{"version":3,"file":"useRBAC.mjs","sources":["../../../../src/lib/auth/rbac/useRBAC.ts"],"sourcesContent":["/**\n * RBAC React Hook\n *\n * Comprehensive hook for Role-Based Access Control in React components.\n * Provides permission checking, role validation, and access control utilities.\n *\n * @module auth/rbac/useRBAC\n */\n\nimport { useContext, useCallback, useMemo } from 'react';\nimport { RBACContext } from './rbac-context';\nimport type {\n  Permission,\n  PermissionAction,\n  RoleDefinition,\n  AccessRequest,\n  EvaluationResult,\n} from './types';\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/**\n * Return type for the useRBAC hook.\n */\nexport interface UseRBACReturn {\n  // State\n  /** Whether RBAC is initialized */\n  initialized: boolean;\n  /** Whether RBAC is loading */\n  loading: boolean;\n  /** Current user's role IDs */\n  userRoles: string[];\n  /** Current user's direct permissions */\n  userPermissions: Permission[];\n  /** Any initialization error */\n  error: string | null;\n\n  // Permission Checking\n  /** Check if user has a permission */\n  hasPermission: (permission: Permission) => boolean;\n  /** Check if user has any of the permissions */\n  hasAnyPermission: (permissions: Permission[]) => boolean;\n  /** Check if user has all permissions */\n  hasAllPermissions: (permissions: Permission[]) => boolean;\n\n  // Role Checking\n  /** Check if user has a role */\n  hasRole: (role: string) => boolean;\n  /** Check if user has any of the roles */\n  hasAnyRole: (roles: string[]) => boolean;\n  /** Check if user has all roles */\n  hasAllRoles: (roles: string[]) => boolean;\n\n  // Resource Access\n  /** Check if user can access resource with action */\n  canAccess: (resource: string, action: PermissionAction, resourceId?: string) => boolean;\n  /** Check resource-level permission */\n  checkResourcePermission: (\n    resourceType: string,\n    resourceId: string,\n    action: PermissionAction\n  ) => boolean;\n  /** Full access evaluation */\n  evaluate: (request: AccessRequest) => EvaluationResult;\n\n  // Utilities\n  /** Get all effective permissions */\n  getEffectivePermissions: () => Permission[];\n  /** Get user's role definitions */\n  getRoleDefinitions: () => RoleDefinition[];\n  /** Refresh permissions from server */\n  refreshPermissions: () => Promise<void>;\n  /** Clear evaluation cache */\n  clearCache: () => void;\n\n  // Shorthand helpers\n  /** Check create permission for resource */\n  canCreate: (resource: string) => boolean;\n  /** Check read permission for resource */\n  canRead: (resource: string) => boolean;\n  /** Check update permission for resource */\n  canUpdate: (resource: string) => boolean;\n  /** Check delete permission for resource */\n  canDelete: (resource: string) => boolean;\n  /** Check manage permission for resource */\n  canManage: (resource: string) => boolean;\n  /** Check if user is admin */\n  isAdmin: boolean;\n  /** Check if user is manager */\n  isManager: boolean;\n}\n\n// =============================================================================\n// Main Hook\n// =============================================================================\n\n/**\n * Main RBAC hook for permission and role checking.\n *\n * @example\n * ```tsx\n * function DocumentsPage() {\n *   const {\n *     canCreate,\n *     canRead,\n *     canDelete,\n *     hasPermission,\n *     isAdmin,\n *   } = useRBAC();\n *\n *   return (\n *     <div>\n *       <h1>Documents</h1>\n *       {canRead('documents') && <DocumentList />}\n *       {canCreate('documents') && <CreateDocumentButton />}\n *       {hasPermission('documents:export') && <ExportButton />}\n *       {isAdmin && <AdminPanel />}\n *     </div>\n *   );\n * }\n * ```\n *\n * @returns RBAC utilities and state\n * @throws Error if used outside RBACProvider\n */\nexport function useRBAC(): UseRBACReturn {\n  const context = useContext(RBACContext);\n\n  if (!context) {\n    throw new Error('useRBAC must be used within an RBACProvider');\n  }\n\n  const {\n    initialized,\n    loading,\n    userRoles,\n    userPermissions,\n    error,\n    hasPermission,\n    hasAnyPermission,\n    hasAllPermissions,\n    hasRole,\n    hasAnyRole,\n    hasAllRoles,\n    canAccess,\n    evaluate,\n    getEffectivePermissions,\n    getRoleDefinitions,\n    refreshPermissions,\n    clearCache,\n    checkResourcePermission,\n  } = context;\n\n  // ===========================================================================\n  // Shorthand Helpers\n  // ===========================================================================\n\n  const canCreate = useCallback((resource: string) => canAccess(resource, 'create'), [canAccess]);\n\n  const canRead = useCallback((resource: string) => canAccess(resource, 'read'), [canAccess]);\n\n  const canUpdate = useCallback((resource: string) => canAccess(resource, 'update'), [canAccess]);\n\n  const canDelete = useCallback((resource: string) => canAccess(resource, 'delete'), [canAccess]);\n\n  const canManage = useCallback((resource: string) => canAccess(resource, 'manage'), [canAccess]);\n\n  const isAdmin = useMemo(() => hasAnyRole(['admin', 'super_admin', 'system_admin']), [hasAnyRole]);\n\n  const isManager = useMemo(() => hasAnyRole(['manager', 'admin', 'super_admin']), [hasAnyRole]);\n\n  return {\n    // State\n    initialized,\n    loading,\n    userRoles,\n    userPermissions,\n    error,\n\n    // Permission checking\n    hasPermission,\n    hasAnyPermission,\n    hasAllPermissions,\n\n    // Role checking\n    hasRole,\n    hasAnyRole,\n    hasAllRoles,\n\n    // Resource access\n    canAccess,\n    checkResourcePermission,\n    evaluate,\n\n    // Utilities\n    getEffectivePermissions,\n    getRoleDefinitions,\n    refreshPermissions,\n    clearCache,\n\n    // Shorthand helpers\n    canCreate,\n    canRead,\n    canUpdate,\n    canDelete,\n    canManage,\n    isAdmin,\n    isManager,\n  };\n}\n\n// =============================================================================\n// Specialized Hooks\n// =============================================================================\n\n/**\n * Hook for checking permissions only.\n *\n * @example\n * ```tsx\n * function SettingsPage() {\n *   const { hasPermission, hasAnyPermission } = usePermissions();\n *\n *   return (\n *     <div>\n *       {hasPermission('settings:view') && <GeneralSettings />}\n *       {hasAnyPermission(['settings:admin', 'settings:manage']) && (\n *         <AdvancedSettings />\n *       )}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function usePermissions(): {\n  permissions: Permission[];\n  effectivePermissions: Permission[];\n  hasPermission: (permission: Permission) => boolean;\n  hasAnyPermission: (permissions: Permission[]) => boolean;\n  hasAllPermissions: (permissions: Permission[]) => boolean;\n} {\n  const {\n    userPermissions,\n    hasPermission,\n    hasAnyPermission,\n    hasAllPermissions,\n    getEffectivePermissions,\n  } = useRBAC();\n\n  return {\n    permissions: userPermissions,\n    effectivePermissions: getEffectivePermissions(),\n    hasPermission,\n    hasAnyPermission,\n    hasAllPermissions,\n  };\n}\n\n/**\n * Hook for checking roles only.\n *\n * @example\n * ```tsx\n * function Dashboard() {\n *   const { hasRole, isAdmin, isManager } = useRoles();\n *\n *   return (\n *     <div>\n *       {isAdmin && <AdminDashboard />}\n *       {isManager && !isAdmin && <ManagerDashboard />}\n *       {!isManager && <UserDashboard />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useRoles(): {\n  roles: string[];\n  roleDefinitions: RoleDefinition[];\n  hasRole: (role: string) => boolean;\n  hasAnyRole: (roles: string[]) => boolean;\n  hasAllRoles: (roles: string[]) => boolean;\n  isAdmin: boolean;\n  isManager: boolean;\n} {\n  const { userRoles, hasRole, hasAnyRole, hasAllRoles, getRoleDefinitions, isAdmin, isManager } =\n    useRBAC();\n\n  return {\n    roles: userRoles,\n    roleDefinitions: getRoleDefinitions(),\n    hasRole,\n    hasAnyRole,\n    hasAllRoles,\n    isAdmin,\n    isManager,\n  };\n}\n\n/**\n * Hook for resource-level access control.\n *\n * @example\n * ```tsx\n * function DocumentViewer({ documentId }) {\n *   const { canAccess, checkResource } = useResourceAccess('documents');\n *\n *   const canView = checkResource(documentId, 'read');\n *   const canEdit = checkResource(documentId, 'update');\n *   const canDelete = checkResource(documentId, 'delete');\n *\n *   return (\n *     <div>\n *       {canView && <DocumentContent />}\n *       {canEdit && <EditButton />}\n *       {canDelete && <DeleteButton />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useResourceAccess(resourceType: string): {\n  resourceType: string;\n  canAccess: (action: PermissionAction) => boolean;\n  checkResource: (resourceId: string, action: PermissionAction) => boolean;\n  evaluateAccess: (\n    resourceId: string,\n    action: string,\n    context?: Record<string, unknown>\n  ) => EvaluationResult;\n  canCreate: () => boolean;\n  canRead: () => boolean;\n  canUpdate: () => boolean;\n  canDelete: () => boolean;\n  canManage: () => boolean;\n} {\n  const { canAccess, checkResourcePermission, evaluate } = useRBAC();\n\n  const checkResource = useCallback(\n    (resourceId: string, action: PermissionAction) =>\n      checkResourcePermission(resourceType, resourceId, action),\n    [checkResourcePermission, resourceType]\n  );\n\n  const canPerformAction = useCallback(\n    (action: PermissionAction) => canAccess(resourceType, action),\n    [canAccess, resourceType]\n  );\n\n  const evaluateAccess = useCallback(\n    (resourceId: string, action: string, context?: Record<string, unknown>) =>\n      evaluate({\n        subject: {\n          id: 'current-user', // Will be resolved by engine\n          type: 'user',\n        },\n        resource: {\n          type: resourceType,\n          id: resourceId,\n          attributes: context,\n        },\n        action,\n      }),\n    [evaluate, resourceType]\n  );\n\n  return {\n    resourceType,\n    canAccess: canPerformAction,\n    checkResource,\n    evaluateAccess,\n    canCreate: () => canPerformAction('create'),\n    canRead: () => canPerformAction('read'),\n    canUpdate: () => canPerformAction('update'),\n    canDelete: () => canPerformAction('delete'),\n    canManage: () => canPerformAction('manage'),\n  };\n}\n\n/**\n * Hook for conditional rendering based on permission.\n *\n * @example\n * ```tsx\n * function AdminPanel() {\n *   const { allowed, loading } = usePermissionGate('admin:access');\n *\n *   if (loading) return <Spinner />;\n *   if (!allowed) return <AccessDenied />;\n *\n *   return <AdminContent />;\n * }\n * ```\n */\nexport function usePermissionGate(permission: Permission): { allowed: boolean; loading: boolean } {\n  const { loading, hasPermission } = useRBAC();\n\n  const allowed = useMemo(() => hasPermission(permission), [hasPermission, permission]);\n\n  return { allowed, loading };\n}\n\n/**\n * Hook for conditional rendering based on role.\n *\n * @example\n * ```tsx\n * function ManagerFeature() {\n *   const { allowed, loading } = useRoleGate(['manager', 'admin']);\n *\n *   if (loading) return <Spinner />;\n *   if (!allowed) return null;\n *\n *   return <ManagerContent />;\n * }\n * ```\n */\nexport function useRoleGate(roles: string | string[]): { allowed: boolean; loading: boolean } {\n  const { loading, hasRole, hasAnyRole } = useRBAC();\n\n  const allowed = useMemo(() => {\n    if (Array.isArray(roles)) {\n      return hasAnyRole(roles);\n    }\n    return hasRole(roles);\n  }, [hasRole, hasAnyRole, roles]);\n\n  return { allowed, loading };\n}\n\n/**\n * Hook for checking multiple permissions/roles at once.\n *\n * @example\n * ```tsx\n * function FeatureComponent() {\n *   const checks = useAccessChecks({\n *     canViewReports: { permission: 'reports:view' },\n *     canExport: { permission: 'reports:export' },\n *     isAdmin: { role: 'admin' },\n *     canManageUsers: { resource: 'users', action: 'manage' },\n *   });\n *\n *   return (\n *     <div>\n *       {checks.canViewReports && <ReportViewer />}\n *       {checks.canExport && <ExportButton />}\n *       {checks.isAdmin && <AdminSection />}\n *       {checks.canManageUsers && <UserManager />}\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useAccessChecks<\n  T extends Record<\n    string,\n    | { permission: Permission }\n    | { role: string }\n    | { roles: string[] }\n    | { resource: string; action: PermissionAction }\n  >,\n>(checks: T): Record<keyof T, boolean> {\n  const { hasPermission, hasRole, hasAnyRole, canAccess } = useRBAC();\n\n  return useMemo(() => {\n    const results: Record<string, boolean> = {};\n\n    for (const [key, check] of Object.entries(checks)) {\n      if ('permission' in check) {\n        results[key] = hasPermission(check.permission);\n      } else if ('roles' in check) {\n        results[key] = hasAnyRole(check.roles);\n      } else if ('role' in check) {\n        results[key] = hasRole(check.role);\n      } else if ('resource' in check) {\n        results[key] = canAccess(check.resource, check.action);\n      }\n    }\n\n    return results as Record<keyof T, boolean>;\n  }, [checks, hasPermission, hasRole, hasAnyRole, canAccess]);\n}\n"],"names":["useRBAC","context","useContext","RBACContext","initialized","loading","userRoles","userPermissions","error","hasPermission","hasAnyPermission","hasAllPermissions","hasRole","hasAnyRole","hasAllRoles","canAccess","evaluate","getEffectivePermissions","getRoleDefinitions","refreshPermissions","clearCache","checkResourcePermission","canCreate","useCallback","resource","canRead","canUpdate","canDelete","canManage","isAdmin","useMemo","isManager","usePermissions","useRoles","useResourceAccess","resourceType","checkResource","resourceId","action","canPerformAction","evaluateAccess","usePermissionGate","permission","useRoleGate","roles","useAccessChecks","checks","results","key","check"],"mappings":";;AA+HO,SAASA,IAAyB;AACvC,QAAMC,IAAUC,EAAWC,CAAW;AAEtC,MAAI,CAACF;AACH,UAAM,IAAI,MAAM,6CAA6C;AAG/D,QAAM;AAAA,IACJ,aAAAG;AAAA,IACA,SAAAC;AAAA,IACA,WAAAC;AAAA,IACA,iBAAAC;AAAA,IACA,OAAAC;AAAA,IACA,eAAAC;AAAA,IACA,kBAAAC;AAAA,IACA,mBAAAC;AAAA,IACA,SAAAC;AAAA,IACA,YAAAC;AAAA,IACA,aAAAC;AAAA,IACA,WAAAC;AAAA,IACA,UAAAC;AAAA,IACA,yBAAAC;AAAA,IACA,oBAAAC;AAAA,IACA,oBAAAC;AAAA,IACA,YAAAC;AAAA,IACA,yBAAAC;AAAA,EAAA,IACEpB,GAMEqB,IAAYC,EAAY,CAACC,MAAqBT,EAAUS,GAAU,QAAQ,GAAG,CAACT,CAAS,CAAC,GAExFU,IAAUF,EAAY,CAACC,MAAqBT,EAAUS,GAAU,MAAM,GAAG,CAACT,CAAS,CAAC,GAEpFW,IAAYH,EAAY,CAACC,MAAqBT,EAAUS,GAAU,QAAQ,GAAG,CAACT,CAAS,CAAC,GAExFY,IAAYJ,EAAY,CAACC,MAAqBT,EAAUS,GAAU,QAAQ,GAAG,CAACT,CAAS,CAAC,GAExFa,IAAYL,EAAY,CAACC,MAAqBT,EAAUS,GAAU,QAAQ,GAAG,CAACT,CAAS,CAAC,GAExFc,IAAUC,EAAQ,MAAMjB,EAAW,CAAC,SAAS,eAAe,cAAc,CAAC,GAAG,CAACA,CAAU,CAAC,GAE1FkB,IAAYD,EAAQ,MAAMjB,EAAW,CAAC,WAAW,SAAS,aAAa,CAAC,GAAG,CAACA,CAAU,CAAC;AAE7F,SAAO;AAAA;AAAA,IAEL,aAAAT;AAAA,IACA,SAAAC;AAAA,IACA,WAAAC;AAAA,IACA,iBAAAC;AAAA,IACA,OAAAC;AAAA;AAAA,IAGA,eAAAC;AAAA,IACA,kBAAAC;AAAA,IACA,mBAAAC;AAAA;AAAA,IAGA,SAAAC;AAAA,IACA,YAAAC;AAAA,IACA,aAAAC;AAAA;AAAA,IAGA,WAAAC;AAAA,IACA,yBAAAM;AAAA,IACA,UAAAL;AAAA;AAAA,IAGA,yBAAAC;AAAA,IACA,oBAAAC;AAAA,IACA,oBAAAC;AAAA,IACA,YAAAC;AAAA;AAAA,IAGA,WAAAE;AAAA,IACA,SAAAG;AAAA,IACA,WAAAC;AAAA,IACA,WAAAC;AAAA,IACA,WAAAC;AAAA,IACA,SAAAC;AAAA,IACA,WAAAE;AAAA,EAAA;AAEJ;AAyBO,SAASC,IAMd;AACA,QAAM;AAAA,IACJ,iBAAAzB;AAAA,IACA,eAAAE;AAAA,IACA,kBAAAC;AAAA,IACA,mBAAAC;AAAA,IACA,yBAAAM;AAAA,EAAA,IACEjB,EAAA;AAEJ,SAAO;AAAA,IACL,aAAaO;AAAA,IACb,sBAAsBU,EAAA;AAAA,IACtB,eAAAR;AAAA,IACA,kBAAAC;AAAA,IACA,mBAAAC;AAAA,EAAA;AAEJ;AAoBO,SAASsB,IAQd;AACA,QAAM,EAAE,WAAA3B,GAAW,SAAAM,GAAS,YAAAC,GAAY,aAAAC,GAAa,oBAAAI,GAAoB,SAAAW,GAAS,WAAAE,EAAA,IAChF/B,EAAA;AAEF,SAAO;AAAA,IACL,OAAOM;AAAA,IACP,iBAAiBY,EAAA;AAAA,IACjB,SAAAN;AAAA,IACA,YAAAC;AAAA,IACA,aAAAC;AAAA,IACA,SAAAe;AAAA,IACA,WAAAE;AAAA,EAAA;AAEJ;AAwBO,SAASG,EAAkBC,GAchC;AACA,QAAM,EAAE,WAAApB,GAAW,yBAAAM,GAAyB,UAAAL,EAAA,IAAahB,EAAA,GAEnDoC,IAAgBb;AAAA,IACpB,CAACc,GAAoBC,MACnBjB,EAAwBc,GAAcE,GAAYC,CAAM;AAAA,IAC1D,CAACjB,GAAyBc,CAAY;AAAA,EAAA,GAGlCI,IAAmBhB;AAAA,IACvB,CAACe,MAA6BvB,EAAUoB,GAAcG,CAAM;AAAA,IAC5D,CAACvB,GAAWoB,CAAY;AAAA,EAAA,GAGpBK,IAAiBjB;AAAA,IACrB,CAACc,GAAoBC,GAAgBrC,MACnCe,EAAS;AAAA,MACP,SAAS;AAAA,QACP,IAAI;AAAA;AAAA,QACJ,MAAM;AAAA,MAAA;AAAA,MAER,UAAU;AAAA,QACR,MAAMmB;AAAA,QACN,IAAIE;AAAA,QACJ,YAAYpC;AAAA,MAAA;AAAA,MAEd,QAAAqC;AAAA,IAAA,CACD;AAAA,IACH,CAACtB,GAAUmB,CAAY;AAAA,EAAA;AAGzB,SAAO;AAAA,IACL,cAAAA;AAAA,IACA,WAAWI;AAAA,IACX,eAAAH;AAAA,IACA,gBAAAI;AAAA,IACA,WAAW,MAAMD,EAAiB,QAAQ;AAAA,IAC1C,SAAS,MAAMA,EAAiB,MAAM;AAAA,IACtC,WAAW,MAAMA,EAAiB,QAAQ;AAAA,IAC1C,WAAW,MAAMA,EAAiB,QAAQ;AAAA,IAC1C,WAAW,MAAMA,EAAiB,QAAQ;AAAA,EAAA;AAE9C;AAiBO,SAASE,EAAkBC,GAAgE;AAChG,QAAM,EAAE,SAAArC,GAAS,eAAAI,EAAA,IAAkBT,EAAA;AAInC,SAAO,EAAE,SAFO8B,EAAQ,MAAMrB,EAAciC,CAAU,GAAG,CAACjC,GAAeiC,CAAU,CAAC,GAElE,SAAArC,EAAA;AACpB;AAiBO,SAASsC,EAAYC,GAAkE;AAC5F,QAAM,EAAE,SAAAvC,GAAS,SAAAO,GAAS,YAAAC,EAAA,IAAeb,EAAA;AASzC,SAAO,EAAE,SAPO8B,EAAQ,MAClB,MAAM,QAAQc,CAAK,IACd/B,EAAW+B,CAAK,IAElBhC,EAAQgC,CAAK,GACnB,CAAChC,GAASC,GAAY+B,CAAK,CAAC,GAEb,SAAAvC,EAAA;AACpB;AA0BO,SAASwC,EAQdC,GAAqC;AACrC,QAAM,EAAE,eAAArC,GAAe,SAAAG,GAAS,YAAAC,GAAY,WAAAE,EAAA,IAAcf,EAAA;AAE1D,SAAO8B,EAAQ,MAAM;AACnB,UAAMiB,IAAmC,CAAA;AAEzC,eAAW,CAACC,GAAKC,CAAK,KAAK,OAAO,QAAQH,CAAM;AAC9C,MAAI,gBAAgBG,IAClBF,EAAQC,CAAG,IAAIvC,EAAcwC,EAAM,UAAU,IACpC,WAAWA,IACpBF,EAAQC,CAAG,IAAInC,EAAWoC,EAAM,KAAK,IAC5B,UAAUA,IACnBF,EAAQC,CAAG,IAAIpC,EAAQqC,EAAM,IAAI,IACxB,cAAcA,MACvBF,EAAQC,CAAG,IAAIjC,EAAUkC,EAAM,UAAUA,EAAM,MAAM;AAIzD,WAAOF;AAAA,EACT,GAAG,CAACD,GAAQrC,GAAeG,GAASC,GAAYE,CAAS,CAAC;AAC5D;"}