@stackwright-pro/auth 0.2.0-alpha.13 → 0.2.0-alpha.15

package/dist/client.js

@@ -0,0 +1,345 @@
+"use client";
+'use strict';
+
+var react = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+var AuthContext = react.createContext(null);
+function useAuth() {
+  const context = react.useContext(AuthContext);
+  if (!context) {
+    throw new Error("useAuth must be used within AuthProvider");
+  }
+  return context;
+}
+function useRequireAuth() {
+  const auth = useAuth();
+  if (!auth.isAuthenticated) {
+    console.warn("useRequireAuth: User is not authenticated");
+    return null;
+  }
+  return auth;
+}
+
+// src/rbac/rbac-engine.ts
+var RBACEngine = class {
+  config;
+  rolePermissions;
+  constructor(config) {
+    this.config = config;
+    this.rolePermissions = this.buildRolePermissionMap();
+  }
+  /**
+   * Build internal map of role → permissions for fast lookups
+   */
+  buildRolePermissionMap() {
+    const map = /* @__PURE__ */ new Map();
+    for (const role of this.config.roles) {
+      map.set(role.name, new Set(role.permissions || []));
+    }
+    return map;
+  }
+  /**
+   * Check if user has a specific role
+   */
+  hasRole(user, role) {
+    return user.roles.includes(role);
+  }
+  /**
+   * Check if user has any of the specified roles
+   */
+  hasAnyRole(user, roles) {
+    return roles.some((role) => this.hasRole(user, role));
+  }
+  /**
+   * Check if user has all of the specified roles
+   */
+  hasAllRoles(user, roles) {
+    return roles.every((role) => this.hasRole(user, role));
+  }
+  /**
+   * Check if user has a specific permission
+   * Permissions are checked both:
+   * 1. Directly in user.permissions array
+   * 2. Through role-based permissions from config
+   */
+  hasPermission(user, permission) {
+    if (user.permissions?.includes(permission)) {
+      return true;
+    }
+    for (const role of user.roles) {
+      const permissions = this.rolePermissions.get(role);
+      if (permissions?.has(permission)) {
+        return true;
+      }
+      if (permissions) {
+        for (const p of permissions) {
+          if (p.endsWith(":*")) {
+            const prefix = p.slice(0, -1);
+            if (permission.startsWith(prefix)) {
+              return true;
+            }
+          }
+        }
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if user has any of the specified permissions
+   */
+  hasAnyPermission(user, permissions) {
+    return permissions.some((permission) => this.hasPermission(user, permission));
+  }
+  /**
+   * Check if user has all of the specified permissions
+   */
+  hasAllPermissions(user, permissions) {
+    return permissions.every((permission) => this.hasPermission(user, permission));
+  }
+  /**
+   * Check if route is public (no auth required)
+   */
+  isPublicRoute(path) {
+    if (!this.config.public_routes) {
+      return false;
+    }
+    return this.config.public_routes.some((publicPath) => {
+      return this.matchPath(path, publicPath);
+    });
+  }
+  /**
+   * Check if user can access a route based on protected_routes config
+   */
+  canAccessRoute(user, path) {
+    if (this.isPublicRoute(path)) {
+      return true;
+    }
+    if (!user) {
+      return false;
+    }
+    if (!this.config.protected_routes || this.config.protected_routes.length === 0) {
+      return true;
+    }
+    const matchingRoute = this.config.protected_routes.find((route) => {
+      return this.matchPath(path, route.path);
+    });
+    if (!matchingRoute) {
+      return true;
+    }
+    return this.hasAnyRole(user, matchingRoute.roles);
+  }
+  /**
+   * Check if user can access a component based on component auth config
+   */
+  canAccessComponent(user, authConfig) {
+    if (!authConfig) {
+      return true;
+    }
+    if (!user) {
+      return false;
+    }
+    if (authConfig.required_roles && authConfig.required_roles.length > 0) {
+      if (!this.hasAnyRole(user, authConfig.required_roles)) {
+        return false;
+      }
+    }
+    if (authConfig.required_permissions && authConfig.required_permissions.length > 0) {
+      if (!this.hasAllPermissions(user, authConfig.required_permissions)) {
+        return false;
+      }
+    }
+    return true;
+  }
+  // Match a path against a pattern with wildcard support
+  matchPath(path, pattern) {
+    if (path === pattern) {
+      return true;
+    }
+    if (!pattern.includes("*")) {
+      return false;
+    }
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    const regex = new RegExp(`^${escaped}$`);
+    return regex.test(path);
+  }
+};
+function AuthProvider({
+  user,
+  session,
+  rbacConfig,
+  isLoading = false,
+  children
+}) {
+  const rbac = react.useMemo(() => new RBACEngine(rbacConfig), [rbacConfig]);
+  const value = react.useMemo(
+    () => ({
+      user,
+      session,
+      isAuthenticated: user !== null,
+      isLoading,
+      hasRole: (role) => {
+        if (!user) return false;
+        return rbac.hasRole(user, role);
+      },
+      hasPermission: (permission) => {
+        if (!user) return false;
+        return rbac.hasPermission(user, permission);
+      },
+      hasAnyRole: (roles) => {
+        if (!user) return false;
+        return rbac.hasAnyRole(user, roles);
+      },
+      hasAllPermissions: (permissions) => {
+        if (!user) return false;
+        return rbac.hasAllPermissions(user, permissions);
+      }
+    }),
+    [user, session, isLoading, rbac]
+  );
+  return /* @__PURE__ */ jsxRuntime.jsx(AuthContext.Provider, { value, children });
+}
+var FallbackComponents = {
+  /**
+   * Hide component (render nothing)
+   */
+  hide: () => null,
+  /**
+   * Show placeholder message
+   */
+  placeholder: ({ className }) => /* @__PURE__ */ jsxRuntime.jsx(
+    "div",
+    {
+      className: className || "auth-placeholder",
+      style: {
+        padding: "1rem",
+        border: "1px dashed #ccc",
+        borderRadius: "4px",
+        color: "#666",
+        fontStyle: "italic",
+        textAlign: "center"
+      },
+      children: "Content requires authorization"
+    }
+  ),
+  /**
+   * Show custom message
+   */
+  message: ({ message, className }) => /* @__PURE__ */ jsxRuntime.jsx(
+    "div",
+    {
+      className: className || "auth-message",
+      style: {
+        padding: "1rem",
+        border: "1px solid #f0ad4e",
+        borderRadius: "4px",
+        backgroundColor: "#fcf8e3",
+        color: "#8a6d3b"
+      },
+      children: message || "Unauthorized"
+    }
+  )
+};
+function withAuth(Component, authConfig) {
+  if (!authConfig) {
+    return Component;
+  }
+  const WrappedComponent = (props) => {
+    const auth = useAuth();
+    if (authConfig.required_roles && authConfig.required_roles.length > 0) {
+      if (!auth.hasAnyRole(authConfig.required_roles)) {
+        return renderFallback(authConfig);
+      }
+    }
+    if (authConfig.required_permissions && authConfig.required_permissions.length > 0) {
+      if (!auth.hasAllPermissions(authConfig.required_permissions)) {
+        return renderFallback(authConfig);
+      }
+    }
+    return /* @__PURE__ */ jsxRuntime.jsx(Component, { ...props });
+  };
+  const componentName = Component.displayName || Component.name || "Component";
+  WrappedComponent.displayName = `withAuth(${componentName})`;
+  return WrappedComponent;
+}
+function renderFallback(authConfig) {
+  const fallbackType = authConfig.fallback || "hide";
+  switch (fallbackType) {
+    case "hide":
+      return FallbackComponents.hide();
+    case "placeholder":
+      return FallbackComponents.placeholder({});
+    case "message":
+      return FallbackComponents.message({
+        message: authConfig.fallback_message
+      });
+    default:
+      return null;
+  }
+}
+function withAuthFallback(Component, authConfig, FallbackComponent) {
+  const WrappedComponent = (props) => {
+    const auth = useAuth();
+    const isAuthorized = checkAuthorization(auth, authConfig);
+    if (!isAuthorized) {
+      return /* @__PURE__ */ jsxRuntime.jsx(FallbackComponent, {});
+    }
+    return /* @__PURE__ */ jsxRuntime.jsx(Component, { ...props });
+  };
+  const componentName = Component.displayName || Component.name || "Component";
+  WrappedComponent.displayName = `withAuthFallback(${componentName})`;
+  return WrappedComponent;
+}
+function checkAuthorization(auth, authConfig) {
+  if (authConfig.required_roles && authConfig.required_roles.length > 0) {
+    if (!auth.hasAnyRole(authConfig.required_roles)) {
+      return false;
+    }
+  }
+  if (authConfig.required_permissions && authConfig.required_permissions.length > 0) {
+    if (!auth.hasAllPermissions(authConfig.required_permissions)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/registration.ts
+var authDecoratorRegistry = {
+  decorator: null
+};
+function registerAuthDecorator() {
+  authDecoratorRegistry.decorator = withAuth;
+  if (typeof window !== "undefined" && window.__STACKWRIGHT_DEBUG__) {
+    console.log("\u{1F510} Auth decorator registered");
+  }
+}
+function getAuthDecorator() {
+  return authDecoratorRegistry.decorator;
+}
+function maybeWrapWithAuth(Component, authConfig) {
+  const decorator = getAuthDecorator();
+  if (!decorator || !authConfig) {
+    return Component;
+  }
+  return decorator(Component, authConfig);
+}
+function hasAuthConfig(item) {
+  if (!item || typeof item !== "object") {
+    return false;
+  }
+  return "auth" in item;
+}
+
+exports.AuthContext = AuthContext;
+exports.AuthProvider = AuthProvider;
+exports.getAuthDecorator = getAuthDecorator;
+exports.hasAuthConfig = hasAuthConfig;
+exports.maybeWrapWithAuth = maybeWrapWithAuth;
+exports.registerAuthDecorator = registerAuthDecorator;
+exports.useAuth = useAuth;
+exports.useRequireAuth = useRequireAuth;
+exports.withAuth = withAuth;
+exports.withAuthFallback = withAuthFallback;
+//# sourceMappingURL=client.js.map
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/context/AuthContext.tsx","../src/rbac/rbac-engine.ts","../src/context/AuthProvider.tsx","../src/decorators/withAuth.tsx","../src/registration.ts"],"names":["createContext","useContext","useMemo","jsx"],"mappings":";;;;;AAmDO,IAAM,WAAA,GAAcA,oBAAuC,IAAI;AAM/D,SAAS,OAAA,GAA4B;AAC1C,EAAA,MAAM,OAAA,GAAUC,iBAAW,WAAW,CAAA;AAEtC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,cAAA,GAA0C;AACxD,EAAA,MAAM,OAAO,OAAA,EAAQ;AAErB,EAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,IAAA,OAAA,CAAQ,KAAK,2CAA2C,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA;AACT;;;AC3EO,IAAM,aAAN,MAAiB;AAAA,EACd,MAAA;AAAA,EACA,eAAA;AAAA,EAER,YAAY,MAAA,EAAoB;AAC9B,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAK,sBAAA,EAAuB;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAAA,GAAmD;AACzD,IAAA,MAAM,GAAA,uBAAU,GAAA,EAAyB;AAEzC,IAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO;AACpC,MAAA,GAAA,CAAI,GAAA,CAAI,KAAK,IAAA,EAAM,IAAI,IAAI,IAAA,CAAK,WAAA,IAAe,EAAE,CAAC,CAAA;AAAA,IACpD;AAEA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,CAAQ,MAAgB,IAAA,EAAuB;AAC7C,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,CAAW,MAAgB,KAAA,EAA0B;AACnD,IAAA,OAAO,KAAA,CAAM,KAAK,CAAC,IAAA,KAAS,KAAK,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA,EAKA,WAAA,CAAY,MAAgB,KAAA,EAA0B;AACpD,IAAA,OAAO,KAAA,CAAM,MAAM,CAAC,IAAA,KAAS,KAAK,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAC,CAAA;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAA,CAAc,MAAgB,UAAA,EAA6B;AAEzD,IAAA,IAAI,IAAA,CAAK,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA,EAAG;AAC1C,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,KAAA,EAAO;AAC7B,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AACjD,MAAA,IAAI,WAAA,EAAa,GAAA,CAAI,UAAU,CAAA,EAAG;AAChC,QAAA,OAAO,IAAA;AAAA,MACT;AAGA,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,UAAA,IAAI,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA,EAAG;AACpB,YAAA,MAAM,MAAA,GAAS,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC5B,YAAA,IAAI,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA,EAAG;AACjC,cAAA,OAAO,IAAA;AAAA,YACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAA,CAAiB,MAAgB,WAAA,EAAgC;AAC/D,IAAA,OAAO,WAAA,CAAY,KAAK,CAAC,UAAA,KAAe,KAAK,aAAA,CAAc,IAAA,EAAM,UAAU,CAAC,CAAA;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAA,CAAkB,MAAgB,WAAA,EAAgC;AAChE,IAAA,OAAO,WAAA,CAAY,MAAM,CAAC,UAAA,KAAe,KAAK,aAAA,CAAc,IAAA,EAAM,UAAU,CAAC,CAAA;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc,IAAA,EAAuB;AACnC,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,aAAA,EAAe;AAC9B,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,aAAA,CAAc,IAAA,CAAK,CAAC,UAAA,KAAe;AACpD,MAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,UAAU,CAAA;AAAA,IACxC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CAAe,MAAuB,IAAA,EAAuB;AAE3D,IAAA,IAAI,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA,EAAG;AAC5B,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO,KAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAC,KAAK,MAAA,CAAO,gBAAA,IAAoB,KAAK,MAAA,CAAO,gBAAA,CAAiB,WAAW,CAAA,EAAG;AAC9E,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,MAAM,gBAAgB,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB,IAAA,CAAK,CAAC,KAAA,KAAU;AACjE,MAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA;AAAA,IACxC,CAAC,CAAA;AAGD,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,OAAO,IAAA,CAAK,UAAA,CAAW,IAAA,EAAM,aAAA,CAAc,KAAK,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAA,CAAmB,MAAuB,UAAA,EAAsD;AAE9F,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO,KAAA;AAAA,IACT;AAGA,IAAA,IAAI,UAAA,CAAW,cAAA,IAAkB,UAAA,CAAW,cAAA,CAAe,SAAS,CAAA,EAAG;AACrE,MAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,IAAA,EAAM,UAAA,CAAW,cAAc,CAAA,EAAG;AACrD,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,CAAW,oBAAA,IAAwB,UAAA,CAAW,oBAAA,CAAqB,SAAS,CAAA,EAAG;AACjF,MAAA,IAAI,CAAC,IAAA,CAAK,iBAAA,CAAkB,IAAA,EAAM,UAAA,CAAW,oBAAoB,CAAA,EAAG;AAClE,QAAA,OAAO,KAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGQ,SAAA,CAAU,MAAc,OAAA,EAA0B;AAExD,IAAA,IAAI,SAAS,OAAA,EAAS;AACpB,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,MAAA,OAAO,KAAA;AAAA,IACT;AAIA,IAAA,MAAM,OAAA,GAAU,QACb,OAAA,CAAQ,oBAAA,EAAsB,MAAM,CAAA,CACpC,OAAA,CAAQ,OAAO,IAAI,CAAA;AAEtB,IAAA,MAAM,KAAA,GAAQ,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,CAAG,CAAA;AACvC,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACxB;AACF,CAAA;ACzJO,SAAS,YAAA,CAAa;AAAA,EAC3B,IAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA,GAAY,KAAA;AAAA,EACZ;AACF,CAAA,EAAoC;AAElC,EAAA,MAAM,IAAA,GAAOC,cAAQ,MAAM,IAAI,WAAW,UAAU,CAAA,EAAG,CAAC,UAAU,CAAC,CAAA;AAGnE,EAAA,MAAM,KAAA,GAA0BA,aAAA;AAAA,IAC9B,OAAO;AAAA,MACL,IAAA;AAAA,MACA,OAAA;AAAA,MACA,iBAAiB,IAAA,KAAS,IAAA;AAAA,MAC1B,SAAA;AAAA,MAEA,OAAA,EAAS,CAAC,IAAA,KAAiB;AACzB,QAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,QAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA;AAAA,MAChC,CAAA;AAAA,MAEA,aAAA,EAAe,CAAC,UAAA,KAAuB;AACrC,QAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,IAAA,EAAM,UAAU,CAAA;AAAA,MAC5C,CAAA;AAAA,MAEA,UAAA,EAAY,CAAC,KAAA,KAAoB;AAC/B,QAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,QAAA,OAAO,IAAA,CAAK,UAAA,CAAW,IAAA,EAAM,KAAK,CAAA;AAAA,MACpC,CAAA;AAAA,MAEA,iBAAA,EAAmB,CAAC,WAAA,KAA0B;AAC5C,QAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,QAAA,OAAO,IAAA,CAAK,iBAAA,CAAkB,IAAA,EAAM,WAAW,CAAA;AAAA,MACjD;AAAA,KACF,CAAA;AAAA,IACA,CAAC,IAAA,EAAM,OAAA,EAAS,SAAA,EAAW,IAAI;AAAA,GACjC;AAEA,EAAA,uBAAOC,cAAA,CAAC,WAAA,CAAY,QAAA,EAAZ,EAAqB,OAAe,QAAA,EAAS,CAAA;AACvD;AC7DA,IAAM,kBAAA,GAAqB;AAAA;AAAA;AAAA;AAAA,EAIzB,MAAM,MAAM,IAAA;AAAA;AAAA;AAAA;AAAA,EAKZ,WAAA,EAAa,CAAC,EAAE,SAAA,uBACdA,cAAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACC,WAAW,SAAA,IAAa,kBAAA;AAAA,MACxB,KAAA,EAAO;AAAA,QACL,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,iBAAA;AAAA,QACR,YAAA,EAAc,KAAA;AAAA,QACd,KAAA,EAAO,MAAA;AAAA,QACP,SAAA,EAAW,QAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACb;AAAA,MACD,QAAA,EAAA;AAAA;AAAA,GAED;AAAA;AAAA;AAAA;AAAA,EAMF,SAAS,CAAC,EAAE,OAAA,EAAS,SAAA,uBACnBA,cAAAA;AAAA,IAAC,KAAA;AAAA,IAAA;AAAA,MACC,WAAW,SAAA,IAAa,cAAA;AAAA,MACxB,KAAA,EAAO;AAAA,QACL,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ,mBAAA;AAAA,QACR,YAAA,EAAc,KAAA;AAAA,QACd,eAAA,EAAiB,SAAA;AAAA,QACjB,KAAA,EAAO;AAAA,OACT;AAAA,MAEC,QAAA,EAAA,OAAA,IAAW;AAAA;AAAA;AAGlB,CAAA;AAkBO,SAAS,QAAA,CACd,WACA,UAAA,EACwB;AAExB,EAAA,IAAI,CAAC,UAAA,EAAY;AACf,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,MAAM,gBAAA,GAAmB,CAAC,KAAA,KAAa;AACrC,IAAA,MAAM,OAAO,OAAA,EAAQ;AAGrB,IAAA,IAAI,UAAA,CAAW,cAAA,IAAkB,UAAA,CAAW,cAAA,CAAe,SAAS,CAAA,EAAG;AACrE,MAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,UAAA,CAAW,cAAc,CAAA,EAAG;AAC/C,QAAA,OAAO,eAAe,UAAU,CAAA;AAAA,MAClC;AAAA,IACF;AAGA,IAAA,IAAI,UAAA,CAAW,oBAAA,IAAwB,UAAA,CAAW,oBAAA,CAAqB,SAAS,CAAA,EAAG;AACjF,MAAA,IAAI,CAAC,IAAA,CAAK,iBAAA,CAAkB,UAAA,CAAW,oBAAoB,CAAA,EAAG;AAC5D,QAAA,OAAO,eAAe,UAAU,CAAA;AAAA,MAClC;AAAA,IACF;AAGA,IAAA,uBAAOA,cAAAA,CAAC,SAAA,EAAA,EAAW,GAAG,KAAA,EAAO,CAAA;AAAA,EAC/B,CAAA;AAGA,EAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,WAAA,IAAe,SAAA,CAAU,IAAA,IAAQ,WAAA;AACjE,EAAA,gBAAA,CAAiB,WAAA,GAAc,YAAY,aAAa,CAAA,CAAA,CAAA;AAExD,EAAA,OAAO,gBAAA;AACT;AAKA,SAAS,eAAe,UAAA,EAA4D;AAClF,EAAA,MAAM,YAAA,GAAe,WAAW,QAAA,IAAY,MAAA;AAE5C,EAAA,QAAQ,YAAA;AAAc,IACpB,KAAK,MAAA;AACH,MAAA,OAAO,mBAAmB,IAAA,EAAK;AAAA,IAEjC,KAAK,aAAA;AACH,MAAA,OAAO,kBAAA,CAAmB,WAAA,CAAY,EAAE,CAAA;AAAA,IAE1C,KAAK,SAAA;AACH,MAAA,OAAO,mBAAmB,OAAA,CAAQ;AAAA,QAChC,SAAS,UAAA,CAAW;AAAA,OACrB,CAAA;AAAA,IAEH;AACE,MAAA,OAAO,IAAA;AAAA;AAEb;AAKO,SAAS,gBAAA,CACd,SAAA,EACA,UAAA,EACA,iBAAA,EACwB;AACxB,EAAA,MAAM,gBAAA,GAAmB,CAAC,KAAA,KAAa;AACrC,IAAA,MAAM,OAAO,OAAA,EAAQ;AAGrB,IAAA,MAAM,YAAA,GAAe,kBAAA,CAAmB,IAAA,EAAM,UAAU,CAAA;AAExD,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,uBAAOA,eAAC,iBAAA,EAAA,EAAkB,CAAA;AAAA,IAC5B;AAEA,IAAA,uBAAOA,cAAAA,CAAC,SAAA,EAAA,EAAW,GAAG,KAAA,EAAO,CAAA;AAAA,EAC/B,CAAA;AAEA,EAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,WAAA,IAAe,SAAA,CAAU,IAAA,IAAQ,WAAA;AACjE,EAAA,gBAAA,CAAiB,WAAA,GAAc,oBAAoB,aAAa,CAAA,CAAA,CAAA;AAEhE,EAAA,OAAO,gBAAA;AACT;AAKA,SAAS,kBAAA,CACP,MACA,UAAA,EACS;AAET,EAAA,IAAI,UAAA,CAAW,cAAA,IAAkB,UAAA,CAAW,cAAA,CAAe,SAAS,CAAA,EAAG;AACrE,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,CAAW,UAAA,CAAW,cAAc,CAAA,EAAG;AAC/C,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,IAAI,UAAA,CAAW,oBAAA,IAAwB,UAAA,CAAW,oBAAA,CAAqB,SAAS,CAAA,EAAG;AACjF,IAAA,IAAI,CAAC,IAAA,CAAK,iBAAA,CAAkB,UAAA,CAAW,oBAAoB,CAAA,EAAG;AAC5D,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;;;ACpLA,IAAM,qBAAA,GAEF;AAAA,EACF,SAAA,EAAW;AACb,CAAA;AAwBO,SAAS,qBAAA,GAA8B;AAC5C,EAAA,qBAAA,CAAsB,SAAA,GAAY,QAAA;AAGlC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAgB,MAAA,CAAe,qBAAA,EAAuB;AAC1E,IAAA,OAAA,CAAQ,IAAI,qCAA8B,CAAA;AAAA,EAC5C;AACF;AAUO,SAAS,gBAAA,GAA2C;AACzD,EAAA,OAAO,qBAAA,CAAsB,SAAA;AAC/B;AAyBO,SAAS,iBAAA,CACd,WACA,UAAA,EACwB;AACxB,EAAA,MAAM,YAAY,gBAAA,EAAiB;AAInC,EAAA,IAAI,CAAC,SAAA,IAAa,CAAC,UAAA,EAAY;AAC7B,IAAA,OAAO,SAAA;AAAA,EACT;AAGA,EAAA,OAAO,SAAA,CAAU,WAAW,UAAU,CAAA;AACxC;AAgBO,SAAS,cAAc,IAAA,EAAkD;AAE9E,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACrC,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA,IAAU,IAAA;AACnB","file":"client.js","sourcesContent":["import { createContext, useContext } from 'react';\nimport type { AuthUser, AuthSession } from '../types/index.js';\n\n/**\n * Auth context value provided to component tree\n */\nexport interface AuthContextValue {\n  /**\n   * Currently authenticated user (null if not authenticated)\n   */\n  user: AuthUser | null;\n\n  /**\n   * Current session (null if not authenticated)\n   */\n  session: AuthSession | null;\n\n  /**\n   * Whether user is authenticated\n   */\n  isAuthenticated: boolean;\n\n  /**\n   * Whether auth is still loading\n   */\n  isLoading: boolean;\n\n  /**\n   * Check if user has a specific role\n   */\n  hasRole: (role: string) => boolean;\n\n  /**\n   * Check if user has a specific permission\n   */\n  hasPermission: (permission: string) => boolean;\n\n  /**\n   * Check if user has any of the specified roles\n   */\n  hasAnyRole: (roles: string[]) => boolean;\n\n  /**\n   * Check if user has all of the specified permissions\n   */\n  hasAllPermissions: (permissions: string[]) => boolean;\n}\n\n/**\n * Auth context - provides authentication state to components\n */\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n\n/**\n * Hook to access auth context\n * Throws error if used outside AuthProvider\n */\nexport function useAuth(): AuthContextValue {\n  const context = useContext(AuthContext);\n\n  if (!context) {\n    throw new Error('useAuth must be used within AuthProvider');\n  }\n\n  return context;\n}\n\n/**\n * Hook to require authentication\n * Returns null and logs warning if not authenticated\n */\nexport function useRequireAuth(): AuthContextValue | null {\n  const auth = useAuth();\n\n  if (!auth.isAuthenticated) {\n    console.warn('useRequireAuth: User is not authenticated');\n    return null;\n  }\n\n  return auth;\n}\n","import type { AuthUser, RBACConfig, ComponentAuthConfig } from '../types/index.js';\n\n/**\n * RBAC Engine for checking roles and permissions\n */\nexport class RBACEngine {\n  private config: RBACConfig;\n  private rolePermissions: Map<string, Set<string>>;\n\n  constructor(config: RBACConfig) {\n    this.config = config;\n    this.rolePermissions = this.buildRolePermissionMap();\n  }\n\n  /**\n   * Build internal map of role → permissions for fast lookups\n   */\n  private buildRolePermissionMap(): Map<string, Set<string>> {\n    const map = new Map<string, Set<string>>();\n\n    for (const role of this.config.roles) {\n      map.set(role.name, new Set(role.permissions || []));\n    }\n\n    return map;\n  }\n\n  /**\n   * Check if user has a specific role\n   */\n  hasRole(user: AuthUser, role: string): boolean {\n    return user.roles.includes(role);\n  }\n\n  /**\n   * Check if user has any of the specified roles\n   */\n  hasAnyRole(user: AuthUser, roles: string[]): boolean {\n    return roles.some((role) => this.hasRole(user, role));\n  }\n\n  /**\n   * Check if user has all of the specified roles\n   */\n  hasAllRoles(user: AuthUser, roles: string[]): boolean {\n    return roles.every((role) => this.hasRole(user, role));\n  }\n\n  /**\n   * Check if user has a specific permission\n   * Permissions are checked both:\n   * 1. Directly in user.permissions array\n   * 2. Through role-based permissions from config\n   */\n  hasPermission(user: AuthUser, permission: string): boolean {\n    // Check direct permissions\n    if (user.permissions?.includes(permission)) {\n      return true;\n    }\n\n    // Check role-based permissions\n    for (const role of user.roles) {\n      const permissions = this.rolePermissions.get(role);\n      if (permissions?.has(permission)) {\n        return true;\n      }\n\n      // Check wildcard permissions (e.g., admin:* grants admin:read, admin:write)\n      if (permissions) {\n        for (const p of permissions) {\n          if (p.endsWith(':*')) {\n            const prefix = p.slice(0, -1); // Remove the *\n            if (permission.startsWith(prefix)) {\n              return true;\n            }\n          }\n        }\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Check if user has any of the specified permissions\n   */\n  hasAnyPermission(user: AuthUser, permissions: string[]): boolean {\n    return permissions.some((permission) => this.hasPermission(user, permission));\n  }\n\n  /**\n   * Check if user has all of the specified permissions\n   */\n  hasAllPermissions(user: AuthUser, permissions: string[]): boolean {\n    return permissions.every((permission) => this.hasPermission(user, permission));\n  }\n\n  /**\n   * Check if route is public (no auth required)\n   */\n  isPublicRoute(path: string): boolean {\n    if (!this.config.public_routes) {\n      return false;\n    }\n\n    return this.config.public_routes.some((publicPath) => {\n      return this.matchPath(path, publicPath);\n    });\n  }\n\n  /**\n   * Check if user can access a route based on protected_routes config\n   */\n  canAccessRoute(user: AuthUser | null, path: string): boolean {\n    // Check if route is public\n    if (this.isPublicRoute(path)) {\n      return true;\n    }\n\n    // No user = can't access protected routes\n    if (!user) {\n      return false;\n    }\n\n    // If no protected routes configured, allow by default\n    if (!this.config.protected_routes || this.config.protected_routes.length === 0) {\n      return true;\n    }\n\n    // Find matching protected route\n    const matchingRoute = this.config.protected_routes.find((route) => {\n      return this.matchPath(path, route.path);\n    });\n\n    // If no matching protected route, allow (route not explicitly protected)\n    if (!matchingRoute) {\n      return true;\n    }\n\n    // Check if user has required role for this route\n    return this.hasAnyRole(user, matchingRoute.roles);\n  }\n\n  /**\n   * Check if user can access a component based on component auth config\n   */\n  canAccessComponent(user: AuthUser | null, authConfig: ComponentAuthConfig | undefined): boolean {\n    // No auth config = public component\n    if (!authConfig) {\n      return true;\n    }\n\n    // No user = can't access protected component\n    if (!user) {\n      return false;\n    }\n\n    // Check required roles\n    if (authConfig.required_roles && authConfig.required_roles.length > 0) {\n      if (!this.hasAnyRole(user, authConfig.required_roles)) {\n        return false;\n      }\n    }\n\n    // Check required permissions\n    if (authConfig.required_permissions && authConfig.required_permissions.length > 0) {\n      if (!this.hasAllPermissions(user, authConfig.required_permissions)) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  // Match a path against a pattern with wildcard support\n  private matchPath(path: string, pattern: string): boolean {\n    // Exact match\n    if (path === pattern) {\n      return true;\n    }\n\n    // No wildcards in pattern — only exact match applies\n    if (!pattern.includes('*')) {\n      return false;\n    }\n\n    // Escape ALL regex metacharacters, then convert glob * to .*\n    // This prevents ReDoS from crafted route patterns in YAML config\n    const escaped = pattern\n      .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&') // Escape regex specials\n      .replace(/\\*/g, '.*'); // Convert glob * to .*\n\n    const regex = new RegExp(`^${escaped}$`);\n    return regex.test(path);\n  }\n}\n","import React, { useMemo, type ReactNode, type ReactElement } from 'react';\nimport { AuthContext, type AuthContextValue } from './AuthContext.js';\nimport { RBACEngine } from '../rbac/rbac-engine.js';\nimport type { AuthUser, AuthSession, RBACConfig } from '../types/index.js';\n\nexport interface AuthProviderProps {\n  /**\n   * Current authenticated user (null if not authenticated)\n   */\n  user: AuthUser | null;\n\n  /**\n   * Current session (null if not authenticated)\n   */\n  session: AuthSession | null;\n\n  /**\n   * RBAC configuration for role/permission checking\n   */\n  rbacConfig: RBACConfig;\n\n  /**\n   * Whether auth is still loading\n   */\n  isLoading?: boolean;\n\n  /**\n   * Child components\n   */\n  children: ReactNode;\n}\n\n/**\n * AuthProvider - Provides authentication state to component tree\n *\n * @example\n * ```tsx\n * <AuthProvider user={user} session={session} rbacConfig={config}>\n *   <App />\n * </AuthProvider>\n * ```\n */\nexport function AuthProvider({\n  user,\n  session,\n  rbacConfig,\n  isLoading = false,\n  children,\n}: AuthProviderProps): ReactElement {\n  // Create RBAC engine for role/permission checking\n  const rbac = useMemo(() => new RBACEngine(rbacConfig), [rbacConfig]);\n\n  // Build context value with helper functions\n  const value: AuthContextValue = useMemo(\n    () => ({\n      user,\n      session,\n      isAuthenticated: user !== null,\n      isLoading,\n\n      hasRole: (role: string) => {\n        if (!user) return false;\n        return rbac.hasRole(user, role);\n      },\n\n      hasPermission: (permission: string) => {\n        if (!user) return false;\n        return rbac.hasPermission(user, permission);\n      },\n\n      hasAnyRole: (roles: string[]) => {\n        if (!user) return false;\n        return rbac.hasAnyRole(user, roles);\n      },\n\n      hasAllPermissions: (permissions: string[]) => {\n        if (!user) return false;\n        return rbac.hasAllPermissions(user, permissions);\n      },\n    }),\n    [user, session, isLoading, rbac]\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","import React from 'react';\nimport { useAuth } from '../context/AuthContext.js';\nimport type { ComponentAuthConfig } from '../types/index.js';\n\n/**\n * Props that any component wrapped with withAuth will receive\n */\nexport interface ComponentProps {\n  id?: string;\n  [key: string]: any;\n}\n\n/**\n * Fallback component props\n */\ninterface FallbackProps {\n  message?: string;\n  className?: string;\n}\n\n/**\n * Default fallback components for unauthorized access\n */\nconst FallbackComponents = {\n  /**\n   * Hide component (render nothing)\n   */\n  hide: () => null,\n\n  /**\n   * Show placeholder message\n   */\n  placeholder: ({ className }: FallbackProps) => (\n    <div\n      className={className || 'auth-placeholder'}\n      style={{\n        padding: '1rem',\n        border: '1px dashed #ccc',\n        borderRadius: '4px',\n        color: '#666',\n        fontStyle: 'italic',\n        textAlign: 'center',\n      }}\n    >\n      Content requires authorization\n    </div>\n  ),\n\n  /**\n   * Show custom message\n   */\n  message: ({ message, className }: FallbackProps) => (\n    <div\n      className={className || 'auth-message'}\n      style={{\n        padding: '1rem',\n        border: '1px solid #f0ad4e',\n        borderRadius: '4px',\n        backgroundColor: '#fcf8e3',\n        color: '#8a6d3b',\n      }}\n    >\n      {message || 'Unauthorized'}\n    </div>\n  ),\n};\n\n/**\n * Higher-order component that wraps a component with authentication checks\n *\n * @example\n * ```tsx\n * const ProtectedButton = withAuth(Button, {\n *   required_roles: ['ADMIN'],\n *   fallback: 'message',\n *   fallback_message: 'Only admins can see this button'\n * });\n * ```\n *\n * @param Component - The component to wrap\n * @param authConfig - Authentication requirements from YAML\n * @returns Wrapped component with auth enforcement\n */\nexport function withAuth<P extends ComponentProps>(\n  Component: React.ComponentType<P>,\n  authConfig?: ComponentAuthConfig\n): React.ComponentType<P> {\n  // If no auth config, return component unchanged\n  if (!authConfig) {\n    return Component;\n  }\n\n  // Create wrapped component with display name for debugging\n  const WrappedComponent = (props: P) => {\n    const auth = useAuth();\n\n    // Check role requirements\n    if (authConfig.required_roles && authConfig.required_roles.length > 0) {\n      if (!auth.hasAnyRole(authConfig.required_roles)) {\n        return renderFallback(authConfig);\n      }\n    }\n\n    // Check permission requirements (must have ALL permissions)\n    if (authConfig.required_permissions && authConfig.required_permissions.length > 0) {\n      if (!auth.hasAllPermissions(authConfig.required_permissions)) {\n        return renderFallback(authConfig);\n      }\n    }\n\n    // User authorized - render component\n    return <Component {...props} />;\n  };\n\n  // Set display name for React DevTools\n  const componentName = Component.displayName || Component.name || 'Component';\n  WrappedComponent.displayName = `withAuth(${componentName})`;\n\n  return WrappedComponent;\n}\n\n/**\n * Render fallback component based on configuration\n */\nfunction renderFallback(authConfig: ComponentAuthConfig): React.ReactElement | null {\n  const fallbackType = authConfig.fallback || 'hide';\n\n  switch (fallbackType) {\n    case 'hide':\n      return FallbackComponents.hide();\n\n    case 'placeholder':\n      return FallbackComponents.placeholder({});\n\n    case 'message':\n      return FallbackComponents.message({\n        message: authConfig.fallback_message,\n      });\n\n    default:\n      return null;\n  }\n}\n\n/**\n * Custom fallback component (for advanced use cases)\n */\nexport function withAuthFallback<P extends ComponentProps>(\n  Component: React.ComponentType<P>,\n  authConfig: ComponentAuthConfig,\n  FallbackComponent: React.ComponentType<any>\n): React.ComponentType<P> {\n  const WrappedComponent = (props: P) => {\n    const auth = useAuth();\n\n    // Check authorization\n    const isAuthorized = checkAuthorization(auth, authConfig);\n\n    if (!isAuthorized) {\n      return <FallbackComponent />;\n    }\n\n    return <Component {...props} />;\n  };\n\n  const componentName = Component.displayName || Component.name || 'Component';\n  WrappedComponent.displayName = `withAuthFallback(${componentName})`;\n\n  return WrappedComponent;\n}\n\n/**\n * Check if user is authorized based on auth config\n */\nfunction checkAuthorization(\n  auth: ReturnType<typeof useAuth>,\n  authConfig: ComponentAuthConfig\n): boolean {\n  // Check roles\n  if (authConfig.required_roles && authConfig.required_roles.length > 0) {\n    if (!auth.hasAnyRole(authConfig.required_roles)) {\n      return false;\n    }\n  }\n\n  // Check permissions\n  if (authConfig.required_permissions && authConfig.required_permissions.length > 0) {\n    if (!auth.hasAllPermissions(authConfig.required_permissions)) {\n      return false;\n    }\n  }\n\n  return true;\n}\n","import { withAuth } from './decorators/withAuth.js';\nimport type { ComponentAuthConfig } from './types/index.js';\nimport type React from 'react';\n\n/**\n * Global registry for auth decorator function\n * This allows OSS packages to optionally use auth without depending on it\n *\n * Design principle: No hard dependencies!\n * - OSS core never imports from pro packages\n * - Pro package registers itself at runtime\n * - User app is the glue that connects them\n */\nconst authDecoratorRegistry: {\n  decorator: typeof withAuth | null;\n} = {\n  decorator: null,\n};\n\n/**\n * Register the auth decorator for use by content renderers\n *\n * This should be called once in your app's initialization (e.g., _app.tsx)\n * to enable auth-aware component rendering.\n *\n * @example\n * ```tsx\n * // In pages/_app.tsx\n * import { registerAuthDecorator } from '@stackwright-pro/auth';\n *\n * registerAuthDecorator();\n *\n * function MyApp({ Component, pageProps }: AppProps) {\n *   return (\n *     <AuthProvider {...authProps}>\n *       <Component {...pageProps} />\n *     </AuthProvider>\n *   );\n * }\n * ```\n */\nexport function registerAuthDecorator(): void {\n  authDecoratorRegistry.decorator = withAuth;\n\n  // Debug logging (only in browser with debug flag)\n  if (typeof window !== 'undefined' && (window as any).__STACKWRIGHT_DEBUG__) {\n    console.log('🔐 Auth decorator registered');\n  }\n}\n\n/**\n * Get the registered auth decorator (for use by content renderers)\n *\n * Returns null if auth is not registered, allowing graceful degradation.\n * This is the function that OSS core would call to check if auth is available.\n *\n * @returns The withAuth decorator function, or null if not registered\n */\nexport function getAuthDecorator(): typeof withAuth | null {\n  return authDecoratorRegistry.decorator;\n}\n\n/**\n * Wrap a component with auth if decorator is registered and config exists\n *\n * This is a safe wrapper that OSS packages can use without depending on auth.\n * If auth is not registered, returns the original component unchanged.\n * If auth config is missing/undefined, returns the original component unchanged.\n *\n * @example\n * ```tsx\n * // In content renderer (can live in OSS core!)\\n * function renderContentItem(item: ContentItem) {\n *   const Component = getComponentFromRegistry(item.type);\n *\n *   // Apply auth if available\n *   const WrappedComponent = maybeWrapWithAuth(Component, item.auth);\n *\n *   return <WrappedComponent {...item} />;\n * }\n * ```\n *\n * @param Component - Component to wrap\n * @param authConfig - Auth configuration from YAML (optional)\n * @returns Wrapped component if auth is registered, original component otherwise\n */\nexport function maybeWrapWithAuth<P extends { id?: string; [key: string]: any }>(\n  Component: React.ComponentType<P>,\n  authConfig?: ComponentAuthConfig\n): React.ComponentType<P> {\n  const decorator = getAuthDecorator();\n\n  // No decorator registered or no auth config = return unwrapped\n  // This ensures graceful degradation when auth isn't installed\n  if (!decorator || !authConfig) {\n    return Component;\n  }\n\n  // Wrap with auth\n  return decorator(Component, authConfig);\n}\n\n/**\n * Type guard to check if content item has auth config\n *\n * Useful for conditionally applying auth in renderers without\n * needing to import auth types.\n *\n * @example\n * ```tsx\n * if (hasAuthConfig(item)) {\n *   // TypeScript knows item.auth exists\n *   WrappedComponent = maybeWrapWithAuth(Component, item.auth);\n * }\n * ```\n */\nexport function hasAuthConfig(item: any): item is { auth: ComponentAuthConfig } {\n  // Explicitly return boolean to handle null/undefined properly\n  if (!item || typeof item !== 'object') {\n    return false;\n  }\n  return 'auth' in item;\n}\n"]}