@endora-commerce/mod-customer-accounts 0.100.0

package/dist/backend/index.js

@@ -0,0 +1,407 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { normalizeEmailAddress } from '@endora-commerce/contracts';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+import { withSystemScope } from '@endora-commerce/platform/tenancy';
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { registerCustomerAccountAuditReferences } from './services/audit-references.js';
+import { effectiveState } from '@endora-commerce/platform/kernel';
+// Feature 075, Phase C — a pure function, so the kernel rather than `auth`.
+import { hashPassword } from '@endora-commerce/platform/kernel';
+import { CustomerAccount } from './entities/customer-account.entity.js';
+import { CustomerGroup } from './entities/customer-group.entity.js';
+import { PasswordResetToken } from './entities/password-reset-token.entity.js';
+import { registerCustomerGroupAdminRoutes } from './routes.admin.js';
+import { CustomerAccountMemberWriteService, CustomerAccountReadService, CustomerPasswordStateService, CustomerPasswordVerificationService, createCustomerAuthPort, createCustomerRolePort, } from './services/customer-account-ports.js';
+import { CustomerAccountAdminSearchService, CustomerAccountLifecycleWriteService, } from './services/customer-account-lifecycle-ports.js';
+import { CustomerAuthService } from './services/customer-auth-service.js';
+import { CustomerGroupReadService } from './services/customer-group-read-port.js';
+import { CustomerGroupService } from './services/customer-group-service.js';
+import { CustomerRollupScopeService } from './services/customer-rollup-scope.js';
+import { PasswordResetService } from './services/password-reset-service.js';
+import { RoleService } from './services/role-service.js';
+export function registerModule(ctx) {
+    /**
+     * Feature 120 (FR-015) — the sales-channel membership bridge this module owns.
+     *
+     * The platform used to hold a map **total** over
+     * `ChannelMemberEntityTypeSchema`, naming this module's bridge table from
+     * inside the kernel. That is D-52/D-53's prohibition expressed in a contract
+     * instead of an import, and it meant a membership call for 'customer' on an
+     * instance that never installed this module executed SQL against a relation
+     * that is not there (D-226). The module whose migration creates the table is
+     * the one that says where it is; a member nothing registers now refuses at
+     * the call instead.
+     *
+     * A **contribution** hook and deliberately **unprobed** (D-62/D-68): a
+     * registration is an inert statement about the schema rather than a
+     * capability, the rows outlive an operator switching this module off, and
+     * probing would make a runtime activation flip require a restart. It is
+     * declared first in this module so any later hook of its own that binds a
+     * membership finds the bridge already there.
+     */
+    ctx.onBoot(() => {
+        const { salesChannelBridgeRegistry } = ctx.cradle();
+        for (const bridge of salesChannelBridges)
+            salesChannelBridgeRegistry.register(bridge);
+    });
+    // D-96 — resolved once, called through on every login. The gate `mfa`'s
+    // `providePort` put on this name is transient, so the proxy asks about the
+    // module's effective state at each call rather than at composition.
+    const mfaLoginPort = lazyPort(ctx, 'mfaLoginPort');
+    // The live source of `twoFactorEnabled`, on the same terms as the login port
+    // above and for the same reason. This module's `two_factor_confirmed_at`
+    // column lost its only non-null writer when the superseded TOTP path was
+    // deleted, so the field derived from it was a provably constant `false` —
+    // including on `GET /api/v1/me/customer`, which is the buyer's own account
+    // page telling them their account is unprotected while it is not.
+    const mfaEnrolmentStatePort = lazyPort(ctx, 'mfaEnrolmentStatePort');
+    /**
+     * The degrade is performed by **not resolving**, exactly as the login port's
+     * getter below does it — presence is decided first and there is deliberately
+     * no `catch` anywhere near the port. A buyer's own account page is the wrong
+     * place for a 503, and `false` is not a substitute for the answer here: with
+     * `mfa` absent no sign-in asks for a second factor, so no account is
+     * protected by one. The sentence an operator is shown before the flip is this
+     * module's `degrades-without` entry for `mfaEnrolmentStatePort`.
+     */
+    const twoFactorEnrolments = async (customerAccountIds) => {
+        if (!effectiveState.isPresent('mfa'))
+            return new Set();
+        return new Set(await mfaEnrolmentStatePort.activeSubjectIds('customer', customerAccountIds));
+    };
+    // ---------------------------------------------------------------------------
+    // Feature 075, Phase P — the published surface.
+    //
+    // The three ports below this block already existed; what they lacked was a
+    // contract a consumer could name without naming a file in this directory.
+    // One of them (`passwordResetService`) already returns a plain shape, so it
+    // gains nothing but a type parameter, which is now the compile-time proof
+    // that it still satisfies what was published.
+    //
+    // The other two return the `CustomerAccount` **entity**, and an entity
+    // crossing a boundary is the problem this feature exists to remove — so they
+    // get record-returning siblings rather than a rename. `customerAuthPort` and
+    // `customerRolePort` are what the consumers rewired to — `customers` was the
+    // last of them, in issue #195 — and `customerAuthService` /
+    // `customerRoleService` stay registered because those two adapters are built
+    // over them.
+    // ---------------------------------------------------------------------------
+    ctx.di.providePort('customerAccountReadPort', ctx
+        .asFunction(({ emFactory }) => new CustomerAccountReadService(emFactory, twoFactorEnrolments))
+        .singleton());
+    /**
+     * Feature 075, Phase C — the member lifecycle `organizations` runs over this
+     * table. Published when that module was cut: it created and mutated the
+     * entity in seven places, and the argon2 hash it needed to do so came from an
+     * import of `auth`. Both are on this side of the port now, and each write
+     * records its own audit row, as `roleService` beside it always has.
+     */
+    ctx.di.providePort('customerAccountMemberWritePort', ctx
+        .asFunction(({ emFactory, auditLogService }) => new CustomerAccountMemberWriteService(emFactory, twoFactorEnrolments, auditLogService))
+        .singleton());
+    /**
+     * Feature 075, Phase C — the account lifecycle `customers` runs over this
+     * table, and the list its admin screen reads it with.
+     *
+     * `customers` is the management surface over these accounts and it ran both
+     * by holding the entity: block, unblock, soft-delete, restore, the retention
+     * sweep's scrub, the organisation and group assignments, standalone
+     * registration and the custom-field patch, plus the paginated admin query.
+     * The policy — who may act on whom, and the "an organisation keeps an
+     * administrator" guard — stayed on that side; the statement and its one audit
+     * row are here.
+     */
+    ctx.di.providePort('customerAccountLifecycleWritePort', ctx
+        .asFunction(({ emFactory, auditLogService, commandBus }) => new CustomerAccountLifecycleWriteService(emFactory, auditLogService, twoFactorEnrolments, 
+    // D-178 — `lazyPort` rather than a captured value: the gate stays
+    // live inside this singleton and the seam is resolved per call. The
+    // proxy is what makes the capture legal at all.
+    lazyPort(ctx, 'personalOrganizationProvisionApi'), commandBus))
+        .singleton());
+    ctx.di.providePort('customerAccountAdminSearchPort', ctx
+        .asFunction(({ emFactory }) => new CustomerAccountAdminSearchService(emFactory, twoFactorEnrolments))
+        .singleton());
+    ctx.di.providePort('customerAuthPort', ctx
+        .asFunction(() => createCustomerAuthPort(() => ctx.cradle().customerAuthService, twoFactorEnrolments))
+        .singleton());
+    /**
+     * Issue #222 — whether a password its holder can use is on record. Read by
+     * `mfa` before it severs an account's last federated identity; nothing else
+     * needs it, which is why it is its own port rather than a field on
+     * `customerAccountReadPort`'s record.
+     */
+    /**
+     * Feature 080 (T040b) — the roll-up widening the per-request tenant-context
+     * builder asks about, published because both composition roots used to
+     * import the derivation out of this module's sources.
+     *
+     * The traversal arrives as an argument rather than being resolved here: the
+     * caller already holds `organizations`' tree service, and reading it from
+     * this side would be a cross-module resolution of a container name no
+     * contract publishes (`check:port-shape` signal 3).
+     */
+    ctx.di.providePort('customerRollupScopePort', ctx
+        .asFunction(({ emFactory }) => new CustomerRollupScopeService(emFactory))
+        .singleton());
+    ctx.di.providePort('customerPasswordStatePort', ctx
+        .asFunction(({ emFactory }) => new CustomerPasswordStateService(emFactory))
+        .singleton());
+    /**
+     * Feature 080 (T052) — step-up re-verification, for `mfa`. Both composition
+     * roots used to read `passwordHash` off this module's entity and compare it
+     * with the platform hasher themselves; the column and the comparison are
+     * this module's, so the boolean is what crosses.
+     *
+     * Its own port rather than a method on `customerPasswordStatePort` for the
+     * reason that port gives for existing at all: the two questions differ, and
+     * only one of them takes a caller-supplied secret.
+     */
+    ctx.di.providePort('customerPasswordVerificationPort', ctx
+        .asFunction(({ emFactory }) => new CustomerPasswordVerificationService(emFactory))
+        .singleton());
+    ctx.di.providePort('customerRolePort', ctx
+        .asFunction(() => createCustomerRolePort(() => ctx.cradle().customerRoleService, twoFactorEnrolments))
+        .singleton());
+    ctx.di.providePort('customerAuthService', ctx
+        .asFunction(({ emFactory, auditLogService }) => new CustomerAuthService(emFactory, 
+    // Feature 075, Phase C — `auth`'s **published** session surface,
+    // where this used to resolve the `sessionService` registration and
+    // type itself against `auth`'s class. The port hands back a plain
+    // cookie payload; the `Session` entity no longer crosses.
+    lazyPort(ctx, 'authSessionPort'), 
+    // D-96 — the degrade is performed by **not resolving**. The port's
+    // gate throws `ModuleDisabledError` when `mfa` is absent, and there
+    // is deliberately no `catch` anywhere near this: a caught gate is a
+    // fail-open degrade nobody declared. Deciding presence first is the
+    // `auth`/`api_keys` shape, and `CustomerAuthService`'s
+    // `if (mfaPort)` branch — the password-only fallback of feature 042
+    // FR-033 — is what `undefined` selects.
+    () => (effectiveState.isPresent('mfa') ? mfaLoginPort : undefined), auditLogService))
+        .singleton());
+    // The type parameter is the compile-time proof that this service still
+    // satisfies what feature 075 published; it returns plain shapes already, so
+    // it needed no adapter.
+    ctx.di.providePort('passwordResetService', ctx
+        .asFunction(({ emFactory, auditLogService }) => new PasswordResetService(emFactory, auditLogService))
+        .singleton());
+    ctx.di.providePort('customerRoleService', ctx
+        .asFunction(({ emFactory, auditLogService }) => new RoleService(emFactory, auditLogService))
+        .singleton());
+    ctx.di.providePort('customerOrgResolver', ctx
+        .asFunction(({ emFactory }) => async (customerAccountId) => {
+        // Runs in the auth hook, before a tenant context exists, so the
+        // read is system-scoped — identity resolution precedes tenancy.
+        return withSystemScope('auth: resolve customer org', async () => {
+            const customer = await emFactory().findOne(CustomerAccount, {
+                id: customerAccountId,
+            });
+            return customer?.organizationId ?? null;
+        });
+    })
+        .singleton());
+    /**
+     * Federated sign-in's two reads/writes of this module's table (T143a).
+     *
+     * A **port** rather than a contribution point (D-39): `autoCreate` decides
+     * whether an account may exist at all and then writes one. Both halves are
+     * system-scoped because they run *before* a tenant context exists — identity
+     * resolution precedes tenancy, exactly as `customerOrgResolver` above.
+     *
+     * The refusal is the return type rather than a throw: `null` is what
+     * `SocialIdentityService` reads as `registration_required`, so the policy
+     * lands on the caller as a redirect to the login screen and not as a 500.
+     *
+     * The setting is `customers.allow_registration_without_organization`, and it
+     * is named here even though `customers` owns it. That module already depends
+     * on this one, so a port pointing the other way would close a cycle; the
+     * platform-wide question "may an account exist without an Organization" is in
+     * any case about *this* table.
+     */
+    ctx.di.providePort('customerSocialLoginPort', ctx
+        .asFunction(({ emFactory, auditLogService }) => ({
+        async resolveByEmail(email) {
+            return withSystemScope('mfa: resolve customer by email', async () => {
+                // The address arrives from the provider's claim, in whatever case
+                // that provider chose to send it; the row is folded, so the compare
+                // is too. Unfolded, a returning buyer would be offered registration
+                // for an account they already have — and `autoCreate` below would
+                // then be refused by the unique index.
+                const customer = await emFactory().findOne(CustomerAccount, {
+                    email: normalizeEmailAddress(email),
+                    deletedAt: null,
+                });
+                return customer ? { id: customer.id } : null;
+            });
+        },
+        async autoCreate(email) {
+            const cradle = ctx.cradle();
+            // The channel a global-scope read resolves against. Both roots used
+            // to pass the literal `'default'` here, which is **not** a channel
+            // id: `sales_channel_id` is a uuid column, so the query threw
+            // `invalid input syntax for type uuid` on every call, the closure's
+            // `catch` read that as "not allowed", and federated sign-in could
+            // therefore never create an account in production however the
+            // operator had configured it. The harness had no gate at all and
+            // always created one. Neither was the behaviour anybody wanted.
+            const salesChannelId = await cradle.settingsChannelResolver();
+            if (salesChannelId === null)
+                return null;
+            let allowed = false;
+            try {
+                allowed = await cradle.settingsReadPort.get('customers.allow_registration_without_organization', salesChannelId, z.boolean());
+            }
+            catch {
+                // An unregistered or out-of-scope setting denies. Not a bare catch
+                // around a module port — `settingsReadPort` is kernel-owned and
+                // ungated, so there is no `ModuleDisabledError` to swallow here;
+                // the degrade is "no answer means no", which is the safe direction
+                // for a gate on account creation.
+                allowed = false;
+            }
+            if (!allowed)
+                return null;
+            const folded = normalizeEmailAddress(email);
+            const customerAccountId = randomUUID();
+            // No password was ever chosen for this account: it signs in through
+            // the provider. A random one keeps the column non-null without minting
+            // a credential anybody could guess — and issue #222 is the other half
+            // of that sentence: `passwordSetAt` stays null, so a reader can tell
+            // this account from one whose holder really has a password. Do not
+            // stamp it here.
+            const passwordHash = await hashPassword(randomUUID() + randomUUID());
+            const provision = lazyPort(ctx, 'personalOrganizationProvisionApi');
+            return withSystemScope('mfa: auto-create customer from social login', async () => emFactory().transactional(async (em) => {
+                /**
+                 * D-178 — the personal organisation, in the same transaction as
+                 * the account.
+                 *
+                 * This path provisioned **none**, so every account a federated
+                 * sign-in created carried `organization_id = NULL` permanently:
+                 * not a window but the steady state of a shipped feature, and the
+                 * buyer reaching checkout was told to attach an Organization they
+                 * had no way to attach. `customers`' self-registration provisioned
+                 * one in a second unit of work; this one is a single transaction,
+                 * which is what closes the window that shape leaves.
+                 *
+                 * The provider sends no name with the claim this seam reads, so
+                 * the organisation is named from the address' local part — which
+                 * is exactly what `PersonalOrganizationService.personalName` falls
+                 * back to for a nameless account.
+                 */
+                const organization = await provision.provisionFor(em, {
+                    customerAccountId,
+                    email: folded,
+                });
+                const account = em.create(CustomerAccount, {
+                    id: customerAccountId,
+                    email: folded,
+                    passwordHash,
+                    passwordSetAt: null,
+                    firstName: '',
+                    lastName: '',
+                    role: 'regular_user',
+                    organizationId: organization.id,
+                    emailVerifiedAt: new Date(),
+                });
+                // The other way an account is created without an admin —
+                // `customers`' standalone self-registration — records this same
+                // shape with a null actor, and this path did not record anything at
+                // all until the coverage scan reached `backend.ts` (issue #122). An
+                // account appearing out of a federated sign-in is exactly the event
+                // an operator later needs to explain.
+                recordAuditFromContext(auditLogService, em, {
+                    action: 'customer_account.register_social',
+                    objectType: 'customer_account',
+                    objectId: account.id,
+                    stateBefore: null,
+                    stateAfter: { email: account.email },
+                });
+                await em.flush();
+                return { id: account.id };
+            }));
+        },
+    }))
+        .singleton());
+    // ---------------------------------------------------------------------------
+    // Feature 076, D-79 — customer groups.
+    //
+    // The entity, its service, its read port and its three admin routes moved
+    // here from `price_lists`. A customer group describes the customer; a price
+    // list refers to one by id. Under the previous owner the single real foreign
+    // key into `customer_groups` — `customer_accounts.customer_group_id` — forced
+    // this module to declare `price_lists`, which made the reverse declaration a
+    // cycle `test/unit/db/module-graph.test.ts` refuses. The key is intra-module now and
+    // the class of problem is gone rather than routed around.
+    //
+    // `customerGroupService` keeps its container name: both composition roots
+    // read it for the promotion Rule Builder's target picker, and renaming it
+    // would have churned two roots to encode an owner this file already states.
+    // ---------------------------------------------------------------------------
+    ctx.di.providePort('customerGroupService', ctx
+        .asFunction(({ emFactory, commandBus }) => new CustomerGroupService(emFactory, commandBus))
+        .singleton());
+    ctx.di.providePort('customerGroupReadPort', ctx
+        .asFunction(({ emFactory }) => new CustomerGroupReadService(emFactory))
+        .singleton());
+    // The module's only routes. They are the customer-group admin surface and
+    // nothing else — customer login, registration and self-service stay with
+    // `organizations` and `customers`, which own those screens.
+    ctx.routes(async (app) => {
+        await registerCustomerGroupAdminRoutes(app, {
+            customerGroupService: () => ctx.cradle().customerGroupService,
+            requireAdmin: (permission) => async (req, reply) => ctx.cradle().requireAdmin(permission)(req, reply),
+        });
+    });
+    /**
+     * What an audit row about an impersonated customer is called, and where the admin app shows it
+     * (feature 075, D-87 drain).
+     *
+     * `audit_logs` used to answer both by hand — one SQL statement naming this
+     * module's table, and this module's admin route spelled into its own switch.
+     * A read port would have been the wrong repair: `audit_logs` is a
+     * cross-cutting reader, and five ports into it would be five edges pointing
+     * from the record towards the things it records. One of the five contributors
+     * (`inventory`) is switchable, and `audit_logs` is `nonDeactivatable`, so that
+     * edge would also have taken the operator's switch away. A push costs nothing
+     * and reads the same for all five.
+     *
+     * A **contribution** hook: it pushes an inert resolver into
+     * `auditReferenceRegistry`, an ungated registry, and carries no presence probe
+     * (D-67/D-68). The registry's own enumeration policy is what drops this entry
+     * while the module is absent — probing here would make the drop survive a
+     * reactivation until the next restart.
+     */
+    ctx.onBoot(() => {
+        registerCustomerAccountAuditReferences(lazyPort(ctx, 'auditReferenceRegistry'), ctx.cradle().emFactory, lazyPort(ctx, 'organizationDetailsPort'));
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table->owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ *
+ * The order is the one `db/entities-registry.generated.ts` declared before this
+ * module became a package, so the registered set is the same list in the same
+ * sequence.
+ */
+export const entities = [CustomerAccount, CustomerGroup, PasswordResetToken];
+/**
+ * The sales-channel membership bridge this module owns (feature 120, FR-015).
+ *
+ * Exported as well as registered because the owning module is the only honest
+ * source for it: a caller that composes no platform — the bare-database test
+ * harness, which constructs the kernel's membership service directly — declares
+ * these from here rather than from a list of nine it keeps itself, which is
+ * exactly the total map this feature deleted.
+ */
+export const salesChannelBridges = [
+    { entityType: 'customer', table: 'sales_channel_customer_accounts', entityIdColumn: 'customer_account_id' },
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAoBnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,sCAAsC,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGlE,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EACL,iCAAiC,EACjC,0BAA0B,EAC1B,4BAA4B,EAC5B,mCAAmC,EACnC,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,iCAAiC,EACjC,oCAAoC,GACrC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAmGzD,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C;;;;;;;;;;;;;;;;;;OAkBG;IACH,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,MAAM,EAAE,0BAA0B,EAAE,GAAG,GAAG,CAAC,MAAM,EAA0B,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,mBAAmB;YAAE,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,YAAY,GAAG,QAAQ,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,qBAAqB,GAAG,QAAQ,CAAwB,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAE5F;;;;;;;;OAQG;IACH,MAAM,mBAAmB,GAA6B,KAAK,EAAE,kBAAkB,EAAE,EAAE;QACjF,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAU,CAAC;QAC/D,OAAO,IAAI,GAAG,CAAC,MAAM,qBAAqB,CAAC,gBAAgB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC;IAEF,8EAA8E;IAC9E,gDAAgD;IAChD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,8CAA8C;IAC9C,EAAE;IACF,uEAAuE;IACvE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,4DAA4D;IAC5D,6EAA6E;IAC7E,aAAa;IACb,8EAA8E;IAE9E,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,yBAAyB,EACzB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAA0B,EAAE,EAAE,CACxC,IAAI,0BAA0B,CAAC,SAAS,EAAE,mBAAmB,CAAC,CACjE;SACA,SAAS,EAAE,CACf,CAAC;IAEF;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,gCAAgC,EAChC,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAA0B,EAAE,EAAE,CACzD,IAAI,iCAAiC,CAAC,SAAS,EAAE,mBAAmB,EAAE,eAAe,CAAC,CACzF;SACA,SAAS,EAAE,CACf,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,mCAAmC,EACnC,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAA0B,EAAE,EAAE,CACrE,IAAI,oCAAoC,CACtC,SAAS,EACT,eAAe,EACf,mBAAmB;IACnB,kEAAkE;IAClE,oEAAoE;IACpE,gDAAgD;IAChD,QAAQ,CAAmC,GAAG,EAAE,kCAAkC,CAAC,EACnF,UAAU,CACX,CACJ;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,gCAAgC,EAChC,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAA0B,EAAE,EAAE,CACxC,IAAI,iCAAiC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CACxE;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,kBAAkB,EAClB,GAAG;SACA,UAAU,CAAC,GAAG,EAAE,CACf,sBAAsB,CACpB,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAA0B,CAAC,mBAAmB,EAC9D,mBAAmB,CACpB,CACF;SACA,SAAS,EAAE,CACf,CAAC;IAEF;;;;;OAKG;IACH;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,yBAAyB,EACzB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAA0B,EAAE,EAAE,CAAC,IAAI,0BAA0B,CAAC,SAAS,CAAC,CACrF;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,2BAA2B,EAC3B,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAA0B,EAAE,EAAE,CAAC,IAAI,4BAA4B,CAAC,SAAS,CAAC,CACvF;SACA,SAAS,EAAE,CACf,CAAC;IAEF;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,kCAAkC,EAClC,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAA0B,EAAE,EAAE,CACxC,IAAI,mCAAmC,CAAC,SAAS,CAAC,CACrD;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,kBAAkB,EAClB,GAAG;SACA,UAAU,CAAC,GAAG,EAAE,CACf,sBAAsB,CACpB,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAA0B,CAAC,mBAAmB,EAC9D,mBAAmB,CACpB,CACF;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,qBAAqB,EACrB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAA0B,EAAE,EAAE,CACzD,IAAI,mBAAmB,CACrB,SAAS;IACT,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,0DAA0D;IAC1D,QAAQ,CAAkB,GAAG,EAAE,iBAAiB,CAAC;IACjD,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,uDAAuD;IACvD,oEAAoE;IACpE,wCAAwC;IACxC,GAAG,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,EAClE,eAAe,CAChB,CACJ;SACA,SAAS,EAAE,CACf,CAAC;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,wBAAwB;IACxB,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,sBAAsB,EACtB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAA0B,EAAE,EAAE,CACzD,IAAI,oBAAoB,CAAC,SAAS,EAAE,eAAe,CAAC,CACvD;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,qBAAqB,EACrB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAA0B,EAAE,EAAE,CACzD,IAAI,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,CAC9C;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,qBAAqB,EACrB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAA0B,EAAE,EAAE,CACxC,KAAK,EAAE,iBAAyB,EAA0B,EAAE;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,OAAO,eAAe,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;gBAC1D,EAAE,EAAE,iBAAiB;aACtB,CAAC,CAAC;YACH,OAAO,QAAQ,EAAE,cAAc,IAAI,IAAI,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CACJ;SACA,SAAS,EAAE,CACf,CAAC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,yBAAyB,EACzB,GAAG;SACA,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAA0B,EAAE,EAAE,CAAC,CAAC;QACvE,KAAK,CAAC,cAAc,CAAC,KAAa;YAChC,OAAO,eAAe,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;gBAClE,kEAAkE;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;oBAC1D,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC;oBACnC,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAa;YAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAA0B,CAAC;YACpD,oEAAoE;YACpE,mEAAmE;YACnE,8DAA8D;YAC9D,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,gEAAgE;YAChE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE,CAAC;YAC9D,IAAI,cAAc,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEzC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,GAAG,CACzC,mDAAmD,EACnD,cAAc,EACd,CAAC,CAAC,OAAO,EAAE,CACZ,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,gEAAgE;gBAChE,iEAAiE;gBACjE,mEAAmE;gBACnE,kCAAkC;gBAClC,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;YACvC,oEAAoE;YACpE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,iBAAiB;YACjB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,QAAQ,CACxB,GAAG,EACH,kCAAkC,CACnC,CAAC;YACF,OAAO,eAAe,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE,CAC/E,SAAS,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACrC;;;;;;;;;;;;;;;;mBAgBG;gBACH,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE;oBACpD,iBAAiB;oBACjB,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE;oBACzC,EAAE,EAAE,iBAAiB;oBACrB,KAAK,EAAE,MAAM;oBACb,YAAY;oBACZ,aAAa,EAAE,IAAI;oBACnB,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,EAAE;oBACZ,IAAI,EAAE,cAAc;oBACpB,cAAc,EAAE,YAAY,CAAC,EAAE;oBAC/B,eAAe,EAAE,IAAI,IAAI,EAAE;iBAC5B,CAAC,CAAC;gBACH,yDAAyD;gBACzD,gEAAgE;gBAChE,oEAAoE;gBACpE,oEAAoE;gBACpE,oEAAoE;gBACpE,sCAAsC;gBACtC,sBAAsB,CAAC,eAAe,EAAE,EAAE,EAAE;oBAC1C,MAAM,EAAE,kCAAkC;oBAC1C,UAAU,EAAE,kBAAkB;oBAC9B,QAAQ,EAAE,OAAO,CAAC,EAAE;oBACpB,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;iBACrC,CAAC,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC5B,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;SACF,SAAS,EAAE,CACf,CAAC;IAEF,8EAA8E;IAC9E,uCAAuC;IACvC,EAAE;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,qFAAqF;IACrF,0DAA0D;IAC1D,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAE9E,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,sBAAsB,EACtB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,UAAU,EAA0B,EAAE,EAAE,CACpD,IAAI,oBAAoB,CAAC,SAAS,EAAE,UAAU,CAAC,CAClD;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,uBAAuB,EACvB,GAAG;SACA,UAAU,CAAC,CAAC,EAAE,SAAS,EAA0B,EAAE,EAAE,CAAC,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;SAC9F,SAAS,EAAE,CACf,CAAC;IAEF,0EAA0E;IAC1E,yEAAyE;IACzE,4DAA4D;IAC5D,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,gCAAgC,CAAC,GAAG,EAAE;YAC1C,oBAAoB,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAA0B,CAAC,oBAAoB;YACrF,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CACjD,GAAG,CAAC,MAAM,EAA0B,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;;;;OAkBG;IACH,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,sCAAsC,CACpC,QAAQ,CAA6B,GAAG,EAAE,wBAAwB,CAAC,EACnE,GAAG,CAAC,MAAM,EAA0B,CAAC,SAAS,EAC9C,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAE7E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAI3B;IACH,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,iCAAiC,EAAE,cAAc,EAAE,qBAAqB,EAAE;CAC5G,CAAC"}

package/dist/backend/routes.admin.d.ts

@@ -0,0 +1,26 @@
+import type { FastifyInstance } from 'fastify';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import type { CustomerGroupService } from './services/customer-group-service.js';
+/**
+ * The customer-group admin surface (feature 076, D-79).
+ *
+ * Three routes, at the paths they have always had — `price_lists` served them
+ * until this module took the entity over, and the admin SPA's pickers call the
+ * same URLs with the same payloads. What changed is the gate: `catalog:write`
+ * was the pricing module's permission and is the wrong question to ask about a
+ * customer's segmentation, so the surface is gated by the two codes this module
+ * declares in its manifest. An operator's role has to be granted them; there is
+ * no silent inheritance from `catalog:write`.
+ */
+export interface CustomerGroupAdminDeps {
+    /**
+     * Resolved per call rather than captured: the registration is a gated port,
+     * and a gate captured at boot keeps answering whatever the effective state
+     * later says. The module is non-deactivatable, so the gate is unreachable —
+     * which is a reason to be uniform, not a reason to be careless.
+     */
+    customerGroupService: () => CustomerGroupService;
+    requireAdmin: RequireAdminFactory;
+}
+export declare function registerCustomerGroupAdminRoutes(app: FastifyInstance, deps: CustomerGroupAdminDeps): Promise<void>;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/backend/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;IACjD,YAAY,EAAE,mBAAmB,CAAC;CACnC;AAED,wBAAsB,gCAAgC,CACpD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/dist/backend/routes.admin.js

@@ -0,0 +1,35 @@
+import { upsertCustomerGroupRequestSchema } from '@endora-commerce/contracts';
+export async function registerCustomerGroupAdminRoutes(app, deps) {
+    const { customerGroupService, requireAdmin } = deps;
+    app.get('/api/v1/admin/customer-groups', { preHandler: requireAdmin('customer_groups:read') }, async () => {
+        const rows = await customerGroupService().list();
+        return { data: rows.map(serializeCustomerGroup) };
+    });
+    app.put('/api/v1/admin/customer-groups/:code', {
+        preHandler: requireAdmin('customer_groups:write'),
+        schema: { body: upsertCustomerGroupRequestSchema },
+    }, async (request) => {
+        const body = upsertCustomerGroupRequestSchema.parse(request.body);
+        const row = await customerGroupService().upsertByCode({
+            code: request.params.code,
+            name: body.name,
+            ...(body.description !== undefined ? { description: body.description } : {}),
+        });
+        return { data: serializeCustomerGroup(row) };
+    });
+    app.delete('/api/v1/admin/customer-groups/:id', { preHandler: requireAdmin('customer_groups:write') }, async (request, reply) => {
+        await customerGroupService().remove(request.params.id);
+        return reply.status(204).send();
+    });
+}
+function serializeCustomerGroup(row) {
+    return {
+        id: row.id,
+        code: row.code,
+        name: row.name,
+        description: row.description ?? null,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+    };
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AA2B9E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAoB,EACpB,IAA4B;IAE5B,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAEpD,GAAG,CAAC,GAAG,CACL,+BAA+B,EAC/B,EAAE,UAAU,EAAE,YAAY,CAAC,sBAAsB,CAAC,EAAE,EACpD,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC,IAAI,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;IACpD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,qCAAqC,EACrC;QACE,UAAU,EAAE,YAAY,CAAC,uBAAuB,CAAC;QACjD,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE;KACnD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,oBAAoB,EAAE,CAAC,YAAY,CAAC;YACpD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,mCAAmC,EACnC,EAAE,UAAU,EAAE,YAAY,CAAC,uBAAuB,CAAC,EAAE,EACrD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,oBAAoB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAkB;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC"}

package/dist/backend/services/audit-references.d.ts

@@ -0,0 +1,22 @@
+import type { AuditReferenceRegistryPort, OrganizationDetailsPort } from '@endora-commerce/contracts';
+import type { EntityManager } from '@mikro-orm/postgresql';
+/**
+ * What an impersonated customer is called on an audit row (feature 075, D-87
+ * drain).
+ *
+ * `audit_logs` used to answer this with a `customer_accounts left join
+ * organizations` written into its own service — one statement crossing two
+ * module boundaries. The organisation name is still preferred over the account
+ * e-mail, because that is what an operator reading "acted as …" recognises; it
+ * comes from `organizationDetailsPort` now, an edge this module already declares
+ * and has always had a foreign key for.
+ *
+ * There is no `catch` around that port on purpose. It is gated, and a gate that
+ * says no must not be turned into a blank name here — the reader's own
+ * enumeration policy is what degrades this whole bucket, one level up.
+ *
+ * No `url`: an audit actor is a person, not a row the card links to. That was
+ * already true of the SQL this replaces.
+ */
+export declare function registerCustomerAccountAuditReferences(registry: AuditReferenceRegistryPort, emFactory: () => EntityManager, organizationDetails: OrganizationDetailsPort): void;
+//# sourceMappingURL=audit-references.d.ts.map

package/dist/backend/services/audit-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-references.d.ts","sourceRoot":"","sources":["../../../src/backend/services/audit-references.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,0BAA0B,EACpC,SAAS,EAAE,MAAM,aAAa,EAC9B,mBAAmB,EAAE,uBAAuB,GAC3C,IAAI,CA+BN"}

package/dist/backend/services/audit-references.js

@@ -0,0 +1,46 @@
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+/**
+ * What an impersonated customer is called on an audit row (feature 075, D-87
+ * drain).
+ *
+ * `audit_logs` used to answer this with a `customer_accounts left join
+ * organizations` written into its own service — one statement crossing two
+ * module boundaries. The organisation name is still preferred over the account
+ * e-mail, because that is what an operator reading "acted as …" recognises; it
+ * comes from `organizationDetailsPort` now, an edge this module already declares
+ * and has always had a foreign key for.
+ *
+ * There is no `catch` around that port on purpose. It is gated, and a gate that
+ * says no must not be turned into a blank name here — the reader's own
+ * enumeration policy is what degrades this whole bucket, one level up.
+ *
+ * No `url`: an audit actor is a person, not a row the card links to. That was
+ * already true of the SQL this replaces.
+ */
+export function registerCustomerAccountAuditReferences(registry, emFactory, organizationDetails) {
+    registry.register({
+        ownerModuleId: 'customer_accounts',
+        referenceType: 'customer_account',
+        resolve: async (ids) => {
+            const accounts = await emFactory().find(CustomerAccount, { id: { $in: [...ids] } }, { fields: ['id', 'email', 'organizationId'] });
+            if (accounts.length === 0)
+                return [];
+            const organizationIds = [
+                ...new Set(accounts.map((a) => a.organizationId).filter((id) => !!id)),
+            ];
+            const names = new Map();
+            if (organizationIds.length > 0) {
+                for (const org of await organizationDetails.findByIds(organizationIds)) {
+                    names.set(org.id, org.name);
+                }
+            }
+            return accounts.map((account) => ({
+                id: account.id,
+                label: (account.organizationId ? names.get(account.organizationId) : undefined) ??
+                    account.email,
+                url: null,
+            }));
+        },
+    });
+}
+//# sourceMappingURL=audit-references.js.map

package/dist/backend/services/audit-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-references.js","sourceRoot":"","sources":["../../../src/backend/services/audit-references.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sCAAsC,CACpD,QAAoC,EACpC,SAA8B,EAC9B,mBAA4C;IAE5C,QAAQ,CAAC,QAAQ,CAAC;QAChB,aAAa,EAAE,mBAAmB;QAClC,aAAa,EAAE,kBAAkB;QACjC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC,IAAI,CACrC,eAAe,EACf,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,EACzB,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,CAC9C,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAErC,MAAM,eAAe,GAAG;gBACtB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACrF,CAAC;YACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;YACxC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,mBAAmB,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;oBACvE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EACH,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACxE,OAAO,CAAC,KAAK;gBACf,GAAG,EAAE,IAAI;aACV,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}