// roles.ts
import { defineRoles } from "secure-role-guard";

export const roleRegistry = defineRoles({
  superadmin: ["*"], // Full access
  admin: ["user.read", "user.update", "user.delete", "report.view"],
  manager: ["user.read", "report.*"], // Namespace wildcard
  support: ["ticket.read", "ticket.reply"],
  viewer: ["user.read"],
});

import { canUser } from "secure-role-guard";
import { roleRegistry } from "./roles";

// Your user context (from your auth system)
const user = {
  userId: "user-123",
  roles: ["admin"],
  permissions: ["custom.feature"], // Direct permissions
};

// Simple checks
canUser(user, "user.update", roleRegistry); // true
canUser(user, "user.delete", roleRegistry); // true
canUser(user, "billing.access", roleRegistry); // false (deny by default)

const registry = defineRoles({
  admin: ["user.read", "user.update"],
  viewer: ["user.read"],
});

const allowed = canUser(user, "user.update", registry);

const allowed = canUserAll(user, ["user.read", "user.update"], registry);

const allowed = canUserAny(
  user,
  ["admin.access", "moderator.access"],
  registry
);

type UserContext = {
  userId?: string; // Optional user identifier
  roles?: string[]; // Array of role names
  permissions?: string[]; // Direct permissions (bypass roles)
  meta?: Record<string, unknown>; // Custom metadata (tenant, org, etc.)
};

// server.ts
import express from "express";
import { defineRoles } from "secure-role-guard/core";
import { requirePermission } from "secure-role-guard/adapters/express";

const app = express();

// Define roles (same as frontend)
const roleRegistry = defineRoles({
  admin: ["user.read", "user.update", "user.delete"],
  viewer: ["user.read"],
});

// YOUR auth middleware (not from this package)
app.use(authMiddleware); // Sets req.user

// Protected routes
app.get(
  "/api/users",
  requirePermission("user.read", roleRegistry),
  (req, res) => {
    res.json({ users: [] });
  }
);

app.put(
  "/api/users/:id",
  requirePermission("user.update", roleRegistry),
  (req, res) => {
    res.json({ success: true });
  }
);

app.delete(
  "/api/users/:id",
  requirePermission("user.delete", roleRegistry),
  (req, res) => {
    res.json({ deleted: true });
  }
);

app.listen(3000);

// src/lib/roles.ts
import { defineRoles } from 'secure-role-guard';

export const roleRegistry = defineRoles({
  admin: ['page.edit', 'page.publish', 'settings.manage'],
  editor: ['page.edit'],
  viewer: [],
});

// src/components/AdminPanel.tsx (React component)
import { PermissionProvider, Can, useCan } from 'secure-role-guard';
import { roleRegistry } from '../lib/roles';

interface Props {
  user: { roles: string[] } | null;
}

export default function AdminPanel({ user }: Props) {
  return (
    <PermissionProvider user={user} registry={roleRegistry}>
      <div className="admin-panel">
        <Can permission="page.edit">
          <PageEditor />
        </Can>

        <Can permission="settings.manage">
          <SettingsPanel />
        </Can>

        <Can permission="page.publish" fallback={<p>Publishing not available</p>}>
          <PublishButton />
        </Can>
      </div>
    </PermissionProvider>
  );
}

// src/pages/admin.astro
---
import AdminPanel from '../components/AdminPanel';
import { getUser } from '../lib/auth';

const user = await getUser(Astro.request);
---

<AdminPanel client:load user={user} />

// app/api/users/route.ts
import { NextRequest, NextResponse } from "next/server";
import { defineRoles, canUser } from "secure-role-guard/core";
import { withPermission } from "secure-role-guard/adapters/nextjs";
import { getUser } from "@/lib/auth";

const roleRegistry = defineRoles({
  admin: ["user.read", "user.update", "user.delete"],
  viewer: ["user.read"],
});

// Option 1: Manual check
export async function GET(request: NextRequest) {
  const user = await getUser(request);

  if (!canUser(user, "user.read", roleRegistry)) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

  const users = await fetchUsers();
  return NextResponse.json(users);
}

// Option 2: Using wrapper
export const PUT = withPermission(
  "user.update",
  roleRegistry,
  { getUser: async (req) => getUser(req) },
  async (request, user) => {
    const body = await request.json();
    const updated = await updateUser(body);
    return NextResponse.json(updated);
  }
);

import { defineRoles, canUser } from "secure-role-guard";

// Define roles for your multi-tenant application
const roleRegistry = defineRoles({
  org_owner: ["*"],
  org_admin: ["user.*", "billing.view", "settings.update"],
  org_member: ["user.read", "project.*"],
  org_viewer: ["user.read", "project.read"],
});

// User context with tenant metadata
const currentUser = {
  userId: "usr_abc123",
  roles: ["org_admin"],
  permissions: ["beta.feature"], // Direct permission for beta access
  meta: {
    tenantId: "tenant_xyz",
    orgId: "org_456",
    plan: "enterprise",
  },
};

// Authorization check
if (canUser(currentUser, "billing.view", roleRegistry)) {
  // Show billing dashboard
}

// Access tenant metadata for additional business logic
const tenantId = currentUser.meta?.tenantId;
if (tenantId) {
  // Filter data by tenant
}

// lib/roles.ts - Define roles at build time
import { defineRoles } from "secure-role-guard";

export const roleRegistry = defineRoles({
  superadmin: ["*"], // Full access
  admin: ["user.read", "user.create", "user.update", "user.delete", "report.*"],
  manager: ["user.read", "user.update", "report.view"],
  support: ["ticket.read", "ticket.reply", "user.read"],
  viewer: ["user.read", "report.view"],
});

// -------------------------------------------------------
// app/providers.tsx - Setup Provider
("use client");

import { PermissionProvider } from "secure-role-guard/react";
import { roleRegistry } from "@/lib/roles";

interface User {
  id: string;
  roles: string[];
  permissions?: string[];
}

export function AuthProvider({
  children,
  user,
}: {
  children: React.ReactNode;
  user: User | null;
}) {
  return (
    <PermissionProvider user={user} registry={roleRegistry}>
      {children}
    </PermissionProvider>
  );
}

// -------------------------------------------------------
// components/Dashboard.tsx - Use Permissions
import { Can, useCan } from "secure-role-guard/react";

export function Dashboard() {
  const canManageUsers = useCan("user.update");

  return (
    <div>
      <h1>Dashboard</h1>

      {/* Declarative approach */}
      <Can permission="user.create">
        <button>Add New User</button>
      </Can>

      <Can permission="report.view">
        <ReportsSection />
      </Can>

      <Can permissions={["user.delete", "user.update"]} anyOf>
        <UserManagement />
      </Can>

      {/* Programmatic approach */}
      {canManageUsers && <EditUserButton />}
    </div>
  );
}

// server.ts - Express with Fixed Roles
import express from "express";
import { defineRoles, canUser } from "secure-role-guard/core";
import { requirePermission } from "secure-role-guard/adapters/express";

const app = express();

// Same role definitions as frontend
const roleRegistry = defineRoles({
  superadmin: ["*"],
  admin: ["user.read", "user.create", "user.update", "user.delete"],
  manager: ["user.read", "user.update"],
  viewer: ["user.read"],
});

// YOUR auth middleware (this package doesn't do auth)
app.use(yourAuthMiddleware); // Sets req.user

// Protected routes with middleware
app.get(
  "/api/users",
  requirePermission("user.read", roleRegistry),
  async (req, res) => {
    const users = await db.users.findAll();
    res.json(users);
  }
);

app.post(
  "/api/users",
  requirePermission("user.create", roleRegistry),
  async (req, res) => {
    const user = await db.users.create(req.body);
    res.json(user);
  }
);

// Manual permission check (for complex logic)
app.put("/api/users/:id", async (req, res) => {
  const user = req.user;

  if (!canUser(user, "user.update", roleRegistry)) {
    return res.status(403).json({ error: "Forbidden" });
  }

  // Additional business logic
  const targetUser = await db.users.findById(req.params.id);

  // Example: Managers can only edit non-admin users
  if (
    targetUser.roles.includes("admin") &&
    !canUser(user, "admin.manage", roleRegistry)
  ) {
    return res.status(403).json({ error: "Cannot edit admin users" });
  }

  const updated = await db.users.update(req.params.id, req.body);
  res.json(updated);
});

app.listen(3000);

// lib/dynamic-roles.ts
import { defineRoles, RoleRegistry } from "secure-role-guard/core";

// Interface for database abstraction
interface RoleFromDB {
  name: string;
  permissions: string[];
}

interface IRoleRepository {
  getAllActiveRoles(): Promise<RoleFromDB[]>;
}

// ============================================================
// MongoDB Implementation
// ============================================================
class MongoRoleRepository implements IRoleRepository {
  async getAllActiveRoles(): Promise<RoleFromDB[]> {
    const roles = await RoleModel.find({ is_active: true })
      .populate("permissions")
      .lean();

    return roles.map((role) => ({
      name: role.name,
      permissions: role.permissions.map((p: any) => p.code),
    }));
  }
}

// ============================================================
// PostgreSQL Implementation (using Prisma)
// ============================================================
class PostgresRoleRepository implements IRoleRepository {
  async getAllActiveRoles(): Promise<RoleFromDB[]> {
    const roles = await prisma.role.findMany({
      where: { is_active: true },
      include: {
        role_permissions: {
          include: { permission: true },
        },
      },
    });

    return roles.map((role) => ({
      name: role.name,
      permissions: role.role_permissions.map((rp) => rp.permission.code),
    }));
  }
}

// ============================================================
// MySQL Implementation (using mysql2)
// ============================================================
class MySQLRoleRepository implements IRoleRepository {
  async getAllActiveRoles(): Promise<RoleFromDB[]> {
    const [rows] = await pool.query(`
      SELECT r.name, GROUP_CONCAT(p.code) as permissions
      FROM roles r
      LEFT JOIN role_permissions rp ON r.id = rp.role_id
      LEFT JOIN permissions p ON rp.permission_id = p.id
      WHERE r.is_active = 1
      GROUP BY r.id, r.name
    `);

    return (rows as any[]).map((row) => ({
      name: row.name,
      permissions: row.permissions ? row.permissions.split(",") : [],
    }));
  }
}

// ============================================================
// Dynamic Role Registry Factory
// ============================================================
let cachedRegistry: RoleRegistry | null = null;
let cacheExpiry = 0;
const CACHE_TTL = 5 * 60 * 1000; // 5 minutes

export async function getDynamicRoleRegistry(
  repository: IRoleRepository
): Promise<RoleRegistry> {
  const now = Date.now();

  // Return cached if valid
  if (cachedRegistry && now < cacheExpiry) {
    return cachedRegistry;
  }

  // Fetch from database
  const rolesFromDB = await repository.getAllActiveRoles();

  // Transform to RoleDefinition format
  const roleDefinition: Record<string, readonly string[]> = {};
  for (const role of rolesFromDB) {
    roleDefinition[role.name] = role.permissions;
  }

  // Create registry
  cachedRegistry = defineRoles(roleDefinition);
  cacheExpiry = now + CACHE_TTL;

  return cachedRegistry;
}

// Force refresh (call when admin updates roles)
export function invalidateRoleCache(): void {
  cachedRegistry = null;
  cacheExpiry = 0;
}

// server.ts
import express from "express";
import { canUser } from "secure-role-guard/core";
import {
  getDynamicRoleRegistry,
  invalidateRoleCache,
} from "./lib/dynamic-roles";

const app = express();
const roleRepository = new MongoRoleRepository(); // or PostgresRoleRepository

// Middleware to attach registry to request
app.use(async (req, res, next) => {
  try {
    req.roleRegistry = await getDynamicRoleRegistry(roleRepository);
    next();
  } catch (error) {
    console.error("Failed to load roles:", error);
    res.status(500).json({ error: "Internal server error" });
  }
});

// Protected routes using dynamic roles
app.get("/api/employees", async (req, res) => {
  if (!canUser(req.user, "employee.read", req.roleRegistry)) {
    return res.status(403).json({ error: "Forbidden" });
  }

  const employees = await db.employees.findAll();
  res.json(employees);
});

// Admin creates a new role
app.post("/api/admin/roles", async (req, res) => {
  if (!canUser(req.user, "role.create", req.roleRegistry)) {
    return res.status(403).json({ error: "Forbidden" });
  }

  const { name, permissions } = req.body;

  // Save to database
  await RoleModel.create({ name, permissions, is_active: true });

  // Invalidate cache so new role is available
  invalidateRoleCache();

  res.json({ success: true });
});

app.listen(3000);

// lib/auth-context.tsx
"use client";

import { createContext, useContext, useEffect, useState } from "react";
import {
  PermissionProvider,
  RoleRegistry,
  defineRoles,
} from "secure-role-guard/react";

interface User {
  id: string;
  email: string;
  roles: string[];
  permissions: string[];
}

interface AuthContextValue {
  user: User | null;
  isLoading: boolean;
}

const AuthContext = createContext<AuthContextValue>({
  user: null,
  isLoading: true,
});

export function DynamicAuthProvider({
  children,
}: {
  children: React.ReactNode;
}) {
  const [user, setUser] = useState<User | null>(null);
  const [roleRegistry, setRoleRegistry] = useState<RoleRegistry | null>(null);
  const [isLoading, setIsLoading] = useState(true);

  useEffect(() => {
    async function loadUserAndRoles() {
      try {
        // Fetch current user
        const userRes = await fetch("/api/auth/me");
        const userData = await userRes.json();

        if (!userData.user) {
          setIsLoading(false);
          return;
        }

        // Fetch dynamic roles from backend
        const rolesRes = await fetch("/api/auth/roles");
        const rolesData = await rolesRes.json();

        // Create registry from dynamic roles
        // rolesData format: { admin: ['user.read', ...], manager: [...] }
        const registry = defineRoles(rolesData.roles);

        setUser(userData.user);
        setRoleRegistry(registry);
      } catch (error) {
        console.error("Failed to load auth:", error);
      } finally {
        setIsLoading(false);
      }
    }

    loadUserAndRoles();
  }, []);

  if (isLoading) {
    return <div>Loading...</div>;
  }

  if (!roleRegistry) {
    return <div>Failed to load permissions</div>;
  }

  return (
    <AuthContext.Provider value={{ user, isLoading }}>
      <PermissionProvider user={user} registry={roleRegistry}>
        {children}
      </PermissionProvider>
    </AuthContext.Provider>
  );
}

// -------------------------------------------------------
// API Route: Return roles for frontend
// app/api/auth/roles/route.ts

import { NextResponse } from "next/server";

export async function GET() {
  // Fetch roles from database
  const roles = await RoleModel.find({ is_active: true }).lean();

  // Transform to { roleName: permissions[] } format
  const roleMap: Record<string, string[]> = {};
  for (const role of roles) {
    roleMap[role.name] = role.permissions;
  }

  return NextResponse.json({ roles: roleMap });
}

// -------------------------------------------------------
// Usage in Components (same as fixed roles!)

import { Can, useCan } from "secure-role-guard/react";

function EmployeeDashboard() {
  const canApproveLeave = useCan("leave.approve");

  return (
    <div>
      <Can permission="employee.read">
        <EmployeeList />
      </Can>

      <Can permission="employee.create">
        <AddEmployeeButton />
      </Can>

      {canApproveLeave && <LeaveApprovalQueue />}
    </div>
  );
}

// WRONG - This package doesn't handle authentication
import { canUser } from "secure-role-guard";

const token = req.headers.authorization;
const decoded = jwt.verify(token, secret); // NOT our job

// CORRECT - You handle auth, we handle authorization
import { canUser } from "secure-role-guard";

// Your auth middleware already verified and decoded the token
const user = req.user; // Set by YOUR auth middleware
const allowed = canUser(user, "admin.access", roleRegistry);

// WRONG - Global state is a security smell
let currentUser = null; // Anti-pattern

// CORRECT - Explicit is better than implicit
<PermissionProvider user={user} registry={roleRegistry}>
  {children}
</PermissionProvider>

// WRONG - This is authentication, not authorization
if (canUser(user, "logged-in", registry)) {
  // ...
}

// CORRECT - This is authorization
if (canUser(user, "user.update", registry)) {
  // ...
}

// WRONG - May throw or behave unexpectedly
if (user.permissions.includes("admin")) {
  // ...
}

// CORRECT - Handles null/undefined safely (deny by default)
if (canUser(user, "admin.access", registry)) {
  // ...
}

import {
  requirePermission,
  requireAllPermissions,
  requireAnyPermission,
} from "secure-role-guard/adapters/express";

// Single permission
app.get("/api/users", requirePermission("user.read", registry), handler);

// All permissions required
app.delete(
  "/api/admin",
  requireAllPermissions(["admin.access", "data.delete"], registry),
  handler
);

// Any permission
app.get(
  "/api/reports",
  requireAnyPermission(["report.view", "report.admin"], registry),
  handler
);

// Custom options
app.put(
  "/api/settings",
  requirePermission("settings.update", registry, {
    statusCode: 401,
    message: "Unauthorized",
    getUser: (req) => req.session?.user,
  }),
  handler
);

import {
  withPermission,
  checkNextPermission,
} from "secure-role-guard/adapters/nextjs";

// Using wrapper
export const POST = withPermission(
  "post.create",
  registry,
  { getUser: async (req) => getUserFromSession(req) },
  async (request, user) => {
    return Response.json({ created: true });
  }
);

// Manual check
export async function GET(request: NextRequest) {
  const user = await getUser(request);
  const result = checkNextPermission(user, "data.read", registry);

  if (!result.allowed) {
    return Response.json({ error: "Forbidden" }, { status: 403 });
  }

  return Response.json({ data: [] });
}

// tsconfig.json (package configuration)
{
  "compilerOptions": {
    "strict": true,
    "noImplicitAny": true,
    "strictNullChecks": true,
    "exactOptionalPropertyTypes": true
  }
}

import type {
  UserContext,
  RoleDefinition,
  RoleRegistry,
  PermissionCheckResult,
} from "secure-role-guard";