@thunderid/react 1.14.0 → 1.15.1

package/dist/cjs/components/{admin → management}/RoleAssignments/RoleAssignments.cjs

@@ -11,7 +11,7 @@ react = require_rolldown_runtime.__toESM(react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/components/admin/RoleAssignments/RoleAssignments.tsx
+//#region src/components/management/RoleAssignments/RoleAssignments.tsx
 /**
 * Lists who holds a role, and lets the signed-in user assign it to users, groups and agents or
 * remove it from them.

package/dist/cjs/components/management/RoleAssignments/RoleAssignments.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleAssignments.cjs","names":["RoleAssignments: FC<RoleAssignmentsProps>","useTranslation","rolesEndpoint: ManagementEndpoint","useManagementEndpoint","usersEndpoint: ManagementEndpoint","groupsEndpoint: ManagementEndpoint","agentsEndpoint: ManagementEndpoint","type: RoleAssigneeType | undefined","filter: string | undefined","assignments: ResourceQueryResult<RoleAssignmentListResponse>","useResourceQuery","RoleQueryKeys","users: ResourceQueryResult<FilteredPage<ManagedUserListResponse>>","UserQueryKeys","groups: ResourceQueryResult<FilteredPage<GroupListResponse>>","GroupQueryKeys","agents: ResourceQueryResult<FilteredPage<AgentListResponse>>","AgentQueryKeys","assign: ResourceMutationResult<void, RoleAssignmentsVariables>","useResourceMutation","unassign: ResourceMutationResult<void, RoleAssignmentsVariables>","candidates: Partial<Record<'user' | 'group' | 'agent', IdentityCandidate[]>>","BaseRoleAssignments"],"sources":["../../../../../src/components/management/RoleAssignments/RoleAssignments.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  AdministrationMode,\n  AgentListResponse,\n  AgentQueryKeys,\n  BasicAgent,\n  Group,\n  GroupListResponse,\n  GroupQueryKeys,\n  ManagedUser,\n  ManagedUserListResponse,\n  RoleAssigneeType,\n  RoleAssignment,\n  RoleAssignmentInput,\n  RoleAssignmentListResponse,\n  RoleQueryKeys,\n  UserQueryKeys,\n  addRoleAssignments,\n  getAgentName,\n  getAgents,\n  getGroups,\n  getRoleAssignments,\n  getUsers,\n  removeRoleAssignments,\n  resolveManagedIdentityName,\n  toEqualityFilter,\n  toManagementErrorMessage,\n} from '@thunderid/browser';\nimport {FC, ReactElement, useMemo, useState} from 'react';\nimport BaseRoleAssignments, {BaseRoleAssignmentsProps} from './BaseRoleAssignments';\nimport useManagementEndpoint, {ManagementEndpoint} from '../../../hooks/management/useManagementEndpoint';\nimport useResourceMutation, {ResourceMutationResult} from '../../../hooks/management/useResourceMutation';\nimport useResourceQuery, {ResourceQueryResult} from '../../../hooks/management/useResourceQuery';\nimport useTranslation from '../../../hooks/useTranslation';\nimport {IdentityCandidate} from '../shared/IdentityPicker';\n\ninterface RoleAssignmentsVariables {\n  assignments: RoleAssignmentInput[];\n  roleId: string;\n}\n\n/**\n * A candidate page with the filter it was listed with.\n */\ninterface FilteredPage<T> {\n  filter: string | undefined;\n  page: T;\n}\n\nexport type RoleAssignmentsProps = Omit<\n  BaseRoleAssignmentsProps,\n  | 'assignments'\n  | 'candidates'\n  | 'error'\n  | 'isLoading'\n  | 'isMutating'\n  | 'onAssign'\n  | 'onTypeFilterChange'\n  | 'onUnassign'\n  | 'typeFilter'\n> & {\n  /**\n   * How an assignment is removed. `flow` runs the administration flow the server configures for it, which can revoke\n   * grants and end sessions first. It needs `baseUrl`.\n   * @default 'native'\n   */\n  administrationMode?: AdministrationMode;\n  /**\n   * Whether assignments can be added and removed from this view.\n   * @default false\n   */\n  editable?: boolean;\n  /**\n   * Whether to show the assignee type filter, which narrows the list on the server.\n   * @default true\n   */\n  filterable?: boolean;\n  /**\n   * Organization unit the users, groups and agents offered for assignment are listed from.\n   */\n  ouId?: string;\n  roleId: string;\n};\n\n/**\n * Lists who holds a role, and lets the signed-in user assign it to users, groups and agents or\n * remove it from them.\n *\n * @example\n * ```tsx\n * <RoleAssignments roleId={roleId} />\n * ```\n */\nconst RoleAssignments: FC<RoleAssignmentsProps> = ({\n  administrationMode,\n  editable = false,\n  filterable = true,\n  ouId,\n  preferences,\n  roleId,\n  ...rest\n}: RoleAssignmentsProps): ReactElement => {\n  const {t} = useTranslation(preferences?.i18n);\n  const [typeFilter, setTypeFilter] = useState<RoleAssigneeType | null>(null);\n  const rolesEndpoint: ManagementEndpoint = useManagementEndpoint('roles');\n  const usersEndpoint: ManagementEndpoint = useManagementEndpoint('users');\n  const groupsEndpoint: ManagementEndpoint = useManagementEndpoint('groups');\n  const agentsEndpoint: ManagementEndpoint = useManagementEndpoint('agents');\n  const type: RoleAssigneeType | undefined = typeFilter ?? undefined;\n  const filter: string | undefined = toEqualityFilter('ouId', ouId);\n  const assignments: ResourceQueryResult<RoleAssignmentListResponse> = useResourceQuery(\n    [RoleQueryKeys.ROLE_ASSIGNMENTS, roleId, {limit: 100, type}],\n    (fetcher) => getRoleAssignments({...rolesEndpoint, fetcher, limit: 100, roleId, type}),\n    {enabled: Boolean(roleId)},\n  );\n  const users: ResourceQueryResult<FilteredPage<ManagedUserListResponse>> = useResourceQuery(\n    [UserQueryKeys.USERS, {filter, limit: 100}],\n    async (fetcher) => ({filter, page: await getUsers({...usersEndpoint, fetcher, filter, limit: 100})}),\n    {enabled: editable},\n  );\n  const groups: ResourceQueryResult<FilteredPage<GroupListResponse>> = useResourceQuery(\n    [GroupQueryKeys.GROUPS, {filter, limit: 100}],\n    async (fetcher) => ({filter, page: await getGroups({...groupsEndpoint, fetcher, filter, limit: 100})}),\n    {enabled: editable},\n  );\n  const agents: ResourceQueryResult<FilteredPage<AgentListResponse>> = useResourceQuery(\n    [AgentQueryKeys.AGENTS, {filter, limit: 100}],\n    async (fetcher) => ({filter, page: await getAgents({...agentsEndpoint, fetcher, filter, limit: 100})}),\n    {enabled: editable},\n  );\n  const assign: ResourceMutationResult<void, RoleAssignmentsVariables> = useResourceMutation(\n    ({assignments: changes, roleId: id}: RoleAssignmentsVariables, fetcher) =>\n      addRoleAssignments({...rolesEndpoint, assignments: changes, fetcher, roleId: id}),\n    () => [[RoleQueryKeys.ROLE_ASSIGNMENTS]],\n  );\n  const unassign: ResourceMutationResult<void, RoleAssignmentsVariables> = useResourceMutation(\n    ({assignments: changes, roleId: id}: RoleAssignmentsVariables, fetcher) =>\n      removeRoleAssignments({...rolesEndpoint, administrationMode, assignments: changes, fetcher, roleId: id}),\n    () => [[RoleQueryKeys.ROLE_ASSIGNMENTS]],\n  );\n\n  const candidates: Partial<Record<'user' | 'group' | 'agent', IdentityCandidate[]>> = useMemo(() => {\n    // A page listed for an earlier ouId stays in a query until the next one succeeds, so it is not offered.\n    const current = <T,>(data: FilteredPage<T> | undefined): T | undefined =>\n      data && data.filter === filter ? data.page : undefined;\n\n    return {\n      agent: (current(agents.data)?.agents ?? []).map((agent: BasicAgent) => ({\n        id: agent.id,\n        label: getAgentName(agent),\n      })),\n      group: (current(groups.data)?.groups ?? []).map((group: Group) => ({id: group.id, label: group.name})),\n      user: (current(users.data)?.users ?? []).map((user: ManagedUser) => ({\n        id: user.id,\n        label: resolveManagedIdentityName(user),\n      })),\n    };\n  }, [agents.data, filter, groups.data, users.data]);\n\n  return (\n    <BaseRoleAssignments\n      assignments={assignments.data?.assignments ?? []}\n      isLoading={assignments.isLoading}\n      isMutating={assign.isLoading || unassign.isLoading}\n      error={\n        toManagementErrorMessage(t, assignments.error, 'admin.roles.assignments.error') ??\n        toManagementErrorMessage(t, assign.error ?? unassign.error, 'admin.roles.assignments.update_error')\n      }\n      candidates={editable ? candidates : undefined}\n      onAssign={\n        editable\n          ? (assignment: RoleAssignmentInput): void => void assign.mutate({assignments: [assignment], roleId})\n          : undefined\n      }\n      onUnassign={\n        editable\n          ? (assignment: RoleAssignment): void =>\n              void unassign.mutate({assignments: [{id: assignment.id, type: assignment.type}], roleId})\n          : undefined\n      }\n      typeFilter={typeFilter}\n      onTypeFilterChange={filterable ? setTypeFilter : undefined}\n      preferences={preferences}\n      {...rest}\n    />\n  );\n};\n\nexport default RoleAssignments;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA+FA,MAAMA,mBAA6C,EACjD,oBACA,WAAW,OACX,aAAa,MACb,MACA,aACA,OACA,GAAG,WACqC;CACxC,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAC7C,MAAM,CAAC,YAAY,qCAAmD,KAAK;CAC3E,MAAMC,gBAAoCC,sCAAsB,QAAQ;CACxE,MAAMC,gBAAoCD,sCAAsB,QAAQ;CACxE,MAAME,iBAAqCF,sCAAsB,SAAS;CAC1E,MAAMG,iBAAqCH,sCAAsB,SAAS;CAC1E,MAAMI,OAAqC,cAAc;CACzD,MAAMC,mDAA8C,QAAQ,KAAK;CACjE,MAAMC,cAA+DC,iCACnE;EAACC,kCAAc;EAAkB;EAAQ;GAAC,OAAO;GAAK;GAAK;EAAC,GAC3D,wDAA+B;EAAC,GAAG;EAAe;EAAS,OAAO;EAAK;EAAQ;EAAK,CAAC,EACtF,EAAC,SAAS,QAAQ,OAAO,EAAC,CAC3B;CACD,MAAMC,QAAoEF,iCACxE,CAACG,kCAAc,OAAO;EAAC;EAAQ,OAAO;EAAI,CAAC,EAC3C,OAAO,aAAa;EAAC;EAAQ,MAAM,wCAAe;GAAC,GAAG;GAAe;GAAS;GAAQ,OAAO;GAAI,CAAC;EAAC,GACnG,EAAC,SAAS,UAAS,CACpB;CACD,MAAMC,SAA+DJ,iCACnE,CAACK,mCAAe,QAAQ;EAAC;EAAQ,OAAO;EAAI,CAAC,EAC7C,OAAO,aAAa;EAAC;EAAQ,MAAM,yCAAgB;GAAC,GAAG;GAAgB;GAAS;GAAQ,OAAO;GAAI,CAAC;EAAC,GACrG,EAAC,SAAS,UAAS,CACpB;CACD,MAAMC,SAA+DN,iCACnE,CAACO,mCAAe,QAAQ;EAAC;EAAQ,OAAO;EAAI,CAAC,EAC7C,OAAO,aAAa;EAAC;EAAQ,MAAM,yCAAgB;GAAC,GAAG;GAAgB;GAAS;GAAQ,OAAO;GAAI,CAAC;EAAC,GACrG,EAAC,SAAS,UAAS,CACpB;CACD,MAAMC,SAAiEC,qCACpE,EAAC,aAAa,SAAS,QAAQ,MAA+B,wDAC1C;EAAC,GAAG;EAAe,aAAa;EAAS;EAAS,QAAQ;EAAG,CAAC,QAC7E,CAAC,CAACR,kCAAc,iBAAiB,CAAC,CACzC;CACD,MAAMS,WAAmED,qCACtE,EAAC,aAAa,SAAS,QAAQ,MAA+B,2DACvC;EAAC,GAAG;EAAe;EAAoB,aAAa;EAAS;EAAS,QAAQ;EAAG,CAAC,QACpG,CAAC,CAACR,kCAAc,iBAAiB,CAAC,CACzC;CAED,MAAMU,sCAA6F;EAEjG,MAAM,WAAe,SACnB,QAAQ,KAAK,WAAW,SAAS,KAAK,OAAO;AAE/C,SAAO;GACL,QAAQ,QAAQ,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,WAAuB;IACtE,IAAI,MAAM;IACV,6CAAoB,MAAM;IAC3B,EAAE;GACH,QAAQ,QAAQ,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,WAAkB;IAAC,IAAI,MAAM;IAAI,OAAO,MAAM;IAAK,EAAE;GACtG,OAAO,QAAQ,MAAM,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,UAAuB;IACnE,IAAI,KAAK;IACT,2DAAkC,KAAK;IACxC,EAAE;GACJ;IACA;EAAC,OAAO;EAAM;EAAQ,OAAO;EAAM,MAAM;EAAK,CAAC;AAElD,QACE,2CAACC;EACC,aAAa,YAAY,MAAM,eAAe,EAAE;EAChD,WAAW,YAAY;EACvB,YAAY,OAAO,aAAa,SAAS;EACzC,yDAC2B,GAAG,YAAY,OAAO,gCAAgC,sDACtD,GAAG,OAAO,SAAS,SAAS,OAAO,uCAAuC;EAErG,YAAY,WAAW,aAAa;EACpC,UACE,YACK,eAA0C,KAAK,OAAO,OAAO;GAAC,aAAa,CAAC,WAAW;GAAE;GAAO,CAAC,GAClG;EAEN,YACE,YACK,eACC,KAAK,SAAS,OAAO;GAAC,aAAa,CAAC;IAAC,IAAI,WAAW;IAAI,MAAM,WAAW;IAAK,CAAC;GAAE;GAAO,CAAC,GAC3F;EAEM;EACZ,oBAAoB,aAAa,gBAAgB;EACpC;EACb,GAAI;GACJ;;AAIN,8BAAe"}

package/dist/cjs/components/{admin → management}/RoleCreate/BaseRoleCreate.cjs

@@ -11,7 +11,7 @@ react = require_rolldown_runtime.__toESM(react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/components/admin/RoleCreate/BaseRoleCreate.tsx
+//#region src/components/management/RoleCreate/BaseRoleCreate.tsx
 /**
 * A form that collects a new role's name and description. Holds no data of its own: handle the
 * submission.

package/dist/cjs/components/management/RoleCreate/BaseRoleCreate.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseRoleCreate.cjs","names":["BaseRoleCreate: FC<BaseRoleCreateProps>","useTheme","styles: Record<string, string>","useStyles","useTranslation","isValid: boolean","AdminSection","Alert","TextField","Button"],"sources":["../../../../../src/components/management/RoleCreate/BaseRoleCreate.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {Preferences} from '@thunderid/browser';\nimport {ChangeEvent, FC, FormEvent, ReactElement, ReactNode, useState} from 'react';\nimport useTheme from '../../../contexts/Theme/useTheme';\nimport useTranslation from '../../../hooks/useTranslation';\nimport Alert from '../../primitives/Alert/Alert';\nimport Button from '../../primitives/Button/Button';\nimport TextField from '../../primitives/TextField/TextField';\nimport AdminSection from '../shared/AdminSection';\nimport useStyles from '../shared/AdminSection.styles';\n\n/**\n * The role {@link BaseRoleCreate} submits. The organization unit is added by the caller.\n */\nexport interface RoleCreateSubmission {\n  description?: string;\n  name: string;\n}\n\n/**\n * What {@link BaseRoleCreate} hands its `children` render function, so the form can be built with any UI.\n */\nexport interface BaseRoleCreateRenderProps {\n  error: string | null;\n  /**\n   * Sets one field of the form.\n   */\n  handleInputChange: (field: 'description' | 'name', value: string) => void;\n  /**\n   * Submits the current values. Does nothing while they are not valid.\n   */\n  handleSubmit: () => void;\n  isSubmitting: boolean;\n  /**\n   * Whether the values can be submitted.\n   */\n  isValid: boolean;\n  onCancel?: () => void;\n  values: {description: string; name: string};\n}\n\nexport interface BaseRoleCreateProps {\n  /**\n   * Renders custom UI in place of the default form. Receives the values, their setters, the submit\n   * handler and the submission state.\n   */\n  children?: (props: BaseRoleCreateRenderProps) => ReactNode;\n  className?: string;\n  description?: string;\n  error?: string | null;\n  isSubmitting?: boolean;\n  onCancel?: () => void;\n  onSubmit: (role: RoleCreateSubmission) => void;\n  preferences?: Preferences;\n  title?: string;\n}\n\n/**\n * A form that collects a new role's name and description. Holds no data of its own: handle the\n * submission.\n */\nconst BaseRoleCreate: FC<BaseRoleCreateProps> = ({\n  children,\n  className,\n  description,\n  error = null,\n  isSubmitting = false,\n  onCancel,\n  onSubmit,\n  preferences,\n  title,\n}: BaseRoleCreateProps): ReactElement => {\n  const {theme, colorScheme} = useTheme();\n  const styles: Record<string, string> = useStyles(theme, colorScheme);\n  const {t} = useTranslation(preferences?.i18n);\n  const [name, setName] = useState<string>('');\n  const [roleDescription, setRoleDescription] = useState<string>('');\n\n  const isValid: boolean = name.trim().length > 0;\n\n  const submit = (): void => {\n    if (isValid) {\n      onSubmit({description: roleDescription.trim() || undefined, name: name.trim()});\n    }\n  };\n\n  const handleSubmit = (event: FormEvent<HTMLFormElement>): void => {\n    event.preventDefault();\n    submit();\n  };\n\n  if (children) {\n    return (\n      <div className={className}>\n        {children({\n          error,\n          handleInputChange: (field: 'description' | 'name', value: string): void =>\n            field === 'name' ? setName(value) : setRoleDescription(value),\n          handleSubmit: submit,\n          isSubmitting,\n          isValid,\n          onCancel,\n          values: {description: roleDescription, name},\n        })}\n      </div>\n    );\n  }\n\n  return (\n    <AdminSection\n      block=\"role-create\"\n      className={className}\n      title={title ?? t('admin.roles.create.title')}\n      description={description}\n      preferences={preferences}\n    >\n      <form className={styles['form']} onSubmit={handleSubmit} noValidate>\n        {error && (\n          <Alert variant=\"error\" role=\"alert\">\n            {error}\n          </Alert>\n        )}\n        <TextField\n          name=\"name\"\n          label={t('admin.roles.create.fields.name')}\n          required\n          value={name}\n          onChange={(event: ChangeEvent<HTMLInputElement>): void => setName(event.target.value)}\n        />\n        <TextField\n          name=\"description\"\n          label={t('admin.roles.create.fields.description')}\n          value={roleDescription}\n          onChange={(event: ChangeEvent<HTMLInputElement>): void => setRoleDescription(event.target.value)}\n        />\n        <div className={styles['formActions']}>\n          {onCancel && (\n            <Button type=\"button\" variant=\"text\" onClick={onCancel} disabled={isSubmitting}>\n              {t('admin.common.actions.cancel')}\n            </Button>\n          )}\n          <Button type=\"submit\" loading={isSubmitting} disabled={!isValid || isSubmitting}>\n            {t('admin.roles.create.submit')}\n          </Button>\n        </div>\n      </form>\n    </AdminSection>\n  );\n};\n\nexport default BaseRoleCreate;\n"],"mappings":";;;;;;;;;;;;;;;;;;AA+DA,MAAMA,kBAA2C,EAC/C,UACA,WACA,aACA,QAAQ,MACR,eAAe,OACf,UACA,UACA,aACA,YACuC;CACvC,MAAM,EAAC,OAAO,gBAAeC,0BAAU;CACvC,MAAMC,SAAiCC,oCAAU,OAAO,YAAY;CACpE,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAC7C,MAAM,CAAC,MAAM,+BAA4B,GAAG;CAC5C,MAAM,CAAC,iBAAiB,0CAAuC,GAAG;CAElE,MAAMC,UAAmB,KAAK,MAAM,CAAC,SAAS;CAE9C,MAAM,eAAqB;AACzB,MAAI,QACF,UAAS;GAAC,aAAa,gBAAgB,MAAM,IAAI;GAAW,MAAM,KAAK,MAAM;GAAC,CAAC;;CAInF,MAAM,gBAAgB,UAA4C;AAChE,QAAM,gBAAgB;AACtB,UAAQ;;AAGV,KAAI,SACF,QACE,2CAAC;EAAe;YACb,SAAS;GACR;GACA,oBAAoB,OAA+B,UACjD,UAAU,SAAS,QAAQ,MAAM,GAAG,mBAAmB,MAAM;GAC/D,cAAc;GACd;GACA;GACA;GACA,QAAQ;IAAC,aAAa;IAAiB;IAAK;GAC7C,CAAC;GACE;AAIV,QACE,2CAACC;EACC,OAAM;EACK;EACX,OAAO,SAAS,EAAE,2BAA2B;EAChC;EACA;YAEb,4CAAC;GAAK,WAAW,OAAO;GAAS,UAAU;GAAc;;IACtD,SACC,2CAACC;KAAM,SAAQ;KAAQ,MAAK;eACzB;MACK;IAEV,2CAACC;KACC,MAAK;KACL,OAAO,EAAE,iCAAiC;KAC1C;KACA,OAAO;KACP,WAAW,UAA+C,QAAQ,MAAM,OAAO,MAAM;MACrF;IACF,2CAACA;KACC,MAAK;KACL,OAAO,EAAE,wCAAwC;KACjD,OAAO;KACP,WAAW,UAA+C,mBAAmB,MAAM,OAAO,MAAM;MAChG;IACF,4CAAC;KAAI,WAAW,OAAO;gBACpB,YACC,2CAACC;MAAO,MAAK;MAAS,SAAQ;MAAO,SAAS;MAAU,UAAU;gBAC/D,EAAE,8BAA8B;OAC1B,EAEX,2CAACA;MAAO,MAAK;MAAS,SAAS;MAAc,UAAU,CAAC,WAAW;gBAChE,EAAE,4BAA4B;OACxB;MACL;;IACD;GACM;;AAInB,6BAAe"}

package/dist/cjs/components/{admin → management}/RoleCreate/RoleCreate.cjs

@@ -9,7 +9,7 @@ __thunderid_browser = require_rolldown_runtime.__toESM(__thunderid_browser);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/components/admin/RoleCreate/RoleCreate.tsx
+//#region src/components/management/RoleCreate/RoleCreate.tsx
 /**
 * Creates a role through the management API.
 *

package/dist/cjs/components/management/RoleCreate/RoleCreate.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleCreate.cjs","names":["RoleCreate: FC<RoleCreateProps>","useTranslation","resolvedOuId: string | undefined","useDefaultOuId","endpoint: ManagementEndpoint","useManagementEndpoint","useResourceMutation","RoleQueryKeys","BaseRoleCreate"],"sources":["../../../../../src/components/management/RoleCreate/RoleCreate.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {CreateRoleRequest, Role, RoleQueryKeys, createRole, toManagementErrorMessage} from '@thunderid/browser';\nimport {FC, ReactElement} from 'react';\nimport BaseRoleCreate, {BaseRoleCreateProps, RoleCreateSubmission} from './BaseRoleCreate';\nimport useManagementEndpoint, {ManagementEndpoint} from '../../../hooks/management/useManagementEndpoint';\nimport useResourceMutation, {ResourceMutationResult} from '../../../hooks/management/useResourceMutation';\nimport useTranslation from '../../../hooks/useTranslation';\nimport useDefaultOuId from '../shared/useDefaultOuId';\n\nexport type RoleCreateProps = Omit<BaseRoleCreateProps, 'error' | 'isSubmitting' | 'onSubmit'> & {\n  /**\n   * Called with the created role.\n   */\n  onCreated?: (role: Role) => void;\n  /**\n   * Organization unit the role is created in. Defaults to the signed-in user's organization unit.\n   */\n  ouId?: string;\n};\n\n/**\n * Creates a role through the management API.\n *\n * @example\n * ```tsx\n * <RoleCreate onCreated={(role) => navigate(`/roles/${role.id}`)} />\n * ```\n */\nconst RoleCreate: FC<RoleCreateProps> = ({onCreated, ouId, preferences, ...rest}: RoleCreateProps): ReactElement => {\n  const {t} = useTranslation(preferences?.i18n);\n  const resolvedOuId: string | undefined = useDefaultOuId(ouId);\n  const endpoint: ManagementEndpoint = useManagementEndpoint('roles');\n  const {error, isLoading, mutate}: ResourceMutationResult<Role, CreateRoleRequest> = useResourceMutation(\n    (payload: CreateRoleRequest, fetcher) => createRole({...endpoint, fetcher, payload}),\n    () => [[RoleQueryKeys.ROLES], [RoleQueryKeys.ROLE_ASSIGNMENTS]],\n    {onSuccess: onCreated},\n  );\n\n  const handleSubmit = ({description, name}: RoleCreateSubmission): void => {\n    if (resolvedOuId) {\n      void mutate({description, name, ouId: resolvedOuId});\n    }\n  };\n\n  return (\n    <BaseRoleCreate\n      onSubmit={handleSubmit}\n      isSubmitting={isLoading}\n      error={\n        resolvedOuId ? toManagementErrorMessage(t, error, 'admin.roles.create.error') : t('admin.common.errors.no_ou')\n      }\n      preferences={preferences}\n      {...rest}\n    />\n  );\n};\n\nexport default RoleCreate;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA8BA,MAAMA,cAAmC,EAAC,WAAW,MAAM,YAAa,GAAG,WAAyC;CAClH,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAC7C,MAAMC,eAAmCC,+BAAe,KAAK;CAC7D,MAAMC,WAA+BC,sCAAsB,QAAQ;CACnE,MAAM,EAAC,OAAO,WAAW,WAA2DC,qCACjF,SAA4B,gDAAuB;EAAC,GAAG;EAAU;EAAS;EAAQ,CAAC,QAC9E,CAAC,CAACC,kCAAc,MAAM,EAAE,CAACA,kCAAc,iBAAiB,CAAC,EAC/D,EAAC,WAAW,WAAU,CACvB;CAED,MAAM,gBAAgB,EAAC,aAAa,WAAsC;AACxE,MAAI,aACF,CAAK,OAAO;GAAC;GAAa;GAAM,MAAM;GAAa,CAAC;;AAIxD,QACE,2CAACC;EACC,UAAU;EACV,cAAc;EACd,OACE,iEAAwC,GAAG,OAAO,2BAA2B,GAAG,EAAE,4BAA4B;EAEnG;EACb,GAAI;GACJ;;AAIN,yBAAe"}

package/dist/cjs/components/management/RoleDetails/BaseRoleDetails.cjs

@@ -0,0 +1,87 @@
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_useTranslation = require('../../../hooks/useTranslation.cjs');
+const require_Spinner = require('../../primitives/Spinner/Spinner.cjs');
+const require_Alert = require('../../primitives/Alert/Alert.cjs');
+const require_useAdminPartStyles = require('../shared/useAdminPartStyles.cjs');
+const require_AdminSection = require('../shared/AdminSection.cjs');
+const require_AdminParts = require('../shared/AdminParts.cjs');
+let react_jsx_runtime = require("react/jsx-runtime");
+react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
+
+//#region src/components/management/RoleDetails/BaseRoleDetails.tsx
+/**
+* Shows a role's name, description and organization unit, with what it grants and who holds it under them. Holds no
+* data of its own: pass the role and handle deletion.
+*/
+const BaseRoleDetails = ({ actions, assignments, children, className, error = null, isDeleting = false, isLoading = false, onDelete, permissions, preferences, role }) => {
+	const { t } = require_useTranslation.default(preferences?.i18n);
+	const styles = require_useAdminPartStyles.default();
+	if (children) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+		className,
+		children: children({
+			error,
+			isDeleting,
+			isLoading,
+			onDelete: role && !role.isReadOnly ? onDelete : void 0,
+			role
+		})
+	});
+	if (isLoading && !role) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminSection.default, {
+		block: "role-details",
+		className,
+		preferences,
+		children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+			className: styles["muted"],
+			role: "status",
+			children: [
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Spinner.default, { size: "small" }),
+				" ",
+				t("admin.common.loading")
+			]
+		})
+	});
+	if (!role) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminSection.default, {
+		block: "role-details",
+		className,
+		preferences,
+		children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Alert.default, {
+			variant: "error",
+			role: "alert",
+			children: error ?? t("admin.common.errors.not_found")
+		})
+	});
+	return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(require_AdminSection.default, {
+		block: "role-details",
+		className,
+		title: role.name,
+		description: role.description,
+		preferences,
+		actions: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [actions, onDelete && !role.isReadOnly && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminParts.ConfirmButton, {
+			confirmText: t("admin.roles.details.delete.confirm", { name: role.name }),
+			isLoading: isDeleting,
+			onConfirm: onDelete,
+			children: t("admin.roles.details.delete.action")
+		})] }),
+		children: [
+			error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Alert.default, {
+				variant: "error",
+				role: "alert",
+				children: error
+			}),
+			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminParts.Panel, {
+				title: t("admin.roles.details.overview"),
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminParts.DetailList, { items: [{
+					label: t("admin.common.columns.organization_unit"),
+					value: role.ouHandle ?? role.ouId
+				}] })
+			}),
+			permissions,
+			assignments
+		]
+	});
+};
+var BaseRoleDetails_default = BaseRoleDetails;
+
+//#endregion
+exports.default = BaseRoleDetails_default;
+//# sourceMappingURL=BaseRoleDetails.cjs.map

package/dist/cjs/components/management/RoleDetails/BaseRoleDetails.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseRoleDetails.cjs","names":["BaseRoleDetails: FC<BaseRoleDetailsProps>","useTranslation","styles: Record<string, string>","useAdminPartStyles","AdminSection","Spinner","Alert","ConfirmButton","Panel","DetailList"],"sources":["../../../../../src/components/management/RoleDetails/BaseRoleDetails.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {Preferences, RoleSummary} from '@thunderid/browser';\nimport {FC, ReactElement, ReactNode} from 'react';\nimport useTranslation from '../../../hooks/useTranslation';\nimport Alert from '../../primitives/Alert/Alert';\nimport Spinner from '../../primitives/Spinner/Spinner';\nimport {ConfirmButton, DetailList, Panel} from '../shared/AdminParts';\nimport AdminSection from '../shared/AdminSection';\nimport useAdminPartStyles from '../shared/useAdminPartStyles';\n\n/**\n * What {@link BaseRoleDetails} hands its `children` render function, so the role can be shown with any UI.\n */\nexport interface BaseRoleDetailsRenderProps {\n  error: string | null;\n  isDeleting: boolean;\n  isLoading: boolean;\n  /**\n   * Deletes the role. Undefined when deletion is not allowed, including for read-only roles.\n   */\n  onDelete?: () => void;\n  role?: RoleSummary;\n}\n\nexport interface BaseRoleDetailsProps {\n  /**\n   * Controls rendered next to the role's name.\n   */\n  actions?: ReactNode;\n  /**\n   * Who the role is assigned to, rendered under its permissions, such as a `RoleAssignments`.\n   */\n  assignments?: ReactNode;\n  /**\n   * Renders custom UI in place of the default view. Receives the role, the loading and error state, and the delete\n   * handler.\n   */\n  children?: (props: BaseRoleDetailsRenderProps) => ReactNode;\n  className?: string;\n  error?: string | null;\n  isDeleting?: boolean;\n  isLoading?: boolean;\n  /**\n   * Deletes the role. The delete action is hidden when omitted, and for read-only roles.\n   */\n  onDelete?: () => void;\n  /**\n   * What the role grants, rendered under its overview, such as a `RolePermissions`.\n   */\n  permissions?: ReactNode;\n  preferences?: Preferences;\n  role?: RoleSummary;\n}\n\n/**\n * Shows a role's name, description and organization unit, with what it grants and who holds it under them. Holds no\n * data of its own: pass the role and handle deletion.\n */\nconst BaseRoleDetails: FC<BaseRoleDetailsProps> = ({\n  actions,\n  assignments,\n  children,\n  className,\n  error = null,\n  isDeleting = false,\n  isLoading = false,\n  onDelete,\n  permissions,\n  preferences,\n  role,\n}: BaseRoleDetailsProps): ReactElement => {\n  const {t} = useTranslation(preferences?.i18n);\n  const styles: Record<string, string> = useAdminPartStyles();\n\n  if (children) {\n    return (\n      <div className={className}>\n        {children({error, isDeleting, isLoading, onDelete: role && !role.isReadOnly ? onDelete : undefined, role})}\n      </div>\n    );\n  }\n\n  if (isLoading && !role) {\n    return (\n      <AdminSection block=\"role-details\" className={className} preferences={preferences}>\n        <span className={styles['muted']} role=\"status\">\n          <Spinner size=\"small\" /> {t('admin.common.loading')}\n        </span>\n      </AdminSection>\n    );\n  }\n\n  if (!role) {\n    return (\n      <AdminSection block=\"role-details\" className={className} preferences={preferences}>\n        <Alert variant=\"error\" role=\"alert\">\n          {error ?? t('admin.common.errors.not_found')}\n        </Alert>\n      </AdminSection>\n    );\n  }\n\n  return (\n    <AdminSection\n      block=\"role-details\"\n      className={className}\n      title={role.name}\n      description={role.description}\n      preferences={preferences}\n      actions={\n        <>\n          {actions}\n          {onDelete && !role.isReadOnly && (\n            <ConfirmButton\n              confirmText={t('admin.roles.details.delete.confirm', {name: role.name})}\n              isLoading={isDeleting}\n              onConfirm={onDelete}\n            >\n              {t('admin.roles.details.delete.action')}\n            </ConfirmButton>\n          )}\n        </>\n      }\n    >\n      {error && (\n        <Alert variant=\"error\" role=\"alert\">\n          {error}\n        </Alert>\n      )}\n      <Panel title={t('admin.roles.details.overview')}>\n        <DetailList items={[{label: t('admin.common.columns.organization_unit'), value: role.ouHandle ?? role.ouId}]} />\n      </Panel>\n      {permissions}\n      {assignments}\n    </AdminSection>\n  );\n};\n\nexport default BaseRoleDetails;\n"],"mappings":";;;;;;;;;;;;;;;AA4DA,MAAMA,mBAA6C,EACjD,SACA,aACA,UACA,WACA,QAAQ,MACR,aAAa,OACb,YAAY,OACZ,UACA,aACA,aACA,WACwC;CACxC,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAC7C,MAAMC,SAAiCC,oCAAoB;AAE3D,KAAI,SACF,QACE,2CAAC;EAAe;YACb,SAAS;GAAC;GAAO;GAAY;GAAW,UAAU,QAAQ,CAAC,KAAK,aAAa,WAAW;GAAW;GAAK,CAAC;GACtG;AAIV,KAAI,aAAa,CAAC,KAChB,QACE,2CAACC;EAAa,OAAM;EAA0B;EAAwB;YACpE,4CAAC;GAAK,WAAW,OAAO;GAAU,MAAK;;IACrC,2CAACC,2BAAQ,MAAK,UAAU;;IAAE,EAAE,uBAAuB;;IAC9C;GACM;AAInB,KAAI,CAAC,KACH,QACE,2CAACD;EAAa,OAAM;EAA0B;EAAwB;YACpE,2CAACE;GAAM,SAAQ;GAAQ,MAAK;aACzB,SAAS,EAAE,gCAAgC;IACtC;GACK;AAInB,QACE,4CAACF;EACC,OAAM;EACK;EACX,OAAO,KAAK;EACZ,aAAa,KAAK;EACL;EACb,SACE,qFACG,SACA,YAAY,CAAC,KAAK,cACjB,2CAACG;GACC,aAAa,EAAE,sCAAsC,EAAC,MAAM,KAAK,MAAK,CAAC;GACvE,WAAW;GACX,WAAW;aAEV,EAAE,oCAAoC;IACzB,IAEjB;;GAGJ,SACC,2CAACD;IAAM,SAAQ;IAAQ,MAAK;cACzB;KACK;GAEV,2CAACE;IAAM,OAAO,EAAE,+BAA+B;cAC7C,2CAACC,iCAAW,OAAO,CAAC;KAAC,OAAO,EAAE,yCAAyC;KAAE,OAAO,KAAK,YAAY,KAAK;KAAK,CAAC,GAAI;KAC1G;GACP;GACA;;GACY;;AAInB,8BAAe"}

package/dist/cjs/components/management/RoleDetails/RoleDetails.cjs

@@ -0,0 +1,68 @@
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_useTranslation = require('../../../hooks/useTranslation.cjs');
+const require_useManagementEndpoint = require('../../../hooks/management/useManagementEndpoint.cjs');
+const require_useResourceQuery = require('../../../hooks/management/useResourceQuery.cjs');
+const require_useResourceMutation = require('../../../hooks/management/useResourceMutation.cjs');
+const require_RoleAssignments = require('../RoleAssignments/RoleAssignments.cjs');
+const require_BaseRolePermissions = require('../RolePermissions/BaseRolePermissions.cjs');
+const require_RolePermissions = require('../RolePermissions/RolePermissions.cjs');
+const require_BaseRoleDetails = require('./BaseRoleDetails.cjs');
+let __thunderid_browser = require("@thunderid/browser");
+__thunderid_browser = require_rolldown_runtime.__toESM(__thunderid_browser);
+let react_jsx_runtime = require("react/jsx-runtime");
+react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
+
+//#region src/components/management/RoleDetails/RoleDetails.tsx
+/**
+* Shows a role with its permissions and assignments, and lets the signed-in user manage the permissions and
+* assignments and delete the role.
+*
+* @example
+* ```tsx
+* <RoleDetails roleId={roleId} editable deletable onDeleted={() => navigate('/roles')} />
+* ```
+*/
+const RoleDetails = ({ administrationMode, deletable = false, editable = false, onDeleted, preferences, roleId,...rest }) => {
+	const { t } = require_useTranslation.default(preferences?.i18n);
+	const endpoint = require_useManagementEndpoint.default("roles");
+	const role = require_useResourceQuery.default([__thunderid_browser.RoleQueryKeys.ROLE, roleId], (fetcher) => (0, __thunderid_browser.getRole)({
+		...endpoint,
+		fetcher,
+		roleId
+	}), { enabled: Boolean(roleId) });
+	const deletion = require_useResourceMutation.default((id, fetcher) => (0, __thunderid_browser.deleteRole)({
+		...endpoint,
+		administrationMode,
+		fetcher,
+		roleId: id
+	}), () => [[__thunderid_browser.RoleQueryKeys.ROLES], [__thunderid_browser.RoleQueryKeys.ROLE_ASSIGNMENTS]], { onSuccess: onDeleted });
+	return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_BaseRoleDetails.default, {
+		role: role.data,
+		isLoading: role.isLoading,
+		error: (0, __thunderid_browser.toManagementErrorMessage)(t, role.error, "admin.roles.details.error") ?? (0, __thunderid_browser.toManagementErrorMessage)(t, deletion.error, "admin.roles.details.delete.error"),
+		isDeleting: deletion.isLoading,
+		onDelete: deletable ? () => void deletion.mutate(roleId) : void 0,
+		permissions: role.data && (editable ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_RolePermissions.default, {
+			roleId,
+			editable: true,
+			administrationMode,
+			preferences
+		}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_BaseRolePermissions.default, {
+			permissions: role.data.permissions ?? [],
+			preferences
+		})),
+		assignments: role.data && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_RoleAssignments.default, {
+			roleId,
+			ouId: role.data.ouId,
+			editable,
+			administrationMode
+		}),
+		preferences,
+		...rest
+	});
+};
+var RoleDetails_default = RoleDetails;
+
+//#endregion
+exports.default = RoleDetails_default;
+//# sourceMappingURL=RoleDetails.cjs.map

package/dist/cjs/components/management/RoleDetails/RoleDetails.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleDetails.cjs","names":["RoleDetails: FC<RoleDetailsProps>","useTranslation","endpoint: ManagementEndpoint","useManagementEndpoint","role: ResourceQueryResult<Role>","useResourceQuery","RoleQueryKeys","deletion: ResourceMutationResult<void, string>","useResourceMutation","BaseRoleDetails","RolePermissions","BaseRolePermissions","RoleAssignments"],"sources":["../../../../../src/components/management/RoleDetails/RoleDetails.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n  AdministrationMode,\n  Role,\n  RoleQueryKeys,\n  deleteRole,\n  getRole,\n  toManagementErrorMessage,\n} from '@thunderid/browser';\nimport {FC, ReactElement} from 'react';\nimport BaseRoleDetails, {BaseRoleDetailsProps} from './BaseRoleDetails';\nimport useManagementEndpoint, {ManagementEndpoint} from '../../../hooks/management/useManagementEndpoint';\nimport useResourceMutation, {ResourceMutationResult} from '../../../hooks/management/useResourceMutation';\nimport useResourceQuery, {ResourceQueryResult} from '../../../hooks/management/useResourceQuery';\nimport useTranslation from '../../../hooks/useTranslation';\nimport RoleAssignments from '../RoleAssignments/RoleAssignments';\nimport BaseRolePermissions from '../RolePermissions/BaseRolePermissions';\nimport RolePermissions from '../RolePermissions/RolePermissions';\n\nexport type RoleDetailsProps = Omit<\n  BaseRoleDetailsProps,\n  'assignments' | 'error' | 'isDeleting' | 'isLoading' | 'onDelete' | 'permissions' | 'role'\n> & {\n  /**\n   * How the role is deleted and an assignment removed. `flow` runs the administration flow the server configures for\n   * it, which can revoke grants and end sessions first. It needs `baseUrl`.\n   * @default 'native'\n   */\n  administrationMode?: AdministrationMode;\n  /**\n   * Whether the role can be deleted from this view. Read-only roles never can.\n   * @default false\n   */\n  deletable?: boolean;\n  /**\n   * Whether the role's permissions can be added and removed, and the role assigned and taken away, from\n   * this view.\n   * @default false\n   */\n  editable?: boolean;\n  /**\n   * Called after the role has been deleted.\n   */\n  onDeleted?: () => void;\n  roleId: string;\n};\n\n/**\n * Shows a role with its permissions and assignments, and lets the signed-in user manage the permissions and\n * assignments and delete the role.\n *\n * @example\n * ```tsx\n * <RoleDetails roleId={roleId} editable deletable onDeleted={() => navigate('/roles')} />\n * ```\n */\nconst RoleDetails: FC<RoleDetailsProps> = ({\n  administrationMode,\n  deletable = false,\n  editable = false,\n  onDeleted,\n  preferences,\n  roleId,\n  ...rest\n}: RoleDetailsProps): ReactElement => {\n  const {t} = useTranslation(preferences?.i18n);\n  const endpoint: ManagementEndpoint = useManagementEndpoint('roles');\n  const role: ResourceQueryResult<Role> = useResourceQuery(\n    [RoleQueryKeys.ROLE, roleId],\n    (fetcher) => getRole({...endpoint, fetcher, roleId}),\n    {enabled: Boolean(roleId)},\n  );\n  const deletion: ResourceMutationResult<void, string> = useResourceMutation(\n    (id: string, fetcher) => deleteRole({...endpoint, administrationMode, fetcher, roleId: id}),\n    () => [[RoleQueryKeys.ROLES], [RoleQueryKeys.ROLE_ASSIGNMENTS]],\n    {onSuccess: onDeleted},\n  );\n\n  return (\n    <BaseRoleDetails\n      role={role.data}\n      isLoading={role.isLoading}\n      error={\n        toManagementErrorMessage(t, role.error, 'admin.roles.details.error') ??\n        toManagementErrorMessage(t, deletion.error, 'admin.roles.details.delete.error')\n      }\n      isDeleting={deletion.isLoading}\n      onDelete={deletable ? (): void => void deletion.mutate(roleId) : undefined}\n      permissions={\n        role.data &&\n        (editable ? (\n          // Shares the role's query, so editing the permissions refreshes this view too.\n          <RolePermissions roleId={roleId} editable administrationMode={administrationMode} preferences={preferences} />\n        ) : (\n          // The role carries its permissions, so they are shown without fetching it again.\n          <BaseRolePermissions permissions={role.data.permissions ?? []} preferences={preferences} />\n        ))\n      }\n      assignments={\n        role.data && (\n          // Assigning waits for the role, so the candidates are only ever listed from its organization unit.\n          <RoleAssignments\n            roleId={roleId}\n            ouId={role.data.ouId}\n            editable={editable}\n            administrationMode={administrationMode}\n          />\n        )\n      }\n      preferences={preferences}\n      {...rest}\n    />\n  );\n};\n\nexport default RoleDetails;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA0DA,MAAMA,eAAqC,EACzC,oBACA,YAAY,OACZ,WAAW,OACX,WACA,aACA,OACA,GAAG,WACiC;CACpC,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAC7C,MAAMC,WAA+BC,sCAAsB,QAAQ;CACnE,MAAMC,OAAkCC,iCACtC,CAACC,kCAAc,MAAM,OAAO,GAC3B,6CAAoB;EAAC,GAAG;EAAU;EAAS;EAAO,CAAC,EACpD,EAAC,SAAS,QAAQ,OAAO,EAAC,CAC3B;CACD,MAAMC,WAAiDC,qCACpD,IAAY,gDAAuB;EAAC,GAAG;EAAU;EAAoB;EAAS,QAAQ;EAAG,CAAC,QACrF,CAAC,CAACF,kCAAc,MAAM,EAAE,CAACA,kCAAc,iBAAiB,CAAC,EAC/D,EAAC,WAAW,WAAU,CACvB;AAED,QACE,2CAACG;EACC,MAAM,KAAK;EACX,WAAW,KAAK;EAChB,yDAC2B,GAAG,KAAK,OAAO,4BAA4B,sDAC3C,GAAG,SAAS,OAAO,mCAAmC;EAEjF,YAAY,SAAS;EACrB,UAAU,kBAAwB,KAAK,SAAS,OAAO,OAAO,GAAG;EACjE,aACE,KAAK,SACJ,WAEC,2CAACC;GAAwB;GAAQ;GAA6B;GAAiC;IAAe,GAG9G,2CAACC;GAAoB,aAAa,KAAK,KAAK,eAAe,EAAE;GAAe;IAAe;EAG/F,aACE,KAAK,QAEH,2CAACC;GACS;GACR,MAAM,KAAK,KAAK;GACN;GACU;IACpB;EAGO;EACb,GAAI;GACJ;;AAIN,0BAAe"}

package/dist/cjs/components/{admin → management}/RoleList/BaseRoleList.cjs

@@ -5,7 +5,7 @@ const require_AdminSection = require('../shared/AdminSection.cjs');
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/components/admin/RoleList/BaseRoleList.tsx
+//#region src/components/management/RoleList/BaseRoleList.tsx
 /**
 * Lists roles with their description and organization unit. Holds no data of its own: pass the
 * page of roles and handle selection and pagination.

package/dist/cjs/components/management/RoleList/BaseRoleList.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseRoleList.cjs","names":["BaseRoleList: FC<BaseRoleListProps>","useTranslation","columns: DataTableColumn<RoleSummary>[]","AdminSection","DataTable"],"sources":["../../../../../src/components/management/RoleList/BaseRoleList.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {Preferences, RoleSummary} from '@thunderid/browser';\nimport {FC, ReactElement, ReactNode} from 'react';\nimport useTranslation from '../../../hooks/useTranslation';\nimport DataTable, {DataTableColumn} from '../../primitives/DataTable/DataTable';\nimport {AdminListRenderProps} from '../shared/AdminListRenderProps';\nimport AdminSection from '../shared/AdminSection';\n\n/**\n * What {@link BaseRoleList} hands its `children` render function. `roles` and `rows` are the same array.\n */\nexport type BaseRoleListRenderProps = AdminListRenderProps<RoleSummary> & {roles: RoleSummary[]};\n\nexport interface BaseRoleListProps {\n  /**\n   * Controls rendered next to the title, such as a button that opens `RoleCreate`.\n   */\n  actions?: ReactNode;\n  /**\n   * Renders custom UI in place of the default table, for example a third-party data grid. Receives\n   * the roles, the default columns, the loading and error state, and the pagination and selection\n   * handlers.\n   */\n  children?: (props: BaseRoleListRenderProps) => ReactNode;\n  className?: string;\n  description?: string;\n  error?: string | null;\n  isLoading?: boolean;\n  /**\n   * Page size.\n   * @default 20\n   */\n  limit?: number;\n  offset?: number;\n  /**\n   * Called with the offset of the page to show. Pagination is hidden when omitted.\n   */\n  onPageChange?: (offset: number) => void;\n  /**\n   * Called when a role is chosen. Rows are selectable only when set.\n   */\n  onSelect?: (role: RoleSummary) => void;\n  preferences?: Preferences;\n  roles: RoleSummary[];\n  selectedRoleId?: string;\n  /**\n   * Heading of the list. Pass an empty string to hide it.\n   */\n  title?: string;\n  totalResults?: number;\n}\n\n/**\n * Lists roles with their description and organization unit. Holds no data of its own: pass the\n * page of roles and handle selection and pagination.\n */\nconst BaseRoleList: FC<BaseRoleListProps> = ({\n  actions,\n  children,\n  className,\n  description,\n  error = null,\n  isLoading = false,\n  limit = 20,\n  offset = 0,\n  onPageChange,\n  onSelect,\n  preferences,\n  roles,\n  selectedRoleId,\n  title,\n  totalResults,\n}: BaseRoleListProps): ReactElement => {\n  const {t} = useTranslation(preferences?.i18n);\n\n  const columns: DataTableColumn<RoleSummary>[] = [\n    {header: t('admin.roles.list.columns.name'), id: 'name', render: (role: RoleSummary): ReactNode => role.name},\n    {\n      header: t('admin.roles.list.columns.description'),\n      id: 'description',\n      render: (role: RoleSummary): ReactNode => role.description ?? '',\n    },\n    {\n      header: t('admin.common.columns.organization_unit'),\n      id: 'ou',\n      render: (role: RoleSummary): ReactNode => role.ouHandle ?? role.ouId,\n    },\n  ];\n\n  if (children) {\n    return (\n      <div className={className}>\n        {children({\n          columns,\n          error,\n          isLoading,\n          limit,\n          offset,\n          onPageChange,\n          onSelect,\n          rows: roles,\n          selectedRowId: selectedRoleId,\n          totalResults: totalResults ?? roles.length,\n          roles,\n        })}\n      </div>\n    );\n  }\n\n  return (\n    <AdminSection\n      block=\"role-list\"\n      className={className}\n      title={title ?? t('admin.roles.list.title')}\n      description={description}\n      actions={actions}\n      preferences={preferences}\n    >\n      <DataTable\n        caption={title?.length ? title : t('admin.roles.list.title')}\n        columns={columns}\n        rows={roles}\n        getRowId={(role: RoleSummary): string => role.id}\n        isLoading={isLoading}\n        error={error}\n        emptyText={t('admin.roles.list.empty')}\n        onRowClick={onSelect}\n        selectedRowId={selectedRoleId}\n        pagination={\n          onPageChange ? {limit, offset, onChange: onPageChange, total: totalResults ?? roles.length} : undefined\n        }\n      />\n    </AdminSection>\n  );\n};\n\nexport default BaseRoleList;\n"],"mappings":";;;;;;;;;;;;AA0DA,MAAMA,gBAAuC,EAC3C,SACA,UACA,WACA,aACA,QAAQ,MACR,YAAY,OACZ,QAAQ,IACR,SAAS,GACT,cACA,UACA,aACA,OACA,gBACA,OACA,mBACqC;CACrC,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAE7C,MAAMC,UAA0C;EAC9C;GAAC,QAAQ,EAAE,gCAAgC;GAAE,IAAI;GAAQ,SAAS,SAAiC,KAAK;GAAK;EAC7G;GACE,QAAQ,EAAE,uCAAuC;GACjD,IAAI;GACJ,SAAS,SAAiC,KAAK,eAAe;GAC/D;EACD;GACE,QAAQ,EAAE,yCAAyC;GACnD,IAAI;GACJ,SAAS,SAAiC,KAAK,YAAY,KAAK;GACjE;EACF;AAED,KAAI,SACF,QACE,2CAAC;EAAe;YACb,SAAS;GACR;GACA;GACA;GACA;GACA;GACA;GACA;GACA,MAAM;GACN,eAAe;GACf,cAAc,gBAAgB,MAAM;GACpC;GACD,CAAC;GACE;AAIV,QACE,2CAACC;EACC,OAAM;EACK;EACX,OAAO,SAAS,EAAE,yBAAyB;EAC9B;EACJ;EACI;YAEb,2CAACC;GACC,SAAS,OAAO,SAAS,QAAQ,EAAE,yBAAyB;GACnD;GACT,MAAM;GACN,WAAW,SAA8B,KAAK;GACnC;GACJ;GACP,WAAW,EAAE,yBAAyB;GACtC,YAAY;GACZ,eAAe;GACf,YACE,eAAe;IAAC;IAAO;IAAQ,UAAU;IAAc,OAAO,gBAAgB,MAAM;IAAO,GAAG;IAEhG;GACW;;AAInB,2BAAe"}

package/dist/cjs/components/{admin → management}/RoleList/RoleList.cjs

@@ -10,7 +10,7 @@ react = require_rolldown_runtime.__toESM(react);
 let react_jsx_runtime = require("react/jsx-runtime");
 react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
 
-//#region src/components/admin/RoleList/RoleList.tsx
+//#region src/components/management/RoleList/RoleList.tsx
 /**
 * Lists the roles the signed-in user is allowed to see, a page at a time.
 *

package/dist/cjs/components/management/RoleList/RoleList.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RoleList.cjs","names":["RoleList: FC<RoleListProps>","useTranslation","endpoint: ManagementEndpoint","useManagementEndpoint","useResourceQuery","RoleQueryKeys","BaseRoleList"],"sources":["../../../../../src/components/management/RoleList/RoleList.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {RoleListResponse, RoleQueryKeys, getRoles, toManagementErrorMessage} from '@thunderid/browser';\nimport {FC, ReactElement, useState} from 'react';\nimport BaseRoleList, {BaseRoleListProps} from './BaseRoleList';\nimport useManagementEndpoint, {ManagementEndpoint} from '../../../hooks/management/useManagementEndpoint';\nimport useResourceQuery, {ResourceQueryResult} from '../../../hooks/management/useResourceQuery';\nimport useTranslation from '../../../hooks/useTranslation';\n\nexport type RoleListProps = Omit<\n  BaseRoleListProps,\n  'error' | 'isLoading' | 'offset' | 'onPageChange' | 'roles' | 'totalResults'\n>;\n\n/**\n * Lists the roles the signed-in user is allowed to see, a page at a time.\n *\n * @example\n * ```tsx\n * <RoleList onSelect={(role) => setSelectedRoleId(role.id)} />\n * ```\n */\nconst RoleList: FC<RoleListProps> = ({limit = 20, preferences, ...rest}: RoleListProps): ReactElement => {\n  const {t} = useTranslation(preferences?.i18n);\n  const [offset, setOffset] = useState<number>(0);\n  const endpoint: ManagementEndpoint = useManagementEndpoint('roles');\n  const {data, error, isLoading}: ResourceQueryResult<RoleListResponse> = useResourceQuery(\n    [RoleQueryKeys.ROLES, {limit, offset}],\n    (fetcher) => getRoles({...endpoint, fetcher, limit, offset}),\n  );\n\n  return (\n    <BaseRoleList\n      roles={data?.roles ?? []}\n      totalResults={data?.totalResults}\n      isLoading={isLoading}\n      error={toManagementErrorMessage(t, error, 'admin.roles.list.error')}\n      limit={limit}\n      offset={offset}\n      onPageChange={setOffset}\n      preferences={preferences}\n      {...rest}\n    />\n  );\n};\n\nexport default RoleList;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,MAAMA,YAA+B,EAAC,QAAQ,IAAI,YAAa,GAAG,WAAuC;CACvG,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAC7C,MAAM,CAAC,QAAQ,iCAA8B,EAAE;CAC/C,MAAMC,WAA+BC,sCAAsB,QAAQ;CACnE,MAAM,EAAC,MAAM,OAAO,cAAoDC,iCACtE,CAACC,kCAAc,OAAO;EAAC;EAAO;EAAO,CAAC,GACrC,8CAAqB;EAAC,GAAG;EAAU;EAAS;EAAO;EAAO,CAAC,CAC7D;AAED,QACE,2CAACC;EACC,OAAO,MAAM,SAAS,EAAE;EACxB,cAAc,MAAM;EACT;EACX,yDAAgC,GAAG,OAAO,yBAAyB;EAC5D;EACC;EACR,cAAc;EACD;EACb,GAAI;GACJ;;AAIN,uBAAe"}

package/dist/cjs/components/management/RolePermissions/BaseRolePermissions.cjs

@@ -0,0 +1,181 @@
+const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
+const require_useTranslation = require('../../../hooks/useTranslation.cjs');
+const require_Spinner = require('../../primitives/Spinner/Spinner.cjs');
+const require_Button = require('../../primitives/Button/Button.cjs');
+const require_Alert = require('../../primitives/Alert/Alert.cjs');
+const require_Select = require('../../primitives/Select/Select.cjs');
+const require_useAdminPartStyles = require('../shared/useAdminPartStyles.cjs');
+const require_AdminSection = require('../shared/AdminSection.cjs');
+const require_AdminParts = require('../shared/AdminParts.cjs');
+let react = require("react");
+react = require_rolldown_runtime.__toESM(react);
+let react_jsx_runtime = require("react/jsx-runtime");
+react_jsx_runtime = require_rolldown_runtime.__toESM(react_jsx_runtime);
+
+//#region src/components/management/RolePermissions/BaseRolePermissions.tsx
+/**
+* Shows the permissions a role grants, grouped by resource server, and lets the caller add and remove
+* them. Holds no data of its own.
+*/
+const BaseRolePermissions = ({ availablePermissions, children, className, description, error = null, isLoading = false, isMutating = false, onAdd, onRemove, onResourceServerSelect, permissions, preferences, resourceServerNames, resourceServers, title }) => {
+	const { t } = require_useTranslation.default(preferences?.i18n);
+	const styles = require_useAdminPartStyles.default();
+	const [resourceServerId, setResourceServerId] = (0, react.useState)("");
+	const [permission, setPermission] = (0, react.useState)("");
+	const [pendingRemoval, setPendingRemoval] = (0, react.useState)(null);
+	const granted = permissions.filter((entry) => entry.permissions.length > 0);
+	const canAdd = Boolean(onAdd && resourceServers);
+	const resolveResourceServerName = (id) => resourceServerNames?.[id] ?? resourceServers?.find((server) => server.id === id)?.name ?? id;
+	if (children) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+		className,
+		children: children({
+			availablePermissions: canAdd ? availablePermissions ?? {} : void 0,
+			error,
+			isLoading,
+			isMutating,
+			onAdd: canAdd ? onAdd : void 0,
+			onRemove,
+			onResourceServerSelect: canAdd ? onResourceServerSelect : void 0,
+			permissions: granted,
+			resolveResourceServerName,
+			resourceServers: canAdd ? resourceServers : void 0
+		})
+	});
+	const grantedOn = (id) => granted.find((entry) => entry.resourceServerId === id)?.permissions ?? [];
+	const candidates = resourceServerId ? availablePermissions?.[resourceServerId] : void 0;
+	const permissionOptions = (candidates ?? []).filter((candidate) => !grantedOn(resourceServerId).includes(candidate.permission)).map((candidate) => ({
+		label: `${candidate.resourceName ? `${candidate.resourceName} / ` : ""}${candidate.name} (${candidate.permission})`,
+		value: candidate.permission
+	}));
+	const handleSubmit = (event) => {
+		event.preventDefault();
+		if (onAdd && resourceServerId && permission) {
+			onAdd({
+				permission,
+				resourceServerId
+			});
+			setPermission("");
+		}
+	};
+	const renderAdd = () => {
+		if (!canAdd) return null;
+		return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("form", {
+			className: styles["row"],
+			onSubmit: handleSubmit,
+			style: { alignItems: "flex-end" },
+			children: [
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Select.default, {
+					label: t("admin.roles.permissions.fields.resource_server"),
+					name: "resourceServer",
+					value: resourceServerId,
+					placeholder: t("admin.roles.permissions.fields.resource_server_placeholder"),
+					options: (resourceServers ?? []).map((server) => ({
+						label: server.name,
+						value: server.id
+					})),
+					onChange: (event) => {
+						setResourceServerId(event.target.value);
+						setPermission("");
+						if (event.target.value) onResourceServerSelect?.(event.target.value);
+					}
+				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Select.default, {
+					label: t("admin.roles.permissions.fields.permission"),
+					name: "permission",
+					value: permission,
+					disabled: !resourceServerId,
+					loading: Boolean(resourceServerId) && candidates === void 0,
+					placeholder: t("admin.roles.permissions.fields.permission_placeholder"),
+					emptyText: t("admin.roles.permissions.fields.permission_empty"),
+					options: permissionOptions,
+					onChange: (event) => setPermission(event.target.value)
+				}),
+				/* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Button.default, {
+					type: "submit",
+					loading: isMutating,
+					disabled: !resourceServerId || !permission || isMutating,
+					children: t("admin.roles.permissions.add")
+				})
+			]
+		});
+	};
+	const renderContent = () => {
+		if (isLoading) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Spinner.default, { size: "small" });
+		return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+			error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Alert.default, {
+				variant: "error",
+				role: "alert",
+				children: error
+			}),
+			renderAdd(),
+			pendingRemoval && onRemove && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+				className: styles["confirm"],
+				role: "group",
+				"aria-label": t("admin.roles.permissions.remove_confirm", { permission: pendingRemoval.permission }),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("admin.roles.permissions.remove_confirm", { permission: pendingRemoval.permission }) }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Button.default, {
+						variant: "text",
+						size: "small",
+						disabled: isMutating,
+						onClick: () => setPendingRemoval(null),
+						children: t("admin.common.actions.cancel")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_Button.default, {
+						color: "error",
+						size: "small",
+						loading: isMutating,
+						disabled: isMutating,
+						onClick: () => {
+							onRemove(pendingRemoval);
+							setPendingRemoval(null);
+						},
+						children: t("admin.common.actions.confirm")
+					})
+				]
+			}),
+			granted.length === 0 && !error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+				className: styles["muted"],
+				children: t("admin.roles.permissions.empty")
+			}),
+			granted.map((entry) => {
+				const name = resolveResourceServerName(entry.resourceServerId);
+				return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminParts.Panel, {
+					title: name,
+					children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminParts.ChipList, {
+						label: name,
+						emptyText: t("admin.roles.permissions.empty"),
+						items: entry.permissions.map((grantedPermission) => ({
+							id: grantedPermission,
+							label: grantedPermission,
+							...onRemove ? {
+								onRemove: () => setPendingRemoval({
+									permission: grantedPermission,
+									resourceServerId: entry.resourceServerId
+								}),
+								removeLabel: t("admin.roles.permissions.remove_label", {
+									permission: grantedPermission,
+									resourceServer: name
+								})
+							} : {}
+						}))
+					})
+				}, entry.resourceServerId);
+			})
+		] });
+	};
+	return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(require_AdminSection.default, {
+		block: "role-permissions",
+		className,
+		title: title ?? t("admin.roles.permissions.title"),
+		description,
+		headingLevel: 3,
+		preferences,
+		children: renderContent()
+	});
+};
+var BaseRolePermissions_default = BaseRolePermissions;
+
+//#endregion
+exports.default = BaseRolePermissions_default;
+//# sourceMappingURL=BaseRolePermissions.cjs.map

package/dist/cjs/components/management/RolePermissions/BaseRolePermissions.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseRolePermissions.cjs","names":["BaseRolePermissions: FC<BaseRolePermissionsProps>","useTranslation","styles: Record<string, string>","useAdminPartStyles","granted: RoleResourcePermissions[]","candidates: ResourceServerPermission[] | undefined","permissionOptions: SelectOption[]","Select","Button","Spinner","Alert","name: string","Panel","ChipList","AdminSection"],"sources":["../../../../../src/components/management/RolePermissions/BaseRolePermissions.tsx"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {Preferences, ResourceServerPermission, RoleResourcePermissions, SelectOption} from '@thunderid/browser';\nimport {ChangeEvent, FC, FormEvent, ReactElement, ReactNode, useState} from 'react';\nimport useTranslation from '../../../hooks/useTranslation';\nimport Alert from '../../primitives/Alert/Alert';\nimport Button from '../../primitives/Button/Button';\nimport Select from '../../primitives/Select/Select';\nimport Spinner from '../../primitives/Spinner/Spinner';\nimport {ChipList, Panel} from '../shared/AdminParts';\nimport AdminSection from '../shared/AdminSection';\nimport useAdminPartStyles from '../shared/useAdminPartStyles';\n\n/**\n * A resource server a permission can be granted on.\n */\nexport interface RolePermissionResourceServer {\n  id: string;\n  name: string;\n}\n\n/**\n * One permission on one resource server, as added to or removed from a role.\n */\nexport interface RolePermissionChange {\n  permission: string;\n  resourceServerId: string;\n}\n\n/**\n * What {@link BaseRolePermissions} hands its `children` render function, so the permissions can be\n * shown with any UI.\n */\nexport interface BaseRolePermissionsRenderProps {\n  /**\n   * The permissions that can be granted, keyed by resource server identifier, for the resource servers\n   * loaded so far. Undefined when adding is not allowed.\n   */\n  availablePermissions?: Record<string, ResourceServerPermission[]>;\n  error: string | null;\n  isLoading: boolean;\n  isMutating: boolean;\n  /**\n   * Grants a permission. Undefined when the permissions cannot be edited.\n   */\n  onAdd?: (change: RolePermissionChange) => void;\n  /**\n   * Revokes a permission. Undefined when the permissions cannot be edited. Ask the user to confirm\n   * before calling it.\n   */\n  onRemove?: (change: RolePermissionChange) => void;\n  /**\n   * Asks for the permissions of a resource server, which then appear in `availablePermissions`.\n   * Undefined when adding is not allowed.\n   */\n  onResourceServerSelect?: (resourceServerId: string) => void;\n  /**\n   * The resource servers the role grants at least one permission on, with those permissions.\n   */\n  permissions: RoleResourcePermissions[];\n  /**\n   * Returns a resource server's display name, or its identifier when the name is missing.\n   */\n  resolveResourceServerName: (resourceServerId: string) => string;\n  /**\n   * The resource servers permissions can be granted on. Undefined when adding is not allowed.\n   */\n  resourceServers?: RolePermissionResourceServer[];\n}\n\nexport interface BaseRolePermissionsProps {\n  /**\n   * The permissions that can be granted, keyed by resource server identifier. A resource server\n   * missing here is still loading, and `onResourceServerSelect` is called to load it.\n   */\n  availablePermissions?: Record<string, ResourceServerPermission[]>;\n  /**\n   * Renders custom UI in place of the default view. Receives the granted permissions grouped by\n   * resource server, the loading and error state, a resource server name resolver and, when the\n   * permissions can be edited, the add and remove handlers with what can be added.\n   */\n  children?: (props: BaseRolePermissionsRenderProps) => ReactNode;\n  className?: string;\n  description?: string;\n  error?: string | null;\n  isLoading?: boolean;\n  isMutating?: boolean;\n  /**\n   * Grants a permission. Adding is hidden when omitted, or when `resourceServers` is omitted.\n   */\n  onAdd?: (change: RolePermissionChange) => void;\n  /**\n   * Revokes a permission, after the user confirms. Removing is hidden when omitted.\n   */\n  onRemove?: (change: RolePermissionChange) => void;\n  /**\n   * Called when a resource server is picked to add a permission on, so its permissions can be loaded.\n   */\n  onResourceServerSelect?: (resourceServerId: string) => void;\n  permissions: RoleResourcePermissions[];\n  preferences?: Preferences;\n  /**\n   * Display names of resource servers, keyed by identifier. The identifier is shown when a name is missing.\n   */\n  resourceServerNames?: Record<string, string>;\n  /**\n   * The resource servers a permission can be added on.\n   */\n  resourceServers?: RolePermissionResourceServer[];\n  title?: string;\n}\n\n/**\n * Shows the permissions a role grants, grouped by resource server, and lets the caller add and remove\n * them. Holds no data of its own.\n */\nconst BaseRolePermissions: FC<BaseRolePermissionsProps> = ({\n  availablePermissions,\n  children,\n  className,\n  description,\n  error = null,\n  isLoading = false,\n  isMutating = false,\n  onAdd,\n  onRemove,\n  onResourceServerSelect,\n  permissions,\n  preferences,\n  resourceServerNames,\n  resourceServers,\n  title,\n}: BaseRolePermissionsProps): ReactElement => {\n  const {t} = useTranslation(preferences?.i18n);\n  const styles: Record<string, string> = useAdminPartStyles();\n  const [resourceServerId, setResourceServerId] = useState<string>('');\n  const [permission, setPermission] = useState<string>('');\n  const [pendingRemoval, setPendingRemoval] = useState<RolePermissionChange | null>(null);\n  const granted: RoleResourcePermissions[] = permissions.filter(\n    (entry: RoleResourcePermissions) => entry.permissions.length > 0,\n  );\n  const canAdd = Boolean(onAdd && resourceServers);\n  const resolveResourceServerName = (id: string): string =>\n    resourceServerNames?.[id] ??\n    resourceServers?.find((server: RolePermissionResourceServer) => server.id === id)?.name ??\n    id;\n\n  if (children) {\n    return (\n      <div className={className}>\n        {children({\n          availablePermissions: canAdd ? (availablePermissions ?? {}) : undefined,\n          error,\n          isLoading,\n          isMutating,\n          onAdd: canAdd ? onAdd : undefined,\n          onRemove,\n          onResourceServerSelect: canAdd ? onResourceServerSelect : undefined,\n          permissions: granted,\n          resolveResourceServerName,\n          resourceServers: canAdd ? resourceServers : undefined,\n        })}\n      </div>\n    );\n  }\n\n  const grantedOn = (id: string): string[] =>\n    granted.find((entry: RoleResourcePermissions) => entry.resourceServerId === id)?.permissions ?? [];\n  const candidates: ResourceServerPermission[] | undefined = resourceServerId\n    ? availablePermissions?.[resourceServerId]\n    : undefined;\n  const permissionOptions: SelectOption[] = (candidates ?? [])\n    .filter((candidate: ResourceServerPermission) => !grantedOn(resourceServerId).includes(candidate.permission))\n    .map((candidate: ResourceServerPermission) => ({\n      label: `${candidate.resourceName ? `${candidate.resourceName} / ` : ''}${candidate.name} (${candidate.permission})`,\n      value: candidate.permission,\n    }));\n\n  const handleSubmit = (event: FormEvent<HTMLFormElement>): void => {\n    event.preventDefault();\n\n    if (onAdd && resourceServerId && permission) {\n      onAdd({permission, resourceServerId});\n      setPermission('');\n    }\n  };\n\n  const renderAdd = (): ReactElement | null => {\n    if (!canAdd) {\n      return null;\n    }\n\n    return (\n      <form className={styles['row']} onSubmit={handleSubmit} style={{alignItems: 'flex-end'}}>\n        <Select\n          label={t('admin.roles.permissions.fields.resource_server')}\n          name=\"resourceServer\"\n          value={resourceServerId}\n          placeholder={t('admin.roles.permissions.fields.resource_server_placeholder')}\n          options={(resourceServers ?? []).map((server: RolePermissionResourceServer) => ({\n            label: server.name,\n            value: server.id,\n          }))}\n          onChange={(event: ChangeEvent<HTMLSelectElement>): void => {\n            setResourceServerId(event.target.value);\n            setPermission('');\n            if (event.target.value) {\n              onResourceServerSelect?.(event.target.value);\n            }\n          }}\n        />\n        <Select\n          label={t('admin.roles.permissions.fields.permission')}\n          name=\"permission\"\n          value={permission}\n          disabled={!resourceServerId}\n          loading={Boolean(resourceServerId) && candidates === undefined}\n          placeholder={t('admin.roles.permissions.fields.permission_placeholder')}\n          emptyText={t('admin.roles.permissions.fields.permission_empty')}\n          options={permissionOptions}\n          onChange={(event: ChangeEvent<HTMLSelectElement>): void => setPermission(event.target.value)}\n        />\n        <Button type=\"submit\" loading={isMutating} disabled={!resourceServerId || !permission || isMutating}>\n          {t('admin.roles.permissions.add')}\n        </Button>\n      </form>\n    );\n  };\n\n  const renderContent = (): ReactElement => {\n    if (isLoading) {\n      return <Spinner size=\"small\" />;\n    }\n\n    return (\n      <>\n        {error && (\n          <Alert variant=\"error\" role=\"alert\">\n            {error}\n          </Alert>\n        )}\n        {renderAdd()}\n        {pendingRemoval && onRemove && (\n          <span\n            className={styles['confirm']}\n            role=\"group\"\n            aria-label={t('admin.roles.permissions.remove_confirm', {permission: pendingRemoval.permission})}\n          >\n            <span>{t('admin.roles.permissions.remove_confirm', {permission: pendingRemoval.permission})}</span>\n            <Button variant=\"text\" size=\"small\" disabled={isMutating} onClick={(): void => setPendingRemoval(null)}>\n              {t('admin.common.actions.cancel')}\n            </Button>\n            <Button\n              color=\"error\"\n              size=\"small\"\n              loading={isMutating}\n              disabled={isMutating}\n              onClick={(): void => {\n                onRemove(pendingRemoval);\n                setPendingRemoval(null);\n              }}\n            >\n              {t('admin.common.actions.confirm')}\n            </Button>\n          </span>\n        )}\n        {granted.length === 0 && !error && (\n          <span className={styles['muted']}>{t('admin.roles.permissions.empty')}</span>\n        )}\n        {granted.map((entry: RoleResourcePermissions) => {\n          const name: string = resolveResourceServerName(entry.resourceServerId);\n\n          return (\n            <Panel key={entry.resourceServerId} title={name}>\n              <ChipList\n                label={name}\n                emptyText={t('admin.roles.permissions.empty')}\n                items={entry.permissions.map((grantedPermission: string) => ({\n                  id: grantedPermission,\n                  label: grantedPermission,\n                  ...(onRemove\n                    ? {\n                        onRemove: (): void =>\n                          setPendingRemoval({permission: grantedPermission, resourceServerId: entry.resourceServerId}),\n                        removeLabel: t('admin.roles.permissions.remove_label', {\n                          permission: grantedPermission,\n                          resourceServer: name,\n                        }),\n                      }\n                    : {}),\n                }))}\n              />\n            </Panel>\n          );\n        })}\n      </>\n    );\n  };\n\n  return (\n    <AdminSection\n      block=\"role-permissions\"\n      className={className}\n      title={title ?? t('admin.roles.permissions.title')}\n      description={description}\n      headingLevel={3}\n      preferences={preferences}\n    >\n      {renderContent()}\n    </AdminSection>\n  );\n};\n\nexport default BaseRolePermissions;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqHA,MAAMA,uBAAqD,EACzD,sBACA,UACA,WACA,aACA,QAAQ,MACR,YAAY,OACZ,aAAa,OACb,OACA,UACA,wBACA,aACA,aACA,qBACA,iBACA,YAC4C;CAC5C,MAAM,EAAC,MAAKC,+BAAe,aAAa,KAAK;CAC7C,MAAMC,SAAiCC,oCAAoB;CAC3D,MAAM,CAAC,kBAAkB,2CAAwC,GAAG;CACpE,MAAM,CAAC,YAAY,qCAAkC,GAAG;CACxD,MAAM,CAAC,gBAAgB,yCAA2D,KAAK;CACvF,MAAMC,UAAqC,YAAY,QACpD,UAAmC,MAAM,YAAY,SAAS,EAChE;CACD,MAAM,SAAS,QAAQ,SAAS,gBAAgB;CAChD,MAAM,6BAA6B,OACjC,sBAAsB,OACtB,iBAAiB,MAAM,WAAyC,OAAO,OAAO,GAAG,EAAE,QACnF;AAEF,KAAI,SACF,QACE,2CAAC;EAAe;YACb,SAAS;GACR,sBAAsB,SAAU,wBAAwB,EAAE,GAAI;GAC9D;GACA;GACA;GACA,OAAO,SAAS,QAAQ;GACxB;GACA,wBAAwB,SAAS,yBAAyB;GAC1D,aAAa;GACb;GACA,iBAAiB,SAAS,kBAAkB;GAC7C,CAAC;GACE;CAIV,MAAM,aAAa,OACjB,QAAQ,MAAM,UAAmC,MAAM,qBAAqB,GAAG,EAAE,eAAe,EAAE;CACpG,MAAMC,aAAqD,mBACvD,uBAAuB,oBACvB;CACJ,MAAMC,qBAAqC,cAAc,EAAE,EACxD,QAAQ,cAAwC,CAAC,UAAU,iBAAiB,CAAC,SAAS,UAAU,WAAW,CAAC,CAC5G,KAAK,eAAyC;EAC7C,OAAO,GAAG,UAAU,eAAe,GAAG,UAAU,aAAa,OAAO,KAAK,UAAU,KAAK,IAAI,UAAU,WAAW;EACjH,OAAO,UAAU;EAClB,EAAE;CAEL,MAAM,gBAAgB,UAA4C;AAChE,QAAM,gBAAgB;AAEtB,MAAI,SAAS,oBAAoB,YAAY;AAC3C,SAAM;IAAC;IAAY;IAAiB,CAAC;AACrC,iBAAc,GAAG;;;CAIrB,MAAM,kBAAuC;AAC3C,MAAI,CAAC,OACH,QAAO;AAGT,SACE,4CAAC;GAAK,WAAW,OAAO;GAAQ,UAAU;GAAc,OAAO,EAAC,YAAY,YAAW;;IACrF,2CAACC;KACC,OAAO,EAAE,iDAAiD;KAC1D,MAAK;KACL,OAAO;KACP,aAAa,EAAE,6DAA6D;KAC5E,UAAU,mBAAmB,EAAE,EAAE,KAAK,YAA0C;MAC9E,OAAO,OAAO;MACd,OAAO,OAAO;MACf,EAAE;KACH,WAAW,UAAgD;AACzD,0BAAoB,MAAM,OAAO,MAAM;AACvC,oBAAc,GAAG;AACjB,UAAI,MAAM,OAAO,MACf,0BAAyB,MAAM,OAAO,MAAM;;MAGhD;IACF,2CAACA;KACC,OAAO,EAAE,4CAA4C;KACrD,MAAK;KACL,OAAO;KACP,UAAU,CAAC;KACX,SAAS,QAAQ,iBAAiB,IAAI,eAAe;KACrD,aAAa,EAAE,wDAAwD;KACvE,WAAW,EAAE,kDAAkD;KAC/D,SAAS;KACT,WAAW,UAAgD,cAAc,MAAM,OAAO,MAAM;MAC5F;IACF,2CAACC;KAAO,MAAK;KAAS,SAAS;KAAY,UAAU,CAAC,oBAAoB,CAAC,cAAc;eACtF,EAAE,8BAA8B;MAC1B;;IACJ;;CAIX,MAAM,sBAAoC;AACxC,MAAI,UACF,QAAO,2CAACC,2BAAQ,MAAK,UAAU;AAGjC,SACE;GACG,SACC,2CAACC;IAAM,SAAQ;IAAQ,MAAK;cACzB;KACK;GAET,WAAW;GACX,kBAAkB,YACjB,4CAAC;IACC,WAAW,OAAO;IAClB,MAAK;IACL,cAAY,EAAE,0CAA0C,EAAC,YAAY,eAAe,YAAW,CAAC;;KAEhG,2CAAC,oBAAM,EAAE,0CAA0C,EAAC,YAAY,eAAe,YAAW,CAAC,GAAQ;KACnG,2CAACF;MAAO,SAAQ;MAAO,MAAK;MAAQ,UAAU;MAAY,eAAqB,kBAAkB,KAAK;gBACnG,EAAE,8BAA8B;OAC1B;KACT,2CAACA;MACC,OAAM;MACN,MAAK;MACL,SAAS;MACT,UAAU;MACV,eAAqB;AACnB,gBAAS,eAAe;AACxB,yBAAkB,KAAK;;gBAGxB,EAAE,+BAA+B;OAC3B;;KACJ;GAER,QAAQ,WAAW,KAAK,CAAC,SACxB,2CAAC;IAAK,WAAW,OAAO;cAAW,EAAE,gCAAgC;KAAQ;GAE9E,QAAQ,KAAK,UAAmC;IAC/C,MAAMG,OAAe,0BAA0B,MAAM,iBAAiB;AAEtE,WACE,2CAACC;KAAmC,OAAO;eACzC,2CAACC;MACC,OAAO;MACP,WAAW,EAAE,gCAAgC;MAC7C,OAAO,MAAM,YAAY,KAAK,uBAA+B;OAC3D,IAAI;OACJ,OAAO;OACP,GAAI,WACA;QACE,gBACE,kBAAkB;SAAC,YAAY;SAAmB,kBAAkB,MAAM;SAAiB,CAAC;QAC9F,aAAa,EAAE,wCAAwC;SACrD,YAAY;SACZ,gBAAgB;SACjB,CAAC;QACH,GACD,EAAE;OACP,EAAE;OACH;OAlBQ,MAAM,iBAmBV;KAEV;MACD;;AAIP,QACE,2CAACC;EACC,OAAM;EACK;EACX,OAAO,SAAS,EAAE,gCAAgC;EACrC;EACb,cAAc;EACD;YAEZ,eAAe;GACH;;AAInB,kCAAe"}