@pol-studios/db 1.0.38 → 1.0.40

package/dist/{chunk-6OSNGHRE.js → chunk-MZLEDWJF.js}

@@ -1,6 +1,7 @@
 import {
-  useDbQuery
-} from "./chunk-UBHORKBS.js";
+  useDbQuery,
+  useDbQueryById
+} from "./chunk-5SJ5O2NQ.js";
 import {
   buildNormalizedQuery,
   encode,
@@ -71,9 +72,292 @@ function useDbQuery2(query, config) {
 import { createContext } from "react";
 var setupAuthContext = createContext({});
 
-// src/auth/context/PermissionContext.tsx
-import { createContext as createContext2, useCallback, useContext, useEffect, useMemo as useMemo2, useRef as useRef2, useState } from "react";
+// src/auth/context/AuthProvider.tsx
+import { useCallback, useEffect, useMemo as useMemo2, useRef as useRef2, useState } from "react";
+import { isUsable, newUuid } from "@pol-studios/utils";
 import { jsx } from "react/jsx-runtime";
+var SESSION_FETCH_TIMEOUT_MS = 3e3;
+function getPermissionLevel(action) {
+  switch (action.toLowerCase()) {
+    case "view":
+    case "read":
+      return 1;
+    case "edit":
+    case "write":
+      return 2;
+    case "admin":
+    case "delete":
+    case "share":
+      return 3;
+    default:
+      return 0;
+  }
+}
+function isNotExpired(expiresAt) {
+  return !expiresAt || new Date(expiresAt) > /* @__PURE__ */ new Date();
+}
+function matchesAccessPattern(pattern, requestedKey) {
+  if (pattern === requestedKey) return true;
+  if (pattern === "*:*:*") return true;
+  const patternParts = pattern.split(":");
+  const keyParts = requestedKey.split(":");
+  if (patternParts.length !== keyParts.length) return false;
+  for (let i = 0; i < patternParts.length; i++) {
+    if (patternParts[i] === "*") continue;
+    if (patternParts[i] !== keyParts[i]) return false;
+  }
+  return true;
+}
+function AuthProvider({
+  children
+}) {
+  const supabase = useSupabase();
+  const [currentUser, setCurrentUser] = useState(void 0);
+  const [userNeedsChange, setUserNeedsChange] = useState(true);
+  const [onSignOutCallbacks, setOnSignOutCallbacks] = useState(/* @__PURE__ */ new Map());
+  async function registerAsync(register) {
+    const response = await supabase.auth.signUp(register);
+    if (response.data.user) {
+      setCurrentUser((prev) => prev?.id === response.data.user?.id ? prev : response.data.user);
+    }
+    return response;
+  }
+  async function signInAsync(username, password) {
+    const response_0 = await supabase.auth.signInWithPassword({
+      email: username,
+      password
+    });
+    if (response_0.data.user) {
+      setCurrentUser((prev_0) => prev_0?.id === response_0.data.user?.id ? prev_0 : response_0.data.user);
+    }
+    return response_0;
+  }
+  const signOutAsync = useCallback(async () => {
+    const response_1 = await supabase.auth.signOut();
+    if (!response_1.error) {
+      Array.from(onSignOutCallbacks.values()).forEach((cb) => cb());
+    }
+    return response_1;
+  }, [supabase.auth, onSignOutCallbacks]);
+  function onSignOut(action) {
+    const id = newUuid();
+    setOnSignOutCallbacks((x) => new Map(x).set(id, action));
+    return id;
+  }
+  function removeOnSignOut(id_0) {
+    setOnSignOutCallbacks((x_0) => {
+      const map = new Map(x_0);
+      map.delete(id_0);
+      return map;
+    });
+  }
+  async function refreshAsync() {
+  }
+  useEffect(() => {
+    const {
+      data: {
+        subscription
+      }
+    } = supabase.auth.onAuthStateChange((event) => {
+      if (event === "SIGNED_IN" || event === "SIGNED_OUT") {
+        setUserNeedsChange(true);
+      }
+    });
+    return () => subscription.unsubscribe();
+  }, [supabase.auth]);
+  useEffect(() => {
+    if (!userNeedsChange) return;
+    let cancelled = false;
+    async function fetchSessionWithTimeout() {
+      try {
+        const timeoutPromise = new Promise((_, reject) => {
+          setTimeout(() => {
+            reject(new Error(`Session fetch timed out after ${SESSION_FETCH_TIMEOUT_MS}ms`));
+          }, SESSION_FETCH_TIMEOUT_MS);
+        });
+        const result = await Promise.race([supabase.auth.getSession(), timeoutPromise]);
+        if (cancelled) return;
+        const newUser = result?.data?.session?.user ?? null;
+        setCurrentUser((prev_2) => {
+          if (newUser === null) return null;
+          if (prev_2?.id === newUser?.id) return prev_2;
+          return newUser;
+        });
+        setUserNeedsChange(false);
+      } catch (error) {
+        if (cancelled) return;
+        console.error("Failed to get session (timeout or error):", error);
+        setCurrentUser((prev_1) => prev_1 === null ? prev_1 : null);
+        setUserNeedsChange(false);
+      }
+    }
+    fetchSessionWithTimeout();
+    return () => {
+      cancelled = true;
+    };
+  }, [userNeedsChange, supabase.auth]);
+  const isUserReady = isUsable(currentUser);
+  const {
+    data: profile,
+    isLoading: profileLoading
+  } = useDbQueryById("core.Profile", currentUser?.id ?? "", {
+    enabled: isUserReady
+  });
+  const {
+    data: directAccess,
+    isLoading: directAccessLoading
+  } = useDbQuery("core.UserAccess", {
+    where: {
+      userId: currentUser?.id
+    },
+    enabled: isUserReady,
+    realtime: true
+  });
+  const {
+    data: userGroups,
+    isLoading: userGroupsLoading
+  } = useDbQuery("core.UserGroup", {
+    where: {
+      userId: currentUser?.id
+    },
+    enabled: isUserReady,
+    realtime: true
+  });
+  const {
+    data: groups,
+    isLoading: groupsLoading
+  } = useDbQuery("core.Group", {
+    where: {
+      isActive: 1
+    },
+    enabled: isUserReady,
+    realtime: true
+  });
+  const groupIds = useMemo2(() => userGroups?.map((ug) => ug.groupId) ?? [], [userGroups]);
+  const groupsMap = useMemo2(() => new Map(groups?.map((g) => [g.id, g]) ?? []), [groups]);
+  const {
+    data: groupAccess,
+    isLoading: groupAccessLoading
+  } = useDbQuery("core.GroupAccessKey", {
+    where: groupIds.length > 0 ? {
+      groupId: {
+        in: groupIds
+      }
+    } : void 0,
+    enabled: groupIds.length > 0,
+    realtime: true
+  });
+  const prevProfileStatusRef = useRef2(void 0);
+  useEffect(() => {
+    const currentStatus = profile?.status;
+    const prevStatus = prevProfileStatusRef.current;
+    if (prevStatus === "active" && (currentStatus === "archived" || currentStatus === "suspended")) {
+      signOutAsync();
+    }
+    prevProfileStatusRef.current = currentStatus;
+  }, [profile?.status, signOutAsync]);
+  const allAccessKeys = useMemo2(() => {
+    const keys = [];
+    directAccess?.forEach((a) => {
+      if (isNotExpired(a.expiresAt)) {
+        keys.push({
+          accessKey: a.accessKey,
+          effect: a.effect ?? "allow",
+          source: "direct",
+          expiresAt: a.expiresAt
+        });
+      }
+    });
+    const activeGroupIds = new Set(userGroups?.filter((ug_0) => {
+      const group = groupsMap.get(ug_0.groupId);
+      return group?.isActive === 1 && isNotExpired(ug_0.expiresAt);
+    }).map((ug_1) => ug_1.groupId) ?? []);
+    groupAccess?.forEach((ga) => {
+      if (activeGroupIds.has(ga.groupId) && isNotExpired(ga.expiresAt)) {
+        keys.push({
+          accessKey: ga.accessKey,
+          effect: ga.effect ?? "allow",
+          source: "group",
+          expiresAt: ga.expiresAt
+        });
+      }
+    });
+    return keys;
+  }, [directAccess, userGroups, groupsMap, groupAccess]);
+  const combinedAccess = useMemo2(() => {
+    const uniqueKeys = /* @__PURE__ */ new Set();
+    for (const item of allAccessKeys) {
+      if (item.accessKey && item.effect === "allow") {
+        uniqueKeys.add(item.accessKey);
+      }
+    }
+    return Array.from(uniqueKeys);
+  }, [allAccessKeys]);
+  const effectivePermissions = useMemo2(() => {
+    const permissions = [];
+    for (const item_0 of allAccessKeys) {
+      if (item_0.effect !== "allow") continue;
+      const parts = item_0.accessKey.split(":");
+      if (parts.length === 3) {
+        const [resourceType, resourceId, permission] = parts;
+        permissions.push({
+          resourceType,
+          resourceId,
+          permission,
+          permissionLevel: getPermissionLevel(permission),
+          source: item_0.source,
+          inheritedFrom: null,
+          expiresAt: item_0.expiresAt ?? null
+        });
+      }
+    }
+    return permissions;
+  }, [allAccessKeys]);
+  const profileStatus = profile?.status;
+  const isArchived = profileStatus === "archived";
+  const isSuspended = profileStatus === "suspended";
+  const hasAccess = useCallback((key) => {
+    if (isArchived || isSuspended) return false;
+    if (!isUsable(combinedAccess)) return false;
+    if (combinedAccess.includes("*:*:*")) return true;
+    if (combinedAccess.includes(key)) return true;
+    if (!isUsable(key)) return true;
+    for (const pattern of combinedAccess) {
+      if (matchesAccessPattern(pattern, key)) return true;
+    }
+    const parts_0 = key.split(":");
+    if (parts_0.length === 3) {
+      const [type, id_1, action_0] = parts_0;
+      const requiredLevel = getPermissionLevel(action_0);
+      const hasPermission = effectivePermissions.some((p) => p.resourceType === type && p.resourceId === id_1 && p.permissionLevel >= requiredLevel);
+      if (hasPermission) return true;
+    }
+    return false;
+  }, [combinedAccess, effectivePermissions, isArchived, isSuspended]);
+  const isAccessLoading = directAccessLoading || userGroupsLoading || groupsLoading || groupAccessLoading;
+  const authState = useMemo2(() => ({
+    hasAccess,
+    user: currentUser,
+    profile,
+    access: combinedAccess,
+    effectivePermissions,
+    profileStatus,
+    isArchived,
+    isSuspended,
+    isLoading: currentUser === null ? false : profileLoading || isAccessLoading || currentUser === void 0,
+    signInAsync,
+    signOutAsync,
+    onSignOut,
+    removeOnSignOut,
+    registerAsync,
+    refreshAsync
+  }), [hasAccess, currentUser, profile, combinedAccess, effectivePermissions, profileStatus, isArchived, isSuspended, profileLoading, isAccessLoading]);
+  return /* @__PURE__ */ jsx(setupAuthContext.Provider, { value: authState, children });
+}
+
+// src/auth/context/PermissionContext.tsx
+import { createContext as createContext2, useCallback as useCallback2, useContext, useEffect as useEffect2, useMemo as useMemo3, useRef as useRef3, useState as useState2 } from "react";
+import { jsx as jsx2 } from "react/jsx-runtime";
 function getCacheKey(userId, entityType, entityId) {
   return `${userId || "anon"}:${entityType}:${entityId}`;
 }
@@ -188,13 +472,13 @@ function PermissionProvider({
   const supabase = useSupabase();
   const setupAuth = useContext(setupAuthContext);
   const user = setupAuth?.user;
-  const cacheRef = useRef2(/* @__PURE__ */ new Map());
-  const pendingLookupsRef = useRef2(/* @__PURE__ */ new Set());
-  const inFlightRef = useRef2(/* @__PURE__ */ new Set());
-  const batchTimerRef = useRef2(null);
-  const [isLoading, setIsLoading] = useState(false);
-  const [, forceUpdate] = useState(0);
-  const cleanupExpiredEntries = useCallback(() => {
+  const cacheRef = useRef3(/* @__PURE__ */ new Map());
+  const pendingLookupsRef = useRef3(/* @__PURE__ */ new Set());
+  const inFlightRef = useRef3(/* @__PURE__ */ new Set());
+  const batchTimerRef = useRef3(null);
+  const [isLoading, setIsLoading] = useState2(false);
+  const [, forceUpdate] = useState2(0);
+  const cleanupExpiredEntries = useCallback2(() => {
     const now = Date.now();
     const cache = cacheRef.current;
     let hasExpired = false;
@@ -208,11 +492,11 @@ function PermissionProvider({
       forceUpdate((prev) => prev + 1);
     }
   }, []);
-  useEffect(() => {
+  useEffect2(() => {
     const cleanupInterval = setInterval(cleanupExpiredEntries, 60 * 1e3);
     return () => clearInterval(cleanupInterval);
   }, [cleanupExpiredEntries]);
-  const executeBatchLookup = useCallback(async () => {
+  const executeBatchLookup = useCallback2(async () => {
     const pending = Array.from(pendingLookupsRef.current);
     pendingLookupsRef.current.clear();
     if (pending.length === 0 || !user?.id) {
@@ -272,7 +556,7 @@ function PermissionProvider({
       setIsLoading(false);
     }
   }, [supabase, user?.id]);
-  const scheduleBatchLookup = useCallback(() => {
+  const scheduleBatchLookup = useCallback2(() => {
     if (batchTimerRef.current) {
       clearTimeout(batchTimerRef.current);
     }
@@ -281,7 +565,7 @@ function PermissionProvider({
       executeBatchLookup();
     }, BATCH_DELAY_MS);
   }, [executeBatchLookup]);
-  const getPermission = useCallback((entityType_0, entityId) => {
+  const getPermission = useCallback2((entityType_0, entityId) => {
     const key_4 = getCacheKey(user?.id, entityType_0, entityId);
     const cache_2 = cacheRef.current;
     const cached = cache_2.get(key_4);
@@ -295,7 +579,7 @@ function PermissionProvider({
     }
     return loadingPermission;
   }, [scheduleBatchLookup, user?.id]);
-  const checkPermission = useCallback((entityType_1, entityId_0, action) => {
+  const checkPermission = useCallback2((entityType_1, entityId_0, action) => {
     const permission = getPermission(entityType_1, entityId_0);
     if (permission.isLoading) {
       return false;
@@ -317,7 +601,7 @@ function PermissionProvider({
         return false;
     }
   }, [getPermission]);
-  const prefetchPermissions = useCallback(async (entities_0) => {
+  const prefetchPermissions = useCallback2(async (entities_0) => {
     if (!user?.id || entities_0.length === 0) {
       return;
     }
@@ -347,416 +631,126 @@ function PermissionProvider({
         p_entities: entitiesParam
       });
       if (error_0) {
-        console.error("Failed to prefetch entity permissions:", error_0);
-        return;
-      }
-      if (data_0) {
-        const cacheTimestamp = Date.now();
-        const resultsMap_0 = /* @__PURE__ */ new Map();
-        const results_0 = data_0;
-        for (const result_0 of results_0) {
-          const key_6 = getCacheKey(user?.id, result_0.entity_type, result_0.entity_id);
-          resultsMap_0.set(key_6, result_0.permission);
-        }
-        for (const entity_0 of toFetch) {
-          const key_7 = getCacheKey(user?.id, entity_0.entityType, entity_0.entityId);
-          const permissionLevel_0 = resultsMap_0.get(key_7) || null;
-          cache_3.set(key_7, {
-            permission: mapPermissionLevel(permissionLevel_0),
-            expiresAt: cacheTimestamp + CACHE_TTL_MS
-          });
-        }
-        forceUpdate((prev_1) => prev_1 + 1);
-      }
-    } catch (err_0) {
-      console.error("Unexpected error prefetching entity permissions:", err_0);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [supabase, user?.id]);
-  const invalidatePermission = useCallback((entityType_2, entityId_1) => {
-    const key_8 = getCacheKey(user?.id, entityType_2, entityId_1);
-    cacheRef.current.delete(key_8);
-    forceUpdate((prev_2) => prev_2 + 1);
-  }, [user?.id]);
-  const parseScopedAccessKey = useCallback((key_9) => {
-    if (!key_9 || typeof key_9 !== "string") {
-      return null;
-    }
-    const parts_0 = key_9.split(":");
-    if (parts_0.length < 2) {
-      return null;
-    }
-    const entityType_3 = parts_0[0];
-    const entityId_2 = parseInt(parts_0[1], 10);
-    if (isNaN(entityId_2)) {
-      return null;
-    }
-    const entityTypeMap = {
-      client: "Client",
-      project: "Project",
-      database: "ProjectDatabase",
-      projectdatabase: "ProjectDatabase"
-    };
-    const normalizedEntityType = entityTypeMap[entityType_3.toLowerCase()];
-    if (!normalizedEntityType) {
-      return null;
-    }
-    return {
-      entityType: normalizedEntityType,
-      entityId: entityId_2
-    };
-  }, []);
-  useEffect(() => {
-    if (!user?.id) {
-      return;
-    }
-    const channel = supabase.channel(`entity-permissions-${user.id}`).on("postgres_changes", {
-      event: "*",
-      schema: "core",
-      table: "UserAccess",
-      filter: `userId=eq.${user.id}`
-    }, (payload) => {
-      if (payload.new && typeof payload.new === "object" && "scopedAccessKey" in payload.new && typeof payload.new.scopedAccessKey === "string") {
-        const parsed = parseScopedAccessKey(payload.new.scopedAccessKey);
-        if (parsed) {
-          invalidatePermission(parsed.entityType, parsed.entityId);
-        }
-      }
-      if (payload.old && typeof payload.old === "object" && "scopedAccessKey" in payload.old && typeof payload.old.scopedAccessKey === "string") {
-        const parsed_0 = parseScopedAccessKey(payload.old.scopedAccessKey);
-        if (parsed_0) {
-          invalidatePermission(parsed_0.entityType, parsed_0.entityId);
-        }
-      }
-    }).subscribe();
-    return () => {
-      channel.unsubscribe();
-      supabase.removeChannel(channel);
-    };
-  }, [supabase, user?.id, invalidatePermission, parseScopedAccessKey]);
-  useEffect(() => {
-    cacheRef.current.clear();
-    pendingLookupsRef.current.clear();
-    inFlightRef.current.clear();
-    if (batchTimerRef.current) {
-      clearTimeout(batchTimerRef.current);
-      batchTimerRef.current = null;
-    }
-    forceUpdate((prev_3) => prev_3 + 1);
-  }, [user?.id]);
-  useEffect(() => {
-    return () => {
-      if (batchTimerRef.current) {
-        clearTimeout(batchTimerRef.current);
-      }
-    };
-  }, []);
-  const value = useMemo2(() => ({
-    getPermission,
-    checkPermission,
-    prefetchPermissions,
-    invalidatePermission,
-    isLoading
-  }), [getPermission, checkPermission, prefetchPermissions, invalidatePermission, isLoading]);
-  return /* @__PURE__ */ jsx(permissionContext.Provider, { value, children });
-}
-function usePermissions() {
-  const context = useContext(permissionContext);
-  if (!context || Object.keys(context).length === 0) {
-    throw new Error("usePermissions must be used within a PermissionProvider");
-  }
-  return context;
-}
-
-// src/auth/context/AuthProvider.tsx
-import { useCallback as useCallback2, useEffect as useEffect2, useMemo as useMemo3, useRef as useRef3, useState as useState2 } from "react";
-import { isUsable, newUuid } from "@pol-studios/utils";
-import { jsx as jsx2 } from "react/jsx-runtime";
-var SESSION_FETCH_TIMEOUT_MS = 3e3;
-function getPermissionLevel(action) {
-  switch (action.toLowerCase()) {
-    case "view":
-    case "read":
-      return 1;
-    case "edit":
-    case "write":
-      return 2;
-    case "admin":
-    case "delete":
-    case "share":
-      return 3;
-    default:
-      return 0;
-  }
-}
-function isNotExpired(expiresAt) {
-  return !expiresAt || new Date(expiresAt) > /* @__PURE__ */ new Date();
-}
-function matchesAccessPattern(pattern, requestedKey) {
-  if (pattern === requestedKey) return true;
-  if (pattern === "*:*:*") return true;
-  const patternParts = pattern.split(":");
-  const keyParts = requestedKey.split(":");
-  if (patternParts.length !== keyParts.length) return false;
-  for (let i = 0; i < patternParts.length; i++) {
-    if (patternParts[i] === "*") continue;
-    if (patternParts[i] !== keyParts[i]) return false;
-  }
-  return true;
-}
-function AuthProvider({
-  children,
-  enableEntityPermissions = false
-}) {
-  const supabase = useSupabase();
-  const [currentUser, setCurrentUser] = useState2(void 0);
-  const [userNeedsChange, setUserNeedsChange] = useState2(true);
-  const [onSignOutCallbacks, setOnSignOutCallbacks] = useState2(/* @__PURE__ */ new Map());
-  async function registerAsync(register) {
-    const response = await supabase.auth.signUp(register);
-    if (response.data.user) {
-      setCurrentUser((prev) => prev?.id === response.data.user?.id ? prev : response.data.user);
-    }
-    return response;
-  }
-  async function signInAsync(username, password) {
-    const response_0 = await supabase.auth.signInWithPassword({
-      email: username,
-      password
-    });
-    if (response_0.data.user) {
-      setCurrentUser((prev_0) => prev_0?.id === response_0.data.user?.id ? prev_0 : response_0.data.user);
-    }
-    return response_0;
-  }
-  const signOutAsync = useCallback2(async () => {
-    const response_1 = await supabase.auth.signOut();
-    if (!response_1.error) {
-      Array.from(onSignOutCallbacks.values()).forEach((cb) => cb());
-    }
-    return response_1;
-  }, [supabase.auth, onSignOutCallbacks]);
-  function onSignOut(action) {
-    const id = newUuid();
-    setOnSignOutCallbacks((x) => new Map(x).set(id, action));
-    return id;
-  }
-  function removeOnSignOut(id_0) {
-    setOnSignOutCallbacks((x_0) => {
-      const map = new Map(x_0);
-      map.delete(id_0);
-      return map;
-    });
-  }
-  async function refreshAsync() {
-  }
-  useEffect2(() => {
-    const {
-      data: {
-        subscription
-      }
-    } = supabase.auth.onAuthStateChange((event) => {
-      if (event === "SIGNED_IN" || event === "SIGNED_OUT") {
-        setUserNeedsChange(true);
-      }
-    });
-    return () => subscription.unsubscribe();
-  }, [supabase.auth]);
-  useEffect2(() => {
-    if (!userNeedsChange) return;
-    let cancelled = false;
-    async function fetchSessionWithTimeout() {
-      try {
-        const timeoutPromise = new Promise((_, reject) => {
-          setTimeout(() => {
-            reject(new Error(`Session fetch timed out after ${SESSION_FETCH_TIMEOUT_MS}ms`));
-          }, SESSION_FETCH_TIMEOUT_MS);
-        });
-        const result = await Promise.race([supabase.auth.getSession(), timeoutPromise]);
-        if (cancelled) return;
-        const newUser = result?.data?.session?.user ?? null;
-        setCurrentUser((prev_2) => {
-          if (newUser === null) return null;
-          if (prev_2?.id === newUser?.id) return prev_2;
-          return newUser;
-        });
-        setUserNeedsChange(false);
-      } catch (error) {
-        if (cancelled) return;
-        console.error("Failed to get session (timeout or error):", error);
-        setCurrentUser((prev_1) => prev_1 === null ? prev_1 : null);
-        setUserNeedsChange(false);
+        console.error("Failed to prefetch entity permissions:", error_0);
+        return;
+      }
+      if (data_0) {
+        const cacheTimestamp = Date.now();
+        const resultsMap_0 = /* @__PURE__ */ new Map();
+        const results_0 = data_0;
+        for (const result_0 of results_0) {
+          const key_6 = getCacheKey(user?.id, result_0.entity_type, result_0.entity_id);
+          resultsMap_0.set(key_6, result_0.permission);
+        }
+        for (const entity_0 of toFetch) {
+          const key_7 = getCacheKey(user?.id, entity_0.entityType, entity_0.entityId);
+          const permissionLevel_0 = resultsMap_0.get(key_7) || null;
+          cache_3.set(key_7, {
+            permission: mapPermissionLevel(permissionLevel_0),
+            expiresAt: cacheTimestamp + CACHE_TTL_MS
+          });
+        }
+        forceUpdate((prev_1) => prev_1 + 1);
       }
+    } catch (err_0) {
+      console.error("Unexpected error prefetching entity permissions:", err_0);
+    } finally {
+      setIsLoading(false);
     }
-    fetchSessionWithTimeout();
-    return () => {
-      cancelled = true;
+  }, [supabase, user?.id]);
+  const invalidatePermission = useCallback2((entityType_2, entityId_1) => {
+    const key_8 = getCacheKey(user?.id, entityType_2, entityId_1);
+    cacheRef.current.delete(key_8);
+    forceUpdate((prev_2) => prev_2 + 1);
+  }, [user?.id]);
+  const parseScopedAccessKey = useCallback2((key_9) => {
+    if (!key_9 || typeof key_9 !== "string") {
+      return null;
+    }
+    const parts_0 = key_9.split(":");
+    if (parts_0.length < 2) {
+      return null;
+    }
+    const entityType_3 = parts_0[0];
+    const entityId_2 = parseInt(parts_0[1], 10);
+    if (isNaN(entityId_2)) {
+      return null;
+    }
+    const entityTypeMap = {
+      client: "Client",
+      project: "Project",
+      database: "ProjectDatabase",
+      projectdatabase: "ProjectDatabase"
     };
-  }, [userNeedsChange, supabase.auth]);
-  const isUserReady = isUsable(currentUser);
-  const {
-    data: profileData,
-    isLoading: profileLoading
-  } = useDbQuery("core.Profile", {
-    where: {
-      id: currentUser?.id
-    },
-    enabled: isUserReady,
-    realtime: true
-  });
-  const {
-    data: directAccess,
-    isLoading: directAccessLoading
-  } = useDbQuery("core.UserAccess", {
-    where: {
-      userId: currentUser?.id
-    },
-    enabled: isUserReady,
-    realtime: true
-  });
-  const {
-    data: userGroups,
-    isLoading: userGroupsLoading
-  } = useDbQuery("core.UserGroup", {
-    where: {
-      userId: currentUser?.id
-    },
-    enabled: isUserReady,
-    realtime: true
-  });
-  const {
-    data: groups,
-    isLoading: groupsLoading
-  } = useDbQuery("core.Group", {
-    where: {
-      isActive: 1
-    },
-    enabled: isUserReady,
-    realtime: true
-  });
-  const groupIds = useMemo3(() => userGroups?.map((ug) => ug.groupId) ?? [], [userGroups]);
-  const groupsMap = useMemo3(() => new Map(groups?.map((g) => [g.id, g]) ?? []), [groups]);
-  const {
-    data: groupAccess,
-    isLoading: groupAccessLoading
-  } = useDbQuery("core.GroupAccessKey", {
-    where: groupIds.length > 0 ? {
-      groupId: {
-        in: groupIds
-      }
-    } : void 0,
-    enabled: groupIds.length > 0,
-    realtime: true
-  });
-  const profile = profileData?.[0] ?? null;
-  const prevProfileStatusRef = useRef3(void 0);
+    const normalizedEntityType = entityTypeMap[entityType_3.toLowerCase()];
+    if (!normalizedEntityType) {
+      return null;
+    }
+    return {
+      entityType: normalizedEntityType,
+      entityId: entityId_2
+    };
+  }, []);
   useEffect2(() => {
-    const currentStatus = profile?.status;
-    const prevStatus = prevProfileStatusRef.current;
-    if (prevStatus === "active" && (currentStatus === "archived" || currentStatus === "suspended")) {
-      signOutAsync();
+    if (!user?.id) {
+      return;
     }
-    prevProfileStatusRef.current = currentStatus;
-  }, [profile?.status, signOutAsync]);
-  const allAccessKeys = useMemo3(() => {
-    const keys = [];
-    directAccess?.forEach((a) => {
-      if (isNotExpired(a.expiresAt)) {
-        keys.push({
-          accessKey: a.accessKey,
-          effect: a.effect ?? "allow",
-          source: "direct",
-          expiresAt: a.expiresAt
-        });
-      }
-    });
-    const activeGroupIds = new Set(userGroups?.filter((ug_0) => {
-      const group = groupsMap.get(ug_0.groupId);
-      return group?.isActive === 1 && isNotExpired(ug_0.expiresAt);
-    }).map((ug_1) => ug_1.groupId) ?? []);
-    groupAccess?.forEach((ga) => {
-      if (activeGroupIds.has(ga.groupId) && isNotExpired(ga.expiresAt)) {
-        keys.push({
-          accessKey: ga.accessKey,
-          effect: ga.effect ?? "allow",
-          source: "group",
-          expiresAt: ga.expiresAt
-        });
+    const channel = supabase.channel(`entity-permissions-${user.id}`).on("postgres_changes", {
+      event: "*",
+      schema: "core",
+      table: "UserAccess",
+      filter: `userId=eq.${user.id}`
+    }, (payload) => {
+      if (payload.new && typeof payload.new === "object" && "scopedAccessKey" in payload.new && typeof payload.new.scopedAccessKey === "string") {
+        const parsed = parseScopedAccessKey(payload.new.scopedAccessKey);
+        if (parsed) {
+          invalidatePermission(parsed.entityType, parsed.entityId);
+        }
       }
-    });
-    return keys;
-  }, [directAccess, userGroups, groupsMap, groupAccess]);
-  const combinedAccess = useMemo3(() => {
-    const uniqueKeys = /* @__PURE__ */ new Set();
-    for (const item of allAccessKeys) {
-      if (item.accessKey && item.effect === "allow") {
-        uniqueKeys.add(item.accessKey);
+      if (payload.old && typeof payload.old === "object" && "scopedAccessKey" in payload.old && typeof payload.old.scopedAccessKey === "string") {
+        const parsed_0 = parseScopedAccessKey(payload.old.scopedAccessKey);
+        if (parsed_0) {
+          invalidatePermission(parsed_0.entityType, parsed_0.entityId);
+        }
       }
+    }).subscribe();
+    return () => {
+      channel.unsubscribe();
+      supabase.removeChannel(channel);
+    };
+  }, [supabase, user?.id, invalidatePermission, parseScopedAccessKey]);
+  useEffect2(() => {
+    cacheRef.current.clear();
+    pendingLookupsRef.current.clear();
+    inFlightRef.current.clear();
+    if (batchTimerRef.current) {
+      clearTimeout(batchTimerRef.current);
+      batchTimerRef.current = null;
     }
-    return Array.from(uniqueKeys);
-  }, [allAccessKeys]);
-  const effectivePermissions = useMemo3(() => {
-    const permissions = [];
-    for (const item_0 of allAccessKeys) {
-      if (item_0.effect !== "allow") continue;
-      const parts = item_0.accessKey.split(":");
-      if (parts.length === 3) {
-        const [resourceType, resourceId, permission] = parts;
-        permissions.push({
-          resourceType,
-          resourceId,
-          permission,
-          permissionLevel: getPermissionLevel(permission),
-          source: item_0.source,
-          inheritedFrom: null,
-          expiresAt: item_0.expiresAt ?? null
-        });
+    forceUpdate((prev_3) => prev_3 + 1);
+  }, [user?.id]);
+  useEffect2(() => {
+    return () => {
+      if (batchTimerRef.current) {
+        clearTimeout(batchTimerRef.current);
       }
-    }
-    return permissions;
-  }, [allAccessKeys]);
-  const profileStatus = profile?.status;
-  const isArchived = profileStatus === "archived";
-  const isSuspended = profileStatus === "suspended";
-  const hasAccess = useCallback2((key) => {
-    if (isArchived || isSuspended) return false;
-    if (!isUsable(combinedAccess)) return false;
-    if (combinedAccess.includes("*:*:*")) return true;
-    if (combinedAccess.includes(key)) return true;
-    if (!isUsable(key)) return true;
-    for (const pattern of combinedAccess) {
-      if (matchesAccessPattern(pattern, key)) return true;
-    }
-    const parts_0 = key.split(":");
-    if (parts_0.length === 3) {
-      const [type, id_1, action_0] = parts_0;
-      const requiredLevel = getPermissionLevel(action_0);
-      const hasPermission = effectivePermissions.some((p) => p.resourceType === type && p.resourceId === id_1 && p.permissionLevel >= requiredLevel);
-      if (hasPermission) return true;
-    }
-    return false;
-  }, [combinedAccess, effectivePermissions, isArchived, isSuspended]);
-  const isAccessLoading = directAccessLoading || userGroupsLoading || groupsLoading || groupAccessLoading;
-  const authState = useMemo3(() => ({
-    hasAccess,
-    user: currentUser,
-    profile,
-    access: combinedAccess,
-    effectivePermissions,
-    profileStatus,
-    isArchived,
-    isSuspended,
-    isLoading: currentUser === null ? false : profileLoading || isAccessLoading || currentUser === void 0,
-    signInAsync,
-    signOutAsync,
-    onSignOut,
-    removeOnSignOut,
-    registerAsync,
-    refreshAsync
-  }), [hasAccess, currentUser, profile, combinedAccess, effectivePermissions, profileStatus, isArchived, isSuspended, profileLoading, isAccessLoading]);
-  const content = enableEntityPermissions ? /* @__PURE__ */ jsx2(PermissionProvider, { children }) : children;
-  return /* @__PURE__ */ jsx2(setupAuthContext.Provider, { value: authState, children: content });
+    };
+  }, []);
+  const value = useMemo3(() => ({
+    getPermission,
+    checkPermission,
+    prefetchPermissions,
+    invalidatePermission,
+    isLoading
+  }), [getPermission, checkPermission, prefetchPermissions, invalidatePermission, isLoading]);
+  return /* @__PURE__ */ jsx2(permissionContext.Provider, { value, children });
+}
+function usePermissions() {
+  const context = useContext(permissionContext);
+  if (!context || Object.keys(context).length === 0) {
+    throw new Error("usePermissions must be used within a PermissionProvider");
+  }
+  return context;
 }
 
 // src/auth/context/UserMetadataContext.tsx
@@ -1100,11 +1094,11 @@ export {
   isTimeoutError,
   useDbQuery2 as useDbQuery,
   setupAuthContext,
+  AuthProvider,
   permissionContext,
   entityPermissionContext,
   PermissionProvider,
   usePermissions,
-  AuthProvider,
   userMetadataContext,
   UserMetadataProvider,
   useUserMetadata,
@@ -1112,4 +1106,4 @@ export {
   useSetUserMetadata,
   useUserMetadataState
 };
-//# sourceMappingURL=chunk-6OSNGHRE.js.map
+//# sourceMappingURL=chunk-MZLEDWJF.js.map