@rebasepro/auth 0.0.1-canary.0

package/dist/index.es.js

@@ -0,0 +1,1883 @@
+import { useState, useRef, useEffect, useCallback } from "react";
+import { jsx, jsxs, Fragment } from "react/jsx-runtime";
+import { MailIcon, IconButton, ArrowBackIcon, Typography, TextField, CircularProgress, Button, CenteredView, Container, AddIcon, Table, TableHeader, TableCell, TableBody, TableRow, Tooltip, DeleteIcon, Checkbox, getColorSchemeForSeed, Chip, Dialog, DialogTitle, DialogContent, DialogActions, LoadingButton, MultiSelect, MultiSelectItem } from "@rebasepro/ui";
+import { useModeController, ErrorView, RebaseLogo, useSnackbarController, ConfirmationDialog, useAuthController, FieldCaption, useCollectionRegistryController } from "@rebasepro/core";
+let baseApiUrl = "";
+function setApiUrl(url) {
+  baseApiUrl = url;
+}
+function getApiUrl() {
+  return baseApiUrl;
+}
+class AuthApiError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "AuthApiError";
+  }
+}
+async function handleResponse(response) {
+  let data;
+  try {
+    data = await response.json();
+  } catch (parseError) {
+    throw new AuthApiError(
+      `Server returned non-JSON response (status: ${response.status})`,
+      "PARSE_ERROR"
+    );
+  }
+  if (!response.ok) {
+    throw new AuthApiError(
+      data.error?.message || "Request failed",
+      data.error?.code || "UNKNOWN_ERROR"
+    );
+  }
+  return data;
+}
+async function fetchWithHandling(input, init) {
+  try {
+    return await fetch(input, init);
+  } catch (error) {
+    if (error instanceof TypeError && error.message.includes("Failed to fetch")) {
+      throw new AuthApiError(
+        "Failed to connect to the backend server. The backend might be down or failed to initialize (e.g., database connection timeout).",
+        "NETWORK_ERROR"
+      );
+    }
+    throw new AuthApiError("Network error: " + (error instanceof Error ? error.message : String(error)), "NETWORK_ERROR");
+  }
+}
+async function register(email, password, displayName) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/register`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password, displayName })
+  });
+  return handleResponse(response);
+}
+async function login(email, password) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password })
+  });
+  return handleResponse(response);
+}
+async function googleLogin(idToken) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/google`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ idToken })
+  });
+  return handleResponse(response);
+}
+async function refreshAccessToken(refreshToken) {
+  console.log("[AUTH-API] Calling refresh endpoint...");
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/refresh`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken })
+  });
+  console.log("[AUTH-API] Refresh response status:", response.status);
+  return handleResponse(response);
+}
+async function logout(refreshToken) {
+  await fetchWithHandling(`${baseApiUrl}/api/auth/logout`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken })
+  });
+}
+async function getCurrentUser(accessToken) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
+    method: "GET",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${accessToken}`
+    }
+  });
+  return handleResponse(response);
+}
+async function forgotPassword(email) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/forgot-password`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email })
+  });
+  return handleResponse(response);
+}
+async function resetPassword(token, password) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/reset-password`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token, password })
+  });
+  return handleResponse(response);
+}
+async function changePassword(accessToken, oldPassword, newPassword) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/change-password`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${accessToken}`
+    },
+    body: JSON.stringify({ oldPassword, newPassword })
+  });
+  return handleResponse(response);
+}
+async function updateProfile(accessToken, displayName, photoURL) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
+    method: "PATCH",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${accessToken}`
+    },
+    body: JSON.stringify({ displayName, photoURL })
+  });
+  return handleResponse(response);
+}
+async function fetchSessions(accessToken, currentRefreshToken) {
+  const headers = {
+    "Content-Type": "application/json",
+    "Authorization": `Bearer ${accessToken}`
+  };
+  if (currentRefreshToken) {
+    headers["X-Refresh-Token"] = currentRefreshToken;
+  }
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
+    method: "GET",
+    headers
+  });
+  return handleResponse(response);
+}
+async function revokeSession(accessToken, sessionId) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions/${sessionId}`, {
+    method: "DELETE",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${accessToken}`
+    }
+  });
+  return handleResponse(response);
+}
+async function revokeAllSessions(accessToken) {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
+    method: "DELETE",
+    headers: {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${accessToken}`
+    }
+  });
+  return handleResponse(response);
+}
+async function fetchAuthConfig() {
+  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/config`, {
+    method: "GET",
+    headers: { "Content-Type": "application/json" }
+  });
+  return handleResponse(response);
+}
+const STORAGE_KEY = "rebase_auth";
+const TOKEN_REFRESH_BUFFER_MS = 2 * 60 * 1e3;
+function convertToUser(userInfo) {
+  return {
+    uid: userInfo.uid,
+    email: userInfo.email,
+    displayName: userInfo.displayName || null,
+    photoURL: userInfo.photoURL || null,
+    providerId: "custom",
+    isAnonymous: false,
+    roles: userInfo.roles || []
+  };
+}
+function saveAuthToStorage(tokens, user) {
+  try {
+    const data = { tokens, user };
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
+    const expiryDate = new Date(tokens.accessTokenExpiresAt);
+    const expiryStr = Number.isFinite(tokens.accessTokenExpiresAt) ? expiryDate.toISOString() : "invalid";
+  } catch (e) {
+  }
+}
+function loadAuthFromStorage() {
+  try {
+    const data = localStorage.getItem(STORAGE_KEY);
+    if (data) {
+      const parsed = JSON.parse(data);
+      return parsed;
+    }
+  } catch (e) {
+    console.warn("Failed to load auth from storage:", e);
+  }
+  return null;
+}
+function clearAuthFromStorage() {
+  try {
+    localStorage.removeItem(STORAGE_KEY);
+  } catch (e) {
+    console.warn("Failed to clear auth from storage:", e);
+  }
+}
+function isTokenExpiredOrNearExpiry(expiresAt, bufferMs = TOKEN_REFRESH_BUFFER_MS) {
+  return Date.now() + bufferMs >= expiresAt;
+}
+function useRebaseAuthController(props = {}) {
+  const { apiUrl, onSignOut, defineRolesFor } = props;
+  const [user, setUser] = useState(null);
+  const [authLoading, setAuthLoading] = useState(false);
+  const [initialLoading, setInitialLoading] = useState(true);
+  const [authError, setAuthError] = useState(null);
+  const [authProviderError, setAuthProviderError] = useState(null);
+  const [loginSkipped, setLoginSkipped] = useState(false);
+  const [extra, setExtra] = useState(null);
+  const [authConfig, setAuthConfig] = useState(null);
+  const tokensRef = useRef(null);
+  const refreshTimeoutRef = useRef(null);
+  const refreshPromiseRef = useRef(null);
+  const isMountedRef = useRef(true);
+  useEffect(() => {
+    if (apiUrl) {
+      setApiUrl(apiUrl);
+    }
+  }, [apiUrl]);
+  const clearSessionAndSignOut = useCallback(() => {
+    tokensRef.current = null;
+    clearAuthFromStorage();
+    if (refreshTimeoutRef.current) {
+      clearTimeout(refreshTimeoutRef.current);
+      refreshTimeoutRef.current = null;
+    }
+    setUser(null);
+    setLoginSkipped(false);
+    onSignOut?.();
+  }, [onSignOut]);
+  const refreshAccessToken$1 = useCallback(async () => {
+    if (refreshPromiseRef.current) {
+      return refreshPromiseRef.current;
+    }
+    const executeRefresh = async () => {
+      const storedData = loadAuthFromStorage();
+      if (storedData?.tokens?.accessTokenExpiresAt) {
+        const storedTokens = storedData.tokens;
+        if (!isTokenExpiredOrNearExpiry(storedTokens.accessTokenExpiresAt) && storedTokens.accessToken !== tokensRef.current?.accessToken) {
+          tokensRef.current = storedTokens;
+          return storedTokens;
+        }
+      }
+      const currentTokens = tokensRef.current;
+      if (!currentTokens?.refreshToken) {
+        return null;
+      }
+      try {
+        const response = await refreshAccessToken(currentTokens.refreshToken);
+        const newTokens = response.tokens;
+        tokensRef.current = newTokens;
+        const latestStoredData = loadAuthFromStorage();
+        if (latestStoredData) {
+          saveAuthToStorage(newTokens, latestStoredData.user);
+        }
+        const newExpiryStr = Number.isFinite(newTokens.accessTokenExpiresAt) ? new Date(newTokens.accessTokenExpiresAt).toISOString() : "invalid";
+        return newTokens;
+      } catch (error) {
+        if (error instanceof Error && error.code === "NETWORK_ERROR") {
+          throw error;
+        }
+        return null;
+      } finally {
+        refreshPromiseRef.current = null;
+      }
+    };
+    refreshPromiseRef.current = executeRefresh();
+    return refreshPromiseRef.current;
+  }, []);
+  const scheduleTokenRefresh = useCallback((tokens) => {
+    if (refreshTimeoutRef.current) {
+      clearTimeout(refreshTimeoutRef.current);
+    }
+    const expiresAt = tokens.accessTokenExpiresAt;
+    const refreshAt = expiresAt - TOKEN_REFRESH_BUFFER_MS;
+    const timeUntilRefresh = refreshAt - Date.now();
+    if (timeUntilRefresh <= 0) {
+      refreshAccessToken$1().then((newTokens) => {
+        if (newTokens && isMountedRef.current) {
+          scheduleTokenRefresh(newTokens);
+        } else if (!newTokens && isMountedRef.current) {
+          clearSessionAndSignOut();
+        }
+      });
+      return;
+    }
+    refreshTimeoutRef.current = setTimeout(async () => {
+      if (!isMountedRef.current) return;
+      try {
+        const newTokens = await refreshAccessToken$1();
+        if (newTokens && isMountedRef.current) {
+          scheduleTokenRefresh(newTokens);
+        } else if (!newTokens && isMountedRef.current) {
+          clearSessionAndSignOut();
+        }
+      } catch (error) {
+        if (isMountedRef.current) {
+          refreshTimeoutRef.current = setTimeout(() => {
+            scheduleTokenRefresh(tokens);
+          }, 1e4);
+        }
+      }
+    }, timeUntilRefresh);
+  }, [refreshAccessToken$1, clearSessionAndSignOut]);
+  const getAuthToken = useCallback(async () => {
+    if (initialLoading) {
+      throw new Error("Auth is still loading");
+    }
+    const currentTokens = tokensRef.current;
+    if (!currentTokens) {
+      throw new Error("User is not logged in");
+    }
+    if (isTokenExpiredOrNearExpiry(currentTokens.accessTokenExpiresAt)) {
+      try {
+        const newTokens = await refreshAccessToken$1();
+        if (!newTokens) {
+          clearSessionAndSignOut();
+          throw new Error("Session expired. Please login again.");
+        }
+        return newTokens.accessToken;
+      } catch (error) {
+        if (error instanceof Error && error.code === "NETWORK_ERROR") {
+          throw error;
+        }
+        clearSessionAndSignOut();
+        throw error;
+      }
+    }
+    return currentTokens.accessToken;
+  }, [initialLoading, refreshAccessToken$1, clearSessionAndSignOut]);
+  const handleAuthSuccess = useCallback(async (userInfo, tokens) => {
+    tokensRef.current = tokens;
+    let convertedUser = convertToUser(userInfo);
+    if (defineRolesFor) {
+      const customRoles = await defineRolesFor(convertedUser);
+      if (customRoles) {
+        convertedUser = { ...convertedUser, roles: customRoles.map((r) => r.id) };
+      }
+    }
+    saveAuthToStorage(tokens, userInfo);
+    setUser(convertedUser);
+    setAuthError(null);
+    setAuthProviderError(null);
+    setLoginSkipped(false);
+    scheduleTokenRefresh(tokens);
+  }, [scheduleTokenRefresh, defineRolesFor]);
+  const emailPasswordLogin = useCallback(async (email, password) => {
+    setAuthLoading(true);
+    setAuthProviderError(null);
+    try {
+      const response = await login(email, password);
+      await handleAuthSuccess(response.user, response.tokens);
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    } finally {
+      setAuthLoading(false);
+    }
+  }, [handleAuthSuccess]);
+  const register$1 = useCallback(async (email, password, displayName) => {
+    setAuthLoading(true);
+    setAuthProviderError(null);
+    try {
+      const response = await register(email, password, displayName);
+      await handleAuthSuccess(response.user, response.tokens);
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    } finally {
+      setAuthLoading(false);
+    }
+  }, [handleAuthSuccess]);
+  const googleLogin$1 = useCallback(async (idToken) => {
+    setAuthLoading(true);
+    setAuthProviderError(null);
+    try {
+      const response = await googleLogin(idToken);
+      await handleAuthSuccess(response.user, response.tokens);
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    } finally {
+      setAuthLoading(false);
+    }
+  }, [handleAuthSuccess]);
+  const signOut = useCallback(async () => {
+    try {
+      if (tokensRef.current) {
+        await logout(tokensRef.current.refreshToken);
+      }
+    } catch (error) {
+      console.error("Logout error:", error);
+    } finally {
+      clearSessionAndSignOut();
+    }
+  }, [clearSessionAndSignOut]);
+  const skipLogin = useCallback(() => {
+    setLoginSkipped(true);
+    setUser(null);
+  }, []);
+  const forgotPassword$1 = useCallback(async (email) => {
+    setAuthLoading(true);
+    setAuthProviderError(null);
+    try {
+      await forgotPassword(email);
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    } finally {
+      setAuthLoading(false);
+    }
+  }, []);
+  const resetPassword$1 = useCallback(async (token, password) => {
+    setAuthLoading(true);
+    setAuthProviderError(null);
+    try {
+      await resetPassword(token, password);
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    } finally {
+      setAuthLoading(false);
+    }
+  }, []);
+  const changePassword$1 = useCallback(async (oldPassword, newPassword) => {
+    setAuthLoading(true);
+    setAuthProviderError(null);
+    try {
+      if (!tokensRef.current) {
+        throw new Error("User is not logged in");
+      }
+      await changePassword(tokensRef.current.accessToken, oldPassword, newPassword);
+      clearSessionAndSignOut();
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    } finally {
+      setAuthLoading(false);
+    }
+  }, [clearSessionAndSignOut]);
+  const updateProfile$1 = useCallback(async (displayName, photoURL) => {
+    setAuthLoading(true);
+    setAuthProviderError(null);
+    try {
+      if (!tokensRef.current) {
+        throw new Error("User is not logged in");
+      }
+      const response = await updateProfile(tokensRef.current.accessToken, displayName, photoURL);
+      let convertedUser = convertToUser(response.user);
+      if (defineRolesFor) {
+        const customRoles = await defineRolesFor(convertedUser);
+        if (customRoles) {
+          convertedUser = { ...convertedUser, roles: customRoles.map((r) => r.id) };
+        }
+      }
+      const storedData = loadAuthFromStorage();
+      if (storedData) {
+        saveAuthToStorage(storedData.tokens, response.user);
+      }
+      setUser(convertedUser);
+      return convertedUser;
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    } finally {
+      setAuthLoading(false);
+    }
+  }, [defineRolesFor]);
+  const fetchSessions$1 = useCallback(async () => {
+    try {
+      if (!tokensRef.current) {
+        throw new Error("User is not logged in");
+      }
+      const response = await fetchSessions(tokensRef.current.accessToken, tokensRef.current.refreshToken);
+      return response.sessions;
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    }
+  }, []);
+  const revokeSession$1 = useCallback(async (sessionId) => {
+    try {
+      if (!tokensRef.current) {
+        throw new Error("User is not logged in");
+      }
+      await revokeSession(tokensRef.current.accessToken, sessionId);
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    }
+  }, []);
+  useEffect(() => {
+    isMountedRef.current = true;
+    const restoreAuth = async () => {
+      try {
+        const config = await fetchAuthConfig();
+        if (isMountedRef.current) {
+          setAuthConfig(config);
+        }
+      } catch (e) {
+      }
+      const stored = loadAuthFromStorage();
+      if (!stored) {
+        setInitialLoading(false);
+        return;
+      }
+      if (!stored.tokens?.refreshToken) {
+        clearAuthFromStorage();
+        setInitialLoading(false);
+        return;
+      }
+      const expiresAt = stored.tokens.accessTokenExpiresAt;
+      if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
+        clearAuthFromStorage();
+        setInitialLoading(false);
+        return;
+      }
+      if (!isTokenExpiredOrNearExpiry(stored.tokens.accessTokenExpiresAt)) {
+        tokensRef.current = stored.tokens;
+        let userToSet = convertToUser(stored.user);
+        if (defineRolesFor) {
+          const customRoles = await defineRolesFor(userToSet);
+          if (customRoles) {
+            userToSet = { ...userToSet, roles: customRoles.map((r) => r.id) };
+          }
+        }
+        setUser(userToSet);
+        scheduleTokenRefresh(stored.tokens);
+        setInitialLoading(false);
+        return;
+      }
+      tokensRef.current = stored.tokens;
+      try {
+        const newTokens = await refreshAccessToken$1();
+        if (!newTokens) {
+          clearAuthFromStorage();
+          tokensRef.current = null;
+          setInitialLoading(false);
+          return;
+        }
+        if (!isMountedRef.current) return;
+        let userToSet;
+        try {
+          const meResponse = await getCurrentUser(newTokens.accessToken);
+          if (!isMountedRef.current) return;
+          const freshUserInfo = meResponse.user;
+          saveAuthToStorage(newTokens, freshUserInfo);
+          userToSet = convertToUser(freshUserInfo);
+          if (defineRolesFor) {
+            const customRoles = await defineRolesFor(userToSet);
+            if (!isMountedRef.current) return;
+            if (customRoles) {
+              userToSet = { ...userToSet, roles: customRoles.map((r) => r.id) };
+            }
+          }
+        } catch (meError) {
+          if (!isMountedRef.current) return;
+          userToSet = convertToUser(stored.user);
+        }
+        if (!isMountedRef.current) return;
+        setUser(userToSet);
+        scheduleTokenRefresh(newTokens);
+      } catch (error) {
+        if (!isMountedRef.current) return;
+        if (!(error instanceof Error && error.code === "NETWORK_ERROR")) {
+          clearAuthFromStorage();
+          tokensRef.current = null;
+        }
+      } finally {
+        if (isMountedRef.current) {
+          setInitialLoading(false);
+        }
+      }
+    };
+    restoreAuth();
+    return () => {
+      isMountedRef.current = false;
+    };
+  }, [scheduleTokenRefresh, defineRolesFor, refreshAccessToken$1]);
+  useEffect(() => {
+    const handleVisibilityChange = async () => {
+      if (initialLoading) return;
+      if (document.visibilityState === "visible" && tokensRef.current) {
+        if (isTokenExpiredOrNearExpiry(tokensRef.current.accessTokenExpiresAt)) {
+          try {
+            const newTokens = await refreshAccessToken$1();
+            if (newTokens && isMountedRef.current) {
+              scheduleTokenRefresh(newTokens);
+            } else if (!newTokens && isMountedRef.current) {
+              clearSessionAndSignOut();
+            }
+          } catch (error) {
+          }
+        }
+      }
+    };
+    document.addEventListener("visibilitychange", handleVisibilityChange);
+    return () => {
+      document.removeEventListener("visibilitychange", handleVisibilityChange);
+    };
+  }, [initialLoading, refreshAccessToken$1, scheduleTokenRefresh, clearSessionAndSignOut]);
+  const getApiUrl$1 = useCallback(() => {
+    return getApiUrl();
+  }, []);
+  useEffect(() => {
+    return () => {
+      isMountedRef.current = false;
+      if (refreshTimeoutRef.current) {
+        clearTimeout(refreshTimeoutRef.current);
+      }
+    };
+  }, []);
+  const revokeAllSessions$1 = useCallback(async () => {
+    try {
+      if (!tokensRef.current) {
+        throw new Error("User is not logged in");
+      }
+      await revokeAllSessions(tokensRef.current.accessToken);
+      clearSessionAndSignOut();
+    } catch (error) {
+      setAuthProviderError(error);
+      throw error;
+    }
+  }, [clearSessionAndSignOut]);
+  return {
+    user,
+    authLoading,
+    initialLoading,
+    authError,
+    authProviderError,
+    loginSkipped,
+    needsSetup: authConfig?.needsSetup ?? false,
+    registrationEnabled: authConfig?.registrationEnabled ?? false,
+    getAuthToken,
+    getApiUrl: getApiUrl$1,
+    signOut,
+    emailPasswordLogin,
+    register: register$1,
+    googleLogin: googleLogin$1,
+    skipLogin,
+    forgotPassword: forgotPassword$1,
+    resetPassword: resetPassword$1,
+    changePassword: changePassword$1,
+    updateProfile: updateProfile$1,
+    fetchSessions: fetchSessions$1,
+    revokeSession: revokeSession$1,
+    revokeAllSessions: revokeAllSessions$1,
+    extra,
+    setExtra
+  };
+}
+function convertUser(apiUser) {
+  return {
+    uid: apiUser.uid,
+    email: apiUser.email,
+    displayName: apiUser.displayName || null,
+    photoURL: apiUser.photoURL || null,
+    providerId: "custom",
+    isAnonymous: false,
+    roles: apiUser.roles
+  };
+}
+function convertRole(apiRole) {
+  return {
+    id: apiRole.id,
+    name: apiRole.name,
+    isAdmin: apiRole.isAdmin ?? false,
+    config: apiRole.config ?? void 0
+  };
+}
+function useBackendUserManagement(config) {
+  const { apiUrl, getAuthToken, currentUser } = config;
+  const [users, setUsers] = useState([]);
+  const [roles, setRoles] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [usersError, setUsersError] = useState();
+  const [rolesError, setRolesError] = useState();
+  const apiRequest = useCallback(async (endpoint, method = "GET", body, retryCount = 6, signal) => {
+    let lastError = null;
+    for (let attempt = 0; attempt < retryCount; attempt++) {
+      if (signal?.aborted) {
+        const error = new Error("Request aborted");
+        error.name = "AbortError";
+        throw error;
+      }
+      try {
+        const token = await getAuthToken();
+        const response = await fetch(`${apiUrl}/api/admin${endpoint}`, {
+          method,
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${token}`
+          },
+          body: body ? JSON.stringify(body) : void 0,
+          signal
+        });
+        if (!response.ok) {
+          const errorText = await response.text();
+          let errorMessage = "API request failed";
+          try {
+            const errorJson = JSON.parse(errorText);
+            errorMessage = errorJson.error?.message || errorMessage;
+          } catch (e) {
+            errorMessage = errorText || `HTTP error ${response.status}`;
+          }
+          const error = Object.assign(new Error(errorMessage), { status: response.status });
+          throw error;
+        }
+        return await response.json();
+      } catch (error) {
+        if (error instanceof Error && error.name === "AbortError" || signal?.aborted) {
+          throw error;
+        }
+        lastError = error instanceof Error ? error : new Error(String(error));
+        const isNetworkError = error instanceof TypeError;
+        const isServerError = typeof error.status === "number" && error.status >= 500 && error.status < 600;
+        if (attempt < retryCount - 1 && (isNetworkError || isServerError)) {
+          const delay = Math.min(1e3 * Math.pow(2, attempt), 5e3);
+          console.warn(`Admin API request to ${endpoint} failed, retrying in ${delay}ms...`);
+          await new Promise((resolve, reject) => {
+            if (signal?.aborted) return reject(new Error("AbortError"));
+            const timer = setTimeout(resolve, delay);
+            if (signal) {
+              signal.addEventListener("abort", () => {
+                clearTimeout(timer);
+                reject(new Error("AbortError"));
+              }, { once: true });
+            }
+          }).catch(() => {
+          });
+          if (signal?.aborted) {
+            const abortError = new Error("Request aborted");
+            abortError.name = "AbortError";
+            throw abortError;
+          }
+          continue;
+        }
+        console.error("Admin API error after retries:", error);
+        throw error;
+      }
+    }
+    throw lastError;
+  }, [apiUrl, getAuthToken]);
+  const loadUsers = useCallback(async (signal) => {
+    try {
+      const data = await apiRequest("/users", "GET", void 0, 6, signal);
+      setUsers(data.users.map((u) => convertUser(u)));
+      setUsersError(void 0);
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") return;
+      console.error("Failed to load users:", error);
+      setUsersError(error instanceof Error ? error : new Error(String(error)));
+    }
+  }, [apiRequest]);
+  useCallback(async (signal) => {
+    try {
+      const data = await apiRequest("/roles", "GET", void 0, 6, signal);
+      setRoles(data.roles.map(convertRole));
+      setRolesError(void 0);
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") return;
+      console.error("Failed to load roles:", error);
+      setRolesError(error instanceof Error ? error : new Error(String(error)));
+    }
+  }, [apiRequest]);
+  useEffect(() => {
+    if (!currentUser) {
+      setLoading(false);
+      return;
+    }
+    const abortController = new AbortController();
+    const load = async () => {
+      setLoading(true);
+      let loadedRoles = [];
+      try {
+        const data = await apiRequest("/roles", "GET", void 0, 6, abortController.signal);
+        loadedRoles = data.roles.map(convertRole);
+        setRoles(loadedRoles);
+        setRolesError(void 0);
+      } catch (error) {
+        if (error instanceof Error && error.name !== "AbortError") {
+          console.error("Failed to load roles:", error);
+          setRolesError(error);
+        }
+      }
+      if (!abortController.signal.aborted) {
+        await loadUsers(abortController.signal);
+      }
+      if (!abortController.signal.aborted) {
+        setLoading(false);
+      }
+    };
+    load();
+    return () => {
+      abortController.abort();
+    };
+  }, [currentUser, apiRequest, loadUsers]);
+  const saveUser = useCallback(async (user) => {
+    const roleIds = user.roles ?? [];
+    const existingUser = users.find((u) => u.uid === user.uid);
+    if (existingUser) {
+      const data = await apiRequest(`/users/${user.uid}`, "PUT", {
+        email: user.email,
+        displayName: user.displayName,
+        roles: roleIds
+      });
+      const updated = convertUser(data.user);
+      setUsers((prev) => prev.map((u) => u.uid === updated.uid ? updated : u));
+      return updated;
+    } else {
+      const data = await apiRequest("/users", "POST", {
+        email: user.email,
+        displayName: user.displayName,
+        roles: roleIds
+      });
+      const created = convertUser(data.user);
+      setUsers((prev) => [...prev, created]);
+      return created;
+    }
+  }, [apiRequest, users, roles]);
+  const deleteUser = useCallback(async (user) => {
+    await apiRequest(`/users/${user.uid}`, "DELETE");
+    setUsers((prev) => prev.filter((u) => u.uid !== user.uid));
+  }, [apiRequest]);
+  const saveRole = useCallback(async (role) => {
+    const existingRole = roles.find((r) => r.id === role.id);
+    if (existingRole) {
+      const data = await apiRequest(`/roles/${role.id}`, "PUT", {
+        name: role.name,
+        isAdmin: role.isAdmin,
+        config: role.config
+      });
+      const updated = convertRole(data.role);
+      setRoles((prev) => prev.map((r) => r.id === updated.id ? updated : r));
+    } else {
+      const data = await apiRequest("/roles", "POST", {
+        id: role.id,
+        name: role.name,
+        isAdmin: role.isAdmin ?? false,
+        config: role.config
+      });
+      const created = convertRole(data.role);
+      setRoles((prev) => [...prev, created]);
+    }
+  }, [apiRequest, roles]);
+  const deleteRole = useCallback(async (role) => {
+    await apiRequest(`/roles/${role.id}`, "DELETE");
+    setRoles((prev) => prev.filter((r) => r.id !== role.id));
+  }, [apiRequest]);
+  const getUser = useCallback((uid) => {
+    return users.find((u) => u.uid === uid) ?? null;
+  }, [users]);
+  const defineRolesFor = useCallback(async (user) => {
+    const existingUser = users.find((u) => u.uid === user.uid || u.email === user.email);
+    if (!existingUser) return void 0;
+    const userRoleIds = existingUser.roles ?? [];
+    return roles.filter((r) => userRoleIds.includes(r.id));
+  }, [users, roles]);
+  const isAdmin = currentUser?.roles?.includes("admin") ?? false;
+  const bootstrapAdmin = useCallback(async () => {
+    try {
+      await apiRequest("/bootstrap", "POST");
+      const data = await apiRequest("/roles");
+      const loadedRoles = data.roles.map(convertRole);
+      setRoles(loadedRoles);
+      await loadUsers();
+    } catch (error) {
+      console.error("Failed to bootstrap admin:", error);
+      throw error;
+    }
+  }, [apiRequest, loadUsers]);
+  return {
+    loading,
+    users,
+    saveUser,
+    deleteUser,
+    roles,
+    saveRole,
+    deleteRole,
+    isAdmin,
+    allowDefaultRolesCreation: true,
+    includeCollectionConfigPermissions: true,
+    defineRolesFor,
+    getUser,
+    usersError,
+    rolesError,
+    bootstrapAdmin
+  };
+}
+function RebaseLoginView({
+  logo,
+  authController,
+  noUserComponent,
+  disableSignupScreen = false,
+  disabled = false,
+  notAllowedError,
+  googleEnabled = false,
+  googleClientId
+}) {
+  const modeState = useModeController();
+  const [registrationSelected, setRegistrationSelected] = useState(false);
+  const [passwordLoginSelected, setPasswordLoginSelected] = useState(false);
+  const [forgotPasswordSelected, setForgotPasswordSelected] = useState(false);
+  const isBootstrapMode = authController.needsSetup;
+  function buildErrorView() {
+    if (!authController.authProviderError) return null;
+    if (authController.user != null) return null;
+    return /* @__PURE__ */ jsx(ErrorView, { error: authController.authProviderError.message ?? authController.authProviderError });
+  }
+  let logoComponent;
+  if (logo) {
+    logoComponent = /* @__PURE__ */ jsx(
+      "img",
+      {
+        src: logo,
+        style: {
+          height: "100%",
+          width: "100%",
+          objectFit: "cover"
+        },
+        alt: "Logo"
+      }
+    );
+  } else {
+    logoComponent = /* @__PURE__ */ jsx(RebaseLogo, {});
+  }
+  let notAllowedMessage;
+  if (notAllowedError) {
+    if (typeof notAllowedError === "string") {
+      notAllowedMessage = notAllowedError;
+    } else if (notAllowedError instanceof Error) {
+      notAllowedMessage = notAllowedError.message;
+    } else {
+      notAllowedMessage = "It looks like you don't have access to the CMS, based on the specified Authenticator configuration";
+    }
+  }
+  return /* @__PURE__ */ jsx("div", { className: "flex flex-col justify-center items-center min-h-screen min-w-full p-2", children: /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center w-full max-w-md", children: [
+    /* @__PURE__ */ jsx("div", { className: `m-4 p-4 w-64 h-64`, children: logoComponent }),
+    notAllowedMessage && /* @__PURE__ */ jsx("div", { className: "p-4", children: /* @__PURE__ */ jsx(ErrorView, { error: notAllowedMessage }) }),
+    !forgotPasswordSelected && buildErrorView(),
+    isBootstrapMode && !authController.user && /* @__PURE__ */ jsx(
+      LoginForm,
+      {
+        authController,
+        registrationMode: true,
+        onClose: () => {
+        },
+        onForgotPassword: () => {
+        },
+        mode: modeState.mode,
+        noUserComponent,
+        disableSignupScreen: false,
+        bootstrapMode: true
+      }
+    ),
+    !isBootstrapMode && !passwordLoginSelected && !registrationSelected && !forgotPasswordSelected && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx(
+        LoginButton,
+        {
+          disabled,
+          text: "Email/password",
+          icon: /* @__PURE__ */ jsx(MailIcon, {}),
+          onClick: () => {
+            setRegistrationSelected(false);
+            setPasswordLoginSelected(true);
+            setForgotPasswordSelected(false);
+          }
+        }
+      ),
+      googleEnabled && googleClientId && /* @__PURE__ */ jsx(
+        GoogleLoginButton,
+        {
+          disabled,
+          googleClientId,
+          authController
+        }
+      ),
+      !disableSignupScreen && authController.registrationEnabled && /* @__PURE__ */ jsx(
+        LoginButton,
+        {
+          disabled,
+          text: "Create account",
+          icon: /* @__PURE__ */ jsx(MailIcon, {}),
+          onClick: () => {
+            setRegistrationSelected(true);
+            setPasswordLoginSelected(false);
+            setForgotPasswordSelected(false);
+          }
+        }
+      )
+    ] }),
+    !isBootstrapMode && (passwordLoginSelected || registrationSelected) && !forgotPasswordSelected && /* @__PURE__ */ jsx(
+      LoginForm,
+      {
+        authController,
+        registrationMode: registrationSelected,
+        onClose: () => {
+          setRegistrationSelected(false);
+          setPasswordLoginSelected(false);
+        },
+        onForgotPassword: () => {
+          setForgotPasswordSelected(true);
+          setPasswordLoginSelected(false);
+        },
+        mode: modeState.mode,
+        noUserComponent,
+        disableSignupScreen
+      }
+    ),
+    forgotPasswordSelected && /* @__PURE__ */ jsx(
+      ForgotPasswordForm,
+      {
+        authController,
+        onClose: () => {
+          setForgotPasswordSelected(false);
+          setPasswordLoginSelected(true);
+        }
+      }
+    )
+  ] }) });
+}
+function LoginButton({
+  icon,
+  onClick,
+  text,
+  disabled
+}) {
+  return /* @__PURE__ */ jsx("div", { className: "m-2 w-full", children: /* @__PURE__ */ jsx(
+    Button,
+    {
+      disabled,
+      className: `w-full`,
+      onClick,
+      children: /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-center p-2 w-full h-8", children: [
+        /* @__PURE__ */ jsx("div", { className: "flex flex-col items-center justify-center w-8", children: icon }),
+        /* @__PURE__ */ jsx("div", { className: "grow pl-2 text-center", children: text })
+      ] })
+    }
+  ) });
+}
+function GoogleLoginButton({
+  disabled,
+  googleClientId,
+  authController
+}) {
+  const handleGoogleLogin = async () => {
+    try {
+      const google = window.google;
+      if (!google) {
+        console.error("Google Sign-In not loaded");
+        return;
+      }
+      google.accounts.id.initialize({
+        client_id: googleClientId,
+        callback: async (response) => {
+          try {
+            await authController.googleLogin(response.credential);
+          } catch (err) {
+            console.error("Google login error:", err);
+          }
+        }
+      });
+      google.accounts.id.prompt();
+    } catch (err) {
+      console.error("Google login error:", err);
+    }
+  };
+  return /* @__PURE__ */ jsx("div", { className: "m-2 w-full", children: /* @__PURE__ */ jsx(
+    Button,
+    {
+      disabled,
+      className: `w-full`,
+      onClick: handleGoogleLogin,
+      children: /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-center p-2 w-full h-8", children: [
+        /* @__PURE__ */ jsx("div", { className: "flex flex-col items-center justify-center w-8", children: /* @__PURE__ */ jsxs("svg", { viewBox: "0 0 24 24", width: "24", height: "24", children: [
+          /* @__PURE__ */ jsx(
+            "path",
+            {
+              fill: "currentColor",
+              d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
+            }
+          ),
+          /* @__PURE__ */ jsx(
+            "path",
+            {
+              fill: "currentColor",
+              d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
+            }
+          ),
+          /* @__PURE__ */ jsx(
+            "path",
+            {
+              fill: "currentColor",
+              d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"
+            }
+          ),
+          /* @__PURE__ */ jsx(
+            "path",
+            {
+              fill: "currentColor",
+              d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
+            }
+          )
+        ] }) }),
+        /* @__PURE__ */ jsx("div", { className: "grow pl-2 text-center", children: "Continue with Google" })
+      ] })
+    }
+  ) });
+}
+function LoginForm({
+  onClose,
+  onForgotPassword,
+  authController,
+  mode,
+  registrationMode,
+  noUserComponent,
+  disableSignupScreen,
+  bootstrapMode = false
+}) {
+  const passwordRef = useRef(null);
+  const [email, setEmail] = useState();
+  const [password, setPassword] = useState();
+  const [displayName, setDisplayName] = useState();
+  useEffect(() => {
+    if (!document) return;
+    const escFunction = (event) => {
+      if (event.keyCode === 27) {
+        onClose();
+      }
+    };
+    document.addEventListener("keydown", escFunction, false);
+    return () => {
+      document.removeEventListener("keydown", escFunction, false);
+    };
+  }, [onClose]);
+  function handleEnterPassword() {
+    if (email && password) {
+      authController.emailPasswordLogin(email, password);
+    }
+  }
+  function handleRegistration() {
+    if (email && password) {
+      authController.register(email, password, displayName);
+    }
+  }
+  const onBackPressed = () => {
+    onClose();
+  };
+  const handleSubmit = (event) => {
+    event.preventDefault();
+    if (registrationMode)
+      handleRegistration();
+    else
+      handleEnterPassword();
+  };
+  const label = bootstrapMode ? "Welcome! Create your admin account" : registrationMode ? "Create a new account" : "Enter your email and password";
+  const button = registrationMode ? "Create account" : "Login";
+  return /* @__PURE__ */ jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col items-center w-full max-w-[500px] gap-2", children: [
+    !bootstrapMode && /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(IconButton, { onClick: onBackPressed, children: /* @__PURE__ */ jsx(ArrowBackIcon, {}) }) }),
+    /* @__PURE__ */ jsx("div", { className: "flex justify-center w-full py-2", children: /* @__PURE__ */ jsx(Typography, { align: "center", variant: bootstrapMode ? "subtitle1" : "subtitle2", children: label }) }),
+    bootstrapMode && /* @__PURE__ */ jsx(Typography, { variant: "body2", className: "text-gray-500 text-center mb-2", children: "No users found. Create the first account to get started. This account will have admin privileges." }),
+    registrationMode && /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(
+      TextField,
+      {
+        placeholder: "Display Name (optional)",
+        className: "w-full",
+        value: displayName ?? "",
+        disabled: authController.initialLoading,
+        type: "text",
+        onChange: (event) => setDisplayName(event.target.value)
+      }
+    ) }),
+    /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(
+      TextField,
+      {
+        placeholder: "Email",
+        className: "w-full",
+        autoFocus: true,
+        value: email ?? "",
+        disabled: authController.initialLoading,
+        type: "email",
+        onChange: (event) => setEmail(event.target.value)
+      }
+    ) }),
+    /* @__PURE__ */ jsx("div", { className: "w-full", children: registrationMode && noUserComponent }),
+    /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(
+      TextField,
+      {
+        placeholder: "Password",
+        className: "w-full",
+        value: password ?? "",
+        disabled: authController.initialLoading,
+        inputRef: passwordRef,
+        type: "password",
+        onChange: (event) => setPassword(event.target.value)
+      }
+    ) }),
+    registrationMode && /* @__PURE__ */ jsx(Typography, { variant: "caption", className: "text-gray-500 text-sm", children: "Password: 8+ chars, uppercase, lowercase, number" }),
+    !registrationMode && /* @__PURE__ */ jsx("div", { className: "w-full text-right", children: /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "button",
+        className: "text-sm text-blue-600 hover:text-blue-800 hover:underline",
+        onClick: onForgotPassword,
+        children: "Forgot password?"
+      }
+    ) }),
+    /* @__PURE__ */ jsxs("div", { className: "flex justify-end items-center w-full gap-2", children: [
+      authController.authLoading && /* @__PURE__ */ jsx(CircularProgress, {}),
+      /* @__PURE__ */ jsx(Button, { type: "submit", disabled: authController.authLoading, children: button })
+    ] })
+  ] });
+}
+function ForgotPasswordForm({
+  onClose,
+  authController
+}) {
+  const [email, setEmail] = useState("");
+  const [submitted, setSubmitted] = useState(false);
+  const [error, setError] = useState(null);
+  useEffect(() => {
+    if (!document) return;
+    const escFunction = (event) => {
+      if (event.keyCode === 27) {
+        onClose();
+      }
+    };
+    document.addEventListener("keydown", escFunction, false);
+    return () => {
+      document.removeEventListener("keydown", escFunction, false);
+    };
+  }, [onClose]);
+  const handleSubmit = async (event) => {
+    event.preventDefault();
+    setError(null);
+    if (!email) {
+      setError("Please enter your email address");
+      return;
+    }
+    try {
+      await authController.forgotPassword(email);
+      setSubmitted(true);
+    } catch (err) {
+      if (err instanceof Error && err.code === "EMAIL_NOT_CONFIGURED") {
+        setError("Password reset is not available. Please contact your administrator.");
+      } else {
+        setSubmitted(true);
+      }
+    }
+  };
+  if (submitted) {
+    return /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center w-full max-w-[500px] gap-4 p-4", children: [
+      /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(IconButton, { onClick: onClose, children: /* @__PURE__ */ jsx(ArrowBackIcon, {}) }) }),
+      /* @__PURE__ */ jsxs("div", { className: "text-center", children: [
+        /* @__PURE__ */ jsx(Typography, { variant: "subtitle1", className: "mb-4", children: "Check your email" }),
+        /* @__PURE__ */ jsxs(Typography, { variant: "body2", className: "text-gray-600", children: [
+          "If an account exists for ",
+          /* @__PURE__ */ jsx("strong", { children: email }),
+          ", you'll receive a password reset link shortly."
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx(Button, { onClick: onClose, className: "mt-4", children: "Back to login" })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs("form", { onSubmit: handleSubmit, className: "flex flex-col items-center w-full max-w-[500px] gap-2", children: [
+    /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(IconButton, { onClick: onClose, children: /* @__PURE__ */ jsx(ArrowBackIcon, {}) }) }),
+    /* @__PURE__ */ jsx("div", { className: "flex justify-center w-full py-2", children: /* @__PURE__ */ jsx(Typography, { align: "center", variant: "subtitle2", children: "Reset your password" }) }),
+    /* @__PURE__ */ jsx(Typography, { variant: "body2", className: "text-gray-600 text-center mb-2", children: "Enter your email address and we'll send you a link to reset your password." }),
+    error && /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(ErrorView, { error }) }),
+    /* @__PURE__ */ jsx("div", { className: "w-full", children: /* @__PURE__ */ jsx(
+      TextField,
+      {
+        placeholder: "Email",
+        className: "w-full",
+        autoFocus: true,
+        value: email,
+        type: "email",
+        onChange: (event) => setEmail(event.target.value)
+      }
+    ) }),
+    /* @__PURE__ */ jsxs("div", { className: "flex justify-end items-center w-full gap-2 mt-2", children: [
+      authController.authLoading && /* @__PURE__ */ jsx(CircularProgress, {}),
+      /* @__PURE__ */ jsx(Button, { type: "submit", disabled: authController.authLoading || !email, children: "Send reset link" })
+    ] })
+  ] });
+}
+function createUserManagementAdminViews({ userManagement, apiUrl, getAuthToken }) {
+  return [
+    {
+      slug: "dev/users",
+      name: "CMS Users",
+      group: "Admin",
+      icon: "face",
+      view: /* @__PURE__ */ jsx(UsersView, { userManagement, apiUrl, getAuthToken })
+    },
+    {
+      slug: "dev/roles",
+      name: "Roles",
+      group: "Admin",
+      icon: "gpp_good",
+      view: /* @__PURE__ */ jsx(RolesView, { userManagement })
+    }
+  ];
+}
+function RoleChip({ role }) {
+  let colorScheme;
+  if (role.isAdmin) {
+    colorScheme = "blueDarker";
+  } else if (role.id === "editor") {
+    colorScheme = "yellowLight";
+  } else if (role.id === "viewer") {
+    colorScheme = "grayLight";
+  } else {
+    colorScheme = getColorSchemeForSeed(role.id);
+  }
+  return /* @__PURE__ */ jsx(Chip, { colorScheme, children: role.name }, role.id);
+}
+function UsersView({ userManagement, apiUrl, getAuthToken }) {
+  const { users, roles, saveUser, deleteUser, loading } = userManagement;
+  const snackbarController = useSnackbarController();
+  const { user: loggedInUser } = useAuthController();
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const [selectedUser, setSelectedUser] = useState();
+  const [deleteConfirmOpen, setDeleteConfirmOpen] = useState(false);
+  const [userToDelete, setUserToDelete] = useState();
+  const [deleteInProgress, setDeleteInProgress] = useState(false);
+  const [formKey, setFormKey] = useState(0);
+  const [bootstrapping, setBootstrapping] = useState(false);
+  const hasAdmin = users.some((u) => u.roles?.includes("admin"));
+  const handleBootstrap = async () => {
+    setBootstrapping(true);
+    try {
+      const token = await getAuthToken();
+      const response = await fetch(`${apiUrl}/api/admin/bootstrap`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${token}`
+        }
+      });
+      const data = await response.json();
+      if (!response.ok) {
+        throw new Error(data.error?.message || "Bootstrap failed");
+      }
+      snackbarController.open({ type: "success", message: "You are now an admin! Refreshing..." });
+      window.location.reload();
+    } catch (error) {
+      snackbarController.open({ type: "error", message: error instanceof Error ? error.message : "Failed to bootstrap admin" });
+    } finally {
+      setBootstrapping(false);
+    }
+  };
+  const handleAddUser = () => {
+    setSelectedUser(void 0);
+    setFormKey((k) => k + 1);
+    setDialogOpen(true);
+  };
+  const handleEditUser = (user) => {
+    setSelectedUser(user);
+    setDialogOpen(true);
+  };
+  const handleClose = () => {
+    setDialogOpen(false);
+    setSelectedUser(void 0);
+  };
+  const handleDelete = async () => {
+    if (!userToDelete) return;
+    setDeleteInProgress(true);
+    try {
+      await deleteUser(userToDelete);
+      snackbarController.open({ type: "success", message: "User deleted successfully" });
+      setDeleteConfirmOpen(false);
+      setUserToDelete(void 0);
+    } catch (error) {
+      snackbarController.open({ type: "error", message: error instanceof Error ? error.message : "Error deleting user" });
+    } finally {
+      setDeleteInProgress(false);
+    }
+  };
+  if (loading) {
+    return /* @__PURE__ */ jsx(CenteredView, { children: /* @__PURE__ */ jsx(CircularProgress, {}) });
+  }
+  return /* @__PURE__ */ jsxs(Container, { className: "w-full flex flex-col py-4 gap-4", maxWidth: "6xl", children: [
+    !hasAdmin && loggedInUser && /* @__PURE__ */ jsxs("div", { className: "bg-yellow-100 dark:bg-yellow-900 border border-yellow-400 dark:border-yellow-700 rounded p-4 flex items-center justify-between", children: [
+      /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(Typography, { variant: "label", className: "text-yellow-800 dark:text-yellow-200", children: "No admin users exist. You can make yourself an admin." }) }),
+      /* @__PURE__ */ jsx(
+        Button,
+        {
+          onClick: handleBootstrap,
+          disabled: bootstrapping,
+          children: bootstrapping ? /* @__PURE__ */ jsx(CircularProgress, { size: "small" }) : "Make me admin"
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxs("div", { className: "flex items-center mt-12", children: [
+      /* @__PURE__ */ jsx(Typography, { gutterBottom: true, variant: "h4", className: "grow", component: "h4", children: "Users" }),
+      /* @__PURE__ */ jsx(Button, { startIcon: /* @__PURE__ */ jsx(AddIcon, {}), onClick: handleAddUser, children: "Add user" })
+    ] }),
+    /* @__PURE__ */ jsx("div", { className: "overflow-auto", children: /* @__PURE__ */ jsxs(Table, { className: "w-full", children: [
+      /* @__PURE__ */ jsxs(TableHeader, { children: [
+        /* @__PURE__ */ jsx(TableCell, { header: true, className: "truncate w-16" }),
+        /* @__PURE__ */ jsx(TableCell, { header: true, children: "Email" }),
+        /* @__PURE__ */ jsx(TableCell, { header: true, children: "Name" }),
+        /* @__PURE__ */ jsx(TableCell, { header: true, children: "Roles" })
+      ] }),
+      /* @__PURE__ */ jsxs(TableBody, { children: [
+        users.map((user) => /* @__PURE__ */ jsxs(TableRow, { onClick: () => handleEditUser(user), children: [
+          /* @__PURE__ */ jsx(TableCell, { style: { width: "64px" }, children: /* @__PURE__ */ jsx(Tooltip, { asChild: true, title: "Delete this user", children: /* @__PURE__ */ jsx(
+            IconButton,
+            {
+              size: "small",
+              onClick: (e) => {
+                e.stopPropagation();
+                setUserToDelete(user);
+                setDeleteConfirmOpen(true);
+              },
+              children: /* @__PURE__ */ jsx(DeleteIcon, {})
+            }
+          ) }) }),
+          /* @__PURE__ */ jsx(TableCell, { children: user.email }),
+          /* @__PURE__ */ jsx(TableCell, { className: "font-medium", children: user.displayName }),
+          /* @__PURE__ */ jsx(TableCell, { children: /* @__PURE__ */ jsx("div", { className: "flex flex-wrap gap-2", children: user.roles?.map((roleId) => {
+            const role = roles.find((r) => r.id === roleId);
+            return role ? /* @__PURE__ */ jsx(RoleChip, { role }, roleId) : /* @__PURE__ */ jsx("span", { children: roleId }, roleId);
+          }) }) })
+        ] }, user.uid)),
+        users.length === 0 && /* @__PURE__ */ jsx(TableRow, { children: /* @__PURE__ */ jsx(TableCell, { colspan: 4, children: /* @__PURE__ */ jsx(CenteredView, { className: "flex flex-col gap-4 my-8 items-center", children: /* @__PURE__ */ jsx(Typography, { variant: "label", children: "There are no users yet" }) }) }) })
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx(
+      UserDetailsForm,
+      {
+        open: dialogOpen,
+        user: selectedUser,
+        roles,
+        saveUser,
+        handleClose
+      },
+      selectedUser?.uid ?? `new-${formKey}`
+    ),
+    /* @__PURE__ */ jsx(
+      ConfirmationDialog,
+      {
+        open: deleteConfirmOpen,
+        loading: deleteInProgress,
+        onAccept: handleDelete,
+        onCancel: () => {
+          setDeleteConfirmOpen(false);
+          setUserToDelete(void 0);
+        },
+        title: /* @__PURE__ */ jsx(Fragment, { children: "Delete?" }),
+        body: /* @__PURE__ */ jsx(Fragment, { children: "Are you sure you want to delete this user?" })
+      }
+    )
+  ] });
+}
+function UserDetailsForm({
+  open,
+  user: userProp,
+  roles,
+  saveUser,
+  handleClose
+}) {
+  const snackbarController = useSnackbarController();
+  const isNewUser = !userProp;
+  const [displayName, setDisplayName] = useState(userProp?.displayName || "");
+  const [email, setEmail] = useState(userProp?.email || "");
+  const [selectedRoleIds, setSelectedRoleIds] = useState(
+    userProp?.roles || ["editor"]
+  );
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [errors, setErrors] = useState({});
+  const [submitCount, setSubmitCount] = useState(0);
+  const validate = () => {
+    const newErrors = {};
+    if (!displayName) newErrors.displayName = "Required";
+    if (!email) newErrors.email = "Required";
+    else if (!/\S+@\S+\.\S+/.test(email)) newErrors.email = "Invalid email";
+    if (selectedRoleIds.length === 0) newErrors.roles = "At least one role is required";
+    setErrors(newErrors);
+    return Object.keys(newErrors).length === 0;
+  };
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setSubmitCount((c) => c + 1);
+    if (!validate()) return;
+    setIsSubmitting(true);
+    try {
+      const userToSave = {
+        uid: userProp?.uid || crypto.randomUUID(),
+        email,
+        displayName: displayName || null,
+        photoURL: userProp?.photoURL || null,
+        providerId: "custom",
+        isAnonymous: false,
+        roles: selectedRoleIds
+      };
+      await saveUser(userToSave);
+      handleClose();
+    } catch (error) {
+      snackbarController.open({ type: "error", message: error instanceof Error ? error.message : "Failed to save user" });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+  const dirty = isNewUser || displayName !== (userProp?.displayName || "") || email !== (userProp?.email || "") || JSON.stringify(selectedRoleIds.sort()) !== JSON.stringify((userProp?.roles || []).sort());
+  return /* @__PURE__ */ jsx(Dialog, { open, onOpenChange: (open2) => !open2 ? handleClose() : void 0, maxWidth: "4xl", children: /* @__PURE__ */ jsxs(
+    "form",
+    {
+      onSubmit: handleSubmit,
+      autoComplete: "off",
+      noValidate: true,
+      style: { display: "flex", flexDirection: "column", position: "relative", height: "100%" },
+      children: [
+        /* @__PURE__ */ jsx(DialogTitle, { variant: "h4", gutterBottom: false, children: "User" }),
+        /* @__PURE__ */ jsx(DialogContent, { className: "h-full grow", children: /* @__PURE__ */ jsxs("div", { className: "grid grid-cols-12 gap-4", children: [
+          /* @__PURE__ */ jsxs("div", { className: "col-span-12", children: [
+            /* @__PURE__ */ jsx(
+              TextField,
+              {
+                name: "displayName",
+                required: true,
+                error: submitCount > 0 && Boolean(errors.displayName),
+                value: displayName,
+                onChange: (e) => setDisplayName(e.target.value),
+                label: "Name"
+              }
+            ),
+            /* @__PURE__ */ jsx(FieldCaption, { children: submitCount > 0 && errors.displayName ? errors.displayName : "Name of this user" })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "col-span-12", children: [
+            /* @__PURE__ */ jsx(
+              TextField,
+              {
+                required: true,
+                error: submitCount > 0 && Boolean(errors.email),
+                name: "email",
+                value: email,
+                onChange: (e) => setEmail(e.target.value),
+                label: "Email",
+                disabled: !isNewUser
+              }
+            ),
+            /* @__PURE__ */ jsx(FieldCaption, { children: submitCount > 0 && errors.email ? errors.email : "Email of this user" })
+          ] }),
+          /* @__PURE__ */ jsx("div", { className: "col-span-12", children: /* @__PURE__ */ jsx(
+            MultiSelect,
+            {
+              className: "w-full",
+              label: "Roles",
+              value: selectedRoleIds,
+              onValueChange: (value) => setSelectedRoleIds(value),
+              children: roles.map((role) => /* @__PURE__ */ jsx(MultiSelectItem, { value: role.id, children: /* @__PURE__ */ jsx(RoleChip, { role }) }, role.id))
+            }
+          ) })
+        ] }) }),
+        /* @__PURE__ */ jsxs(DialogActions, { children: [
+          /* @__PURE__ */ jsx(Button, { variant: "text", onClick: handleClose, children: "Cancel" }),
+          /* @__PURE__ */ jsx(
+            LoadingButton,
+            {
+              variant: "filled",
+              type: "submit",
+              disabled: !dirty,
+              loading: isSubmitting,
+              children: isNewUser ? "Create user" : "Update"
+            }
+          )
+        ] })
+      ]
+    }
+  ) });
+}
+function RolesView({ userManagement }) {
+  const { roles, saveRole, deleteRole, loading, allowDefaultRolesCreation } = userManagement;
+  const snackbarController = useSnackbarController();
+  const [dialogOpen, setDialogOpen] = useState(false);
+  const [selectedRole, setSelectedRole] = useState();
+  const [deleteConfirmOpen, setDeleteConfirmOpen] = useState(false);
+  const [roleToDelete, setRoleToDelete] = useState();
+  const [deleteInProgress, setDeleteInProgress] = useState(false);
+  const handleAddRole = () => {
+    setSelectedRole(void 0);
+    setDialogOpen(true);
+  };
+  const handleEditRole = (role) => {
+    setSelectedRole(role);
+    setDialogOpen(true);
+  };
+  const handleClose = () => {
+    setDialogOpen(false);
+    setSelectedRole(void 0);
+  };
+  const handleDelete = async () => {
+    if (!roleToDelete) return;
+    setDeleteInProgress(true);
+    try {
+      await deleteRole(roleToDelete);
+      snackbarController.open({ type: "success", message: "Role deleted successfully" });
+      setDeleteConfirmOpen(false);
+      setRoleToDelete(void 0);
+    } catch (error) {
+      snackbarController.open({ type: "error", message: error instanceof Error ? error.message : "Error deleting role" });
+    } finally {
+      setDeleteInProgress(false);
+    }
+  };
+  const createDefaultRoles = () => {
+    const defaultRoles = [
+      { id: "admin", name: "Admin", isAdmin: true },
+      { id: "editor", name: "Editor", isAdmin: false },
+      { id: "viewer", name: "Viewer", isAdmin: false }
+    ];
+    defaultRoles.forEach((role) => saveRole(role));
+  };
+  if (loading) {
+    return /* @__PURE__ */ jsx(CenteredView, { children: /* @__PURE__ */ jsx(CircularProgress, {}) });
+  }
+  return /* @__PURE__ */ jsxs(Container, { className: "w-full flex flex-col py-4 gap-4", maxWidth: "6xl", children: [
+    /* @__PURE__ */ jsxs("div", { className: "flex items-center mt-12", children: [
+      /* @__PURE__ */ jsx(Typography, { gutterBottom: true, variant: "h4", className: "grow", component: "h4", children: "Roles" }),
+      /* @__PURE__ */ jsx(Button, { startIcon: /* @__PURE__ */ jsx(AddIcon, {}), onClick: handleAddRole, children: "Add role" })
+    ] }),
+    /* @__PURE__ */ jsx("div", { className: "w-full overflow-auto", children: /* @__PURE__ */ jsxs(Table, { className: "w-full", children: [
+      /* @__PURE__ */ jsxs(TableHeader, { children: [
+        /* @__PURE__ */ jsx(TableCell, { header: true, className: "w-16" }),
+        /* @__PURE__ */ jsx(TableCell, { header: true, children: "Role" }),
+        /* @__PURE__ */ jsx(TableCell, { header: true, className: "items-center", children: "Is Admin" })
+      ] }),
+      /* @__PURE__ */ jsxs(TableBody, { children: [
+        roles.map((role) => {
+          return /* @__PURE__ */ jsxs(TableRow, { onClick: () => handleEditRole(role), children: [
+            /* @__PURE__ */ jsx(TableCell, { style: { width: "64px" }, children: !role.isAdmin && /* @__PURE__ */ jsx(Tooltip, { asChild: true, title: "Delete this role", children: /* @__PURE__ */ jsx(
+              IconButton,
+              {
+                size: "small",
+                onClick: (e) => {
+                  e.stopPropagation();
+                  setRoleToDelete(role);
+                  setDeleteConfirmOpen(true);
+                },
+                children: /* @__PURE__ */ jsx(DeleteIcon, {})
+              }
+            ) }) }),
+            /* @__PURE__ */ jsx(TableCell, { children: /* @__PURE__ */ jsx(RoleChip, { role }) }),
+            /* @__PURE__ */ jsx(TableCell, { className: "items-center", children: /* @__PURE__ */ jsx(Checkbox, { checked: role.isAdmin ?? false }) })
+          ] }, role.id);
+        }),
+        roles.length === 0 && /* @__PURE__ */ jsx(TableRow, { children: /* @__PURE__ */ jsx(TableCell, { colspan: 4, children: /* @__PURE__ */ jsxs(CenteredView, { className: "flex flex-col gap-4 my-8 items-center", children: [
+          /* @__PURE__ */ jsx(Typography, { variant: "label", children: "You don't have any roles yet." }),
+          allowDefaultRolesCreation && /* @__PURE__ */ jsx(Button, { onClick: createDefaultRoles, children: "Create default roles" })
+        ] }) }) })
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx(
+      RoleDetailsForm,
+      {
+        open: dialogOpen,
+        role: selectedRole,
+        saveRole,
+        handleClose
+      },
+      selectedRole?.id ?? "new"
+    ),
+    /* @__PURE__ */ jsx(
+      ConfirmationDialog,
+      {
+        open: deleteConfirmOpen,
+        loading: deleteInProgress,
+        onAccept: handleDelete,
+        onCancel: () => {
+          setDeleteConfirmOpen(false);
+          setRoleToDelete(void 0);
+        },
+        title: /* @__PURE__ */ jsx(Fragment, { children: "Delete?" }),
+        body: /* @__PURE__ */ jsx(Fragment, { children: "Are you sure you want to delete this role?" })
+      }
+    )
+  ] });
+}
+function RoleDetailsForm({
+  open,
+  role: roleProp,
+  saveRole,
+  handleClose
+}) {
+  const snackbarController = useSnackbarController();
+  const isNewRole = !roleProp;
+  const [roleId, setRoleId] = useState(roleProp?.id || "");
+  const [roleName, setRoleName] = useState(roleProp?.name || "");
+  const [isAdmin, setIsAdmin] = useState(roleProp?.isAdmin ?? false);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [errors, setErrors] = useState({});
+  const [submitCount, setSubmitCount] = useState(0);
+  const validate = () => {
+    const newErrors = {};
+    if (!roleId) newErrors.id = "Required";
+    if (!roleName) newErrors.name = "Required";
+    setErrors(newErrors);
+    return Object.keys(newErrors).length === 0;
+  };
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setSubmitCount((c) => c + 1);
+    if (!validate()) return;
+    setIsSubmitting(true);
+    try {
+      await saveRole({
+        id: roleId,
+        name: roleName,
+        isAdmin
+      });
+      handleClose();
+    } catch (error) {
+      snackbarController.open({ type: "error", message: error instanceof Error ? error.message : "Failed to save role" });
+    } finally {
+      setIsSubmitting(false);
+    }
+  };
+  return /* @__PURE__ */ jsx(Dialog, { open, onOpenChange: (open2) => !open2 ? handleClose() : void 0, maxWidth: "6xl", children: /* @__PURE__ */ jsxs(
+    "form",
+    {
+      onSubmit: handleSubmit,
+      autoComplete: "off",
+      noValidate: true,
+      style: { display: "flex", flexDirection: "column", position: "relative", height: "100%" },
+      children: [
+        /* @__PURE__ */ jsx(DialogTitle, { variant: "h4", gutterBottom: false, children: "Role" }),
+        /* @__PURE__ */ jsx(DialogContent, { className: "h-full grow overflow-y-auto", children: /* @__PURE__ */ jsxs("div", { className: "grid grid-cols-12 gap-4", children: [
+          /* @__PURE__ */ jsxs("div", { className: "col-span-12 sm:col-span-4", children: [
+            /* @__PURE__ */ jsx(
+              TextField,
+              {
+                name: "id",
+                required: true,
+                error: submitCount > 0 && Boolean(errors.id),
+                value: roleId,
+                onChange: (e) => setRoleId(e.target.value),
+                label: "Role ID",
+                disabled: !isNewRole
+              }
+            ),
+            /* @__PURE__ */ jsx(FieldCaption, { children: submitCount > 0 && errors.id ? errors.id : "Unique identifier for this role" })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { className: "col-span-12 sm:col-span-4", children: [
+            /* @__PURE__ */ jsx(
+              TextField,
+              {
+                name: "name",
+                required: true,
+                error: submitCount > 0 && Boolean(errors.name),
+                value: roleName,
+                onChange: (e) => setRoleName(e.target.value),
+                label: "Role Name"
+              }
+            ),
+            /* @__PURE__ */ jsx(FieldCaption, { children: submitCount > 0 && errors.name ? errors.name : "Display name for this role" })
+          ] }),
+          /* @__PURE__ */ jsx("div", { className: "col-span-12 sm:col-span-4 flex items-start pt-2", children: /* @__PURE__ */ jsxs("label", { className: "flex items-center gap-2 cursor-pointer mt-3", children: [
+            /* @__PURE__ */ jsx(
+              Checkbox,
+              {
+                checked: isAdmin,
+                onCheckedChange: (checked) => setIsAdmin(Boolean(checked))
+              }
+            ),
+            /* @__PURE__ */ jsx("span", { className: "font-medium", children: "Is Admin" })
+          ] }) }),
+          /* @__PURE__ */ jsx("div", { className: "col-span-12", children: /* @__PURE__ */ jsx(CollectionPermissionsMatrix, { roleId, isAdmin }) })
+        ] }) }),
+        /* @__PURE__ */ jsxs(DialogActions, { children: [
+          /* @__PURE__ */ jsx(Button, { variant: "text", onClick: handleClose, children: "Cancel" }),
+          /* @__PURE__ */ jsx(
+            LoadingButton,
+            {
+              variant: "filled",
+              type: "submit",
+              loading: isSubmitting,
+              children: isNewRole ? "Create role" : "Update"
+            }
+          )
+        ] })
+      ]
+    }
+  ) });
+}
+const CRUD_OPS = [
+  { op: "select", label: "Read" },
+  { op: "insert", label: "Create" },
+  { op: "update", label: "Edit" },
+  { op: "delete", label: "Delete" }
+];
+function hasRoleAccess(rules, roleId, op) {
+  if (!rules || rules.length === 0) return true;
+  const applicable = rules.filter(
+    (r) => r.operation === op || r.operation === "all" || r.operations?.includes(op) || r.operations?.includes("all")
+  );
+  if (applicable.length === 0) return false;
+  const forRole = applicable.filter(
+    (r) => !r.roles || r.roles.length === 0 || r.roles.includes(roleId) || r.roles.includes("public")
+  );
+  if (forRole.length === 0) return false;
+  for (const r of forRole) {
+    if ((r.mode ?? "permissive") === "restrictive") return false;
+  }
+  return forRole.some((r) => (r.mode ?? "permissive") === "permissive");
+}
+function PermCell({ granted }) {
+  return /* @__PURE__ */ jsx(
+    "span",
+    {
+      className: granted ? "text-green-500 dark:text-green-400 text-base select-none" : "text-surface-300 dark:text-surface-600 text-base select-none",
+      children: granted ? "✓" : "✗"
+    }
+  );
+}
+function CollectionPermissionsMatrix({ roleId, isAdmin }) {
+  const { collections } = useCollectionRegistryController();
+  if (!collections || collections.length === 0) {
+    return /* @__PURE__ */ jsx("div", { className: "mt-4", children: /* @__PURE__ */ jsx(Typography, { variant: "label", className: "text-surface-400", children: "No collections configured" }) });
+  }
+  const topLevel = collections.filter((c) => !c.collectionGroup);
+  return /* @__PURE__ */ jsxs("div", { className: "mt-6", children: [
+    /* @__PURE__ */ jsx(Typography, { variant: "label", className: "mb-2 block text-surface-600 dark:text-surface-400 uppercase tracking-wide text-xs", children: "Collection permissions" }),
+    /* @__PURE__ */ jsx("div", { className: "rounded-lg border border-surface-200 dark:border-surface-700 overflow-hidden", children: /* @__PURE__ */ jsxs(Table, { children: [
+      /* @__PURE__ */ jsx(TableHeader, { children: /* @__PURE__ */ jsxs(TableRow, { children: [
+        /* @__PURE__ */ jsx(TableCell, { header: true, children: "Collection" }),
+        CRUD_OPS.map(({ op, label }) => /* @__PURE__ */ jsx(TableCell, { header: true, className: "text-center w-24", children: label }, op))
+      ] }) }),
+      /* @__PURE__ */ jsx(TableBody, { children: topLevel.map((collection) => {
+        const noRules = !collection.securityRules || collection.securityRules.length === 0;
+        return /* @__PURE__ */ jsxs(TableRow, { children: [
+          /* @__PURE__ */ jsxs(TableCell, { children: [
+            /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
+              /* @__PURE__ */ jsx("span", { className: "font-medium", children: collection.name }),
+              noRules && !isAdmin && /* @__PURE__ */ jsx(Tooltip, { title: "No security rules — unrestricted", children: /* @__PURE__ */ jsx(Chip, { className: "text-xs", colorScheme: "yellowLight", children: "No rules" }) })
+            ] }),
+            /* @__PURE__ */ jsx("span", { className: "text-xs text-surface-400 font-mono", children: collection.slug })
+          ] }),
+          CRUD_OPS.map(({ op }) => /* @__PURE__ */ jsx(TableCell, { className: "text-center", children: /* @__PURE__ */ jsx(PermCell, { granted: isAdmin || hasRoleAccess(collection.securityRules, roleId, op) }) }, op))
+        ] }, collection.slug);
+      }) })
+    ] }) }),
+    !roleId && /* @__PURE__ */ jsx(Typography, { variant: "caption", className: "mt-2 text-surface-400 italic", children: "Enter a role ID above to preview permissions" })
+  ] });
+}
+export {
+  AuthApiError,
+  RebaseLoginView,
+  RolesView,
+  UsersView,
+  createUserManagementAdminViews,
+  fetchAuthConfig,
+  getApiUrl,
+  setApiUrl,
+  useBackendUserManagement,
+  useRebaseAuthController
+};
+//# sourceMappingURL=index.es.js.map