@aglyn/plugins-commerce 1.0.0-beta.285 → 1.0.0-beta.288

package/src/lib/server/pos-auth.js

@@ -17,18 +17,44 @@
 import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
 import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
 import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { holdsPosPermission, posPermissionRefusal } from "../model/plugin-permissions.js";
+/** Who works the register: `managePos`, as resolved for the site (AGL-4047). */ export function worksPosRegister(permissions) {
+    return (permissions == null ? void 0 : permissions['managePos']) === true;
+}
 /**
- * The register's gate, shared by every POS route (AGL-3607): the same three
+ * The register's gate, shared by every POS route (AGL-3607): the same
  * questions `pos-order.ts` asks, in the same order, so a payment, a reader or
  * a display pairing is refused to exactly the people a sale is refused to.
  *
  * 1. A Firebase ID token.
- * 2. `admin` or `editor` on THIS site (`memberRoles`), an allowlist so a role
- *    added later is refused until someone decides otherwise (AGL-2262).
- * 3. `managePos` on the member's resolved permissions (AGL-2474), and the
- *    `pos` plan entitlement on the org that owns the site.
- */ export async function authorizePosStaff(req, hostId) {
-    var _req_headers_authorization, _hostSnapshot_get, _ref, _ref1, _ref2;
+ * 2. `managePos` on the member's permissions as resolved FOR THIS SITE
+ *    (AGL-2474) — or what `admits` asks instead — and the `pos` plan
+ *    entitlement on the org that owns the site.
+ * 3. When the route names one, the finer register key its action needs
+ *    (AGL-4047): `posSell`, `posDevices`, `posBuyHardware` and the rest,
+ *    each following `managePos` unless a role or the member sets it.
+ *
+ * THE KEYS DECIDE, NOT THE SITE ROLE (AGL-4047). This asked for `admin` or
+ * `editor` in the site's `memberRoles` as well, which is exactly the set the
+ * key is on for by default, so nobody who had the register loses it. The
+ * resolver answers for this site: an org-wide member from their org role,
+ * custom role and overrides; a site collaborator from the role they hold
+ * here and their overrides; and anyone without access to the site with
+ * nothing. So a site viewer the workspace grants the register works it, and
+ * an admin a role narrows is refused. A site no workspace owns resolves
+ * against the caller's own workspace, and is refused by the plan step, which
+ * reads the plan of the workspace that owns the site.
+ */ export async function authorizePosStaff(req, hostId, permission, /**
+   * Who the route admits before the finer key: whoever works the register,
+   * unless the route says otherwise — the hardware shop also admits a member
+   * who may buy hardware without the register.
+   */ admits = worksPosRegister, /**
+   * `planRequired: false` admits a workspace whose plan does not include the
+   * point of sale, for the one read that must tell such a workspace what it
+   * needs first: a card reader it bought in person, waiting for that plan
+   * (AGL-4038). Everything that acts still asks the plan.
+   */ options = {}) {
+    var _req_headers_authorization, _membership_permissions, _ref, _ref1, _ref2;
     var _ownerOrg_org;
     const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
     const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
@@ -59,26 +85,25 @@ import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refus
         status: 404,
         error: 'Unknown site'
     };
-    const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[uid];
-    if (memberRole !== 'admin' && memberRole !== 'editor') {
+    const membership = await resolveOrgPermissions(uid, {
+        hostId
+    });
+    if (!admits((_membership_permissions = membership.permissions) != null ? _membership_permissions : {})) {
         return {
             ok: false,
             status: 403,
             error: 'Not permitted'
         };
     }
-    const membership = await resolveOrgPermissions(uid, {
-        hostId
-    });
-    if (!membership.permissions.managePos) {
+    if (permission && !holdsPosPermission(membership.permissions, permission)) {
         return {
             ok: false,
             status: 403,
-            error: 'Not permitted'
+            error: posPermissionRefusal(permission)
         };
     }
     const ownerOrg = await getOrgForHost(hostId);
-    if (!Aglyn.checkEntitlement(ownerOrg == null ? void 0 : ownerOrg.org, 'pos')) {
+    if (options.planRequired !== false && !Aglyn.checkEntitlement(ownerOrg == null ? void 0 : ownerOrg.org, 'pos')) {
         return {
             ok: false,
             status: 403,

package/src/lib/server/pos-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-auth.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport type { PluginApiRequest } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\n\n/** Who is working the register, once the gate has admitted them. */\nexport interface PosStaff {\n  uid: string\n  hostId: string\n  orgId: string\n  org: Record<string, any> | null\n}\n\nexport type PosStaffGate =\n  | { ok: true; staff: PosStaff }\n  | { ok: false; status: number; error: string }\n\n/**\n * The register's gate, shared by every POS route (AGL-3607): the same three\n * questions `pos-order.ts` asks, in the same order, so a payment, a reader or\n * a display pairing is refused to exactly the people a sale is refused to.\n *\n * 1. A Firebase ID token.\n * 2. `admin` or `editor` on THIS site (`memberRoles`), an allowlist so a role\n *    added later is refused until someone decides otherwise (AGL-2262).\n * 3. `managePos` on the member's resolved permissions (AGL-2474), and the\n *    `pos` plan entitlement on the org that owns the site.\n */\nexport async function authorizePosStaff(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<PosStaffGate> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : ''\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  if (!hostId) return { ok: false, status: 400, error: 'Missing hostId' }\n  let uid: string\n  try {\n    uid = (await firebaseAdmin.app().auth().verifyIdToken(idToken)).uid\n  } catch (error) {\n    if (!isRefusedIdToken(error)) throw error\n    return { ok: false, status: 401, error: 'Unauthenticated' }\n  }\n  const hostSnapshot = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n  const memberRole = (hostSnapshot.get('memberRoles') ?? {})[uid]\n  if (memberRole !== 'admin' && memberRole !== 'editor') {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  const membership = await resolveOrgPermissions(uid, { hostId })\n  if (!membership.permissions.managePos) {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  const ownerOrg = await getOrgForHost(hostId)\n  if (!Aglyn.checkEntitlement(ownerOrg?.org as any, 'pos')) {\n    return { ok: false, status: 403, error: 'POS requires the Pro plan or above' }\n  }\n  return {\n    ok: true,\n    staff: {\n      uid,\n      hostId,\n      orgId: String(ownerOrg?.org?.id ?? ownerOrg?.orgId ?? ''),\n      org: (ownerOrg?.org as Record<string, any>) ?? null,\n    },\n  }\n}\n\n/** A JSON body, whether the dispatcher parsed it or not. */\nexport function posRequestBody(req: PluginApiRequest): Record<string, any> {\n  if (typeof req.body === 'string') {\n    try {\n      const parsed = JSON.parse(req.body)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return req.body && typeof req.body === 'object' ? req.body : {}\n}\n\n/** A GET request's query as a flat body, first value of each key. */\nexport function posQueryBody(req: PluginApiRequest): Record<string, any> {\n  return Object.fromEntries(\n    Object.entries(req.query ?? {}).map(([key, value]) => [\n      key,\n      Array.isArray(value) ? value[0] : value,\n    ]),\n  )\n}\n\n/** The request's Idempotency-Key header, trimmed and bounded. */\nexport function posIdempotencyKey(req: PluginApiRequest): string {\n  return String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n}\n"],"names":["Aglyn","firebaseAdmin","getOrgForHost","resolveOrgPermissions","isRefusedIdToken","authorizePosStaff","req","hostId","hostSnapshot","ownerOrg","authorization","String","headers","idToken","startsWith","slice","length","ok","status","error","uid","app","auth","verifyIdToken","firestore","collection","doc","get","exists","memberRole","membership","permissions","managePos","checkEntitlement","org","staff","orgId","id","posRequestBody","body","parsed","JSON","parse","posQueryBody","Object","fromEntries","entries","query","map","key","value","Array","isArray","posIdempotencyKey","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAE5C,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,gBAAgB,QAAQ,mDAAkD;AAcnF;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,kBACpBC,GAAqB,EACrBC,MAAc;QAEeD,4BAoBTE,mBAiBFC;QAAAA;IArClB,MAAMC,gBAAgBC,QAAOL,6BAAAA,IAAIM,OAAO,CAACF,aAAa,YAAzBJ,6BAA6B;IAC1D,MAAMO,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpC;IACJ,IAAI,CAACH,SAAS,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,IAAI,CAACZ,QAAQ,OAAO;QAAEU,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAiB;IACtE,IAAIC;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAMnB,cAAcoB,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV,QAAO,EAAGO,GAAG;IACrE,EAAE,OAAOD,OAAO;QACd,IAAI,CAACf,iBAAiBe,QAAQ,MAAMA;QACpC,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;IAC5D;IACA,MAAMX,eAAe,MAAMP,cACxBoB,GAAG,GACHG,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACnB,QACJoB,GAAG;IACN,IAAI,CAACnB,aAAaoB,MAAM,EAAE,OAAO;QAAEX,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACjF,MAAMU,aAAa,EAACrB,oBAAAA,aAAamB,GAAG,CAAC,0BAAjBnB,oBAAmC,CAAC,EAAE,CAACY,IAAI;IAC/D,IAAIS,eAAe,WAAWA,eAAe,UAAU;QACrD,OAAO;YAAEZ,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,MAAMW,aAAa,MAAM3B,sBAAsBiB,KAAK;QAAEb;IAAO;IAC7D,IAAI,CAACuB,WAAWC,WAAW,CAACC,SAAS,EAAE;QACrC,OAAO;YAAEf,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,MAAMV,WAAW,MAAMP,cAAcK;IACrC,IAAI,CAACP,MAAMiC,gBAAgB,CAACxB,4BAAAA,SAAUyB,GAAG,EAAS,QAAQ;QACxD,OAAO;YAAEjB,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAqC;IAC/E;IACA,OAAO;QACLF,IAAI;QACJkB,OAAO;YACLf;YACAb;YACA6B,OAAOzB,QAAOF,gBAAAA,6BAAAA,gBAAAA,SAAUyB,GAAG,qBAAbzB,cAAe4B,EAAE,oBAAI5B,4BAAAA,SAAU2B,KAAK,YAApC3B,OAAwC;YACtDyB,GAAG,WAAGzB,4BAAAA,SAAUyB,GAAG,oBAA4B;QACjD;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASI,eAAehC,GAAqB;IAClD,IAAI,OAAOA,IAAIiC,IAAI,KAAK,UAAU;QAChC,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACpC,IAAIiC,IAAI;YAClC,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOlC,IAAIiC,IAAI,IAAI,OAAOjC,IAAIiC,IAAI,KAAK,WAAWjC,IAAIiC,IAAI,GAAG,CAAC;AAChE;AAEA,mEAAmE,GACnE,OAAO,SAASI,aAAarC,GAAqB;QAE/BA;IADjB,OAAOsC,OAAOC,WAAW,CACvBD,OAAOE,OAAO,EAACxC,aAAAA,IAAIyC,KAAK,YAATzC,aAAa,CAAC,GAAG0C,GAAG,CAAC,CAAC,CAACC,KAAKC,MAAM,GAAK;YACpDD;YACAE,MAAMC,OAAO,CAACF,SAASA,KAAK,CAAC,EAAE,GAAGA;SACnC;AAEL;AAEA,+DAA+D,GAC/D,OAAO,SAASG,kBAAkB/C,GAAqB;QAEnDA,MAAAA;IADF,OAAOK,QACLL,QAAAA,8BAAAA,IAAIM,OAAO,CAAC,kBAAkB,YAA9BN,8BAAkCA,IAAIM,OAAO,CAAC,kBAAkB,YAAhEN,OAAoE,IAEnEgD,IAAI,GACJvC,KAAK,CAAC,GAAG;AACd"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pos-auth.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport type { PluginApiRequest } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport {\n  holdsPosPermission,\n  posPermissionRefusal,\n  type PosPermission,\n} from '../model/plugin-permissions'\n\n/** Who is working the register, once the gate has admitted them. */\nexport interface PosStaff {\n  uid: string\n  hostId: string\n  orgId: string\n  org: Record<string, any> | null\n}\n\nexport type PosStaffGate =\n  | { ok: true; staff: PosStaff }\n  | { ok: false; status: number; error: string }\n\n/** Who works the register: `managePos`, as resolved for the site (AGL-4047). */\nexport function worksPosRegister(\n  permissions: Readonly<Record<string, boolean | undefined>> | null | undefined,\n): boolean {\n  return permissions?.['managePos'] === true\n}\n\n/**\n * The register's gate, shared by every POS route (AGL-3607): the same\n * questions `pos-order.ts` asks, in the same order, so a payment, a reader or\n * a display pairing is refused to exactly the people a sale is refused to.\n *\n * 1. A Firebase ID token.\n * 2. `managePos` on the member's permissions as resolved FOR THIS SITE\n *    (AGL-2474) — or what `admits` asks instead — and the `pos` plan\n *    entitlement on the org that owns the site.\n * 3. When the route names one, the finer register key its action needs\n *    (AGL-4047): `posSell`, `posDevices`, `posBuyHardware` and the rest,\n *    each following `managePos` unless a role or the member sets it.\n *\n * THE KEYS DECIDE, NOT THE SITE ROLE (AGL-4047). This asked for `admin` or\n * `editor` in the site's `memberRoles` as well, which is exactly the set the\n * key is on for by default, so nobody who had the register loses it. The\n * resolver answers for this site: an org-wide member from their org role,\n * custom role and overrides; a site collaborator from the role they hold\n * here and their overrides; and anyone without access to the site with\n * nothing. So a site viewer the workspace grants the register works it, and\n * an admin a role narrows is refused. A site no workspace owns resolves\n * against the caller's own workspace, and is refused by the plan step, which\n * reads the plan of the workspace that owns the site.\n */\nexport async function authorizePosStaff(\n  req: PluginApiRequest,\n  hostId: string,\n  permission?: PosPermission,\n  /**\n   * Who the route admits before the finer key: whoever works the register,\n   * unless the route says otherwise — the hardware shop also admits a member\n   * who may buy hardware without the register.\n   */\n  admits: (permissions: Readonly<Record<string, boolean | undefined>>) => boolean = worksPosRegister,\n  /**\n   * `planRequired: false` admits a workspace whose plan does not include the\n   * point of sale, for the one read that must tell such a workspace what it\n   * needs first: a card reader it bought in person, waiting for that plan\n   * (AGL-4038). Everything that acts still asks the plan.\n   */\n  options: { planRequired?: boolean } = {},\n): Promise<PosStaffGate> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : ''\n  if (!idToken) return { ok: false, status: 401, error: 'Unauthenticated' }\n  if (!hostId) return { ok: false, status: 400, error: 'Missing hostId' }\n  let uid: string\n  try {\n    uid = (await firebaseAdmin.app().auth().verifyIdToken(idToken)).uid\n  } catch (error) {\n    if (!isRefusedIdToken(error)) throw error\n    return { ok: false, status: 401, error: 'Unauthenticated' }\n  }\n  const hostSnapshot = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .get()\n  if (!hostSnapshot.exists) return { ok: false, status: 404, error: 'Unknown site' }\n  const membership = await resolveOrgPermissions(uid, { hostId })\n  if (!admits(membership.permissions ?? {})) {\n    return { ok: false, status: 403, error: 'Not permitted' }\n  }\n  if (permission && !holdsPosPermission(membership.permissions, permission)) {\n    return { ok: false, status: 403, error: posPermissionRefusal(permission) }\n  }\n  const ownerOrg = await getOrgForHost(hostId)\n  if (options.planRequired !== false && !Aglyn.checkEntitlement(ownerOrg?.org as any, 'pos')) {\n    return { ok: false, status: 403, error: 'POS requires the Pro plan or above' }\n  }\n  return {\n    ok: true,\n    staff: {\n      uid,\n      hostId,\n      orgId: String(ownerOrg?.org?.id ?? ownerOrg?.orgId ?? ''),\n      org: (ownerOrg?.org as Record<string, any>) ?? null,\n    },\n  }\n}\n\n/** A JSON body, whether the dispatcher parsed it or not. */\nexport function posRequestBody(req: PluginApiRequest): Record<string, any> {\n  if (typeof req.body === 'string') {\n    try {\n      const parsed = JSON.parse(req.body)\n      return parsed && typeof parsed === 'object' ? parsed : {}\n    } catch {\n      return {}\n    }\n  }\n  return req.body && typeof req.body === 'object' ? req.body : {}\n}\n\n/** A GET request's query as a flat body, first value of each key. */\nexport function posQueryBody(req: PluginApiRequest): Record<string, any> {\n  return Object.fromEntries(\n    Object.entries(req.query ?? {}).map(([key, value]) => [\n      key,\n      Array.isArray(value) ? value[0] : value,\n    ]),\n  )\n}\n\n/** The request's Idempotency-Key header, trimmed and bounded. */\nexport function posIdempotencyKey(req: PluginApiRequest): string {\n  return String(\n    req.headers['idempotency-key'] ?? req.headers['Idempotency-Key'] ?? '',\n  )\n    .trim()\n    .slice(0, 200)\n}\n"],"names":["Aglyn","firebaseAdmin","getOrgForHost","resolveOrgPermissions","isRefusedIdToken","holdsPosPermission","posPermissionRefusal","worksPosRegister","permissions","authorizePosStaff","req","hostId","permission","admits","options","membership","ownerOrg","authorization","String","headers","idToken","startsWith","slice","length","ok","status","error","uid","app","auth","verifyIdToken","hostSnapshot","firestore","collection","doc","get","exists","planRequired","checkEntitlement","org","staff","orgId","id","posRequestBody","body","parsed","JSON","parse","posQueryBody","Object","fromEntries","entries","query","map","key","value","Array","isArray","posIdempotencyKey","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAE5C,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SACEC,kBAAkB,EAClBC,oBAAoB,QAEf,iCAA6B;AAcpC,8EAA8E,GAC9E,OAAO,SAASC,iBACdC,WAA6E;IAE7E,OAAOA,CAAAA,+BAAAA,WAAa,CAAC,YAAY,MAAK;AACxC;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,kBACpBC,GAAqB,EACrBC,MAAc,EACdC,UAA0B,EAC1B;;;;GAIC,GACDC,SAAkFN,gBAAgB,EAClG;;;;;GAKC,GACDO,UAAsC,CAAC,CAAC;QAEXJ,4BAqBjBK,yBAeMC;QAAAA;IApClB,MAAMC,gBAAgBC,QAAOR,6BAAAA,IAAIS,OAAO,CAACF,aAAa,YAAzBP,6BAA6B;IAC1D,MAAMU,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpC;IACJ,IAAI,CAACH,SAAS,OAAO;QAAEI,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAkB;IACxE,IAAI,CAACf,QAAQ,OAAO;QAAEa,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAiB;IACtE,IAAIC;IACJ,IAAI;QACFA,MAAM,AAAC,CAAA,MAAM1B,cAAc2B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV,QAAO,EAAGO,GAAG;IACrE,EAAE,OAAOD,OAAO;QACd,IAAI,CAACtB,iBAAiBsB,QAAQ,MAAMA;QACpC,OAAO;YAAEF,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAkB;IAC5D;IACA,MAAMK,eAAe,MAAM9B,cACxB2B,GAAG,GACHI,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACvB,QACJwB,GAAG;IACN,IAAI,CAACJ,aAAaK,MAAM,EAAE,OAAO;QAAEZ,IAAI;QAAOC,QAAQ;QAAKC,OAAO;IAAe;IACjF,MAAMX,aAAa,MAAMZ,sBAAsBwB,KAAK;QAAEhB;IAAO;IAC7D,IAAI,CAACE,QAAOE,0BAAAA,WAAWP,WAAW,YAAtBO,0BAA0B,CAAC,IAAI;QACzC,OAAO;YAAES,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAgB;IAC1D;IACA,IAAId,cAAc,CAACP,mBAAmBU,WAAWP,WAAW,EAAEI,aAAa;QACzE,OAAO;YAAEY,IAAI;YAAOC,QAAQ;YAAKC,OAAOpB,qBAAqBM;QAAY;IAC3E;IACA,MAAMI,WAAW,MAAMd,cAAcS;IACrC,IAAIG,QAAQuB,YAAY,KAAK,SAAS,CAACrC,MAAMsC,gBAAgB,CAACtB,4BAAAA,SAAUuB,GAAG,EAAS,QAAQ;QAC1F,OAAO;YAAEf,IAAI;YAAOC,QAAQ;YAAKC,OAAO;QAAqC;IAC/E;IACA,OAAO;QACLF,IAAI;QACJgB,OAAO;YACLb;YACAhB;YACA8B,OAAOvB,QAAOF,gBAAAA,6BAAAA,gBAAAA,SAAUuB,GAAG,qBAAbvB,cAAe0B,EAAE,oBAAI1B,4BAAAA,SAAUyB,KAAK,YAApCzB,OAAwC;YACtDuB,GAAG,WAAGvB,4BAAAA,SAAUuB,GAAG,oBAA4B;QACjD;IACF;AACF;AAEA,0DAA0D,GAC1D,OAAO,SAASI,eAAejC,GAAqB;IAClD,IAAI,OAAOA,IAAIkC,IAAI,KAAK,UAAU;QAChC,IAAI;YACF,MAAMC,SAASC,KAAKC,KAAK,CAACrC,IAAIkC,IAAI;YAClC,OAAOC,UAAU,OAAOA,WAAW,WAAWA,SAAS,CAAC;QAC1D,EAAE,eAAM;YACN,OAAO,CAAC;QACV;IACF;IACA,OAAOnC,IAAIkC,IAAI,IAAI,OAAOlC,IAAIkC,IAAI,KAAK,WAAWlC,IAAIkC,IAAI,GAAG,CAAC;AAChE;AAEA,mEAAmE,GACnE,OAAO,SAASI,aAAatC,GAAqB;QAE/BA;IADjB,OAAOuC,OAAOC,WAAW,CACvBD,OAAOE,OAAO,EAACzC,aAAAA,IAAI0C,KAAK,YAAT1C,aAAa,CAAC,GAAG2C,GAAG,CAAC,CAAC,CAACC,KAAKC,MAAM,GAAK;YACpDD;YACAE,MAAMC,OAAO,CAACF,SAASA,KAAK,CAAC,EAAE,GAAGA;SACnC;AAEL;AAEA,+DAA+D,GAC/D,OAAO,SAASG,kBAAkBhD,GAAqB;QAEnDA,MAAAA;IADF,OAAOQ,QACLR,QAAAA,8BAAAA,IAAIS,OAAO,CAAC,kBAAkB,YAA9BT,8BAAkCA,IAAIS,OAAO,CAAC,kBAAkB,YAAhET,OAAoE,IAEnEiD,IAAI,GACJrC,KAAK,CAAC,GAAG;AACd"}

package/src/lib/server/pos-cellular-billing.d.ts

@@ -0,0 +1,81 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginOrgEraser } from '@aglyn/aglyn/plugin-manager/plugin-org-erasure';
+import type { PluginJobHostGate } from '@aglyn/aglyn/server';
+import { raiseOperatorAlert } from '@aglyn/tenant-data-admin';
+import { type OrgUsageInvoiceRequest, type OrgUsageInvoiceResult } from '@aglyn/tenant-data-admin/server/usage-invoice';
+import { type PosCellularConfig } from '../model/pos-cellular';
+type Charge = (request: OrgUsageInvoiceRequest) => Promise<OrgUsageInvoiceResult>;
+type InvoiceStatus = (invoiceId: string) => Promise<{
+    status: string;
+    amountPaidCents: number;
+} | null>;
+export interface PosCellularBillingDeps {
+    now?: () => number;
+    config?: PosCellularConfig | null;
+    charge?: Charge;
+    readBilling?: (orgId: string) => Promise<{
+        stripeCustomerId?: unknown;
+    }>;
+    turnOff?: (configurationId: string) => Promise<boolean>;
+    alert?: typeof raiseOperatorAlert;
+    /** Stripe's word on a charge's invoice now, or null when it cannot be asked. */
+    invoiceStatus?: InvoiceStatus;
+    /** Tells the workspace 4G was turned off; true once told (or there is nobody to tell). */
+    notify?: (notice: import('./pos-cellular-notify').PosCellularTurnedOffNotice) => Promise<boolean>;
+    /** Warns the workspace 4G turns off unless the charge is paid; true once told (or there is nobody to tell). */
+    warn?: (notice: import('./pos-cellular-notify').PosCellularPaymentDueNotice) => Promise<boolean>;
+}
+export interface PosCellularBillingReport {
+    month: string | null;
+    workspaces: number;
+    paid: number;
+    open: number;
+    failed: number;
+    unbillable: number;
+    deferred: number;
+    storesGone: number;
+    /** Open charges paid since, found by asking Stripe. */
+    paidLate: number;
+    /** Workspaces warned that 4G turns off unless a charge left open is paid. */
+    warned: number;
+    /** Workspaces whose 4G was turned off for a month unpaid past its grace. */
+    turnedOff: number;
+}
+/** The charge of every workspace whose readers had 4G last month, once each. */
+export declare function runPosCellularBilling(gate: PluginJobHostGate, deps?: PosCellularBillingDeps): Promise<PosCellularBillingReport>;
+/**
+ * Commerce's 4G share of a WORKSPACE erasure (AGL-4038), before its data
+ * goes:
+ *
+ * 1. CHARGE IT. The month the workspace is deleted in is charged now, for
+ *    each S710 that had 4G in it, as the monthly run would have charged it a
+ *    month later; and last month too, if the run had not charged it yet.
+ *    Through the run's own claim and key, so the two never charge one month
+ *    twice. A workspace that is locked is not charged (its card may be the
+ *    stolen one the lock is about): staff are alerted instead. Any failure
+ *    alerts staff and goes on.
+ * 2. TURN IT OFF. Every store of the workspace with 4G on has cellular turned
+ *    off at Stripe, so the platform stops paying for readers nobody will be
+ *    charged for, and their periods are closed.
+ *
+ * Never fails the erasure: a refusal is a must alert. A dry run only counts.
+ */
+export declare function createPosCellularOrgEraser(deps?: Pick<PosCellularBillingDeps, 'turnOff' | 'alert' | 'now' | 'config' | 'charge' | 'readBilling'>): PluginOrgEraser;
+/** The eraser over the platform's own Firestore and Stripe, as the declarations register it. */
+export declare const posCellularOrgEraser: PluginOrgEraser;
+export {};