/excluded-resources", { excludedResources });
+      toggleNotification({ type: "success", message: "Protected resources saved successfully" });
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to save protected resources" });
+    } finally {
+      setSavingResources(false);
+    }
+  };
+  const toggleUserAttribute = (fieldName) => {
+    setUserAttrMappings(
+      (prev) => prev.includes(fieldName) ? prev.filter((f) => f !== fieldName) : [...prev, fieldName]
+    );
+  };
+  const handleSaveUserAttributes = async () => {
+    setSavingUserAttrs(true);
+    try {
+      await post("/permit-strapi/user-attribute-mappings", { mappings: userAttrMappings });
+      toggleNotification({
+        type: "success",
+        message: "User attribute mappings saved. Resources re-synced."
+      });
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to save user attribute mappings" });
+    } finally {
+      setSavingUserAttrs(false);
+    }
+  };
+  const toggleResourceAttribute = (uid, fieldName) => {
+    setResourceAttrMappings((prev) => {
+      const current = prev[uid] || [];
+      const updated = current.includes(fieldName) ? current.filter((f) => f !== fieldName) : [...current, fieldName];
+      return { ...prev, [uid]: updated };
+    });
+  };
+  const handleSaveResourceAttributes = async () => {
+    setSavingResourceAttrs(true);
+    try {
+      await post("/permit-strapi/resource-attribute-mappings", { mappings: resourceAttrMappings });
+      toggleNotification({
+        type: "success",
+        message: "Resource attribute mappings saved. Resources re-synced."
+      });
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to save resource attribute mappings" });
+    } finally {
+      setSavingResourceAttrs(false);
+    }
+  };
+  const fetchRebacConfig = async () => {
+    try {
+      const { data } = await get("/permit-strapi/rebac-config");
+      setRebacConfig(data.config || {});
+    } catch {
+    }
+  };
+  const fetchInstanceRoles = async (uid) => {
+    try {
+      const encodedUid = encodeURIComponent(uid);
+      const { data } = await get(`/permit-strapi/instance-roles/${encodedUid}`);
+      setInstanceRoles((prev) => ({ ...prev, [uid]: data.roles || [] }));
+    } catch {
+    }
+  };
+  const toggleRebacEnabled = (uid) => {
+    setRebacConfig((prev) => {
+      const current = prev[uid] || { enabled: false, creatorRole: "owner" };
+      const updated = { ...current, enabled: !current.enabled };
+      if (updated.enabled && !instanceRoles[uid]) {
+        fetchInstanceRoles(uid);
+      }
+      return { ...prev, [uid]: updated };
+    });
+  };
+  const updateCreatorRole = (uid, value) => {
+    setRebacConfig((prev) => ({
+      ...prev,
+      [uid]: { ...prev[uid] || { enabled: false, creatorRole: "owner" }, creatorRole: value }
+    }));
+  };
+  const handleSaveRebacConfig = async () => {
+    setSavingRebac(true);
+    try {
+      await post("/permit-strapi/rebac-config", { config: rebacConfig });
+      toggleNotification({ type: "success", message: "ReBAC configuration saved" });
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to save ReBAC configuration" });
+    } finally {
+      setSavingRebac(false);
+    }
+  };
+  const addInstanceRole = (uid) => {
+    setInstanceRoles((prev) => ({
+      ...prev,
+      [uid]: [...prev[uid] || [], { key: "", name: "" }]
+    }));
+  };
+  const updateInstanceRole = (uid, index, field, value) => {
+    setInstanceRoles((prev) => {
+      const roles = [...prev[uid] || []];
+      roles[index] = { ...roles[index], [field]: value };
+      return { ...prev, [uid]: roles };
+    });
+  };
+  const removeInstanceRole = (uid, index) => {
+    setInstanceRoles((prev) => {
+      const roles = [...prev[uid] || []];
+      roles.splice(index, 1);
+      return { ...prev, [uid]: roles };
+    });
+  };
+  const handleSaveInstanceRoles = async (uid) => {
+    setSavingInstanceRoles((prev) => ({ ...prev, [uid]: true }));
+    try {
+      const encodedUid = encodeURIComponent(uid);
+      const roles = instanceRoles[uid] || [];
+      await post(`/permit-strapi/instance-roles/${encodedUid}`, { roles });
+      toggleNotification({
+        type: "success",
+        message: "Instance roles saved and synced to Permit.io"
+      });
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to save instance roles" });
+    } finally {
+      setSavingInstanceRoles((prev) => ({ ...prev, [uid]: false }));
+    }
+  };
+  const handleSyncInstances = async (uid) => {
+    setSyncingInstances((prev) => ({ ...prev, [uid]: true }));
+    try {
+      const encodedUid = encodeURIComponent(uid);
+      const { data } = await post(`/permit-strapi/sync-instances/${encodedUid}`, {});
+      setInstanceSyncResults((prev) => ({ ...prev, [uid]: data }));
+      toggleNotification({
+        type: "success",
+        message: `Synced ${data.synced} of ${data.total} instances`
+      });
+    } catch {
+      toggleNotification({ type: "danger", message: "Failed to sync instances" });
+    } finally {
+      setSyncingInstances((prev) => ({ ...prev, [uid]: false }));
+    }
+  };
+  const protectedContentTypes = contentTypes.filter((ct) => protectedTypes[ct.uid] !== false);
+  return /* @__PURE__ */ jsxs(Box, { padding: 10, children: [
+    /* @__PURE__ */ jsxs(Box, { background: "neutral0", shadow: "tableShadow", hasRadius: true, padding: 6, marginBottom: 6, children: [
+      /* @__PURE__ */ jsxs(Flex, { justifyContent: "space-between", alignItems: "center", paddingBottom: 4, children: [
+        /* @__PURE__ */ jsxs(Flex, { gap: 3, alignItems: "center", children: [
+          /* @__PURE__ */ jsx(Logo$1, { src: logo, alt: "Permit.io" }),
+          /* @__PURE__ */ jsx(Typography, { variant: "delta", children: "Permit.io" })
+        ] }),
+        /* @__PURE__ */ jsx(Status, { variant: "success", size: "S", children: /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "success700", children: "Connected" }) })
+      ] }),
+      /* @__PURE__ */ jsx(Divider, {}),
+      /* @__PURE__ */ jsxs(Flex, { justifyContent: "space-between", alignItems: "center", paddingTop: 4, children: [
+        /* @__PURE__ */ jsxs(Flex, { gap: 8, children: [
+          /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, children: [
+            /* @__PURE__ */ jsx(
+              Typography,
+              {
+                variant: "sigma",
+                textColor: "neutral500",
+                style: { textTransform: "uppercase", letterSpacing: "0.08em", fontSize: "10px" },
+                children: "API KEY"
+              }
+            ),
+            /* @__PURE__ */ jsx(Typography, { variant: "omega", children: config?.apiKey })
+          ] }),
+          /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, children: [
+            /* @__PURE__ */ jsx(
+              Typography,
+              {
+                variant: "sigma",
+                textColor: "neutral500",
+                style: { textTransform: "uppercase", letterSpacing: "0.08em", fontSize: "10px" },
+                children: "PDP URL"
+              }
+            ),
+            /* @__PURE__ */ jsxs(Flex, { gap: 1, alignItems: "center", style: { lineHeight: 1 }, children: [
+              /* @__PURE__ */ jsx(Typography, { variant: "omega", style: { lineHeight: 1 }, children: config?.pdpUrl }),
+              /* @__PURE__ */ jsx(
+                "a",
+                {
+                  href: "https://docs.permit.io",
+                  target: "_blank",
+                  rel: "noreferrer",
+                  style: { display: "flex", alignItems: "center" },
+                  children: /* @__PURE__ */ jsx(ExternalLink, { width: "11px", height: "11px", fill: "neutral400" })
+                }
+              )
+            ] })
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxs(Flex, { gap: 2, children: [
+          /* @__PURE__ */ jsxs(Modal.Root, { children: [
+            /* @__PURE__ */ jsx(Modal.Trigger, { children: /* @__PURE__ */ jsx(Button, { variant: "secondary", startIcon: /* @__PURE__ */ jsx(Pencil, {}), size: "S", children: "Update Config" }) }),
+            /* @__PURE__ */ jsxs(Modal.Content, { children: [
+              /* @__PURE__ */ jsx(Modal.Header, { children: /* @__PURE__ */ jsx(Modal.Title, { children: "Update Configuration" }) }),
+              /* @__PURE__ */ jsx(Modal.Body, { children: /* @__PURE__ */ jsx(Box, { padding: 2, children: /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 4, children: [
+                /* @__PURE__ */ jsxs(
+                  Field.Root,
+                  {
+                    name: "updateApiKey",
+                    width: "100%",
+                    hint: "Enter a new Permit.io API key to replace the current one",
+                    children: [
+                      /* @__PURE__ */ jsx(Field.Label, { children: "New API Key" }),
+                      /* @__PURE__ */ jsx(Field.Hint, {}),
+                      /* @__PURE__ */ jsx(
+                        TextInput,
+                        {
+                          placeholder: "permit_key_...",
+                          value: updateApiKey,
+                          onChange: (e) => setUpdateApiKey(e.target.value),
+                          type: "password"
+                        }
+                      )
+                    ]
+                  }
+                ),
+                /* @__PURE__ */ jsxs(Field.Root, { name: "updatePdpUrl", width: "100%", children: [
+                  /* @__PURE__ */ jsx(Field.Label, { children: "PDP UR" }),
+                  /* @__PURE__ */ jsx(
+                    TextInput,
+                    {
+                      value: updatePdpUrl,
+                      onChange: (e) => setUpdatePdpUrl(e.target.value)
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxs(
+                  Flex,
+                  {
+                    gap: 2,
+                    alignItems: "flex-start",
+                    padding: 3,
+                    style: { background: "#f0f4ff", borderRadius: "4px" },
+                    children: [
+                      /* @__PURE__ */ jsx(
+                        Information,
+                        {
+                          width: "14px",
+                          height: "14px",
+                          fill: "primary600",
+                          style: { flexShrink: 0, marginTop: "2px" }
+                        }
+                      ),
+                      /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "primary600", children: [
+                        "The Cloud PDP supports ",
+                        /* @__PURE__ */ jsx("strong", { children: "RBAC only" }),
+                        ". For ABAC or ReBAC policies, use a",
+                        " ",
+                        /* @__PURE__ */ jsx(
+                          TextLink,
+                          {
+                            href: "https://docs.permit.io/how-to/deploy/deploy-to-production",
+                            target: "_blank",
+                            rel: "noreferrer",
+                            children: "self-hosted PDP"
+                          }
+                        ),
+                        "."
+                      ] })
+                    ]
+                  }
+                )
+              ] }) }) }),
+              /* @__PURE__ */ jsxs(Modal.Footer, { children: [
+                /* @__PURE__ */ jsx(Modal.Close, { children: /* @__PURE__ */ jsx(Button, { variant: "tertiary", startIcon: /* @__PURE__ */ jsx(Cross, {}), children: "Cancel" }) }),
+                /* @__PURE__ */ jsx(
+                  Button,
+                  {
+                    startIcon: /* @__PURE__ */ jsx(Check, {}),
+                    onClick: handleUpdateConfig,
+                    loading: updateLoading,
+                    disabled: !updateApiKey.trim() || updateLoading,
+                    children: "Save Changes"
+                  }
+                )
+              ] })
+            ] })
+          ] }),
+          /* @__PURE__ */ jsxs(Modal.Root, { children: [
+            /* @__PURE__ */ jsx(Modal.Trigger, { children: /* @__PURE__ */ jsx(Button, { variant: "danger-light", startIcon: /* @__PURE__ */ jsx(Trash, {}), size: "S", children: "Disconnect" }) }),
+            /* @__PURE__ */ jsxs(Modal.Content, { children: [
+              /* @__PURE__ */ jsx(Modal.Header, { children: /* @__PURE__ */ jsx(Modal.Title, { children: "Disconnect from Permit.io" }) }),
+              /* @__PURE__ */ jsx(Modal.Body, { children: /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 4, children: [
+                /* @__PURE__ */ jsx(Typography, { variant: "omega", children: "Are you sure you want to disconnect from Permit.io?" }),
+                /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "danger600", children: "All API requests will immediately stop being checked for authorization. Your content types will be unprotected until you reconnect." }),
+                /* @__PURE__ */ jsx(
+                  Checkbox,
+                  {
+                    checked: disconnectConfirmed,
+                    onCheckedChange: (val) => setDisconnectConfirmed(val),
+                    children: "I understand the consequences of disconnecting"
+                  }
+                )
+              ] }) }),
+              /* @__PURE__ */ jsxs(Modal.Footer, { children: [
+                /* @__PURE__ */ jsx(Modal.Close, { children: /* @__PURE__ */ jsx(Button, { variant: "tertiary", startIcon: /* @__PURE__ */ jsx(Cross, {}), children: "Cancel" }) }),
+                /* @__PURE__ */ jsx(
+                  Button,
+                  {
+                    variant: "danger",
+                    startIcon: /* @__PURE__ */ jsx(Trash, {}),
+                    onClick: handleDisconnect,
+                    loading: disconnectLoading,
+                    disabled: !disconnectConfirmed || disconnectLoading,
+                    children: "Yes, Disconnect"
+                  }
+                )
+              ] })
+            ] })
+          ] })
+        ] })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx(Box, { background: "neutral0", shadow: "tableShadow", hasRadius: true, padding: 6, marginBottom: 6, children: /* @__PURE__ */ jsxs(Flex, { justifyContent: "space-between", alignItems: "center", width: "100%", children: [
+      /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, alignItems: "flex-start", children: [
+        /* @__PURE__ */ jsx(Typography, { variant: "delta", children: "User Sync" }),
+        /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", children: "Sync all existing Strapi users to Permit.io. New users are synced automatically on registration." }),
+        syncResult && /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "neutral500", children: [
+          "Last sync: ",
+          syncResult.synced,
+          " synced, ",
+          syncResult.failed,
+          " failed (total:",
+          " ",
+          syncResult.total,
+          ")"
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx(Button, { variant: "secondary", size: "S", onClick: handleSyncAllUsers, loading: syncingUsers, children: "Sync All Users" })
+    ] }) }),
+    /* @__PURE__ */ jsxs(Box, { background: "neutral0", shadow: "tableShadow", hasRadius: true, padding: 6, marginBottom: 6, children: [
+      /* @__PURE__ */ jsxs(Flex, { justifyContent: "space-between", alignItems: "center", paddingBottom: 4, width: "100%", children: [
+        /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, alignItems: "flex-start", children: [
+          /* @__PURE__ */ jsx(Typography, { variant: "delta", children: "Protected Resources" }),
+          /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", children: "Toggle which content types are protected by Permit.io authorization" })
+        ] }),
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            startIcon: /* @__PURE__ */ jsx(Check, {}),
+            size: "S",
+            onClick: handleSaveResources,
+            loading: savingResources,
+            children: "Save"
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsx(Divider, {}),
+      contentTypes.length === 0 ? /* @__PURE__ */ jsx(Box, { paddingTop: 6, children: /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral500", children: "No content types found. Create a collection type in the Content-Type Builder first." }) }) : /* @__PURE__ */ jsx(Flex, { direction: "column", gap: 0, paddingTop: 2, width: "100%", children: contentTypes.map((ct, index) => {
+        const isProtected = protectedTypes[ct.uid] ?? true;
+        return /* @__PURE__ */ jsxs(Box, { width: "100%", children: [
+          /* @__PURE__ */ jsxs(Flex, { alignItems: "center", padding: 4, style: { width: "100%" }, children: [
+            /* @__PURE__ */ jsx(Box, { flex: 1, children: /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: ct.displayName }) }),
+            /* @__PURE__ */ jsxs(
+              Flex,
+              {
+                style: {
+                  border: "1px solid #dcdce4",
+                  borderRadius: "4px",
+                  overflow: "hidden"
+                },
+                children: [
+                  /* @__PURE__ */ jsx(
+                    SegButton,
+                    {
+                      $active: !isProtected,
+                      $variant: "danger",
+                      onClick: () => isProtected && toggleProtection(ct.uid),
+                      children: "Unprotected"
+                    }
+                  ),
+                  /* @__PURE__ */ jsx(
+                    SegButton,
+                    {
+                      $active: isProtected,
+                      $variant: "success",
+                      onClick: () => !isProtected && toggleProtection(ct.uid),
+                      children: "Protected"
+                    }
+                  )
+                ]
+              }
+            )
+          ] }),
+          index < contentTypes.length - 1 && /* @__PURE__ */ jsx(Divider, {})
+        ] }, ct.uid);
+      }) })
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { background: "neutral0", shadow: "tableShadow", hasRadius: true, padding: 6, children: [
+      /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, paddingBottom: 4, alignItems: "flex-start", children: [
+        /* @__PURE__ */ jsx(Typography, { variant: "delta", children: "ABAC Attribute Mapping" }),
+        /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", children: "Select which fields to pass as attributes for Attribute-Based Access Control. Requires a self-hosted PDP." })
+      ] }),
+      /* @__PURE__ */ jsxs(Accordion.Root, { children: [
+        /* @__PURE__ */ jsxs(Accordion.Item, { value: "user-attributes", children: [
+          /* @__PURE__ */ jsx(Accordion.Header, { children: /* @__PURE__ */ jsx(Accordion.Trigger, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: "User Attributes" }) }) }),
+          /* @__PURE__ */ jsx(Accordion.Content, { children: /* @__PURE__ */ jsx(Box, { padding: 4, children: userFields.length === 0 ? /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral500", children: "No custom user fields found. Add fields to the User content type to use as ABAC attributes." }) : /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 3, alignItems: "flex-start", children: [
+            /* @__PURE__ */ jsx(Flex, { gap: 4, wrap: "wrap", children: userFields.map((field) => /* @__PURE__ */ jsx(
+              Checkbox,
+              {
+                checked: userAttrMappings.includes(field.name),
+                onCheckedChange: () => toggleUserAttribute(field.name),
+                children: /* @__PURE__ */ jsxs(Flex, { gap: 1, alignItems: "center", children: [
+                  /* @__PURE__ */ jsx(Typography, { variant: "omega", children: field.name }),
+                  /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "neutral400", children: [
+                    "(",
+                    field.type,
+                    ")"
+                  ] })
+                ] })
+              },
+              field.name
+            )) }),
+            /* @__PURE__ */ jsx(
+              Button,
+              {
+                startIcon: /* @__PURE__ */ jsx(Check, {}),
+                size: "S",
+                onClick: handleSaveUserAttributes,
+                loading: savingUserAttrs,
+                variant: "secondary",
+                children: "Save User Attributes"
+              }
+            )
+          ] }) }) })
+        ] }),
+        /* @__PURE__ */ jsxs(Accordion.Item, { value: "resource-attributes", children: [
+          /* @__PURE__ */ jsx(Accordion.Header, { children: /* @__PURE__ */ jsx(Accordion.Trigger, { children: /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: "Resource Attributes" }) }) }),
+          /* @__PURE__ */ jsx(Accordion.Content, { children: /* @__PURE__ */ jsx(Box, { padding: 4, children: protectedContentTypes.length === 0 ? /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral500", children: "No protected content types. Enable protection for a content type above to configure resource attributes." }) : /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 4, alignItems: "flex-start", children: [
+            protectedContentTypes.map((ct) => {
+              const fields = resourceFieldsMap[ct.uid] || [];
+              const selected = resourceAttrMappings[ct.uid] || [];
+              return /* @__PURE__ */ jsxs(Box, { children: [
+                /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: ct.displayName }),
+                /* @__PURE__ */ jsx(Box, { paddingTop: 2 }),
+                fields.length === 0 ? /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral400", children: "No mappable fields" }) : /* @__PURE__ */ jsx(Flex, { gap: 4, wrap: "wrap", paddingLeft: 2, children: fields.map((field) => /* @__PURE__ */ jsx(
+                  Checkbox,
+                  {
+                    checked: selected.includes(field.name),
+                    onCheckedChange: () => toggleResourceAttribute(ct.uid, field.name),
+                    children: /* @__PURE__ */ jsxs(Flex, { gap: 1, alignItems: "center", children: [
+                      /* @__PURE__ */ jsx(Typography, { variant: "omega", children: field.name }),
+                      /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "neutral400", children: [
+                        "(",
+                        field.type,
+                        ")"
+                      ] })
+                    ] })
+                  },
+                  field.name
+                )) })
+              ] }, ct.uid);
+            }),
+            /* @__PURE__ */ jsx(
+              Button,
+              {
+                startIcon: /* @__PURE__ */ jsx(Check, {}),
+                size: "S",
+                onClick: handleSaveResourceAttributes,
+                loading: savingResourceAttrs,
+                variant: "secondary",
+                children: "Save Resource Attributes"
+              }
+            )
+          ] }) }) })
+        ] })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { background: "neutral0", shadow: "tableShadow", hasRadius: true, padding: 6, marginTop: 6, children: [
+      /* @__PURE__ */ jsxs(Flex, { justifyContent: "space-between", alignItems: "center", paddingBottom: 4, width: "100%", children: [
+        /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, alignItems: "flex-start", children: [
+          /* @__PURE__ */ jsx(Typography, { variant: "delta", children: "ReBAC Configuration" }),
+          /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", children: "Enable Relationship-Based Access Control per content type. Requires a self-hosted PDP." })
+        ] }),
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            startIcon: /* @__PURE__ */ jsx(Check, {}),
+            size: "S",
+            onClick: handleSaveRebacConfig,
+            loading: savingRebac,
+            children: "Save"
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsx(Divider, {}),
+      protectedContentTypes.length === 0 ? /* @__PURE__ */ jsx(Box, { paddingTop: 6, children: /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral500", children: "No protected content types. Enable protection above first." }) }) : /* @__PURE__ */ jsx(Accordion.Root, { children: protectedContentTypes.map((ct) => {
+        const ctRebac = rebacConfig[ct.uid] || { enabled: false, creatorRole: "owner" };
+        const roles = instanceRoles[ct.uid] || [];
+        const syncResult2 = instanceSyncResults[ct.uid];
+        return /* @__PURE__ */ jsxs(Accordion.Item, { value: ct.uid, children: [
+          /* @__PURE__ */ jsx(Accordion.Header, { children: /* @__PURE__ */ jsx(Accordion.Trigger, { children: /* @__PURE__ */ jsxs(Flex, { gap: 3, alignItems: "center", children: [
+            /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: ct.displayName }),
+            ctRebac.enabled && /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "success600", children: "(ReBAC enabled)" })
+          ] }) }) }),
+          /* @__PURE__ */ jsx(Accordion.Content, { children: /* @__PURE__ */ jsx(Box, { padding: 4, children: /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 5, alignItems: "flex-start", children: [
+            /* @__PURE__ */ jsxs(Flex, { alignItems: "center", gap: 3, children: [
+              /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: "ReBAC Mode" }),
+              /* @__PURE__ */ jsxs(
+                Flex,
+                {
+                  style: {
+                    border: "1px solid #dcdce4",
+                    borderRadius: "4px",
+                    overflow: "hidden"
+                  },
+                  children: [
+                    /* @__PURE__ */ jsx(
+                      SegButton,
+                      {
+                        $active: !ctRebac.enabled,
+                        $variant: "danger",
+                        onClick: () => ctRebac.enabled && toggleRebacEnabled(ct.uid),
+                        children: "Disabled"
+                      }
+                    ),
+                    /* @__PURE__ */ jsx(
+                      SegButton,
+                      {
+                        $active: ctRebac.enabled,
+                        $variant: "success",
+                        onClick: () => !ctRebac.enabled && toggleRebacEnabled(ct.uid),
+                        children: "Enabled"
+                      }
+                    )
+                  ]
+                }
+              )
+            ] }),
+            ctRebac.enabled && /* @__PURE__ */ jsxs(Fragment, { children: [
+              /* @__PURE__ */ jsxs(
+                Field.Root,
+                {
+                  name: `creator-role-${ct.uid}`,
+                  width: "300px",
+                  hint: "Role assigned to the user who creates a record",
+                  children: [
+                    /* @__PURE__ */ jsx(Field.Label, { children: "Creator Role" }),
+                    /* @__PURE__ */ jsx(Field.Hint, {}),
+                    /* @__PURE__ */ jsx(
+                      TextInput,
+                      {
+                        placeholder: "owner",
+                        value: ctRebac.creatorRole,
+                        onChange: (e) => updateCreatorRole(ct.uid, e.target.value)
+                      }
+                    )
+                  ]
+                }
+              ),
+              /* @__PURE__ */ jsx(Divider, {}),
+              /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 3, alignItems: "flex-start", width: "100%", children: [
+                /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: "Instance Roles" }),
+                /* @__PURE__ */ jsx(Typography, { variant: "pi", textColor: "neutral500", children: "Define roles that can be assigned to users on specific records (e.g. owner, editor, viewer)" }),
+                roles.length > 0 && /* @__PURE__ */ jsx(Flex, { direction: "column", gap: 2, width: "100%", children: roles.map((role, index) => /* @__PURE__ */ jsxs(Flex, { gap: 2, alignItems: "center", width: "100%", children: [
+                  /* @__PURE__ */ jsx(Box, { flex: 1, children: /* @__PURE__ */ jsx(
+                    TextInput,
+                    {
+                      placeholder: "key (e.g. owner)",
+                      value: role.key,
+                      onChange: (e) => updateInstanceRole(ct.uid, index, "key", e.target.value),
+                      "aria-label": "Role key"
+                    }
+                  ) }),
+                  /* @__PURE__ */ jsx(Box, { flex: 1, children: /* @__PURE__ */ jsx(
+                    TextInput,
+                    {
+                      placeholder: "name (e.g. Owner)",
+                      value: role.name,
+                      onChange: (e) => updateInstanceRole(
+                        ct.uid,
+                        index,
+                        "name",
+                        e.target.value
+                      ),
+                      "aria-label": "Role name"
+                    }
+                  ) }),
+                  /* @__PURE__ */ jsx(
+                    Button,
+                    {
+                      variant: "danger-light",
+                      size: "S",
+                      onClick: () => removeInstanceRole(ct.uid, index),
+                      startIcon: /* @__PURE__ */ jsx(Trash, {}),
+                      children: "Remove"
+                    }
+                  )
+                ] }, index)) }),
+                /* @__PURE__ */ jsxs(Flex, { gap: 2, children: [
+                  /* @__PURE__ */ jsx(
+                    Button,
+                    {
+                      variant: "secondary",
+                      size: "S",
+                      startIcon: /* @__PURE__ */ jsx(Plus, {}),
+                      onClick: () => addInstanceRole(ct.uid),
+                      children: "Add Role"
+                    }
+                  ),
+                  /* @__PURE__ */ jsx(
+                    Button,
+                    {
+                      startIcon: /* @__PURE__ */ jsx(Check, {}),
+                      size: "S",
+                      onClick: () => handleSaveInstanceRoles(ct.uid),
+                      loading: savingInstanceRoles[ct.uid],
+                      disabled: roles.length === 0,
+                      children: "Save Roles"
+                    }
+                  )
+                ] })
+              ] }),
+              /* @__PURE__ */ jsx(Divider, {}),
+              /* @__PURE__ */ jsxs(Flex, { justifyContent: "space-between", alignItems: "center", width: "100%", children: [
+                /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, alignItems: "flex-start", children: [
+                  /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: "Sync Instances" }),
+                  /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "neutral500", children: [
+                    "Bulk sync all existing ",
+                    ct.displayName,
+                    " records to Permit.io as resource instances"
+                  ] }),
+                  syncResult2 && /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "neutral400", children: [
+                    "Last sync: ",
+                    syncResult2.synced,
+                    " synced, ",
+                    syncResult2.failed,
+                    " ",
+                    "failed (total: ",
+                    syncResult2.total,
+                    ")"
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsx(
+                  Button,
+                  {
+                    variant: "secondary",
+                    size: "S",
+                    onClick: () => handleSyncInstances(ct.uid),
+                    loading: syncingInstances[ct.uid],
+                    children: "Sync Instances"
+                  }
+                )
+              ] })
+            ] })
+          ] }) }) })
+        ] }, ct.uid);
+      }) })
+    ] })
+  ] });
+};
+const Logo = styled.img`
+  width: 48px;
+  height: 48px;
+  border-radius: 8px;
+`;
+const StepLink = styled.a`
+  color: ${({ theme }) => theme.colors.primary600};
+  font-size: ${({ theme }) => theme.fontSizes[2]};
+  text-decoration: none;
+  &:hover { text-decoration: underline; }
+`;
+const StepNumber = styled(Flex)`
+  width: 28px;
+  height: 28px;
+  border-radius: 50%;
+  background-color: ${({ theme }) => theme.colors.primary100};
+  flex-shrink: 0;
+`;
+const steps = [
+  {
+    number: 1,
+    title: "Create a Permit.io account",
+    description: "Sign up at permit.io and create a new workspace for your project.",
+    link: "https://app.permit.io",
+    linkText: "Go to Permit.io"
+  },
+  {
+    number: 2,
+    title: "Assign policies in Permit.io",
+    description: "Once connected, your Strapi content types and roles sync automatically. Head to the Permit.io dashboard to assign permissions per role.",
+    link: "https://docs.permit.io",
+    linkText: "Read the docs"
+  },
+  {
+    number: 3,
+    title: "Enter your API key below",
+    description: "Copy your API key from the Permit.io dashboard and paste it below to connect."
+  }
+];
+const DEFAULT_PDP_URL = "https://cloudpdp.api.permit.io";
+const GettingStarted = ({ onConnect }) => {
+  const [apiKey, setApiKey] = useState("");
+  const [pdpUrl, setPdpUrl] = useState(DEFAULT_PDP_URL);
+  const [errors, setErrors] = useState({});
+  const [loading, setLoading] = useState(false);
+  const { post } = useFetchClient();
+  const { toggleNotification } = useNotification();
+  const handleConnect = async () => {
+    if (!apiKey.trim()) {
+      setErrors({ apiKey: "API key is required" });
+      return;
+    }
+    setErrors({});
+    setLoading(true);
+    try {
+      await post("/permit-strapi/config", {
+        apiKey: apiKey.trim(),
+        pdpUrl: pdpUrl.trim() || DEFAULT_PDP_URL
+      });
+      toggleNotification({
+        type: "success",
+        message: "Successfully connected to Permit.io"
+      });
+      onConnect();
+    } catch (error) {
+      const message = error?.response?.data?.error?.message || "Failed to connect. Please check your API key.";
+      toggleNotification({
+        type: "danger",
+        message
+      });
+    } finally {
+      setLoading(false);
+    }
+  };
+  return /* @__PURE__ */ jsxs(Box, { padding: 10, children: [
+    /* @__PURE__ */ jsxs(Flex, { direction: "column", alignItems: "center", gap: 4, paddingBottom: 10, children: [
+      /* @__PURE__ */ jsx(Logo, { src: logo, alt: "Permit.io" }),
+      /* @__PURE__ */ jsxs(Flex, { direction: "column", alignItems: "center", gap: 2, children: [
+        /* @__PURE__ */ jsx(Typography, { variant: "alpha", children: "Welcome to Permit Strapi" }),
+        /* @__PURE__ */ jsx(Typography, { variant: "epsilon", textColor: "neutral600", children: "Fine-grained authorization for your Strapi content types, powered by Permit.io" })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs(
+      Box,
+      {
+        background: "neutral0",
+        shadow: "tableShadow",
+        hasRadius: true,
+        padding: 8,
+        marginBottom: 6,
+        style: { maxWidth: 640, margin: "0 auto 24px auto" },
+        children: [
+          /* @__PURE__ */ jsx(Typography, { variant: "delta", paddingBottom: 6, children: "Get started in 3 steps" }),
+          /* @__PURE__ */ jsx(Flex, { direction: "column", gap: 6, paddingTop: 4, children: steps.map((step) => /* @__PURE__ */ jsxs(Flex, { gap: 4, alignItems: "flex-start", children: [
+            /* @__PURE__ */ jsx(StepNumber, { justifyContent: "center", alignItems: "center", style: { marginTop: "2px", flexShrink: 0 }, children: /* @__PURE__ */ jsx(Typography, { variant: "sigma", textColor: "primary600", children: step.number }) }),
+            /* @__PURE__ */ jsxs(Flex, { direction: "column", gap: 1, alignItems: "flex-start", style: { flex: 1 }, children: [
+              /* @__PURE__ */ jsx(Typography, { variant: "omega", fontWeight: "bold", children: step.title }),
+              /* @__PURE__ */ jsx(Typography, { variant: "omega", textColor: "neutral600", children: step.description }),
+              step.link && /* @__PURE__ */ jsxs(Flex, { gap: 1, alignItems: "center", paddingTop: 1, children: [
+                /* @__PURE__ */ jsx(StepLink, { href: step.link, target: "_blank", rel: "noreferrer", children: step.linkText }),
+                /* @__PURE__ */ jsx(ExternalLink, { width: "12px", height: "12px", fill: "primary600" })
+              ] })
+            ] })
+          ] }, step.number)) }),
+          /* @__PURE__ */ jsx(Box, { paddingTop: 8, children: /* @__PURE__ */ jsxs(Field.Root, { name: "apiKey", error: errors.apiKey, children: [
+            /* @__PURE__ */ jsx(Field.Label, { children: "Permit.io API Key" }),
+            /* @__PURE__ */ jsx(
+              TextInput,
+              {
+                placeholder: "permit_key_...",
+                value: apiKey,
+                onChange: (e) => setApiKey(e.target.value),
+                type: "password"
+              }
+            ),
+            /* @__PURE__ */ jsx(Field.Error, {})
+          ] }) }),
+          /* @__PURE__ */ jsxs(Box, { paddingTop: 4, children: [
+            /* @__PURE__ */ jsxs(Field.Root, { name: "pdpUrl", hint: "Leave as default to use Permit.io Cloud PDP. Change to your local PDP URL if self-hosting.", children: [
+              /* @__PURE__ */ jsx(Field.Label, { children: "PDP URL" }),
+              /* @__PURE__ */ jsx(Field.Hint, {}),
+              /* @__PURE__ */ jsx(
+                TextInput,
+                {
+                  placeholder: DEFAULT_PDP_URL,
+                  value: pdpUrl,
+                  onChange: (e) => setPdpUrl(e.target.value)
+                }
+              )
+            ] }),
+            /* @__PURE__ */ jsx(Box, { paddingTop: 3, children: /* @__PURE__ */ jsxs(
+              Flex,
+              {
+                gap: 2,
+                alignItems: "flex-start",
+                padding: 3,
+                style: { background: "#f0f4ff", borderRadius: "4px" },
+                children: [
+                  /* @__PURE__ */ jsx(Information, { width: "14px", height: "14px", fill: "primary600", style: { flexShrink: 0, marginTop: "2px" } }),
+                  /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "primary600", children: [
+                    "The Cloud PDP supports ",
+                    /* @__PURE__ */ jsx("strong", { children: "RBAC only" }),
+                    ". If you plan to use ABAC or ReBAC policies, you must deploy a",
+                    " ",
+                    /* @__PURE__ */ jsx(
+                      "a",
+                      {
+                        href: "https://docs.permit.io/how-to/deploy/deploy-to-production",
+                        target: "_blank",
+                        rel: "noreferrer",
+                        style: { color: "inherit", textDecoration: "underline" },
+                        children: "self-hosted PDP"
+                      }
+                    ),
+                    "."
+                  ] })
+                ]
+              }
+            ) })
+          ] }),
+          /* @__PURE__ */ jsx(Flex, { paddingTop: 6, justifyContent: "flex-end", children: /* @__PURE__ */ jsx(
+            Button,
+            {
+              startIcon: /* @__PURE__ */ jsx(Check, {}),
+              onClick: handleConnect,
+              disabled: !apiKey.trim() || loading,
+              loading,
+              size: "L",
+              children: "Connect to Permit.io"
+            }
+          ) })
+        ]
+      }
+    )
+  ] });
+};
+const App = () => {
+  const [isConfigured, setIsConfigured] = useState(null);
+  const { get } = useFetchClient();
+  useEffect(() => {
+    get("/permit-strapi/config").then(({ data }) => setIsConfigured(data.configured)).catch(() => setIsConfigured(false));
+  }, []);
+  if (isConfigured === null) {
+    return /* @__PURE__ */ jsx(Page.Loading, {});
+  }
+  if (!isConfigured) {
+    return /* @__PURE__ */ jsx(GettingStarted, { onConnect: () => setIsConfigured(true) });
+  }
+  return /* @__PURE__ */ jsxs(Routes, { children: [
+    /* @__PURE__ */ jsx(Route, { index: true, element: /* @__PURE__ */ jsx(HomePage, { onDisconnect: () => setIsConfigured(false) }) }),
+    /* @__PURE__ */ jsx(Route, { path: "*", element: /* @__PURE__ */ jsx(Page.Error, {}) })
+  ] });
+};
+export {
+  App
+};