@seifer-webapp-factory/authorization 0.1.0

package/dist/contract/schemas.js

@@ -0,0 +1,91 @@
+import { z } from 'zod';
+/**
+ * US-Z0101 — DTO-schema's (de seam). Eén set Zod-schema's waaruit de backend valideert én de frontend
+ * zijn getypte client afleidt (`z.infer`). Rol-/permissie-namen zijn data; de vorm + minimale
+ * invarianten staan hier. Geen policy-logica — die zit in de `access-control`-kit.
+ */
+// --- Primitieven ---
+/** Puntgescheiden sleutel-conventie (`authz.manage`, `article.write`), geen spaties. */
+export const permissionKeySchema = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/, 'ongeldige permissie-sleutel');
+/** Rol-sleutel: kleine letters/cijfers + scheidingstekens (`admin`, `content-editor`). */
+export const roleKeySchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9]+(?:[_-][a-z0-9]+)*$/, 'ongeldige rol-sleutel');
+export const subjectIdSchema = z.string().min(1);
+export const roleIdSchema = z.string().min(1);
+// --- Rollen ---
+export const roleSchema = z.object({
+    id: roleIdSchema,
+    key: roleKeySchema,
+    name: z.string().min(1).max(128),
+    permissions: z.array(permissionKeySchema),
+    /** Rol-hiërarchie: de bovenliggende rol waarvan deze rol de permissies erft; `null` = geen ouder. */
+    parentRoleId: roleIdSchema.nullable(),
+});
+export const roleListResponseSchema = z.object({ roles: z.array(roleSchema) });
+export const createRoleRequestSchema = z.object({
+    key: roleKeySchema,
+    name: z.string().min(1).max(128),
+    permissions: z.array(permissionKeySchema).default([]),
+    parentRoleId: roleIdSchema.nullable().default(null),
+});
+/** Alle velden optioneel: een PATCH die alleen de aangeleverde velden wijzigt. */
+export const updateRoleRequestSchema = z.object({
+    name: z.string().min(1).max(128).optional(),
+    permissions: z.array(permissionKeySchema).optional(),
+    parentRoleId: roleIdSchema.nullable().optional(),
+});
+// --- Permissie-catalogus ---
+export const permissionSchema = z.object({
+    key: permissionKeySchema,
+    description: z.string(),
+});
+export const permissionListResponseSchema = z.object({ permissions: z.array(permissionSchema) });
+// --- Toewijzingen ---
+export const assignmentRequestSchema = z.object({
+    subjectId: subjectIdSchema,
+    roleId: roleIdSchema,
+});
+export const subjectRolesResponseSchema = z.object({
+    subjectId: subjectIdSchema,
+    roles: z.array(roleSchema),
+});
+// --- Resolutie / hydratie ---
+export const mePermissionsResponseSchema = z.object({
+    subjectId: subjectIdSchema,
+    roles: z.array(roleKeySchema),
+    permissions: z.array(permissionKeySchema),
+});
+// --- Programmatic check ---
+export const checkRequestSchema = z
+    .object({
+    /** RBAC-vorm: heeft het huidige subject deze permissie? */
+    permission: permissionKeySchema.optional(),
+    /** PDP-vorm: is deze action toegestaan (evt. tegen een resource, voor ReBAC/ownership)? */
+    action: z.string().min(1).optional(),
+    resource: z.object({ id: z.string().min(1), type: z.string().min(1).optional() }).optional(),
+})
+    .refine((v) => Boolean(v.permission) || Boolean(v.action), {
+    message: 'permission of action is verplicht',
+});
+export const checkResponseSchema = z.object({
+    allowed: z.boolean(),
+    /** Veilige, niet-lekkende reden (geen policy-interne details). */
+    reason: z.string(),
+});
+// --- ReBAC-relaties (achter config-toggle) ---
+export const relationRequestSchema = z.object({
+    subjectId: subjectIdSchema,
+    relation: z.string().min(1).max(64),
+    objectType: z.string().min(1).max(64),
+    objectId: z.string().min(1),
+});
+// --- Generieke bevestiging ---
+export const acknowledgementSchema = z.object({ ok: z.literal(true) });
+//# sourceMappingURL=schemas.js.map

package/dist/contract/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../contract/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AAEH,sBAAsB;AACtB,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,gCAAgC,EAAE,6BAA6B,CAAC,CAAC;AAC1E,0FAA0F;AAC1F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,+BAA+B,EAAE,uBAAuB,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9C,iBAAiB;AACjB,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,YAAY;IAChB,GAAG,EAAE,aAAa;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACzC,qGAAqG;IACrG,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,aAAa;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACpD,CAAC,CAAC;AACH,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACpD,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,8BAA8B;AAC9B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,EAAE,mBAAmB;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;AAEjG,uBAAuB;AACvB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,eAAe;IAC1B,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;CAC3B,CAAC,CAAC;AAEH,+BAA+B;AAC/B,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CAC1C,CAAC,CAAC;AAEH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,2DAA2D;IAC3D,UAAU,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC1C,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7F,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;IACzD,OAAO,EAAE,mCAAmC;CAC7C,CAAC,CAAC;AACL,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,kEAAkE;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,gCAAgC;AAChC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}

package/dist/frontend/src/client.d.ts

@@ -0,0 +1,31 @@
+import type { HttpClient } from '@seifer-webapp-factory/kits/frontend/http-client';
+import type { Acknowledgement, AssignmentRequest, AuthzErrorCode, CheckRequest, CheckResponse, CreateRoleRequest, MePermissionsResponse, PermissionListResponse, RelationRequest, Role, RoleListResponse, SubjectRolesResponse, UpdateRoleRequest } from '../../contract/index.js';
+/** Getypte fout bij een niet-2xx-respons: draagt de contract-`code` + `i18nKey`; nooit rauwe details. */
+export declare class AuthzClientError extends Error {
+    readonly code: AuthzErrorCode;
+    readonly i18nKey: string;
+    readonly httpStatus: number;
+    readonly fields?: Readonly<Record<string, string[]>>;
+    constructor(code: AuthzErrorCode, i18nKey: string, httpStatus: number, fields?: Readonly<Record<string, string[]>>);
+}
+/** De publieke, getypte client-API (12 endpoints). */
+export interface AuthzClient {
+    listRoles(): Promise<RoleListResponse>;
+    createRole(input: CreateRoleRequest): Promise<Role>;
+    updateRole(id: string, patch: UpdateRoleRequest): Promise<Role>;
+    deleteRole(id: string): Promise<Acknowledgement>;
+    listPermissions(): Promise<PermissionListResponse>;
+    subjectRoles(subjectId: string): Promise<SubjectRolesResponse>;
+    assignRole(input: AssignmentRequest): Promise<Acknowledgement>;
+    revokeRole(input: AssignmentRequest): Promise<Acknowledgement>;
+    mePermissions(): Promise<MePermissionsResponse>;
+    check(input: CheckRequest): Promise<CheckResponse>;
+    writeRelation(input: RelationRequest): Promise<Acknowledgement>;
+    removeRelation(input: RelationRequest): Promise<Acknowledgement>;
+}
+export interface CreateAuthzClientOptions {
+    readonly http: HttpClient;
+}
+/** Maakt een getypte authorization-client rond de geïnjecteerde kit-`HttpClient`. */
+export declare function createAuthzClient(options: CreateAuthzClientOptions): AuthzClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/frontend/src/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../frontend/src/client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAMnF,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EAEjB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,IAAI,EACJ,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAEjC,yGAAyG;AACzG,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAEzC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAQnH;AAED,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvC,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnD,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC/D,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAChD,KAAK,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnD,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAwBD,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CA8ChF"}

package/dist/frontend/src/client.js

@@ -0,0 +1,83 @@
+/**
+ * US-Z0105 — De getypte authorization-client (het mechanisme). Leidt methoden, paden en foutcodes af
+ * uit het contract (`AUTHZ_ENDPOINTS` + `AUTHZ_ERROR_TAXONOMY`) — één bron, geen drift. Kent geen
+ * netwerk: krijgt de kit-`HttpClient` geïnjecteerd. Bij een niet-2xx-respons mapt hij de kit-`HttpError`
+ * (mét geparste body) naar een getypte `AuthzClientError` met de contract-`code` + `i18nKey`.
+ */
+import { HttpError } from '@seifer-webapp-factory/kits/frontend/http-client';
+import { AUTHZ_ENDPOINTS, AUTHZ_ERROR_CODES, AUTHZ_ERROR_TAXONOMY, } from '../../contract/index.js';
+/** Getypte fout bij een niet-2xx-respons: draagt de contract-`code` + `i18nKey`; nooit rauwe details. */
+export class AuthzClientError extends Error {
+    code;
+    i18nKey;
+    httpStatus;
+    fields;
+    constructor(code, i18nKey, httpStatus, fields) {
+        super(`[authz] ${code} (HTTP ${httpStatus})`);
+        this.name = 'AuthzClientError';
+        this.code = code;
+        this.i18nKey = i18nKey;
+        this.httpStatus = httpStatus;
+        this.fields = fields;
+    }
+}
+const ERROR_CODES = AUTHZ_ERROR_CODES;
+/** Leidt de foutcode af: bij voorkeur uit de body (`code`), anders reverse-lookup op HTTP-status. */
+function resolveErrorCode(status, body) {
+    const bodyCode = body?.code;
+    if (typeof bodyCode === 'string' && ERROR_CODES.includes(bodyCode))
+        return bodyCode;
+    const byStatus = AUTHZ_ERROR_CODES.find((code) => AUTHZ_ERROR_TAXONOMY[code].httpStatus === status);
+    return byStatus ?? 'validation_failed';
+}
+/** Vervangt `:param`-segmenten in een pad door concrete (ge-encodeerde) waarden. */
+function buildPath(template, params) {
+    if (!params)
+        return template;
+    return template.replace(/:([A-Za-z0-9_]+)/g, (_, name) => encodeURIComponent(params[name] ?? ''));
+}
+/** Maakt een getypte authorization-client rond de geïnjecteerde kit-`HttpClient`. */
+export function createAuthzClient(options) {
+    const { http } = options;
+    async function call(endpoint, opts = {}) {
+        let data;
+        let status;
+        try {
+            const res = await http.request({
+                method: endpoint.method,
+                path: buildPath(endpoint.path, opts.params),
+                body: opts.body,
+            });
+            data = res.data;
+            status = res.status;
+        }
+        catch (err) {
+            if (err instanceof HttpError && err.status !== undefined) {
+                const code = resolveErrorCode(err.status, err.body);
+                const errorBody = err.body;
+                throw new AuthzClientError(code, AUTHZ_ERROR_TAXONOMY[code].i18nKey, err.status, errorBody?.fields);
+            }
+            throw err;
+        }
+        const parsed = endpoint.response.safeParse(data);
+        if (!parsed.success) {
+            throw new AuthzClientError('validation_failed', AUTHZ_ERROR_TAXONOMY.validation_failed.i18nKey, status);
+        }
+        return parsed.data;
+    }
+    return {
+        listRoles: () => call(AUTHZ_ENDPOINTS.listRoles),
+        createRole: (input) => call(AUTHZ_ENDPOINTS.createRole, { body: input }),
+        updateRole: (id, patch) => call(AUTHZ_ENDPOINTS.updateRole, { body: patch, params: { id } }),
+        deleteRole: (id) => call(AUTHZ_ENDPOINTS.deleteRole, { params: { id } }),
+        listPermissions: () => call(AUTHZ_ENDPOINTS.listPermissions),
+        subjectRoles: (subjectId) => call(AUTHZ_ENDPOINTS.subjectRoles, { params: { id: subjectId } }),
+        assignRole: (input) => call(AUTHZ_ENDPOINTS.assignRole, { body: input }),
+        revokeRole: (input) => call(AUTHZ_ENDPOINTS.revokeRole, { body: input }),
+        mePermissions: () => call(AUTHZ_ENDPOINTS.mePermissions),
+        check: (input) => call(AUTHZ_ENDPOINTS.check, { body: input }),
+        writeRelation: (input) => call(AUTHZ_ENDPOINTS.writeRelation, { body: input }),
+        removeRelation: (input) => call(AUTHZ_ENDPOINTS.removeRelation, { body: input }),
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/frontend/src/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../frontend/src/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,kDAAkD,CAAC;AAE7E,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAkBjC,yGAAyG;AACzG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAiB;IACrB,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,MAAM,CAAsC;IAErD,YAAY,IAAoB,EAAE,OAAe,EAAE,UAAkB,EAAE,MAA2C;QAChH,KAAK,CAAC,WAAW,IAAI,UAAU,UAAU,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAsBD,MAAM,WAAW,GAAsB,iBAAiB,CAAC;AAEzD,qGAAqG;AACrG,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAa;IACrD,MAAM,QAAQ,GAAI,IAA8C,EAAE,IAAI,CAAC;IACvE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAA0B,CAAC;IACtG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;IACpG,OAAO,QAAQ,IAAI,mBAAmB,CAAC;AACzC,CAAC;AAQD,oFAAoF;AACpF,SAAS,SAAS,CAAC,QAAgB,EAAE,MAA+B;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,OAAO,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAEzB,KAAK,UAAU,IAAI,CACjB,QAA0B,EAC1B,OAA4D,EAAE;QAE9D,IAAI,IAAa,CAAC;QAClB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAU;gBACtC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;gBAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAkD,CAAC;gBACzE,MAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACtG,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,MAAM,CAAC,IAAW,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAmB,eAAe,CAAC,SAAS,CAAC;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAO,eAAe,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC9E,UAAU,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAO,eAAe,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAClG,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAkB,eAAe,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QACzF,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAyB,eAAe,CAAC,eAAe,CAAC;QACpF,YAAY,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAuB,eAAe,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC;QACpH,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,eAAe,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzF,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,eAAe,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzF,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAwB,eAAe,CAAC,aAAa,CAAC;QAC/E,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAgB,eAAe,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7E,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,eAAe,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/F,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB,eAAe,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;KAClG,CAAC;AACJ,CAAC"}

package/dist/frontend/src/composables.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Vue-composables (het mechanisme, provide/inject). Een dunne, reactieve laag bovenop de getypte
+ * authorization-client. De client wordt per app-instance geprovide (`provideAuthzClient`), zodat
+ * SSR-render en client-hydratie per request geïsoleerd blijven — geen module-globale mutable state.
+ *
+ * Stories: US-Z0405 (usePermissions — hydratie van `can`), US-Z0201..0203 (useRoles),
+ * US-Z0301/0305 (useAssignments).
+ */
+import { type App, type InjectionKey, type Ref } from 'vue';
+import { type AuthzClient } from './client.js';
+import type { AssignmentRequest, CreateRoleRequest, Permission, Role, UpdateRoleRequest } from '../../contract/index.js';
+/** De per-request client die op de app wordt geprovide. Symbool = module-constante (geen state). */
+export declare const AUTHZ_CLIENT_KEY: InjectionKey<AuthzClient>;
+/** Registreer de authorization-client op een app-instance (bij bootstrap). */
+export declare function provideAuthzClient(app: App, client: AuthzClient): void;
+/** Haal de getypte authorization-client op binnen setup(). Werpt als er niets geprovide is. */
+export declare function useAuthzClient(): AuthzClient;
+/** De reactieve vorm die elke actie-composable teruggeeft. `error` is een i18n-sleutel, geen detail. */
+export interface UseAuthzAction<Input, Result> {
+    readonly pending: Ref<boolean>;
+    readonly error: Ref<string | null>;
+    readonly result: Ref<Result | null>;
+    submit(input: Input): Promise<Result | undefined>;
+}
+/**
+ * US-Z0405 — hydrateert de effectieve permissies/rollen van het huidige subject uit
+ * `/authz/me/permissions` en biedt een reactieve `can(permission)`. Deze bron voedt de kit-evaluator
+ * (via `claimsPermissionSource`) zodat `<Can>`/`v-can`/de route-guard consistent gaten.
+ */
+export interface UsePermissions {
+    readonly permissions: Ref<string[]>;
+    readonly roles: Ref<string[]>;
+    readonly loaded: Ref<boolean>;
+    readonly pending: Ref<boolean>;
+    /** Reactieve permissie-check (default-deny: onbekend => false). */
+    can(permission: string): boolean;
+    /** (Her)laadt de permissies van de server. */
+    reload(): Promise<void>;
+}
+export declare function usePermissions(): UsePermissions;
+/** US-Z0201..0203 — rollenbeheer-composables (lijst + mutaties). */
+export interface UseRoles {
+    readonly roles: Ref<Role[]>;
+    readonly permissions: Ref<Permission[]>;
+    readonly pending: Ref<boolean>;
+    readonly error: Ref<string | null>;
+    refresh(): Promise<void>;
+    create: UseAuthzAction<CreateRoleRequest, Role>['submit'];
+    update: (id: string, patch: UpdateRoleRequest) => Promise<Role | undefined>;
+    remove: (id: string) => Promise<boolean>;
+}
+export declare function useRoles(): UseRoles;
+/** US-Z0301/0305 — rol-toewijzing-composables (toekennen/intrekken + subject-rollen). */
+export interface UseAssignments {
+    readonly subjectRoles: Ref<Role[]>;
+    readonly error: Ref<string | null>;
+    loadSubject(subjectId: string): Promise<void>;
+    assign(input: AssignmentRequest): Promise<boolean>;
+    revoke(input: AssignmentRequest): Promise<boolean>;
+}
+export declare function useAssignments(): UseAssignments;
+//# sourceMappingURL=composables.d.ts.map

package/dist/frontend/src/composables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composables.d.ts","sourceRoot":"","sources":["../../../frontend/src/composables.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAyB,KAAK,GAAG,EAAoB,KAAK,YAAY,EAAE,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AACrG,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,IAAI,EACJ,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAEjC,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,EAAE,YAAY,CAAC,WAAW,CAA0B,CAAC;AAElF,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,IAAI,WAAW,CAQ5C;AAED,wGAAwG;AACxG,MAAM,WAAW,cAAc,CAAC,KAAK,EAAE,MAAM;IAC3C,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AA8BD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,mEAAmE;IACnE,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,8CAA8C;IAC9C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,wBAAgB,cAAc,IAAI,cAAc,CA4B/C;AAED,oEAAoE;AACpE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,EAAE,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,wBAAgB,QAAQ,IAAI,QAAQ,CAqDnC;AAED,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD;AAED,wBAAgB,cAAc,IAAI,cAAc,CAqC/C"}

package/dist/frontend/src/composables.js

@@ -0,0 +1,170 @@
+/**
+ * Vue-composables (het mechanisme, provide/inject). Een dunne, reactieve laag bovenop de getypte
+ * authorization-client. De client wordt per app-instance geprovide (`provideAuthzClient`), zodat
+ * SSR-render en client-hydratie per request geïsoleerd blijven — geen module-globale mutable state.
+ *
+ * Stories: US-Z0405 (usePermissions — hydratie van `can`), US-Z0201..0203 (useRoles),
+ * US-Z0301/0305 (useAssignments).
+ */
+import { computed, inject, ref } from 'vue';
+import { AuthzClientError } from './client.js';
+/** De per-request client die op de app wordt geprovide. Symbool = module-constante (geen state). */
+export const AUTHZ_CLIENT_KEY = Symbol('authz.client');
+/** Registreer de authorization-client op een app-instance (bij bootstrap). */
+export function provideAuthzClient(app, client) {
+    app.provide(AUTHZ_CLIENT_KEY, client);
+}
+/** Haal de getypte authorization-client op binnen setup(). Werpt als er niets geprovide is. */
+export function useAuthzClient() {
+    const client = inject(AUTHZ_CLIENT_KEY);
+    if (client === undefined) {
+        throw new Error('[authz] useAuthzClient(): geen authorization-client geprovide. Roep provideAuthzClient(app, client) aan bij bootstrap.');
+    }
+    return client;
+}
+/** Vertaalt een gevangen fout naar een i18n-sleutel zonder details te lekken. */
+function toI18nKey(cause) {
+    return cause instanceof AuthzClientError ? cause.i18nKey : 'authz.error.unknown';
+}
+function useAuthzAction(run) {
+    const pending = ref(false);
+    const error = ref(null);
+    const result = ref(null);
+    async function submit(input) {
+        pending.value = true;
+        error.value = null;
+        try {
+            const value = await run(input);
+            result.value = value;
+            return value;
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+            return undefined;
+        }
+        finally {
+            pending.value = false;
+        }
+    }
+    return { pending, error, result, submit };
+}
+export function usePermissions() {
+    const client = useAuthzClient();
+    const permissions = ref([]);
+    const roles = ref([]);
+    const loaded = ref(false);
+    const pending = ref(false);
+    const permissionSet = computed(() => new Set(permissions.value));
+    async function reload() {
+        pending.value = true;
+        try {
+            const me = await client.mePermissions();
+            permissions.value = me.permissions;
+            roles.value = me.roles;
+            loaded.value = true;
+        }
+        finally {
+            pending.value = false;
+        }
+    }
+    return {
+        permissions,
+        roles,
+        loaded,
+        pending,
+        can: (permission) => permissionSet.value.has(permission),
+        reload,
+    };
+}
+export function useRoles() {
+    const client = useAuthzClient();
+    const roles = ref([]);
+    const permissions = ref([]);
+    const pending = ref(false);
+    const error = ref(null);
+    async function refresh() {
+        pending.value = true;
+        error.value = null;
+        try {
+            const [roleList, permList] = await Promise.all([client.listRoles(), client.listPermissions()]);
+            roles.value = roleList.roles;
+            permissions.value = permList.permissions;
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+        }
+        finally {
+            pending.value = false;
+        }
+    }
+    async function create(input) {
+        error.value = null;
+        try {
+            return await client.createRole(input);
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+            return undefined;
+        }
+    }
+    async function update(id, patch) {
+        error.value = null;
+        try {
+            return await client.updateRole(id, patch);
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+            return undefined;
+        }
+    }
+    async function remove(id) {
+        error.value = null;
+        try {
+            await client.deleteRole(id);
+            return true;
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+            return false;
+        }
+    }
+    return { roles, permissions, pending, error, refresh, create, update, remove };
+}
+export function useAssignments() {
+    const client = useAuthzClient();
+    const subjectRoles = ref([]);
+    const error = ref(null);
+    async function loadSubject(subjectId) {
+        error.value = null;
+        try {
+            subjectRoles.value = (await client.subjectRoles(subjectId)).roles;
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+        }
+    }
+    async function assign(input) {
+        error.value = null;
+        try {
+            await client.assignRole(input);
+            return true;
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+            return false;
+        }
+    }
+    async function revoke(input) {
+        error.value = null;
+        try {
+            await client.revokeRole(input);
+            return true;
+        }
+        catch (cause) {
+            error.value = toI18nKey(cause);
+            return false;
+        }
+    }
+    return { subjectRoles, error, loadSubject, assign, revoke };
+}
+//# sourceMappingURL=composables.js.map

package/dist/frontend/src/composables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composables.js","sourceRoot":"","sources":["../../../frontend/src/composables.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAA2D,MAAM,KAAK,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAoB,MAAM,aAAa,CAAC;AASjE,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAA8B,MAAM,CAAC,cAAc,CAAC,CAAC;AAElF,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,GAAQ,EAAE,MAAmB;IAC9D,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACnF,CAAC;AAED,SAAS,cAAc,CAAgB,GAAsC;IAC3E,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAgB,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAgB,IAAI,CAAuB,CAAC;IAE9D,KAAK,UAAU,MAAM,CAAC,KAAY;QAChC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAkBD,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,GAAG,CAAW,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAW,EAAE,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,aAAa,GAA6B,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3F,KAAK,UAAU,MAAM;QACnB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;YACxC,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC;YACnC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;YACvB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,KAAK;QACL,MAAM;QACN,OAAO;QACP,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QACxD,MAAM;KACP,CAAC;AACJ,CAAC;AAcD,MAAM,UAAU,QAAQ;IACtB,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,CAAS,EAAE,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,CAAe,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAgB,IAAI,CAAC,CAAC;IAEvC,KAAK,UAAU,OAAO;QACpB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;YAC/F,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC7B,WAAW,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,KAAwB;QAC5C,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EAAU,EAAE,KAAwB;QACxD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EAAU;QAC9B,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjF,CAAC;AAWD,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,GAAG,CAAS,EAAE,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAgB,IAAI,CAAC,CAAC;IAEvC,KAAK,UAAU,WAAW,CAAC,SAAiB;QAC1C,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,YAAY,CAAC,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,KAAwB;QAC5C,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,KAAwB;QAC5C,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC"}

package/dist/frontend/src/guards.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Route-guards + gating (het mechanisme). De module levert kant-en-klare autorisatie-gating door de
+ * pure `access-control`-kit-adapters te composeren/her-exporteren: de `permissionGuard` (blokkeert
+ * routes zonder de vereiste permissie), de `<Can>`-component, de `v-can`-directive, `useCan()` en de
+ * evaluator-provider. De permissies komen via een geïnjecteerde bron (gehydrateerd uit
+ * `/authz/me/permissions`, US-Z0405) — geen module-globale state, SSR/hydratie-veilig.
+ */
+export { permissionGuard, createRedirectPolicy, Can, createCanDirective, providePermissions, useCan, PERMISSION_EVALUATOR_KEY, } from '@seifer-webapp-factory/kits/frontend/access-control/vue';
+export type { RequiredPermissions, RedirectContext, RedirectPolicy, PermissionGuardOptions, RedirectTargets, } from '@seifer-webapp-factory/kits/frontend/access-control/vue';
+export { createPermissionEvaluator, staticPermissionSource, claimsPermissionSource, } from '@seifer-webapp-factory/kits/frontend/access-control';
+export type { PermissionEvaluator, PermissionSource, PermissionClaims, } from '@seifer-webapp-factory/kits/frontend/access-control';
+//# sourceMappingURL=guards.d.ts.map

package/dist/frontend/src/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../../frontend/src/guards.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,GAAG,EACH,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,wBAAwB,GACzB,MAAM,yDAAyD,CAAC;AACjE,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,eAAe,GAChB,MAAM,yDAAyD,CAAC;AACjE,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qDAAqD,CAAC;AAC7D,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qDAAqD,CAAC"}

package/dist/frontend/src/guards.js

@@ -0,0 +1,10 @@
+/**
+ * Route-guards + gating (het mechanisme). De module levert kant-en-klare autorisatie-gating door de
+ * pure `access-control`-kit-adapters te composeren/her-exporteren: de `permissionGuard` (blokkeert
+ * routes zonder de vereiste permissie), de `<Can>`-component, de `v-can`-directive, `useCan()` en de
+ * evaluator-provider. De permissies komen via een geïnjecteerde bron (gehydrateerd uit
+ * `/authz/me/permissions`, US-Z0405) — geen module-globale state, SSR/hydratie-veilig.
+ */
+export { permissionGuard, createRedirectPolicy, Can, createCanDirective, providePermissions, useCan, PERMISSION_EVALUATOR_KEY, } from '@seifer-webapp-factory/kits/frontend/access-control/vue';
+export { createPermissionEvaluator, staticPermissionSource, claimsPermissionSource, } from '@seifer-webapp-factory/kits/frontend/access-control';
+//# sourceMappingURL=guards.js.map

package/dist/frontend/src/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../../frontend/src/guards.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,GAAG,EACH,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,wBAAwB,GACzB,MAAM,yDAAyD,CAAC;AAQjE,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qDAAqD,CAAC"}

package/dist/frontend/src/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * authorization — de frontend-helft (het mechanisme). Barrel die de getypte client, de Vue-
+ * composables (provide/inject) en de gating/route-guards bundelt. Alle types leidt de consumer via het
+ * contract af; hier alleen het uitvoerbare mechanisme dat de frontend-kits samenbindt.
+ */
+export { createAuthzClient, AuthzClientError } from './client.js';
+export type { AuthzClient, CreateAuthzClientOptions } from './client.js';
+export { AUTHZ_CLIENT_KEY, provideAuthzClient, useAuthzClient, usePermissions, useRoles, useAssignments, } from './composables.js';
+export type { UseAuthzAction, UsePermissions, UseRoles, UseAssignments } from './composables.js';
+export { permissionGuard, createRedirectPolicy, Can, createCanDirective, providePermissions, useCan, createPermissionEvaluator, staticPermissionSource, claimsPermissionSource, PERMISSION_EVALUATOR_KEY, } from './guards.js';
+export type { RequiredPermissions, RedirectContext, RedirectPolicy, PermissionGuardOptions, RedirectTargets, PermissionEvaluator, PermissionSource, PermissionClaims, } from './guards.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/frontend/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../frontend/src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEjG,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,GAAG,EACH,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,aAAa,CAAC"}

package/dist/frontend/src/index.js

@@ -0,0 +1,9 @@
+/**
+ * authorization — de frontend-helft (het mechanisme). Barrel die de getypte client, de Vue-
+ * composables (provide/inject) en de gating/route-guards bundelt. Alle types leidt de consumer via het
+ * contract af; hier alleen het uitvoerbare mechanisme dat de frontend-kits samenbindt.
+ */
+export { createAuthzClient, AuthzClientError } from './client.js';
+export { AUTHZ_CLIENT_KEY, provideAuthzClient, useAuthzClient, usePermissions, useRoles, useAssignments, } from './composables.js';
+export { permissionGuard, createRedirectPolicy, Can, createCanDirective, providePermissions, useCan, createPermissionEvaluator, staticPermissionSource, claimsPermissionSource, PERMISSION_EVALUATOR_KEY, } from './guards.js';
+//# sourceMappingURL=index.js.map

package/dist/frontend/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../frontend/src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGlE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,GAAG,EACH,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,EACN,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,aAAa,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,56 @@
+/** De genormaliseerde vorm van een capability-module-manifest (identiek aan de authentication-tier). */
+export interface CapabilityModuleManifest {
+    readonly name: string;
+    readonly version: string;
+    readonly templateVersion: string;
+    readonly provides: {
+        readonly routes: readonly string[];
+        readonly backendRoutes: readonly string[];
+        readonly capabilities: readonly string[];
+    };
+    readonly requires: {
+        readonly kits: {
+            readonly backend: readonly string[];
+            readonly frontend: readonly string[];
+        };
+        readonly ports: readonly string[];
+        /** Andere capability-modules waarvan deze afhangt (US-Z0803 presence-check). */
+        readonly modules?: readonly string[];
+    };
+    readonly contract: string;
+    readonly config: unknown;
+    readonly migrations: readonly string[];
+    readonly surface: readonly string[];
+    readonly mechanism: readonly string[];
+}
+/** De concrete manifest van de authorization-module. */
+export declare const authorizationManifest: {
+    name: string;
+    version: string;
+    templateVersion: string;
+    provides: {
+        routes: string[];
+        backendRoutes: readonly string[];
+        capabilities: string[];
+    };
+    requires: {
+        kits: {
+            backend: string[];
+            frontend: string[];
+        };
+        ports: string[];
+        modules: string[];
+    };
+    contract: string;
+    config: undefined;
+    migrations: string[];
+    surface: string[];
+    mechanism: string[];
+};
+/**
+ * Valideert een capability-module-manifest. Naast de bekende checks (verplichte velden, geen dubbele
+ * kit binnen een stack) borgt deze variant dat een opgegeven `requires.modules` niet-leeg en uniek is
+ * (US-Z0801) — het is de basis voor de scaffolder-presence-check (US-Z0803).
+ */
+export declare function validateManifest(m: CapabilityModuleManifest): CapabilityModuleManifest;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../manifest.ts"],"names":[],"mappings":"AAUA,wGAAwG;AACxG,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;KAC1C,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE;YACb,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;SACtC,CAAC;QACF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,gFAAgF;QAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAQD,wDAAwD;AACxD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;CAsBE,CAAC;AAYrC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,wBAAwB,GAAG,wBAAwB,CAmCtF"}