hazo_auth 4.2.0 → 4.4.0

package/dist/cli/init_users.js

@@ -0,0 +1,307 @@
+// file_description: CLI command to initialize users, roles, and permissions from configuration
+// section: imports
+import { get_hazo_connect_instance } from "../lib/hazo_connect_instance.server.js";
+import { createCrudService } from "hazo_connect/server";
+import { get_user_management_config } from "../lib/user_management_config.server.js";
+import { get_config_value } from "../lib/config/config_loader.server.js";
+import { create_app_logger } from "../lib/app_logger.js";
+// section: helpers
+/**
+ * Prints a summary of what was inserted vs what already existed
+ */
+function print_summary(summary) {
+    console.log("=".repeat(60));
+    console.log("INITIALIZATION SUMMARY");
+    console.log("=".repeat(60));
+    console.log();
+    // Permissions summary
+    console.log("Permissions:");
+    if (summary.permissions.inserted.length > 0) {
+        console.log(`  ✓ Inserted (${summary.permissions.inserted.length}):`);
+        summary.permissions.inserted.forEach((name) => console.log(`    - ${name}`));
+    }
+    if (summary.permissions.existing.length > 0) {
+        console.log(`  ⊙ Already existed (${summary.permissions.existing.length}):`);
+        summary.permissions.existing.forEach((name) => console.log(`    - ${name}`));
+    }
+    console.log();
+    // Role summary
+    console.log("Role:");
+    if (summary.role.inserted) {
+        console.log(`  ✓ Inserted: default_super_user_role (ID: ${summary.role.role_id})`);
+    }
+    if (summary.role.existing) {
+        console.log(`  ⊙ Already existed: default_super_user_role (ID: ${summary.role.role_id})`);
+    }
+    console.log();
+    // Role permissions summary
+    console.log("Role-Permission Assignments:");
+    if (summary.role_permissions.inserted > 0) {
+        console.log(`  ✓ Inserted: ${summary.role_permissions.inserted} assignment(s)`);
+    }
+    if (summary.role_permissions.existing > 0) {
+        console.log(`  ⊙ Already existed: ${summary.role_permissions.existing} assignment(s)`);
+    }
+    console.log();
+    // User role summary
+    console.log("User-Role Assignment:");
+    if (summary.user_role.inserted) {
+        console.log(`  ✓ Inserted: Super user role assigned to user`);
+    }
+    if (summary.user_role.existing) {
+        console.log(`  ⊙ Already existed: User already has super user role`);
+    }
+    console.log();
+    console.log("=".repeat(60));
+}
+// section: main_function
+/**
+ * Initializes users, roles, and permissions from configuration
+ * This function reads from hazo_auth_config.ini and sets up:
+ * 1. Permissions from [hazo_auth__user_management] application_permission_list_defaults
+ * 2. A default_super_user_role with all permissions
+ * 3. Assigns the role to user from --email parameter or [hazo_auth__initial_setup] default_super_user_email
+ */
+export async function handle_init_users(options = {}) {
+    var _a;
+    const logger = create_app_logger();
+    const summary = {
+        permissions: {
+            inserted: [],
+            existing: [],
+        },
+        role: {
+            inserted: false,
+            existing: false,
+            role_id: null,
+        },
+        role_permissions: {
+            inserted: 0,
+            existing: 0,
+        },
+        user_role: {
+            inserted: false,
+            existing: false,
+        },
+    };
+    try {
+        console.log("\n🐸 hazo_auth init-users\n");
+        console.log("Initializing users, roles, and permissions from configuration...\n");
+        // Get hazo_connect instance
+        const hazoConnect = get_hazo_connect_instance();
+        const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+        const roles_service = createCrudService(hazoConnect, "hazo_roles");
+        const role_permissions_service = createCrudService(hazoConnect, "hazo_role_permissions");
+        const users_service = createCrudService(hazoConnect, "hazo_users");
+        const user_roles_service = createCrudService(hazoConnect, "hazo_user_roles");
+        // 1. Get permissions from config
+        const config = get_user_management_config();
+        const permission_names = config.application_permission_list_defaults || [];
+        if (permission_names.length === 0) {
+            console.log("⚠ No permissions found in configuration.");
+            console.log("  Add permissions to [hazo_auth__user_management] application_permission_list_defaults\n");
+            return;
+        }
+        console.log(`Found ${permission_names.length} permission(s) in configuration:`);
+        permission_names.forEach((name) => console.log(`  - ${name}`));
+        console.log();
+        // 2. Add permissions to hazo_permissions table
+        const permission_id_map = {};
+        const now = new Date().toISOString();
+        for (const permission_name of permission_names) {
+            const trimmed_name = permission_name.trim();
+            if (!trimmed_name)
+                continue;
+            // Check if permission already exists
+            const existing_permissions = await permissions_service.findBy({
+                permission_name: trimmed_name,
+            });
+            if (Array.isArray(existing_permissions) && existing_permissions.length > 0) {
+                const existing_permission = existing_permissions[0];
+                const perm_id = existing_permission.id;
+                permission_id_map[trimmed_name] = perm_id;
+                summary.permissions.existing.push(trimmed_name);
+                console.log(`✓ Permission already exists: ${trimmed_name} (ID: ${perm_id})`);
+            }
+            else {
+                // Insert new permission
+                const new_permission = await permissions_service.insert({
+                    permission_name: trimmed_name,
+                    description: `Permission for ${trimmed_name}`,
+                    created_at: now,
+                    changed_at: now,
+                });
+                const perm_id = Array.isArray(new_permission)
+                    ? new_permission[0].id
+                    : new_permission.id;
+                permission_id_map[trimmed_name] = perm_id;
+                summary.permissions.inserted.push(trimmed_name);
+                console.log(`✓ Inserted permission: ${trimmed_name} (ID: ${perm_id})`);
+            }
+        }
+        console.log();
+        // 3. Create or get default_super_user_role
+        const role_name = "default_super_user_role";
+        const existing_roles = await roles_service.findBy({
+            role_name,
+        });
+        let role_id;
+        if (Array.isArray(existing_roles) && existing_roles.length > 0) {
+            role_id = existing_roles[0].id;
+            summary.role.existing = true;
+            summary.role.role_id = role_id;
+            console.log(`✓ Role already exists: ${role_name} (ID: ${role_id})`);
+        }
+        else {
+            const new_role = await roles_service.insert({
+                role_name,
+                created_at: now,
+                changed_at: now,
+            });
+            role_id = Array.isArray(new_role)
+                ? new_role[0].id
+                : new_role.id;
+            summary.role.inserted = true;
+            summary.role.role_id = role_id;
+            console.log(`✓ Created role: ${role_name} (ID: ${role_id})`);
+        }
+        console.log();
+        // 4. Assign all permissions to the role
+        const permission_ids = Object.values(permission_id_map);
+        for (const permission_id of permission_ids) {
+            // Check if role-permission assignment already exists
+            const existing_assignments = await role_permissions_service.findBy({
+                role_id,
+                permission_id,
+            });
+            if (Array.isArray(existing_assignments) && existing_assignments.length > 0) {
+                summary.role_permissions.existing++;
+                const perm_name = Object.keys(permission_id_map).find((key) => permission_id_map[key] === permission_id);
+                console.log(`✓ Role-permission already exists: ${role_name} -> ${perm_name}`);
+            }
+            else {
+                await role_permissions_service.insert({
+                    role_id,
+                    permission_id,
+                    created_at: now,
+                    changed_at: now,
+                });
+                summary.role_permissions.inserted++;
+                const perm_name = Object.keys(permission_id_map).find((key) => permission_id_map[key] === permission_id);
+                console.log(`✓ Assigned permission to role: ${role_name} -> ${perm_name}`);
+            }
+        }
+        console.log();
+        // 5. Get super user email from options or config
+        const super_user_email = ((_a = options.email) === null || _a === void 0 ? void 0 : _a.trim()) || get_config_value("hazo_auth__initial_setup", "default_super_user_email", "").trim();
+        if (!super_user_email) {
+            console.log("⚠ No super user email provided.");
+            console.log("  Either use --email=user@example.com parameter");
+            console.log("  Or add [hazo_auth__initial_setup] default_super_user_email to config\n");
+            print_summary(summary);
+            return;
+        }
+        if (options.email) {
+            console.log(`Using email from --email parameter: ${super_user_email}`);
+        }
+        else {
+            console.log(`Using email from config: ${super_user_email}`);
+        }
+        console.log(`Looking up user with email: ${super_user_email}`);
+        // 6. Find user by email
+        const users = await users_service.findBy({
+            email_address: super_user_email,
+        });
+        if (!Array.isArray(users) || users.length === 0) {
+            console.log(`✗ User not found with email: ${super_user_email}`);
+            console.log("  Please ensure the user exists in the database before running this script.\n");
+            print_summary(summary);
+            return;
+        }
+        const user = users[0];
+        const user_id = user.id;
+        console.log(`✓ Found user: ${super_user_email} (ID: ${user_id})`);
+        console.log();
+        // 7. Assign role to user
+        const existing_user_roles = await user_roles_service.findBy({
+            user_id,
+            role_id,
+        });
+        if (Array.isArray(existing_user_roles) && existing_user_roles.length > 0) {
+            summary.user_role.existing = true;
+            console.log(`✓ User already has role assigned: ${user_id} -> ${role_name}`);
+        }
+        else {
+            await user_roles_service.insert({
+                user_id,
+                role_id,
+                created_at: now,
+                changed_at: now,
+            });
+            summary.user_role.inserted = true;
+            console.log(`✓ Assigned role to user: ${user_id} -> ${role_name}`);
+        }
+        console.log();
+        // 8. Print summary
+        print_summary(summary);
+        logger.info("init_users_completed", {
+            filename: "init_users.ts",
+            line_number: 0,
+            summary,
+        });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        console.error("\n✗ Error initializing users:");
+        console.error(`  ${error_message}`);
+        if (error_stack) {
+            console.error("\nStack trace:");
+            console.error(error_stack);
+        }
+        logger.error("init_users_failed", {
+            filename: "init_users.ts",
+            line_number: 0,
+            error_message,
+            error_stack,
+        });
+        process.exit(1);
+    }
+}
+// section: help
+/**
+ * Shows help for the init-users command
+ */
+export function show_init_users_help() {
+    console.log(`
+hazo_auth init-users
+
+Initialize users, roles, and permissions from configuration.
+
+This command reads from hazo_auth_config.ini and:
+  1. Creates permissions from [hazo_auth__user_management] application_permission_list_defaults
+  2. Creates a 'default_super_user_role' role
+  3. Assigns all permissions to the super user role
+  4. Finds user by email (from --email parameter or config)
+  5. Assigns the super user role to that user
+
+Options:
+  --email=<email>    Email address of the user to assign super user role
+                     (overrides [hazo_auth__initial_setup] default_super_user_email)
+  --help, -h         Show this help message
+
+Configuration required in hazo_auth_config.ini:
+
+  [hazo_auth__user_management]
+  application_permission_list_defaults = admin_user_management,admin_role_management,admin_permission_management
+
+  [hazo_auth__initial_setup]
+  default_super_user_email = admin@example.com   (optional if using --email)
+
+Note: The user must already exist in the database (registered) before running this command.
+
+Usage:
+  npx hazo_auth init-users
+  npx hazo_auth init-users --email=admin@example.com
+`);
+}

package/dist/components/layouts/dev_lock/index.d.ts

@@ -0,0 +1,29 @@
+export type DevLockLayoutProps = {
+    /** Background color (default: #000000 - black) */
+    background_color?: string;
+    /** Logo image path (default: /logo.png) */
+    logo_path?: string;
+    /** Logo width in pixels (default: 120) */
+    logo_width?: number;
+    /** Logo height in pixels (default: 120) */
+    logo_height?: number;
+    /** Application name displayed below logo */
+    application_name?: string;
+    /** Limited access text displayed with lock icon (default: "Limited Access") */
+    limited_access_text?: string;
+    /** Password input placeholder (default: "Enter access password") */
+    password_placeholder?: string;
+    /** Submit button text (default: "Unlock") */
+    submit_button_text?: string;
+    /** Error message for incorrect password (default: "Incorrect password") */
+    error_message?: string;
+    /** Text color for labels (default: #ffffff - white) */
+    text_color?: string;
+    /** Accent color for button (default: #3b82f6 - blue) */
+    accent_color?: string;
+    /** Callback when unlock is successful */
+    onUnlock?: () => void;
+};
+export default function DevLockLayout({ background_color, logo_path, logo_width, logo_height, application_name, limited_access_text, password_placeholder, submit_button_text, error_message, text_color, accent_color, onUnlock, }: DevLockLayoutProps): import("react/jsx-runtime").JSX.Element;
+export { DevLockLayout };
+//# sourceMappingURL=index.d.ts.map

package/dist/components/layouts/dev_lock/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/layouts/dev_lock/index.tsx"],"names":[],"mappings":"AAaA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACvB,CAAC;AAGF,MAAM,CAAC,OAAO,UAAU,aAAa,CAAC,EACpC,gBAA4B,EAC5B,SAAuB,EACvB,UAAgB,EAChB,WAAiB,EACjB,gBAAqB,EACrB,mBAAsC,EACtC,oBAA8C,EAC9C,kBAA6B,EAC7B,aAAoC,EACpC,UAAsB,EACtB,YAAwB,EACxB,QAAQ,GACT,EAAE,kBAAkB,2CA4IpB;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/components/layouts/dev_lock/index.js

@@ -0,0 +1,60 @@
+// file_description: Development lock screen layout component
+// A simple centered layout for entering the dev lock password
+// section: client_directive
+"use client";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+// section: imports
+import { useState, useCallback } from "react";
+import Image from "next/image";
+import { Input } from "../../ui/input";
+import { Button } from "../../ui/button";
+import { Lock, AlertCircle, Loader2 } from "lucide-react";
+// section: component
+export default function DevLockLayout({ background_color = "#000000", logo_path = "/logo.png", logo_width = 120, logo_height = 120, application_name = "", limited_access_text = "Limited Access", password_placeholder = "Enter access password", submit_button_text = "Unlock", error_message = "Incorrect password", text_color = "#ffffff", accent_color = "#3b82f6", onUnlock, }) {
+    const [password, setPassword] = useState("");
+    const [error, setError] = useState(null);
+    const [isLoading, setIsLoading] = useState(false);
+    const handleSubmit = useCallback(async (e) => {
+        e.preventDefault();
+        setError(null);
+        setIsLoading(true);
+        try {
+            const response = await fetch("/api/hazo_auth/dev_lock", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ password }),
+            });
+            if (response.ok) {
+                // Success - redirect to home or call onUnlock
+                if (onUnlock) {
+                    onUnlock();
+                }
+                else {
+                    window.location.href = "/";
+                }
+            }
+            else {
+                setError(error_message);
+                setPassword("");
+            }
+        }
+        catch (_a) {
+            setError("An error occurred. Please try again.");
+        }
+        finally {
+            setIsLoading(false);
+        }
+    }, [password, error_message, onUnlock]);
+    const handlePasswordChange = useCallback((e) => {
+        setPassword(e.target.value);
+        // Clear error when user starts typing
+        if (error) {
+            setError(null);
+        }
+    }, [error]);
+    return (_jsx("div", { className: "cls_dev_lock_layout min-h-screen flex flex-col items-center justify-center p-4", style: { backgroundColor: background_color }, children: _jsxs("div", { className: "cls_dev_lock_container flex flex-col items-center gap-6 max-w-sm w-full", children: [_jsx("div", { className: "cls_dev_lock_logo", children: _jsx(Image, { src: logo_path, alt: "Application logo", width: logo_width, height: logo_height, className: "object-contain", priority: true }) }), application_name && (_jsx("h1", { className: "cls_dev_lock_app_name text-2xl font-bold text-center", style: { color: text_color }, children: application_name })), _jsxs("div", { className: "cls_dev_lock_header flex items-center gap-2", children: [_jsx(Lock, { className: "w-5 h-5", style: { color: text_color } }), _jsx("span", { className: "cls_dev_lock_text text-sm font-medium uppercase tracking-wider", style: { color: text_color, opacity: 0.8 }, children: limited_access_text })] }), _jsxs("form", { onSubmit: handleSubmit, className: "cls_dev_lock_form flex flex-col gap-4 w-full", children: [_jsx("div", { className: "cls_dev_lock_input_wrapper relative", children: _jsx(Input, { type: "password", value: password, onChange: handlePasswordChange, placeholder: password_placeholder, className: "cls_dev_lock_input h-12 bg-white/10 border-white/20 text-white placeholder:text-white/50 focus:border-white/40 focus:ring-white/20", disabled: isLoading, autoFocus: true, autoComplete: "current-password" }) }), error && (_jsxs("div", { className: "cls_dev_lock_error flex items-center gap-2 text-sm", style: { color: "#ef4444" }, children: [_jsx(AlertCircle, { className: "w-4 h-4 flex-shrink-0" }), _jsx("span", { children: error })] })), _jsx(Button, { type: "submit", className: "cls_dev_lock_button h-12 font-medium transition-colors", style: {
+                                backgroundColor: accent_color,
+                                color: "#ffffff",
+                            }, disabled: isLoading || !password, children: isLoading ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { className: "w-4 h-4 animate-spin mr-2" }), "Verifying..."] })) : (submit_button_text) })] })] }) }));
+}
+export { DevLockLayout };

package/dist/components/layouts/index.d.ts

@@ -12,5 +12,7 @@ export { default as MySettingsLayout } from "./my_settings/index";
 export type { MySettingsLayoutProps } from "./my_settings/index";
 export { UserManagementLayout } from "./user_management/index";
 export type { UserManagementLayoutProps } from "./user_management/index";
+export { default as DevLockLayout } from "./dev_lock/index";
+export type { DevLockLayoutProps } from "./dev_lock/index";
 export * from "./shared/index";
 //# sourceMappingURL=index.d.ts.map

package/dist/components/layouts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/layouts/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACxE,YAAY,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAChF,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGzE,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/layouts/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACxE,YAAY,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAChF,YAAY,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,cAAc,gBAAgB,CAAC"}

package/dist/components/layouts/index.js

@@ -7,5 +7,6 @@ export { default as ResetPasswordLayout } from "./reset_password/index";
 export { default as EmailVerificationLayout } from "./email_verification/index";
 export { default as MySettingsLayout } from "./my_settings/index";
 export { UserManagementLayout } from "./user_management/index";
+export { default as DevLockLayout } from "./dev_lock/index";
 // section: shared_exports
 export * from "./shared/index";

package/dist/components/layouts/org_management/index.d.ts

@@ -0,0 +1,26 @@
+export type OrgManagementLayoutProps = {
+    className?: string;
+    /** Title displayed at the top */
+    title?: string;
+    /** Description displayed below the title */
+    description?: string;
+    /** Required permission for org management (default: hazo_perm_org_management) */
+    requiredPermission?: string;
+    /** Permission for global admin access (default: hazo_org_global_admin) */
+    globalAdminPermission?: string;
+    /** Message shown when authentication is required */
+    authRequiredMessage?: string;
+    /** Message shown when permission is denied */
+    permissionDeniedMessage?: string;
+    /** Message shown when multi-tenancy is disabled */
+    multiTenancyDisabledMessage?: string;
+};
+/**
+ * Standalone Organization Management layout component
+ * Provides organization hierarchy management with CRUD operations
+ * @param props - Component props
+ * @returns Organization Management layout component
+ */
+export declare function OrgManagementLayout({ className, title, description, requiredPermission, globalAdminPermission, authRequiredMessage, permissionDeniedMessage, multiTenancyDisabledMessage, }: OrgManagementLayoutProps): import("react/jsx-runtime").JSX.Element;
+export default OrgManagementLayout;
+//# sourceMappingURL=index.d.ts.map

package/dist/components/layouts/org_management/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/components/layouts/org_management/index.tsx"],"names":[],"mappings":"AAwBA,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mDAAmD;IACnD,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,CAAC;AAGF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,SAAS,EACT,KAAiC,EACjC,WAAiE,EACjE,kBAA+C,EAC/C,qBAA+C,EAC/C,mBAAwE,EACxE,uBAA4F,EAC5F,2BAAkF,GACnF,EAAE,wBAAwB,2CAuH1B;AAED,eAAe,mBAAmB,CAAC"}

package/dist/components/layouts/org_management/index.js

@@ -0,0 +1,75 @@
+// file_description: Standalone Organization Management layout component for managing multi-tenancy organizations
+// section: client_directive
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// section: imports
+import { useState, useEffect } from "react";
+import { OrgHierarchyTab } from "../user_management/components/org_hierarchy_tab";
+import { useHazoAuthConfig } from "../../../contexts/hazo_auth_provider";
+import { use_hazo_auth } from "../shared/hooks/use_hazo_auth";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle, } from "../../ui/card";
+import { Loader2, AlertCircle, Shield, Building2, } from "lucide-react";
+// section: component
+/**
+ * Standalone Organization Management layout component
+ * Provides organization hierarchy management with CRUD operations
+ * @param props - Component props
+ * @returns Organization Management layout component
+ */
+export function OrgManagementLayout({ className, title = "Organization Management", description = "Manage your organization hierarchy and structure.", requiredPermission = "hazo_perm_org_management", globalAdminPermission = "hazo_org_global_admin", authRequiredMessage = "Please log in to access organization management.", permissionDeniedMessage = "You need organization management permission to access this page.", multiTenancyDisabledMessage = "Multi-tenancy is not enabled in the configuration.", }) {
+    const { apiBasePath } = useHazoAuthConfig();
+    const authResult = use_hazo_auth();
+    const [multiTenancyEnabled, setMultiTenancyEnabled] = useState(null);
+    const [checkingMultiTenancy, setCheckingMultiTenancy] = useState(true);
+    // Check if multi-tenancy is enabled
+    useEffect(() => {
+        const checkMultiTenancy = async () => {
+            try {
+                const response = await fetch(`${apiBasePath}/org_management/orgs?action=list`);
+                const data = await response.json();
+                if (data.code === "MULTI_TENANCY_DISABLED") {
+                    setMultiTenancyEnabled(false);
+                }
+                else {
+                    setMultiTenancyEnabled(true);
+                }
+            }
+            catch (error) {
+                // If we can't check, assume enabled and let the component handle it
+                setMultiTenancyEnabled(true);
+            }
+            finally {
+                setCheckingMultiTenancy(false);
+            }
+        };
+        if (authResult.authenticated && authResult.permissions.includes(requiredPermission)) {
+            void checkMultiTenancy();
+        }
+        else {
+            setCheckingMultiTenancy(false);
+        }
+    }, [apiBasePath, authResult.authenticated, authResult.permissions, requiredPermission]);
+    // Loading state
+    if (authResult.loading || checkingMultiTenancy) {
+        return (_jsx("div", { className: `cls_org_management_layout flex items-center justify-center p-8 ${className || ""}`, children: _jsx(Loader2, { className: "h-6 w-6 animate-spin text-slate-400" }) }));
+    }
+    // Not authenticated
+    if (!authResult.authenticated) {
+        return (_jsxs("div", { className: `cls_org_management_layout flex flex-col items-center justify-center p-8 gap-4 ${className || ""}`, children: [_jsx(AlertCircle, { className: "h-12 w-12 text-red-500" }), _jsx("h1", { className: "text-xl font-semibold", children: "Authentication Required" }), _jsx("p", { className: "text-muted-foreground text-center", children: authRequiredMessage })] }));
+    }
+    // Check required permission
+    const hasOrgManagementPermission = authResult.permissions.includes(requiredPermission);
+    if (!hasOrgManagementPermission) {
+        return (_jsxs("div", { className: `cls_org_management_layout flex flex-col items-center justify-center p-8 gap-4 ${className || ""}`, children: [_jsx(Shield, { className: "h-12 w-12 text-amber-500" }), _jsx("h1", { className: "text-xl font-semibold", children: "Access Denied" }), _jsx("p", { className: "text-muted-foreground text-center", children: permissionDeniedMessage }), _jsxs("p", { className: "text-xs text-muted-foreground", children: ["Required permission: ", _jsx("code", { className: "bg-muted px-1 py-0.5 rounded", children: requiredPermission })] })] }));
+    }
+    // Multi-tenancy disabled
+    if (multiTenancyEnabled === false) {
+        return (_jsxs("div", { className: `cls_org_management_layout flex flex-col items-center justify-center p-8 gap-4 ${className || ""}`, children: [_jsx(Building2, { className: "h-12 w-12 text-amber-500" }), _jsx("h1", { className: "text-xl font-semibold", children: "Multi-Tenancy Disabled" }), _jsx("p", { className: "text-muted-foreground text-center max-w-md", children: multiTenancyDisabledMessage }), _jsxs("p", { className: "text-xs text-muted-foreground text-center", children: ["Enable multi-tenancy by setting", " ", _jsx("code", { className: "bg-muted px-1 py-0.5 rounded", children: "enable_multi_tenancy = true" }), " in the", " ", _jsx("code", { className: "bg-muted px-1 py-0.5 rounded", children: "[hazo_auth__multi_tenancy]" }), " section."] })] }));
+    }
+    // Check global admin permission
+    const isGlobalAdmin = authResult.permissions.includes(globalAdminPermission);
+    return (_jsxs("div", { className: `cls_org_management_layout flex flex-col gap-6 p-4 w-full max-w-5xl mx-auto ${className || ""}`, children: [_jsxs("div", { className: "cls_org_management_header", children: [_jsxs("h1", { className: "text-2xl font-bold flex items-center gap-2", children: [_jsx(Building2, { className: "h-6 w-6" }), title] }), _jsx("p", { className: "text-muted-foreground", children: description })] }), _jsxs(Card, { children: [_jsxs(CardHeader, { children: [_jsx(CardTitle, { className: "text-lg", children: "Organization Hierarchy" }), _jsxs(CardDescription, { children: ["View and manage the organization structure.", isGlobalAdmin
+                                        ? " As a global admin, you can see and manage all organizations."
+                                        : " You can manage organizations within your access scope."] })] }), _jsx(CardContent, { children: _jsx(OrgHierarchyTab, { isGlobalAdmin: isGlobalAdmin }) })] })] }));
+}
+export default OrgManagementLayout;

package/dist/components/layouts/shared/config/layout_customization.d.ts

@@ -1,3 +1,5 @@
+import type { PasswordRequirementOptions } from "../../../../lib/utils/password_validator";
+export type { PasswordRequirementOptions };
 export type LayoutFieldId = string;
 export type LayoutFieldDefinition = {
     id: LayoutFieldId;
@@ -23,13 +25,6 @@ export type ButtonPaletteDefaults = {
     cancelText: string;
 };
 export type ButtonPaletteOverrides = Partial<ButtonPaletteDefaults>;
-export type PasswordRequirementOptions = {
-    minimum_length: number;
-    require_uppercase: boolean;
-    require_lowercase: boolean;
-    require_number: boolean;
-    require_special: boolean;
-};
 export type PasswordRequirementOverrides = Partial<PasswordRequirementOptions>;
 export declare const resolveFieldDefinitions: (baseDefinitions: LayoutFieldMap, overrides?: LayoutFieldMapOverrides) => LayoutFieldMap;
 export declare const resolveLabels: (defaults: LayoutLabelDefaults, overrides?: LayoutLabelOverrides) => LayoutLabelDefaults;

package/dist/components/layouts/shared/config/layout_customization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout_customization.d.ts","sourceRoot":"","sources":["../../../../../src/components/layouts/shared/config/layout_customization.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAErG,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAAG;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpE,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAG/E,eAAO,MAAM,uBAAuB,GAClC,iBAAiB,cAAc,EAC/B,YAAY,uBAAuB,KAClC,cAqBF,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,UAAU,mBAAmB,EAC7B,YAAY,oBAAoB,KAC/B,mBAGD,CAAC;AAEH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,qBAAqB,EAC/B,YAAY,sBAAsB,KACjC,qBAGD,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,UAAU,0BAA0B,EACpC,YAAY,4BAA4B,KACvC,0BAGD,CAAC"}
+{"version":3,"file":"layout_customization.d.ts","sourceRoot":"","sources":["../../../../../src/components/layouts/shared/config/layout_customization.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,YAAY,EAAE,0BAA0B,EAAE,CAAC;AAG3C,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,aAAa,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;AAC1E,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAErG,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAAG;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpE,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAG/E,eAAO,MAAM,uBAAuB,GAClC,iBAAiB,cAAc,EAC/B,YAAY,uBAAuB,KAClC,cAqBF,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,UAAU,mBAAmB,EAC7B,YAAY,oBAAoB,KAC/B,mBAGD,CAAC;AAEH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,qBAAqB,EAC/B,YAAY,sBAAsB,KACjC,qBAGD,CAAC;AAEH,eAAO,MAAM,2BAA2B,GACtC,UAAU,0BAA0B,EACpC,YAAY,4BAA4B,KACvC,0BAGD,CAAC"}

package/dist/components/layouts/user_management/components/org_hierarchy_tab.d.ts

@@ -0,0 +1,13 @@
+export type OrgHierarchyTabProps = {
+    className?: string;
+    /** Whether the user has global admin permission (can see all orgs) */
+    isGlobalAdmin?: boolean;
+};
+/**
+ * Organization Hierarchy tab component for managing multi-tenancy organizations
+ * Displays organizations in a tree view for intuitive hierarchy configuration
+ * @param props - Component props
+ * @returns Organization Hierarchy tab component
+ */
+export declare function OrgHierarchyTab({ className, isGlobalAdmin, }: OrgHierarchyTabProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=org_hierarchy_tab.d.ts.map

package/dist/components/layouts/user_management/components/org_hierarchy_tab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org_hierarchy_tab.d.ts","sourceRoot":"","sources":["../../../../../src/components/layouts/user_management/components/org_hierarchy_tab.tsx"],"names":[],"mappings":"AA6CA,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AA6GF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAC9B,SAAS,EACT,aAAqB,GACtB,EAAE,oBAAoB,2CA0ftB"}