(()=>{const l=window.React;if(!l)return;const t=l.createElement,i=l.useState,A=l.useEffect,e={surface:"var(--app-surface,#1a1a1c)",elevated:"var(--app-elevated,#2a2a2e)",rule:"var(--app-rule,rgba(255,255,255,.07))",ink:"var(--app-ink,#e6e3da)",inkSoft:"var(--app-ink-soft,rgba(230,227,218,.62))",inkFaint:"var(--app-ink-faint,rgba(230,227,218,.38))",accent:"var(--app-accent,#00f3ff)",success:"var(--app-success,#00d4b8)",warn:"var(--app-warn,#f8d974)",fail:"var(--app-fail,#f43f6c)",mono:'var(--app-font-mono,"JetBrains Mono",SFMono-Regular,monospace)'},c={background:e.surface,border:`1px solid ${e.rule}`,borderRadius:"var(--app-radius,8px)",padding:"14px 16px",marginBottom:12},f={fontFamily:e.mono,fontSize:11,letterSpacing:".08em",textTransform:"uppercase",color:e.inkFaint,marginBottom:8},u={background:e.elevated,border:`1px solid ${e.rule}`,borderRadius:6,color:e.ink,padding:"6px 10px",fontFamily:e.mono,fontSize:12};function y(){const n=window.CANVAS_RBAC;return n?{roles:n.roles||{},effective:n.effectiveRoleMeta||(n.getRole?n.getRole(n.effectiveRole):{id:"restricted"}),isRbacAdmin:n.isRbacAdmin===!0,source:n.source||"static-fallback"}:{roles:{},effective:{id:"restricted",label:"Restricted",streams:[]},isRbacAdmin:!1,source:"unavailable"}}function k(n){return!Array.isArray(n)||!n.length?"personal only":n.includes("*")?"all OPS streams":n.join(" \xB7 ")}function b(){const[n,x]=i(y),[w,R]=i(""),[S,I]=i(""),[r,h]=i(!1),[m,d]=i(null);A(()=>{const a=()=>x(y());try{return window.addEventListener("rbac-hydrated",a),()=>window.removeEventListener("rbac-hydrated",a)}catch{return}},[]);const v=Object.keys(n.roles),s=window.CANVAS_ACTIONS&&typeof window.CANVAS_ACTIONS.dispatch=="function";function F(){if(!s||r)return;const a=w.trim(),g=S.trim();if(!a||!g){d({tone:e.warn,text:"target uid and role are required"});return}h(!0),d({tone:e.inkSoft,text:"submitting\u2026"}),window.CANVAS_ACTIONS.dispatch("rbac.role.set",{target_uid:a,role:g},{confirm:!0}).then(o=>{d({tone:e.success,text:`role '${o.role}' assigned to ${o.target_uid} (tenant ${o.tenant})${o.persisted?"":" \u2014 dry-run (live writes disabled)"}`})}).catch(o=>{d({tone:e.fail,text:String(o&&o.message||o)})}).then(()=>h(!1))}return t("div",{style:{padding:16,color:e.ink,maxWidth:720}},t("div",{style:c},t("div",{style:f},"Your effective role"),t("div",{style:{display:"flex",alignItems:"baseline",gap:10}},t("span",{style:{fontFamily:e.mono,fontSize:16,color:e.accent}},n.effective.label||n.effective.id),t("span",{style:{fontFamily:e.mono,fontSize:11,color:e.inkFaint}},`source: ${n.source}`)),t("div",{style:{fontSize:12,color:e.inkSoft,marginTop:6}},"Resolved server-side from the tenant roles map + your canvas-config. ","Missing or unknown assignments resolve to the least-privilege floor.")),t("div",{style:c},t("div",{style:f},"Tenant role model"),v.length?v.map(a=>t("div",{key:a,style:{display:"flex",gap:12,padding:"6px 0",borderBottom:`1px solid ${e.rule}`,alignItems:"baseline"}},t("span",{style:{fontFamily:e.mono,fontSize:12,minWidth:90}},n.roles[a].label||a),t("span",{style:{fontSize:11,color:e.inkFaint,fontFamily:e.mono}},k(n.roles[a].streams)))):t("div",{style:{fontSize:12,color:e.inkSoft}},"No roles defined for this tenant \u2014 every user resolves to the restricted floor (default-deny).")),t("div",{style:c},t("div",{style:f},"Assign a role (own tenant only)"),!n.isRbacAdmin&&t("div",{style:{fontSize:12,color:e.warn,marginBottom:8,fontFamily:e.mono}},"You are not an rbac admin for this tenant \u2014 the server will deny writes (403)."),t("div",{style:{display:"flex",gap:8,flexWrap:"wrap"}},t("input",{style:{...u,flex:"1 1 220px"},placeholder:"target uid",value:w,onChange:a=>R(a.target.value),"aria-label":"target uid"}),t("select",{style:{...u,flex:"0 1 180px"},value:S,onChange:a=>I(a.target.value),"aria-label":"role"},t("option",{value:""},"role\u2026"),v.map(a=>t("option",{key:a,value:a},n.roles[a].label||a))),t("button",{style:{...u,cursor:s&&!r?"pointer":"not-allowed",borderColor:e.accent,color:e.accent,opacity:s&&!r?1:.5},disabled:!s||r,onClick:F},r?"\u2026":"Assign")),!s&&t("div",{style:{fontSize:11,color:e.inkFaint,marginTop:8}},"Write engine unavailable in this build \u2014 assignments are disabled."),m&&t("div",{style:{fontSize:12,marginTop:10,fontFamily:e.mono,color:m.tone},role:"status"},m.text),t("div",{style:{fontSize:11,color:e.inkFaint,marginTop:10}},"Server-enforced: writes are scoped to your own tenant (cross-tenant \u2192 403), ","require the rbac-admin entitlement, and self-escalation is denied independently. ","Changes take effect on the next role resolution \u2014 no deploy.")))}window.RBAC_ADMIN_VIEW_FN=b,window.VIEWS=window.VIEWS||{},window.VIEWS.rbacAdmin=b;const p=window.KIND_REGISTRY;p&&(p.rbacAdmin=p.rbacAdmin||{id:"rbacAdmin",label:"Rights management",workspaceLabel:"Account",workspaceIcon:"admin_panel_settings",defaultView:"rbacAdmin",defaultDetail:"none",agentTreatment:"implicit",scopeTag:"account",mockItems:[],liveData:null,heroKpis:[],description:"Tenant-admin self-service role assignment (own tenant only) \u2014 server-gated: identity-bound tenant, rbac-admin entitlement, independent self-escalation guard."})})();