@aglyn/plugins-commerce 1.0.0-beta.230 → 1.0.0-beta.232

package/src/lib/server/payment-methods.js

@@ -0,0 +1,284 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement, pluginRequestFromWeb } from "@aglyn/aglyn/server";
+import { emailUnverifiedResponse, firebaseAdmin, getOrgForHost, isImpersonationSession, lockdownRefusal } from "@aglyn/tenant-data-admin";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { isStorefrontPaymentMethodOn, normalizeStorefrontPaymentMethodSettings, STOREFRONT_PAYMENT_METHODS } from "../model/commerce-payment-methods.js";
+import { readSiteDomainRecords } from "./payment-method-domains.js";
+/** How long the platform's configuration is trusted in memory. */ const PLATFORM_CONFIGURATION_TTL_MS = 10 * 60 * 1000;
+let platformCache = null;
+/** Test seam: forget the cached platform configuration. */ export function resetPlatformPaymentMethodCacheForTests() {
+    platformCache = null;
+}
+async function stripe(method, path, params, idempotencyKey) {
+    const query = method === 'GET' && params ? `?${params}` : '';
+    const response = await fetch(`https://api.stripe.com/v1/${path}${query}`, _extends({
+        method,
+        headers: _extends({
+            Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`
+        }, method === 'POST' && {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        }, idempotencyKey && {
+            'Idempotency-Key': idempotencyKey
+        })
+    }, method === 'POST' && params && {
+        body: params.toString()
+    }));
+    const payload = await response.json().catch(()=>({}));
+    if (!response.ok) {
+        var _ref;
+        var _payload_error;
+        throw new Error((_ref = payload == null ? void 0 : (_payload_error = payload.error) == null ? void 0 : _payload_error.message) != null ? _ref : `Stripe ${path} failed (${response.status})`);
+    }
+    return payload;
+}
+/**
+ * Which methods the platform's own default configuration offers. The list
+ * also returns configurations OTHER Connect applications made for this
+ * account (`application` set); those do not govern our sessions and are
+ * skipped. `null` per method when Stripe could not be asked — the card then
+ * shows the toggle without a verdict rather than hiding a method that may work.
+ */ export async function platformPaymentMethodAvailability() {
+    if (platformCache && Date.now() - platformCache.at < PLATFORM_CONFIGURATION_TTL_MS) {
+        return platformCache.value;
+    }
+    const value = {};
+    try {
+        var _ref, _ref1;
+        var _list_data, _list_data1;
+        const list = await stripe('GET', 'payment_method_configurations', new URLSearchParams({
+            limit: '20'
+        }));
+        const own = (_ref = (_ref1 = (_list_data = list.data) == null ? void 0 : _list_data.find((entry)=>entry.is_default && !entry.application)) != null ? _ref1 : (_list_data1 = list.data) == null ? void 0 : _list_data1.find((entry)=>!entry.application)) != null ? _ref : null;
+        for (const method of STOREFRONT_PAYMENT_METHODS){
+            var _entry_display_preference;
+            if (!own) {
+                value[method.id] = null;
+                continue;
+            }
+            const entry = own[method.configurationKey];
+            value[method.id] = (entry == null ? void 0 : entry.available) === true && (entry == null ? void 0 : (_entry_display_preference = entry.display_preference) == null ? void 0 : _entry_display_preference.value) === 'on' ? 'on' : 'unavailable';
+        }
+        platformCache = {
+            at: Date.now(),
+            value
+        };
+    } catch (error) {
+        console.warn('[commerce] payment method configuration unreadable', error);
+        for (const method of STOREFRONT_PAYMENT_METHODS)value[method.id] = null;
+    }
+    return value;
+}
+function capabilityStatus(capabilities, key) {
+    if (!key) return null;
+    const status = capabilities == null ? void 0 : capabilities[key];
+    if (status === 'active' || status === 'pending' || status === 'inactive') return status;
+    return 'unrequested';
+}
+async function readAccountCapabilities(accountId) {
+    if (!accountId) return undefined;
+    try {
+        var _account_capabilities;
+        const account = await stripe('GET', `accounts/${encodeURIComponent(accountId)}`);
+        return (_account_capabilities = account.capabilities) != null ? _account_capabilities : {};
+    } catch (error) {
+        console.warn('[commerce] connected account unreadable', error);
+        return undefined;
+    }
+}
+/** The capabilities a save asks Stripe for: on, offered, not yet requested. */ export function capabilitiesToRequest(settings, platform, capabilities) {
+    return STOREFRONT_PAYMENT_METHODS.filter((method)=>method.capability && isStorefrontPaymentMethodOn(settings, method.id) && platform[method.id] !== 'unavailable' && capabilityStatus(capabilities, method.capability) === 'unrequested').map((method)=>method.capability);
+}
+export function buildPaymentMethodRows(settings, platform, capabilities) {
+    return STOREFRONT_PAYMENT_METHODS.map((method)=>{
+        var _platform_method_id;
+        return {
+            id: method.id,
+            on: isStorefrontPaymentMethodOn(settings, method.id),
+            platform: (_platform_method_id = platform[method.id]) != null ? _platform_method_id : null,
+            capability: capabilities ? capabilityStatus(capabilities, method.capability) : null
+        };
+    });
+}
+const json = (body, status = 200)=>Response.json(body, {
+        status
+    });
+/**
+ * Where Stripe sends the owner back: the console page they pressed the button
+ * on, judged against the request's own origin so a forged `Referer` cannot
+ * turn the link into a redirect to somewhere else.
+ */ export function consoleReturnUrl(headers) {
+    var _headers_referer;
+    const origin = headers.origin || (headers.host ? `https://${headers.host}` : '');
+    const referer = (_headers_referer = headers.referer) != null ? _headers_referer : '';
+    try {
+        if (origin && referer && new URL(referer).origin === new URL(origin).origin) {
+            return referer;
+        }
+    } catch (unused) {
+    // Unparseable: fall through to the origin.
+    }
+    return origin || 'https://localhost/';
+}
+export async function paymentMethodsHandler(request) {
+    var _headers_authorization, _ref;
+    const { method, headers: rawHeaders, query, body } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    if (method !== 'GET' && method !== 'POST') {
+        return json({
+            error: 'Method not allowed'
+        }, 405);
+    }
+    if (!process.env.STRIPE_SECRET_KEY) {
+        return json({
+            error: 'Payments are not configured (STRIPE_SECRET_KEY).'
+        }, 501);
+    }
+    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return json({
+        error: 'Unauthenticated'
+    }, 401);
+    const parsed = typeof body === 'string' ? JSON.parse(body || '{}') : body != null ? body : {};
+    const hostId = String((_ref = method === 'GET' ? query == null ? void 0 : query['hostId'] : parsed['hostId']) != null ? _ref : '');
+    if (!hostId) return json({
+        error: 'Missing hostId'
+    }, 400);
+    try {
+        var _hostSnapshot_get, _ref1, _ref2, _get;
+        var _owner_org;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return emailUnverifiedResponse();
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) return json({
+            error: 'Not found'
+        }, 404);
+        // An allowlist. Reading the card is for whoever manages the store; a
+        // change asks Stripe for capabilities on the owner's payout account, so it
+        // is an admin's, like connecting that account is the owner's.
+        const role = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        const mayRead = role === 'admin' || role === 'editor';
+        if (!mayRead) return json({
+            error: 'Not found'
+        }, 404);
+        if (method === 'POST' && role !== 'admin') {
+            return json({
+                error: 'Only a site admin can change payment methods'
+            }, 403);
+        }
+        const owner = await getOrgForHost(hostId);
+        const locked = await lockdownRefusal({
+            request,
+            staff: decoded['staff'] === true,
+            uid: decoded.uid,
+            org: owner == null ? void 0 : owner.org,
+            host: hostSnapshot.data()
+        });
+        if (locked) return locked;
+        if (!checkEntitlement((_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : {}, 'commerce')) {
+            return json({
+                error: 'Selling is not included on this plan'
+            }, 402);
+        }
+        const ownerUid = String((_ref2 = owner == null ? void 0 : (_owner_org = owner.org) == null ? void 0 : _owner_org.ownerUid) != null ? _ref2 : '');
+        const accountId = ownerUid ? (_get = (await firestore.collection('profiles').doc(ownerUid).get()).get('stripeAccountId')) != null ? _get : null : null;
+        const storeRef = hostRef.collection('settings').doc('store');
+        let settings = normalizeStorefrontPaymentMethodSettings((await storeRef.get()).get('paymentMethods'));
+        const platform = await platformPaymentMethodAvailability();
+        let capabilities = await readAccountCapabilities(accountId);
+        const warnings = [];
+        // FINISH IN STRIPE: a capability Stripe holds `inactive` needs details
+        // only the account holder can give, and an Express account has no login of
+        // its own, so a link minted here is the only way in. The owner's alone,
+        // as connecting the account is (`connect.ts`): the link opens the owner's
+        // identity and bank details.
+        if (method === 'POST' && parsed['action'] === 'finish') {
+            var _link_url;
+            if (!accountId || decoded.uid !== ownerUid) {
+                return json({
+                    error: 'Only the organization owner can finish this in Stripe'
+                }, 403);
+            }
+            const back = consoleReturnUrl(headers);
+            const link = await stripe('POST', 'account_links', new URLSearchParams({
+                account: accountId,
+                type: 'account_onboarding',
+                'collection_options[fields]': 'currently_due',
+                refresh_url: back,
+                return_url: back
+            }));
+            return json({
+                url: (_link_url = link.url) != null ? _link_url : null
+            });
+        }
+        if (method === 'POST') {
+            const requested = normalizeStorefrontPaymentMethodSettings(parsed['methods']);
+            if (!Object.keys(requested).length) {
+                return json({
+                    error: 'Nothing to save'
+                }, 400);
+            }
+            settings = _extends({}, settings, requested);
+            await storeRef.set({
+                paymentMethods: settings,
+                paymentMethodsUpdatedAtMs: Date.now(),
+                paymentMethodsUpdatedBy: decoded.uid
+            }, {
+                merge: true
+            });
+            const wanted = accountId ? capabilitiesToRequest(settings, platform, capabilities) : [];
+            if (accountId && wanted.length) {
+                const params = new URLSearchParams();
+                for (const capability of wanted){
+                    params.set(`capabilities[${capability}][requested]`, 'true');
+                }
+                try {
+                    var _account_capabilities;
+                    const account = await stripe('POST', `accounts/${encodeURIComponent(accountId)}`, params, `aglyn-pm-capabilities:${accountId}:${[
+                        ...wanted
+                    ].sort().join(',')}`);
+                    capabilities = (_account_capabilities = account.capabilities) != null ? _account_capabilities : capabilities;
+                } catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    warnings.push(`Stripe did not accept the request to enable ${wanted.join(', ')} on your payout account: ${message}`);
+                }
+            }
+        }
+        const answer = {
+            methods: buildPaymentMethodRows(settings, platform, capabilities),
+            domains: await readSiteDomainRecords(hostSnapshot.data()),
+            accountConnected: Boolean(accountId),
+            canEdit: role === 'admin',
+            canFinish: Boolean(accountId) && decoded.uid === ownerUid,
+            warnings
+        };
+        return json(answer);
+    } catch (error) {
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        console.error(error);
+        return json({
+            error: 'Payment methods could not be loaded'
+        }, 500);
+    }
+}
+
+//# sourceMappingURL=payment-methods.js.map

package/src/lib/server/payment-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/payment-methods.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { checkEntitlement, pluginRequestFromWeb } from '@aglyn/aglyn/server'\nimport type { SiteReturnHost } from '@aglyn/aglyn/app-utils/site-return-url'\nimport {\n  emailUnverifiedResponse,\n  firebaseAdmin,\n  getOrgForHost,\n  isImpersonationSession,\n  lockdownRefusal,\n} from '@aglyn/tenant-data-admin'\nimport { invalidIdTokenResponse } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport {\n  isStorefrontPaymentMethodOn,\n  normalizeStorefrontPaymentMethodSettings,\n  STOREFRONT_PAYMENT_METHODS,\n  type StorefrontPaymentMethodId,\n  type StorefrontPaymentMethodSettings,\n} from '../model/commerce-payment-methods'\nimport {\n  type PaymentMethodDomainRecord,\n  readSiteDomainRecords,\n} from './payment-method-domains'\n\n/**\n * The merchant's payment methods card (AGL-3629):\n * `GET|POST /api/commerce/payment-methods?hostId=…`, served by the console.\n *\n * GET answers, per method, three facts the card needs and no client can read:\n *\n *  - whether the PLATFORM offers it (its default payment method configuration\n *    — storefront charges are destination charges with the platform as\n *    merchant of record, so that configuration is the ceiling). A method the\n *    platform has not turned on, or that Stripe has not made available to it,\n *    is reported `unavailable` and the card does not show it at all;\n *  - the connected account's capability for it, which Stripe asks platforms to\n *    request before an account accepts BNPL, Cash App, Amazon Pay or crypto;\n *  - the site's domain registrations, which Apple Pay depends on.\n *\n * POST saves the toggles to `hosts/{hostId}/settings/store.paymentMethods` and\n * requests the capability of each method turned on, in one account update with\n * an idempotency key. Server-side, because the toggle and the capability are\n * one decision: a toggle saved by the browser with no capability behind it\n * would read as on and never appear.\n */\n\nexport type PlatformAvailability = 'on' | 'unavailable' | null\n\nexport type CapabilityStatus = 'active' | 'pending' | 'inactive' | 'unrequested' | null\n\nexport interface PaymentMethodRow {\n  id: StorefrontPaymentMethodId\n  on: boolean\n  platform: PlatformAvailability\n  capability: CapabilityStatus\n}\n\nexport interface PaymentMethodsAnswer {\n  methods: PaymentMethodRow[]\n  domains: PaymentMethodDomainRecord[]\n  accountConnected: boolean\n  /** The caller may save toggles: a site admin. */\n  canEdit: boolean\n  /** The caller may open Stripe to finish a method: the organization owner. */\n  canFinish: boolean\n  warnings: string[]\n}\n\n/** How long the platform's configuration is trusted in memory. */\nconst PLATFORM_CONFIGURATION_TTL_MS = 10 * 60 * 1000\n\nlet platformCache: { at: number; value: Record<string, PlatformAvailability> } | null = null\n\n/** Test seam: forget the cached platform configuration. */\nexport function resetPlatformPaymentMethodCacheForTests(): void {\n  platformCache = null\n}\n\nasync function stripe<T>(\n  method: 'GET' | 'POST',\n  path: string,\n  params?: URLSearchParams,\n  idempotencyKey?: string,\n): Promise<T> {\n  const query = method === 'GET' && params ? `?${params}` : ''\n  const response = await fetch(`https://api.stripe.com/v1/${path}${query}`, {\n    method,\n    headers: {\n      Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n      ...(method === 'POST' && { 'Content-Type': 'application/x-www-form-urlencoded' }),\n      ...(idempotencyKey && { 'Idempotency-Key': idempotencyKey }),\n    },\n    ...(method === 'POST' && params && { body: params.toString() }),\n  })\n  const payload = (await response.json().catch(() => ({}))) as T & {\n    error?: { message?: string }\n  }\n  if (!response.ok) {\n    throw new Error(payload?.error?.message ?? `Stripe ${path} failed (${response.status})`)\n  }\n  return payload\n}\n\ninterface StripeConfiguration {\n  is_default?: boolean\n  application?: string | null\n  active?: boolean\n  [key: string]: unknown\n}\n\n/**\n * Which methods the platform's own default configuration offers. The list\n * also returns configurations OTHER Connect applications made for this\n * account (`application` set); those do not govern our sessions and are\n * skipped. `null` per method when Stripe could not be asked — the card then\n * shows the toggle without a verdict rather than hiding a method that may work.\n */\nexport async function platformPaymentMethodAvailability(): Promise<\n  Record<string, PlatformAvailability>\n> {\n  if (platformCache && Date.now() - platformCache.at < PLATFORM_CONFIGURATION_TTL_MS) {\n    return platformCache.value\n  }\n  const value: Record<string, PlatformAvailability> = {}\n  try {\n    const list = await stripe<{ data?: StripeConfiguration[] }>(\n      'GET',\n      'payment_method_configurations',\n      new URLSearchParams({ limit: '20' }),\n    )\n    const own =\n      list.data?.find((entry) => entry.is_default && !entry.application) ??\n      list.data?.find((entry) => !entry.application) ??\n      null\n    for (const method of STOREFRONT_PAYMENT_METHODS) {\n      if (!own) {\n        value[method.id] = null\n        continue\n      }\n      const entry = own[method.configurationKey] as\n        | { available?: boolean; display_preference?: { value?: string } }\n        | undefined\n      value[method.id] =\n        entry?.available === true && entry?.display_preference?.value === 'on'\n          ? 'on'\n          : 'unavailable'\n    }\n    platformCache = { at: Date.now(), value }\n  } catch (error) {\n    console.warn('[commerce] payment method configuration unreadable', error)\n    for (const method of STOREFRONT_PAYMENT_METHODS) value[method.id] = null\n  }\n  return value\n}\n\nfunction capabilityStatus(\n  capabilities: Record<string, string> | undefined,\n  key: string | undefined,\n): CapabilityStatus {\n  if (!key) return null\n  const status = capabilities?.[key]\n  if (status === 'active' || status === 'pending' || status === 'inactive') return status\n  return 'unrequested'\n}\n\nasync function readAccountCapabilities(\n  accountId: string | null,\n): Promise<Record<string, string> | undefined> {\n  if (!accountId) return undefined\n  try {\n    const account = await stripe<{ capabilities?: Record<string, string> }>(\n      'GET',\n      `accounts/${encodeURIComponent(accountId)}`,\n    )\n    return account.capabilities ?? {}\n  } catch (error) {\n    console.warn('[commerce] connected account unreadable', error)\n    return undefined\n  }\n}\n\n/** The capabilities a save asks Stripe for: on, offered, not yet requested. */\nexport function capabilitiesToRequest(\n  settings: StorefrontPaymentMethodSettings,\n  platform: Record<string, PlatformAvailability>,\n  capabilities: Record<string, string> | undefined,\n): string[] {\n  return STOREFRONT_PAYMENT_METHODS.filter(\n    (method) =>\n      method.capability &&\n      isStorefrontPaymentMethodOn(settings, method.id) &&\n      platform[method.id] !== 'unavailable' &&\n      capabilityStatus(capabilities, method.capability) === 'unrequested',\n  ).map((method) => method.capability as string)\n}\n\nexport function buildPaymentMethodRows(\n  settings: StorefrontPaymentMethodSettings,\n  platform: Record<string, PlatformAvailability>,\n  capabilities: Record<string, string> | undefined,\n): PaymentMethodRow[] {\n  return STOREFRONT_PAYMENT_METHODS.map((method) => ({\n    id: method.id,\n    on: isStorefrontPaymentMethodOn(settings, method.id),\n    platform: platform[method.id] ?? null,\n    capability: capabilities ? capabilityStatus(capabilities, method.capability) : null,\n  }))\n}\n\nconst json = (body: unknown, status = 200) => Response.json(body, { status })\n\n/**\n * Where Stripe sends the owner back: the console page they pressed the button\n * on, judged against the request's own origin so a forged `Referer` cannot\n * turn the link into a redirect to somewhere else.\n */\nexport function consoleReturnUrl(headers: Partial<Record<string, string>>): string {\n  const origin = headers.origin || (headers.host ? `https://${headers.host}` : '')\n  const referer = headers.referer ?? ''\n  try {\n    if (origin && referer && new URL(referer).origin === new URL(origin).origin) {\n      return referer\n    }\n  } catch {\n    // Unparseable: fall through to the origin.\n  }\n  return origin || 'https://localhost/'\n}\n\nexport async function paymentMethodsHandler(request: Request): Promise<Response> {\n  const { method, headers: rawHeaders, query, body } = await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'GET' && method !== 'POST') {\n    return json({ error: 'Method not allowed' }, 405)\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return json({ error: 'Payments are not configured (STRIPE_SECRET_KEY).' }, 501)\n  }\n  const authorization = headers.authorization ?? ''\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return json({ error: 'Unauthenticated' }, 401)\n\n  const parsed =\n    typeof body === 'string' ? (JSON.parse(body || '{}') as Record<string, unknown>) : (body ?? {})\n  const hostId = String(\n    (method === 'GET' ? query?.['hostId'] : (parsed as Record<string, unknown>)['hostId']) ?? '',\n  )\n  if (!hostId) return json({ error: 'Missing hostId' }, 400)\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      return emailUnverifiedResponse()\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) return json({ error: 'Not found' }, 404)\n\n    // An allowlist. Reading the card is for whoever manages the store; a\n    // change asks Stripe for capabilities on the owner's payout account, so it\n    // is an admin's, like connecting that account is the owner's.\n    const role = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    const mayRead = role === 'admin' || role === 'editor'\n    if (!mayRead) return json({ error: 'Not found' }, 404)\n    if (method === 'POST' && role !== 'admin') {\n      return json({ error: 'Only a site admin can change payment methods' }, 403)\n    }\n\n    const owner = await getOrgForHost(hostId)\n    const locked = await lockdownRefusal({\n      request,\n      staff: decoded['staff'] === true,\n      uid: decoded.uid,\n      org: owner?.org,\n      host: hostSnapshot.data(),\n    })\n    if (locked) return locked\n    if (!checkEntitlement((owner?.org ?? {}) as never, 'commerce')) {\n      return json({ error: 'Selling is not included on this plan' }, 402)\n    }\n\n    const ownerUid = String(owner?.org?.ownerUid ?? '')\n    const accountId = ownerUid\n      ? (((await firestore.collection('profiles').doc(ownerUid).get()).get(\n          'stripeAccountId',\n        ) as string | undefined) ?? null)\n      : null\n\n    const storeRef = hostRef.collection('settings').doc('store')\n    let settings = normalizeStorefrontPaymentMethodSettings(\n      (await storeRef.get()).get('paymentMethods'),\n    )\n    const platform = await platformPaymentMethodAvailability()\n    let capabilities = await readAccountCapabilities(accountId)\n    const warnings: string[] = []\n\n    // FINISH IN STRIPE: a capability Stripe holds `inactive` needs details\n    // only the account holder can give, and an Express account has no login of\n    // its own, so a link minted here is the only way in. The owner's alone,\n    // as connecting the account is (`connect.ts`): the link opens the owner's\n    // identity and bank details.\n    if (method === 'POST' && (parsed as Record<string, unknown>)['action'] === 'finish') {\n      if (!accountId || decoded.uid !== ownerUid) {\n        return json({ error: 'Only the organization owner can finish this in Stripe' }, 403)\n      }\n      const back = consoleReturnUrl(headers)\n      const link = await stripe<{ url?: string }>(\n        'POST',\n        'account_links',\n        new URLSearchParams({\n          account: accountId,\n          type: 'account_onboarding',\n          'collection_options[fields]': 'currently_due',\n          refresh_url: back,\n          return_url: back,\n        }),\n      )\n      return json({ url: link.url ?? null })\n    }\n\n    if (method === 'POST') {\n      const requested = normalizeStorefrontPaymentMethodSettings(\n        (parsed as Record<string, unknown>)['methods'],\n      )\n      if (!Object.keys(requested).length) {\n        return json({ error: 'Nothing to save' }, 400)\n      }\n      settings = { ...settings, ...requested }\n      await storeRef.set(\n        { paymentMethods: settings, paymentMethodsUpdatedAtMs: Date.now(), paymentMethodsUpdatedBy: decoded.uid },\n        { merge: true },\n      )\n      const wanted = accountId ? capabilitiesToRequest(settings, platform, capabilities) : []\n      if (accountId && wanted.length) {\n        const params = new URLSearchParams()\n        for (const capability of wanted) {\n          params.set(`capabilities[${capability}][requested]`, 'true')\n        }\n        try {\n          const account = await stripe<{ capabilities?: Record<string, string> }>(\n            'POST',\n            `accounts/${encodeURIComponent(accountId)}`,\n            params,\n            `aglyn-pm-capabilities:${accountId}:${[...wanted].sort().join(',')}`,\n          )\n          capabilities = account.capabilities ?? capabilities\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error)\n          warnings.push(\n            `Stripe did not accept the request to enable ${wanted.join(', ')} on your payout account: ${message}`,\n          )\n        }\n      }\n    }\n\n    const answer: PaymentMethodsAnswer = {\n      methods: buildPaymentMethodRows(settings, platform, capabilities),\n      domains: await readSiteDomainRecords(hostSnapshot.data() as SiteReturnHost | undefined),\n      accountConnected: Boolean(accountId),\n      canEdit: role === 'admin',\n      canFinish: Boolean(accountId) && decoded.uid === ownerUid,\n      warnings,\n    }\n    return json(answer)\n  } catch (error) {\n    const unauthenticated = invalidIdTokenResponse(error)\n    if (unauthenticated) return unauthenticated\n    console.error(error)\n    return json({ error: 'Payment methods could not be loaded' }, 500)\n  }\n}\n"],"names":["checkEntitlement","pluginRequestFromWeb","emailUnverifiedResponse","firebaseAdmin","getOrgForHost","isImpersonationSession","lockdownRefusal","invalidIdTokenResponse","isStorefrontPaymentMethodOn","normalizeStorefrontPaymentMethodSettings","STOREFRONT_PAYMENT_METHODS","readSiteDomainRecords","PLATFORM_CONFIGURATION_TTL_MS","platformCache","resetPlatformPaymentMethodCacheForTests","stripe","method","path","params","idempotencyKey","query","response","fetch","headers","Authorization","process","env","STRIPE_SECRET_KEY","body","toString","payload","json","catch","ok","Error","error","message","status","platformPaymentMethodAvailability","Date","now","at","value","list","URLSearchParams","limit","own","data","find","entry","is_default","application","id","configurationKey","available","display_preference","console","warn","capabilityStatus","capabilities","key","readAccountCapabilities","accountId","undefined","account","encodeURIComponent","capabilitiesToRequest","settings","platform","filter","capability","map","buildPaymentMethodRows","on","Response","consoleReturnUrl","origin","host","referer","URL","paymentMethodsHandler","request","rawHeaders","authorization","idToken","startsWith","slice","length","parsed","JSON","parse","hostId","String","hostSnapshot","owner","decoded","app","auth","verifyIdToken","email_verified","firestore","hostRef","collection","doc","get","exists","role","uid","mayRead","locked","staff","org","ownerUid","storeRef","warnings","link","back","type","refresh_url","return_url","url","requested","Object","keys","set","paymentMethods","paymentMethodsUpdatedAtMs","paymentMethodsUpdatedBy","merge","wanted","sort","join","push","answer","methods","domains","accountConnected","Boolean","canEdit","canFinish","unauthenticated"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,EAAEC,oBAAoB,QAAQ,sBAAqB;AAE5E,SACEC,uBAAuB,EACvBC,aAAa,EACbC,aAAa,EACbC,sBAAsB,EACtBC,eAAe,QACV,2BAA0B;AACjC,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SACEC,2BAA2B,EAC3BC,wCAAwC,EACxCC,0BAA0B,QAGrB,uCAAmC;AAC1C,SAEEC,qBAAqB,QAChB,8BAA0B;AA8CjC,gEAAgE,GAChE,MAAMC,gCAAgC,KAAK,KAAK;AAEhD,IAAIC,gBAAoF;AAExF,yDAAyD,GACzD,OAAO,SAASC;IACdD,gBAAgB;AAClB;AAEA,eAAeE,OACbC,MAAsB,EACtBC,IAAY,EACZC,MAAwB,EACxBC,cAAuB;IAEvB,MAAMC,QAAQJ,WAAW,SAASE,SAAS,CAAC,CAAC,EAAEA,QAAQ,GAAG;IAC1D,MAAMG,WAAW,MAAMC,MAAM,CAAC,0BAA0B,EAAEL,OAAOG,OAAO,EAAE;QACxEJ;QACAO,SAAS;YACPC,eAAe,CAAC,OAAO,EAAEC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;WACpDX,WAAW,UAAU;YAAE,gBAAgB;QAAoC,GAC3EG,kBAAkB;YAAE,mBAAmBA;QAAe;OAExDH,WAAW,UAAUE,UAAU;QAAEU,MAAMV,OAAOW,QAAQ;IAAG;IAE/D,MAAMC,UAAW,MAAMT,SAASU,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;IAGrD,IAAI,CAACX,SAASY,EAAE,EAAE;;YACAH;QAAhB,MAAM,IAAII,cAAMJ,4BAAAA,iBAAAA,QAASK,KAAK,qBAAdL,eAAgBM,OAAO,mBAAI,CAAC,OAAO,EAAEnB,KAAK,SAAS,EAAEI,SAASgB,MAAM,CAAC,CAAC,CAAC;IACzF;IACA,OAAOP;AACT;AASA;;;;;;CAMC,GACD,OAAO,eAAeQ;IAGpB,IAAIzB,iBAAiB0B,KAAKC,GAAG,KAAK3B,cAAc4B,EAAE,GAAG7B,+BAA+B;QAClF,OAAOC,cAAc6B,KAAK;IAC5B;IACA,MAAMA,QAA8C,CAAC;IACrD,IAAI;YAOAC;YAAAA,YACAA;QAPF,MAAMA,OAAO,MAAM5B,OACjB,OACA,iCACA,IAAI6B,gBAAgB;YAAEC,OAAO;QAAK;QAEpC,MAAMC,OACJH,iBAAAA,aAAAA,KAAKI,IAAI,qBAATJ,WAAWK,IAAI,CAAC,CAACC,QAAUA,MAAMC,UAAU,IAAI,CAACD,MAAME,WAAW,sBACjER,cAAAA,KAAKI,IAAI,qBAATJ,YAAWK,IAAI,CAAC,CAACC,QAAU,CAACA,MAAME,WAAW,aAD7CR,OAEA;QACF,KAAK,MAAM3B,UAAUN,2BAA4B;gBAShBuC;YAR/B,IAAI,CAACH,KAAK;gBACRJ,KAAK,CAAC1B,OAAOoC,EAAE,CAAC,GAAG;gBACnB;YACF;YACA,MAAMH,QAAQH,GAAG,CAAC9B,OAAOqC,gBAAgB,CAAC;YAG1CX,KAAK,CAAC1B,OAAOoC,EAAE,CAAC,GACdH,CAAAA,yBAAAA,MAAOK,SAAS,MAAK,QAAQL,CAAAA,0BAAAA,4BAAAA,MAAOM,kBAAkB,qBAAzBN,0BAA2BP,KAAK,MAAK,OAC9D,OACA;QACR;QACA7B,gBAAgB;YAAE4B,IAAIF,KAAKC,GAAG;YAAIE;QAAM;IAC1C,EAAE,OAAOP,OAAO;QACdqB,QAAQC,IAAI,CAAC,sDAAsDtB;QACnE,KAAK,MAAMnB,UAAUN,2BAA4BgC,KAAK,CAAC1B,OAAOoC,EAAE,CAAC,GAAG;IACtE;IACA,OAAOV;AACT;AAEA,SAASgB,iBACPC,YAAgD,EAChDC,GAAuB;IAEvB,IAAI,CAACA,KAAK,OAAO;IACjB,MAAMvB,SAASsB,gCAAAA,YAAc,CAACC,IAAI;IAClC,IAAIvB,WAAW,YAAYA,WAAW,aAAaA,WAAW,YAAY,OAAOA;IACjF,OAAO;AACT;AAEA,eAAewB,wBACbC,SAAwB;IAExB,IAAI,CAACA,WAAW,OAAOC;IACvB,IAAI;YAKKC;QAJP,MAAMA,UAAU,MAAMjD,OACpB,OACA,CAAC,SAAS,EAAEkD,mBAAmBH,YAAY;QAE7C,QAAOE,wBAAAA,QAAQL,YAAY,YAApBK,wBAAwB,CAAC;IAClC,EAAE,OAAO7B,OAAO;QACdqB,QAAQC,IAAI,CAAC,2CAA2CtB;QACxD,OAAO4B;IACT;AACF;AAEA,6EAA6E,GAC7E,OAAO,SAASG,sBACdC,QAAyC,EACzCC,QAA8C,EAC9CT,YAAgD;IAEhD,OAAOjD,2BAA2B2D,MAAM,CACtC,CAACrD,SACCA,OAAOsD,UAAU,IACjB9D,4BAA4B2D,UAAUnD,OAAOoC,EAAE,KAC/CgB,QAAQ,CAACpD,OAAOoC,EAAE,CAAC,KAAK,iBACxBM,iBAAiBC,cAAc3C,OAAOsD,UAAU,MAAM,eACxDC,GAAG,CAAC,CAACvD,SAAWA,OAAOsD,UAAU;AACrC;AAEA,OAAO,SAASE,uBACdL,QAAyC,EACzCC,QAA8C,EAC9CT,YAAgD;IAEhD,OAAOjD,2BAA2B6D,GAAG,CAAC,CAACvD;YAG3BoD;eAHuC;YACjDhB,IAAIpC,OAAOoC,EAAE;YACbqB,IAAIjE,4BAA4B2D,UAAUnD,OAAOoC,EAAE;YACnDgB,QAAQ,GAAEA,sBAAAA,QAAQ,CAACpD,OAAOoC,EAAE,CAAC,YAAnBgB,sBAAuB;YACjCE,YAAYX,eAAeD,iBAAiBC,cAAc3C,OAAOsD,UAAU,IAAI;QACjF;;AACF;AAEA,MAAMvC,OAAO,CAACH,MAAeS,SAAS,GAAG,GAAKqC,SAAS3C,IAAI,CAACH,MAAM;QAAES;IAAO;AAE3E;;;;CAIC,GACD,OAAO,SAASsC,iBAAiBpD,OAAwC;QAEvDA;IADhB,MAAMqD,SAASrD,QAAQqD,MAAM,IAAKrD,CAAAA,QAAQsD,IAAI,GAAG,CAAC,QAAQ,EAAEtD,QAAQsD,IAAI,EAAE,GAAG,EAAC;IAC9E,MAAMC,WAAUvD,mBAAAA,QAAQuD,OAAO,YAAfvD,mBAAmB;IACnC,IAAI;QACF,IAAIqD,UAAUE,WAAW,IAAIC,IAAID,SAASF,MAAM,KAAK,IAAIG,IAAIH,QAAQA,MAAM,EAAE;YAC3E,OAAOE;QACT;IACF,EAAE,eAAM;IACN,2CAA2C;IAC7C;IACA,OAAOF,UAAU;AACnB;AAEA,OAAO,eAAeI,sBAAsBC,OAAgB;QASpC1D,wBASnBP;IAjBH,MAAM,EAAEA,MAAM,EAAEO,SAAS2D,UAAU,EAAE9D,KAAK,EAAEQ,IAAI,EAAE,GAAG,MAAM3B,qBAAqBgF;IAChF,MAAM1D,UAAU2D;IAChB,IAAIlE,WAAW,SAASA,WAAW,QAAQ;QACzC,OAAOe,KAAK;YAAEI,OAAO;QAAqB,GAAG;IAC/C;IACA,IAAI,CAACV,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOI,KAAK;YAAEI,OAAO;QAAmD,GAAG;IAC7E;IACA,MAAMgD,iBAAgB5D,yBAAAA,QAAQ4D,aAAa,YAArB5D,yBAAyB;IAC/C,MAAM6D,UAAUD,cAAcE,UAAU,CAAC,aACrCF,cAAcG,KAAK,CAAC,UAAUC,MAAM,IACpCxB;IACJ,IAAI,CAACqB,SAAS,OAAOrD,KAAK;QAAEI,OAAO;IAAkB,GAAG;IAExD,MAAMqD,SACJ,OAAO5D,SAAS,WAAY6D,KAAKC,KAAK,CAAC9D,QAAQ,QAAqCA,eAAAA,OAAQ,CAAC;IAC/F,MAAM+D,SAASC,QACZ5E,OAAAA,WAAW,QAAQI,yBAAAA,KAAO,CAAC,SAAS,GAAG,AAACoE,MAAkC,CAAC,SAAS,YAApFxE,OAAyF;IAE5F,IAAI,CAAC2E,QAAQ,OAAO5D,KAAK;QAAEI,OAAO;IAAiB,GAAG;IAEtD,IAAI;YAaY0D,iCAsBR;YAFkBC;QAhCxB,MAAMC,UAAU,MAAM5F,cAAc6F,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACd;QAC/D,IAAI,CAACW,QAAQI,cAAc,IAAI,CAAC9F,uBAAuB0F,UAAU;YAC/D,OAAO7F;QACT;QACA,MAAMkG,YAAYjG,cAAc6F,GAAG,GAAGI,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACZ;QAClD,MAAME,eAAe,MAAMQ,QAAQG,GAAG;QACtC,IAAI,CAACX,aAAaY,MAAM,EAAE,OAAO1E,KAAK;YAAEI,OAAO;QAAY,GAAG;QAE9D,qEAAqE;QACrE,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAMuE,OAAO,EAACb,oBAAAA,aAAaW,GAAG,CAAC,0BAAjBX,oBAAmC,CAAC,EAAE,CAACE,QAAQY,GAAG,CAAC;QACjE,MAAMC,UAAUF,SAAS,WAAWA,SAAS;QAC7C,IAAI,CAACE,SAAS,OAAO7E,KAAK;YAAEI,OAAO;QAAY,GAAG;QAClD,IAAInB,WAAW,UAAU0F,SAAS,SAAS;YACzC,OAAO3E,KAAK;gBAAEI,OAAO;YAA+C,GAAG;QACzE;QAEA,MAAM2D,QAAQ,MAAM1F,cAAcuF;QAClC,MAAMkB,SAAS,MAAMvG,gBAAgB;YACnC2E;YACA6B,OAAOf,OAAO,CAAC,QAAQ,KAAK;YAC5BY,KAAKZ,QAAQY,GAAG;YAChBI,GAAG,EAAEjB,yBAAAA,MAAOiB,GAAG;YACflC,MAAMgB,aAAa9C,IAAI;QACzB;QACA,IAAI8D,QAAQ,OAAOA;QACnB,IAAI,CAAC7G,0BAAkB8F,yBAAAA,MAAOiB,GAAG,oBAAI,CAAC,GAAa,aAAa;YAC9D,OAAOhF,KAAK;gBAAEI,OAAO;YAAuC,GAAG;QACjE;QAEA,MAAM6E,WAAWpB,gBAAOE,0BAAAA,aAAAA,MAAOiB,GAAG,qBAAVjB,WAAYkB,QAAQ,oBAAI;QAChD,MAAMlD,YAAYkD,YACZ,OAAA,AAAC,CAAA,MAAMZ,UAAUE,UAAU,CAAC,YAAYC,GAAG,CAACS,UAAUR,GAAG,EAAC,EAAGA,GAAG,CAChE,8BADA,OAE0B,OAC5B;QAEJ,MAAMS,WAAWZ,QAAQC,UAAU,CAAC,YAAYC,GAAG,CAAC;QACpD,IAAIpC,WAAW1D,yCACb,AAAC,CAAA,MAAMwG,SAAST,GAAG,EAAC,EAAGA,GAAG,CAAC;QAE7B,MAAMpC,WAAW,MAAM9B;QACvB,IAAIqB,eAAe,MAAME,wBAAwBC;QACjD,MAAMoD,WAAqB,EAAE;QAE7B,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,6BAA6B;QAC7B,IAAIlG,WAAW,UAAU,AAACwE,MAAkC,CAAC,SAAS,KAAK,UAAU;gBAgBhE2B;YAfnB,IAAI,CAACrD,aAAaiC,QAAQY,GAAG,KAAKK,UAAU;gBAC1C,OAAOjF,KAAK;oBAAEI,OAAO;gBAAwD,GAAG;YAClF;YACA,MAAMiF,OAAOzC,iBAAiBpD;YAC9B,MAAM4F,OAAO,MAAMpG,OACjB,QACA,iBACA,IAAI6B,gBAAgB;gBAClBoB,SAASF;gBACTuD,MAAM;gBACN,8BAA8B;gBAC9BC,aAAaF;gBACbG,YAAYH;YACd;YAEF,OAAOrF,KAAK;gBAAEyF,GAAG,GAAEL,YAAAA,KAAKK,GAAG,YAARL,YAAY;YAAK;QACtC;QAEA,IAAInG,WAAW,QAAQ;YACrB,MAAMyG,YAAYhH,yCAChB,AAAC+E,MAAkC,CAAC,UAAU;YAEhD,IAAI,CAACkC,OAAOC,IAAI,CAACF,WAAWlC,MAAM,EAAE;gBAClC,OAAOxD,KAAK;oBAAEI,OAAO;gBAAkB,GAAG;YAC5C;YACAgC,WAAW,aAAKA,UAAasD;YAC7B,MAAMR,SAASW,GAAG,CAChB;gBAAEC,gBAAgB1D;gBAAU2D,2BAA2BvF,KAAKC,GAAG;gBAAIuF,yBAAyBhC,QAAQY,GAAG;YAAC,GACxG;gBAAEqB,OAAO;YAAK;YAEhB,MAAMC,SAASnE,YAAYI,sBAAsBC,UAAUC,UAAUT,gBAAgB,EAAE;YACvF,IAAIG,aAAamE,OAAO1C,MAAM,EAAE;gBAC9B,MAAMrE,SAAS,IAAI0B;gBACnB,KAAK,MAAM0B,cAAc2D,OAAQ;oBAC/B/G,OAAO0G,GAAG,CAAC,CAAC,aAAa,EAAEtD,WAAW,YAAY,CAAC,EAAE;gBACvD;gBACA,IAAI;wBAOaN;oBANf,MAAMA,UAAU,MAAMjD,OACpB,QACA,CAAC,SAAS,EAAEkD,mBAAmBH,YAAY,EAC3C5C,QACA,CAAC,sBAAsB,EAAE4C,UAAU,CAAC,EAAE;2BAAImE;qBAAO,CAACC,IAAI,GAAGC,IAAI,CAAC,MAAM;oBAEtExE,gBAAeK,wBAAAA,QAAQL,YAAY,YAApBK,wBAAwBL;gBACzC,EAAE,OAAOxB,OAAO;oBACd,MAAMC,UAAUD,iBAAiBD,QAAQC,MAAMC,OAAO,GAAGwD,OAAOzD;oBAChE+E,SAASkB,IAAI,CACX,CAAC,4CAA4C,EAAEH,OAAOE,IAAI,CAAC,MAAM,yBAAyB,EAAE/F,SAAS;gBAEzG;YACF;QACF;QAEA,MAAMiG,SAA+B;YACnCC,SAAS9D,uBAAuBL,UAAUC,UAAUT;YACpD4E,SAAS,MAAM5H,sBAAsBkF,aAAa9C,IAAI;YACtDyF,kBAAkBC,QAAQ3E;YAC1B4E,SAAShC,SAAS;YAClBiC,WAAWF,QAAQ3E,cAAciC,QAAQY,GAAG,KAAKK;YACjDE;QACF;QACA,OAAOnF,KAAKsG;IACd,EAAE,OAAOlG,OAAO;QACd,MAAMyG,kBAAkBrI,uBAAuB4B;QAC/C,IAAIyG,iBAAiB,OAAOA;QAC5BpF,QAAQrB,KAAK,CAACA;QACd,OAAOJ,KAAK;YAAEI,OAAO;QAAsC,GAAG;IAChE;AACF"}

package/src/lib/server/pos-auth.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiRequest } from '@aglyn/aglyn/server';
+/** Who is working the register, once the gate has admitted them. */
+export interface PosStaff {
+    uid: string;
+    hostId: string;
+    orgId: string;
+    org: Record<string, any> | null;
+}
+export type PosStaffGate = {
+    ok: true;
+    staff: PosStaff;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+/**
+ * The register's gate, shared by every POS route (AGL-3607): the same three
+ * questions `pos-order.ts` asks, in the same order, so a payment, a reader or
+ * a display pairing is refused to exactly the people a sale is refused to.
+ *
+ * 1. A Firebase ID token.
+ * 2. `admin` or `editor` on THIS site (`memberRoles`), an allowlist so a role
+ *    added later is refused until someone decides otherwise (AGL-2262).
+ * 3. `managePos` on the member's resolved permissions (AGL-2474), and the
+ *    `pos` plan entitlement on the org that owns the site.
+ */
+export declare function authorizePosStaff(req: PluginApiRequest, hostId: string): Promise<PosStaffGate>;
+/** A JSON body, whether the dispatcher parsed it or not. */
+export declare function posRequestBody(req: PluginApiRequest): Record<string, any>;
+/** A GET request's query as a flat body, first value of each key. */
+export declare function posQueryBody(req: PluginApiRequest): Record<string, any>;
+/** The request's Idempotency-Key header, trimmed and bounded. */
+export declare function posIdempotencyKey(req: PluginApiRequest): string;

package/src/lib/server/pos-auth.js

@@ -0,0 +1,121 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+/**
+ * The register's gate, shared by every POS route (AGL-3607): the same three
+ * questions `pos-order.ts` asks, in the same order, so a payment, a reader or
+ * a display pairing is refused to exactly the people a sale is refused to.
+ *
+ * 1. A Firebase ID token.
+ * 2. `admin` or `editor` on THIS site (`memberRoles`), an allowlist so a role
+ *    added later is refused until someone decides otherwise (AGL-2262).
+ * 3. `managePos` on the member's resolved permissions (AGL-2474), and the
+ *    `pos` plan entitlement on the org that owns the site.
+ */ export async function authorizePosStaff(req, hostId) {
+    var _req_headers_authorization, _hostSnapshot_get, _ref, _ref1, _ref2;
+    var _ownerOrg_org;
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
+    if (!idToken) return {
+        ok: false,
+        status: 401,
+        error: 'Unauthenticated'
+    };
+    if (!hostId) return {
+        ok: false,
+        status: 400,
+        error: 'Missing hostId'
+    };
+    let uid;
+    try {
+        uid = (await firebaseAdmin.app().auth().verifyIdToken(idToken)).uid;
+    } catch (error) {
+        if (!isRefusedIdToken(error)) throw error;
+        return {
+            ok: false,
+            status: 401,
+            error: 'Unauthenticated'
+        };
+    }
+    const hostSnapshot = await firebaseAdmin.app().firestore().collection('hosts').doc(hostId).get();
+    if (!hostSnapshot.exists) return {
+        ok: false,
+        status: 404,
+        error: 'Unknown site'
+    };
+    const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[uid];
+    if (memberRole !== 'admin' && memberRole !== 'editor') {
+        return {
+            ok: false,
+            status: 403,
+            error: 'Not permitted'
+        };
+    }
+    const membership = await resolveOrgPermissions(uid, {
+        hostId
+    });
+    if (!membership.permissions.managePos) {
+        return {
+            ok: false,
+            status: 403,
+            error: 'Not permitted'
+        };
+    }
+    const ownerOrg = await getOrgForHost(hostId);
+    if (!Aglyn.checkEntitlement(ownerOrg == null ? void 0 : ownerOrg.org, 'pos')) {
+        return {
+            ok: false,
+            status: 403,
+            error: 'POS requires the Pro plan or above'
+        };
+    }
+    return {
+        ok: true,
+        staff: {
+            uid,
+            hostId,
+            orgId: String((_ref = (_ref1 = ownerOrg == null ? void 0 : (_ownerOrg_org = ownerOrg.org) == null ? void 0 : _ownerOrg_org.id) != null ? _ref1 : ownerOrg == null ? void 0 : ownerOrg.orgId) != null ? _ref : ''),
+            org: (_ref2 = ownerOrg == null ? void 0 : ownerOrg.org) != null ? _ref2 : null
+        }
+    };
+}
+/** A JSON body, whether the dispatcher parsed it or not. */ export function posRequestBody(req) {
+    if (typeof req.body === 'string') {
+        try {
+            const parsed = JSON.parse(req.body);
+            return parsed && typeof parsed === 'object' ? parsed : {};
+        } catch (unused) {
+            return {};
+        }
+    }
+    return req.body && typeof req.body === 'object' ? req.body : {};
+}
+/** A GET request's query as a flat body, first value of each key. */ export function posQueryBody(req) {
+    var _req_query;
+    return Object.fromEntries(Object.entries((_req_query = req.query) != null ? _req_query : {}).map(([key, value])=>[
+            key,
+            Array.isArray(value) ? value[0] : value
+        ]));
+}
+/** The request's Idempotency-Key header, trimmed and bounded. */ export function posIdempotencyKey(req) {
+    var _ref, _req_headers_idempotencykey;
+    return String((_ref = (_req_headers_idempotencykey = req.headers['idempotency-key']) != null ? _req_headers_idempotencykey : req.headers['Idempotency-Key']) != null ? _ref : '').trim().slice(0, 200);
+}
+
+//# sourceMappingURL=pos-auth.js.map

package/src/lib/server/pos-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-auth.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport type { PluginApiRequest } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\n\n/** Who is working the register, once the gate has admitted them. */\nexport interface PosStaff {\n  uid: string\n  hostId: string\n  orgId: string\n  org: Record<string, any> | null\n}\n\nexport type PosStaffGate =\n  | { ok: true; staff: PosStaff }\n  | { ok: false; status: number; error: string }\n\n/**\n * The register's gate, shared by every POS route (AGL-3607): the same three\n * questions `pos-order.ts` asks, in the same order, so a payment, a reader or\n * a display pairing is refused to exactly the people a sale is refused to.\n *\n * 1. A Firebase ID token.\n * 2. `admin` or `editor` on THIS site (`memberRoles`), an allowlist so a role\n *    added later is refused until someone decides otherwise (AGL-2262).\n * 3. `managePos` on the member's resolved permissions (AGL-2474), and the\n *    `pos` plan entitlement on the org that owns the site.\n */\nexport async function authorizePosStaff(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<PosStaffGate> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : ''\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  if (!hostId) return { ok: false, status: 400, error: 'Missing hostId' }\n  let uid: string\n  try {\n    uid = (await firebaseAdmin.app().auth().verifyIdToken(idToken)).uid\n  } catch (error) {\n    if (!isRefusedIdToken(error)) throw error\n    return { ok: false, status: 401, error: 'Unauthenticated' }\n  }\n  const hostSnapshot = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  const membership = await resolveOrgPermissions(uid, { hostId })\n  if (!membership.permissions.managePos) {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  const ownerOrg = await getOrgForHost(hostId)\n  if (!Aglyn.checkEntitlement(ownerOrg?.org as any, 'pos')) {\n    return { ok: false, status: 403, error: 'POS requires the Pro plan or above' }\n  }\n  return {\n    ok: true,\n    staff: {\n      uid,\n      hostId,\n      orgId: String(ownerOrg?.org?.id ?? ownerOrg?.orgId ?? ''),\n      org: (ownerOrg?.org as Record<string, any>) ?? null,\n    },\n  }\n}\n\n/** A JSON body, whether the dispatcher parsed it or not. */\nexport function posRequestBody(req: PluginApiRequest): Record<string, any> {\n  if (typeof req.body === 'string') {\n    try {\n      const parsed = JSON.parse(req.body)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return req.body && typeof req.body === 'object' ? req.body : {}\n}\n\n/** A GET request's query as a flat body, first value of each key. */\nexport function posQueryBody(req: PluginApiRequest): Record<string, any> {\n  return Object.fromEntries(\n    Object.entries(req.query ?? {}).map(([key, value]) => [\n      key,\n      Array.isArray(value) ? value[0] : value,\n    ]),\n  )\n}\n\n/** The request's Idempotency-Key header, trimmed and bounded. */\nexport function posIdempotencyKey(req: PluginApiRequest): string {\n  return String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n}\n"],"names":["Aglyn","firebaseAdmin","getOrgForHost","resolveOrgPermissions","isRefusedIdToken","authorizePosStaff","req","hostId","hostSnapshot","ownerOrg","authorization","String","headers","idToken","startsWith","slice","length","ok","status","error","uid","app","auth","verifyIdToken","firestore","collection","doc","get","exists","memberRole","membership","permissions","managePos","checkEntitlement","org","staff","orgId","id","posRequestBody","body","parsed","JSON","parse","posQueryBody","Object","fromEntries","entries","query","map","key","value","Array","isArray","posIdempotencyKey","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAE5C,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,gBAAgB,QAAQ,mDAAkD;AAcnF;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,kBACpBC,GAAqB,EACrBC,MAAc;QAEeD,4BAoBTE,mBAiBFC;QAAAA;IArClB,MAAMC,gBAAgBC,QAAOL,6BAAAA,IAAIM,OAAO,CAACF,aAAa,YAAzBJ,6BAA6B;IAC1D,MAAMO,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpC;IACJ,IAAI,CAACH,SAAS,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,IAAI,CAACZ,QAAQ,OAAO;QAAEU,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAiB;IACtE,IAAIC;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAMnB,cAAcoB,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV,QAAO,EAAGO,GAAG;IACrE,EAAE,OAAOD,OAAO;QACd,IAAI,CAACf,iBAAiBe,QAAQ,MAAMA;QACpC,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;IAC5D;IACA,MAAMX,eAAe,MAAMP,cACxBoB,GAAG,GACHG,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACnB,QACJoB,GAAG;IACN,IAAI,CAACnB,aAAaoB,MAAM,EAAE,OAAO;QAAEX,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACjF,MAAMU,aAAa,EAACrB,oBAAAA,aAAamB,GAAG,CAAC,0BAAjBnB,oBAAmC,CAAC,EAAE,CAACY,IAAI;IAC/D,IAAIS,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YAAEZ,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,MAAMW,aAAa,MAAM3B,sBAAsBiB,KAAK;QAAEb;IAAO;IAC7D,IAAI,CAACuB,WAAWC,WAAW,CAACC,SAAS,EAAE;QACrC,OAAO;YAAEf,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,MAAMV,WAAW,MAAMP,cAAcK;IACrC,IAAI,CAACP,MAAMiC,gBAAgB,CAACxB,4BAAAA,SAAUyB,GAAG,EAAS,QAAQ;QACxD,OAAO;YAAEjB,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAqC;IAC/E;IACA,OAAO;QACLF,IAAI;QACJkB,OAAO;YACLf;YACAb;YACA6B,OAAOzB,QAAOF,gBAAAA,6BAAAA,gBAAAA,SAAUyB,GAAG,qBAAbzB,cAAe4B,EAAE,oBAAI5B,4BAAAA,SAAU2B,KAAK,YAApC3B,OAAwC;YACtDyB,GAAG,WAAGzB,4BAAAA,SAAUyB,GAAG,oBAA4B;QACjD;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASI,eAAehC,GAAqB;IAClD,IAAI,OAAOA,IAAIiC,IAAI,KAAK,UAAU;QAChC,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACpC,IAAIiC,IAAI;YAClC,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOlC,IAAIiC,IAAI,IAAI,OAAOjC,IAAIiC,IAAI,KAAK,WAAWjC,IAAIiC,IAAI,GAAG,CAAC;AAChE;AAEA,mEAAmE,GACnE,OAAO,SAASI,aAAarC,GAAqB;QAE/BA;IADjB,OAAOsC,OAAOC,WAAW,CACvBD,OAAOE,OAAO,EAACxC,aAAAA,IAAIyC,KAAK,YAATzC,aAAa,CAAC,GAAG0C,GAAG,CAAC,CAAC,CAACC,KAAKC,MAAM,GAAK;YACpDD;YACAE,MAAMC,OAAO,CAACF,SAASA,KAAK,CAAC,EAAE,GAAGA;SACnC;AAEL;AAEA,+DAA+D,GAC/D,OAAO,SAASG,kBAAkB/C,GAAqB;QAEnDA,MAAAA;IADF,OAAOK,QACLL,QAAAA,8BAAAA,IAAIM,OAAO,CAAC,kBAAkB,YAA9BN,8BAAkCA,IAAIM,OAAO,CAAC,kBAAkB,YAAhEN,OAAoE,IAEnEgD,IAAI,GACJvC,KAAK,CAAC,GAAG;AACd"}

package/src/lib/server/pos-customer.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler, PluginApiRequest } from '@aglyn/aglyn/server';
+import type { PluginContactCaptureRequest, PluginContactCaptured } from '@aglyn/aglyn/plugin-manager/plugin-contact-capture';
+import { type PluginPersonRecord, type PluginPersonSearchRequest } from '@aglyn/aglyn/plugin-manager/plugin-person-records';
+import { type PosOpsDeps } from './pos-ops-gate';
+/** The statuses a customer actually paid in. A refund is netted, not excluded. */
+export declare const POS_CUSTOMER_PAID_STATUSES: readonly ["paid", "partially_fulfilled", "fulfilled", "delivered", "refunded"];
+export interface PosCustomerDeps extends PosOpsDeps {
+    searchPeople(request: PluginPersonSearchRequest): Promise<PluginPersonRecord[] | null>;
+    captureContact(request: PluginContactCaptureRequest): Promise<PluginContactCaptured | null>;
+    /** Orders, spend and refunds for one address on one site, by aggregate. */
+    orderStats(hostRef: FirebaseFirestore.DocumentReference, emailLower: string): Promise<{
+        orderCount: number;
+        spentCents: number;
+        refundedCents: number;
+    }>;
+}
+export declare function defaultPosCustomerDeps(): PosCustomerDeps;
+/** One person as the register lists them. */
+export interface PosCustomer {
+    kind: string;
+    id: string;
+    name: string;
+    email: string | null;
+    phone: string | null;
+}
+type Outcome = {
+    status: number;
+    body: Record<string, unknown>;
+};
+export declare function handlePosCustomer(deps: PosCustomerDeps, req: PluginApiRequest): Promise<Outcome>;
+export declare function createPosCustomerHandler(deps?: () => PosCustomerDeps): PluginApiHandler;
+export declare const posCustomerHandler: PluginApiHandler;
+export {};