@hartl-services/medusa-affiliate 0.3.0

package/.medusa/server/src/utils/affiliate-cart-operation-lock.js

@@ -0,0 +1,316 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withAffiliateCartOperationLock = exports.withAffiliateOperationLocks = exports.acquireAffiliateOperationLocks = exports.affiliateProgramSagaLockKey = exports.affiliateSagaLockKey = exports.runAsIndependentAffiliateOperation = exports.isAffiliateCartOperationLockKeyHeld = exports.affiliateCartLockKey = exports.AffiliateOperationLockTimeoutError = void 0;
+const node_async_hooks_1 = require("node:async_hooks");
+const utils_1 = require("@medusajs/framework/utils");
+class KeyedConnectionPermits {
+    constructor(capacity) {
+        this.capacity = capacity;
+        this.active = 0;
+        this.activeKeys = new Set();
+        this.waiters = [];
+    }
+    async acquire(keys) {
+        return await new Promise((resolve) => {
+            this.waiters.push({ keys, resolve });
+            this.dispatch();
+        });
+    }
+    release(keys) {
+        this.active -= 1;
+        for (const key of keys) {
+            this.activeKeys.delete(key);
+        }
+        this.dispatch();
+    }
+    dispatch() {
+        for (let index = 0; index < this.waiters.length;) {
+            if (this.active >= this.capacity) {
+                return;
+            }
+            const waiter = this.waiters[index];
+            if (waiter.keys.some((key) => this.activeKeys.has(key))) {
+                index += 1;
+                continue;
+            }
+            this.waiters.splice(index, 1);
+            this.active += 1;
+            for (const key of waiter.keys) {
+                this.activeKeys.add(key);
+            }
+            let released = false;
+            waiter.resolve(() => {
+                if (released)
+                    return;
+                released = true;
+                this.release(waiter.keys);
+            });
+        }
+    }
+}
+class AffiliateOperationLockTimeoutError extends Error {
+    constructor(lockKey) {
+        super(`Timed out acquiring Affiliate operation lock "${lockKey}".`);
+        this.name = "AffiliateOperationLockTimeoutError";
+    }
+}
+exports.AffiliateOperationLockTimeoutError = AffiliateOperationLockTimeoutError;
+const heldOperationLocks = new node_async_hooks_1.AsyncLocalStorage();
+const schedulerByClient = new WeakMap();
+const defaultPoolMax = 2;
+const reservedWorkflowConnections = 1;
+const advisoryLockTimeoutMs = 5_000;
+const advisoryLockPollIntervalMs = 25;
+const normalizeLockKeys = (lockKeys) => [...new Set(lockKeys)].sort((left, right) => {
+    const leftIsCart = left.startsWith("affiliate-cart:");
+    const rightIsCart = right.startsWith("affiliate-cart:");
+    if (leftIsCart !== rightIsCart)
+        return leftIsCart ? -1 : 1;
+    return left.localeCompare(right);
+});
+const combinedFailure = (failures, message) => {
+    if (failures.length === 1)
+        return failures[0];
+    return new AggregateError(failures, message);
+};
+const lockCapacity = (knex) => {
+    const configuredMaxValue = knex.client.pool?.max ?? knex.client.config?.pool?.max ?? defaultPoolMax;
+    const configuredMax = Number.isFinite(configuredMaxValue)
+        ? Math.floor(configuredMaxValue)
+        : defaultPoolMax;
+    if (configuredMax <= reservedWorkflowConnections) {
+        throw new Error("Affiliate operation locking requires a PostgreSQL pool with at least two connections.");
+    }
+    return configuredMax - reservedWorkflowConnections;
+};
+const connectionPermits = (knex) => {
+    const client = knex.client;
+    let permits = schedulerByClient.get(client);
+    if (!permits) {
+        permits = new KeyedConnectionPermits(lockCapacity(knex));
+        schedulerByClient.set(client, permits);
+    }
+    return permits;
+};
+const queryBoolean = (result, field) => {
+    const rows = result
+        ?.rows;
+    return rows?.[0]?.[field] === true;
+};
+const wait = async (milliseconds) => await new Promise((resolve) => setTimeout(resolve, milliseconds));
+const acquireAdvisoryLock = async (connection, lockKey) => {
+    const deadline = Date.now() + advisoryLockTimeoutMs;
+    while (true) {
+        const result = await connection.query("select pg_try_advisory_lock(hashtext($1)) as acquired", [lockKey]);
+        if (queryBoolean(result, "acquired"))
+            return;
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            throw new AffiliateOperationLockTimeoutError(lockKey);
+        }
+        await wait(Math.min(advisoryLockPollIntervalMs, remaining));
+    }
+};
+const discardConnection = async (knex, connection, reason, failures) => {
+    // Close immediately so an ambiguous query cannot leave a server lock alive.
+    // Knex rejects the marker during later pool validation; pg's callback-based
+    // end() completes immediately when the client is already ended.
+    connection.__knex__disposed =
+        reason instanceof Error
+            ? reason
+            : new Error("Affiliate operation lock connection was discarded.");
+    try {
+        await knex.client.destroyRawConnection(connection);
+    }
+    catch (destroyError) {
+        failures.push(destroyError);
+    }
+    try {
+        const pool = knex.client.pool;
+        if (!pool?.release) {
+            throw new Error("Tarn cannot release the discarded Affiliate operation lock connection.");
+        }
+        // Tarn returns false only when this exact resource is already absent from
+        // `used`, so either result leaves no occupied pool slot.
+        pool.release(connection);
+    }
+    catch (poolReleaseError) {
+        failures.push(poolReleaseError);
+    }
+};
+const releaseAdvisoryLocks = async (connection, lockKeys) => {
+    for (const lockKey of [...lockKeys].reverse()) {
+        const unlockResult = await connection.query("select pg_advisory_unlock(hashtext($1)) as unlocked", [lockKey]);
+        if (!queryBoolean(unlockResult, "unlocked")) {
+            throw new Error(`PostgreSQL did not release Affiliate lock "${lockKey}".`);
+        }
+    }
+};
+const releaseAfterFailedAcquisition = async (knex, connection, acquisitionError, acquiredLockKeys) => {
+    const failures = [acquisitionError];
+    if (acquisitionError instanceof AffiliateOperationLockTimeoutError) {
+        try {
+            await releaseAdvisoryLocks(connection, acquiredLockKeys);
+            await knex.client.releaseConnection(connection);
+        }
+        catch (unlockError) {
+            failures.push(unlockError);
+            await discardConnection(knex, connection, unlockError, failures);
+        }
+    }
+    else {
+        // A failed query has an unknown server-side outcome.
+        await discardConnection(knex, connection, acquisitionError, failures);
+    }
+    throw combinedFailure(failures, "Affiliate operation lock acquisition failed");
+};
+const affiliateCartLockKey = (cartId) => `affiliate-cart:${cartId}`;
+exports.affiliateCartLockKey = affiliateCartLockKey;
+const isAffiliateCartOperationLockKeyHeld = (lockKey) => heldOperationLocks.getStore()?.has(lockKey) ?? false;
+exports.isAffiliateCartOperationLockKeyHeld = isAffiliateCartOperationLockKeyHeld;
+const runAsIndependentAffiliateOperation = async (operation) => await heldOperationLocks.run(new Set(), operation);
+exports.runAsIndependentAffiliateOperation = runAsIndependentAffiliateOperation;
+const affiliateSagaLockKey = (affiliateId) => `affiliate-saga:${affiliateId}`;
+exports.affiliateSagaLockKey = affiliateSagaLockKey;
+const affiliateProgramSagaLockKey = () => "affiliate-program-saga";
+exports.affiliateProgramSagaLockKey = affiliateProgramSagaLockKey;
+const acquireAffiliateOperationLocks = async (container, lockKeys) => {
+    const normalizedLockKeys = normalizeLockKeys(lockKeys);
+    const inheritedLocks = heldOperationLocks.getStore();
+    const acquiredLockKeys = normalizedLockKeys.filter((lockKey) => !inheritedLocks?.has(lockKey));
+    if (!acquiredLockKeys.length) {
+        return {
+            run: (operation) => operation(),
+            release: async () => undefined,
+        };
+    }
+    const knex = container.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+    const releasePermit = await connectionPermits(knex).acquire(acquiredLockKeys);
+    let connection;
+    try {
+        connection = await knex.client.acquireConnection();
+    }
+    catch (error) {
+        releasePermit();
+        throw error;
+    }
+    const lockedKeys = [];
+    try {
+        for (const lockKey of acquiredLockKeys) {
+            await acquireAdvisoryLock(connection, lockKey);
+            lockedKeys.push(lockKey);
+        }
+    }
+    catch (acquisitionError) {
+        try {
+            return await releaseAfterFailedAcquisition(knex, connection, acquisitionError, lockedKeys);
+        }
+        finally {
+            releasePermit();
+        }
+    }
+    const operationLocks = new Set(inheritedLocks ?? []);
+    for (const lockKey of acquiredLockKeys) {
+        operationLocks.add(lockKey);
+    }
+    let releasePromise;
+    return {
+        run: (operation) => heldOperationLocks.run(operationLocks, operation),
+        release: () => {
+            releasePromise ??= (async () => {
+                const failures = [];
+                for (const lockKey of acquiredLockKeys) {
+                    operationLocks.delete(lockKey);
+                }
+                let unlocked = false;
+                try {
+                    await releaseAdvisoryLocks(connection, acquiredLockKeys);
+                    unlocked = true;
+                }
+                catch (unlockError) {
+                    failures.push(unlockError);
+                    await discardConnection(knex, connection, unlockError, failures);
+                }
+                if (unlocked) {
+                    try {
+                        await knex.client.releaseConnection(connection);
+                    }
+                    catch (releaseError) {
+                        failures.push(releaseError);
+                        await discardConnection(knex, connection, releaseError, failures);
+                    }
+                }
+                releasePermit();
+                if (failures.length) {
+                    throw combinedFailure(failures, "Affiliate operation lease cleanup failed");
+                }
+            })();
+            return releasePromise;
+        },
+    };
+};
+exports.acquireAffiliateOperationLocks = acquireAffiliateOperationLocks;
+const withAffiliateOperationLocks = async (container, lockKeys, operation) => {
+    const normalizedLockKeys = normalizeLockKeys(lockKeys);
+    const inheritedLocks = heldOperationLocks.getStore();
+    const acquiredLockKeys = normalizedLockKeys.filter((lockKey) => !inheritedLocks?.has(lockKey));
+    if (!acquiredLockKeys.length)
+        return await operation();
+    const knex = container.resolve(utils_1.ContainerRegistrationKeys.PG_CONNECTION);
+    const releasePermit = await connectionPermits(knex).acquire(acquiredLockKeys);
+    let operationLocks;
+    try {
+        const connection = await knex.client.acquireConnection();
+        const lockedKeys = [];
+        try {
+            for (const lockKey of acquiredLockKeys) {
+                await acquireAdvisoryLock(connection, lockKey);
+                lockedKeys.push(lockKey);
+            }
+        }
+        catch (acquisitionError) {
+            return await releaseAfterFailedAcquisition(knex, connection, acquisitionError, lockedKeys);
+        }
+        operationLocks = new Set(inheritedLocks ?? []);
+        for (const lockKey of acquiredLockKeys) {
+            operationLocks.add(lockKey);
+        }
+        const failures = [];
+        let result;
+        try {
+            result = await heldOperationLocks.run(operationLocks, operation);
+        }
+        catch (operationError) {
+            failures.push(operationError);
+        }
+        for (const lockKey of acquiredLockKeys) {
+            operationLocks.delete(lockKey);
+        }
+        let unlocked = false;
+        try {
+            await releaseAdvisoryLocks(connection, acquiredLockKeys);
+            unlocked = true;
+        }
+        catch (unlockError) {
+            failures.push(unlockError);
+            await discardConnection(knex, connection, unlockError, failures);
+        }
+        if (unlocked) {
+            await knex.client.releaseConnection(connection);
+        }
+        if (failures.length) {
+            throw combinedFailure(failures, "Affiliate operation cleanup failed");
+        }
+        return result;
+    }
+    finally {
+        for (const lockKey of acquiredLockKeys) {
+            operationLocks?.delete(lockKey);
+        }
+        releasePermit();
+    }
+};
+exports.withAffiliateOperationLocks = withAffiliateOperationLocks;
+const withAffiliateCartOperationLock = async (container, cartId, operation) => await (0, exports.withAffiliateOperationLocks)(container, [(0, exports.affiliateCartLockKey)(cartId)], operation);
+exports.withAffiliateCartOperationLock = withAffiliateCartOperationLock;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWZmaWxpYXRlLWNhcnQtb3BlcmF0aW9uLWxvY2suanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvdXRpbHMvYWZmaWxpYXRlLWNhcnQtb3BlcmF0aW9uLWxvY2sudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsdURBQXFEO0FBR3JELHFEQUFzRTtBQXlCdEUsTUFBTSxzQkFBc0I7SUFLMUIsWUFBNkIsUUFBZ0I7UUFBaEIsYUFBUSxHQUFSLFFBQVEsQ0FBUTtRQUpyQyxXQUFNLEdBQUcsQ0FBQyxDQUFDO1FBQ0YsZUFBVSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7UUFDL0IsWUFBTyxHQUFtQixFQUFFLENBQUM7SUFFRSxDQUFDO0lBRWpELEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBYztRQUMxQixPQUFPLE1BQU0sSUFBSSxPQUFPLENBQWEsQ0FBQyxPQUFPLEVBQUUsRUFBRTtZQUMvQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQ3JDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNsQixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxPQUFPLENBQUMsSUFBYztRQUM1QixJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsQ0FBQztRQUNqQixLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3ZCLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzlCLENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUVPLFFBQVE7UUFDZCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUksQ0FBQztZQUNsRCxJQUFJLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNqQyxPQUFPO1lBQ1QsQ0FBQztZQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDbkMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUN4RCxLQUFLLElBQUksQ0FBQyxDQUFDO2dCQUNYLFNBQVM7WUFDWCxDQUFDO1lBRUQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQzlCLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxDQUFDO1lBQ2pCLEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUM5QixJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMzQixDQUFDO1lBQ0QsSUFBSSxRQUFRLEdBQUcsS0FBSyxDQUFDO1lBQ3JCLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO2dCQUNsQixJQUFJLFFBQVE7b0JBQUUsT0FBTztnQkFDckIsUUFBUSxHQUFHLElBQUksQ0FBQztnQkFDaEIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDNUIsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBRUQsTUFBYSxrQ0FBbUMsU0FBUSxLQUFLO0lBQzNELFlBQVksT0FBZTtRQUN6QixLQUFLLENBQUMsaURBQWlELE9BQU8sSUFBSSxDQUFDLENBQUM7UUFDcEUsSUFBSSxDQUFDLElBQUksR0FBRyxvQ0FBb0MsQ0FBQztJQUNuRCxDQUFDO0NBQ0Y7QUFMRCxnRkFLQztBQUVELE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxvQ0FBaUIsRUFBdUIsQ0FBQztBQUN4RSxNQUFNLGlCQUFpQixHQUFHLElBQUksT0FBTyxFQUFrQyxDQUFDO0FBRXhFLE1BQU0sY0FBYyxHQUFHLENBQUMsQ0FBQztBQUN6QixNQUFNLDJCQUEyQixHQUFHLENBQUMsQ0FBQztBQUN0QyxNQUFNLHFCQUFxQixHQUFHLEtBQUssQ0FBQztBQUNwQyxNQUFNLDBCQUEwQixHQUFHLEVBQUUsQ0FBQztBQUV0QyxNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBMkIsRUFBWSxFQUFFLENBQ2xFLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRTtJQUMxQyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDdEQsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hELElBQUksVUFBVSxLQUFLLFdBQVc7UUFBRSxPQUFPLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMzRCxPQUFPLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDLENBQUM7QUFFTCxNQUFNLGVBQWUsR0FBRyxDQUFDLFFBQW1CLEVBQUUsT0FBZSxFQUFXLEVBQUU7SUFDeEUsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxPQUFPLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5QyxPQUFPLElBQUksY0FBYyxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUMvQyxDQUFDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLElBQXNCLEVBQVUsRUFBRTtJQUN0RCxNQUFNLGtCQUFrQixHQUN0QixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEdBQUcsSUFBSSxjQUFjLENBQUM7SUFDM0UsTUFBTSxhQUFhLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQztRQUN2RCxDQUFDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQztRQUNoQyxDQUFDLENBQUMsY0FBYyxDQUFDO0lBQ25CLElBQUksYUFBYSxJQUFJLDJCQUEyQixFQUFFLENBQUM7UUFDakQsTUFBTSxJQUFJLEtBQUssQ0FDYix1RkFBdUYsQ0FDeEYsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLGFBQWEsR0FBRywyQkFBMkIsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsSUFBc0IsRUFBMEIsRUFBRTtJQUMzRSxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBZ0IsQ0FBQztJQUNyQyxJQUFJLE9BQU8sR0FBRyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDNUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2IsT0FBTyxHQUFHLElBQUksc0JBQXNCLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDekQsaUJBQWlCLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQztJQUN6QyxDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxNQUFlLEVBQUUsS0FBYSxFQUFXLEVBQUU7SUFDL0QsTUFBTSxJQUFJLEdBQUksTUFBMkQ7UUFDdkUsRUFBRSxJQUFJLENBQUM7SUFDVCxPQUFPLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssSUFBSSxDQUFDO0FBQ3JDLENBQUMsQ0FBQztBQUVGLE1BQU0sSUFBSSxHQUFHLEtBQUssRUFBRSxZQUFvQixFQUFpQixFQUFFLENBQ3pELE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztBQUUxRSxNQUFNLG1CQUFtQixHQUFHLEtBQUssRUFDL0IsVUFBa0MsRUFDbEMsT0FBZSxFQUNBLEVBQUU7SUFDakIsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLHFCQUFxQixDQUFDO0lBQ3BELE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDWixNQUFNLE1BQU0sR0FBRyxNQUFNLFVBQVUsQ0FBQyxLQUFLLENBQ25DLHVEQUF1RCxFQUN2RCxDQUFDLE9BQU8sQ0FBQyxDQUNWLENBQUM7UUFDRixJQUFJLFlBQVksQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDO1lBQUUsT0FBTztRQUU3QyxNQUFNLFNBQVMsR0FBRyxRQUFRLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3hDLElBQUksU0FBUyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ25CLE1BQU0sSUFBSSxrQ0FBa0MsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4RCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQywwQkFBMEIsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQzlELENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLEtBQUssRUFDN0IsSUFBc0IsRUFDdEIsVUFBa0MsRUFDbEMsTUFBZSxFQUNmLFFBQW1CLEVBQ0osRUFBRTtJQUNqQiw0RUFBNEU7SUFDNUUsNEVBQTRFO0lBQzVFLGdFQUFnRTtJQUNoRSxVQUFVLENBQUMsZ0JBQWdCO1FBQ3pCLE1BQU0sWUFBWSxLQUFLO1lBQ3JCLENBQUMsQ0FBQyxNQUFNO1lBQ1IsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFFdEUsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO1FBQ3RCLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDOUIsQ0FBQztJQUVELElBQUksQ0FBQztRQUNILE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDO1FBQzlCLElBQUksQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLEtBQUssQ0FDYix3RUFBd0UsQ0FDekUsQ0FBQztRQUNKLENBQUM7UUFDRCwwRUFBMEU7UUFDMUUseURBQXlEO1FBQ3pELElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDM0IsQ0FBQztJQUFDLE9BQU8sZ0JBQWdCLEVBQUUsQ0FBQztRQUMxQixRQUFRLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDbEMsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sb0JBQW9CLEdBQUcsS0FBSyxFQUNoQyxVQUFrQyxFQUNsQyxRQUEyQixFQUNaLEVBQUU7SUFDakIsS0FBSyxNQUFNLE9BQU8sSUFBSSxDQUFDLEdBQUcsUUFBUSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUM5QyxNQUFNLFlBQVksR0FBRyxNQUFNLFVBQVUsQ0FBQyxLQUFLLENBQ3pDLHFEQUFxRCxFQUNyRCxDQUFDLE9BQU8sQ0FBQyxDQUNWLENBQUM7UUFDRixJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSxLQUFLLENBQ2IsOENBQThDLE9BQU8sSUFBSSxDQUMxRCxDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLDZCQUE2QixHQUFHLEtBQUssRUFDekMsSUFBc0IsRUFDdEIsVUFBa0MsRUFDbEMsZ0JBQXlCLEVBQ3pCLGdCQUFtQyxFQUNuQixFQUFFO0lBQ2xCLE1BQU0sUUFBUSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUNwQyxJQUFJLGdCQUFnQixZQUFZLGtDQUFrQyxFQUFFLENBQUM7UUFDbkUsSUFBSSxDQUFDO1lBQ0gsTUFBTSxvQkFBb0IsQ0FBQyxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztZQUN6RCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7WUFDckIsUUFBUSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUMzQixNQUFNLGlCQUFpQixDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ25FLENBQUM7SUFDSCxDQUFDO1NBQU0sQ0FBQztRQUNOLHFEQUFxRDtRQUNyRCxNQUFNLGlCQUFpQixDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELE1BQU0sZUFBZSxDQUNuQixRQUFRLEVBQ1IsNkNBQTZDLENBQzlDLENBQUM7QUFDSixDQUFDLENBQUM7QUFFSyxNQUFNLG9CQUFvQixHQUFHLENBQUMsTUFBYyxFQUFVLEVBQUUsQ0FDN0Qsa0JBQWtCLE1BQU0sRUFBRSxDQUFDO0FBRGhCLFFBQUEsb0JBQW9CLHdCQUNKO0FBRXRCLE1BQU0sbUNBQW1DLEdBQUcsQ0FBQyxPQUFlLEVBQVcsRUFBRSxDQUM5RSxrQkFBa0IsQ0FBQyxRQUFRLEVBQUUsRUFBRSxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksS0FBSyxDQUFDO0FBRDFDLFFBQUEsbUNBQW1DLHVDQUNPO0FBRWhELE1BQU0sa0NBQWtDLEdBQUcsS0FBSyxFQUNyRCxTQUEyQixFQUNmLEVBQUUsQ0FBQyxNQUFNLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxFQUFFLFNBQVMsQ0FBQyxDQUFDO0FBRnZELFFBQUEsa0NBQWtDLHNDQUVxQjtBQUU3RCxNQUFNLG9CQUFvQixHQUFHLENBQUMsV0FBbUIsRUFBVSxFQUFFLENBQ2xFLGtCQUFrQixXQUFXLEVBQUUsQ0FBQztBQURyQixRQUFBLG9CQUFvQix3QkFDQztBQUUzQixNQUFNLDJCQUEyQixHQUFHLEdBQVcsRUFBRSxDQUN0RCx3QkFBd0IsQ0FBQztBQURkLFFBQUEsMkJBQTJCLCtCQUNiO0FBT3BCLE1BQU0sOEJBQThCLEdBQUcsS0FBSyxFQUNqRCxTQUEwQixFQUMxQixRQUEyQixFQUNXLEVBQUU7SUFDeEMsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2RCxNQUFNLGNBQWMsR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUNyRCxNQUFNLGdCQUFnQixHQUFHLGtCQUFrQixDQUFDLE1BQU0sQ0FDaEQsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsY0FBYyxFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FDM0MsQ0FBQztJQUNGLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUM3QixPQUFPO1lBQ0wsR0FBRyxFQUFFLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLEVBQUU7WUFDL0IsT0FBTyxFQUFFLEtBQUssSUFBSSxFQUFFLENBQUMsU0FBUztTQUMvQixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQzVCLGlDQUF5QixDQUFDLGFBQWEsQ0FDcEIsQ0FBQztJQUN0QixNQUFNLGFBQWEsR0FBRyxNQUFNLGlCQUFpQixDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzlFLElBQUksVUFBa0MsQ0FBQztJQUN2QyxJQUFJLENBQUM7UUFDSCxVQUFVLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGlCQUFpQixFQUFFLENBQUM7SUFDckQsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixhQUFhLEVBQUUsQ0FBQztRQUNoQixNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7SUFFRCxNQUFNLFVBQVUsR0FBYSxFQUFFLENBQUM7SUFDaEMsSUFBSSxDQUFDO1FBQ0gsS0FBSyxNQUFNLE9BQU8sSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3ZDLE1BQU0sbUJBQW1CLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQy9DLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDM0IsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLGdCQUFnQixFQUFFLENBQUM7UUFDMUIsSUFBSSxDQUFDO1lBQ0gsT0FBTyxNQUFNLDZCQUE2QixDQUN4QyxJQUFJLEVBQ0osVUFBVSxFQUNWLGdCQUFnQixFQUNoQixVQUFVLENBQ1gsQ0FBQztRQUNKLENBQUM7Z0JBQVMsQ0FBQztZQUNULGFBQWEsRUFBRSxDQUFDO1FBQ2xCLENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsSUFBSSxHQUFHLENBQUMsY0FBYyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELEtBQUssTUFBTSxPQUFPLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztRQUN2QyxjQUFjLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFDRCxJQUFJLGNBQXlDLENBQUM7SUFFOUMsT0FBTztRQUNMLEdBQUcsRUFBRSxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLGNBQWMsRUFBRSxTQUFTLENBQUM7UUFDckUsT0FBTyxFQUFFLEdBQUcsRUFBRTtZQUNaLGNBQWMsS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFO2dCQUM3QixNQUFNLFFBQVEsR0FBYyxFQUFFLENBQUM7Z0JBQy9CLEtBQUssTUFBTSxPQUFPLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztvQkFDdkMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDakMsQ0FBQztnQkFDRCxJQUFJLFFBQVEsR0FBRyxLQUFLLENBQUM7Z0JBQ3JCLElBQUksQ0FBQztvQkFDSCxNQUFNLG9CQUFvQixDQUFDLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO29CQUN6RCxRQUFRLEdBQUcsSUFBSSxDQUFDO2dCQUNsQixDQUFDO2dCQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7b0JBQ3JCLFFBQVEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUM7b0JBQzNCLE1BQU0saUJBQWlCLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQ25FLENBQUM7Z0JBRUQsSUFBSSxRQUFRLEVBQUUsQ0FBQztvQkFDYixJQUFJLENBQUM7d0JBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUNsRCxDQUFDO29CQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7d0JBQ3RCLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7d0JBQzVCLE1BQU0saUJBQWlCLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUM7b0JBQ3BFLENBQUM7Z0JBQ0gsQ0FBQztnQkFFRCxhQUFhLEVBQUUsQ0FBQztnQkFDaEIsSUFBSSxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7b0JBQ3BCLE1BQU0sZUFBZSxDQUNuQixRQUFRLEVBQ1IsMENBQTBDLENBQzNDLENBQUM7Z0JBQ0osQ0FBQztZQUNILENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDTCxPQUFPLGNBQWMsQ0FBQztRQUN4QixDQUFDO0tBQ0YsQ0FBQztBQUNKLENBQUMsQ0FBQztBQXpGVyxRQUFBLDhCQUE4QixrQ0F5RnpDO0FBRUssTUFBTSwyQkFBMkIsR0FBRyxLQUFLLEVBQzlDLFNBQTBCLEVBQzFCLFFBQTJCLEVBQzNCLFNBQTJCLEVBQ2YsRUFBRTtJQUNkLE1BQU0sa0JBQWtCLEdBQUcsaUJBQWlCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDdkQsTUFBTSxjQUFjLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDckQsTUFBTSxnQkFBZ0IsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQ2hELENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLGNBQWMsRUFBRSxHQUFHLENBQUMsT0FBTyxDQUFDLENBQzNDLENBQUM7SUFDRixJQUFJLENBQUMsZ0JBQWdCLENBQUMsTUFBTTtRQUFFLE9BQU8sTUFBTSxTQUFTLEVBQUUsQ0FBQztJQUV2RCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsT0FBTyxDQUM1QixpQ0FBeUIsQ0FBQyxhQUFhLENBQ3BCLENBQUM7SUFDdEIsTUFBTSxhQUFhLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUM5RSxJQUFJLGNBQXVDLENBQUM7SUFFNUMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxVQUFVLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDekQsTUFBTSxVQUFVLEdBQWEsRUFBRSxDQUFDO1FBQ2hDLElBQUksQ0FBQztZQUNILEtBQUssTUFBTSxPQUFPLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztnQkFDdkMsTUFBTSxtQkFBbUIsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7Z0JBQy9DLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDM0IsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLGdCQUFnQixFQUFFLENBQUM7WUFDMUIsT0FBTyxNQUFNLDZCQUE2QixDQUN4QyxJQUFJLEVBQ0osVUFBVSxFQUNWLGdCQUFnQixFQUNoQixVQUFVLENBQ1gsQ0FBQztRQUNKLENBQUM7UUFDRCxjQUFjLEdBQUcsSUFBSSxHQUFHLENBQUMsY0FBYyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLEtBQUssTUFBTSxPQUFPLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztZQUN2QyxjQUFjLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzlCLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBYyxFQUFFLENBQUM7UUFDL0IsSUFBSSxNQUFxQixDQUFDO1FBQzFCLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxNQUFNLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUFDLE9BQU8sY0FBYyxFQUFFLENBQUM7WUFDeEIsUUFBUSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNoQyxDQUFDO1FBQ0QsS0FBSyxNQUFNLE9BQU8sSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3ZDLGNBQWMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUNELElBQUksUUFBUSxHQUFHLEtBQUssQ0FBQztRQUNyQixJQUFJLENBQUM7WUFDSCxNQUFNLG9CQUFvQixDQUFDLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ3pELFFBQVEsR0FBRyxJQUFJLENBQUM7UUFDbEIsQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7WUFDckIsUUFBUSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUMzQixNQUFNLGlCQUFpQixDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFFRCxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2xELENBQUM7UUFFRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNwQixNQUFNLGVBQWUsQ0FBQyxRQUFRLEVBQUUsb0NBQW9DLENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBQ0QsT0FBTyxNQUFXLENBQUM7SUFDckIsQ0FBQztZQUFTLENBQUM7UUFDVCxLQUFLLE1BQU0sT0FBTyxJQUFJLGdCQUFnQixFQUFFLENBQUM7WUFDdkMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNsQyxDQUFDO1FBQ0QsYUFBYSxFQUFFLENBQUM7SUFDbEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQXZFVyxRQUFBLDJCQUEyQiwrQkF1RXRDO0FBRUssTUFBTSw4QkFBOEIsR0FBRyxLQUFLLEVBQ2pELFNBQTBCLEVBQzFCLE1BQWMsRUFDZCxTQUEyQixFQUNmLEVBQUUsQ0FDZCxNQUFNLElBQUEsbUNBQTJCLEVBQy9CLFNBQVMsRUFDVCxDQUFDLElBQUEsNEJBQW9CLEVBQUMsTUFBTSxDQUFDLENBQUMsRUFDOUIsU0FBUyxDQUNWLENBQUM7QUFUUyxRQUFBLDhCQUE4QixrQ0FTdkMifQ==

package/.medusa/server/src/utils/affiliate-promotion-mutation-authorization.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consumeAffiliatePromotionMutationAuthorization = exports.issueAffiliatePromotionMutationAuthorization = exports.affiliatePromotionAuthorizationInputKey = void 0;
+const node_crypto_1 = require("node:crypto");
+exports.affiliatePromotionAuthorizationInputKey = "__affiliate_promotion_mutation_authorization";
+const pendingAuthorizations = new Map();
+const authorizationTtlMs = 30_000;
+const normalizedCodes = (codes) => codes.map((code) => code.trim().toUpperCase());
+const scopesMatch = (authorization, scope) => {
+    const authorizedCodes = normalizedCodes(authorization.promo_codes);
+    const requestedCodes = normalizedCodes(scope.promo_codes);
+    return (authorization.cart_id === scope.cart_id &&
+        authorization.coupon_id === scope.coupon_id &&
+        authorization.promotion_id === scope.promotion_id &&
+        authorization.action === scope.action &&
+        authorizedCodes.length === requestedCodes.length &&
+        authorizedCodes.every((code, index) => code === requestedCodes[index]));
+};
+const issueAffiliatePromotionMutationAuthorization = (scope) => {
+    const now = Date.now();
+    for (const [token, authorization] of pendingAuthorizations) {
+        if (authorization.expires_at <= now)
+            pendingAuthorizations.delete(token);
+    }
+    const token = (0, node_crypto_1.randomBytes)(32).toString("base64url");
+    pendingAuthorizations.set(token, {
+        ...scope,
+        promo_codes: [...scope.promo_codes],
+        expires_at: now + authorizationTtlMs,
+    });
+    return {
+        token,
+        revoke: () => {
+            pendingAuthorizations.delete(token);
+        },
+    };
+};
+exports.issueAffiliatePromotionMutationAuthorization = issueAffiliatePromotionMutationAuthorization;
+const consumeAffiliatePromotionMutationAuthorization = (token, scope) => {
+    if (typeof token !== "string")
+        return false;
+    const authorization = pendingAuthorizations.get(token);
+    pendingAuthorizations.delete(token);
+    return Boolean(authorization &&
+        authorization.expires_at > Date.now() &&
+        scopesMatch(authorization, scope));
+};
+exports.consumeAffiliatePromotionMutationAuthorization = consumeAffiliatePromotionMutationAuthorization;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWZmaWxpYXRlLXByb21vdGlvbi1tdXRhdGlvbi1hdXRob3JpemF0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3V0aWxzL2FmZmlsaWF0ZS1wcm9tb3Rpb24tbXV0YXRpb24tYXV0aG9yaXphdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSw2Q0FBMEM7QUFJN0IsUUFBQSx1Q0FBdUMsR0FDbEQsOENBQXVELENBQUM7QUFjMUQsTUFBTSxxQkFBcUIsR0FBRyxJQUFJLEdBQUcsRUFBZ0MsQ0FBQztBQUN0RSxNQUFNLGtCQUFrQixHQUFHLE1BQU0sQ0FBQztBQUVsQyxNQUFNLGVBQWUsR0FBRyxDQUFDLEtBQWUsRUFBWSxFQUFFLENBQ3BELEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0FBRWpELE1BQU0sV0FBVyxHQUFHLENBQ2xCLGFBQW1DLEVBQ25DLEtBQW1ELEVBQzFDLEVBQUU7SUFDWCxNQUFNLGVBQWUsR0FBRyxlQUFlLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ25FLE1BQU0sY0FBYyxHQUFHLGVBQWUsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDMUQsT0FBTyxDQUNMLGFBQWEsQ0FBQyxPQUFPLEtBQUssS0FBSyxDQUFDLE9BQU87UUFDdkMsYUFBYSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUztRQUMzQyxhQUFhLENBQUMsWUFBWSxLQUFLLEtBQUssQ0FBQyxZQUFZO1FBQ2pELGFBQWEsQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU07UUFDckMsZUFBZSxDQUFDLE1BQU0sS0FBSyxjQUFjLENBQUMsTUFBTTtRQUNoRCxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsSUFBSSxLQUFLLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUN2RSxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUssTUFBTSw0Q0FBNEMsR0FBRyxDQUMxRCxLQUFtRCxFQUNoQixFQUFFO0lBQ3JDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUN2QixLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsYUFBYSxDQUFDLElBQUkscUJBQXFCLEVBQUUsQ0FBQztRQUMzRCxJQUFJLGFBQWEsQ0FBQyxVQUFVLElBQUksR0FBRztZQUFFLHFCQUFxQixDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBRUQsTUFBTSxLQUFLLEdBQUcsSUFBQSx5QkFBVyxFQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNwRCxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFO1FBQy9CLEdBQUcsS0FBSztRQUNSLFdBQVcsRUFBRSxDQUFDLEdBQUcsS0FBSyxDQUFDLFdBQVcsQ0FBQztRQUNuQyxVQUFVLEVBQUUsR0FBRyxHQUFHLGtCQUFrQjtLQUNyQyxDQUFDLENBQUM7SUFDSCxPQUFPO1FBQ0wsS0FBSztRQUNMLE1BQU0sRUFBRSxHQUFHLEVBQUU7WUFDWCxxQkFBcUIsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdEMsQ0FBQztLQUNGLENBQUM7QUFDSixDQUFDLENBQUM7QUFwQlcsUUFBQSw0Q0FBNEMsZ0RBb0J2RDtBQUVLLE1BQU0sOENBQThDLEdBQUcsQ0FDNUQsS0FBYyxFQUNkLEtBQW1ELEVBQzFDLEVBQUU7SUFDWCxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUU1QyxNQUFNLGFBQWEsR0FBRyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDdkQscUJBQXFCLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3BDLE9BQU8sT0FBTyxDQUNaLGFBQWE7UUFDYixhQUFhLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUU7UUFDckMsV0FBVyxDQUFDLGFBQWEsRUFBRSxLQUFLLENBQUMsQ0FDbEMsQ0FBQztBQUNKLENBQUMsQ0FBQztBQWJXLFFBQUEsOENBQThDLGtEQWF6RCJ9

package/.medusa/server/src/utils/cart-promotions.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readCartPromotions = void 0;
+const readCartPromotions = (promotions) => (promotions ?? []).filter((promotion) => typeof promotion === "object" &&
+    promotion !== null &&
+    typeof promotion.id === "string" &&
+    promotion.id.length > 0);
+exports.readCartPromotions = readCartPromotions;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2FydC1wcm9tb3Rpb25zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3V0aWxzL2NhcnQtcHJvbW90aW9ucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFjTyxNQUFNLGtCQUFrQixHQUFHLENBQ2hDLFVBQW1DLEVBQzlCLEVBQUUsQ0FDUCxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQ3ZCLENBQUMsU0FBUyxFQUFrQixFQUFFLENBQzVCLE9BQU8sU0FBUyxLQUFLLFFBQVE7SUFDN0IsU0FBUyxLQUFLLElBQUk7SUFDbEIsT0FBTyxTQUFTLENBQUMsRUFBRSxLQUFLLFFBQVE7SUFDaEMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUMxQixDQUFBO0FBVFUsUUFBQSxrQkFBa0Isc0JBUzVCIn0=

package/.medusa/server/src/utils/money.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Money = exports.getCurrencyDecimals = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * Fallback used when a currency is unknown to Medusa's static currency table.
+ * Most ISO currencies use 2 minor-unit digits; the exceptions (0 for JPY, 3 for
+ * KWD/BHD, etc.) are resolved from `defaultCurrencies` by `getCurrencyDecimals`.
+ */
+const DEFAULT_CURRENCY_DECIMAL_PLACES = 2;
+/**
+ * Minor-unit digit count for a currency, e.g. EUR/USD = 2, JPY = 0, KWD = 3.
+ * Sourced from Medusa's installed static currency data so commission rounding
+ * respects each currency's precision instead of assuming two decimals.
+ */
+const getCurrencyDecimals = (currencyCode) => utils_1.defaultCurrencies[currencyCode.toUpperCase()]?.decimal_digits ??
+    DEFAULT_CURRENCY_DECIMAL_PLACES;
+exports.getCurrencyDecimals = getCurrencyDecimals;
+/**
+ * Immutable value object for authoritative money arithmetic. Wraps MathBN
+ * (bignumber.js) so commission calculations never rely on native JS float
+ * operators - only the final `toRoundedNumber()` call touches a plain number.
+ */
+class Money {
+    constructor(value) {
+        this.value = value;
+    }
+    static of(value) {
+        return value instanceof Money ? value : new Money(utils_1.MathBN.convert(value));
+    }
+    static zero() {
+        return Money.of(0);
+    }
+    static sum(values) {
+        return values.reduce((total, value) => total.add(value), Money.zero());
+    }
+    add(value) {
+        return new Money(utils_1.MathBN.add(this.value, Money.of(value).value));
+    }
+    subtract(value) {
+        return new Money(utils_1.MathBN.sub(this.value, Money.of(value).value));
+    }
+    multiply(value) {
+        return new Money(utils_1.MathBN.mult(this.value, Money.of(value).value));
+    }
+    divide(value) {
+        return new Money(utils_1.MathBN.div(this.value, Money.of(value).value));
+    }
+    /** `this * ratePercent / 100`, e.g. a base amount times a commission rate. */
+    applyPercentageRate(ratePercent) {
+        return this.multiply(ratePercent).divide(100);
+    }
+    negate() {
+        return new Money(utils_1.MathBN.mult(this.value, -1));
+    }
+    abs() {
+        return new Money(utils_1.MathBN.abs(this.value));
+    }
+    min(value) {
+        return new Money(utils_1.MathBN.min(this.value, Money.of(value).value));
+    }
+    max(value) {
+        return new Money(utils_1.MathBN.max(this.value, Money.of(value).value));
+    }
+    isNegative() {
+        return utils_1.MathBN.lt(this.value, 0);
+    }
+    isPositive() {
+        return utils_1.MathBN.gt(this.value, 0);
+    }
+    toRoundedNumber(decimalPlaces = DEFAULT_CURRENCY_DECIMAL_PLACES) {
+        // MathBN.convert's second argument is ignored when it is falsy, so a
+        // 0-decimal currency (e.g. JPY) would not be rounded. Round on the
+        // BigNumber directly instead, which honors 0.
+        return this.value.decimalPlaces(decimalPlaces).toNumber();
+    }
+}
+exports.Money = Money;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibW9uZXkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvdXRpbHMvbW9uZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEscURBQXFFO0FBR3JFOzs7O0dBSUc7QUFDSCxNQUFNLCtCQUErQixHQUFHLENBQUMsQ0FBQTtBQUV6Qzs7OztHQUlHO0FBQ0ksTUFBTSxtQkFBbUIsR0FBRyxDQUFDLFlBQW9CLEVBQVUsRUFBRSxDQUNsRSx5QkFBaUIsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLENBQUMsRUFBRSxjQUFjO0lBQzdELCtCQUErQixDQUFBO0FBRnBCLFFBQUEsbUJBQW1CLHVCQUVDO0FBSWpDOzs7O0dBSUc7QUFDSCxNQUFhLEtBQUs7SUFDaEIsWUFBcUMsS0FBa0I7UUFBbEIsVUFBSyxHQUFMLEtBQUssQ0FBYTtJQUFHLENBQUM7SUFFM0QsTUFBTSxDQUFDLEVBQUUsQ0FBQyxLQUE2QjtRQUNyQyxPQUFPLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLENBQUMsY0FBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBQzFFLENBQUM7SUFFRCxNQUFNLENBQUMsSUFBSTtRQUNULE9BQU8sS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUNwQixDQUFDO0lBRUQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFrQztRQUMzQyxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQVEsQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBQy9FLENBQUM7SUFFRCxHQUFHLENBQUMsS0FBNkI7UUFDL0IsT0FBTyxJQUFJLEtBQUssQ0FBQyxjQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBQ2pFLENBQUM7SUFFRCxRQUFRLENBQUMsS0FBNkI7UUFDcEMsT0FBTyxJQUFJLEtBQUssQ0FBQyxjQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBQ2pFLENBQUM7SUFFRCxRQUFRLENBQUMsS0FBNkI7UUFDcEMsT0FBTyxJQUFJLEtBQUssQ0FBQyxjQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBQ2xFLENBQUM7SUFFRCxNQUFNLENBQUMsS0FBNkI7UUFDbEMsT0FBTyxJQUFJLEtBQUssQ0FBQyxjQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBQ2pFLENBQUM7SUFFRCw4RUFBOEU7SUFDOUUsbUJBQW1CLENBQUMsV0FBbUM7UUFDckQsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUMvQyxDQUFDO0lBRUQsTUFBTTtRQUNKLE9BQU8sSUFBSSxLQUFLLENBQUMsY0FBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUMvQyxDQUFDO0lBRUQsR0FBRztRQUNELE9BQU8sSUFBSSxLQUFLLENBQUMsY0FBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQTtJQUMxQyxDQUFDO0lBRUQsR0FBRyxDQUFDLEtBQTZCO1FBQy9CLE9BQU8sSUFBSSxLQUFLLENBQUMsY0FBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQTtJQUNqRSxDQUFDO0lBRUQsR0FBRyxDQUFDLEtBQTZCO1FBQy9CLE9BQU8sSUFBSSxLQUFLLENBQUMsY0FBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQTtJQUNqRSxDQUFDO0lBRUQsVUFBVTtRQUNSLE9BQU8sY0FBTSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQ2pDLENBQUM7SUFFRCxVQUFVO1FBQ1IsT0FBTyxjQUFNLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUE7SUFDakMsQ0FBQztJQUVELGVBQWUsQ0FDYixnQkFBd0IsK0JBQStCO1FBRXZELHFFQUFxRTtRQUNyRSxtRUFBbUU7UUFDbkUsOENBQThDO1FBQzlDLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUE7SUFDM0QsQ0FBQztDQUNGO0FBcEVELHNCQW9FQyJ9

package/.medusa/server/src/utils/promotion-code-availability.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertPromotionCodeAvailable = exports.promotionCodeTakenMessage = exports.findPromotionsWithCodeIgnoringCase = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * Medusa's unique index on `promotion.code` is case-sensitive, while every
+ * code a customer types is looked up after normalization (the storefront
+ * upper-cases input, the affiliate plugin canonicalizes to upper case). Two
+ * promotions whose codes differ only in case are therefore one code from the
+ * customer's point of view and must never coexist - regardless of whether
+ * the Admin dashboard or an affiliate coupon created them.
+ */
+const escapeLikePattern = (value) => value.replace(/[\\%_]/g, (character) => `\\${character}`);
+const findPromotionsWithCodeIgnoringCase = async (promotionService, code, options = {}) => {
+    const trimmed = code.trim();
+    if (!trimmed)
+        return [];
+    const excluded = new Set(options.except_promotion_ids ?? []);
+    const promotions = (await promotionService.listPromotions({ code: { $ilike: escapeLikePattern(trimmed) } }, { select: ["id", "code"], take: 10 }));
+    return promotions.filter((promotion) => !excluded.has(promotion.id) &&
+        (promotion.code ?? "").trim().toLowerCase() === trimmed.toLowerCase());
+};
+exports.findPromotionsWithCodeIgnoringCase = findPromotionsWithCodeIgnoringCase;
+const promotionCodeTakenMessage = (code, owner) => `Der Code „${code}“ wird bereits von einer Werbeaktion verwendet („${owner.code ?? owner.id}“). Gutschein- und Promotion-Codes müssen sich auch ohne Beachtung der Groß-/Kleinschreibung unterscheiden.`;
+exports.promotionCodeTakenMessage = promotionCodeTakenMessage;
+const assertPromotionCodeAvailable = async (container, code, options = {}) => {
+    const promotionService = container.resolve(utils_1.Modules.PROMOTION);
+    const [owner] = await (0, exports.findPromotionsWithCodeIgnoringCase)(promotionService, code, options);
+    if (owner) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.DUPLICATE_ERROR, (0, exports.promotionCodeTakenMessage)(code, owner));
+    }
+};
+exports.assertPromotionCodeAvailable = assertPromotionCodeAvailable;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvbW90aW9uLWNvZGUtYXZhaWxhYmlsaXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3V0aWxzL3Byb21vdGlvbi1jb2RlLWF2YWlsYWJpbGl0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFJQSxxREFBZ0U7QUFTaEU7Ozs7Ozs7R0FPRztBQUNILE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxLQUFhLEVBQVUsRUFBRSxDQUNsRCxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQyxDQUFBO0FBRXBELE1BQU0sa0NBQWtDLEdBQUcsS0FBSyxFQUNyRCxnQkFBcUMsRUFDckMsSUFBWSxFQUNaLFVBQXdELEVBQUUsRUFDM0IsRUFBRTtJQUNqQyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUE7SUFDM0IsSUFBSSxDQUFDLE9BQU87UUFBRSxPQUFPLEVBQUUsQ0FBQTtJQUN2QixNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLElBQUksRUFBRSxDQUFDLENBQUE7SUFDNUQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxNQUFNLGdCQUFnQixDQUFDLGNBQWMsQ0FDdkQsRUFBRSxJQUFJLEVBQUUsRUFBRSxNQUFNLEVBQUUsaUJBQWlCLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxFQUNoRCxFQUFFLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxNQUFNLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLENBQ3JDLENBQXlCLENBQUE7SUFDMUIsT0FBTyxVQUFVLENBQUMsTUFBTSxDQUN0QixDQUFDLFNBQVMsRUFBRSxFQUFFLENBQ1osQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDM0IsQ0FBQyxTQUFTLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxLQUFLLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FDeEUsQ0FBQTtBQUNILENBQUMsQ0FBQTtBQWpCWSxRQUFBLGtDQUFrQyxzQ0FpQjlDO0FBRU0sTUFBTSx5QkFBeUIsR0FBRyxDQUN2QyxJQUFZLEVBQ1osS0FBeUIsRUFDakIsRUFBRSxDQUNWLGFBQWEsSUFBSSxvREFDZixLQUFLLENBQUMsSUFBSSxJQUFJLEtBQUssQ0FBQyxFQUN0Qiw2R0FBNkcsQ0FBQTtBQU5sRyxRQUFBLHlCQUF5Qiw2QkFNeUU7QUFFeEcsTUFBTSw0QkFBNEIsR0FBRyxLQUFLLEVBQy9DLFNBQTBCLEVBQzFCLElBQVksRUFDWixVQUF3RCxFQUFFLEVBQzNDLEVBQUU7SUFDakIsTUFBTSxnQkFBZ0IsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUN4QyxlQUFPLENBQUMsU0FBUyxDQUNTLENBQUE7SUFDNUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLE1BQU0sSUFBQSwwQ0FBa0MsRUFDdEQsZ0JBQWdCLEVBQ2hCLElBQUksRUFDSixPQUFPLENBQ1IsQ0FBQTtJQUNELElBQUksS0FBSyxFQUFFLENBQUM7UUFDVixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsZUFBZSxFQUNqQyxJQUFBLGlDQUF5QixFQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FDdkMsQ0FBQTtJQUNILENBQUM7QUFDSCxDQUFDLENBQUE7QUFuQlksUUFBQSw0QkFBNEIsZ0NBbUJ4QyJ9

package/.medusa/server/src/utils/registered-email-checkout.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireLoginForRegisteredCheckoutEmail = exports.requireLoginForRegisteredPaymentEmail = exports.requireLoginForRegisteredCartEmail = exports.CUSTOMER_LOGIN_REQUIRED_MESSAGE = void 0;
+exports.isCheckoutBlockedForRegisteredEmail = isCheckoutBlockedForRegisteredEmail;
+exports.escapeLikePattern = escapeLikePattern;
+exports.assertEmailAllowedForActor = assertEmailAllowedForActor;
+const utils_1 = require("@medusajs/framework/utils");
+exports.CUSTOMER_LOGIN_REQUIRED_MESSAGE = "Für diese E-Mail-Adresse besteht bereits ein Kundenkonto. Bitte melde dich an, um die Bestellung abzuschließen.";
+function isCheckoutBlockedForRegisteredEmail(input) {
+    return (input.registeredCustomerIds.length > 0 &&
+        !input.registeredCustomerIds.includes(input.actorId ?? ""));
+}
+// ILIKE gives case-insensitive matching (Medusa does not normalize stored
+// emails), but treats `%` and `_` as wildcards - and `_` is common in real
+// addresses. Unescaped, "a_b@x.de" would match "aXb@x.de".
+function escapeLikePattern(value) {
+    return value.replace(/[\\%_]/g, "\\$&");
+}
+/**
+ * An email that belongs to a registered account may only be used for a
+ * checkout by a request authenticated as that account. Medusa core would
+ * otherwise link an anonymous cart to whichever customer record shares the
+ * email - the account itself included - and file the order, plus any affiliate
+ * own-order discount or commission tied to it, under that identity with
+ * nothing but the typed-in address as proof.
+ *
+ * The request's auth context is the only usable signal: cart.customer_id is
+ * set by that same core linking and so never proves a login. The storefront
+ * establishes a Medusa browser session at login precisely so that its
+ * browser-side cart and payment calls carry this identity.
+ */
+async function assertEmailAllowedForActor(container, email, actorId) {
+    // Same deliberately provider-agnostic normalization as normalizeAffiliateEmail.
+    const normalizedEmail = email?.trim().toLowerCase();
+    if (!normalizedEmail) {
+        return;
+    }
+    const customerService = container.resolve(utils_1.Modules.CUSTOMER);
+    const registeredCustomers = await customerService.listCustomers({ email: { $ilike: escapeLikePattern(normalizedEmail) }, has_account: true }, { select: ["id"] });
+    if (isCheckoutBlockedForRegisteredEmail({
+        registeredCustomerIds: registeredCustomers.map(({ id }) => id),
+        actorId,
+    })) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_ALLOWED, exports.CUSTOMER_LOGIN_REQUIRED_MESSAGE);
+    }
+}
+async function loadCartEmail(container, cartId) {
+    const query = container.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const { data } = await query.graph({
+        entity: "cart",
+        fields: ["id", "email"],
+        filters: { id: cartId },
+    });
+    return data[0]?.email;
+}
+/**
+ * First gate, on setting the email itself (cart create and update): refusing
+ * here keeps a cart with someone else's account email from ever existing, and
+ * puts the login prompt at the address step - before any payment details.
+ * Runs ahead of the core body validation, so the raw body is read defensively.
+ */
+const requireLoginForRegisteredCartEmail = async (req, _res, next) => {
+    const email = req.body?.email;
+    if (typeof email === "string") {
+        await assertEmailAllowedForActor(req.scope, email, req.auth_context?.actor_id);
+    }
+    next();
+};
+exports.requireLoginForRegisteredCartEmail = requireLoginForRegisteredCartEmail;
+/**
+ * Second gate. Creating a payment session is what hands the browser a Stripe
+ * client secret, and Stripe charges on confirmPayment - before completeCart
+ * runs at all. Covers carts that got their email past the first gate (set
+ * before it existed, or by a server-side backfill).
+ */
+const requireLoginForRegisteredPaymentEmail = async (req, _res, next) => {
+    const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const { data } = await query.graph({
+        entity: "payment_collection",
+        fields: ["id", "cart.email"],
+        filters: { id: req.params.id },
+    });
+    const cart = data[0]?.cart;
+    if (cart) {
+        await assertEmailAllowedForActor(req.scope, cart.email, req.auth_context?.actor_id);
+    }
+    next();
+};
+exports.requireLoginForRegisteredPaymentEmail = requireLoginForRegisteredPaymentEmail;
+/**
+ * Backstop on completion, for a cart whose payment session was created before
+ * the gates existed. By this point a payment may already be authorized; the
+ * two gates above exist so that this one is never the first to refuse.
+ */
+const requireLoginForRegisteredCheckoutEmail = async (req, _res, next) => {
+    const email = await loadCartEmail(req.scope, req.params.id);
+    await assertEmailAllowedForActor(req.scope, email, req.auth_context?.actor_id);
+    next();
+};
+exports.requireLoginForRegisteredCheckoutEmail = requireLoginForRegisteredCheckoutEmail;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaXN0ZXJlZC1lbWFpbC1jaGVja291dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy91dGlscy9yZWdpc3RlcmVkLWVtYWlsLWNoZWNrb3V0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQXNCQSxrRkFRQztBQUtELDhDQUVDO0FBZUQsZ0VBK0JDO0FBMUVELHFEQUlrQztBQUVyQixRQUFBLCtCQUErQixHQUMxQyxpSEFBaUgsQ0FBQTtBQU1uSCxTQUFnQixtQ0FBbUMsQ0FBQyxLQUduRDtJQUNDLE9BQU8sQ0FDTCxLQUFLLENBQUMscUJBQXFCLENBQUMsTUFBTSxHQUFHLENBQUM7UUFDdEMsQ0FBQyxLQUFLLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDLENBQzNELENBQUE7QUFDSCxDQUFDO0FBRUQsMEVBQTBFO0FBQzFFLDJFQUEyRTtBQUMzRSwyREFBMkQ7QUFDM0QsU0FBZ0IsaUJBQWlCLENBQUMsS0FBYTtJQUM3QyxPQUFPLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0FBQ3pDLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSSxLQUFLLFVBQVUsMEJBQTBCLENBQzlDLFNBQTBCLEVBQzFCLEtBQWdDLEVBQ2hDLE9BQWtDO0lBRWxDLGdGQUFnRjtJQUNoRixNQUFNLGVBQWUsR0FBRyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUE7SUFFbkQsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ3JCLE9BQU07SUFDUixDQUFDO0lBRUQsTUFBTSxlQUFlLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FDdkMsZUFBTyxDQUFDLFFBQVEsQ0FDUyxDQUFBO0lBQzNCLE1BQU0sbUJBQW1CLEdBQUcsTUFBTSxlQUFlLENBQUMsYUFBYSxDQUM3RCxFQUFFLEtBQUssRUFBRSxFQUFFLE1BQU0sRUFBRSxpQkFBaUIsQ0FBQyxlQUFlLENBQUMsRUFBRSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsRUFDNUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUNuQixDQUFBO0lBRUQsSUFDRSxtQ0FBbUMsQ0FBQztRQUNsQyxxQkFBcUIsRUFBRSxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDOUQsT0FBTztLQUNSLENBQUMsRUFDRixDQUFDO1FBQ0QsTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFDN0IsdUNBQStCLENBQ2hDLENBQUE7SUFDSCxDQUFDO0FBQ0gsQ0FBQztBQUVELEtBQUssVUFBVSxhQUFhLENBQzFCLFNBQTBCLEVBQzFCLE1BQWM7SUFFZCxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ2hFLE1BQU0sRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDakMsTUFBTSxFQUFFLE1BQU07UUFDZCxNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDO1FBQ3ZCLE9BQU8sRUFBRSxFQUFFLEVBQUUsRUFBRSxNQUFNLEVBQUU7S0FDeEIsQ0FBQyxDQUFBO0lBRUYsT0FBUSxJQUFJLENBQUMsQ0FBQyxDQUEyQyxFQUFFLEtBQUssQ0FBQTtBQUNsRSxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSSxNQUFNLGtDQUFrQyxHQUFHLEtBQUssRUFDckQsR0FBeUIsRUFDekIsSUFBb0IsRUFDcEIsSUFBd0IsRUFDVCxFQUFFO0lBQ2pCLE1BQU0sS0FBSyxHQUFJLEdBQUcsQ0FBQyxJQUF3QyxFQUFFLEtBQUssQ0FBQTtJQUVsRSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzlCLE1BQU0sMEJBQTBCLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQTtJQUNoRixDQUFDO0lBRUQsSUFBSSxFQUFFLENBQUE7QUFDUixDQUFDLENBQUE7QUFaWSxRQUFBLGtDQUFrQyxzQ0FZOUM7QUFFRDs7Ozs7R0FLRztBQUNJLE1BQU0scUNBQXFDLEdBQUcsS0FBSyxFQUN4RCxHQUF5QixFQUN6QixJQUFvQixFQUNwQixJQUF3QixFQUNULEVBQUU7SUFDakIsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDaEUsTUFBTSxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQztRQUNqQyxNQUFNLEVBQUUsb0JBQW9CO1FBQzVCLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLENBQUM7UUFDNUIsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFO0tBQy9CLENBQUMsQ0FBQTtJQUNGLE1BQU0sSUFBSSxHQUFJLElBQUksQ0FBQyxDQUFDLENBQTZELEVBQUUsSUFBSSxDQUFBO0lBRXZGLElBQUksSUFBSSxFQUFFLENBQUM7UUFDVCxNQUFNLDBCQUEwQixDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFBO0lBQ3JGLENBQUM7SUFFRCxJQUFJLEVBQUUsQ0FBQTtBQUNSLENBQUMsQ0FBQTtBQWxCWSxRQUFBLHFDQUFxQyx5Q0FrQmpEO0FBRUQ7Ozs7R0FJRztBQUNJLE1BQU0sc0NBQXNDLEdBQUcsS0FBSyxFQUN6RCxHQUF5QixFQUN6QixJQUFvQixFQUNwQixJQUF3QixFQUNULEVBQUU7SUFDakIsTUFBTSxLQUFLLEdBQUcsTUFBTSxhQUFhLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFBO0lBRTNELE1BQU0sMEJBQTBCLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQTtJQUU5RSxJQUFJLEVBQUUsQ0FBQTtBQUNSLENBQUMsQ0FBQTtBQVZZLFFBQUEsc0NBQXNDLDBDQVVsRCJ9

package/.medusa/server/src/utils/resolve-services.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAffiliateService = void 0;
+const affiliate_1 = require("../modules/affiliate");
+const resolveAffiliateService = (container) => container.resolve(affiliate_1.AFFILIATE_MODULE);
+exports.resolveAffiliateService = resolveAffiliateService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS1zZXJ2aWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy91dGlscy9yZXNvbHZlLXNlcnZpY2VzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUVBLG9EQUF1RDtBQUdoRCxNQUFNLHVCQUF1QixHQUFHLENBQ3JDLFNBQTBCLEVBQ0YsRUFBRSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsNEJBQWdCLENBQUMsQ0FBQTtBQUZuRCxRQUFBLHVCQUF1QiwyQkFFNEIifQ==