add rbac

Frontend/erp-system/lib/api/auth.ts

@@ -2,8 +2,14 @@
 // delivers the session as httpOnly cookies — there is no token for JS to hold or attach.
 import { apiRequest } from "@/lib/api-client"
 import { AuthSession, LoginRequest, RegisterRequest } from "@/types/auth"
+import { MeResponse } from "@/types/rbac"
 
 export const authApi = {
+  /** Authoritative role + permitted sidebar nav codes for the current session. */
+  me(): Promise<MeResponse> {
+    return apiRequest<MeResponse>("/auth/me")
+  },
+
   /** Sets erp_at / erp_rt / XSRF-TOKEN cookies on success. Body carries no tokens. */
   login(request: LoginRequest): Promise<AuthSession> {
     return apiRequest<AuthSession>("/auth/login", { method: "POST", body: request })

Frontend/erp-system/lib/api/nav.ts

@@ -0,0 +1,9 @@
+// Read-only sidebar nav tree (ERPCore Controllers/NavController.cs).
+import { apiRequest } from "@/lib/api-client"
+import { NavItem } from "@/types/rbac"
+
+export const navApi = {
+  tree(): Promise<NavItem[]> {
+    return apiRequest<NavItem[]>("/nav")
+  },
+}

Frontend/erp-system/lib/api/roles.ts

@@ -0,0 +1,51 @@
+// Role CRUD + permission assignment (ERPCore Controllers/RolesController.cs).
+import { apiRequest, apiRequestWithETag, buildQuery } from "@/lib/api-client"
+import { ApiResult, EntityStatus, PagedResponse } from "@/types/common"
+import {
+  AssignRolePermissionsRequest,
+  CreateRoleRequest,
+  Role,
+  RolePermissions,
+  UpdateRoleRequest,
+} from "@/types/rbac"
+
+export interface ListRolesParams {
+  page?: number
+  pageSize?: number
+  q?: string
+  status?: EntityStatus
+}
+
+export const rolesApi = {
+  list(params: ListRolesParams = {}): Promise<PagedResponse<Role>> {
+    return apiRequest<PagedResponse<Role>>(`/roles${buildQuery(params)}`)
+  },
+
+  get(roleId: number): Promise<ApiResult<Role>> {
+    return apiRequestWithETag<Role>(`/roles/${roleId}`)
+  },
+
+  create(request: CreateRoleRequest): Promise<ApiResult<Role>> {
+    return apiRequestWithETag<Role>("/roles", { method: "POST", body: request })
+  },
+
+  update(roleId: number, request: UpdateRoleRequest, ifMatch: string): Promise<ApiResult<Role>> {
+    return apiRequestWithETag<Role>(`/roles/${roleId}`, { method: "PUT", body: request, ifMatch })
+  },
+
+  updateStatus(roleId: number, status: EntityStatus): Promise<void> {
+    return apiRequest<void>(`/roles/${roleId}/status`, { method: "PATCH", body: { status } })
+  },
+
+  remove(roleId: number): Promise<void> {
+    return apiRequest<void>(`/roles/${roleId}`, { method: "DELETE" })
+  },
+
+  getPermissions(roleId: number): Promise<RolePermissions> {
+    return apiRequest<RolePermissions>(`/roles/${roleId}/permissions`)
+  },
+
+  assignPermissions(roleId: number, request: AssignRolePermissionsRequest): Promise<RolePermissions> {
+    return apiRequest<RolePermissions>(`/roles/${roleId}/permissions`, { method: "PUT", body: request })
+  },
+}

Frontend/erp-system/lib/api/users.ts

@@ -0,0 +1,33 @@
+// User management (ERPCore Controllers/UsersController.cs). Create orchestrates
+// account creation in both AuthHex and ERPCore's local shadow table server-side.
+import { apiRequest, buildQuery } from "@/lib/api-client"
+import { PagedResponse } from "@/types/common"
+import { CreateUserRequest, ManagedUser, UpdateUserRoleRequest, UserTypeOption } from "@/types/users"
+
+export interface ListUsersParams {
+  page?: number
+  pageSize?: number
+  q?: string
+}
+
+export const usersApi = {
+  list(params: ListUsersParams = {}): Promise<PagedResponse<ManagedUser>> {
+    return apiRequest<PagedResponse<ManagedUser>>(`/users${buildQuery(params)}`)
+  },
+
+  get(userId: number): Promise<ManagedUser> {
+    return apiRequest<ManagedUser>(`/users/${userId}`)
+  },
+
+  create(request: CreateUserRequest): Promise<ManagedUser> {
+    return apiRequest<ManagedUser>("/users", { method: "POST", body: request })
+  },
+
+  updateRole(userId: number, request: UpdateUserRoleRequest): Promise<ManagedUser> {
+    return apiRequest<ManagedUser>(`/users/${userId}/role`, { method: "PUT", body: request })
+  },
+
+  userTypes(): Promise<UserTypeOption[]> {
+    return apiRequest<UserTypeOption[]>("/users/user-types")
+  },
+}