snipe-auth-rbac 0.3.0 → 0.4.0

package/dist/index-nfrns9Ye.d.ts

@@ -0,0 +1,191 @@
+import { c as ResourceRegistry, U as UserProfile, A as Action, e as PermissionMap, b as AuthRbacFetcher, a as ResourceDescriptor } from './types-Oj9yfWvz.js';
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Transport-agnostic client: turns an adopter-supplied
+ * `AuthRbacFetcher` into a permission resolver. The React provider
+ * wraps this; non-React consumers (Node scripts, edge functions)
+ * can use it directly.
+ */
+
+interface AuthRbacClientOptions {
+    fetcher: AuthRbacFetcher;
+    /**
+     * The host project's full resource list. Required so the resolver
+     * can look up a resource's scope without a DB round-trip per call.
+     * Re-using the same array the host syncs into the
+     * `rbac.resources` table at boot keeps everything in lockstep.
+     */
+    resources: ResourceRegistry;
+}
+interface CanOptions {
+    /**
+     * Override the active company. Omit to use the company the
+     * caller has currently activated (the React provider tracks
+     * this; for direct client use you must pass it).
+     */
+    companyId?: string | null;
+}
+/**
+ * Pure resolver. Given a hydrated profile it answers boolean
+ * questions instantly — no I/O. The `resourceMap` is built once at
+ * construction so per-call work is two map lookups.
+ */
+declare function buildPermissionResolver(resources: ResourceRegistry, profile: UserProfile, defaultCompanyId: string | null): {
+    can: (resource: string, action: Action, options?: CanOptions) => boolean;
+    canAccessSection: (resource: string, action?: Action, options?: CanOptions) => boolean;
+    /** Permission map for the active (or specified) company. */
+    activePermissions: (companyId?: string | null) => PermissionMap;
+    systemPermissions: () => PermissionMap;
+};
+/**
+ * Helper: groups a resource registry by `group` for the matrix UI.
+ * Returns groups in insertion order with their resources.
+ */
+declare function groupResources(registry: ResourceRegistry): Array<{
+    group: string;
+    resources: ResourceDescriptor[];
+}>;
+type AuthRbacClient = ReturnType<typeof buildPermissionResolver>;
+
+/**
+ * Typed factory — turns a const-asserted resource registry into a
+ * set of hooks/components whose `resource` arg is constrained to
+ * the registered names. Typos become TypeScript errors instead of
+ * silent runtime `false`.
+ *
+ * @example
+ *   // src/auth/resources.ts
+ *   import { defineAuthRbac } from "snipe-auth-rbac/react";
+ *
+ *   export const RESOURCES = [
+ *     { resource: "properties", scope: "company", label: "Liegenschaften", group: "Stammdaten" },
+ *     { resource: "payments",   scope: "company", label: "Zahlungen",     group: "Finanzen" },
+ *     { resource: "system_audit", scope: "system",  label: "Audit-Log",    group: "Plattform" },
+ *   ] as const;
+ *
+ *   export const { useCan, Can, RequirePermission } = defineAuthRbac(RESOURCES);
+ *
+ *   // ----- elsewhere -----
+ *   useCan("properties", "update");       // ✓
+ *   useCan("paymetns", "update");          // ✗ TS error: not assignable to type "properties" | "payments" | "system_audit"
+ */
+
+/**
+ * Thrown by `defineAuthRbac` when the registry contains a cycle in
+ * its `dependsOn` graph. The cycle path is included in the message,
+ * named in registry order.
+ */
+declare class RbacRegistryError extends Error {
+    constructor(message: string);
+}
+/**
+ * Drop-in replacement signatures for the three guards, with a
+ * narrowed `resource` arg.
+ */
+interface TypedGuards<R extends string> {
+    useCan: (resource: R, action: Action, options?: {
+        companyId?: string | null;
+    }) => boolean;
+    /**
+     * `useCan` for sidebar / list-page access: returns true only when
+     * the user holds the action on the resource as a **direct** grant
+     * (no `<action>_granted_via`). Implied rows answer false here.
+     *
+     * `action` defaults to `'read'` because the canonical use is
+     * top-level-nav gating. Available since 0.4.0.
+     */
+    useCanAccessSection: (resource: R, action?: Action, options?: {
+        companyId?: string | null;
+    }) => boolean;
+    Can: ComponentType<{
+        resource: R;
+        action: Action;
+        companyId?: string | null;
+        children: ReactNode;
+        fallback?: ReactNode;
+    }>;
+    RequirePermission: ComponentType<{
+        resource: R;
+        action: Action;
+        companyId?: string | null;
+        loadingFallback?: ReactNode;
+        deniedFallback?: ReactNode;
+        children?: ReactNode;
+    }>;
+    /** The const-asserted registry, re-exported so call-sites can iterate. */
+    resources: ResourceRegistry;
+    /** All registered resource names as a union — handy for typing
+     *  application-side data structures. */
+    resourceNames: ReadonlyArray<R>;
+}
+
+/**
+ * Built-in fetchers — adopters can use these or pass their own
+ * implementation of `AuthRbacFetcher`.
+ */
+
+/**
+ * Calls the package's SQL function `rbac.user_profile(uuid)` via
+ * a Supabase JS client. Easiest path when the host project already
+ * uses Supabase.
+ *
+ * The function lives in the dedicated `rbac` Postgres schema, so the
+ * adopter must add `rbac` to their PostgREST exposed-schemas list
+ * (Supabase Studio → Settings → API → Exposed schemas) for the
+ * `.schema('rbac')` call below to reach it.
+ *
+ * @example
+ * createSupabaseFetcher({ supabase, userId: session.user.id })
+ */
+declare function createSupabaseFetcher(opts: {
+    supabase: {
+        schema: (name: string) => {
+            rpc: (fn: string, args: Record<string, unknown>) => Promise<{
+                data: unknown;
+                error: {
+                    message: string;
+                } | null;
+            }>;
+        };
+    };
+    userId: string;
+}): AuthRbacFetcher;
+/**
+ * Cheap probe — returns true if the package's `rbac` schema looks
+ * reachable. Useful at app start to fail loudly if the migration
+ * hasn't been applied OR if `rbac` isn't in the project's PostgREST
+ * exposed-schemas list.
+ *
+ * @example
+ * if (!(await detectRbacSchema(supabase))) {
+ *   console.error("rbac schema not reachable — apply 0001_initial.sql");
+ * }
+ */
+declare function detectRbacSchema(supabase: {
+    schema: (name: string) => {
+        rpc: (fn: string, args: Record<string, unknown>) => Promise<{
+            data: unknown;
+            error: {
+                message: string;
+            } | null;
+        }>;
+    };
+}): Promise<boolean>;
+/**
+ * Calls a regular HTTP endpoint that returns a `UserProfile` JSON
+ * payload. Use this when the host project has its own backend that
+ * wraps the package's Python helpers (or any equivalent).
+ *
+ * @example
+ * createHttpFetcher({ url: "/api/users/me/profile" })
+ */
+declare function createHttpFetcher(opts: {
+    url: string;
+    /** Forwarded as-is to `fetch`. Use this to attach auth headers. */
+    init?: RequestInit;
+    /** Override the global `fetch` if you're in a non-browser env. */
+    fetch?: typeof fetch;
+}): AuthRbacFetcher;
+
+export { type AuthRbacClient as A, type CanOptions as C, RbacRegistryError as R, type TypedGuards as T, createSupabaseFetcher as a, type AuthRbacClientOptions as b, createHttpFetcher as c, detectRbacSchema as d, buildPermissionResolver as e, groupResources as g };

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  RbacRegistryError: () => RbacRegistryError,
   buildPermissionResolver: () => buildPermissionResolver,
   createHttpFetcher: () => createHttpFetcher,
   createSupabaseFetcher: () => createSupabaseFetcher,
@@ -56,8 +57,32 @@ function buildPermissionResolver(resources, profile, defaultCompanyId) {
     }
     return readGrid(membership.permissions, resource, action);
   };
+  const canAccessSection = (resource, action = "read", options) => {
+    if (profile.is_super_admin) {
+      return true;
+    }
+    const scope = scopeByResource.get(resource);
+    if (!scope) {
+      return false;
+    }
+    if (scope === "system") {
+      return readDirect(profile, action, resource);
+    }
+    const companyId = options?.companyId ?? defaultCompanyId;
+    if (!companyId) {
+      return false;
+    }
+    const membership = profile.memberships.find(
+      (m) => m.company_id === companyId
+    );
+    if (!membership) {
+      return false;
+    }
+    return readDirectMembership(membership, action, resource);
+  };
   return {
     can,
+    canAccessSection,
     /** Permission map for the active (or specified) company. */
     activePermissions: (companyId) => {
       const id = companyId ?? defaultCompanyId;
@@ -69,6 +94,14 @@ function buildPermissionResolver(resources, profile, defaultCompanyId) {
     systemPermissions: () => profile.system_permissions
   };
 }
+function readDirect(profile, action, resource) {
+  const map = action === "read" ? profile.system_direct_reads : action === "write" ? profile.system_direct_writes : action === "update" ? profile.system_direct_updates : profile.system_direct_deletes;
+  return map?.[resource] === true;
+}
+function readDirectMembership(membership, action, resource) {
+  const map = action === "read" ? membership.direct_reads : action === "write" ? membership.direct_writes : action === "update" ? membership.direct_updates : membership.direct_deletes;
+  return map?.[resource] === true;
+}
 function readGrid(map, resource, action) {
   const grid = map[resource];
   if (!grid) {
@@ -90,6 +123,14 @@ function groupResources(registry) {
   return order.map((g) => ({ group: g, resources: buckets.get(g) }));
 }
 
+// src/define.ts
+var RbacRegistryError = class extends Error {
+  constructor(message) {
+    super(`auth-rbac: ${message}`);
+    this.name = "RbacRegistryError";
+  }
+};
+
 // src/fetchers.ts
 function createSupabaseFetcher(opts) {
   return {
@@ -154,6 +195,7 @@ function normalizeProfile(raw) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  RbacRegistryError,
   buildPermissionResolver,
   createHttpFetcher,
   createSupabaseFetcher,

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/fetchers.ts"],"sourcesContent":["/**\n * Public entry — transport-agnostic. Use this in non-React code\n * (Node, scripts, edge workers). React hosts should import from\n * `snipe-auth-rbac/react`.\n */\n\nexport type {\n  Action,\n  AuthRbacFetcher,\n  CompanyMembership,\n  FrontendConfig,\n  PermissionGrid,\n  PermissionMap,\n  ResourceDescriptor,\n  ResourceRegistry,\n  ResourceScope,\n  RoleSummary,\n  UserProfile,\n} from \"./types.js\";\n\nexport {\n  buildPermissionResolver,\n  groupResources,\n  type AuthRbacClient,\n  type CanOptions,\n  type ClientOptions,\n} from \"./client.js\";\n\nexport {\n  createSupabaseFetcher,\n  createHttpFetcher,\n  detectRbacSchema,\n} from \"./fetchers.js\";\n","/**\n * Transport-agnostic client: turns an adopter-supplied\n * `AuthRbacFetcher` into a permission resolver. The React provider\n * wraps this; non-React consumers (Node scripts, edge functions)\n * can use it directly.\n */\n\nimport type {\n  Action,\n  AuthRbacFetcher,\n  PermissionMap,\n  ResourceDescriptor,\n  ResourceRegistry,\n  ResourceScope,\n  UserProfile,\n} from \"./types.js\";\n\nexport interface AuthRbacClientOptions {\n  fetcher: AuthRbacFetcher;\n  /**\n   * The host project's full resource list. Required so the resolver\n   * can look up a resource's scope without a DB round-trip per call.\n   * Re-using the same array the host syncs into the\n   * `rbac.resources` table at boot keeps everything in lockstep.\n   */\n  resources: ResourceRegistry;\n}\n\nexport interface CanOptions {\n  /**\n   * Override the active company. Omit to use the company the\n   * caller has currently activated (the React provider tracks\n   * this; for direct client use you must pass it).\n   */\n  companyId?: string | null;\n}\n\n/**\n * Pure resolver. Given a hydrated profile it answers boolean\n * questions instantly — no I/O. The `resourceMap` is built once at\n * construction so per-call work is two map lookups.\n */\nexport function buildPermissionResolver(\n  resources: ResourceRegistry,\n  profile: UserProfile,\n  defaultCompanyId: string | null,\n) {\n  const scopeByResource = new Map<string, ResourceScope>(\n    resources.map((r) => [r.resource, r.scope]),\n  );\n\n  const can = (\n    resource: string,\n    action: Action,\n    options?: CanOptions,\n  ): boolean => {\n    if (profile.is_super_admin) {\n      return true;\n    }\n    const scope = scopeByResource.get(resource);\n    if (!scope) {\n      // Unknown resource — fail closed.\n      return false;\n    }\n    if (scope === \"system\") {\n      return readGrid(profile.system_permissions, resource, action);\n    }\n    const companyId = options?.companyId ?? defaultCompanyId;\n    if (!companyId) {\n      return false;\n    }\n    const membership = profile.memberships.find(\n      (m) => m.company_id === companyId,\n    );\n    if (!membership) {\n      return false;\n    }\n    return readGrid(membership.permissions, resource, action);\n  };\n\n  return {\n    can,\n    /** Permission map for the active (or specified) company. */\n    activePermissions: (companyId?: string | null): PermissionMap => {\n      const id = companyId ?? defaultCompanyId;\n      if (!id) {\n        return {};\n      }\n      return (\n        profile.memberships.find((m) => m.company_id === id)?.permissions ?? {}\n      );\n    },\n    systemPermissions: (): PermissionMap => profile.system_permissions,\n  };\n}\n\nfunction readGrid(\n  map: PermissionMap,\n  resource: string,\n  action: Action,\n): boolean {\n  const grid = map[resource];\n  if (!grid) {\n    return false;\n  }\n  return grid[action];\n}\n\n/**\n * Helper: groups a resource registry by `group` for the matrix UI.\n * Returns groups in insertion order with their resources.\n */\nexport function groupResources(\n  registry: ResourceRegistry,\n): Array<{ group: string; resources: ResourceDescriptor[] }> {\n  const order: string[] = [];\n  const buckets = new Map<string, ResourceDescriptor[]>();\n  for (const r of registry) {\n    const key = r.group ?? \"Sonstige\";\n    if (!buckets.has(key)) {\n      buckets.set(key, []);\n      order.push(key);\n    }\n    buckets.get(key)!.push(r);\n  }\n  return order.map((g) => ({ group: g, resources: buckets.get(g)! }));\n}\n\nexport type AuthRbacClient = ReturnType<typeof buildPermissionResolver>;\nexport type { AuthRbacClientOptions as ClientOptions };\n","/**\n * Built-in fetchers — adopters can use these or pass their own\n * implementation of `AuthRbacFetcher`.\n */\n\nimport type { AuthRbacFetcher, UserProfile } from \"./types.js\";\n\n/**\n * Calls the package's SQL function `rbac.user_profile(uuid)` via\n * a Supabase JS client. Easiest path when the host project already\n * uses Supabase.\n *\n * The function lives in the dedicated `rbac` Postgres schema, so the\n * adopter must add `rbac` to their PostgREST exposed-schemas list\n * (Supabase Studio → Settings → API → Exposed schemas) for the\n * `.schema('rbac')` call below to reach it.\n *\n * @example\n * createSupabaseFetcher({ supabase, userId: session.user.id })\n */\nexport function createSupabaseFetcher(opts: {\n  supabase: {\n    schema: (name: string) => {\n      rpc: (\n        fn: string,\n        args: Record<string, unknown>,\n      ) => Promise<{ data: unknown; error: { message: string } | null }>;\n    };\n  };\n  userId: string;\n}): AuthRbacFetcher {\n  return {\n    async fetchProfile(): Promise<UserProfile> {\n      const { data, error } = await opts.supabase.schema(\"rbac\").rpc(\n        \"user_profile\",\n        { p_user_id: opts.userId },\n      );\n      if (error) {\n        throw new Error(\n          `auth-rbac: failed to load user profile via Supabase RPC: ${error.message}`,\n        );\n      }\n      return normalizeProfile(data);\n    },\n  };\n}\n\n/**\n * Cheap probe — returns true if the package's `rbac` schema looks\n * reachable. Useful at app start to fail loudly if the migration\n * hasn't been applied OR if `rbac` isn't in the project's PostgREST\n * exposed-schemas list.\n *\n * @example\n * if (!(await detectRbacSchema(supabase))) {\n *   console.error(\"rbac schema not reachable — apply 0001_initial.sql\");\n * }\n */\nexport async function detectRbacSchema(supabase: {\n  schema: (name: string) => {\n    rpc: (\n      fn: string,\n      args: Record<string, unknown>,\n    ) => Promise<{ data: unknown; error: { message: string } | null }>;\n  };\n}): Promise<boolean> {\n  try {\n    const { error } = await supabase.schema(\"rbac\").rpc(\"user_can\", {\n      p_user_id: \"00000000-0000-0000-0000-000000000000\",\n      p_resource: \"__rbac_self_check__\",\n      p_action: \"read\",\n      p_company_id: null,\n    });\n    return error === null;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Calls a regular HTTP endpoint that returns a `UserProfile` JSON\n * payload. Use this when the host project has its own backend that\n * wraps the package's Python helpers (or any equivalent).\n *\n * @example\n * createHttpFetcher({ url: \"/api/users/me/profile\" })\n */\nexport function createHttpFetcher(opts: {\n  url: string;\n  /** Forwarded as-is to `fetch`. Use this to attach auth headers. */\n  init?: RequestInit;\n  /** Override the global `fetch` if you're in a non-browser env. */\n  fetch?: typeof fetch;\n}): AuthRbacFetcher {\n  const fetchImpl = opts.fetch ?? globalThis.fetch;\n  return {\n    async fetchProfile(): Promise<UserProfile> {\n      const res = await fetchImpl(opts.url, opts.init);\n      if (!res.ok) {\n        throw new Error(\n          `auth-rbac: profile endpoint ${opts.url} returned ${res.status}`,\n        );\n      }\n      const json = (await res.json()) as unknown;\n      return normalizeProfile(json);\n    },\n  };\n}\n\n/**\n * Defensive normalisation: the Supabase RPC returns whatever the SQL\n * function emitted. We coerce missing fields into the empty defaults\n * so consumers can iterate without null checks. Throws if the shape\n * is unrecognisable.\n */\nfunction normalizeProfile(raw: unknown): UserProfile {\n  if (!raw || typeof raw !== \"object\") {\n    throw new Error(\"auth-rbac: profile payload is not an object\");\n  }\n  const p = raw as Partial<UserProfile> & Record<string, unknown>;\n  if (typeof p.user_id !== \"string\") {\n    throw new Error(\"auth-rbac: profile payload missing user_id\");\n  }\n  return {\n    user_id: p.user_id,\n    is_super_admin: !!p.is_super_admin,\n    system_roles: Array.isArray(p.system_roles) ? p.system_roles : [],\n    system_permissions:\n      p.system_permissions && typeof p.system_permissions === \"object\"\n        ? (p.system_permissions as UserProfile[\"system_permissions\"])\n        : {},\n    system_frontend_config:\n      p.system_frontend_config && typeof p.system_frontend_config === \"object\"\n        ? (p.system_frontend_config as UserProfile[\"system_frontend_config\"])\n        : {},\n    memberships: Array.isArray(p.memberships)\n      ? (p.memberships as UserProfile[\"memberships\"])\n      : [],\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC0CO,SAAS,wBACd,WACA,SACA,kBACA;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC;AAAA,EAC5C;AAEA,QAAM,MAAM,CACV,UACA,QACA,YACY;AACZ,QAAI,QAAQ,gBAAgB;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,gBAAgB,IAAI,QAAQ;AAC1C,QAAI,CAAC,OAAO;AAEV,aAAO;AAAA,IACT;AACA,QAAI,UAAU,UAAU;AACtB,aAAO,SAAS,QAAQ,oBAAoB,UAAU,MAAM;AAAA,IAC9D;AACA,UAAM,YAAY,SAAS,aAAa;AACxC,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,IACT;AACA,UAAM,aAAa,QAAQ,YAAY;AAAA,MACrC,CAAC,MAAM,EAAE,eAAe;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,IACT;AACA,WAAO,SAAS,WAAW,aAAa,UAAU,MAAM;AAAA,EAC1D;AAEA,SAAO;AAAA,IACL;AAAA;AAAA,IAEA,mBAAmB,CAAC,cAA6C;AAC/D,YAAM,KAAK,aAAa;AACxB,UAAI,CAAC,IAAI;AACP,eAAO,CAAC;AAAA,MACV;AACA,aACE,QAAQ,YAAY,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC;AAAA,IAE1E;AAAA,IACA,mBAAmB,MAAqB,QAAQ;AAAA,EAClD;AACF;AAEA,SAAS,SACP,KACA,UACA,QACS;AACT,QAAM,OAAO,IAAI,QAAQ;AACzB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,SAAO,KAAK,MAAM;AACpB;AAMO,SAAS,eACd,UAC2D;AAC3D,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAU,oBAAI,IAAkC;AACtD,aAAW,KAAK,UAAU;AACxB,UAAM,MAAM,EAAE,SAAS;AACvB,QAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,cAAQ,IAAI,KAAK,CAAC,CAAC;AACnB,YAAM,KAAK,GAAG;AAAA,IAChB;AACA,YAAQ,IAAI,GAAG,EAAG,KAAK,CAAC;AAAA,EAC1B;AACA,SAAO,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,QAAQ,IAAI,CAAC,EAAG,EAAE;AACpE;;;AC1GO,SAAS,sBAAsB,MAUlB;AAClB,SAAO;AAAA,IACL,MAAM,eAAqC;AACzC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,SAAS,OAAO,MAAM,EAAE;AAAA,QACzD;AAAA,QACA,EAAE,WAAW,KAAK,OAAO;AAAA,MAC3B;AACA,UAAI,OAAO;AACT,cAAM,IAAI;AAAA,UACR,4DAA4D,MAAM,OAAO;AAAA,QAC3E;AAAA,MACF;AACA,aAAO,iBAAiB,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAaA,eAAsB,iBAAiB,UAOlB;AACnB,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,SAAS,OAAO,MAAM,EAAE,IAAI,YAAY;AAAA,MAC9D,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,cAAc;AAAA,IAChB,CAAC;AACD,WAAO,UAAU;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,kBAAkB,MAMd;AAClB,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,SAAO;AAAA,IACL,MAAM,eAAqC;AACzC,YAAM,MAAM,MAAM,UAAU,KAAK,KAAK,KAAK,IAAI;AAC/C,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,+BAA+B,KAAK,GAAG,aAAa,IAAI,MAAM;AAAA,QAChE;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,aAAO,iBAAiB,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAQA,SAAS,iBAAiB,KAA2B;AACnD,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,YAAY,UAAU;AACjC,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,SAAS,EAAE;AAAA,IACX,gBAAgB,CAAC,CAAC,EAAE;AAAA,IACpB,cAAc,MAAM,QAAQ,EAAE,YAAY,IAAI,EAAE,eAAe,CAAC;AAAA,IAChE,oBACE,EAAE,sBAAsB,OAAO,EAAE,uBAAuB,WACnD,EAAE,qBACH,CAAC;AAAA,IACP,wBACE,EAAE,0BAA0B,OAAO,EAAE,2BAA2B,WAC3D,EAAE,yBACH,CAAC;AAAA,IACP,aAAa,MAAM,QAAQ,EAAE,WAAW,IACnC,EAAE,cACH,CAAC;AAAA,EACP;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/define.ts","../src/fetchers.ts"],"sourcesContent":["/**\n * Public entry — transport-agnostic. Use this in non-React code\n * (Node, scripts, edge workers). React hosts should import from\n * `snipe-auth-rbac/react`.\n */\n\nexport type {\n  Action,\n  AuthRbacFetcher,\n  CompanyMembership,\n  DependencyEdge,\n  DirectGrantMap,\n  FrontendConfig,\n  PermissionGrid,\n  PermissionMap,\n  ResourceDescriptor,\n  ResourceRegistry,\n  ResourceScope,\n  RoleSummary,\n  UserProfile,\n} from \"./types.js\";\n\nexport {\n  buildPermissionResolver,\n  groupResources,\n  type AuthRbacClient,\n  type CanOptions,\n  type ClientOptions,\n} from \"./client.js\";\n\nexport { RbacRegistryError } from \"./define.js\";\n\nexport {\n  createSupabaseFetcher,\n  createHttpFetcher,\n  detectRbacSchema,\n} from \"./fetchers.js\";\n","/**\n * Transport-agnostic client: turns an adopter-supplied\n * `AuthRbacFetcher` into a permission resolver. The React provider\n * wraps this; non-React consumers (Node scripts, edge functions)\n * can use it directly.\n */\n\nimport type {\n  Action,\n  AuthRbacFetcher,\n  PermissionMap,\n  ResourceDescriptor,\n  ResourceRegistry,\n  ResourceScope,\n  UserProfile,\n} from \"./types.js\";\n\nexport interface AuthRbacClientOptions {\n  fetcher: AuthRbacFetcher;\n  /**\n   * The host project's full resource list. Required so the resolver\n   * can look up a resource's scope without a DB round-trip per call.\n   * Re-using the same array the host syncs into the\n   * `rbac.resources` table at boot keeps everything in lockstep.\n   */\n  resources: ResourceRegistry;\n}\n\nexport interface CanOptions {\n  /**\n   * Override the active company. Omit to use the company the\n   * caller has currently activated (the React provider tracks\n   * this; for direct client use you must pass it).\n   */\n  companyId?: string | null;\n}\n\n/**\n * Pure resolver. Given a hydrated profile it answers boolean\n * questions instantly — no I/O. The `resourceMap` is built once at\n * construction so per-call work is two map lookups.\n */\nexport function buildPermissionResolver(\n  resources: ResourceRegistry,\n  profile: UserProfile,\n  defaultCompanyId: string | null,\n) {\n  const scopeByResource = new Map<string, ResourceScope>(\n    resources.map((r) => [r.resource, r.scope]),\n  );\n\n  const can = (\n    resource: string,\n    action: Action,\n    options?: CanOptions,\n  ): boolean => {\n    if (profile.is_super_admin) {\n      return true;\n    }\n    const scope = scopeByResource.get(resource);\n    if (!scope) {\n      // Unknown resource — fail closed.\n      return false;\n    }\n    if (scope === \"system\") {\n      return readGrid(profile.system_permissions, resource, action);\n    }\n    const companyId = options?.companyId ?? defaultCompanyId;\n    if (!companyId) {\n      return false;\n    }\n    const membership = profile.memberships.find(\n      (m) => m.company_id === companyId,\n    );\n    if (!membership) {\n      return false;\n    }\n    return readGrid(membership.permissions, resource, action);\n  };\n\n  /**\n   * Direct-grant lookup: returns true only if the user has the\n   * action granted on the resource as a direct admin grant —\n   * `<action>_granted_via IS NULL` in `rbac.role_permissions`.\n   * Implied rows (granted as a side-effect of a parent resource's\n   * `dependsOn` cascade) return false here.\n   *\n   * Use for top-level navigation / list-page gating: a Verwalter\n   * with only `leases:read` direct gets the Leases sidebar item but\n   * not Tenants / Units / Properties, even though `can(...)` returns\n   * true for those (because the implied rows let the lease detail\n   * page render its joined data).\n   *\n   * Available since 0.4.0. For older SQL that doesn't return\n   * `direct_*` maps, every cell answers false — equivalent to\n   * \"no direct grants known\". Adopters running pre-0.4.0 SQL should\n   * keep using `can(...)`.\n   */\n  const canAccessSection = (\n    resource: string,\n    action: Action = \"read\",\n    options?: CanOptions,\n  ): boolean => {\n    if (profile.is_super_admin) {\n      return true;\n    }\n    const scope = scopeByResource.get(resource);\n    if (!scope) {\n      return false;\n    }\n    if (scope === \"system\") {\n      return readDirect(profile, action, resource);\n    }\n    const companyId = options?.companyId ?? defaultCompanyId;\n    if (!companyId) {\n      return false;\n    }\n    const membership = profile.memberships.find(\n      (m) => m.company_id === companyId,\n    );\n    if (!membership) {\n      return false;\n    }\n    return readDirectMembership(membership, action, resource);\n  };\n\n  return {\n    can,\n    canAccessSection,\n    /** Permission map for the active (or specified) company. */\n    activePermissions: (companyId?: string | null): PermissionMap => {\n      const id = companyId ?? defaultCompanyId;\n      if (!id) {\n        return {};\n      }\n      return (\n        profile.memberships.find((m) => m.company_id === id)?.permissions ?? {}\n      );\n    },\n    systemPermissions: (): PermissionMap => profile.system_permissions,\n  };\n}\n\nfunction readDirect(\n  profile: UserProfile,\n  action: Action,\n  resource: string,\n): boolean {\n  const map =\n    action === \"read\"\n      ? profile.system_direct_reads\n      : action === \"write\"\n        ? profile.system_direct_writes\n        : action === \"update\"\n          ? profile.system_direct_updates\n          : profile.system_direct_deletes;\n  return map?.[resource] === true;\n}\n\nfunction readDirectMembership(\n  membership: { direct_reads?: Readonly<Record<string, boolean>>;\n                direct_writes?: Readonly<Record<string, boolean>>;\n                direct_updates?: Readonly<Record<string, boolean>>;\n                direct_deletes?: Readonly<Record<string, boolean>>; },\n  action: Action,\n  resource: string,\n): boolean {\n  const map =\n    action === \"read\"\n      ? membership.direct_reads\n      : action === \"write\"\n        ? membership.direct_writes\n        : action === \"update\"\n          ? membership.direct_updates\n          : membership.direct_deletes;\n  return map?.[resource] === true;\n}\n\nfunction readGrid(\n  map: PermissionMap,\n  resource: string,\n  action: Action,\n): boolean {\n  const grid = map[resource];\n  if (!grid) {\n    return false;\n  }\n  return grid[action];\n}\n\n/**\n * Helper: groups a resource registry by `group` for the matrix UI.\n * Returns groups in insertion order with their resources.\n */\nexport function groupResources(\n  registry: ResourceRegistry,\n): Array<{ group: string; resources: ResourceDescriptor[] }> {\n  const order: string[] = [];\n  const buckets = new Map<string, ResourceDescriptor[]>();\n  for (const r of registry) {\n    const key = r.group ?? \"Sonstige\";\n    if (!buckets.has(key)) {\n      buckets.set(key, []);\n      order.push(key);\n    }\n    buckets.get(key)!.push(r);\n  }\n  return order.map((g) => ({ group: g, resources: buckets.get(g)! }));\n}\n\nexport type AuthRbacClient = ReturnType<typeof buildPermissionResolver>;\nexport type { AuthRbacClientOptions as ClientOptions };\n","/**\n * Typed factory — turns a const-asserted resource registry into a\n * set of hooks/components whose `resource` arg is constrained to\n * the registered names. Typos become TypeScript errors instead of\n * silent runtime `false`.\n *\n * @example\n *   // src/auth/resources.ts\n *   import { defineAuthRbac } from \"snipe-auth-rbac/react\";\n *\n *   export const RESOURCES = [\n *     { resource: \"properties\", scope: \"company\", label: \"Liegenschaften\", group: \"Stammdaten\" },\n *     { resource: \"payments\",   scope: \"company\", label: \"Zahlungen\",     group: \"Finanzen\" },\n *     { resource: \"system_audit\", scope: \"system\",  label: \"Audit-Log\",    group: \"Plattform\" },\n *   ] as const;\n *\n *   export const { useCan, Can, RequirePermission } = defineAuthRbac(RESOURCES);\n *\n *   // ----- elsewhere -----\n *   useCan(\"properties\", \"update\");       // ✓\n *   useCan(\"paymetns\", \"update\");          // ✗ TS error: not assignable to type \"properties\" | \"payments\" | \"system_audit\"\n */\n\nimport type { ComponentType, ReactNode } from \"react\";\n\nimport type {\n  Action,\n  DependencyEdge,\n  ResourceDescriptor,\n  ResourceRegistry,\n} from \"./types.js\";\n\n/**\n * Thrown by `defineAuthRbac` when the registry contains a cycle in\n * its `dependsOn` graph. The cycle path is included in the message,\n * named in registry order.\n */\nexport class RbacRegistryError extends Error {\n  constructor(message: string) {\n    super(`auth-rbac: ${message}`);\n    this.name = \"RbacRegistryError\";\n  }\n}\n\n/**\n * Walks the `dependsOn` graph with three-colour DFS and throws on\n * the first back-edge. Runs once at module-init time, so misconfigured\n * registries fail loud at app boot rather than corrupting the matrix\n * at first toggle.\n */\nfunction detectDependencyCycles(registry: ResourceRegistry): void {\n  const WHITE = 0;\n  const GREY = 1;\n  const BLACK = 2;\n  const colour = new Map<string, number>();\n  const byName = new Map<string, ResourceDescriptor>();\n  for (const r of registry) {\n    byName.set(r.resource, r);\n    colour.set(r.resource, WHITE);\n  }\n  const stack: string[] = [];\n\n  const edgeTarget = (edge: string | DependencyEdge): string =>\n    typeof edge === \"string\" ? edge : edge.resource;\n\n  function visit(name: string): void {\n    const state = colour.get(name);\n    if (state === BLACK) {\n      return;\n    }\n    if (state === GREY) {\n      const cycleStart = stack.indexOf(name);\n      const cycle = [...stack.slice(cycleStart), name].join(\" → \");\n      throw new RbacRegistryError(\n        `dependency cycle detected in resource registry: ${cycle}`,\n      );\n    }\n    if (state === undefined) {\n      // Dangling edge — referenced resource not in registry. Treat\n      // as a registration error so adopters fix the typo at boot.\n      throw new RbacRegistryError(\n        `dependsOn target '${name}' is not a registered resource ` +\n          `(referenced by '${stack[stack.length - 1] ?? \"<root>\"}')`,\n      );\n    }\n    colour.set(name, GREY);\n    stack.push(name);\n    const descriptor = byName.get(name);\n    const edges = descriptor?.dependsOn ?? [];\n    for (const edge of edges) {\n      visit(edgeTarget(edge));\n    }\n    stack.pop();\n    colour.set(name, BLACK);\n  }\n\n  for (const r of registry) {\n    visit(r.resource);\n  }\n}\n\n/**\n * Drop-in replacement signatures for the three guards, with a\n * narrowed `resource` arg.\n */\nexport interface TypedGuards<R extends string> {\n  useCan: (\n    resource: R,\n    action: Action,\n    options?: { companyId?: string | null },\n  ) => boolean;\n  /**\n   * `useCan` for sidebar / list-page access: returns true only when\n   * the user holds the action on the resource as a **direct** grant\n   * (no `<action>_granted_via`). Implied rows answer false here.\n   *\n   * `action` defaults to `'read'` because the canonical use is\n   * top-level-nav gating. Available since 0.4.0.\n   */\n  useCanAccessSection: (\n    resource: R,\n    action?: Action,\n    options?: { companyId?: string | null },\n  ) => boolean;\n  Can: ComponentType<{\n    resource: R;\n    action: Action;\n    companyId?: string | null;\n    children: ReactNode;\n    fallback?: ReactNode;\n  }>;\n  RequirePermission: ComponentType<{\n    resource: R;\n    action: Action;\n    companyId?: string | null;\n    loadingFallback?: ReactNode;\n    deniedFallback?: ReactNode;\n    children?: ReactNode;\n  }>;\n  /** The const-asserted registry, re-exported so call-sites can iterate. */\n  resources: ResourceRegistry;\n  /** All registered resource names as a union — handy for typing\n   *  application-side data structures. */\n  resourceNames: ReadonlyArray<R>;\n}\n\n/**\n * Factory. Run once at module-init time in your host project; the\n * returned hooks/components are referentially stable.\n */\nexport function defineAuthRbac<\n  const Reg extends ReadonlyArray<ResourceDescriptor>,\n>(\n  resources: Reg,\n  // The runtime guards live in the React entry; we accept them\n  // here as plain refs so this module stays React-free at the type\n  // level. The `react` entry calls this factory passing its own\n  // exports so adopters never see the wiring.\n  runtime: {\n    useCan: TypedGuards<string>[\"useCan\"];\n    useCanAccessSection: TypedGuards<string>[\"useCanAccessSection\"];\n    Can: TypedGuards<string>[\"Can\"];\n    RequirePermission: TypedGuards<string>[\"RequirePermission\"];\n  },\n): TypedGuards<Reg[number][\"resource\"]> {\n  // Cycle detection runs once at module-init time so misconfigured\n  // registries fail at app boot, not on the first matrix toggle.\n  detectDependencyCycles(resources);\n\n  type R = Reg[number][\"resource\"];\n  return {\n    useCan: runtime.useCan as TypedGuards<R>[\"useCan\"],\n    useCanAccessSection: runtime.useCanAccessSection as TypedGuards<R>[\"useCanAccessSection\"],\n    Can: runtime.Can as TypedGuards<R>[\"Can\"],\n    RequirePermission: runtime.RequirePermission as TypedGuards<R>[\"RequirePermission\"],\n    resources,\n    resourceNames: resources.map((r) => r.resource) as ReadonlyArray<R>,\n  };\n}\n","/**\n * Built-in fetchers — adopters can use these or pass their own\n * implementation of `AuthRbacFetcher`.\n */\n\nimport type { AuthRbacFetcher, UserProfile } from \"./types.js\";\n\n/**\n * Calls the package's SQL function `rbac.user_profile(uuid)` via\n * a Supabase JS client. Easiest path when the host project already\n * uses Supabase.\n *\n * The function lives in the dedicated `rbac` Postgres schema, so the\n * adopter must add `rbac` to their PostgREST exposed-schemas list\n * (Supabase Studio → Settings → API → Exposed schemas) for the\n * `.schema('rbac')` call below to reach it.\n *\n * @example\n * createSupabaseFetcher({ supabase, userId: session.user.id })\n */\nexport function createSupabaseFetcher(opts: {\n  supabase: {\n    schema: (name: string) => {\n      rpc: (\n        fn: string,\n        args: Record<string, unknown>,\n      ) => Promise<{ data: unknown; error: { message: string } | null }>;\n    };\n  };\n  userId: string;\n}): AuthRbacFetcher {\n  return {\n    async fetchProfile(): Promise<UserProfile> {\n      const { data, error } = await opts.supabase.schema(\"rbac\").rpc(\n        \"user_profile\",\n        { p_user_id: opts.userId },\n      );\n      if (error) {\n        throw new Error(\n          `auth-rbac: failed to load user profile via Supabase RPC: ${error.message}`,\n        );\n      }\n      return normalizeProfile(data);\n    },\n  };\n}\n\n/**\n * Cheap probe — returns true if the package's `rbac` schema looks\n * reachable. Useful at app start to fail loudly if the migration\n * hasn't been applied OR if `rbac` isn't in the project's PostgREST\n * exposed-schemas list.\n *\n * @example\n * if (!(await detectRbacSchema(supabase))) {\n *   console.error(\"rbac schema not reachable — apply 0001_initial.sql\");\n * }\n */\nexport async function detectRbacSchema(supabase: {\n  schema: (name: string) => {\n    rpc: (\n      fn: string,\n      args: Record<string, unknown>,\n    ) => Promise<{ data: unknown; error: { message: string } | null }>;\n  };\n}): Promise<boolean> {\n  try {\n    const { error } = await supabase.schema(\"rbac\").rpc(\"user_can\", {\n      p_user_id: \"00000000-0000-0000-0000-000000000000\",\n      p_resource: \"__rbac_self_check__\",\n      p_action: \"read\",\n      p_company_id: null,\n    });\n    return error === null;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Calls a regular HTTP endpoint that returns a `UserProfile` JSON\n * payload. Use this when the host project has its own backend that\n * wraps the package's Python helpers (or any equivalent).\n *\n * @example\n * createHttpFetcher({ url: \"/api/users/me/profile\" })\n */\nexport function createHttpFetcher(opts: {\n  url: string;\n  /** Forwarded as-is to `fetch`. Use this to attach auth headers. */\n  init?: RequestInit;\n  /** Override the global `fetch` if you're in a non-browser env. */\n  fetch?: typeof fetch;\n}): AuthRbacFetcher {\n  const fetchImpl = opts.fetch ?? globalThis.fetch;\n  return {\n    async fetchProfile(): Promise<UserProfile> {\n      const res = await fetchImpl(opts.url, opts.init);\n      if (!res.ok) {\n        throw new Error(\n          `auth-rbac: profile endpoint ${opts.url} returned ${res.status}`,\n        );\n      }\n      const json = (await res.json()) as unknown;\n      return normalizeProfile(json);\n    },\n  };\n}\n\n/**\n * Defensive normalisation: the Supabase RPC returns whatever the SQL\n * function emitted. We coerce missing fields into the empty defaults\n * so consumers can iterate without null checks. Throws if the shape\n * is unrecognisable.\n */\nfunction normalizeProfile(raw: unknown): UserProfile {\n  if (!raw || typeof raw !== \"object\") {\n    throw new Error(\"auth-rbac: profile payload is not an object\");\n  }\n  const p = raw as Partial<UserProfile> & Record<string, unknown>;\n  if (typeof p.user_id !== \"string\") {\n    throw new Error(\"auth-rbac: profile payload missing user_id\");\n  }\n  return {\n    user_id: p.user_id,\n    is_super_admin: !!p.is_super_admin,\n    system_roles: Array.isArray(p.system_roles) ? p.system_roles : [],\n    system_permissions:\n      p.system_permissions && typeof p.system_permissions === \"object\"\n        ? (p.system_permissions as UserProfile[\"system_permissions\"])\n        : {},\n    system_frontend_config:\n      p.system_frontend_config && typeof p.system_frontend_config === \"object\"\n        ? (p.system_frontend_config as UserProfile[\"system_frontend_config\"])\n        : {},\n    memberships: Array.isArray(p.memberships)\n      ? (p.memberships as UserProfile[\"memberships\"])\n      : [],\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC0CO,SAAS,wBACd,WACA,SACA,kBACA;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC;AAAA,EAC5C;AAEA,QAAM,MAAM,CACV,UACA,QACA,YACY;AACZ,QAAI,QAAQ,gBAAgB;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,gBAAgB,IAAI,QAAQ;AAC1C,QAAI,CAAC,OAAO;AAEV,aAAO;AAAA,IACT;AACA,QAAI,UAAU,UAAU;AACtB,aAAO,SAAS,QAAQ,oBAAoB,UAAU,MAAM;AAAA,IAC9D;AACA,UAAM,YAAY,SAAS,aAAa;AACxC,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,IACT;AACA,UAAM,aAAa,QAAQ,YAAY;AAAA,MACrC,CAAC,MAAM,EAAE,eAAe;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,IACT;AACA,WAAO,SAAS,WAAW,aAAa,UAAU,MAAM;AAAA,EAC1D;AAoBA,QAAM,mBAAmB,CACvB,UACA,SAAiB,QACjB,YACY;AACZ,QAAI,QAAQ,gBAAgB;AAC1B,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,gBAAgB,IAAI,QAAQ;AAC1C,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,IACT;AACA,QAAI,UAAU,UAAU;AACtB,aAAO,WAAW,SAAS,QAAQ,QAAQ;AAAA,IAC7C;AACA,UAAM,YAAY,SAAS,aAAa;AACxC,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,IACT;AACA,UAAM,aAAa,QAAQ,YAAY;AAAA,MACrC,CAAC,MAAM,EAAE,eAAe;AAAA,IAC1B;AACA,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,IACT;AACA,WAAO,qBAAqB,YAAY,QAAQ,QAAQ;AAAA,EAC1D;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA;AAAA,IAEA,mBAAmB,CAAC,cAA6C;AAC/D,YAAM,KAAK,aAAa;AACxB,UAAI,CAAC,IAAI;AACP,eAAO,CAAC;AAAA,MACV;AACA,aACE,QAAQ,YAAY,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC;AAAA,IAE1E;AAAA,IACA,mBAAmB,MAAqB,QAAQ;AAAA,EAClD;AACF;AAEA,SAAS,WACP,SACA,QACA,UACS;AACT,QAAM,MACJ,WAAW,SACP,QAAQ,sBACR,WAAW,UACT,QAAQ,uBACR,WAAW,WACT,QAAQ,wBACR,QAAQ;AAClB,SAAO,MAAM,QAAQ,MAAM;AAC7B;AAEA,SAAS,qBACP,YAIA,QACA,UACS;AACT,QAAM,MACJ,WAAW,SACP,WAAW,eACX,WAAW,UACT,WAAW,gBACX,WAAW,WACT,WAAW,iBACX,WAAW;AACrB,SAAO,MAAM,QAAQ,MAAM;AAC7B;AAEA,SAAS,SACP,KACA,UACA,QACS;AACT,QAAM,OAAO,IAAI,QAAQ;AACzB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,SAAO,KAAK,MAAM;AACpB;AAMO,SAAS,eACd,UAC2D;AAC3D,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAU,oBAAI,IAAkC;AACtD,aAAW,KAAK,UAAU;AACxB,UAAM,MAAM,EAAE,SAAS;AACvB,QAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,cAAQ,IAAI,KAAK,CAAC,CAAC;AACnB,YAAM,KAAK,GAAG;AAAA,IAChB;AACA,YAAQ,IAAI,GAAG,EAAG,KAAK,CAAC;AAAA,EAC1B;AACA,SAAO,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,QAAQ,IAAI,CAAC,EAAG,EAAE;AACpE;;;AC3KO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,SAAiB;AAC3B,UAAM,cAAc,OAAO,EAAE;AAC7B,SAAK,OAAO;AAAA,EACd;AACF;;;ACtBO,SAAS,sBAAsB,MAUlB;AAClB,SAAO;AAAA,IACL,MAAM,eAAqC;AACzC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,SAAS,OAAO,MAAM,EAAE;AAAA,QACzD;AAAA,QACA,EAAE,WAAW,KAAK,OAAO;AAAA,MAC3B;AACA,UAAI,OAAO;AACT,cAAM,IAAI;AAAA,UACR,4DAA4D,MAAM,OAAO;AAAA,QAC3E;AAAA,MACF;AACA,aAAO,iBAAiB,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAaA,eAAsB,iBAAiB,UAOlB;AACnB,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,SAAS,OAAO,MAAM,EAAE,IAAI,YAAY;AAAA,MAC9D,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,cAAc;AAAA,IAChB,CAAC;AACD,WAAO,UAAU;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUO,SAAS,kBAAkB,MAMd;AAClB,QAAM,YAAY,KAAK,SAAS,WAAW;AAC3C,SAAO;AAAA,IACL,MAAM,eAAqC;AACzC,YAAM,MAAM,MAAM,UAAU,KAAK,KAAK,KAAK,IAAI;AAC/C,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI;AAAA,UACR,+BAA+B,KAAK,GAAG,aAAa,IAAI,MAAM;AAAA,QAChE;AAAA,MACF;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,aAAO,iBAAiB,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAQA,SAAS,iBAAiB,KAA2B;AACnD,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,YAAY,UAAU;AACjC,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,SAAS,EAAE;AAAA,IACX,gBAAgB,CAAC,CAAC,EAAE;AAAA,IACpB,cAAc,MAAM,QAAQ,EAAE,YAAY,IAAI,EAAE,eAAe,CAAC;AAAA,IAChE,oBACE,EAAE,sBAAsB,OAAO,EAAE,uBAAuB,WACnD,EAAE,qBACH,CAAC;AAAA,IACP,wBACE,EAAE,0BAA0B,OAAO,EAAE,2BAA2B,WAC3D,EAAE,yBACH,CAAC;AAAA,IACP,aAAa,MAAM,QAAQ,EAAE,WAAW,IACnC,EAAE,cACH,CAAC;AAAA,EACP;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,118 +1,3 @@
-import { c as ResourceRegistry, U as UserProfile, A as Action, d as PermissionMap, b as AuthRbacFetcher, a as ResourceDescriptor } from './types-DxvFudPF.cjs';
-export { C as CompanyMembership, F as FrontendConfig, P as PermissionGrid, R as ResourceScope, e as RoleSummary } from './types-DxvFudPF.cjs';
-
-/**
- * Transport-agnostic client: turns an adopter-supplied
- * `AuthRbacFetcher` into a permission resolver. The React provider
- * wraps this; non-React consumers (Node scripts, edge functions)
- * can use it directly.
- */
-
-interface AuthRbacClientOptions {
-    fetcher: AuthRbacFetcher;
-    /**
-     * The host project's full resource list. Required so the resolver
-     * can look up a resource's scope without a DB round-trip per call.
-     * Re-using the same array the host syncs into the
-     * `rbac.resources` table at boot keeps everything in lockstep.
-     */
-    resources: ResourceRegistry;
-}
-interface CanOptions {
-    /**
-     * Override the active company. Omit to use the company the
-     * caller has currently activated (the React provider tracks
-     * this; for direct client use you must pass it).
-     */
-    companyId?: string | null;
-}
-/**
- * Pure resolver. Given a hydrated profile it answers boolean
- * questions instantly — no I/O. The `resourceMap` is built once at
- * construction so per-call work is two map lookups.
- */
-declare function buildPermissionResolver(resources: ResourceRegistry, profile: UserProfile, defaultCompanyId: string | null): {
-    can: (resource: string, action: Action, options?: CanOptions) => boolean;
-    /** Permission map for the active (or specified) company. */
-    activePermissions: (companyId?: string | null) => PermissionMap;
-    systemPermissions: () => PermissionMap;
-};
-/**
- * Helper: groups a resource registry by `group` for the matrix UI.
- * Returns groups in insertion order with their resources.
- */
-declare function groupResources(registry: ResourceRegistry): Array<{
-    group: string;
-    resources: ResourceDescriptor[];
-}>;
-type AuthRbacClient = ReturnType<typeof buildPermissionResolver>;
-
-/**
- * Built-in fetchers — adopters can use these or pass their own
- * implementation of `AuthRbacFetcher`.
- */
-
-/**
- * Calls the package's SQL function `rbac.user_profile(uuid)` via
- * a Supabase JS client. Easiest path when the host project already
- * uses Supabase.
- *
- * The function lives in the dedicated `rbac` Postgres schema, so the
- * adopter must add `rbac` to their PostgREST exposed-schemas list
- * (Supabase Studio → Settings → API → Exposed schemas) for the
- * `.schema('rbac')` call below to reach it.
- *
- * @example
- * createSupabaseFetcher({ supabase, userId: session.user.id })
- */
-declare function createSupabaseFetcher(opts: {
-    supabase: {
-        schema: (name: string) => {
-            rpc: (fn: string, args: Record<string, unknown>) => Promise<{
-                data: unknown;
-                error: {
-                    message: string;
-                } | null;
-            }>;
-        };
-    };
-    userId: string;
-}): AuthRbacFetcher;
-/**
- * Cheap probe — returns true if the package's `rbac` schema looks
- * reachable. Useful at app start to fail loudly if the migration
- * hasn't been applied OR if `rbac` isn't in the project's PostgREST
- * exposed-schemas list.
- *
- * @example
- * if (!(await detectRbacSchema(supabase))) {
- *   console.error("rbac schema not reachable — apply 0001_initial.sql");
- * }
- */
-declare function detectRbacSchema(supabase: {
-    schema: (name: string) => {
-        rpc: (fn: string, args: Record<string, unknown>) => Promise<{
-            data: unknown;
-            error: {
-                message: string;
-            } | null;
-        }>;
-    };
-}): Promise<boolean>;
-/**
- * Calls a regular HTTP endpoint that returns a `UserProfile` JSON
- * payload. Use this when the host project has its own backend that
- * wraps the package's Python helpers (or any equivalent).
- *
- * @example
- * createHttpFetcher({ url: "/api/users/me/profile" })
- */
-declare function createHttpFetcher(opts: {
-    url: string;
-    /** Forwarded as-is to `fetch`. Use this to attach auth headers. */
-    init?: RequestInit;
-    /** Override the global `fetch` if you're in a non-browser env. */
-    fetch?: typeof fetch;
-}): AuthRbacFetcher;
-
-export { Action, type AuthRbacClient, AuthRbacFetcher, type CanOptions, type AuthRbacClientOptions as ClientOptions, PermissionMap, ResourceDescriptor, ResourceRegistry, UserProfile, buildPermissionResolver, createHttpFetcher, createSupabaseFetcher, detectRbacSchema, groupResources };
+export { A as Action, b as AuthRbacFetcher, C as CompanyMembership, D as DependencyEdge, d as DirectGrantMap, F as FrontendConfig, P as PermissionGrid, e as PermissionMap, a as ResourceDescriptor, c as ResourceRegistry, R as ResourceScope, f as RoleSummary, U as UserProfile } from './types-Oj9yfWvz.cjs';
+export { A as AuthRbacClient, C as CanOptions, b as ClientOptions, R as RbacRegistryError, e as buildPermissionResolver, c as createHttpFetcher, a as createSupabaseFetcher, d as detectRbacSchema, g as groupResources } from './index-CJqb5nY5.cjs';
+import 'react';

package/dist/index.d.ts

@@ -1,118 +1,3 @@
-import { c as ResourceRegistry, U as UserProfile, A as Action, d as PermissionMap, b as AuthRbacFetcher, a as ResourceDescriptor } from './types-DxvFudPF.js';
-export { C as CompanyMembership, F as FrontendConfig, P as PermissionGrid, R as ResourceScope, e as RoleSummary } from './types-DxvFudPF.js';
-
-/**
- * Transport-agnostic client: turns an adopter-supplied
- * `AuthRbacFetcher` into a permission resolver. The React provider
- * wraps this; non-React consumers (Node scripts, edge functions)
- * can use it directly.
- */
-
-interface AuthRbacClientOptions {
-    fetcher: AuthRbacFetcher;
-    /**
-     * The host project's full resource list. Required so the resolver
-     * can look up a resource's scope without a DB round-trip per call.
-     * Re-using the same array the host syncs into the
-     * `rbac.resources` table at boot keeps everything in lockstep.
-     */
-    resources: ResourceRegistry;
-}
-interface CanOptions {
-    /**
-     * Override the active company. Omit to use the company the
-     * caller has currently activated (the React provider tracks
-     * this; for direct client use you must pass it).
-     */
-    companyId?: string | null;
-}
-/**
- * Pure resolver. Given a hydrated profile it answers boolean
- * questions instantly — no I/O. The `resourceMap` is built once at
- * construction so per-call work is two map lookups.
- */
-declare function buildPermissionResolver(resources: ResourceRegistry, profile: UserProfile, defaultCompanyId: string | null): {
-    can: (resource: string, action: Action, options?: CanOptions) => boolean;
-    /** Permission map for the active (or specified) company. */
-    activePermissions: (companyId?: string | null) => PermissionMap;
-    systemPermissions: () => PermissionMap;
-};
-/**
- * Helper: groups a resource registry by `group` for the matrix UI.
- * Returns groups in insertion order with their resources.
- */
-declare function groupResources(registry: ResourceRegistry): Array<{
-    group: string;
-    resources: ResourceDescriptor[];
-}>;
-type AuthRbacClient = ReturnType<typeof buildPermissionResolver>;
-
-/**
- * Built-in fetchers — adopters can use these or pass their own
- * implementation of `AuthRbacFetcher`.
- */
-
-/**
- * Calls the package's SQL function `rbac.user_profile(uuid)` via
- * a Supabase JS client. Easiest path when the host project already
- * uses Supabase.
- *
- * The function lives in the dedicated `rbac` Postgres schema, so the
- * adopter must add `rbac` to their PostgREST exposed-schemas list
- * (Supabase Studio → Settings → API → Exposed schemas) for the
- * `.schema('rbac')` call below to reach it.
- *
- * @example
- * createSupabaseFetcher({ supabase, userId: session.user.id })
- */
-declare function createSupabaseFetcher(opts: {
-    supabase: {
-        schema: (name: string) => {
-            rpc: (fn: string, args: Record<string, unknown>) => Promise<{
-                data: unknown;
-                error: {
-                    message: string;
-                } | null;
-            }>;
-        };
-    };
-    userId: string;
-}): AuthRbacFetcher;
-/**
- * Cheap probe — returns true if the package's `rbac` schema looks
- * reachable. Useful at app start to fail loudly if the migration
- * hasn't been applied OR if `rbac` isn't in the project's PostgREST
- * exposed-schemas list.
- *
- * @example
- * if (!(await detectRbacSchema(supabase))) {
- *   console.error("rbac schema not reachable — apply 0001_initial.sql");
- * }
- */
-declare function detectRbacSchema(supabase: {
-    schema: (name: string) => {
-        rpc: (fn: string, args: Record<string, unknown>) => Promise<{
-            data: unknown;
-            error: {
-                message: string;
-            } | null;
-        }>;
-    };
-}): Promise<boolean>;
-/**
- * Calls a regular HTTP endpoint that returns a `UserProfile` JSON
- * payload. Use this when the host project has its own backend that
- * wraps the package's Python helpers (or any equivalent).
- *
- * @example
- * createHttpFetcher({ url: "/api/users/me/profile" })
- */
-declare function createHttpFetcher(opts: {
-    url: string;
-    /** Forwarded as-is to `fetch`. Use this to attach auth headers. */
-    init?: RequestInit;
-    /** Override the global `fetch` if you're in a non-browser env. */
-    fetch?: typeof fetch;
-}): AuthRbacFetcher;
-
-export { Action, type AuthRbacClient, AuthRbacFetcher, type CanOptions, type AuthRbacClientOptions as ClientOptions, PermissionMap, ResourceDescriptor, ResourceRegistry, UserProfile, buildPermissionResolver, createHttpFetcher, createSupabaseFetcher, detectRbacSchema, groupResources };
+export { A as Action, b as AuthRbacFetcher, C as CompanyMembership, D as DependencyEdge, d as DirectGrantMap, F as FrontendConfig, P as PermissionGrid, e as PermissionMap, a as ResourceDescriptor, c as ResourceRegistry, R as ResourceScope, f as RoleSummary, U as UserProfile } from './types-Oj9yfWvz.js';
+export { A as AuthRbacClient, C as CanOptions, b as ClientOptions, R as RbacRegistryError, e as buildPermissionResolver, c as createHttpFetcher, a as createSupabaseFetcher, d as detectRbacSchema, g as groupResources } from './index-nfrns9Ye.js';
+import 'react';

package/dist/index.js

@@ -1,13 +1,15 @@
 import {
+  RbacRegistryError,
   createHttpFetcher,
   createSupabaseFetcher,
   detectRbacSchema
-} from "./chunk-NRDW233A.js";
+} from "./chunk-5UAIIOKT.js";
 import {
   buildPermissionResolver,
   groupResources
-} from "./chunk-C76JHCKM.js";
+} from "./chunk-XHPBUCFN.js";
 export {
+  RbacRegistryError,
   buildPermissionResolver,
   createHttpFetcher,
   createSupabaseFetcher,