@infuro/cms-core 1.0.29 → 1.0.31

package/dist/migrations/1775400000001-AddDiscountAndOrderAddresses.ts

@@ -0,0 +1,274 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class AddDiscountAndOrderAddresses1775400000001
+  implements MigrationInterface
+{
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    
+    // ENUMS
+
+    await queryRunner.query(`
+      CREATE TYPE "discounts_discounttype_enum"
+      AS ENUM ('PERCENTAGE', 'FLAT')
+    `);
+
+    await queryRunner.query(`
+      CREATE TYPE "discounts_status_enum"
+      AS ENUM ('ACTIVE', 'INACTIVE', 'EXPIRED')
+    `);
+
+    await queryRunner.query(`
+      CREATE TYPE "order_addresses_addresstype_enum"
+      AS ENUM ('shipping_address', 'billing_address')
+    `);
+
+    await queryRunner.query(`
+      CREATE TYPE "discount_rules_conditiontype_enum"
+      AS ENUM ('group', 'rule')
+    `);
+
+    await queryRunner.query(`
+      CREATE TYPE "discount_rules_conditionoperator_enum"
+      AS ENUM ('and', 'or')
+    `);
+
+    await queryRunner.query(`
+      CREATE TYPE "discount_rules_type_enum"
+      AS ENUM (
+        'minAmount',
+        'user',
+        'product',
+        'category',
+        'cart',
+        'paymentMethod',
+        'order',
+        'quantity',
+        'time',
+        'shipping'
+      )
+    `);
+
+    await queryRunner.query(`
+      CREATE TYPE "discount_rules_subtype_enum"
+      AS ENUM (
+        'userType',
+        'userId',
+        'productId',
+        'categoryId',
+        'cartId',
+        'orderId',
+        'firstOrder',
+        'nthOrder',
+        'dateRange',
+        'dayOfWeek',
+        'timeRange'
+      )
+    `);
+
+    await queryRunner.query(`
+      CREATE TYPE "discount_rules_comparisonoperator_enum"
+      AS ENUM (
+        'eq',
+        'neq',
+        'gt',
+        'gte',
+        'lt',
+        'lte',
+        'in',
+        'notIn',
+        'between'
+      )
+    `);
+
+    // DISCOUNTS
+
+    await queryRunner.query(`
+      CREATE TABLE "discounts" (
+        "id" SERIAL PRIMARY KEY,
+        "name" varchar NOT NULL,
+        "couponCode" varchar UNIQUE NOT NULL,
+        "description" varchar,
+        "discountType" "discounts_discounttype_enum" NOT NULL,
+        "value" decimal(10,2) NOT NULL,
+        "maxDiscountAmount" decimal(10,2),
+        "maxTotalUsage" int,
+        "maxUsagePerUser" int,
+        "usedCount" int DEFAULT 0,
+        "validFrom" timestamp NOT NULL,
+        "validUntil" timestamp NOT NULL,
+        "status" "discounts_status_enum" DEFAULT 'ACTIVE',
+        "canCombineWithOtherDiscounts" boolean NOT NULL
+      )
+    `);
+    
+    // DISCOUNT RULES
+
+    await queryRunner.query(`
+      CREATE TABLE "discount_rules" (
+        "id" SERIAL PRIMARY KEY,
+        "discountId" int NOT NULL,
+        "parentId" int,
+        "conditionType" "discount_rules_conditiontype_enum" NOT NULL,
+        "conditionOperator" "discount_rules_conditionoperator_enum",
+        "type" "discount_rules_type_enum",
+        "subType" "discount_rules_subtype_enum",
+        "comparisonOperator" "discount_rules_comparisonoperator_enum",
+        "value" jsonb NOT NULL
+      )
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "discount_rules"
+      ADD CONSTRAINT "FK_discount_rules_discount"
+      FOREIGN KEY ("discountId") REFERENCES "discounts"("id")
+      ON DELETE CASCADE
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "discount_rules"
+      ADD CONSTRAINT "FK_discount_rules_parent"
+      FOREIGN KEY ("parentId") REFERENCES "discount_rules"("id")
+      ON DELETE CASCADE
+    `);
+ 
+    // ORDER DISCOUNTS
+
+    await queryRunner.query(`
+      CREATE TABLE "order_discounts" (
+        "id" SERIAL PRIMARY KEY,
+        "orderId" int NOT NULL,
+        "orderItemId" int NOT NULL,
+        "userId" int NOT NULL,
+        "discountId" int NOT NULL,
+        "discountCode" varchar NOT NULL,
+        "discountAmount" decimal(10,2) NOT NULL,
+        "metaData" jsonb
+      )
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_discounts"
+      ADD CONSTRAINT "FK_order_discounts_order"
+      FOREIGN KEY ("orderId") REFERENCES "orders"("id")
+      ON DELETE CASCADE
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_discounts"
+      ADD CONSTRAINT "FK_order_discounts_item"
+      FOREIGN KEY ("orderItemId") REFERENCES "order_items"("id")
+      ON DELETE CASCADE
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_discounts"
+      ADD CONSTRAINT "FK_order_discounts_discount"
+      FOREIGN KEY ("discountId") REFERENCES "discounts"("id")
+      ON DELETE CASCADE
+    `);
+
+    // ORDER ADDRESSES
+
+    await queryRunner.query(`
+      CREATE TABLE "order_addresses" (
+        "id" SERIAL PRIMARY KEY,
+        "contactId" int NOT NULL,
+        "addressType" "order_addresses_addresstype_enum" NOT NULL,
+        "line1" varchar NOT NULL,
+        "line2" varchar,
+        "city" varchar NOT NULL,
+        "state" varchar NOT NULL,
+        "postalCode" varchar NOT NULL,
+        "country" varchar NOT NULL,
+        "createdAt" timestamp DEFAULT CURRENT_TIMESTAMP,
+        "updatedAt" timestamp DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_addresses"
+      ADD CONSTRAINT "FK_order_addresses_contact"
+      FOREIGN KEY ("contactId") REFERENCES "contacts"("id")
+      ON DELETE CASCADE
+    `);
+ 
+    // ALTER ORDER ITEMS 
+
+    await queryRunner.query(`
+      ALTER TABLE "order_items"
+      ADD COLUMN "discountIds" integer[] DEFAULT ARRAY[]::INTEGER[]
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_items"
+      ADD COLUMN "subTotal" decimal(10,2)
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_items"
+      ADD COLUMN "discount" decimal(10,2)
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_items"
+      ADD COLUMN "discountedAmount" decimal(10,2)
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    
+    // DROP FK FIRST (SAFE)  
+
+    await queryRunner.query(`
+      ALTER TABLE "order_addresses" DROP CONSTRAINT IF EXISTS "FK_order_addresses_contact"
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_discounts" DROP CONSTRAINT IF EXISTS "FK_order_discounts_discount"
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_discounts" DROP CONSTRAINT IF EXISTS "FK_order_discounts_item"
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "order_discounts" DROP CONSTRAINT IF EXISTS "FK_order_discounts_order"
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "discount_rules" DROP CONSTRAINT IF EXISTS "FK_discount_rules_parent"
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "discount_rules" DROP CONSTRAINT IF EXISTS "FK_discount_rules_discount"
+    `);
+    
+    // DROP TABLES 
+
+    await queryRunner.query(`DROP TABLE IF EXISTS "order_addresses"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "order_discounts"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "discount_rules"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "discounts"`);
+ 
+    // ROLLBACK ORDER ITEMS 
+
+    await queryRunner.query(`ALTER TABLE "order_items" DROP COLUMN IF EXISTS "discountIds"`);
+    await queryRunner.query(`ALTER TABLE "order_items" DROP COLUMN IF EXISTS "subTotal"`);
+    await queryRunner.query(`ALTER TABLE "order_items" DROP COLUMN IF EXISTS "discount"`);
+    await queryRunner.query(`ALTER TABLE "order_items" DROP COLUMN IF EXISTS "discountedAmount"`);
+    await queryRunner.query(`ALTER TABLE "order_items" DROP COLUMN IF EXISTS "metadata"`);
+    await queryRunner.query(`ALTER TABLE "order_items" DROP COLUMN IF EXISTS "createdAt"`);
+    await queryRunner.query(`ALTER TABLE "order_items" DROP COLUMN IF EXISTS "updatedAt"`);
+ 
+    // DROP ENUMS
+
+    await queryRunner.query(`DROP TYPE IF EXISTS "discounts_discounttype_enum"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "discounts_status_enum"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "order_addresses_addresstype_enum"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "discount_rules_conditiontype_enum"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "discount_rules_conditionoperator_enum"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "discount_rules_type_enum"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "discount_rules_subtype_enum"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "discount_rules_comparisonoperator_enum"`);
+  }
+}

package/dist/migrations/1775800000000-VendorsAndVendorUsers.ts

@@ -0,0 +1,74 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class VendorsAndVendorUsers1775800000000 implements MigrationInterface {
+  name = 'VendorsAndVendorUsers1775800000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS "vendors" (
+        "id" SERIAL NOT NULL,
+        "name" character varying NOT NULL,
+        "slug" character varying NOT NULL,
+        "email" character varying,
+        "phone" character varying,
+        "logo" character varying,
+        "description" text,
+        "metadata" jsonb,
+        "active" boolean NOT NULL DEFAULT true,
+        "createdAt" TIMESTAMP NOT NULL DEFAULT now(),
+        "updatedAt" TIMESTAMP NOT NULL DEFAULT now(),
+        "deletedAt" TIMESTAMP,
+        "deleted" boolean NOT NULL DEFAULT false,
+        "createdBy" integer,
+        "updatedBy" integer,
+        "deletedBy" integer,
+        CONSTRAINT "UQ_vendors_slug" UNIQUE ("slug"),
+        CONSTRAINT "PK_vendors" PRIMARY KEY ("id")
+      )
+    `);
+
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS "vendor_users" (
+        "id" SERIAL NOT NULL,
+        "vendorId" integer NOT NULL,
+        "userId" integer NOT NULL,
+        "role" character varying NOT NULL DEFAULT 'staff',
+        "createdAt" TIMESTAMP NOT NULL DEFAULT now(),
+        "updatedAt" TIMESTAMP NOT NULL DEFAULT now(),
+        CONSTRAINT "UQ_vendor_users_vendor_user" UNIQUE ("vendorId", "userId"),
+        CONSTRAINT "PK_vendor_users" PRIMARY KEY ("id")
+      )
+    `);
+
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_vendor_users_vendor" ON "vendor_users" ("vendorId")
+    `);
+    await queryRunner.query(`
+      CREATE INDEX IF NOT EXISTS "IDX_vendor_users_user" ON "vendor_users" ("userId")
+    `);
+
+    await queryRunner.query(`
+      DO $$ BEGIN
+        ALTER TABLE "vendor_users" ADD CONSTRAINT "FK_vendor_users_vendorId"
+        FOREIGN KEY ("vendorId") REFERENCES "vendors"("id") ON DELETE CASCADE ON UPDATE NO ACTION;
+      EXCEPTION WHEN duplicate_object THEN NULL;
+      END $$
+    `);
+    await queryRunner.query(`
+      DO $$ BEGIN
+        ALTER TABLE "vendor_users" ADD CONSTRAINT "FK_vendor_users_userId"
+        FOREIGN KEY ("userId") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE NO ACTION;
+      EXCEPTION WHEN duplicate_object THEN NULL;
+      END $$
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "vendor_users" DROP CONSTRAINT IF EXISTS "FK_vendor_users_userId"`);
+    await queryRunner.query(`ALTER TABLE "vendor_users" DROP CONSTRAINT IF EXISTS "FK_vendor_users_vendorId"`);
+    await queryRunner.query(`DROP INDEX IF EXISTS "IDX_vendor_users_user"`);
+    await queryRunner.query(`DROP INDEX IF EXISTS "IDX_vendor_users_vendor"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "vendor_users"`);
+    await queryRunner.query(`DROP TABLE IF EXISTS "vendors"`);
+  }
+}

package/dist/migrations/1775900000000-StoreVendorIdColumns.ts

@@ -0,0 +1,124 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+const STORE_TABLES = [
+  'product_categories',
+  'brands',
+  'attributes',
+  'taxes',
+  'collections',
+  'products',
+  'orders',
+  'payments',
+] as const;
+
+/** Global slug/orderNumber uniques replaced by (vendorId, …) composites. */
+const SLUG_UNIQUE_DROPS: Array<{ table: string; constraint: string; composite: string; columns: string }> = [
+  { table: 'product_categories', constraint: 'UQ_product_categories_slug', composite: 'UQ_product_categories_vendor_slug', columns: '"vendorId", "slug"' },
+  { table: 'brands', constraint: 'UQ_brands_slug', composite: 'UQ_brands_vendor_slug', columns: '"vendorId", "slug"' },
+  { table: 'attributes', constraint: 'UQ_attributes_slug', composite: 'UQ_attributes_vendor_slug', columns: '"vendorId", "slug"' },
+  { table: 'taxes', constraint: 'UQ_taxes_slug', composite: 'UQ_taxes_vendor_slug', columns: '"vendorId", "slug"' },
+  { table: 'collections', constraint: 'UQ_collections_slug', composite: 'UQ_collections_vendor_slug', columns: '"vendorId", "slug"' },
+  { table: 'products', constraint: 'UQ_products_slug', composite: 'UQ_products_vendor_slug', columns: '"vendorId", "slug"' },
+];
+
+export class StoreVendorIdColumns1775900000000 implements MigrationInterface {
+  name = 'StoreVendorIdColumns1775900000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      INSERT INTO "vendors" ("name", "slug", "active")
+      VALUES ('Default Store', 'default', true)
+      ON CONFLICT ("slug") DO NOTHING
+    `);
+
+    for (const table of STORE_TABLES) {
+      await queryRunner.query(`ALTER TABLE "${table}" ADD COLUMN IF NOT EXISTS "vendorId" integer`);
+    }
+
+    await queryRunner.query(`
+      UPDATE "product_categories" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "brands" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "attributes" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "taxes" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "collections" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "products" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "orders" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "payments" p SET "vendorId" = o."vendorId"
+      FROM "orders" o
+      WHERE p."orderId" = o.id AND p."vendorId" IS NULL
+    `);
+    await queryRunner.query(`
+      UPDATE "payments" SET "vendorId" = (SELECT id FROM "vendors" WHERE "slug" = 'default' LIMIT 1)
+      WHERE "vendorId" IS NULL
+    `);
+
+    for (const table of STORE_TABLES) {
+      await queryRunner.query(`ALTER TABLE "${table}" ALTER COLUMN "vendorId" SET NOT NULL`);
+    }
+
+    for (const table of STORE_TABLES) {
+      await queryRunner.query(`
+        DO $$ BEGIN
+          ALTER TABLE "${table}" ADD CONSTRAINT "FK_${table}_vendorId"
+          FOREIGN KEY ("vendorId") REFERENCES "vendors"("id") ON DELETE RESTRICT ON UPDATE NO ACTION;
+        EXCEPTION WHEN duplicate_object THEN NULL;
+        END $$
+      `);
+      await queryRunner.query(`CREATE INDEX IF NOT EXISTS "IDX_${table}_vendorId" ON "${table}" ("vendorId")`);
+    }
+
+    for (const { table, constraint, composite, columns } of SLUG_UNIQUE_DROPS) {
+      await queryRunner.query(`ALTER TABLE "${table}" DROP CONSTRAINT IF EXISTS "${constraint}"`);
+      await queryRunner.query(`
+        CREATE UNIQUE INDEX IF NOT EXISTS "${composite}" ON "${table}" (${columns})
+      `);
+    }
+
+    await queryRunner.query(`ALTER TABLE "orders" DROP CONSTRAINT IF EXISTS "UQ_orders_orderNumber"`);
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS "UQ_orders_vendor_orderNumber"
+      ON "orders" ("vendorId", "orderNumber")
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP INDEX IF EXISTS "UQ_orders_vendor_orderNumber"`);
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS "UQ_orders_orderNumber" ON "orders" ("orderNumber")
+    `);
+
+    for (const { table, constraint, composite } of [...SLUG_UNIQUE_DROPS].reverse()) {
+      await queryRunner.query(`DROP INDEX IF EXISTS "${composite}"`);
+      await queryRunner.query(`
+        CREATE UNIQUE INDEX IF NOT EXISTS "${constraint}" ON "${table}" ("slug")
+      `);
+    }
+
+    for (const table of [...STORE_TABLES].reverse()) {
+      await queryRunner.query(`ALTER TABLE "${table}" DROP CONSTRAINT IF EXISTS "FK_${table}_vendorId"`);
+      await queryRunner.query(`DROP INDEX IF EXISTS "IDX_${table}_vendorId"`);
+      await queryRunner.query(`ALTER TABLE "${table}" DROP COLUMN IF EXISTS "vendorId"`);
+    }
+  }
+}

package/dist/migrations/1775910000000-VendorOwnerRbacSeed.ts

@@ -0,0 +1,54 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+const VENDOR_OWNER = 'Vendor Owner';
+const STORE_ENTITIES = [
+  'products',
+  'collections',
+  'brands',
+  'product_categories',
+  'orders',
+  'payments',
+  'taxes',
+  'attributes',
+];
+
+export class VendorOwnerRbacSeed1775910000000 implements MigrationInterface {
+  name = 'VendorOwnerRbacSeed1775910000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      INSERT INTO "user_groups" ("name") VALUES ('${VENDOR_OWNER}')
+      ON CONFLICT ("name") DO NOTHING
+    `);
+
+    const groupRows = (await queryRunner.query(
+      `SELECT id FROM "user_groups" WHERE "name" = '${VENDOR_OWNER}' AND "deleted" = false LIMIT 1`
+    )) as { id: number }[];
+    const groupId = groupRows[0]?.id;
+    if (!groupId) return;
+
+    for (const entity of STORE_ENTITIES) {
+      await queryRunner.query(`
+        INSERT INTO "permissions" ("groupId", "entity", "canCreate", "canRead", "canUpdate", "canDelete")
+        VALUES (${groupId}, '${entity}', true, true, true, true)
+        ON CONFLICT ("groupId", "entity") DO UPDATE SET
+          "canCreate" = true, "canRead" = true, "canUpdate" = true, "canDelete" = true
+      `);
+    }
+
+    await queryRunner.query(`
+      INSERT INTO "permissions" ("groupId", "entity", "canCreate", "canRead", "canUpdate", "canDelete")
+      VALUES (${groupId}, 'dashboard', false, true, false, false)
+      ON CONFLICT ("groupId", "entity") DO UPDATE SET "canRead" = true
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      DELETE FROM "permissions" p
+      USING "user_groups" g
+      WHERE p."groupId" = g.id AND g.name = '${VENDOR_OWNER}'
+    `);
+    await queryRunner.query(`DELETE FROM "user_groups" WHERE "name" = '${VENDOR_OWNER}'`);
+  }
+}

package/dist/migrations/1775920000000-VendorOwnerSettingsPermission.ts

@@ -0,0 +1,25 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+/** Vendor Owner group: read/update store settings in admin. */
+export class VendorOwnerSettingsPermission1775920000000 implements MigrationInterface {
+  name = 'VendorOwnerSettingsPermission1775920000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      INSERT INTO "permissions" ("groupId", "entity", "canCreate", "canRead", "canUpdate", "canDelete")
+      SELECT g.id, 'settings', false, true, true, false
+      FROM "user_groups" g
+      WHERE g.name = 'Vendor Owner' AND g.deleted = false
+      ON CONFLICT ("groupId", "entity") DO UPDATE SET
+        "canRead" = true, "canUpdate" = true
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      DELETE FROM "permissions" p
+      USING "user_groups" g
+      WHERE p."groupId" = g.id AND g.name = 'Vendor Owner' AND p.entity = 'settings'
+    `);
+  }
+}

package/dist/migrations/1775930000000-VendorGroupStorePermissions.ts

@@ -0,0 +1,54 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+const STORE_ENTITIES = [
+  'products',
+  'collections',
+  'brands',
+  'product_categories',
+  'orders',
+  'payments',
+  'taxes',
+  'attributes',
+];
+
+/** Ensure vendor-named groups (e.g. vendor-admin) have store CRUD like Vendor Owner. */
+export class VendorGroupStorePermissions1775930000000 implements MigrationInterface {
+  name = 'VendorGroupStorePermissions1775930000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    for (const entity of STORE_ENTITIES) {
+      await queryRunner.query(`
+        INSERT INTO "permissions" ("groupId", "entity", "canCreate", "canRead", "canUpdate", "canDelete")
+        SELECT g.id, '${entity}', true, true, true, true
+        FROM "user_groups" g
+        WHERE g.deleted = false
+          AND lower(g.name) LIKE '%vendor%'
+          AND g.name <> 'Administrator'
+        ON CONFLICT ("groupId", "entity") DO NOTHING
+      `);
+    }
+
+    await queryRunner.query(`
+      INSERT INTO "permissions" ("groupId", "entity", "canCreate", "canRead", "canUpdate", "canDelete")
+      SELECT g.id, 'dashboard', false, true, false, false
+      FROM "user_groups" g
+      WHERE g.deleted = false
+        AND lower(g.name) LIKE '%vendor%'
+        AND g.name <> 'Administrator'
+      ON CONFLICT ("groupId", "entity") DO NOTHING
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    const entities = [...STORE_ENTITIES, 'dashboard'].map((e) => `'${e}'`).join(', ');
+    await queryRunner.query(`
+      DELETE FROM "permissions" p
+      USING "user_groups" g
+      WHERE p."groupId" = g.id
+        AND g.deleted = false
+        AND lower(g.name) LIKE '%vendor%'
+        AND g.name <> 'Administrator'
+        AND p.entity IN (${entities})
+    `);
+  }
+}

package/dist/migrations/1775940000000-VendorRls.ts

@@ -0,0 +1,71 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Enables PostgreSQL Row Level Security on all vendor-scoped store tables.
+ *
+ * Policy design
+ * ─────────────
+ * Before every vendor-scoped query the application sets a session-local GUC:
+ *
+ *   SET LOCAL app.vendor_id = '4';   -- restrict to vendor 4
+ *   SET LOCAL app.vendor_id = '0';   -- admin / all-access mode
+ *
+ * The policy allows a row when either:
+ *   a) the GUC is absent / empty / '0'  → admin / no restriction
+ *   b) the row's vendorId matches the GUC value
+ *
+ * FORCE ROW LEVEL SECURITY makes the policy apply even to the table owner
+ * (it does NOT apply to PostgreSQL superusers; production should use a
+ * non-superuser app role so RLS is fully enforced).
+ *
+ * Use `withVendorRlsContext(dataSource, vendorId, fn)` from
+ * `@infuro/cms-core/lib` to set the GUC inside a transaction.
+ */
+
+const VENDOR_TABLES = [
+  'products',
+  'collections',
+  'brands',
+  'product_categories',
+  'orders',
+  'payments',
+  'taxes',
+  'attributes',
+] as const;
+
+export class VendorRls1775940000000 implements MigrationInterface {
+  name = 'VendorRls1775940000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    for (const table of VENDOR_TABLES) {
+      // Enable RLS — FORCE applies even to the table owner role.
+      await queryRunner.query(`ALTER TABLE "${table}" ENABLE ROW LEVEL SECURITY`);
+      await queryRunner.query(`ALTER TABLE "${table}" FORCE ROW LEVEL SECURITY`);
+
+      // Drop previous policy if migration is re-run.
+      await queryRunner.query(`DROP POLICY IF EXISTS "vendor_isolation" ON "${table}"`);
+
+      // Permissive SELECT/INSERT/UPDATE/DELETE policy.
+      // Allow when: no vendor context set (admin mode) OR row belongs to the current vendor.
+      await queryRunner.query(`
+        CREATE POLICY "vendor_isolation" ON "${table}"
+        USING (
+          COALESCE(NULLIF(current_setting('app.vendor_id', true), ''), '0') = '0'
+          OR "vendorId" = NULLIF(current_setting('app.vendor_id', true), '')::integer
+        )
+        WITH CHECK (
+          COALESCE(NULLIF(current_setting('app.vendor_id', true), ''), '0') = '0'
+          OR "vendorId" = NULLIF(current_setting('app.vendor_id', true), '')::integer
+        )
+      `);
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    for (const table of [...VENDOR_TABLES].reverse()) {
+      await queryRunner.query(`DROP POLICY IF EXISTS "vendor_isolation" ON "${table}"`);
+      await queryRunner.query(`ALTER TABLE "${table}" NO FORCE ROW LEVEL SECURITY`);
+      await queryRunner.query(`ALTER TABLE "${table}" DISABLE ROW LEVEL SECURITY`);
+    }
+  }
+}