@timardex/cluemart-shared 1.5.828 → 1.5.830

package/dist/auth/index.d.ts

@@ -6,9 +6,6 @@ import React, { ReactNode } from 'react';
 import '../global-wVC9VaCx.js';
 import 'react-hook-form';
 
-/** Super-admin identity used for elevated admin checks in clients. */
-declare const SUPER_ADMIN_EMAIL = "hello@cluemart.co.nz";
-
 type AuthManager = {
     logout: () => Promise<void>;
     setLogout: (fn: () => Promise<void>) => void;
@@ -24,6 +21,29 @@ type AuthManager = {
  */
 declare function createAuthManager(): AuthManager;
 
+/** Roles allowed to sign into the admin web app (CUSTOMER-only is denied). */
+declare const ADMIN_APP_ROLES: readonly [EnumUserRole.SUPER_ADMIN, EnumUserRole.ADMIN, EnumUserRole.EVENT, EnumUserRole.VENDOR, EnumUserRole.PARTNER, EnumUserRole.SCHOOL, EnumUserRole.AFFILIATE];
+type AdminAppRole = (typeof ADMIN_APP_ROLES)[number];
+type AdminDashboardContext = "staff" | "event" | "vendor" | "partner" | "school" | "affiliate";
+type AdminDashboardContextInfo = {
+    context: AdminDashboardContext;
+    home: string;
+    label: string;
+    /** Path prefixes that belong to this context (including home). */
+    pathPrefixes: readonly string[];
+    roles: readonly EnumUserRole[];
+};
+/**
+ * Priority order for default home + role switcher.
+ * Staff first, then product roles.
+ */
+declare const ADMIN_DASHBOARD_CONTEXTS: readonly AdminDashboardContextInfo[];
+declare function canAccessAdminApp(roles: EnumUserRole[] | null | undefined): boolean;
+declare function getUsableAdminContexts(roles: EnumUserRole[] | null | undefined): AdminDashboardContextInfo[];
+declare function getDefaultAdminHome(roles: EnumUserRole[] | null | undefined, preferredContext?: AdminDashboardContext | null): string;
+declare function resolveAdminContextFromPath(pathname: string): AdminDashboardContext | null;
+declare function canAccessAdminPath(roles: EnumUserRole[] | null | undefined, pathname: string): boolean;
+
 /**
  * Union of permissions for the given roles (deduped, stable order).
  */
@@ -141,4 +161,4 @@ declare const UserProvider: React.FC<{
 }>;
 declare const useAuthUser: () => UseAuthReturnType;
 
-export { type AuthManager, type AuthManagerLike, type AuthStorageAdapter, DEFAULT_LIMITS, type HasLicenceResult, type LicencedResourceType, type LicencesByRole, type LimitType, type LogoutReason, Permission, type ProfileBadgeLicence, ROLE_PERMISSIONS, type RoleLicences, SUPER_ADMIN_EMAIL, type UseAuthCoreAdapters, type UseAuthReturnType, UserProvider, createAuthManager, getLicenceFlagsByRole, getPermissionsForRoles, hasAllPermissions, hasAnyPermission, hasAnyRole, hasLicence, hasPermission, hasRole, hasUserLicenceType, isLicencedResourceType, isProfileBadgeLicence, permissionListIncludes, useAuthCore, useAuthUser };
+export { ADMIN_APP_ROLES, ADMIN_DASHBOARD_CONTEXTS, type AdminAppRole, type AdminDashboardContext, type AdminDashboardContextInfo, type AuthManager, type AuthManagerLike, type AuthStorageAdapter, DEFAULT_LIMITS, type HasLicenceResult, type LicencedResourceType, type LicencesByRole, type LimitType, type LogoutReason, Permission, type ProfileBadgeLicence, ROLE_PERMISSIONS, type RoleLicences, type UseAuthCoreAdapters, type UseAuthReturnType, UserProvider, canAccessAdminApp, canAccessAdminPath, createAuthManager, getDefaultAdminHome, getLicenceFlagsByRole, getPermissionsForRoles, getUsableAdminContexts, hasAllPermissions, hasAnyPermission, hasAnyRole, hasLicence, hasPermission, hasRole, hasUserLicenceType, isLicencedResourceType, isProfileBadgeLicence, permissionListIncludes, resolveAdminContextFromPath, useAuthCore, useAuthUser };

package/dist/auth/index.mjs

@@ -1,16 +1,23 @@
 "use client";
 import {
+  ADMIN_APP_ROLES,
+  ADMIN_DASHBOARD_CONTEXTS,
   PERMISSIONS,
   ROLE_PERMISSIONS,
   WILDCARD_PERMISSION,
+  canAccessAdminApp,
+  canAccessAdminPath,
+  getDefaultAdminHome,
   getPermissionsForRoles,
+  getUsableAdminContexts,
   hasAllPermissions,
   hasAnyPermission,
   hasAnyRole,
   hasPermission,
   hasRole,
-  permissionListIncludes
-} from "../chunk-GHW3ZGBY.mjs";
+  permissionListIncludes,
+  resolveAdminContextFromPath
+} from "../chunk-VPANTTZI.mjs";
 import {
   USER_STORAGE_KEY
 } from "../chunk-DWO35OY4.mjs";
@@ -23,9 +30,6 @@ import {
 } from "../chunk-UOFI3LKZ.mjs";
 import "../chunk-VR3TDBJL.mjs";
 
-// src/auth/constants.ts
-var SUPER_ADMIN_EMAIL = "hello@cluemart.co.nz";
-
 // src/auth/createAuthManager.ts
 function createAuthManager() {
   let logoutFn = null;
@@ -223,8 +227,8 @@ function useAuthCore(adapters) {
     [authUser?.roles, permissions]
   );
   const isSuperAdmin = useMemo(
-    () => hasRole(authUser?.roles, "super_admin" /* SUPER_ADMIN */) && authUser?.email === SUPER_ADMIN_EMAIL,
-    [authUser?.roles, authUser?.email]
+    () => hasRole(authUser?.roles, "super_admin" /* SUPER_ADMIN */),
+    [authUser?.roles]
   );
   const isAffiliate = useMemo(
     () => hasRole(authUser?.roles, "affiliate" /* AFFILIATE */) && authUser?.affiliate !== null && authUser?.affiliate !== void 0,
@@ -328,15 +332,20 @@ var useAuthUser = () => {
   return context;
 };
 export {
+  ADMIN_APP_ROLES,
+  ADMIN_DASHBOARD_CONTEXTS,
   DEFAULT_LIMITS,
   PERMISSIONS,
   ROLE_PERMISSIONS,
-  SUPER_ADMIN_EMAIL,
   UserProvider,
   WILDCARD_PERMISSION,
+  canAccessAdminApp,
+  canAccessAdminPath,
   createAuthManager,
+  getDefaultAdminHome,
   getLicenceFlagsByRole,
   getPermissionsForRoles,
+  getUsableAdminContexts,
   hasAllPermissions,
   hasAnyPermission,
   hasAnyRole,
@@ -347,6 +356,7 @@ export {
   isLicencedResourceType,
   isProfileBadgeLicence,
   permissionListIncludes,
+  resolveAdminContextFromPath,
   useAuthCore,
   useAuthUser
 };

package/dist/auth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/constants.ts","../../src/auth/createAuthManager.ts","../../src/auth/licenceUtils.ts","../../src/auth/useAuthCore.ts","../../src/auth/UserProvider.tsx"],"sourcesContent":["/** Super-admin identity used for elevated admin checks in clients. */\nexport const SUPER_ADMIN_EMAIL = \"hello@cluemart.co.nz\";\n","export type AuthManager = {\n  logout: () => Promise<void>;\n  setLogout: (fn: () => Promise<void>) => void;\n  handleRefetchUser: () => Promise<void>;\n  setUserRefetch: (fn: () => Promise<void>) => void;\n};\n\n/**\n * Creates an auth manager used by Apollo error links to trigger logout/refetch\n * without importing React. Matches the former mobile authManager shape.\n *\n * `logout()` dedupes concurrent calls via an in-flight promise so token-refresh\n * failures do not kick off multiple logout sequences.\n */\nexport function createAuthManager(): AuthManager {\n  let logoutFn: (() => Promise<void>) | null = null;\n  let userRefetchFn: (() => Promise<void>) | null = null;\n  let logoutPromise: Promise<void> | null = null;\n\n  return {\n    handleRefetchUser: async () => {\n      if (userRefetchFn) {\n        await userRefetchFn();\n      } else {\n        console.warn(\"❌ User refetch function not set!\");\n      }\n    },\n    logout(): Promise<void> {\n      if (logoutPromise !== null) return logoutPromise;\n      if (logoutFn === null) {\n        console.warn(\"❌ Logout function not set!\");\n        return Promise.resolve();\n      }\n      logoutPromise = logoutFn().finally(() => {\n        logoutPromise = null;\n      });\n      return logoutPromise;\n    },\n    setLogout(fn: () => Promise<void>) {\n      logoutFn = fn;\n    },\n    setUserRefetch(fn: () => Promise<void>) {\n      userRefetchFn = fn;\n    },\n  };\n}\n","/* eslint-disable camelcase */\nimport { EnumResourceType, EnumUserLicence } from \"../enums\";\nimport type { SafeUserType } from \"../types\";\nimport { TIERS_BY_PRIORITY, type Tier } from \"../types/subscription\";\n\nimport type {\n  HasLicenceResult,\n  LicencedResourceType,\n  LicencesByRole,\n  LimitType,\n  ProfileBadgeLicence,\n  RoleLicences,\n} from \"./types\";\n\nexport function isLicencedResourceType(\n  resourceType: EnumResourceType,\n): resourceType is LicencedResourceType {\n  return (\n    resourceType !== EnumResourceType.AFFILIATE &&\n    resourceType !== EnumResourceType.SCHOOL\n  );\n}\n\nexport function isProfileBadgeLicence(\n  licenceType: EnumUserLicence,\n): licenceType is ProfileBadgeLicence {\n  return (\n    licenceType !== EnumUserLicence.STANDARD_AFFILIATE &&\n    licenceType !== EnumUserLicence.STANDARD_SCHOOL\n  );\n}\n\nexport const hasUserLicenceType = (\n  authUser: SafeUserType | null,\n  licenceType: EnumUserLicence,\n): boolean =>\n  authUser?.licences?.some((licence) => licence.licenceType === licenceType) ??\n  false;\n\nexport const hasLicence = (\n  authUser: SafeUserType | null,\n  licenceType: \"vendor\" | \"partner\" | \"event\",\n): HasLicenceResult => {\n  const directLicence =\n    authUser?.licences?.some((licence) =>\n      licence.licenceType?.includes(licenceType),\n    ) ?? false;\n\n  const associateLicence =\n    authUser?.associates?.some((associate) =>\n      associate.licence?.licenceType?.includes(licenceType),\n    ) ?? false;\n\n  return {\n    associateLicence,\n    directLicence,\n  };\n};\n\n/** Default limits per subscription tier. */\nexport const DEFAULT_LIMITS: Record<LimitType, Record<Tier, number>> = {\n  // 1 means calendar/productMenu is enabled, 0 means disabled\n  associates: { pro: 3, pro_plus: 3, standard: 0 },\n  availability: { pro: 1, pro_plus: 1, standard: 0 },\n  calendar: { pro: 1, pro_plus: 1, standard: 0 },\n  images: { pro: 12, pro_plus: 12, standard: 6 },\n  posters: { pro: 5, pro_plus: 5, standard: 5 },\n  productsList: { pro: 1, pro_plus: 1, standard: 0 },\n  relationShare: { pro: 1, pro_plus: 1, standard: 0 },\n  statistics: { pro: 1, pro_plus: 1, standard: 0 },\n};\n\n/**\n * Parses an array of licence strings into structured, role-based licences.\n */\nexport function getLicenceFlagsByRole(licences?: string[]): LicencesByRole {\n  const normalized = licences?.map((l) => l.toLowerCase()) ?? [];\n\n  function resolve(role: EnumResourceType): RoleLicences {\n    const result: RoleLicences = {\n      pro_plus: false,\n      // eslint-disable-next-line sort-keys\n      pro: false,\n      standard: false,\n    };\n\n    for (const tier of TIERS_BY_PRIORITY) {\n      if (normalized.some((l) => l.startsWith(`${tier}_${role}`))) {\n        result[tier] = true;\n        break; // stop at first match → ensures mutual exclusivity\n      }\n    }\n\n    return result;\n  }\n\n  return {\n    event: resolve(EnumResourceType.EVENT),\n    partner: resolve(EnumResourceType.PARTNER),\n    vendor: resolve(EnumResourceType.VENDOR),\n  };\n}\n","import { useCallback, useEffect, useMemo, useState } from \"react\";\n\nimport { EnumResourceType, EnumUserLicence, EnumUserRole } from \"../enums\";\nimport { useLogout } from \"../graphql/hooks/auth\";\nimport { useGetUser } from \"../graphql/hooks/user/hooksQuery\";\nimport { USER_STORAGE_KEY } from \"../storage\";\nimport type { SafeUserType } from \"../types\";\n\nimport { SUPER_ADMIN_EMAIL } from \"./constants\";\nimport {\n  DEFAULT_LIMITS,\n  getLicenceFlagsByRole,\n  hasLicence,\n  hasUserLicenceType,\n  isLicencedResourceType,\n} from \"./licenceUtils\";\nimport {\n  getPermissionsForRoles,\n  hasRole as roleHasRole,\n  permissionListIncludes,\n} from \"./permissions\";\nimport type { Permission } from \"./permissions\";\nimport type {\n  LimitType,\n  LogoutReason,\n  UseAuthCoreAdapters,\n  UseAuthReturnType,\n} from \"./types\";\n\n/**\n * Platform-agnostic auth session core (source of truth for shared useAuth).\n *\n * Owns: persisted user load/set, refetch, role/licence flags, logout orchestration.\n * Does not own: AsyncStorage vs localStorage, Expo/Next navigation, toasts,\n * Apollo/WS reset, Firebase — those stay in each app's adapter wrapper.\n */\nexport function useAuthCore(adapters: UseAuthCoreAdapters): UseAuthReturnType {\n  const {\n    storage,\n    authManager,\n    afterLogout,\n    shouldCallLogoutMutation = () => true,\n    notifyLogoutSuccess,\n    notifySessionExpired,\n    onError,\n  } = adapters;\n\n  const [authUser, setAuthUser] = useState<SafeUserType | null>(null);\n  const [isLoading, setIsLoading] = useState(true);\n\n  const userId = useMemo(() => authUser?._id ?? \"\", [authUser?._id]);\n  const { refetch } = useGetUser(userId);\n  const { logout, loading } = useLogout();\n\n  const handleSetAuthUser = useCallback(\n    async (user: SafeUserType | null) => {\n      setAuthUser(user);\n      if (user) {\n        await storage.setItem(USER_STORAGE_KEY, JSON.stringify(user));\n      } else {\n        await storage.removeItem(USER_STORAGE_KEY);\n      }\n    },\n    [storage],\n  );\n\n  const handleRefetchUser = useCallback(async () => {\n    if (!authUser) return;\n    try {\n      const result = await refetch();\n      if (!result) return;\n      const { data } = result;\n      if (data?.user) await handleSetAuthUser(data.user);\n    } catch (error: unknown) {\n      onError?.(error, { action: \"refetchUser\" });\n      console.warn(\n        \"Failed to refetch user:\",\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }, [authUser, handleSetAuthUser, onError, refetch]);\n\n  const licences = useCallback(\n    (resourceId: string) => {\n      const myLicences =\n        authUser?.licences?.map((licence) => licence.licenceType) ?? [];\n      const associateLicences =\n        authUser?.associates?.map(\n          (associate) => associate.licence.licenceType,\n        ) ?? [];\n\n      // No resource yet (e.g. create flow / unloaded id): use the user's own\n      // licences only — never hard-code elevated tiers for an empty id.\n      if (resourceId === \"\") {\n        return getLicenceFlagsByRole(myLicences);\n      }\n\n      const myResourceIds = [\n        authUser?.vendor ?? null,\n        authUser?.partner ?? null,\n        ...(authUser?.events ?? []),\n      ].filter((id): id is string => id !== null);\n\n      return myResourceIds.includes(resourceId)\n        ? getLicenceFlagsByRole(myLicences)\n        : getLicenceFlagsByRole(associateLicences);\n    },\n    [authUser],\n  );\n\n  const getLicenseAccessLevel = useCallback(\n    (\n      limitType: LimitType,\n      resourceId: string,\n      resourceType: EnumResourceType,\n    ): number => {\n      if (!isLicencedResourceType(resourceType)) {\n        return 0;\n      }\n\n      const roleLicences = licences(resourceId)[resourceType];\n\n      if (roleLicences.pro_plus) return DEFAULT_LIMITS[limitType].pro_plus;\n      if (roleLicences.pro) return DEFAULT_LIMITS[limitType].pro;\n      if (roleLicences.standard) return DEFAULT_LIMITS[limitType].standard;\n\n      return 0;\n    },\n    [licences],\n  );\n\n  const hasVendorLicence = useMemo(\n    () => hasLicence(authUser, \"vendor\"),\n    [authUser],\n  );\n\n  const hasPartnerLicence = useMemo(\n    () => hasLicence(authUser, \"partner\"),\n    [authUser],\n  );\n\n  const hasEventLicence = useMemo(\n    () => hasLicence(authUser, \"event\"),\n    [authUser],\n  );\n\n  const hasUserLicence = useCallback(\n    (licenceType: EnumUserLicence) => hasUserLicenceType(authUser, licenceType),\n    [authUser],\n  );\n\n  const permissions = useMemo(() => {\n    if (authUser?.permissions != null) {\n      return authUser.permissions;\n    }\n    return getPermissionsForRoles(authUser?.roles);\n  }, [authUser?.permissions, authUser?.roles]);\n\n  const hasPermissionFn = useCallback(\n    (permission: Permission) => permissionListIncludes(permissions, permission),\n    [permissions],\n  );\n\n  const hasRoleFn = useCallback(\n    (role: EnumUserRole) => roleHasRole(authUser?.roles, role),\n    [authUser?.roles],\n  );\n\n  const isAdmin = useMemo(\n    () =>\n      roleHasRole(authUser?.roles, EnumUserRole.ADMIN) ||\n      permissionListIncludes(permissions, \"dashboard.admin\") ||\n      permissionListIncludes(permissions, \"*\"),\n    [authUser?.roles, permissions],\n  );\n\n  const isSuperAdmin = useMemo(\n    () =>\n      roleHasRole(authUser?.roles, EnumUserRole.SUPER_ADMIN) &&\n      authUser?.email === SUPER_ADMIN_EMAIL,\n    [authUser?.roles, authUser?.email],\n  );\n\n  const isAffiliate = useMemo(\n    () =>\n      roleHasRole(authUser?.roles, EnumUserRole.AFFILIATE) &&\n      authUser?.affiliate !== null &&\n      authUser?.affiliate !== undefined,\n    [authUser?.roles, authUser?.affiliate],\n  );\n\n  const isSchool = useMemo(\n    () =>\n      roleHasRole(authUser?.roles, EnumUserRole.SCHOOL) &&\n      authUser?.school !== null &&\n      authUser?.school !== undefined,\n    [authUser?.roles, authUser?.school],\n  );\n\n  // Mount-only hydrate from storage. Do not re-run when adapter identities\n  // change — that can overwrite a newer in-memory user (e.g. post-login setUser).\n  useEffect(() => {\n    const loadUser = async () => {\n      try {\n        const userJson = await storage.getItem(USER_STORAGE_KEY);\n        await handleSetAuthUser(userJson ? JSON.parse(userJson) : null);\n      } catch (error: unknown) {\n        onError?.(error, { action: \"loadUserFromStorage\" });\n        console.error(\"Failed to load user from storage:\", error);\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    void loadUser();\n  }, []);\n\n  const logoutWithReason = useCallback(\n    async (reason: LogoutReason) => {\n      try {\n        if (shouldCallLogoutMutation(reason)) {\n          try {\n            const result = await logout();\n            const message = result?.data?.logout?.message as string | undefined;\n            if (message) {\n              notifyLogoutSuccess?.(message);\n            }\n          } catch (err: unknown) {\n            onError?.(err, { action: \"logout\" });\n            console.warn(\"Logout request failed (ignored):\", err);\n          }\n        }\n      } finally {\n        await afterLogout(reason);\n        setAuthUser(null);\n        await storage.removeItem(USER_STORAGE_KEY);\n      }\n    },\n    [\n      afterLogout,\n      logout,\n      notifyLogoutSuccess,\n      onError,\n      shouldCallLogoutMutation,\n      storage,\n    ],\n  );\n\n  const handleLogoutExplicit = useCallback(\n    () => logoutWithReason(\"manual\"),\n    [logoutWithReason],\n  );\n\n  const handleLogoutExpired = useCallback(async () => {\n    const hadSession = authUser != null;\n    if (!hadSession) return;\n    await logoutWithReason(\"expired\");\n    notifySessionExpired?.();\n  }, [authUser, logoutWithReason, notifySessionExpired]);\n\n  useEffect(() => {\n    authManager.setLogout(() => handleLogoutExpired());\n    authManager.setUserRefetch(() => handleRefetchUser());\n  }, [authManager, handleLogoutExpired, handleRefetchUser]);\n\n  return {\n    authUser,\n    getLicenseAccessLevel,\n    handleLogoutExplicit,\n    hasEventLicence,\n    hasPartnerLicence,\n    hasPermission: hasPermissionFn,\n    hasRole: hasRoleFn,\n    hasUserLicence,\n    hasVendorLicence,\n    isAdmin,\n    isAffiliate,\n    isLoading: loading || isLoading,\n    isSchool,\n    isSuperAdmin,\n    permissions,\n    refetchUser: handleRefetchUser,\n    setUser: handleSetAuthUser,\n  };\n}\n","/**\n * Shared React context for auth session state.\n *\n * Apps keep a thin local UserProvider that calls their platform `useAuth`\n * (adapters) and pass the result here as `value`. Import `useAuthUser` from\n * this module (or re-export it) so consumers share one context instance.\n *\n * `\"use client\"`: required for Next.js; ignored by React Native.\n */\n\"use client\";\n\nimport React, { createContext, useContext, type ReactNode } from \"react\";\n\nimport type { UseAuthReturnType } from \"./types\";\n\nconst UserContext = createContext<UseAuthReturnType | undefined>(undefined);\n\n/**\n * Provides auth session value from the app's thin useAuth wrapper.\n */\nexport const UserProvider: React.FC<{\n  children: ReactNode;\n  value: UseAuthReturnType;\n}> = ({ children, value }) => {\n  return <UserContext.Provider value={value}>{children}</UserContext.Provider>;\n};\n\nexport const useAuthUser = (): UseAuthReturnType => {\n  const context = useContext(UserContext);\n  if (!context) {\n    throw new Error(\"useAuthUser must be used within a UserProvider\");\n  }\n  return context;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AACO,IAAM,oBAAoB;;;ACa1B,SAAS,oBAAiC;AAC/C,MAAI,WAAyC;AAC7C,MAAI,gBAA8C;AAClD,MAAI,gBAAsC;AAE1C,SAAO;AAAA,IACL,mBAAmB,YAAY;AAC7B,UAAI,eAAe;AACjB,cAAM,cAAc;AAAA,MACtB,OAAO;AACL,gBAAQ,KAAK,uCAAkC;AAAA,MACjD;AAAA,IACF;AAAA,IACA,SAAwB;AACtB,UAAI,kBAAkB,KAAM,QAAO;AACnC,UAAI,aAAa,MAAM;AACrB,gBAAQ,KAAK,iCAA4B;AACzC,eAAO,QAAQ,QAAQ;AAAA,MACzB;AACA,sBAAgB,SAAS,EAAE,QAAQ,MAAM;AACvC,wBAAgB;AAAA,MAClB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,UAAU,IAAyB;AACjC,iBAAW;AAAA,IACb;AAAA,IACA,eAAe,IAAyB;AACtC,sBAAgB;AAAA,IAClB;AAAA,EACF;AACF;;;AC/BO,SAAS,uBACd,cACsC;AACtC,SACE,gDACA;AAEJ;AAEO,SAAS,sBACd,aACoC;AACpC,SACE,iEACA;AAEJ;AAEO,IAAM,qBAAqB,CAChC,UACA,gBAEA,UAAU,UAAU,KAAK,CAAC,YAAY,QAAQ,gBAAgB,WAAW,KACzE;AAEK,IAAM,aAAa,CACxB,UACA,gBACqB;AACrB,QAAM,gBACJ,UAAU,UAAU;AAAA,IAAK,CAAC,YACxB,QAAQ,aAAa,SAAS,WAAW;AAAA,EAC3C,KAAK;AAEP,QAAM,mBACJ,UAAU,YAAY;AAAA,IAAK,CAAC,cAC1B,UAAU,SAAS,aAAa,SAAS,WAAW;AAAA,EACtD,KAAK;AAEP,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAGO,IAAM,iBAA0D;AAAA;AAAA,EAErE,YAAY,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAC/C,cAAc,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EACjD,UAAU,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAC7C,QAAQ,EAAE,KAAK,IAAI,UAAU,IAAI,UAAU,EAAE;AAAA,EAC7C,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAC5C,cAAc,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EACjD,eAAe,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAClD,YAAY,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AACjD;AAKO,SAAS,sBAAsB,UAAqC;AACzE,QAAM,aAAa,UAAU,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;AAE7D,WAAS,QAAQ,MAAsC;AACrD,UAAM,SAAuB;AAAA,MAC3B,UAAU;AAAA;AAAA,MAEV,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAEA,eAAW,QAAQ,mBAAmB;AACpC,UAAI,WAAW,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,GAAG;AAC3D,eAAO,IAAI,IAAI;AACf;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,OAAO,2BAA8B;AAAA,IACrC,SAAS,+BAAgC;AAAA,IACzC,QAAQ,6BAA+B;AAAA,EACzC;AACF;;;ACrGA,SAAS,aAAa,WAAW,SAAS,gBAAgB;AAoCnD,SAAS,YAAY,UAAkD;AAC5E,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,2BAA2B,MAAM;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,CAAC,UAAU,WAAW,IAAI,SAA8B,IAAI;AAClE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAE/C,QAAM,SAAS,QAAQ,MAAM,UAAU,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC;AACjE,QAAM,EAAE,QAAQ,IAAI,WAAW,MAAM;AACrC,QAAM,EAAE,QAAQ,QAAQ,IAAI,UAAU;AAEtC,QAAM,oBAAoB;AAAA,IACxB,OAAO,SAA8B;AACnC,kBAAY,IAAI;AAChB,UAAI,MAAM;AACR,cAAM,QAAQ,QAAQ,kBAAkB,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9D,OAAO;AACL,cAAM,QAAQ,WAAW,gBAAgB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,oBAAoB,YAAY,YAAY;AAChD,QAAI,CAAC,SAAU;AACf,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ;AAC7B,UAAI,CAAC,OAAQ;AACb,YAAM,EAAE,KAAK,IAAI;AACjB,UAAI,MAAM,KAAM,OAAM,kBAAkB,KAAK,IAAI;AAAA,IACnD,SAAS,OAAgB;AACvB,gBAAU,OAAO,EAAE,QAAQ,cAAc,CAAC;AAC1C,cAAQ;AAAA,QACN;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,GAAG,CAAC,UAAU,mBAAmB,SAAS,OAAO,CAAC;AAElD,QAAM,WAAW;AAAA,IACf,CAAC,eAAuB;AACtB,YAAM,aACJ,UAAU,UAAU,IAAI,CAAC,YAAY,QAAQ,WAAW,KAAK,CAAC;AAChE,YAAM,oBACJ,UAAU,YAAY;AAAA,QACpB,CAAC,cAAc,UAAU,QAAQ;AAAA,MACnC,KAAK,CAAC;AAIR,UAAI,eAAe,IAAI;AACrB,eAAO,sBAAsB,UAAU;AAAA,MACzC;AAEA,YAAM,gBAAgB;AAAA,QACpB,UAAU,UAAU;AAAA,QACpB,UAAU,WAAW;AAAA,QACrB,GAAI,UAAU,UAAU,CAAC;AAAA,MAC3B,EAAE,OAAO,CAAC,OAAqB,OAAO,IAAI;AAE1C,aAAO,cAAc,SAAS,UAAU,IACpC,sBAAsB,UAAU,IAChC,sBAAsB,iBAAiB;AAAA,IAC7C;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,wBAAwB;AAAA,IAC5B,CACE,WACA,YACA,iBACW;AACX,UAAI,CAAC,uBAAuB,YAAY,GAAG;AACzC,eAAO;AAAA,MACT;AAEA,YAAM,eAAe,SAAS,UAAU,EAAE,YAAY;AAEtD,UAAI,aAAa,SAAU,QAAO,eAAe,SAAS,EAAE;AAC5D,UAAI,aAAa,IAAK,QAAO,eAAe,SAAS,EAAE;AACvD,UAAI,aAAa,SAAU,QAAO,eAAe,SAAS,EAAE;AAE5D,aAAO;AAAA,IACT;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,mBAAmB;AAAA,IACvB,MAAM,WAAW,UAAU,QAAQ;AAAA,IACnC,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,oBAAoB;AAAA,IACxB,MAAM,WAAW,UAAU,SAAS;AAAA,IACpC,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,kBAAkB;AAAA,IACtB,MAAM,WAAW,UAAU,OAAO;AAAA,IAClC,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,iBAAiB;AAAA,IACrB,CAAC,gBAAiC,mBAAmB,UAAU,WAAW;AAAA,IAC1E,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,cAAc,QAAQ,MAAM;AAChC,QAAI,UAAU,eAAe,MAAM;AACjC,aAAO,SAAS;AAAA,IAClB;AACA,WAAO,uBAAuB,UAAU,KAAK;AAAA,EAC/C,GAAG,CAAC,UAAU,aAAa,UAAU,KAAK,CAAC;AAE3C,QAAM,kBAAkB;AAAA,IACtB,CAAC,eAA2B,uBAAuB,aAAa,UAAU;AAAA,IAC1E,CAAC,WAAW;AAAA,EACd;AAEA,QAAM,YAAY;AAAA,IAChB,CAAC,SAAuB,QAAY,UAAU,OAAO,IAAI;AAAA,IACzD,CAAC,UAAU,KAAK;AAAA,EAClB;AAEA,QAAM,UAAU;AAAA,IACd,MACE,QAAY,UAAU,0BAAyB,KAC/C,uBAAuB,aAAa,iBAAiB,KACrD,uBAAuB,aAAa,GAAG;AAAA,IACzC,CAAC,UAAU,OAAO,WAAW;AAAA,EAC/B;AAEA,QAAM,eAAe;AAAA,IACnB,MACE,QAAY,UAAU,sCAA+B,KACrD,UAAU,UAAU;AAAA,IACtB,CAAC,UAAU,OAAO,UAAU,KAAK;AAAA,EACnC;AAEA,QAAM,cAAc;AAAA,IAClB,MACE,QAAY,UAAU,kCAA6B,KACnD,UAAU,cAAc,QACxB,UAAU,cAAc;AAAA,IAC1B,CAAC,UAAU,OAAO,UAAU,SAAS;AAAA,EACvC;AAEA,QAAM,WAAW;AAAA,IACf,MACE,QAAY,UAAU,4BAA0B,KAChD,UAAU,WAAW,QACrB,UAAU,WAAW;AAAA,IACvB,CAAC,UAAU,OAAO,UAAU,MAAM;AAAA,EACpC;AAIA,YAAU,MAAM;AACd,UAAM,WAAW,YAAY;AAC3B,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ,QAAQ,gBAAgB;AACvD,cAAM,kBAAkB,WAAW,KAAK,MAAM,QAAQ,IAAI,IAAI;AAAA,MAChE,SAAS,OAAgB;AACvB,kBAAU,OAAO,EAAE,QAAQ,sBAAsB,CAAC;AAClD,gBAAQ,MAAM,qCAAqC,KAAK;AAAA,MAC1D,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,SAAK,SAAS;AAAA,EAChB,GAAG,CAAC,CAAC;AAEL,QAAM,mBAAmB;AAAA,IACvB,OAAO,WAAyB;AAC9B,UAAI;AACF,YAAI,yBAAyB,MAAM,GAAG;AACpC,cAAI;AACF,kBAAM,SAAS,MAAM,OAAO;AAC5B,kBAAM,UAAU,QAAQ,MAAM,QAAQ;AACtC,gBAAI,SAAS;AACX,oCAAsB,OAAO;AAAA,YAC/B;AAAA,UACF,SAAS,KAAc;AACrB,sBAAU,KAAK,EAAE,QAAQ,SAAS,CAAC;AACnC,oBAAQ,KAAK,oCAAoC,GAAG;AAAA,UACtD;AAAA,QACF;AAAA,MACF,UAAE;AACA,cAAM,YAAY,MAAM;AACxB,oBAAY,IAAI;AAChB,cAAM,QAAQ,WAAW,gBAAgB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,uBAAuB;AAAA,IAC3B,MAAM,iBAAiB,QAAQ;AAAA,IAC/B,CAAC,gBAAgB;AAAA,EACnB;AAEA,QAAM,sBAAsB,YAAY,YAAY;AAClD,UAAM,aAAa,YAAY;AAC/B,QAAI,CAAC,WAAY;AACjB,UAAM,iBAAiB,SAAS;AAChC,2BAAuB;AAAA,EACzB,GAAG,CAAC,UAAU,kBAAkB,oBAAoB,CAAC;AAErD,YAAU,MAAM;AACd,gBAAY,UAAU,MAAM,oBAAoB,CAAC;AACjD,gBAAY,eAAe,MAAM,kBAAkB,CAAC;AAAA,EACtD,GAAG,CAAC,aAAa,qBAAqB,iBAAiB,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,WAAW;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AACF;;;ACjRA,SAAgB,eAAe,kBAAkC;AAaxD;AATT,IAAM,cAAc,cAA6C,MAAS;AAKnE,IAAM,eAGR,CAAC,EAAE,UAAU,MAAM,MAAM;AAC5B,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;AAEO,IAAM,cAAc,MAAyB;AAClD,QAAM,UAAU,WAAW,WAAW;AACtC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/auth/createAuthManager.ts","../../src/auth/licenceUtils.ts","../../src/auth/useAuthCore.ts","../../src/auth/UserProvider.tsx"],"sourcesContent":["export type AuthManager = {\n  logout: () => Promise<void>;\n  setLogout: (fn: () => Promise<void>) => void;\n  handleRefetchUser: () => Promise<void>;\n  setUserRefetch: (fn: () => Promise<void>) => void;\n};\n\n/**\n * Creates an auth manager used by Apollo error links to trigger logout/refetch\n * without importing React. Matches the former mobile authManager shape.\n *\n * `logout()` dedupes concurrent calls via an in-flight promise so token-refresh\n * failures do not kick off multiple logout sequences.\n */\nexport function createAuthManager(): AuthManager {\n  let logoutFn: (() => Promise<void>) | null = null;\n  let userRefetchFn: (() => Promise<void>) | null = null;\n  let logoutPromise: Promise<void> | null = null;\n\n  return {\n    handleRefetchUser: async () => {\n      if (userRefetchFn) {\n        await userRefetchFn();\n      } else {\n        console.warn(\"❌ User refetch function not set!\");\n      }\n    },\n    logout(): Promise<void> {\n      if (logoutPromise !== null) return logoutPromise;\n      if (logoutFn === null) {\n        console.warn(\"❌ Logout function not set!\");\n        return Promise.resolve();\n      }\n      logoutPromise = logoutFn().finally(() => {\n        logoutPromise = null;\n      });\n      return logoutPromise;\n    },\n    setLogout(fn: () => Promise<void>) {\n      logoutFn = fn;\n    },\n    setUserRefetch(fn: () => Promise<void>) {\n      userRefetchFn = fn;\n    },\n  };\n}\n","/* eslint-disable camelcase */\nimport { EnumResourceType, EnumUserLicence } from \"../enums\";\nimport type { SafeUserType } from \"../types\";\nimport { TIERS_BY_PRIORITY, type Tier } from \"../types/subscription\";\n\nimport type {\n  HasLicenceResult,\n  LicencedResourceType,\n  LicencesByRole,\n  LimitType,\n  ProfileBadgeLicence,\n  RoleLicences,\n} from \"./types\";\n\nexport function isLicencedResourceType(\n  resourceType: EnumResourceType,\n): resourceType is LicencedResourceType {\n  return (\n    resourceType !== EnumResourceType.AFFILIATE &&\n    resourceType !== EnumResourceType.SCHOOL\n  );\n}\n\nexport function isProfileBadgeLicence(\n  licenceType: EnumUserLicence,\n): licenceType is ProfileBadgeLicence {\n  return (\n    licenceType !== EnumUserLicence.STANDARD_AFFILIATE &&\n    licenceType !== EnumUserLicence.STANDARD_SCHOOL\n  );\n}\n\nexport const hasUserLicenceType = (\n  authUser: SafeUserType | null,\n  licenceType: EnumUserLicence,\n): boolean =>\n  authUser?.licences?.some((licence) => licence.licenceType === licenceType) ??\n  false;\n\nexport const hasLicence = (\n  authUser: SafeUserType | null,\n  licenceType: \"vendor\" | \"partner\" | \"event\",\n): HasLicenceResult => {\n  const directLicence =\n    authUser?.licences?.some((licence) =>\n      licence.licenceType?.includes(licenceType),\n    ) ?? false;\n\n  const associateLicence =\n    authUser?.associates?.some((associate) =>\n      associate.licence?.licenceType?.includes(licenceType),\n    ) ?? false;\n\n  return {\n    associateLicence,\n    directLicence,\n  };\n};\n\n/** Default limits per subscription tier. */\nexport const DEFAULT_LIMITS: Record<LimitType, Record<Tier, number>> = {\n  // 1 means calendar/productMenu is enabled, 0 means disabled\n  associates: { pro: 3, pro_plus: 3, standard: 0 },\n  availability: { pro: 1, pro_plus: 1, standard: 0 },\n  calendar: { pro: 1, pro_plus: 1, standard: 0 },\n  images: { pro: 12, pro_plus: 12, standard: 6 },\n  posters: { pro: 5, pro_plus: 5, standard: 5 },\n  productsList: { pro: 1, pro_plus: 1, standard: 0 },\n  relationShare: { pro: 1, pro_plus: 1, standard: 0 },\n  statistics: { pro: 1, pro_plus: 1, standard: 0 },\n};\n\n/**\n * Parses an array of licence strings into structured, role-based licences.\n */\nexport function getLicenceFlagsByRole(licences?: string[]): LicencesByRole {\n  const normalized = licences?.map((l) => l.toLowerCase()) ?? [];\n\n  function resolve(role: EnumResourceType): RoleLicences {\n    const result: RoleLicences = {\n      pro_plus: false,\n      // eslint-disable-next-line sort-keys\n      pro: false,\n      standard: false,\n    };\n\n    for (const tier of TIERS_BY_PRIORITY) {\n      if (normalized.some((l) => l.startsWith(`${tier}_${role}`))) {\n        result[tier] = true;\n        break; // stop at first match → ensures mutual exclusivity\n      }\n    }\n\n    return result;\n  }\n\n  return {\n    event: resolve(EnumResourceType.EVENT),\n    partner: resolve(EnumResourceType.PARTNER),\n    vendor: resolve(EnumResourceType.VENDOR),\n  };\n}\n","import { useCallback, useEffect, useMemo, useState } from \"react\";\n\nimport { EnumResourceType, EnumUserLicence, EnumUserRole } from \"../enums\";\nimport { useLogout } from \"../graphql/hooks/auth\";\nimport { useGetUser } from \"../graphql/hooks/user/hooksQuery\";\nimport { USER_STORAGE_KEY } from \"../storage\";\nimport type { SafeUserType } from \"../types\";\n\nimport {\n  DEFAULT_LIMITS,\n  getLicenceFlagsByRole,\n  hasLicence,\n  hasUserLicenceType,\n  isLicencedResourceType,\n} from \"./licenceUtils\";\nimport {\n  getPermissionsForRoles,\n  hasRole as roleHasRole,\n  permissionListIncludes,\n} from \"./permissions\";\nimport type { Permission } from \"./permissions\";\nimport type {\n  LimitType,\n  LogoutReason,\n  UseAuthCoreAdapters,\n  UseAuthReturnType,\n} from \"./types\";\n\n/**\n * Platform-agnostic auth session core (source of truth for shared useAuth).\n *\n * Owns: persisted user load/set, refetch, role/licence flags, logout orchestration.\n * Does not own: AsyncStorage vs localStorage, Expo/Next navigation, toasts,\n * Apollo/WS reset, Firebase — those stay in each app's adapter wrapper.\n */\nexport function useAuthCore(adapters: UseAuthCoreAdapters): UseAuthReturnType {\n  const {\n    storage,\n    authManager,\n    afterLogout,\n    shouldCallLogoutMutation = () => true,\n    notifyLogoutSuccess,\n    notifySessionExpired,\n    onError,\n  } = adapters;\n\n  const [authUser, setAuthUser] = useState<SafeUserType | null>(null);\n  const [isLoading, setIsLoading] = useState(true);\n\n  const userId = useMemo(() => authUser?._id ?? \"\", [authUser?._id]);\n  const { refetch } = useGetUser(userId);\n  const { logout, loading } = useLogout();\n\n  const handleSetAuthUser = useCallback(\n    async (user: SafeUserType | null) => {\n      setAuthUser(user);\n      if (user) {\n        await storage.setItem(USER_STORAGE_KEY, JSON.stringify(user));\n      } else {\n        await storage.removeItem(USER_STORAGE_KEY);\n      }\n    },\n    [storage],\n  );\n\n  const handleRefetchUser = useCallback(async () => {\n    if (!authUser) return;\n    try {\n      const result = await refetch();\n      if (!result) return;\n      const { data } = result;\n      if (data?.user) await handleSetAuthUser(data.user);\n    } catch (error: unknown) {\n      onError?.(error, { action: \"refetchUser\" });\n      console.warn(\n        \"Failed to refetch user:\",\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }, [authUser, handleSetAuthUser, onError, refetch]);\n\n  const licences = useCallback(\n    (resourceId: string) => {\n      const myLicences =\n        authUser?.licences?.map((licence) => licence.licenceType) ?? [];\n      const associateLicences =\n        authUser?.associates?.map(\n          (associate) => associate.licence.licenceType,\n        ) ?? [];\n\n      // No resource yet (e.g. create flow / unloaded id): use the user's own\n      // licences only — never hard-code elevated tiers for an empty id.\n      if (resourceId === \"\") {\n        return getLicenceFlagsByRole(myLicences);\n      }\n\n      const myResourceIds = [\n        authUser?.vendor ?? null,\n        authUser?.partner ?? null,\n        ...(authUser?.events ?? []),\n      ].filter((id): id is string => id !== null);\n\n      return myResourceIds.includes(resourceId)\n        ? getLicenceFlagsByRole(myLicences)\n        : getLicenceFlagsByRole(associateLicences);\n    },\n    [authUser],\n  );\n\n  const getLicenseAccessLevel = useCallback(\n    (\n      limitType: LimitType,\n      resourceId: string,\n      resourceType: EnumResourceType,\n    ): number => {\n      if (!isLicencedResourceType(resourceType)) {\n        return 0;\n      }\n\n      const roleLicences = licences(resourceId)[resourceType];\n\n      if (roleLicences.pro_plus) return DEFAULT_LIMITS[limitType].pro_plus;\n      if (roleLicences.pro) return DEFAULT_LIMITS[limitType].pro;\n      if (roleLicences.standard) return DEFAULT_LIMITS[limitType].standard;\n\n      return 0;\n    },\n    [licences],\n  );\n\n  const hasVendorLicence = useMemo(\n    () => hasLicence(authUser, \"vendor\"),\n    [authUser],\n  );\n\n  const hasPartnerLicence = useMemo(\n    () => hasLicence(authUser, \"partner\"),\n    [authUser],\n  );\n\n  const hasEventLicence = useMemo(\n    () => hasLicence(authUser, \"event\"),\n    [authUser],\n  );\n\n  const hasUserLicence = useCallback(\n    (licenceType: EnumUserLicence) => hasUserLicenceType(authUser, licenceType),\n    [authUser],\n  );\n\n  const permissions = useMemo(() => {\n    if (authUser?.permissions != null) {\n      return authUser.permissions;\n    }\n    return getPermissionsForRoles(authUser?.roles);\n  }, [authUser?.permissions, authUser?.roles]);\n\n  const hasPermissionFn = useCallback(\n    (permission: Permission) => permissionListIncludes(permissions, permission),\n    [permissions],\n  );\n\n  const hasRoleFn = useCallback(\n    (role: EnumUserRole) => roleHasRole(authUser?.roles, role),\n    [authUser?.roles],\n  );\n\n  const isAdmin = useMemo(\n    () =>\n      roleHasRole(authUser?.roles, EnumUserRole.ADMIN) ||\n      permissionListIncludes(permissions, \"dashboard.admin\") ||\n      permissionListIncludes(permissions, \"*\"),\n    [authUser?.roles, permissions],\n  );\n\n  const isSuperAdmin = useMemo(\n    () => roleHasRole(authUser?.roles, EnumUserRole.SUPER_ADMIN),\n    [authUser?.roles],\n  );\n\n  const isAffiliate = useMemo(\n    () =>\n      roleHasRole(authUser?.roles, EnumUserRole.AFFILIATE) &&\n      authUser?.affiliate !== null &&\n      authUser?.affiliate !== undefined,\n    [authUser?.roles, authUser?.affiliate],\n  );\n\n  const isSchool = useMemo(\n    () =>\n      roleHasRole(authUser?.roles, EnumUserRole.SCHOOL) &&\n      authUser?.school !== null &&\n      authUser?.school !== undefined,\n    [authUser?.roles, authUser?.school],\n  );\n\n  // Mount-only hydrate from storage. Do not re-run when adapter identities\n  // change — that can overwrite a newer in-memory user (e.g. post-login setUser).\n  useEffect(() => {\n    const loadUser = async () => {\n      try {\n        const userJson = await storage.getItem(USER_STORAGE_KEY);\n        await handleSetAuthUser(userJson ? JSON.parse(userJson) : null);\n      } catch (error: unknown) {\n        onError?.(error, { action: \"loadUserFromStorage\" });\n        console.error(\"Failed to load user from storage:\", error);\n      } finally {\n        setIsLoading(false);\n      }\n    };\n\n    void loadUser();\n  }, []);\n\n  const logoutWithReason = useCallback(\n    async (reason: LogoutReason) => {\n      try {\n        if (shouldCallLogoutMutation(reason)) {\n          try {\n            const result = await logout();\n            const message = result?.data?.logout?.message as string | undefined;\n            if (message) {\n              notifyLogoutSuccess?.(message);\n            }\n          } catch (err: unknown) {\n            onError?.(err, { action: \"logout\" });\n            console.warn(\"Logout request failed (ignored):\", err);\n          }\n        }\n      } finally {\n        await afterLogout(reason);\n        setAuthUser(null);\n        await storage.removeItem(USER_STORAGE_KEY);\n      }\n    },\n    [\n      afterLogout,\n      logout,\n      notifyLogoutSuccess,\n      onError,\n      shouldCallLogoutMutation,\n      storage,\n    ],\n  );\n\n  const handleLogoutExplicit = useCallback(\n    () => logoutWithReason(\"manual\"),\n    [logoutWithReason],\n  );\n\n  const handleLogoutExpired = useCallback(async () => {\n    const hadSession = authUser != null;\n    if (!hadSession) return;\n    await logoutWithReason(\"expired\");\n    notifySessionExpired?.();\n  }, [authUser, logoutWithReason, notifySessionExpired]);\n\n  useEffect(() => {\n    authManager.setLogout(() => handleLogoutExpired());\n    authManager.setUserRefetch(() => handleRefetchUser());\n  }, [authManager, handleLogoutExpired, handleRefetchUser]);\n\n  return {\n    authUser,\n    getLicenseAccessLevel,\n    handleLogoutExplicit,\n    hasEventLicence,\n    hasPartnerLicence,\n    hasPermission: hasPermissionFn,\n    hasRole: hasRoleFn,\n    hasUserLicence,\n    hasVendorLicence,\n    isAdmin,\n    isAffiliate,\n    isLoading: loading || isLoading,\n    isSchool,\n    isSuperAdmin,\n    permissions,\n    refetchUser: handleRefetchUser,\n    setUser: handleSetAuthUser,\n  };\n}\n","/**\n * Shared React context for auth session state.\n *\n * Apps keep a thin local UserProvider that calls their platform `useAuth`\n * (adapters) and pass the result here as `value`. Import `useAuthUser` from\n * this module (or re-export it) so consumers share one context instance.\n *\n * `\"use client\"`: required for Next.js; ignored by React Native.\n */\n\"use client\";\n\nimport React, { createContext, useContext, type ReactNode } from \"react\";\n\nimport type { UseAuthReturnType } from \"./types\";\n\nconst UserContext = createContext<UseAuthReturnType | undefined>(undefined);\n\n/**\n * Provides auth session value from the app's thin useAuth wrapper.\n */\nexport const UserProvider: React.FC<{\n  children: ReactNode;\n  value: UseAuthReturnType;\n}> = ({ children, value }) => {\n  return <UserContext.Provider value={value}>{children}</UserContext.Provider>;\n};\n\nexport const useAuthUser = (): UseAuthReturnType => {\n  const context = useContext(UserContext);\n  if (!context) {\n    throw new Error(\"useAuthUser must be used within a UserProvider\");\n  }\n  return context;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcO,SAAS,oBAAiC;AAC/C,MAAI,WAAyC;AAC7C,MAAI,gBAA8C;AAClD,MAAI,gBAAsC;AAE1C,SAAO;AAAA,IACL,mBAAmB,YAAY;AAC7B,UAAI,eAAe;AACjB,cAAM,cAAc;AAAA,MACtB,OAAO;AACL,gBAAQ,KAAK,uCAAkC;AAAA,MACjD;AAAA,IACF;AAAA,IACA,SAAwB;AACtB,UAAI,kBAAkB,KAAM,QAAO;AACnC,UAAI,aAAa,MAAM;AACrB,gBAAQ,KAAK,iCAA4B;AACzC,eAAO,QAAQ,QAAQ;AAAA,MACzB;AACA,sBAAgB,SAAS,EAAE,QAAQ,MAAM;AACvC,wBAAgB;AAAA,MAClB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,UAAU,IAAyB;AACjC,iBAAW;AAAA,IACb;AAAA,IACA,eAAe,IAAyB;AACtC,sBAAgB;AAAA,IAClB;AAAA,EACF;AACF;;;AC/BO,SAAS,uBACd,cACsC;AACtC,SACE,gDACA;AAEJ;AAEO,SAAS,sBACd,aACoC;AACpC,SACE,iEACA;AAEJ;AAEO,IAAM,qBAAqB,CAChC,UACA,gBAEA,UAAU,UAAU,KAAK,CAAC,YAAY,QAAQ,gBAAgB,WAAW,KACzE;AAEK,IAAM,aAAa,CACxB,UACA,gBACqB;AACrB,QAAM,gBACJ,UAAU,UAAU;AAAA,IAAK,CAAC,YACxB,QAAQ,aAAa,SAAS,WAAW;AAAA,EAC3C,KAAK;AAEP,QAAM,mBACJ,UAAU,YAAY;AAAA,IAAK,CAAC,cAC1B,UAAU,SAAS,aAAa,SAAS,WAAW;AAAA,EACtD,KAAK;AAEP,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAGO,IAAM,iBAA0D;AAAA;AAAA,EAErE,YAAY,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAC/C,cAAc,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EACjD,UAAU,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAC7C,QAAQ,EAAE,KAAK,IAAI,UAAU,IAAI,UAAU,EAAE;AAAA,EAC7C,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAC5C,cAAc,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EACjD,eAAe,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AAAA,EAClD,YAAY,EAAE,KAAK,GAAG,UAAU,GAAG,UAAU,EAAE;AACjD;AAKO,SAAS,sBAAsB,UAAqC;AACzE,QAAM,aAAa,UAAU,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;AAE7D,WAAS,QAAQ,MAAsC;AACrD,UAAM,SAAuB;AAAA,MAC3B,UAAU;AAAA;AAAA,MAEV,KAAK;AAAA,MACL,UAAU;AAAA,IACZ;AAEA,eAAW,QAAQ,mBAAmB;AACpC,UAAI,WAAW,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,GAAG;AAC3D,eAAO,IAAI,IAAI;AACf;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,OAAO,2BAA8B;AAAA,IACrC,SAAS,+BAAgC;AAAA,IACzC,QAAQ,6BAA+B;AAAA,EACzC;AACF;;;ACrGA,SAAS,aAAa,WAAW,SAAS,gBAAgB;AAmCnD,SAAS,YAAY,UAAkD;AAC5E,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,2BAA2B,MAAM;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,CAAC,UAAU,WAAW,IAAI,SAA8B,IAAI;AAClE,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,IAAI;AAE/C,QAAM,SAAS,QAAQ,MAAM,UAAU,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC;AACjE,QAAM,EAAE,QAAQ,IAAI,WAAW,MAAM;AACrC,QAAM,EAAE,QAAQ,QAAQ,IAAI,UAAU;AAEtC,QAAM,oBAAoB;AAAA,IACxB,OAAO,SAA8B;AACnC,kBAAY,IAAI;AAChB,UAAI,MAAM;AACR,cAAM,QAAQ,QAAQ,kBAAkB,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9D,OAAO;AACL,cAAM,QAAQ,WAAW,gBAAgB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAEA,QAAM,oBAAoB,YAAY,YAAY;AAChD,QAAI,CAAC,SAAU;AACf,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ;AAC7B,UAAI,CAAC,OAAQ;AACb,YAAM,EAAE,KAAK,IAAI;AACjB,UAAI,MAAM,KAAM,OAAM,kBAAkB,KAAK,IAAI;AAAA,IACnD,SAAS,OAAgB;AACvB,gBAAU,OAAO,EAAE,QAAQ,cAAc,CAAC;AAC1C,cAAQ;AAAA,QACN;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,GAAG,CAAC,UAAU,mBAAmB,SAAS,OAAO,CAAC;AAElD,QAAM,WAAW;AAAA,IACf,CAAC,eAAuB;AACtB,YAAM,aACJ,UAAU,UAAU,IAAI,CAAC,YAAY,QAAQ,WAAW,KAAK,CAAC;AAChE,YAAM,oBACJ,UAAU,YAAY;AAAA,QACpB,CAAC,cAAc,UAAU,QAAQ;AAAA,MACnC,KAAK,CAAC;AAIR,UAAI,eAAe,IAAI;AACrB,eAAO,sBAAsB,UAAU;AAAA,MACzC;AAEA,YAAM,gBAAgB;AAAA,QACpB,UAAU,UAAU;AAAA,QACpB,UAAU,WAAW;AAAA,QACrB,GAAI,UAAU,UAAU,CAAC;AAAA,MAC3B,EAAE,OAAO,CAAC,OAAqB,OAAO,IAAI;AAE1C,aAAO,cAAc,SAAS,UAAU,IACpC,sBAAsB,UAAU,IAChC,sBAAsB,iBAAiB;AAAA,IAC7C;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,wBAAwB;AAAA,IAC5B,CACE,WACA,YACA,iBACW;AACX,UAAI,CAAC,uBAAuB,YAAY,GAAG;AACzC,eAAO;AAAA,MACT;AAEA,YAAM,eAAe,SAAS,UAAU,EAAE,YAAY;AAEtD,UAAI,aAAa,SAAU,QAAO,eAAe,SAAS,EAAE;AAC5D,UAAI,aAAa,IAAK,QAAO,eAAe,SAAS,EAAE;AACvD,UAAI,aAAa,SAAU,QAAO,eAAe,SAAS,EAAE;AAE5D,aAAO;AAAA,IACT;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,mBAAmB;AAAA,IACvB,MAAM,WAAW,UAAU,QAAQ;AAAA,IACnC,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,oBAAoB;AAAA,IACxB,MAAM,WAAW,UAAU,SAAS;AAAA,IACpC,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,kBAAkB;AAAA,IACtB,MAAM,WAAW,UAAU,OAAO;AAAA,IAClC,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,iBAAiB;AAAA,IACrB,CAAC,gBAAiC,mBAAmB,UAAU,WAAW;AAAA,IAC1E,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,cAAc,QAAQ,MAAM;AAChC,QAAI,UAAU,eAAe,MAAM;AACjC,aAAO,SAAS;AAAA,IAClB;AACA,WAAO,uBAAuB,UAAU,KAAK;AAAA,EAC/C,GAAG,CAAC,UAAU,aAAa,UAAU,KAAK,CAAC;AAE3C,QAAM,kBAAkB;AAAA,IACtB,CAAC,eAA2B,uBAAuB,aAAa,UAAU;AAAA,IAC1E,CAAC,WAAW;AAAA,EACd;AAEA,QAAM,YAAY;AAAA,IAChB,CAAC,SAAuB,QAAY,UAAU,OAAO,IAAI;AAAA,IACzD,CAAC,UAAU,KAAK;AAAA,EAClB;AAEA,QAAM,UAAU;AAAA,IACd,MACE,QAAY,UAAU,0BAAyB,KAC/C,uBAAuB,aAAa,iBAAiB,KACrD,uBAAuB,aAAa,GAAG;AAAA,IACzC,CAAC,UAAU,OAAO,WAAW;AAAA,EAC/B;AAEA,QAAM,eAAe;AAAA,IACnB,MAAM,QAAY,UAAU,sCAA+B;AAAA,IAC3D,CAAC,UAAU,KAAK;AAAA,EAClB;AAEA,QAAM,cAAc;AAAA,IAClB,MACE,QAAY,UAAU,kCAA6B,KACnD,UAAU,cAAc,QACxB,UAAU,cAAc;AAAA,IAC1B,CAAC,UAAU,OAAO,UAAU,SAAS;AAAA,EACvC;AAEA,QAAM,WAAW;AAAA,IACf,MACE,QAAY,UAAU,4BAA0B,KAChD,UAAU,WAAW,QACrB,UAAU,WAAW;AAAA,IACvB,CAAC,UAAU,OAAO,UAAU,MAAM;AAAA,EACpC;AAIA,YAAU,MAAM;AACd,UAAM,WAAW,YAAY;AAC3B,UAAI;AACF,cAAM,WAAW,MAAM,QAAQ,QAAQ,gBAAgB;AACvD,cAAM,kBAAkB,WAAW,KAAK,MAAM,QAAQ,IAAI,IAAI;AAAA,MAChE,SAAS,OAAgB;AACvB,kBAAU,OAAO,EAAE,QAAQ,sBAAsB,CAAC;AAClD,gBAAQ,MAAM,qCAAqC,KAAK;AAAA,MAC1D,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,SAAK,SAAS;AAAA,EAChB,GAAG,CAAC,CAAC;AAEL,QAAM,mBAAmB;AAAA,IACvB,OAAO,WAAyB;AAC9B,UAAI;AACF,YAAI,yBAAyB,MAAM,GAAG;AACpC,cAAI;AACF,kBAAM,SAAS,MAAM,OAAO;AAC5B,kBAAM,UAAU,QAAQ,MAAM,QAAQ;AACtC,gBAAI,SAAS;AACX,oCAAsB,OAAO;AAAA,YAC/B;AAAA,UACF,SAAS,KAAc;AACrB,sBAAU,KAAK,EAAE,QAAQ,SAAS,CAAC;AACnC,oBAAQ,KAAK,oCAAoC,GAAG;AAAA,UACtD;AAAA,QACF;AAAA,MACF,UAAE;AACA,cAAM,YAAY,MAAM;AACxB,oBAAY,IAAI;AAChB,cAAM,QAAQ,WAAW,gBAAgB;AAAA,MAC3C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,uBAAuB;AAAA,IAC3B,MAAM,iBAAiB,QAAQ;AAAA,IAC/B,CAAC,gBAAgB;AAAA,EACnB;AAEA,QAAM,sBAAsB,YAAY,YAAY;AAClD,UAAM,aAAa,YAAY;AAC/B,QAAI,CAAC,WAAY;AACjB,UAAM,iBAAiB,SAAS;AAChC,2BAAuB;AAAA,EACzB,GAAG,CAAC,UAAU,kBAAkB,oBAAoB,CAAC;AAErD,YAAU,MAAM;AACd,gBAAY,UAAU,MAAM,oBAAoB,CAAC;AACjD,gBAAY,eAAe,MAAM,kBAAkB,CAAC;AAAA,EACtD,GAAG,CAAC,aAAa,qBAAqB,iBAAiB,CAAC;AAExD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,WAAW;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,SAAS;AAAA,EACX;AACF;;;AC9QA,SAAgB,eAAe,kBAAkC;AAaxD;AATT,IAAM,cAAc,cAA6C,MAAS;AAKnE,IAAM,eAGR,CAAC,EAAE,UAAU,MAAM,MAAM;AAC5B,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;AAEO,IAAM,cAAc,MAAyB;AAClD,QAAM,UAAU,WAAW,WAAW;AACtC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-GHW3ZGBY.mjs → chunk-VPANTTZI.mjs}

@@ -61,9 +61,6 @@ var WILDCARD_PERMISSION = "*";
 // src/auth/permissions/rolePermissions.ts
 var ADMIN_PERMISSIONS = [
   "dashboard.admin",
-  "users.read",
-  "users.update",
-  "users.delete",
   "events.read",
   "events.create",
   "events.update",
@@ -91,9 +88,7 @@ var ADMIN_PERMISSIONS = [
   "posts.read",
   "posts.create",
   "posts.update",
-  "posts.delete",
-  "settings.read",
-  "settings.update"
+  "posts.delete"
 ];
 var ROLE_PERMISSIONS = {
   ["super_admin" /* SUPER_ADMIN */]: ["*"],
@@ -153,6 +148,98 @@ function hasAnyRole(roles, checkRoles) {
   return checkRoles.some((r) => set.has(r));
 }
 
+// src/auth/permissions/adminAppAccess.ts
+var ADMIN_APP_ROLES = [
+  "super_admin" /* SUPER_ADMIN */,
+  "admin" /* ADMIN */,
+  "event" /* EVENT */,
+  "vendor" /* VENDOR */,
+  "partner" /* PARTNER */,
+  "school" /* SCHOOL */,
+  "affiliate" /* AFFILIATE */
+];
+var ADMIN_DASHBOARD_CONTEXTS = [
+  {
+    context: "staff",
+    home: "/dashboard",
+    label: "Staff",
+    pathPrefixes: ["/dashboard"],
+    roles: ["super_admin" /* SUPER_ADMIN */, "admin" /* ADMIN */]
+  },
+  {
+    context: "event",
+    home: "/event/dashboard",
+    label: "Events",
+    pathPrefixes: ["/event"],
+    roles: ["event" /* EVENT */]
+  },
+  {
+    context: "vendor",
+    home: "/vendor/dashboard",
+    label: "Stallholders",
+    pathPrefixes: ["/vendor"],
+    roles: ["vendor" /* VENDOR */]
+  },
+  {
+    context: "partner",
+    home: "/partner/dashboard",
+    label: "Partners",
+    pathPrefixes: ["/partner"],
+    roles: ["partner" /* PARTNER */]
+  },
+  {
+    context: "school",
+    home: "/school/dashboard",
+    label: "Schools",
+    pathPrefixes: ["/school"],
+    roles: ["school" /* SCHOOL */]
+  },
+  {
+    context: "affiliate",
+    home: "/affiliate/dashboard",
+    label: "Affiliate",
+    pathPrefixes: ["/affiliate"],
+    roles: ["affiliate" /* AFFILIATE */]
+  }
+];
+function canAccessAdminApp(roles) {
+  return hasAnyRole(roles, ADMIN_APP_ROLES);
+}
+function getUsableAdminContexts(roles) {
+  return ADMIN_DASHBOARD_CONTEXTS.filter((ctx) => hasAnyRole(roles, ctx.roles));
+}
+function getDefaultAdminHome(roles, preferredContext) {
+  const usable = getUsableAdminContexts(roles);
+  if (usable.length === 0) {
+    return "/login";
+  }
+  if (preferredContext) {
+    const preferred = usable.find((ctx) => ctx.context === preferredContext);
+    if (preferred) return preferred.home;
+  }
+  return usable[0].home;
+}
+function resolveAdminContextFromPath(pathname) {
+  for (const ctx of ADMIN_DASHBOARD_CONTEXTS) {
+    if (ctx.pathPrefixes.some(
+      (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`)
+    )) {
+      return ctx.context;
+    }
+  }
+  return null;
+}
+function canAccessAdminPath(roles, pathname) {
+  if (!canAccessAdminApp(roles)) return false;
+  const context = resolveAdminContextFromPath(pathname);
+  if (!context) {
+    return true;
+  }
+  const info = ADMIN_DASHBOARD_CONTEXTS.find((ctx) => ctx.context === context);
+  if (!info) return false;
+  return hasAnyRole(roles, info.roles);
+}
+
 export {
   PERMISSIONS,
   WILDCARD_PERMISSION,
@@ -163,6 +250,13 @@ export {
   hasAnyPermission,
   hasAllPermissions,
   hasRole,
-  hasAnyRole
+  hasAnyRole,
+  ADMIN_APP_ROLES,
+  ADMIN_DASHBOARD_CONTEXTS,
+  canAccessAdminApp,
+  getUsableAdminContexts,
+  getDefaultAdminHome,
+  resolveAdminContextFromPath,
+  canAccessAdminPath
 };
-//# sourceMappingURL=chunk-GHW3ZGBY.mjs.map
+//# sourceMappingURL=chunk-VPANTTZI.mjs.map

package/dist/chunk-VPANTTZI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/permissions/permissions.ts","../src/auth/permissions/rolePermissions.ts","../src/auth/permissions/helpers.ts","../src/auth/permissions/adminAppAccess.ts"],"sourcesContent":["/**\n * Canonical permission IDs. Add new permissions here first, then map them in\n * ROLE_PERMISSIONS. Prefer resource.action names (e.g. users.read).\n */\nexport const PERMISSIONS = [\n  \"*\",\n  // Dashboards\n  \"dashboard.admin\",\n  \"dashboard.affiliate\",\n  \"dashboard.customer\",\n  \"dashboard.event\",\n  \"dashboard.partner\",\n  \"dashboard.school\",\n  \"dashboard.vendor\",\n  // Admin: users\n  \"users.delete\",\n  \"users.read\",\n  \"users.update\",\n  // Admin: events\n  \"events.create\",\n  \"events.delete\",\n  \"events.read\",\n  \"events.update\",\n  // Admin: vendors\n  \"vendors.create\",\n  \"vendors.delete\",\n  \"vendors.read\",\n  \"vendors.update\",\n  // Admin: partners\n  \"partners.create\",\n  \"partners.delete\",\n  \"partners.read\",\n  \"partners.update\",\n  // Admin: schools\n  \"schools.create\",\n  \"schools.delete\",\n  \"schools.read\",\n  \"schools.update\",\n  // Admin: affiliates\n  \"affiliates.create\",\n  \"affiliates.delete\",\n  \"affiliates.read\",\n  \"affiliates.update\",\n  // Admin: ads / posts / settings\n  \"ads.create\",\n  \"ads.delete\",\n  \"ads.read\",\n  \"ads.update\",\n  \"posts.create\",\n  \"posts.delete\",\n  \"posts.read\",\n  \"posts.update\",\n  \"settings.read\",\n  \"settings.update\",\n  // Product: own-resource management\n  \"affiliates.manage_own\",\n  \"events.manage_own\",\n  \"partners.manage_own\",\n  \"schools.manage_own\",\n  \"vendors.manage_own\",\n] as const;\n\nexport type Permission = (typeof PERMISSIONS)[number];\n\nexport const WILDCARD_PERMISSION: Permission = \"*\";\n","import { EnumUserRole } from \"../../enums\";\n\nimport type { Permission } from \"./permissions\";\n\nconst ADMIN_PERMISSIONS: readonly Permission[] = [\n  \"dashboard.admin\",\n  \"events.read\",\n  \"events.create\",\n  \"events.update\",\n  \"events.delete\",\n  \"vendors.read\",\n  \"vendors.create\",\n  \"vendors.update\",\n  \"vendors.delete\",\n  \"partners.read\",\n  \"partners.create\",\n  \"partners.update\",\n  \"partners.delete\",\n  \"schools.read\",\n  \"schools.create\",\n  \"schools.update\",\n  \"schools.delete\",\n  \"affiliates.read\",\n  \"affiliates.create\",\n  \"affiliates.update\",\n  \"affiliates.delete\",\n  \"ads.read\",\n  \"ads.create\",\n  \"ads.update\",\n  \"ads.delete\",\n  \"posts.read\",\n  \"posts.create\",\n  \"posts.update\",\n  \"posts.delete\",\n];\n\n/**\n * Static role → permissions map. Source of truth for access.\n * Permissions for a user = union of all their roles' lists.\n */\nexport const ROLE_PERMISSIONS: Record<EnumUserRole, readonly Permission[]> = {\n  [EnumUserRole.SUPER_ADMIN]: [\"*\"],\n  [EnumUserRole.ADMIN]: ADMIN_PERMISSIONS,\n  [EnumUserRole.CUSTOMER]: [\"dashboard.customer\"],\n  [EnumUserRole.EVENT]: [\"dashboard.event\", \"events.manage_own\"],\n  [EnumUserRole.VENDOR]: [\"dashboard.vendor\", \"vendors.manage_own\"],\n  [EnumUserRole.PARTNER]: [\"dashboard.partner\", \"partners.manage_own\"],\n  [EnumUserRole.SCHOOL]: [\"dashboard.school\", \"schools.manage_own\"],\n  [EnumUserRole.AFFILIATE]: [\"dashboard.affiliate\", \"affiliates.manage_own\"],\n};\n","import { EnumUserRole } from \"../../enums\";\n\nimport type { Permission } from \"./permissions\";\nimport { WILDCARD_PERMISSION } from \"./permissions\";\nimport { ROLE_PERMISSIONS } from \"./rolePermissions\";\n\nfunction normalizeRoles(\n  roles: EnumUserRole[] | null | undefined,\n): EnumUserRole[] {\n  if (!roles?.length) return [];\n  return roles;\n}\n\n/**\n * Union of permissions for the given roles (deduped, stable order).\n */\nexport function getPermissionsForRoles(\n  roles: EnumUserRole[] | null | undefined,\n): Permission[] {\n  const seen = new Set<Permission>();\n  const result: Permission[] = [];\n\n  for (const role of normalizeRoles(roles)) {\n    const perms = ROLE_PERMISSIONS[role] ?? [];\n    for (const perm of perms) {\n      if (!seen.has(perm)) {\n        seen.add(perm);\n        result.push(perm);\n      }\n    }\n  }\n\n  return result;\n}\n\n/**\n * Check a concrete permission list (e.g. authUser.permissions) for a grant.\n * Honours the \"*\" wildcard.\n */\nexport function permissionListIncludes(\n  permissions: readonly Permission[] | null | undefined,\n  permission: Permission,\n): boolean {\n  if (!permissions?.length) return false;\n  const set = new Set(permissions);\n  if (set.has(WILDCARD_PERMISSION)) return true;\n  return set.has(permission);\n}\n\nexport function hasPermission(\n  roles: EnumUserRole[] | null | undefined,\n  permission: Permission,\n): boolean {\n  return permissionListIncludes(getPermissionsForRoles(roles), permission);\n}\n\nexport function hasAnyPermission(\n  roles: EnumUserRole[] | null | undefined,\n  permissions: readonly Permission[],\n): boolean {\n  if (permissions.length === 0) return false;\n  const granted = getPermissionsForRoles(roles);\n  return permissions.some((p) => permissionListIncludes(granted, p));\n}\n\nexport function hasAllPermissions(\n  roles: EnumUserRole[] | null | undefined,\n  permissions: readonly Permission[],\n): boolean {\n  if (permissions.length === 0) return true;\n  const granted = getPermissionsForRoles(roles);\n  return permissions.every((p) => permissionListIncludes(granted, p));\n}\n\nexport function hasRole(\n  roles: EnumUserRole[] | null | undefined,\n  role: EnumUserRole,\n): boolean {\n  return normalizeRoles(roles).includes(role);\n}\n\nexport function hasAnyRole(\n  roles: EnumUserRole[] | null | undefined,\n  checkRoles: readonly EnumUserRole[],\n): boolean {\n  if (checkRoles.length === 0) return false;\n  const set = new Set(normalizeRoles(roles));\n  return checkRoles.some((r) => set.has(r));\n}\n","import { EnumUserRole } from \"../../enums\";\n\nimport { hasAnyRole } from \"./helpers\";\n\n/** Roles allowed to sign into the admin web app (CUSTOMER-only is denied). */\nexport const ADMIN_APP_ROLES = [\n  EnumUserRole.SUPER_ADMIN,\n  EnumUserRole.ADMIN,\n  EnumUserRole.EVENT,\n  EnumUserRole.VENDOR,\n  EnumUserRole.PARTNER,\n  EnumUserRole.SCHOOL,\n  EnumUserRole.AFFILIATE,\n] as const;\n\nexport type AdminAppRole = (typeof ADMIN_APP_ROLES)[number];\n\nexport type AdminDashboardContext =\n  | \"staff\"\n  | \"event\"\n  | \"vendor\"\n  | \"partner\"\n  | \"school\"\n  | \"affiliate\";\n\nexport type AdminDashboardContextInfo = {\n  context: AdminDashboardContext;\n  home: string;\n  label: string;\n  /** Path prefixes that belong to this context (including home). */\n  pathPrefixes: readonly string[];\n  roles: readonly EnumUserRole[];\n};\n\n/**\n * Priority order for default home + role switcher.\n * Staff first, then product roles.\n */\nexport const ADMIN_DASHBOARD_CONTEXTS: readonly AdminDashboardContextInfo[] = [\n  {\n    context: \"staff\",\n    home: \"/dashboard\",\n    label: \"Staff\",\n    pathPrefixes: [\"/dashboard\"],\n    roles: [EnumUserRole.SUPER_ADMIN, EnumUserRole.ADMIN],\n  },\n  {\n    context: \"event\",\n    home: \"/event/dashboard\",\n    label: \"Events\",\n    pathPrefixes: [\"/event\"],\n    roles: [EnumUserRole.EVENT],\n  },\n  {\n    context: \"vendor\",\n    home: \"/vendor/dashboard\",\n    label: \"Stallholders\",\n    pathPrefixes: [\"/vendor\"],\n    roles: [EnumUserRole.VENDOR],\n  },\n  {\n    context: \"partner\",\n    home: \"/partner/dashboard\",\n    label: \"Partners\",\n    pathPrefixes: [\"/partner\"],\n    roles: [EnumUserRole.PARTNER],\n  },\n  {\n    context: \"school\",\n    home: \"/school/dashboard\",\n    label: \"Schools\",\n    pathPrefixes: [\"/school\"],\n    roles: [EnumUserRole.SCHOOL],\n  },\n  {\n    context: \"affiliate\",\n    home: \"/affiliate/dashboard\",\n    label: \"Affiliate\",\n    pathPrefixes: [\"/affiliate\"],\n    roles: [EnumUserRole.AFFILIATE],\n  },\n] as const;\n\nexport function canAccessAdminApp(\n  roles: EnumUserRole[] | null | undefined,\n): boolean {\n  return hasAnyRole(roles, ADMIN_APP_ROLES);\n}\n\nexport function getUsableAdminContexts(\n  roles: EnumUserRole[] | null | undefined,\n): AdminDashboardContextInfo[] {\n  return ADMIN_DASHBOARD_CONTEXTS.filter((ctx) => hasAnyRole(roles, ctx.roles));\n}\n\nexport function getDefaultAdminHome(\n  roles: EnumUserRole[] | null | undefined,\n  preferredContext?: AdminDashboardContext | null,\n): string {\n  const usable = getUsableAdminContexts(roles);\n  if (usable.length === 0) {\n    return \"/login\";\n  }\n\n  if (preferredContext) {\n    const preferred = usable.find((ctx) => ctx.context === preferredContext);\n    if (preferred) return preferred.home;\n  }\n\n  return usable[0].home;\n}\n\nexport function resolveAdminContextFromPath(\n  pathname: string,\n): AdminDashboardContext | null {\n  for (const ctx of ADMIN_DASHBOARD_CONTEXTS) {\n    if (\n      ctx.pathPrefixes.some(\n        (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),\n      )\n    ) {\n      return ctx.context;\n    }\n  }\n  return null;\n}\n\nexport function canAccessAdminPath(\n  roles: EnumUserRole[] | null | undefined,\n  pathname: string,\n): boolean {\n  if (!canAccessAdminApp(roles)) return false;\n\n  const context = resolveAdminContextFromPath(pathname);\n  if (!context) {\n    // Authenticated admin-app users may hit non-dashboard admin routes later;\n    // unknown paths are allowed only if they have any admin-app role.\n    return true;\n  }\n\n  const info = ADMIN_DASHBOARD_CONTEXTS.find((ctx) => ctx.context === context);\n  if (!info) return false;\n  return hasAnyRole(roles, info.roles);\n}\n"],"mappings":";AAIO,IAAM,cAAc;AAAA,EACzB;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,sBAAkC;;;AC5D/C,IAAM,oBAA2C;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,mBAAgE;AAAA,EAC3E,gCAAyB,GAAG,CAAC,GAAG;AAAA,EAChC,oBAAmB,GAAG;AAAA,EACtB,0BAAsB,GAAG,CAAC,oBAAoB;AAAA,EAC9C,oBAAmB,GAAG,CAAC,mBAAmB,mBAAmB;AAAA,EAC7D,sBAAoB,GAAG,CAAC,oBAAoB,oBAAoB;AAAA,EAChE,wBAAqB,GAAG,CAAC,qBAAqB,qBAAqB;AAAA,EACnE,sBAAoB,GAAG,CAAC,oBAAoB,oBAAoB;AAAA,EAChE,4BAAuB,GAAG,CAAC,uBAAuB,uBAAuB;AAC3E;;;AC3CA,SAAS,eACP,OACgB;AAChB,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAC5B,SAAO;AACT;AAKO,SAAS,uBACd,OACc;AACd,QAAM,OAAO,oBAAI,IAAgB;AACjC,QAAM,SAAuB,CAAC;AAE9B,aAAW,QAAQ,eAAe,KAAK,GAAG;AACxC,UAAM,QAAQ,iBAAiB,IAAI,KAAK,CAAC;AACzC,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,KAAK,IAAI,IAAI,GAAG;AACnB,aAAK,IAAI,IAAI;AACb,eAAO,KAAK,IAAI;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMO,SAAS,uBACd,aACA,YACS;AACT,MAAI,CAAC,aAAa,OAAQ,QAAO;AACjC,QAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,MAAI,IAAI,IAAI,mBAAmB,EAAG,QAAO;AACzC,SAAO,IAAI,IAAI,UAAU;AAC3B;AAEO,SAAS,cACd,OACA,YACS;AACT,SAAO,uBAAuB,uBAAuB,KAAK,GAAG,UAAU;AACzE;AAEO,SAAS,iBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,UAAU,uBAAuB,KAAK;AAC5C,SAAO,YAAY,KAAK,CAAC,MAAM,uBAAuB,SAAS,CAAC,CAAC;AACnE;AAEO,SAAS,kBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,UAAU,uBAAuB,KAAK;AAC5C,SAAO,YAAY,MAAM,CAAC,MAAM,uBAAuB,SAAS,CAAC,CAAC;AACpE;AAEO,SAAS,QACd,OACA,MACS;AACT,SAAO,eAAe,KAAK,EAAE,SAAS,IAAI;AAC5C;AAEO,SAAS,WACd,OACA,YACS;AACT,MAAI,WAAW,WAAW,EAAG,QAAO;AACpC,QAAM,MAAM,IAAI,IAAI,eAAe,KAAK,CAAC;AACzC,SAAO,WAAW,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;AAC1C;;;ACnFO,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQ/B;AAyBO,IAAM,2BAAiE;AAAA,EAC5E;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,OAAO;AAAA,IACP,cAAc,CAAC,YAAY;AAAA,IAC3B,OAAO,qDAA6C;AAAA,EACtD;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,OAAO;AAAA,IACP,cAAc,CAAC,QAAQ;AAAA,IACvB,OAAO,oBAAmB;AAAA,EAC5B;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,OAAO;AAAA,IACP,cAAc,CAAC,SAAS;AAAA,IACxB,OAAO,sBAAoB;AAAA,EAC7B;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,OAAO;AAAA,IACP,cAAc,CAAC,UAAU;AAAA,IACzB,OAAO,wBAAqB;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,OAAO;AAAA,IACP,cAAc,CAAC,SAAS;AAAA,IACxB,OAAO,sBAAoB;AAAA,EAC7B;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,OAAO;AAAA,IACP,cAAc,CAAC,YAAY;AAAA,IAC3B,OAAO,4BAAuB;AAAA,EAChC;AACF;AAEO,SAAS,kBACd,OACS;AACT,SAAO,WAAW,OAAO,eAAe;AAC1C;AAEO,SAAS,uBACd,OAC6B;AAC7B,SAAO,yBAAyB,OAAO,CAAC,QAAQ,WAAW,OAAO,IAAI,KAAK,CAAC;AAC9E;AAEO,SAAS,oBACd,OACA,kBACQ;AACR,QAAM,SAAS,uBAAuB,KAAK;AAC3C,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO;AAAA,EACT;AAEA,MAAI,kBAAkB;AACpB,UAAM,YAAY,OAAO,KAAK,CAAC,QAAQ,IAAI,YAAY,gBAAgB;AACvE,QAAI,UAAW,QAAO,UAAU;AAAA,EAClC;AAEA,SAAO,OAAO,CAAC,EAAE;AACnB;AAEO,SAAS,4BACd,UAC8B;AAC9B,aAAW,OAAO,0BAA0B;AAC1C,QACE,IAAI,aAAa;AAAA,MACf,CAAC,WAAW,aAAa,UAAU,SAAS,WAAW,GAAG,MAAM,GAAG;AAAA,IACrE,GACA;AACA,aAAO,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mBACd,OACA,UACS;AACT,MAAI,CAAC,kBAAkB,KAAK,EAAG,QAAO;AAEtC,QAAM,UAAU,4BAA4B,QAAQ;AACpD,MAAI,CAAC,SAAS;AAGZ,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,yBAAyB,KAAK,CAAC,QAAQ,IAAI,YAAY,OAAO;AAC3E,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,WAAW,OAAO,KAAK,KAAK;AACrC;","names":[]}

package/dist/hooks/index.cjs

@@ -5344,9 +5344,6 @@ var SHARE_TYPE_PATH_REGEX = [
 // src/auth/permissions/rolePermissions.ts
 var ADMIN_PERMISSIONS = [
   "dashboard.admin",
-  "users.read",
-  "users.update",
-  "users.delete",
   "events.read",
   "events.create",
   "events.update",
@@ -5374,9 +5371,7 @@ var ADMIN_PERMISSIONS = [
   "posts.read",
   "posts.create",
   "posts.update",
-  "posts.delete",
-  "settings.read",
-  "settings.update"
+  "posts.delete"
 ];
 var ROLE_PERMISSIONS = {
   ["super_admin" /* SUPER_ADMIN */]: ["*"],
@@ -5389,6 +5384,61 @@ var ROLE_PERMISSIONS = {
   ["affiliate" /* AFFILIATE */]: ["dashboard.affiliate", "affiliates.manage_own"]
 };
 
+// src/auth/permissions/adminAppAccess.ts
+var ADMIN_APP_ROLES = [
+  "super_admin" /* SUPER_ADMIN */,
+  "admin" /* ADMIN */,
+  "event" /* EVENT */,
+  "vendor" /* VENDOR */,
+  "partner" /* PARTNER */,
+  "school" /* SCHOOL */,
+  "affiliate" /* AFFILIATE */
+];
+var ADMIN_DASHBOARD_CONTEXTS = [
+  {
+    context: "staff",
+    home: "/dashboard",
+    label: "Staff",
+    pathPrefixes: ["/dashboard"],
+    roles: ["super_admin" /* SUPER_ADMIN */, "admin" /* ADMIN */]
+  },
+  {
+    context: "event",
+    home: "/event/dashboard",
+    label: "Events",
+    pathPrefixes: ["/event"],
+    roles: ["event" /* EVENT */]
+  },
+  {
+    context: "vendor",
+    home: "/vendor/dashboard",
+    label: "Stallholders",
+    pathPrefixes: ["/vendor"],
+    roles: ["vendor" /* VENDOR */]
+  },
+  {
+    context: "partner",
+    home: "/partner/dashboard",
+    label: "Partners",
+    pathPrefixes: ["/partner"],
+    roles: ["partner" /* PARTNER */]
+  },
+  {
+    context: "school",
+    home: "/school/dashboard",
+    label: "Schools",
+    pathPrefixes: ["/school"],
+    roles: ["school" /* SCHOOL */]
+  },
+  {
+    context: "affiliate",
+    home: "/affiliate/dashboard",
+    label: "Affiliate",
+    pathPrefixes: ["/affiliate"],
+    roles: ["affiliate" /* AFFILIATE */]
+  }
+];
+
 // src/yupSchema/post.ts
 var postContentSchema = yup8.object().shape({
   contentData: yup8.mixed().optional().nullable(),