@infuro/cms-core 1.0.30 → 1.0.33

package/dist/auth.js

@@ -1,30 +1,14 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
 // src/auth/permission-entities.ts
-var PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
-  "users",
-  "password_reset_tokens",
-  "user_groups",
-  "permissions",
-  "comments",
-  "form_fields",
-  "configs",
-  "knowledge_base_chunks",
-  "carts",
-  "cart_items",
-  "wishlists",
-  "wishlist_items",
-  "message_templates"
-]);
-var PERMISSION_LOGICAL_ENTITIES = [
-  "users",
-  "forms",
-  "form_submissions",
-  "dashboard",
-  "upload",
-  "settings",
-  "analytics",
-  "chat"
-];
-var ADMIN_GROUP_NAME = "Administrator";
 function isSuperAdminGroupName(name) {
   return name === ADMIN_GROUP_NAME;
 }
@@ -54,13 +38,315 @@ function hasEntityPermission(record, entity, action) {
   if (action === "update") return p.u;
   return p.d;
 }
+var PERMISSION_ENTITY_INTERNAL_EXCLUDE, PERMISSION_LOGICAL_ENTITIES, ADMIN_GROUP_NAME;
+var init_permission_entities = __esm({
+  "src/auth/permission-entities.ts"() {
+    "use strict";
+    PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
+      "users",
+      "password_reset_tokens",
+      "user_groups",
+      "permissions",
+      "comments",
+      "form_fields",
+      "configs",
+      "knowledge_base_chunks",
+      "carts",
+      "cart_items",
+      "wishlists",
+      "wishlist_items",
+      "message_templates",
+      "vendor_users"
+    ]);
+    PERMISSION_LOGICAL_ENTITIES = [
+      "users",
+      "forms",
+      "form_submissions",
+      "dashboard",
+      "upload",
+      "settings",
+      "analytics",
+      "chat"
+    ];
+    ADMIN_GROUP_NAME = "Administrator";
+  }
+});
+
+// src/auth/vendor-scope.ts
+function isVendorGroupName(name) {
+  if (!name?.trim()) return false;
+  const n = name.trim().toLowerCase();
+  return n === VENDOR_OWNER_GROUP_NAME.toLowerCase() || n.includes("vendor");
+}
+function isPlatformAdministrator(user) {
+  if (!user?.email) return false;
+  return !!(user.isRBACAdmin || isSuperAdminGroupName(user.groupName));
+}
+function isVendorPortalUser(user) {
+  if (user?.isVendorPortal === true) return true;
+  if (!user?.email || isPlatformAdministrator(user)) return false;
+  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  return isVendorGroupName(user.groupName);
+}
+function isVendorStaff(user) {
+  return isVendorPortalUser(user);
+}
+function isVendorOwner(user) {
+  if (user?.isVendorOwner === true) return true;
+  if (!user?.email || isPlatformAdministrator(user)) return false;
+  if (user.vendorRole === "staff") return false;
+  if (user.vendorRole === "owner") return true;
+  if (!isVendorPortalUser(user)) return false;
+  return user.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase();
+}
+function canManageVendorTeam(user) {
+  return isPlatformAdministrator(user) || isVendorOwner(user);
+}
+function canManageVendorRoles(user) {
+  return isPlatformAdministrator(user) || isVendorOwner(user);
+}
+function canOnboardVendors(user) {
+  return isPlatformAdministrator(user);
+}
+function resolveVendorScopeFromSessionUser(user) {
+  if (!user?.email) return { type: "deny" };
+  if (isPlatformAdministrator(user)) return { type: "all" };
+  const vendorIds = user.vendorIds ?? [];
+  if (vendorIds.length === 0) return { type: "deny" };
+  const preferred = user.activeVendorId ?? vendorIds[0];
+  const vendorId = vendorIds.includes(preferred) ? preferred : vendorIds[0];
+  return { type: "vendor", vendorId, vendorIds };
+}
+function vendorPortalFlagsFromUser(input) {
+  const vendorIds = input.vendorIds ?? [];
+  const isVendorPortal = !input.isRBACAdmin && (vendorIds.length > 0 || isVendorGroupName(input.groupName));
+  const isVendorOwner2 = isVendorPortal && input.vendorRole !== "staff" && (input.vendorRole === "owner" || input.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase());
+  return { isVendorPortal, isVendorOwner: isVendorOwner2 };
+}
+var VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_OWNER_GROUP_NAME;
+var init_vendor_scope = __esm({
+  "src/auth/vendor-scope.ts"() {
+    "use strict";
+    init_permission_entities();
+    VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
+      "products",
+      "collections",
+      "brands",
+      "product_categories",
+      "orders",
+      "payments",
+      "taxes",
+      "attributes",
+      "vendor_customers",
+      "discounts"
+    ]);
+    VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
+      ...VENDOR_SCOPED_STORE_ENTITIES,
+      "order_discounts",
+      "order_addresses"
+    ]);
+    VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+  }
+});
+
+// src/auth/rbac-debug-db.ts
+var rbac_debug_db_exports = {};
+__export(rbac_debug_db_exports, {
+  loadDbPermissionsForUser: () => loadDbPermissionsForUser
+});
+async function loadDbPermissionsForUser(dataSource, userId) {
+  const rows = await dataSource.query(
+    `
+    SELECT u."groupId" AS "groupId", g.name AS "groupName",
+           p.entity, p."canCreate", p."canRead", p."canUpdate", p."canDelete"
+    FROM users u
+    LEFT JOIN user_groups g ON g.id = u."groupId" AND g.deleted = false
+    LEFT JOIN permissions p ON p."groupId" = g.id
+    WHERE u.id = $1
+    `,
+    [userId]
+  );
+  const groupId = rows[0]?.groupId ?? null;
+  const groupName = rows[0]?.groupName ?? null;
+  const permRows = rows.filter((r) => r.entity).map((r) => ({
+    entity: r.entity,
+    canCreate: !!r.canCreate,
+    canRead: !!r.canRead,
+    canUpdate: !!r.canUpdate,
+    canDelete: !!r.canDelete
+  }));
+  return {
+    groupId,
+    groupName,
+    dbEntityPerms: summarizeEntityPerms(permissionRowsToRecord(permRows))
+  };
+}
+var init_rbac_debug_db = __esm({
+  "src/auth/rbac-debug-db.ts"() {
+    "use strict";
+    init_permission_entities();
+    init_rbac_debug();
+  }
+});
+
+// src/auth/rbac-debug.ts
+function isRbacDebugEnabled() {
+  const v = process.env.CMS_RBAC_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function logRbac(message, data) {
+  if (!isRbacDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX, message, data);
+  else console.info(LOG_PREFIX, message);
+}
+function summarizeEntityPerms(entityPerms) {
+  const out = {};
+  if (!entityPerms) return out;
+  for (const [entity, p] of Object.entries(entityPerms)) {
+    out[entity] = { c: p.c, r: p.r, u: p.u, d: p.d };
+  }
+  return out;
+}
+function vendorPortalFallbackReason(user, entity, action) {
+  if (!isVendorPortalUser(user)) return null;
+  if (entity === "dashboard" && action === "read") return "vendor_portal_dashboard_fallback";
+  if (entity === "analytics" && action === "read") return "vendor_portal_analytics_fallback";
+  if (entity === "settings" && action === "read") return "vendor_portal_settings_read_fallback";
+  if (VENDOR_STORE_RBAC_ENTITIES.has(entity) && action === "read") return "vendor_portal_store_read_fallback";
+  return null;
+}
+function explainSessionEntityAccess(user, entity, action) {
+  const userSnapshot = {
+    email: user?.email ?? null,
+    id: user?.id ?? null,
+    groupId: user?.groupId ?? null,
+    groupName: user?.groupName ?? null,
+    isRBACAdmin: user?.isRBACAdmin ?? false,
+    adminAccess: user?.adminAccess ?? null,
+    vendorIds: user?.vendorIds ?? [],
+    activeVendorId: user?.activeVendorId ?? null,
+    vendorRole: user?.vendorRole ?? null,
+    isVendorPortal: user?.isVendorPortal ?? false,
+    isVendorOwner: user?.isVendorOwner ?? false,
+    isVendorPortalComputed: isVendorPortalUser(user),
+    isVendorOwnerComputed: isVendorOwner(user),
+    jwtEntityPerms: summarizeEntityPerms(user?.entityPerms),
+    jwtEntityPermForTarget: user?.entityPerms?.[entity] ?? null
+  };
+  if (!user?.email) {
+    return { allowed: false, reason: "no_session_email", userSnapshot };
+  }
+  if (user.isRBACAdmin) {
+    return { allowed: true, reason: "platform_administrator", userSnapshot };
+  }
+  const vendorIds = user.vendorIds ?? [];
+  const isStaff = user.vendorRole === "staff";
+  if (vendorIds.length > 0) {
+    if (entity === "dashboard" && action === "read") {
+      return { allowed: true, reason: "vendor_link_dashboard_read", userSnapshot };
+    }
+    if (entity === "analytics" && action === "read") {
+      return { allowed: true, reason: "vendor_link_analytics_read", userSnapshot };
+    }
+    if (entity === "settings") {
+      if (action === "read") {
+        return { allowed: true, reason: "vendor_link_settings_read", userSnapshot };
+      }
+      if (action === "update" && !isStaff) {
+        return { allowed: true, reason: "vendor_link_settings_update", userSnapshot };
+      }
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      if (isStaff && action === "read") {
+        return { allowed: true, reason: "vendor_staff_store_read", userSnapshot };
+      }
+      if (!isStaff) {
+        return { allowed: true, reason: "vendor_link_store_full", userSnapshot };
+      }
+      return {
+        allowed: false,
+        reason: "vendor_staff_store_write_denied",
+        userSnapshot
+      };
+    }
+  }
+  if (isVendorPortalUser(user) && isVendorOwner(user)) {
+    if (entity === "dashboard" && action === "read") {
+      return { allowed: true, reason: "vendor_owner_group_dashboard", userSnapshot };
+    }
+    if (entity === "analytics" && action === "read") {
+      return { allowed: true, reason: "vendor_owner_group_analytics", userSnapshot };
+    }
+    if (entity === "settings" && (action === "read" || action === "update")) {
+      return { allowed: true, reason: "vendor_owner_group_settings", userSnapshot };
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      return { allowed: true, reason: "vendor_owner_group_store", userSnapshot };
+    }
+  }
+  const vendorPortalReason = vendorPortalFallbackReason(user, entity, action);
+  if (vendorPortalReason) {
+    return { allowed: true, reason: vendorPortalReason, userSnapshot };
+  }
+  const explicit = user.entityPerms?.[entity];
+  if (explicit !== void 0) {
+    const allowed2 = hasEntityPermission(user.entityPerms, entity, action);
+    return {
+      allowed: allowed2,
+      reason: allowed2 ? "jwt_entity_perms_allow" : "jwt_entity_perms_deny",
+      userSnapshot
+    };
+  }
+  const allowed = hasEntityPermission(user.entityPerms, entity, action);
+  return {
+    allowed,
+    reason: allowed ? "entity_perms_fallback_allow" : "no_matching_rule",
+    userSnapshot
+  };
+}
+async function logEntityAccessDecision(dataSource, context, user, entity, action, extra) {
+  if (!isRbacDebugEnabled()) return;
+  const explanation = explainSessionEntityAccess(user, entity, action);
+  let dbPermissions;
+  if (dataSource && user?.id) {
+    const id = Number(user.id);
+    if (Number.isFinite(id)) {
+      try {
+        const { loadDbPermissionsForUser: loadDbPermissionsForUser2 } = await Promise.resolve().then(() => (init_rbac_debug_db(), rbac_debug_db_exports));
+        dbPermissions = await loadDbPermissionsForUser2(dataSource, id);
+      } catch (e) {
+        dbPermissions = { error: e instanceof Error ? e.message : String(e) };
+      }
+    }
+  }
+  logRbac(context, {
+    entity,
+    action,
+    allowed: explanation.allowed,
+    reason: explanation.reason,
+    ...explanation.userSnapshot,
+    dbPermissions,
+    ...extra
+  });
+}
+var LOG_PREFIX;
+var init_rbac_debug = __esm({
+  "src/auth/rbac-debug.ts"() {
+    "use strict";
+    init_permission_entities();
+    init_vendor_scope();
+    LOG_PREFIX = "[cms-rbac]";
+  }
+});
 
 // src/auth/helpers.ts
+init_rbac_debug();
+init_vendor_scope();
 var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set(["users", "user_groups", "permissions"]);
 function sessionHasEntityAccess(user, entity, action) {
-  if (!user?.email) return false;
-  if (user.isRBACAdmin && RBAC_ADMIN_ONLY_ENTITIES.has(entity)) return true;
-  return hasEntityPermission(user.entityPerms, entity, action);
+  return explainSessionEntityAccess(user, entity, action).allowed;
 }
 function canManageRoles(user) {
   return !!(user?.email && user.isRBACAdmin);
@@ -85,6 +371,19 @@ function isPublicMethod(pathname, method) {
   return false;
 }
 function createAuthHelpers(getSession, NextResponse) {
+  return createAuthHelpersFromGetSession(getSession, NextResponse);
+}
+function createCmsAuthBundle(getSession, NextResponse) {
+  const auth = createAuthHelpers(getSession, NextResponse);
+  return {
+    requireAuth: auth.requireAuth,
+    requireAdminAccess: auth.requireAdminAccess,
+    requireEntityPermission: auth.requireEntityPermission,
+    getSessionUser: auth.getAuthenticatedUser,
+    getAuthenticatedUser: auth.getAuthenticatedUser
+  };
+}
+function createAuthHelpersFromGetSession(getSession, NextResponse) {
   return {
     async requireAuth() {
       const session = await getSession();
@@ -106,8 +405,21 @@ function createAuthHelpers(getSession, NextResponse) {
         return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
       }
       const u = session.user;
-      if (sessionHasEntityAccess(u, entity, action)) return null;
-      return NextResponse.json({ error: "Forbidden", entity, action }, { status: 403 });
+      const allowed = sessionHasEntityAccess(u, entity, action);
+      const { reason } = explainSessionEntityAccess(u, entity, action);
+      logRbac("authHelpers.requireEntityPermission", {
+        entity,
+        action,
+        allowed,
+        reason,
+        email: u.email,
+        groupName: u.groupName,
+        vendorIds: u.vendorIds,
+        isVendorPortal: u.isVendorPortal,
+        isVendorOwner: u.isVendorOwner
+      });
+      if (allowed) return null;
+      return NextResponse.json({ error: "Forbidden", entity, action, reason }, { status: 403 });
     },
     async requireAdminAccess() {
       const session = await getSession();
@@ -116,8 +428,23 @@ function createAuthHelpers(getSession, NextResponse) {
       }
       const u = session.user;
       if (u.isRBACAdmin) return null;
-      if (u.adminAccess === false) return NextResponse.json({ error: "Forbidden", reason: "admin_access" }, { status: 403 });
-      return null;
+      if (isVendorPortalUser(u)) return null;
+      if (u.adminAccess === true) return null;
+      if (u.adminAccess === false) {
+        logRbac("requireAdminAccess denied (adminAccess:false)", {
+          email: u.email,
+          groupName: u.groupName,
+          isVendorPortal: u.isVendorPortal
+        });
+        return NextResponse.json({ error: "Forbidden", reason: "admin_access" }, { status: 403 });
+      }
+      logRbac("requireAdminAccess denied (no matching rule)", {
+        email: u.email,
+        adminAccess: u.adminAccess,
+        groupName: u.groupName,
+        isVendorPortal: u.isVendorPortal
+      });
+      return NextResponse.json({ error: "Forbidden", reason: "admin_access" }, { status: 403 });
     },
     async getAuthenticatedUser() {
       const session = await getSession();
@@ -126,18 +453,26 @@ function createAuthHelpers(getSession, NextResponse) {
   };
 }
 
+// src/auth/index.ts
+init_rbac_debug();
+init_vendor_scope();
+init_permission_entities();
+
 // src/auth/seed-permissions.ts
+init_permission_entities();
 async function seedAdministratorPermissions(dataSource, entityMap) {
   const entities = getPermissionableEntityKeys(entityMap);
   const groupRepo = dataSource.getRepository(entityMap.user_groups);
   const permRepo = dataSource.getRepository(entityMap.permissions);
   const adminGroup = await groupRepo.findOne({ where: { name: ADMIN_GROUP_NAME, deleted: false } });
+  console.log("ADMIN GROUP", adminGroup);
   if (!adminGroup) return;
   const fullCrud = { canCreate: true, canRead: true, canUpdate: true, canDelete: true };
   for (const entity of entities) {
     const existing = await permRepo.findOne({
       where: { groupId: adminGroup.id, entity }
     });
+    console.log("EXISTING", existing);
     if (existing) {
       existing.canCreate = true;
       existing.canRead = true;
@@ -156,6 +491,59 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
   }
 }
 
+// src/auth/middleware.ts
+import { getToken } from "next-auth/jwt";
+
+// src/auth/auth-debug.ts
+var LOG_PREFIX2 = "[cms-auth]";
+function isAuthDebugEnabled() {
+  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function isAuthDebugClientEnabled() {
+  if (typeof window === "undefined") return false;
+  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function logAuth(message, data) {
+  if (!isAuthDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function logAuthClient(message, data) {
+  if (!isAuthDebugClientEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function summarizeSessionUserForLog(user) {
+  if (!user || typeof user !== "object") return { present: false };
+  const u = user;
+  return {
+    present: true,
+    email: u.email ?? null,
+    id: u.id ?? null,
+    adminAccess: u.adminAccess ?? null,
+    isRBACAdmin: u.isRBACAdmin ?? null,
+    isVendorPortal: u.isVendorPortal ?? null,
+    groupName: u.groupName ?? null
+  };
+}
+function nextAuthCookieDebugInfo() {
+  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
+  const isHttps = nextAuthUrl.startsWith("https");
+  return {
+    nextAuthUrl,
+    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
+    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
+    cookieSecure: isHttps,
+    nodeEnv: process.env.NODE_ENV ?? "(unset)"
+  };
+}
+
 // src/auth/middleware.ts
 var defaultPublicApiMethods = {
   "/api/contacts": ["POST"],
@@ -168,8 +556,21 @@ var defaultPublicApiMethods = {
   "/api/users/set-password": ["POST"],
   "/api/users/invite": ["POST"]
 };
-function defaultGetSessionToken(request) {
-  return request.cookies.get("__Secure-next-auth.session-token")?.value ?? request.cookies.get("next-auth.session-token")?.value;
+function legacyGetSessionToken(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  return secure ?? regular;
+}
+function sessionCookiePresence(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
+  return {
+    hasSecureToken: Boolean(secure),
+    hasRegularToken: Boolean(regular),
+    hasChunkedToken: hasChunked,
+    resolved: Boolean(secure ?? regular)
+  };
 }
 function isPublicMethod2(pathname, method, publicApiMethods) {
   for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
@@ -177,31 +578,59 @@ function isPublicMethod2(pathname, method, publicApiMethods) {
   }
   return false;
 }
+async function hasValidSession(request, secret, legacyGetToken) {
+  if (request.req) {
+    const token = await getToken({ req: request.req, secret });
+    return token != null;
+  }
+  return Boolean(legacyGetToken(request));
+}
 function createCmsMiddleware(config = {}) {
   const {
     publicAdminPaths = ["/admin/signin", "/admin/forgot-password", "/admin/reset-password", "/admin/invite"],
     publicApiMethods = defaultPublicApiMethods,
     signInPath = "/admin/signin",
-    getSessionToken = defaultGetSessionToken
+    getSessionToken = legacyGetSessionToken,
+    secret = process.env.NEXTAUTH_SECRET
   } = config;
-  return function cmsMiddleware(request) {
+  return async function cmsMiddleware(request) {
     const pathname = request.nextUrl.pathname;
     const method = request.method;
     if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
       return { type: "next" };
     }
     if (pathname.startsWith("/admin")) {
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      const cookies = sessionCookiePresence(request);
+      if (!authenticated) {
+        logAuth("middleware: admin redirect to signin (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...cookies,
+          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
+        });
         return { type: "redirect", url: new URL(signInPath, request.url).toString() };
       }
+      logAuth("middleware: admin allowed", {
+        pathname,
+        method,
+        usesGetToken: Boolean(request.req),
+        ...cookies
+      });
     }
     if (pathname.startsWith("/api")) {
       if (isPublicMethod2(pathname, method, publicApiMethods)) {
         return { type: "next" };
       }
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      if (!authenticated) {
+        logAuth("middleware: api 401 (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...sessionCookiePresence(request)
+        });
         return { type: "json", status: 401, body: { error: "Unauthorized" } };
       }
     }
@@ -210,21 +639,39 @@ function createCmsMiddleware(config = {}) {
 }
 
 // src/auth/nextauth-options.ts
+init_permission_entities();
+init_vendor_scope();
 import _CredentialsProvider from "next-auth/providers/credentials";
 var CredentialsProvider = _CredentialsProvider.default ?? _CredentialsProvider;
 function sessionUserFromNextAuthUser(user) {
   const g = user.group;
   const isRBACAdmin = isSuperAdminGroupName(g?.name);
   const entityPerms = permissionRowsToRecord(g?.permissions);
-  const adminAccess = user.adminAccess === true;
+  const rawAdminAccess = user.adminAccess;
+  const adminAccess = rawAdminAccess === true ? true : rawAdminAccess === false ? false : void 0;
+  const vendorIds = user.vendorIds ?? [];
+  const vendorRole = user.vendorRole ?? null;
+  const { isVendorPortal, isVendorOwner: isVendorOwner2 } = vendorPortalFlagsFromUser({
+    email: user.email,
+    isRBACAdmin,
+    groupName: g?.name,
+    vendorIds,
+    vendorRole
+  });
   return {
     id: user.id.toString(),
     email: user.email,
     name: user.name,
     groupId: user.groupId ?? void 0,
+    groupName: g?.name ?? void 0,
     isRBACAdmin,
     entityPerms,
-    adminAccess
+    adminAccess,
+    vendorIds,
+    activeVendorId: user.activeVendorId ?? vendorIds[0] ?? null,
+    vendorRole,
+    isVendorPortal,
+    isVendorOwner: isVendorOwner2
   };
 }
 function getNextAuthOptions(config) {
@@ -238,6 +685,7 @@ function getNextAuthOptions(config) {
     enableOtpLogin = false,
     authorizeOtp
   } = config;
+  logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
     providers.push(
@@ -248,14 +696,43 @@ function getNextAuthOptions(config) {
           password: { label: "Password", type: "password" }
         },
         async authorize(credentials) {
-          if (!credentials?.email || !credentials?.password) return null;
+          const email = credentials?.email?.trim() ?? "";
+          if (!email || !credentials?.password) {
+            logAuth("authorize(credentials) rejected", { reason: "missing_email_or_password" });
+            return null;
+          }
           try {
-            const user = await getUserByEmail(credentials.email);
-            if (!user || user.blocked || user.deleted || !user.password) return null;
+            const user = await getUserByEmail(email);
+            if (!user) {
+              logAuth("authorize(credentials) rejected", { reason: "user_not_found", email });
+              return null;
+            }
+            if (user.blocked) {
+              logAuth("authorize(credentials) rejected", { reason: "blocked", email, userId: user.id });
+              return null;
+            }
+            if (user.deleted) {
+              logAuth("authorize(credentials) rejected", { reason: "deleted", email, userId: user.id });
+              return null;
+            }
+            if (!user.password) {
+              logAuth("authorize(credentials) rejected", { reason: "no_password", email, userId: user.id });
+              return null;
+            }
             const valid = await comparePassword(credentials.password, user.password);
-            if (!valid) return null;
-            return sessionUserFromNextAuthUser(user);
-          } catch {
+            if (!valid) {
+              logAuth("authorize(credentials) rejected", { reason: "invalid_password", email, userId: user.id });
+              return null;
+            }
+            const sessionUser = sessionUserFromNextAuthUser(user);
+            logAuth("authorize(credentials) ok", summarizeSessionUserForLog(sessionUser));
+            return sessionUser;
+          } catch (err) {
+            console.error("[cms-auth] authorize error (credentials):", err instanceof Error ? err.message : err);
+            logAuth("authorize(credentials) error", {
+              email,
+              message: err instanceof Error ? err.message : String(err)
+            });
             return null;
           }
         }
@@ -281,7 +758,8 @@ function getNextAuthOptions(config) {
             const user = await authorizeOtp({ identifier, channel: ch, code });
             if (!user || user.blocked || user.deleted) return null;
             return sessionUserFromNextAuthUser(user);
-          } catch {
+          } catch (err) {
+            console.error("[cms-auth] authorize error (otp):", err instanceof Error ? err.message : err);
             return null;
           }
         }
@@ -307,31 +785,54 @@ function getNextAuthOptions(config) {
     callbacks: {
       async jwt({ token, user, trigger, session }) {
         if (user) {
+          logAuth("jwt callback: new sign-in", {
+            trigger,
+            user: summarizeSessionUserForLog(user)
+          });
           const u = user;
           token.id = u.id;
           token.groupId = u.groupId;
+          token.groupName = u.groupName;
           token.isRBACAdmin = u.isRBACAdmin;
           token.entityPerms = u.entityPerms;
           token.adminAccess = u.adminAccess;
+          token.vendorIds = u.vendorIds;
+          token.activeVendorId = u.activeVendorId;
+          token.vendorRole = u.vendorRole;
+          token.isVendorPortal = u.isVendorPortal;
+          token.isVendorOwner = u.isVendorOwner;
         }
         if (trigger === "update" && session && typeof session === "object") {
+          logAuth("jwt callback: session update", { trigger });
           const s = session;
           const t = token;
           if (typeof s.name === "string") t.name = s.name;
           if (typeof s.email === "string") t.email = s.email;
+          if (typeof s.activeVendorId === "number") t.activeVendorId = s.activeVendorId;
         }
         return token;
       },
       async session({ session, token }) {
+        const t = token;
+        logAuth("session callback", {
+          tokenHasId: t.id != null,
+          tokenEmail: typeof t.email === "string" ? t.email : null,
+          sessionUser: summarizeSessionUserForLog(session.user)
+        });
         if (session.user) {
-          const t = token;
           if (typeof t.name === "string") session.user.name = t.name;
           if (typeof t.email === "string") session.user.email = t.email;
           session.user.id = t.id;
           session.user.groupId = t.groupId;
+          session.user.groupName = t.groupName;
           session.user.isRBACAdmin = t.isRBACAdmin;
           session.user.entityPerms = t.entityPerms;
           session.user.adminAccess = t.adminAccess;
+          session.user.vendorIds = t.vendorIds;
+          session.user.activeVendorId = t.activeVendorId;
+          session.user.vendorRole = t.vendorRole;
+          session.user.isVendorPortal = t.isVendorPortal;
+          session.user.isVendorOwner = t.isVendorOwner;
         }
         return session;
       }
@@ -344,19 +845,44 @@ export {
   OPEN_ENDPOINTS,
   PERMISSION_REQUIRED_ENDPOINTS,
   RBAC_ADMIN_ONLY_ENTITIES,
+  VENDOR_OWNER_GROUP_NAME,
+  VENDOR_SCOPED_STORE_ENTITIES,
+  VENDOR_STORE_RBAC_ENTITIES,
   canManageRoles,
+  canManageVendorRoles,
+  canManageVendorTeam,
+  canOnboardVendors,
   createAuthHelpers,
+  createCmsAuthBundle,
   createCmsMiddleware,
   defaultPublicApiMethods,
+  explainSessionEntityAccess,
   getNextAuthOptions,
   getPermissionableEntityKeys,
   getRequiredPermission,
   hasEntityPermission,
+  isAuthDebugClientEnabled,
+  isAuthDebugEnabled,
   isOpenEndpoint,
+  isPlatformAdministrator,
   isPublicMethod,
+  isRbacDebugEnabled,
   isSuperAdminGroupName,
+  isVendorGroupName,
+  isVendorOwner,
+  isVendorPortalUser,
+  isVendorStaff,
+  logAuth,
+  logAuthClient,
+  logEntityAccessDecision,
+  logRbac,
+  nextAuthCookieDebugInfo,
   permissionRowsToRecord,
+  resolveVendorScopeFromSessionUser,
   seedAdministratorPermissions,
-  sessionHasEntityAccess
+  sessionHasEntityAccess,
+  summarizeEntityPerms,
+  summarizeSessionUserForLog,
+  vendorPortalFlagsFromUser
 };
 //# sourceMappingURL=auth.js.map