@infuro/cms-core 1.0.31 → 1.0.34

package/dist/auth.cjs

@@ -94,6 +94,30 @@ var init_permission_entities = __esm({
   }
 });
 
+// src/auth/role-helpers.ts
+function isSuperAdmin(user) {
+  if (!user) return false;
+  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
+  if (user.isRBACAdmin === true) return true;
+  return isSuperAdminGroupName(user.groupName);
+}
+function isVendorAdmin(user) {
+  if (!user?.email || isSuperAdmin(user)) return false;
+  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
+  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  return isVendorGroupName(user.groupName);
+}
+var SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID;
+var init_role_helpers = __esm({
+  "src/auth/role-helpers.ts"() {
+    "use strict";
+    init_permission_entities();
+    init_vendor_scope();
+    SUPER_ADMIN_GROUP_ID = 1;
+    VENDOR_ADMIN_GROUP_ID = 5;
+  }
+});
+
 // src/auth/vendor-scope.ts
 function isVendorGroupName(name) {
   if (!name?.trim()) return false;
@@ -102,12 +126,12 @@ function isVendorGroupName(name) {
 }
 function isPlatformAdministrator(user) {
   if (!user?.email) return false;
-  return !!(user.isRBACAdmin || isSuperAdminGroupName(user.groupName));
+  return isSuperAdmin(user);
 }
 function isVendorPortalUser(user) {
   if (user?.isVendorPortal === true) return true;
   if (!user?.email || isPlatformAdministrator(user)) return false;
-  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  if (isVendorAdmin(user)) return true;
   return isVendorGroupName(user.groupName);
 }
 function isVendorStaff(user) {
@@ -149,7 +173,7 @@ var VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_OWNER_GROUP
 var init_vendor_scope = __esm({
   "src/auth/vendor-scope.ts"() {
     "use strict";
-    init_permission_entities();
+    init_role_helpers();
     VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
       "products",
       "collections",
@@ -370,6 +394,8 @@ __export(auth_exports, {
   OPEN_ENDPOINTS: () => OPEN_ENDPOINTS,
   PERMISSION_REQUIRED_ENDPOINTS: () => PERMISSION_REQUIRED_ENDPOINTS,
   RBAC_ADMIN_ONLY_ENTITIES: () => RBAC_ADMIN_ONLY_ENTITIES,
+  SUPER_ADMIN_GROUP_ID: () => SUPER_ADMIN_GROUP_ID,
+  VENDOR_ADMIN_GROUP_ID: () => VENDOR_ADMIN_GROUP_ID,
   VENDOR_OWNER_GROUP_NAME: () => VENDOR_OWNER_GROUP_NAME,
   VENDOR_SCOPED_STORE_ENTITIES: () => VENDOR_SCOPED_STORE_ENTITIES,
   VENDOR_STORE_RBAC_ENTITIES: () => VENDOR_STORE_RBAC_ENTITIES,
@@ -385,23 +411,32 @@ __export(auth_exports, {
   getNextAuthOptions: () => getNextAuthOptions,
   getPermissionableEntityKeys: () => getPermissionableEntityKeys,
   getRequiredPermission: () => getRequiredPermission,
+  getStorefrontNextAuthOptions: () => getStorefrontNextAuthOptions,
   hasEntityPermission: () => hasEntityPermission,
+  isAuthDebugClientEnabled: () => isAuthDebugClientEnabled,
+  isAuthDebugEnabled: () => isAuthDebugEnabled,
   isOpenEndpoint: () => isOpenEndpoint,
   isPlatformAdministrator: () => isPlatformAdministrator,
   isPublicMethod: () => isPublicMethod,
   isRbacDebugEnabled: () => isRbacDebugEnabled,
+  isSuperAdmin: () => isSuperAdmin,
   isSuperAdminGroupName: () => isSuperAdminGroupName,
+  isVendorAdmin: () => isVendorAdmin,
   isVendorGroupName: () => isVendorGroupName,
   isVendorOwner: () => isVendorOwner,
   isVendorPortalUser: () => isVendorPortalUser,
   isVendorStaff: () => isVendorStaff,
+  logAuth: () => logAuth,
+  logAuthClient: () => logAuthClient,
   logEntityAccessDecision: () => logEntityAccessDecision,
   logRbac: () => logRbac,
+  nextAuthCookieDebugInfo: () => nextAuthCookieDebugInfo,
   permissionRowsToRecord: () => permissionRowsToRecord,
   resolveVendorScopeFromSessionUser: () => resolveVendorScopeFromSessionUser,
   seedAdministratorPermissions: () => seedAdministratorPermissions,
   sessionHasEntityAccess: () => sessionHasEntityAccess,
   summarizeEntityPerms: () => summarizeEntityPerms,
+  summarizeSessionUserForLog: () => summarizeSessionUserForLog,
   vendorPortalFlagsFromUser: () => vendorPortalFlagsFromUser
 });
 module.exports = __toCommonJS(auth_exports);
@@ -520,6 +555,7 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
 
 // src/auth/index.ts
 init_rbac_debug();
+init_role_helpers();
 init_vendor_scope();
 init_permission_entities();
 
@@ -556,6 +592,59 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
   }
 }
 
+// src/auth/middleware.ts
+var import_jwt = require("next-auth/jwt");
+
+// src/auth/auth-debug.ts
+var LOG_PREFIX2 = "[cms-auth]";
+function isAuthDebugEnabled() {
+  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function isAuthDebugClientEnabled() {
+  if (typeof window === "undefined") return false;
+  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function logAuth(message, data) {
+  if (!isAuthDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function logAuthClient(message, data) {
+  if (!isAuthDebugClientEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function summarizeSessionUserForLog(user) {
+  if (!user || typeof user !== "object") return { present: false };
+  const u = user;
+  return {
+    present: true,
+    email: u.email ?? null,
+    id: u.id ?? null,
+    adminAccess: u.adminAccess ?? null,
+    isRBACAdmin: u.isRBACAdmin ?? null,
+    isVendorPortal: u.isVendorPortal ?? null,
+    groupName: u.groupName ?? null
+  };
+}
+function nextAuthCookieDebugInfo() {
+  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
+  const isHttps = nextAuthUrl.startsWith("https");
+  return {
+    nextAuthUrl,
+    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
+    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
+    cookieSecure: isHttps,
+    nodeEnv: process.env.NODE_ENV ?? "(unset)"
+  };
+}
+
 // src/auth/middleware.ts
 var defaultPublicApiMethods = {
   "/api/contacts": ["POST"],
@@ -568,8 +657,21 @@ var defaultPublicApiMethods = {
   "/api/users/set-password": ["POST"],
   "/api/users/invite": ["POST"]
 };
-function defaultGetSessionToken(request) {
-  return request.cookies.get("__Secure-next-auth.session-token")?.value ?? request.cookies.get("next-auth.session-token")?.value;
+function legacyGetSessionToken(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  return secure ?? regular;
+}
+function sessionCookiePresence(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
+  return {
+    hasSecureToken: Boolean(secure),
+    hasRegularToken: Boolean(regular),
+    hasChunkedToken: hasChunked,
+    resolved: Boolean(secure ?? regular)
+  };
 }
 function isPublicMethod2(pathname, method, publicApiMethods) {
   for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
@@ -577,31 +679,59 @@ function isPublicMethod2(pathname, method, publicApiMethods) {
   }
   return false;
 }
+async function hasValidSession(request, secret, legacyGetToken) {
+  if (request.req) {
+    const token = await (0, import_jwt.getToken)({ req: request.req, secret });
+    return token != null;
+  }
+  return Boolean(legacyGetToken(request));
+}
 function createCmsMiddleware(config = {}) {
   const {
     publicAdminPaths = ["/admin/signin", "/admin/forgot-password", "/admin/reset-password", "/admin/invite"],
     publicApiMethods = defaultPublicApiMethods,
     signInPath = "/admin/signin",
-    getSessionToken = defaultGetSessionToken
+    getSessionToken = legacyGetSessionToken,
+    secret = process.env.NEXTAUTH_SECRET
   } = config;
-  return function cmsMiddleware(request) {
+  return async function cmsMiddleware(request) {
     const pathname = request.nextUrl.pathname;
     const method = request.method;
     if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
       return { type: "next" };
     }
     if (pathname.startsWith("/admin")) {
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      const cookies = sessionCookiePresence(request);
+      if (!authenticated) {
+        logAuth("middleware: admin redirect to signin (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...cookies,
+          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
+        });
         return { type: "redirect", url: new URL(signInPath, request.url).toString() };
       }
+      logAuth("middleware: admin allowed", {
+        pathname,
+        method,
+        usesGetToken: Boolean(request.req),
+        ...cookies
+      });
     }
     if (pathname.startsWith("/api")) {
       if (isPublicMethod2(pathname, method, publicApiMethods)) {
         return { type: "next" };
       }
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      if (!authenticated) {
+        logAuth("middleware: api 401 (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...sessionCookiePresence(request)
+        });
         return { type: "json", status: 401, body: { error: "Unauthorized" } };
       }
     }
@@ -612,11 +742,16 @@ function createCmsMiddleware(config = {}) {
 // src/auth/nextauth-options.ts
 var import_credentials = __toESM(require("next-auth/providers/credentials"), 1);
 init_permission_entities();
+init_role_helpers();
 init_vendor_scope();
 var CredentialsProvider = import_credentials.default.default ?? import_credentials.default;
 function sessionUserFromNextAuthUser(user) {
   const g = user.group;
-  const isRBACAdmin = isSuperAdminGroupName(g?.name);
+  const isRBACAdmin = isSuperAdmin({
+    groupId: user.groupId ?? void 0,
+    groupName: g?.name,
+    isRBACAdmin: false
+  });
   const entityPerms = permissionRowsToRecord(g?.permissions);
   const rawAdminAccess = user.adminAccess;
   const adminAccess = rawAdminAccess === true ? true : rawAdminAccess === false ? false : void 0;
@@ -645,6 +780,26 @@ function sessionUserFromNextAuthUser(user) {
     isVendorOwner: isVendorOwner2
   };
 }
+function isCustomerGroupUser(user) {
+  return user.group?.name?.toLocaleLowerCase().trim() === "customer";
+}
+function callbackUrlTargetsAdmin(callbackUrl) {
+  const raw = callbackUrl.trim();
+  if (!raw) return false;
+  if (raw.startsWith("/admin")) return true;
+  try {
+    const path = raw.startsWith("http") ? new URL(raw).pathname : raw.split("?")[0] ?? raw;
+    return path.startsWith("/admin");
+  } catch {
+    return raw.includes("/admin");
+  }
+}
+function permitsCustomerLogin(allowCustomerLogin, credentials) {
+  if (allowCustomerLogin === true) return true;
+  if (allowCustomerLogin === false) return false;
+  const callbackUrl = typeof credentials?.callbackUrl === "string" ? credentials.callbackUrl : "";
+  return !callbackUrlTargetsAdmin(callbackUrl);
+}
 function getNextAuthOptions(config) {
   const {
     getUserByEmail,
@@ -654,8 +809,10 @@ function getNextAuthOptions(config) {
     extend,
     enablePasswordLogin = true,
     enableOtpLogin = false,
-    authorizeOtp
+    authorizeOtp,
+    allowCustomerLogin
   } = config;
+  logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
     providers.push(
@@ -666,15 +823,53 @@ function getNextAuthOptions(config) {
           password: { label: "Password", type: "password" }
         },
         async authorize(credentials) {
-          if (!credentials?.email || !credentials?.password) return null;
+          const creds = credentials;
+          const email = creds?.email?.trim() ?? "";
+          if (!email || !creds?.password) {
+            logAuth("authorize(credentials) rejected", { reason: "missing_email_or_password" });
+            return null;
+          }
           try {
-            const user = await getUserByEmail(credentials.email);
-            if (!user || user.blocked || user.deleted || !user.password) return null;
-            const valid = await comparePassword(credentials.password, user.password);
-            if (!valid) return null;
-            return sessionUserFromNextAuthUser(user);
+            const user = await getUserByEmail(email);
+            if (!user) {
+              logAuth("authorize(credentials) rejected", { reason: "user_not_found", email });
+              return null;
+            }
+            if (user.blocked) {
+              logAuth("authorize(credentials) rejected", { reason: "blocked", email, userId: user.id });
+              return null;
+            }
+            if (user.deleted) {
+              logAuth("authorize(credentials) rejected", { reason: "deleted", email, userId: user.id });
+              return null;
+            }
+            if (!user.password) {
+              logAuth("authorize(credentials) rejected", { reason: "no_password", email, userId: user.id });
+              return null;
+            }
+            const valid = await comparePassword(creds.password, user.password);
+            if (!valid) {
+              logAuth("authorize(credentials) rejected", { reason: "invalid_password", email, userId: user.id });
+              return null;
+            }
+            if (isCustomerGroupUser(user) && !permitsCustomerLogin(allowCustomerLogin, creds)) {
+              logAuth("authorize(credentials) rejected", {
+                reason: "customer_group",
+                email,
+                userId: user.id,
+                callbackUrl: creds?.callbackUrl ?? null
+              });
+              return null;
+            }
+            const sessionUser = sessionUserFromNextAuthUser(user);
+            logAuth("authorize(credentials) ok", summarizeSessionUserForLog(sessionUser));
+            return sessionUser;
           } catch (err) {
             console.error("[cms-auth] authorize error (credentials):", err instanceof Error ? err.message : err);
+            logAuth("authorize(credentials) error", {
+              email,
+              message: err instanceof Error ? err.message : String(err)
+            });
             return null;
           }
         }
@@ -692,13 +887,22 @@ function getNextAuthOptions(config) {
           channel: { label: "Channel", type: "text" }
         },
         async authorize(credentials) {
-          const identifier = typeof credentials?.identifier === "string" ? credentials.identifier.trim() : "";
-          const code = typeof credentials?.code === "string" ? credentials.code.trim() : "";
-          const ch = credentials?.channel === "sms" ? "sms" : "email";
+          const creds = credentials;
+          const identifier = typeof creds?.identifier === "string" ? creds.identifier.trim() : "";
+          const code = typeof creds?.code === "string" ? creds.code.trim() : "";
+          const ch = creds?.channel === "sms" ? "sms" : "email";
           if (!identifier || !code) return null;
           try {
             const user = await authorizeOtp({ identifier, channel: ch, code });
             if (!user || user.blocked || user.deleted) return null;
+            if (isCustomerGroupUser(user) && !permitsCustomerLogin(allowCustomerLogin, creds)) {
+              logAuth("authorize(otp) rejected", {
+                reason: "customer_group",
+                identifier,
+                callbackUrl: creds?.callbackUrl ?? null
+              });
+              return null;
+            }
             return sessionUserFromNextAuthUser(user);
           } catch (err) {
             console.error("[cms-auth] authorize error (otp):", err instanceof Error ? err.message : err);
@@ -727,6 +931,10 @@ function getNextAuthOptions(config) {
     callbacks: {
       async jwt({ token, user, trigger, session }) {
         if (user) {
+          logAuth("jwt callback: new sign-in", {
+            trigger,
+            user: summarizeSessionUserForLog(user)
+          });
           const u = user;
           token.id = u.id;
           token.groupId = u.groupId;
@@ -741,6 +949,7 @@ function getNextAuthOptions(config) {
           token.isVendorOwner = u.isVendorOwner;
         }
         if (trigger === "update" && session && typeof session === "object") {
+          logAuth("jwt callback: session update", { trigger });
           const s = session;
           const t = token;
           if (typeof s.name === "string") t.name = s.name;
@@ -750,8 +959,13 @@ function getNextAuthOptions(config) {
         return token;
       },
       async session({ session, token }) {
+        const t = token;
+        logAuth("session callback", {
+          tokenHasId: t.id != null,
+          tokenEmail: typeof t.email === "string" ? t.email : null,
+          sessionUser: summarizeSessionUserForLog(session.user)
+        });
         if (session.user) {
-          const t = token;
           if (typeof t.name === "string") session.user.name = t.name;
           if (typeof t.email === "string") session.user.email = t.email;
           session.user.id = t.id;
@@ -772,12 +986,17 @@ function getNextAuthOptions(config) {
   };
   return extend ? extend(options) : options;
 }
+function getStorefrontNextAuthOptions(config) {
+  return getNextAuthOptions({ ...config, allowCustomerLogin: true });
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ADMIN_GROUP_NAME,
   OPEN_ENDPOINTS,
   PERMISSION_REQUIRED_ENDPOINTS,
   RBAC_ADMIN_ONLY_ENTITIES,
+  SUPER_ADMIN_GROUP_ID,
+  VENDOR_ADMIN_GROUP_ID,
   VENDOR_OWNER_GROUP_NAME,
   VENDOR_SCOPED_STORE_ENTITIES,
   VENDOR_STORE_RBAC_ENTITIES,
@@ -793,23 +1012,32 @@ function getNextAuthOptions(config) {
   getNextAuthOptions,
   getPermissionableEntityKeys,
   getRequiredPermission,
+  getStorefrontNextAuthOptions,
   hasEntityPermission,
+  isAuthDebugClientEnabled,
+  isAuthDebugEnabled,
   isOpenEndpoint,
   isPlatformAdministrator,
   isPublicMethod,
   isRbacDebugEnabled,
+  isSuperAdmin,
   isSuperAdminGroupName,
+  isVendorAdmin,
   isVendorGroupName,
   isVendorOwner,
   isVendorPortalUser,
   isVendorStaff,
+  logAuth,
+  logAuthClient,
   logEntityAccessDecision,
   logRbac,
+  nextAuthCookieDebugInfo,
   permissionRowsToRecord,
   resolveVendorScopeFromSessionUser,
   seedAdministratorPermissions,
   sessionHasEntityAccess,
   summarizeEntityPerms,
+  summarizeSessionUserForLog,
   vendorPortalFlagsFromUser
 });
 //# sourceMappingURL=auth.cjs.map