@infuro/cms-core 1.0.31 → 1.0.34

package/dist/auth.js

@@ -72,6 +72,30 @@ var init_permission_entities = __esm({
   }
 });
 
+// src/auth/role-helpers.ts
+function isSuperAdmin(user) {
+  if (!user) return false;
+  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
+  if (user.isRBACAdmin === true) return true;
+  return isSuperAdminGroupName(user.groupName);
+}
+function isVendorAdmin(user) {
+  if (!user?.email || isSuperAdmin(user)) return false;
+  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
+  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  return isVendorGroupName(user.groupName);
+}
+var SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID;
+var init_role_helpers = __esm({
+  "src/auth/role-helpers.ts"() {
+    "use strict";
+    init_permission_entities();
+    init_vendor_scope();
+    SUPER_ADMIN_GROUP_ID = 1;
+    VENDOR_ADMIN_GROUP_ID = 5;
+  }
+});
+
 // src/auth/vendor-scope.ts
 function isVendorGroupName(name) {
   if (!name?.trim()) return false;
@@ -80,12 +104,12 @@ function isVendorGroupName(name) {
 }
 function isPlatformAdministrator(user) {
   if (!user?.email) return false;
-  return !!(user.isRBACAdmin || isSuperAdminGroupName(user.groupName));
+  return isSuperAdmin(user);
 }
 function isVendorPortalUser(user) {
   if (user?.isVendorPortal === true) return true;
   if (!user?.email || isPlatformAdministrator(user)) return false;
-  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  if (isVendorAdmin(user)) return true;
   return isVendorGroupName(user.groupName);
 }
 function isVendorStaff(user) {
@@ -127,7 +151,7 @@ var VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_OWNER_GROUP
 var init_vendor_scope = __esm({
   "src/auth/vendor-scope.ts"() {
     "use strict";
-    init_permission_entities();
+    init_role_helpers();
     VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
       "products",
       "collections",
@@ -455,6 +479,7 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
 
 // src/auth/index.ts
 init_rbac_debug();
+init_role_helpers();
 init_vendor_scope();
 init_permission_entities();
 
@@ -491,6 +516,59 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
   }
 }
 
+// src/auth/middleware.ts
+import { getToken } from "next-auth/jwt";
+
+// src/auth/auth-debug.ts
+var LOG_PREFIX2 = "[cms-auth]";
+function isAuthDebugEnabled() {
+  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function isAuthDebugClientEnabled() {
+  if (typeof window === "undefined") return false;
+  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
+  if (v === "1" || v === "true" || v === "yes") return true;
+  if (v === "0" || v === "false" || v === "no") return false;
+  return process.env.NODE_ENV === "development";
+}
+function logAuth(message, data) {
+  if (!isAuthDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function logAuthClient(message, data) {
+  if (!isAuthDebugClientEnabled()) return;
+  if (data) console.info(LOG_PREFIX2, message, data);
+  else console.info(LOG_PREFIX2, message);
+}
+function summarizeSessionUserForLog(user) {
+  if (!user || typeof user !== "object") return { present: false };
+  const u = user;
+  return {
+    present: true,
+    email: u.email ?? null,
+    id: u.id ?? null,
+    adminAccess: u.adminAccess ?? null,
+    isRBACAdmin: u.isRBACAdmin ?? null,
+    isVendorPortal: u.isVendorPortal ?? null,
+    groupName: u.groupName ?? null
+  };
+}
+function nextAuthCookieDebugInfo() {
+  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
+  const isHttps = nextAuthUrl.startsWith("https");
+  return {
+    nextAuthUrl,
+    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
+    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
+    cookieSecure: isHttps,
+    nodeEnv: process.env.NODE_ENV ?? "(unset)"
+  };
+}
+
 // src/auth/middleware.ts
 var defaultPublicApiMethods = {
   "/api/contacts": ["POST"],
@@ -503,8 +581,21 @@ var defaultPublicApiMethods = {
   "/api/users/set-password": ["POST"],
   "/api/users/invite": ["POST"]
 };
-function defaultGetSessionToken(request) {
-  return request.cookies.get("__Secure-next-auth.session-token")?.value ?? request.cookies.get("next-auth.session-token")?.value;
+function legacyGetSessionToken(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  return secure ?? regular;
+}
+function sessionCookiePresence(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
+  return {
+    hasSecureToken: Boolean(secure),
+    hasRegularToken: Boolean(regular),
+    hasChunkedToken: hasChunked,
+    resolved: Boolean(secure ?? regular)
+  };
 }
 function isPublicMethod2(pathname, method, publicApiMethods) {
   for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
@@ -512,31 +603,59 @@ function isPublicMethod2(pathname, method, publicApiMethods) {
   }
   return false;
 }
+async function hasValidSession(request, secret, legacyGetToken) {
+  if (request.req) {
+    const token = await getToken({ req: request.req, secret });
+    return token != null;
+  }
+  return Boolean(legacyGetToken(request));
+}
 function createCmsMiddleware(config = {}) {
   const {
     publicAdminPaths = ["/admin/signin", "/admin/forgot-password", "/admin/reset-password", "/admin/invite"],
     publicApiMethods = defaultPublicApiMethods,
     signInPath = "/admin/signin",
-    getSessionToken = defaultGetSessionToken
+    getSessionToken = legacyGetSessionToken,
+    secret = process.env.NEXTAUTH_SECRET
   } = config;
-  return function cmsMiddleware(request) {
+  return async function cmsMiddleware(request) {
     const pathname = request.nextUrl.pathname;
     const method = request.method;
     if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
       return { type: "next" };
     }
     if (pathname.startsWith("/admin")) {
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      const cookies = sessionCookiePresence(request);
+      if (!authenticated) {
+        logAuth("middleware: admin redirect to signin (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...cookies,
+          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
+        });
         return { type: "redirect", url: new URL(signInPath, request.url).toString() };
       }
+      logAuth("middleware: admin allowed", {
+        pathname,
+        method,
+        usesGetToken: Boolean(request.req),
+        ...cookies
+      });
     }
     if (pathname.startsWith("/api")) {
       if (isPublicMethod2(pathname, method, publicApiMethods)) {
         return { type: "next" };
       }
-      const token = getSessionToken(request);
-      if (!token) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      if (!authenticated) {
+        logAuth("middleware: api 401 (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...sessionCookiePresence(request)
+        });
         return { type: "json", status: 401, body: { error: "Unauthorized" } };
       }
     }
@@ -546,12 +665,17 @@ function createCmsMiddleware(config = {}) {
 
 // src/auth/nextauth-options.ts
 init_permission_entities();
+init_role_helpers();
 init_vendor_scope();
 import _CredentialsProvider from "next-auth/providers/credentials";
 var CredentialsProvider = _CredentialsProvider.default ?? _CredentialsProvider;
 function sessionUserFromNextAuthUser(user) {
   const g = user.group;
-  const isRBACAdmin = isSuperAdminGroupName(g?.name);
+  const isRBACAdmin = isSuperAdmin({
+    groupId: user.groupId ?? void 0,
+    groupName: g?.name,
+    isRBACAdmin: false
+  });
   const entityPerms = permissionRowsToRecord(g?.permissions);
   const rawAdminAccess = user.adminAccess;
   const adminAccess = rawAdminAccess === true ? true : rawAdminAccess === false ? false : void 0;
@@ -580,6 +704,26 @@ function sessionUserFromNextAuthUser(user) {
     isVendorOwner: isVendorOwner2
   };
 }
+function isCustomerGroupUser(user) {
+  return user.group?.name?.toLocaleLowerCase().trim() === "customer";
+}
+function callbackUrlTargetsAdmin(callbackUrl) {
+  const raw = callbackUrl.trim();
+  if (!raw) return false;
+  if (raw.startsWith("/admin")) return true;
+  try {
+    const path = raw.startsWith("http") ? new URL(raw).pathname : raw.split("?")[0] ?? raw;
+    return path.startsWith("/admin");
+  } catch {
+    return raw.includes("/admin");
+  }
+}
+function permitsCustomerLogin(allowCustomerLogin, credentials) {
+  if (allowCustomerLogin === true) return true;
+  if (allowCustomerLogin === false) return false;
+  const callbackUrl = typeof credentials?.callbackUrl === "string" ? credentials.callbackUrl : "";
+  return !callbackUrlTargetsAdmin(callbackUrl);
+}
 function getNextAuthOptions(config) {
   const {
     getUserByEmail,
@@ -589,8 +733,10 @@ function getNextAuthOptions(config) {
     extend,
     enablePasswordLogin = true,
     enableOtpLogin = false,
-    authorizeOtp
+    authorizeOtp,
+    allowCustomerLogin
   } = config;
+  logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
     providers.push(
@@ -601,15 +747,53 @@ function getNextAuthOptions(config) {
           password: { label: "Password", type: "password" }
         },
         async authorize(credentials) {
-          if (!credentials?.email || !credentials?.password) return null;
+          const creds = credentials;
+          const email = creds?.email?.trim() ?? "";
+          if (!email || !creds?.password) {
+            logAuth("authorize(credentials) rejected", { reason: "missing_email_or_password" });
+            return null;
+          }
           try {
-            const user = await getUserByEmail(credentials.email);
-            if (!user || user.blocked || user.deleted || !user.password) return null;
-            const valid = await comparePassword(credentials.password, user.password);
-            if (!valid) return null;
-            return sessionUserFromNextAuthUser(user);
+            const user = await getUserByEmail(email);
+            if (!user) {
+              logAuth("authorize(credentials) rejected", { reason: "user_not_found", email });
+              return null;
+            }
+            if (user.blocked) {
+              logAuth("authorize(credentials) rejected", { reason: "blocked", email, userId: user.id });
+              return null;
+            }
+            if (user.deleted) {
+              logAuth("authorize(credentials) rejected", { reason: "deleted", email, userId: user.id });
+              return null;
+            }
+            if (!user.password) {
+              logAuth("authorize(credentials) rejected", { reason: "no_password", email, userId: user.id });
+              return null;
+            }
+            const valid = await comparePassword(creds.password, user.password);
+            if (!valid) {
+              logAuth("authorize(credentials) rejected", { reason: "invalid_password", email, userId: user.id });
+              return null;
+            }
+            if (isCustomerGroupUser(user) && !permitsCustomerLogin(allowCustomerLogin, creds)) {
+              logAuth("authorize(credentials) rejected", {
+                reason: "customer_group",
+                email,
+                userId: user.id,
+                callbackUrl: creds?.callbackUrl ?? null
+              });
+              return null;
+            }
+            const sessionUser = sessionUserFromNextAuthUser(user);
+            logAuth("authorize(credentials) ok", summarizeSessionUserForLog(sessionUser));
+            return sessionUser;
           } catch (err) {
             console.error("[cms-auth] authorize error (credentials):", err instanceof Error ? err.message : err);
+            logAuth("authorize(credentials) error", {
+              email,
+              message: err instanceof Error ? err.message : String(err)
+            });
             return null;
           }
         }
@@ -627,13 +811,22 @@ function getNextAuthOptions(config) {
           channel: { label: "Channel", type: "text" }
         },
         async authorize(credentials) {
-          const identifier = typeof credentials?.identifier === "string" ? credentials.identifier.trim() : "";
-          const code = typeof credentials?.code === "string" ? credentials.code.trim() : "";
-          const ch = credentials?.channel === "sms" ? "sms" : "email";
+          const creds = credentials;
+          const identifier = typeof creds?.identifier === "string" ? creds.identifier.trim() : "";
+          const code = typeof creds?.code === "string" ? creds.code.trim() : "";
+          const ch = creds?.channel === "sms" ? "sms" : "email";
           if (!identifier || !code) return null;
           try {
             const user = await authorizeOtp({ identifier, channel: ch, code });
             if (!user || user.blocked || user.deleted) return null;
+            if (isCustomerGroupUser(user) && !permitsCustomerLogin(allowCustomerLogin, creds)) {
+              logAuth("authorize(otp) rejected", {
+                reason: "customer_group",
+                identifier,
+                callbackUrl: creds?.callbackUrl ?? null
+              });
+              return null;
+            }
             return sessionUserFromNextAuthUser(user);
           } catch (err) {
             console.error("[cms-auth] authorize error (otp):", err instanceof Error ? err.message : err);
@@ -662,6 +855,10 @@ function getNextAuthOptions(config) {
     callbacks: {
       async jwt({ token, user, trigger, session }) {
         if (user) {
+          logAuth("jwt callback: new sign-in", {
+            trigger,
+            user: summarizeSessionUserForLog(user)
+          });
           const u = user;
           token.id = u.id;
           token.groupId = u.groupId;
@@ -676,6 +873,7 @@ function getNextAuthOptions(config) {
           token.isVendorOwner = u.isVendorOwner;
         }
         if (trigger === "update" && session && typeof session === "object") {
+          logAuth("jwt callback: session update", { trigger });
           const s = session;
           const t = token;
           if (typeof s.name === "string") t.name = s.name;
@@ -685,8 +883,13 @@ function getNextAuthOptions(config) {
         return token;
       },
       async session({ session, token }) {
+        const t = token;
+        logAuth("session callback", {
+          tokenHasId: t.id != null,
+          tokenEmail: typeof t.email === "string" ? t.email : null,
+          sessionUser: summarizeSessionUserForLog(session.user)
+        });
         if (session.user) {
-          const t = token;
           if (typeof t.name === "string") session.user.name = t.name;
           if (typeof t.email === "string") session.user.email = t.email;
           session.user.id = t.id;
@@ -707,11 +910,16 @@ function getNextAuthOptions(config) {
   };
   return extend ? extend(options) : options;
 }
+function getStorefrontNextAuthOptions(config) {
+  return getNextAuthOptions({ ...config, allowCustomerLogin: true });
+}
 export {
   ADMIN_GROUP_NAME,
   OPEN_ENDPOINTS,
   PERMISSION_REQUIRED_ENDPOINTS,
   RBAC_ADMIN_ONLY_ENTITIES,
+  SUPER_ADMIN_GROUP_ID,
+  VENDOR_ADMIN_GROUP_ID,
   VENDOR_OWNER_GROUP_NAME,
   VENDOR_SCOPED_STORE_ENTITIES,
   VENDOR_STORE_RBAC_ENTITIES,
@@ -727,23 +935,32 @@ export {
   getNextAuthOptions,
   getPermissionableEntityKeys,
   getRequiredPermission,
+  getStorefrontNextAuthOptions,
   hasEntityPermission,
+  isAuthDebugClientEnabled,
+  isAuthDebugEnabled,
   isOpenEndpoint,
   isPlatformAdministrator,
   isPublicMethod,
   isRbacDebugEnabled,
+  isSuperAdmin,
   isSuperAdminGroupName,
+  isVendorAdmin,
   isVendorGroupName,
   isVendorOwner,
   isVendorPortalUser,
   isVendorStaff,
+  logAuth,
+  logAuthClient,
   logEntityAccessDecision,
   logRbac,
+  nextAuthCookieDebugInfo,
   permissionRowsToRecord,
   resolveVendorScopeFromSessionUser,
   seedAdministratorPermissions,
   sessionHasEntityAccess,
   summarizeEntityPerms,
+  summarizeSessionUserForLog,
   vendorPortalFlagsFromUser
 };
 //# sourceMappingURL=auth.js.map