"use client";
'use strict';

// src/platform/rbac.ts
function matchPermission(pattern, target) {
  if (pattern === "*") return true;
  if (pattern === target) return true;
  const patternParts = pattern.split(":");
  const targetParts = target.split(":");
  for (let i = 0; i < patternParts.length; i++) {
    if (patternParts[i] === "*") return true;
    if (patternParts[i] !== targetParts[i]) return false;
  }
  return patternParts.length === targetParts.length;
}
function createPlatformRbac(opts) {
  const ROLE_DEFINITIONS = opts.roles;
  const MODULE_PERMISSIONS = opts.modulePermissions ?? {};
  const PERMISSION_CLAIMS_MAP = opts.permissionClaimsMap;
  const knownRoles = Object.keys(ROLE_DEFINITIONS);
  const fallbackRole = opts.defaultRole ?? knownRoles[0];
  function normalizePlatformRole(input) {
    if (typeof input === "string" && input in ROLE_DEFINITIONS) {
      return input;
    }
    return fallbackRole;
  }
  function can(user, permission) {
    if (!user) return false;
    const userClaims = user.permissions ?? [];
    const requiredClaims = PERMISSION_CLAIMS_MAP[permission] ?? [];
    return requiredClaims.some(
      (claim) => userClaims.some((userClaim) => matchPermission(userClaim, claim))
    );
  }
  return {
    ROLE_DEFINITIONS,
    MODULE_PERMISSIONS,
    normalizePlatformRole,
    can
  };
}

exports.createPlatformRbac = createPlatformRbac;
//# sourceMappingURL=chunk-VY52Y5GC.js.map
//# sourceMappingURL=chunk-VY52Y5GC.js.map