hazo_auth 9.1.1 → 10.0.0

package/cli-src/lib/services/user_scope_service.ts

@@ -8,8 +8,6 @@ import {
   get_scope_by_id,
   get_scope_ancestors,
   get_root_scope_id,
-  SUPER_ADMIN_SCOPE_ID,
-  is_super_admin_scope,
 } from "./scope_service.js";
 
 // section: constants
@@ -48,7 +46,6 @@ export type ScopeAccessCheckResult = {
     scope_name?: string;
   };
   user_scopes?: UserScope[];
-  is_super_admin?: boolean;
 };
 
 export type AssignUserScopeData = {
@@ -365,27 +362,6 @@ export async function update_user_scopes(
   }
 }
 
-/**
- * Checks if a user is a super admin (has super admin scope assigned)
- */
-export async function is_user_super_admin(
-  adapter: HazoConnectAdapter,
-  user_id: string,
-): Promise<boolean> {
-  try {
-    const user_scopes_result = await get_user_scopes(adapter, user_id);
-    if (!user_scopes_result.success || !user_scopes_result.scopes) {
-      return false;
-    }
-
-    return user_scopes_result.scopes.some((scope) =>
-      is_super_admin_scope(scope.scope_id),
-    );
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Checks if a user has any scope assigned
  */
@@ -408,9 +384,11 @@ export async function user_has_any_scope(
 /**
  * Checks if a user has access to a specific scope
  * Access is granted if:
- * 1. User is a super admin (has super admin scope)
- * 2. User has the exact scope assigned
- * 3. User has access to an ancestor scope (inherited access)
+ * 1. User has the exact scope assigned
+ * 2. User has access to an ancestor scope (inherited access)
+ *
+ * Global admin access (hazo_org_global_admin permission) is handled upstream
+ * in hazo_get_auth before this function is called.
  *
  * @param adapter - HazoConnect adapter
  * @param user_id - User ID to check
@@ -430,24 +408,7 @@ export async function check_user_scope_access(
 
     const user_scopes = user_scopes_result.scopes;
 
-    // Check 1: Is user a super admin?
-    const has_super_admin = user_scopes.some((scope) =>
-      is_super_admin_scope(scope.scope_id),
-    );
-
-    if (has_super_admin) {
-      return {
-        has_access: true,
-        access_via: {
-          scope_id: SUPER_ADMIN_SCOPE_ID,
-          scope_name: "Super Admin",
-        },
-        user_scopes,
-        is_super_admin: true,
-      };
-    }
-
-    // Check 2: Does user have exact scope assigned?
+    // Check 1: Does user have exact scope assigned?
     for (const user_scope of user_scopes) {
       if (user_scope.scope_id === target_scope_id) {
         const scope_result = await get_scope_by_id(adapter, target_scope_id);
@@ -464,7 +425,7 @@ export async function check_user_scope_access(
       }
     }
 
-    // Check 3: Does user have access via an ancestor scope?
+    // Check 2: Does user have access via an ancestor scope?
     const ancestors_result = await get_scope_ancestors(
       adapter,
       target_scope_id,
@@ -568,18 +529,3 @@ export async function get_user_direct_scopes(
   }
 }
 
-/**
- * Assigns super admin scope to a user
- */
-export async function assign_super_admin_scope(
-  adapter: HazoConnectAdapter,
-  user_id: string,
-  role_id: string,
-): Promise<UserScopeResult> {
-  return assign_user_scope(adapter, {
-    user_id,
-    scope_id: SUPER_ADMIN_SCOPE_ID,
-    root_scope_id: SUPER_ADMIN_SCOPE_ID,
-    role_id,
-  });
-}

package/dist/cli/init_users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init_users.d.ts","sourceRoot":"","sources":["../../src/cli/init_users.ts"],"names":[],"mappings":"AAuGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsRrF;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAkC3C"}
+{"version":3,"file":"init_users.d.ts","sourceRoot":"","sources":["../../src/cli/init_users.ts"],"names":[],"mappings":"AA0FA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0RrF;AAGD;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAmC3C"}

package/dist/cli/init_users.js

@@ -5,7 +5,8 @@ import { createCrudService } from "hazo_connect/server";
 import { get_user_management_config } from "../lib/user_management_config.server.js";
 import { get_config_value } from "../lib/config/config_loader.server.js";
 import { create_app_logger } from "../lib/app_logger.js";
-import { SUPER_ADMIN_SCOPE_ID } from "../lib/services/scope_service.js";
+import { DEFAULT_SYSTEM_SCOPE_ID } from "../lib/services/scope_service.js";
+import { GLOBAL_ADMIN_PERMISSION } from "../lib/constants.js";
 // section: helpers
 /**
  * Prints a summary of what was inserted vs what already existed
@@ -45,22 +46,13 @@ function print_summary(summary) {
     }
     console.log();
     // v5.x: User-Role assignments are now handled via User-Scope assignments (see below)
-    // Super admin scope summary
-    console.log("Super Admin Scope:");
-    if (summary.super_admin_scope.inserted) {
-        console.log(`  ✓ Inserted: Super Admin scope (ID: ${SUPER_ADMIN_SCOPE_ID})`);
-    }
-    if (summary.super_admin_scope.existing) {
-        console.log(`  ⊙ Already existed: Super Admin scope (ID: ${SUPER_ADMIN_SCOPE_ID})`);
-    }
-    console.log();
     // User scope summary
     console.log("User-Scope Assignment:");
     if (summary.user_scope.inserted) {
-        console.log(`  ✓ Inserted: User assigned to Super Admin scope`);
+        console.log(`  ✓ Inserted: User assigned to default system scope`);
     }
     if (summary.user_scope.existing) {
-        console.log(`  ⊙ Already existed: User already in Super Admin scope`);
+        console.log(`  ⊙ Already existed: User already in default system scope`);
     }
     console.log();
     console.log("=".repeat(60));
@@ -91,10 +83,6 @@ export async function handle_init_users(options = {}) {
             existing: 0,
         },
         // v5.x: Removed user_role - roles are now assigned via hazo_user_scopes
-        super_admin_scope: {
-            inserted: false,
-            existing: false,
-        },
         user_scope: {
             inserted: false,
             existing: false,
@@ -113,7 +101,6 @@ export async function handle_init_users(options = {}) {
         });
         const users_service = createCrudService(hazoConnect, "hazo_users");
         // v5.x: Removed hazo_user_roles - roles are now assigned via hazo_user_scopes
-        const scopes_service = createCrudService(hazoConnect, "hazo_scopes");
         // hazo_user_scopes uses composite primary key (user_id, scope_id), no 'id' column
         const user_scopes_service = createCrudService(hazoConnect, "hazo_user_scopes", {
             primaryKeys: ["user_id", "scope_id"],
@@ -247,49 +234,61 @@ export async function handle_init_users(options = {}) {
         const user_id = user.id;
         console.log(`✓ Found user: ${super_user_email} (ID: ${user_id})`);
         console.log();
-        // v5.x: Step 7 removed - role assignment now happens via hazo_user_scopes (see step 9)
-        // 8. Ensure super admin scope exists
-        const existing_scopes = await scopes_service.findBy({ id: SUPER_ADMIN_SCOPE_ID });
-        if (Array.isArray(existing_scopes) && existing_scopes.length > 0) {
-            summary.super_admin_scope.existing = true;
-            console.log(`✓ Super Admin scope already exists (ID: ${SUPER_ADMIN_SCOPE_ID})`);
-        }
-        else {
-            await scopes_service.insert({
-                id: SUPER_ADMIN_SCOPE_ID,
-                parent_id: null,
-                name: "Super Admin",
-                level: "system",
+        // 7. Ensure hazo_org_global_admin is in the permission catalog
+        const global_admin_perms = await permissions_service.findBy({
+            permission_name: GLOBAL_ADMIN_PERMISSION,
+        });
+        if (!Array.isArray(global_admin_perms) || global_admin_perms.length === 0) {
+            await permissions_service.insert({
+                permission_name: GLOBAL_ADMIN_PERMISSION,
+                description: "Global admin — access to all scopes and operations",
                 created_at: now,
                 changed_at: now,
             });
-            summary.super_admin_scope.inserted = true;
-            console.log(`✓ Created Super Admin scope (ID: ${SUPER_ADMIN_SCOPE_ID})`);
+            console.log(`✓ Created permission: ${GLOBAL_ADMIN_PERMISSION}`);
+        }
+        else {
+            console.log(`✓ Permission already exists: ${GLOBAL_ADMIN_PERMISSION}`);
+        }
+        console.log();
+        // 9. Ensure hazo_org_global_admin is assigned to the super user role
+        // (The role already has all configured permissions; this ensures the global admin perm is included)
+        const perm_row = await permissions_service.findBy({ permission_name: GLOBAL_ADMIN_PERMISSION });
+        const perm_id = Array.isArray(perm_row) && perm_row.length > 0 ? perm_row[0].id : null;
+        if (perm_id && role_id) {
+            const existing_rp = await role_permissions_service.findBy({ role_id, permission_id: perm_id });
+            if (!Array.isArray(existing_rp) || existing_rp.length === 0) {
+                await role_permissions_service.insert({ role_id, permission_id: perm_id });
+                console.log(`✓ Assigned ${GLOBAL_ADMIN_PERMISSION} to super user role`);
+            }
+            else {
+                console.log(`✓ Super user role already has ${GLOBAL_ADMIN_PERMISSION}`);
+            }
         }
         console.log();
-        // 9. Assign user to super admin scope
+        // 10. Assign user to DEFAULT_SYSTEM_SCOPE_ID (global access comes from the permission, not the scope)
         const existing_user_scopes = await user_scopes_service.findBy({
             user_id,
-            scope_id: SUPER_ADMIN_SCOPE_ID,
+            scope_id: DEFAULT_SYSTEM_SCOPE_ID,
         });
         if (Array.isArray(existing_user_scopes) && existing_user_scopes.length > 0) {
             summary.user_scope.existing = true;
-            console.log(`✓ User already assigned to Super Admin scope`);
+            console.log(`✓ User already assigned to default system scope`);
         }
         else {
             await user_scopes_service.insert({
                 user_id,
-                scope_id: SUPER_ADMIN_SCOPE_ID,
-                root_scope_id: SUPER_ADMIN_SCOPE_ID,
+                scope_id: DEFAULT_SYSTEM_SCOPE_ID,
+                root_scope_id: DEFAULT_SYSTEM_SCOPE_ID,
                 role_id,
                 created_at: now,
                 changed_at: now,
             });
             summary.user_scope.inserted = true;
-            console.log(`✓ Assigned user to Super Admin scope`);
+            console.log(`✓ Assigned user to default system scope`);
         }
         console.log();
-        // 10. Print summary
+        // 11. Print summary
         print_summary(summary);
         logger.info("init_users_completed", {
             filename: "init_users.ts",
@@ -323,15 +322,16 @@ export function show_init_users_help() {
     console.log(`
 hazo_auth init-users
 
-Initialize users, roles, permissions, and super admin scope from configuration.
+Initialize users, roles, and permissions from configuration.
 
 This command reads from hazo_auth_config.ini and:
   1. Creates permissions from [hazo_auth__user_management] application_permission_list_defaults
   2. Creates a 'default_super_user_role' role
   3. Assigns all permissions to the super user role
   4. Finds user by email (from --email parameter or config)
-  5. Creates the Super Admin scope (${SUPER_ADMIN_SCOPE_ID})
-  6. Assigns the user to the Super Admin scope with the super user role
+  5. Ensures the '${GLOBAL_ADMIN_PERMISSION}' permission exists and is assigned to the super user role
+  6. Assigns the user to the default system scope (${DEFAULT_SYSTEM_SCOPE_ID})
+     Global admin access is granted via the '${GLOBAL_ADMIN_PERMISSION}' permission, not by scope
      (v5.x: Roles are assigned per-scope via hazo_user_scopes table)
 
 Options:

package/dist/client.d.ts

@@ -7,6 +7,6 @@ export { use_hazo_auth, trigger_hazo_auth_refresh } from "./components/layouts/s
 export type { UseHazoAuthOptions, UseHazoAuthResult } from "./components/layouts/shared/hooks/use_hazo_auth";
 export { use_firm_branding, use_current_user_branding } from "./components/layouts/shared/hooks/use_firm_branding.js";
 export type { FirmBranding, UseFirmBrandingOptions, UseFirmBrandingResult } from "./components/layouts/shared/hooks/use_firm_branding";
-export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS } from "./lib/constants.js";
+export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
 export * from "./components/layouts/shared/utils/validation.js";
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAYA,cAAc,oBAAoB,CAAC;AAInC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAInI,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIpD,cAAc,uBAAuB,CAAC;AAItC,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AACjH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC3G,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACnH,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAGvI,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAI/E,cAAc,8CAA8C,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAYA,cAAc,oBAAoB,CAAC;AAInC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAInI,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIpD,cAAc,uBAAuB,CAAC;AAItC,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAC;AACjH,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC3G,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACnH,YAAY,EAAE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAGvI,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAIxG,cAAc,8CAA8C,CAAC"}

package/dist/client.js

@@ -25,7 +25,7 @@ export { use_auth_status, trigger_auth_status_refresh } from "./components/layou
 export { use_hazo_auth, trigger_hazo_auth_refresh } from "./components/layouts/shared/hooks/use_hazo_auth.js";
 export { use_firm_branding, use_current_user_branding } from "./components/layouts/shared/hooks/use_firm_branding.js";
 // section: constant_exports
-export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS } from "./lib/constants.js";
+export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
 // section: validation_exports
 // Client-side validation utilities
 export * from "./components/layouts/shared/utils/validation.js";

package/dist/components/layouts/shared/components/profile_pic_menu.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile_pic_menu.d.ts","sourceRoot":"","sources":["../../../../../src/components/layouts/shared/components/profile_pic_menu.tsx"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAI7F,MAAM,MAAM,mBAAmB,GAAG;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;IACtC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAGF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAC7B,kBAA0B,EAC1B,aAAyB,EACzB,aAAyB,EACzB,aAAqC,EACrC,UAA+B,EAC/B,aAAwC,EACxC,WAAW,EACX,iBAAsB,EACtB,SAAS,EACT,WAAuB,EACvB,OAAoB,EACpB,mBAA+B,GAChC,EAAE,mBAAmB,2CAsfrB"}
+{"version":3,"file":"profile_pic_menu.d.ts","sourceRoot":"","sources":["../../../../../src/components/layouts/shared/components/profile_pic_menu.tsx"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAI7F,MAAM,MAAM,mBAAmB,GAAG;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;IACtC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAGF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAC7B,kBAA0B,EAC1B,aAAyB,EACzB,aAAyB,EACzB,aAAqC,EACrC,UAA+B,EAC/B,aAAwC,EACxC,WAAW,EACX,iBAAsB,EACtB,SAAS,EACT,WAAuB,EACvB,OAAoB,EACpB,mBAA+B,GAChC,EAAE,mBAAmB,2CA8gBrB"}

package/dist/components/layouts/shared/components/profile_pic_menu.js

@@ -141,7 +141,7 @@ export function ProfilePicMenu({ show_single_button = false, sign_up_label = "Si
         // Order: info items first, then separators, then links
         items.sort((a, b) => {
             // Define type priority: info = 0, separator = 1, link = 2
-            const typePriority = { info: 0, separator: 1, link: 2 };
+            const typePriority = { info: 0, separator: 1, link: 2, action: 2 };
             const aPriority = typePriority[a.type];
             const bPriority = typePriority[b.type];
             if (aPriority !== bPriority) {
@@ -195,6 +195,9 @@ export function ProfilePicMenu({ show_single_button = false, sign_up_label = "Si
                                                     // Generic link handling
                                                     return (_jsx(DropdownMenuItem, { asChild: true, className: "cls_profile_pic_menu_link cursor-pointer", children: _jsx(Link, { href: item.href || "#", children: item.label }) }, item.id));
                                                 }
+                                                if (item.type === "action") {
+                                                    return (_jsx(DropdownMenuItem, { onClick: item.onSelect, className: "cls_profile_pic_menu_action cursor-pointer", children: item.label }, item.id));
+                                                }
                                                 return null;
                                             }), shiftKeyHeld && (_jsxs(_Fragment, { children: [_jsx(DropdownMenuSeparator, { className: "cls_profile_pic_menu_separator" }), _jsxs(DropdownMenuItem, { onClick: () => setShowPermissionsDialog(true), className: "cls_profile_pic_menu_permissions cursor-pointer", children: [_jsx(Shield, { className: "mr-2 h-4 w-4" }), "My Permissions"] })] }))] })] }), _jsx(Dialog, { open: showPermissionsDialog, onOpenChange: setShowPermissionsDialog, children: _jsxs(DialogContent, { className: "cls_profile_pic_menu_permissions_dialog max-w-2xl max-h-[80vh] flex flex-col", children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: "My Permissions" }), _jsx(DialogDescription, { children: "Your assigned roles and their permissions" })] }), _jsx("div", { className: "flex-1 overflow-y-auto", children: _jsx(RolesMatrix, { user_id: authStatus.user_id, add_button_enabled: false, role_name_selection_enabled: false, permissions_read_only: true, show_save_cancel: false }) })] }) })] }) })] }));
     }
@@ -219,6 +222,9 @@ export function ProfilePicMenu({ show_single_button = false, sign_up_label = "Si
                                     // Generic link handling
                                     return (_jsx(DropdownMenuItem, { asChild: true, className: "cls_profile_pic_menu_link cursor-pointer", children: _jsx(Link, { href: item.href || "#", children: item.label }) }, item.id));
                                 }
+                                if (item.type === "action") {
+                                    return (_jsx(DropdownMenuItem, { onClick: item.onSelect, className: "cls_profile_pic_menu_action cursor-pointer", children: item.label }, item.id));
+                                }
                                 return null;
                             }), shiftKeyHeld && (_jsxs(_Fragment, { children: [_jsx(DropdownMenuSeparator, { className: "cls_profile_pic_menu_separator" }), _jsxs(DropdownMenuItem, { onClick: () => setShowPermissionsDialog(true), className: "cls_profile_pic_menu_permissions cursor-pointer", children: [_jsx(Shield, { className: "mr-2 h-4 w-4" }), "My Permissions"] })] }))] })] }), _jsx(Dialog, { open: showPermissionsDialog, onOpenChange: setShowPermissionsDialog, children: _jsxs(DialogContent, { className: "cls_profile_pic_menu_permissions_dialog max-w-2xl max-h-[80vh] flex flex-col", children: [_jsxs(DialogHeader, { children: [_jsx(DialogTitle, { children: "My Permissions" }), _jsx(DialogDescription, { children: "Your assigned roles and their permissions" })] }), _jsx("div", { className: "flex-1 overflow-y-auto", children: _jsx(RolesMatrix, { user_id: authStatus.user_id, add_button_enabled: false, role_name_selection_enabled: false, permissions_read_only: true, show_save_cancel: false }) })] }) })] }));
 }

package/dist/components/ui/button.d.ts

@@ -1,7 +1,7 @@
 import * as React from "react";
 import { type VariantProps } from "class-variance-authority";
 declare const buttonVariants: (props?: ({
-    variant?: "default" | "destructive" | "outline" | "secondary" | "ghost" | "link" | null | undefined;
+    variant?: "link" | "default" | "destructive" | "outline" | "secondary" | "ghost" | null | undefined;
     size?: "default" | "sm" | "lg" | "icon" | null | undefined;
 } & import("class-variance-authority/types").ClassProp) | undefined) => string;
 export interface ButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement>, VariantProps<typeof buttonVariants> {

package/dist/components/ui/input-otp.d.ts

@@ -1,5 +1,5 @@
 import * as React from "react";
-declare const InputOTP: React.ForwardRefExoticComponent<(Omit<Omit<React.InputHTMLAttributes<HTMLInputElement>, "value" | "onChange" | "maxLength" | "textAlign" | "onComplete" | "pushPasswordManagerStrategy" | "pasteTransformer" | "containerClassName" | "noScriptCSSFallback"> & {
+declare const InputOTP: React.ForwardRefExoticComponent<(Omit<Omit<React.InputHTMLAttributes<HTMLInputElement>, "onChange" | "value" | "maxLength" | "textAlign" | "onComplete" | "pushPasswordManagerStrategy" | "pasteTransformer" | "containerClassName" | "noScriptCSSFallback"> & {
     value?: string;
     onChange?: (newValue: string) => unknown;
     maxLength: number;
@@ -12,7 +12,7 @@ declare const InputOTP: React.ForwardRefExoticComponent<(Omit<Omit<React.InputHT
 } & {
     render: (props: import("input-otp").RenderProps) => React.ReactNode;
     children?: never;
-} & React.RefAttributes<HTMLInputElement>, "ref"> | Omit<Omit<React.InputHTMLAttributes<HTMLInputElement>, "value" | "onChange" | "maxLength" | "textAlign" | "onComplete" | "pushPasswordManagerStrategy" | "pasteTransformer" | "containerClassName" | "noScriptCSSFallback"> & {
+} & React.RefAttributes<HTMLInputElement>, "ref"> | Omit<Omit<React.InputHTMLAttributes<HTMLInputElement>, "onChange" | "value" | "maxLength" | "textAlign" | "onComplete" | "pushPasswordManagerStrategy" | "pasteTransformer" | "containerClassName" | "noScriptCSSFallback"> & {
     value?: string;
     onChange?: (newValue: string) => unknown;
     maxLength: number;

package/dist/index.d.ts

@@ -5,5 +5,5 @@ export type { HazoAuthUser, HazoAuthResult, HazoAuthError, HazoAuthOptions, Scop
 export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedError, } from "./lib/auth/auth_types.js";
 export type { LegalDoc, LegalAcceptanceRecord, LegalAcceptanceMap } from './lib/legal/legal_docs_types';
 export { cn, merge_class_names } from "./lib/utils.js";
-export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS } from "./lib/constants.js";
+export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAG5C,cAAc,oBAAoB,CAAC;AAGnC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAGxG,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -13,4 +13,4 @@ export { AuthenticationRequiredError, TenantRequiredError, TenantAccessDeniedErr
 // section: utility_exports (client-safe)
 export { cn, merge_class_names } from "./lib/utils.js";
 // section: constant_exports
-export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS } from "./lib/constants.js";
+export { HAZO_AUTH_PERMISSIONS, ALL_ADMIN_PERMISSIONS, GLOBAL_ADMIN_PERMISSION } from "./lib/constants.js";

package/dist/lib/auth/auth_types.d.ts

@@ -18,7 +18,6 @@ export type HazoAuthUser = {
 export type ScopeAccessInfo = {
     scope_id: string;
     scope_name?: string;
-    is_super_admin?: boolean;
 };
 /**
  * Result type for hazo_get_auth function
@@ -114,7 +113,6 @@ export type TenantOrganization = {
     slug: string | null;
     level: string;
     role_id: string;
-    is_super_admin: boolean;
     branding?: {
         logo_url: string | null;
         primary_color: string | null;

package/dist/lib/auth/auth_types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_types.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth_types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE9C,gBAAgB,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAE/B,mBAAmB,EAAE,MAAM,EAAE;IAC7B,gBAAgB,EAAE,MAAM,EAAE;IAC1B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,qBAAqB,CAAC,EAAE,MAAM;IAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;gBAJ7C,mBAAmB,EAAE,MAAM,EAAE,EAC7B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,oBAAoB,EAAE,MAAM,EAAE,EAC9B,qBAAqB,CAAC,EAAE,MAAM,YAAA,EAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA;CAKvD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEhC,QAAQ,EAAE,MAAM;IAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;gBAD7D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAKvE;AAID;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG;IAChD;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,YAAY,EAAE,IAAI,CAAC;IACnB,0EAA0E;IAC1E,eAAe,EAAE,IAAI,CAAC;IACtB,WAAW,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,EAAE,IAAI,CAAC;IACpB,YAAY,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAIF;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAGpB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,MAAM;gBAFnC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM;CAKtC;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,aAAa;gBAChD,OAAO,GAAE,MAAkC;CAIxD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;aAGlC,WAAW,EAAE,YAAY,EAAE;gBAD3C,OAAO,GAAE,MAAkC,EAC3B,WAAW,GAAE,YAAY,EAAO;CAKnD;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,aAAa;aAEtC,QAAQ,EAAE,MAAM;aAChB,WAAW,EAAE,YAAY,EAAE;gBAD3B,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,YAAY,EAAO;CAKnD"}
+{"version":3,"file":"auth_types.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth_types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE9C,gBAAgB,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAE/B,mBAAmB,EAAE,MAAM,EAAE;IAC7B,gBAAgB,EAAE,MAAM,EAAE;IAC1B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,qBAAqB,CAAC,EAAE,MAAM;IAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;gBAJ7C,mBAAmB,EAAE,MAAM,EAAE,EAC7B,gBAAgB,EAAE,MAAM,EAAE,EAC1B,oBAAoB,EAAE,MAAM,EAAE,EAC9B,qBAAqB,CAAC,EAAE,MAAM,YAAA,EAC9B,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,YAAA;CAKvD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAEhC,QAAQ,EAAE,MAAM;IAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;gBAD7D,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAKvE;AAID;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC;CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG;IAChD;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,aAAa,EAAE,IAAI,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,0EAA0E;IAC1E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC,GACD;IACE,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,EAAE,CAAC;IAChB,aAAa,EAAE,KAAK,CAAC;IACrB,YAAY,EAAE,IAAI,CAAC;IACnB,0EAA0E;IAC1E,eAAe,EAAE,IAAI,CAAC;IACtB,WAAW,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IACxD,aAAa,EAAE,IAAI,CAAC;IACpB,YAAY,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAIF;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAGpB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,MAAM;gBAFnC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM;CAKtC;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,aAAa;gBAChD,OAAO,GAAE,MAAkC;CAIxD;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,aAAa;aAGlC,WAAW,EAAE,YAAY,EAAE;gBAD3C,OAAO,GAAE,MAAkC,EAC3B,WAAW,GAAE,YAAY,EAAO;CAKnD;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,aAAa;aAEtC,QAAQ,EAAE,MAAM;aAChB,WAAW,EAAE,YAAY,EAAE;gBAD3B,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,YAAY,EAAO;CAKnD"}

package/dist/lib/auth/hazo_get_auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hazo_get_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/hazo_get_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM1C,OAAO,KAAK,EACV,cAAc,EAEd,eAAe,EAGhB,MAAM,cAAc,CAAC;AA+DtB;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAU1D;AA6SD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,CAAC,CAyNzB"}
+{"version":3,"file":"hazo_get_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/hazo_get_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM1C,OAAO,KAAK,EACV,cAAc,EAEd,eAAe,EAGhB,MAAM,cAAc,CAAC;AAgEtB;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAU1D;AA4SD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,CAAC,CA+NzB"}

package/dist/lib/auth/hazo_get_auth.server.js

@@ -16,6 +16,7 @@ import { is_hrbac_enabled, get_scope_hierarchy_config } from "../scope_hierarchy
 import { check_user_scope_access, get_user_scopes, } from "../services/user_scope_service.js";
 import { get_cookie_name, BASE_COOKIE_NAMES } from "../cookies_config.server.js";
 import { get_app_permission_descriptions } from "../app_permissions_config.server.js";
+import { GLOBAL_ADMIN_PERMISSION } from "../constants.js";
 // section: helpers
 /**
  * Parse JSON string to object, returning null on failure
@@ -287,7 +288,6 @@ async function check_scope_access_internal(user_id, scope_id) {
             scope_access_via: {
                 scope_id: result.access_via.scope_id,
                 scope_name: result.access_via.scope_name,
-                is_super_admin: result.is_super_admin,
             },
             user_scopes,
         };
@@ -445,25 +445,33 @@ export async function hazo_get_auth(request, options) {
     let scope_access_via;
     const hrbac_enabled = is_hrbac_enabled();
     if (hrbac_enabled && (options === null || options === void 0 ? void 0 : options.scope_id)) {
-        const scope_result = await check_scope_access_internal(user.id, options.scope_id);
-        scope_ok = scope_result.scope_ok;
-        scope_access_via = scope_result.scope_access_via;
-        // Log scope denial if permission logging is enabled
-        if (!scope_ok && config.log_permission_denials) {
-            const client_ip = get_client_ip(request);
-            logger.warn("auth_utility_scope_access_denied", {
-                filename: get_filename(),
-                line_number: get_line_number(),
-                user_id: user.id,
-                scope_id: options.scope_id,
-                user_scopes: scope_result.user_scopes,
-                ip: client_ip,
-                correlation_id: getCorrelationId(),
-            });
+        // Global admin permission grants access to all scopes
+        const has_global_admin = permissions.includes(GLOBAL_ADMIN_PERMISSION);
+        if (has_global_admin) {
+            scope_ok = true;
+            scope_access_via = { scope_id: options.scope_id };
         }
-        // Throw error if strict mode and scope access denied
-        if (!scope_ok && options.strict) {
-            throw new ScopeAccessError(options.scope_id, scope_result.user_scopes);
+        else {
+            const scope_result = await check_scope_access_internal(user.id, options.scope_id);
+            scope_ok = scope_result.scope_ok;
+            scope_access_via = scope_result.scope_access_via;
+            // Log scope denial if permission logging is enabled
+            if (!scope_ok && config.log_permission_denials) {
+                const client_ip = get_client_ip(request);
+                logger.warn("auth_utility_scope_access_denied", {
+                    filename: get_filename(),
+                    line_number: get_line_number(),
+                    user_id: user.id,
+                    scope_id: options.scope_id,
+                    user_scopes: scope_result.user_scopes,
+                    ip: client_ip,
+                    correlation_id: getCorrelationId(),
+                });
+            }
+            // Throw error if strict mode and scope access denied
+            if (!scope_ok && options.strict) {
+                throw new ScopeAccessError(options.scope_id, scope_result.user_scopes);
+            }
         }
     }
     return {

package/dist/lib/auth/hazo_get_tenant_auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hazo_get_tenant_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/hazo_get_tenant_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EAGzB,MAAM,cAAc,CAAC;AAqBtB;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,iBAAiB,GACzB,MAAM,GAAG,SAAS,CAYpB;AAiCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA0F3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CA0BnC"}
+{"version":3,"file":"hazo_get_tenant_auth.server.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/hazo_get_tenant_auth.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQ1C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EAGzB,MAAM,cAAc,CAAC;AAqBtB;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,iBAAiB,GACzB,MAAM,GAAG,SAAS,CAYpB;AA8BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAwF3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CA0BnC"}

package/dist/lib/auth/hazo_get_tenant_auth.server.js

@@ -4,6 +4,7 @@ import "server-only";
 import { hazo_get_auth } from "./hazo_get_auth.server.js";
 import { get_auth_cache } from "./auth_cache.js";
 import { get_scope_by_id } from "../services/scope_service.js";
+import { GLOBAL_ADMIN_PERMISSION } from "../constants.js";
 import { get_hazo_connect_instance } from "../hazo_connect_instance.server.js";
 import { get_cookie_name } from "../cookies_config.server.js";
 import { get_auth_utility_config } from "../auth_utility_config.server.js";
@@ -39,19 +40,17 @@ export function extract_scope_id_from_request(request, options) {
     return cookie_value;
 }
 /**
- * Builds TenantOrganization from scope details and access info
+ * Builds TenantOrganization from scope details
  * @param scope_details - Full scope details from cache
- * @param is_super_admin - Whether user is accessing as super admin
  * @returns TenantOrganization object
  */
-function build_tenant_organization(scope_details, is_super_admin) {
+function build_tenant_organization(scope_details) {
     return {
         id: scope_details.id,
         name: scope_details.name,
         slug: scope_details.slug,
         level: scope_details.level,
         role_id: scope_details.role_id,
-        is_super_admin,
         branding: scope_details.logo_url || scope_details.primary_color
             ? {
                 logo_url: scope_details.logo_url,
@@ -113,13 +112,15 @@ export async function hazo_get_tenant_auth(request, options = {}) {
     // Build organization info if scope access was successful
     let organization = null;
     if (scope_id && auth_result.scope_ok && auth_result.scope_access_via) {
-        // Find the scope in user's scopes that matches the access_via scope
+        // Try to find the scope in user's cached scope assignments first.
+        // For global admins the scope may not be in their cache (they can access any scope),
+        // in which case we fall through to the permission-based fetch below.
         const access_scope = user_scopes.find((s) => { var _a; return s.id === ((_a = auth_result.scope_access_via) === null || _a === void 0 ? void 0 : _a.scope_id); });
         if (access_scope) {
-            organization = build_tenant_organization(access_scope, auth_result.scope_access_via.is_super_admin || false);
+            organization = build_tenant_organization(access_scope);
         }
-        else if (auth_result.scope_access_via.is_super_admin) {
-            // Super admin accessing scope they're not assigned to - fetch scope details
+        else if (auth_result.permissions.includes(GLOBAL_ADMIN_PERMISSION)) {
+            // Global admin accessing a scope they aren't directly assigned to — fetch scope details
             const hazoConnect = get_hazo_connect_instance();
             const scope_result = await get_scope_by_id(hazoConnect, scope_id);
             if (scope_result.success && scope_result.scope) {
@@ -128,8 +129,7 @@ export async function hazo_get_tenant_auth(request, options = {}) {
                     name: scope_result.scope.name,
                     slug: null, // Could fetch from scope if slug column exists
                     level: scope_result.scope.level,
-                    role_id: "", // Super admin doesn't have a role in the scope
-                    is_super_admin: true,
+                    role_id: "", // Global admin doesn't have a role assignment in the scope
                     branding: scope_result.scope.logo_url
                         ? {
                             logo_url: scope_result.scope.logo_url,

package/dist/lib/constants.d.ts

@@ -8,4 +8,5 @@ export declare const HAZO_AUTH_PERMISSIONS: {
     readonly ADMIN_TEST_ACCESS: "admin_test_access";
 };
 export declare const ALL_ADMIN_PERMISSIONS: string[];
+export declare const GLOBAL_ADMIN_PERMISSION = "hazo_org_global_admin";
 //# sourceMappingURL=constants.d.ts.map

package/dist/lib/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAAyC,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAAyC,CAAC;AAEpF,eAAO,MAAM,uBAAuB,0BAA0B,CAAC"}

package/dist/lib/constants.js

@@ -11,3 +11,4 @@ export const HAZO_AUTH_PERMISSIONS = {
     ADMIN_TEST_ACCESS: "admin_test_access",
 };
 export const ALL_ADMIN_PERMISSIONS = Object.values(HAZO_AUTH_PERMISSIONS);
+export const GLOBAL_ADMIN_PERMISSION = "hazo_org_global_admin";

package/dist/lib/profile_pic_menu_config.server.d.ts

@@ -1,10 +1,11 @@
 import "server-only";
-export type MenuItemType = "info" | "link" | "separator";
+export type MenuItemType = "info" | "link" | "separator" | "action";
 export type ProfilePicMenuMenuItem = {
     type: MenuItemType;
     label?: string;
     value?: string;
     href?: string;
+    onSelect?: () => void;
     order: number;
     id: string;
 };

package/dist/lib/profile_pic_menu_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile_pic_menu_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/profile_pic_menu_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;AAEzD,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;CAC7C,CAAC;AA4EF;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,oBAAoB,CA4BlE"}
+{"version":3,"file":"profile_pic_menu_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/profile_pic_menu_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEpE,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;CAC7C,CAAC;AA4EF;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,oBAAoB,CA4BlE"}

package/dist/lib/profile_pic_menu_config.server.js

@@ -20,7 +20,7 @@ function parse_custom_menu_items(items_string) {
         }
         const type = parts[0];
         if (type !== "info" && type !== "link" && type !== "separator") {
-            return; // Invalid type, skip
+            return; // Invalid type or action (action items carry callbacks, not expressible in INI)
         }
         if (type === "separator") {
             const order = parseInt(parts[1] || "1", 10);