import { Button, Logo } from "@godxjp/ui/general"; import { AppShell, ErrorSurface, Flex, PageContainer, Sidebar, type SidebarSectionProp, Topbar, } from "@godxjp/ui/layout"; import { AppSettingPicker } from "@godxjp/ui/navigation"; import { BarChart3, FileText, LayoutDashboard, Users } from "lucide-react"; /** * 403 — `mode="application"`. The failure happened INSIDE the authenticated app, so the app shell is * PRESERVED: the sidebar nav, the topbar and the breadcrumb all survive, and only the page body is * replaced. The user is never stranded on a chrome-less page with a single "go home" button. * * READ THE MODE CONTRACT: `mode="application"` does NOT make the component build a shell. It cannot * — the nav sections, the product identity and the user menu are consumer-owned data. The mode says * "this is what you put in AppShell's children": the surface returns just its own block, and the * `AppShell` the route already renders stays mounted around it. * * 403 is the one status where WHY matters as much as WHAT, so both permission slots are used here: * `permission` names the missing role and `organization` names the workspace the request was scoped * to — that pair is what distinguishes "you need a role" from "you are in the wrong tenant". Both * are semantic `