@infuro/cms-core 1.0.33 → 1.0.35

package/dist/auth.js

@@ -1,888 +1,4 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/auth/permission-entities.ts
-function isSuperAdminGroupName(name) {
-  return name === ADMIN_GROUP_NAME;
-}
-function getPermissionableEntityKeys(entityMap) {
-  const fromMap = Object.keys(entityMap).filter((k) => !PERMISSION_ENTITY_INTERNAL_EXCLUDE.has(k));
-  const logical = PERMISSION_LOGICAL_ENTITIES.filter((k) => !fromMap.includes(k));
-  return [...fromMap.sort(), ...logical].filter((k, i, a) => a.indexOf(k) === i);
-}
-function permissionRowsToRecord(rows) {
-  const out = {};
-  if (!rows?.length) return out;
-  for (const p of rows) {
-    out[p.entity] = {
-      c: !!p.canCreate,
-      r: !!p.canRead,
-      u: !!p.canUpdate,
-      d: !!p.canDelete
-    };
-  }
-  return out;
-}
-function hasEntityPermission(record, entity, action) {
-  const p = record?.[entity];
-  if (!p) return false;
-  if (action === "create") return p.c;
-  if (action === "read") return p.r;
-  if (action === "update") return p.u;
-  return p.d;
-}
-var PERMISSION_ENTITY_INTERNAL_EXCLUDE, PERMISSION_LOGICAL_ENTITIES, ADMIN_GROUP_NAME;
-var init_permission_entities = __esm({
-  "src/auth/permission-entities.ts"() {
-    "use strict";
-    PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
-      "users",
-      "password_reset_tokens",
-      "user_groups",
-      "permissions",
-      "comments",
-      "form_fields",
-      "configs",
-      "knowledge_base_chunks",
-      "carts",
-      "cart_items",
-      "wishlists",
-      "wishlist_items",
-      "message_templates",
-      "vendor_users"
-    ]);
-    PERMISSION_LOGICAL_ENTITIES = [
-      "users",
-      "forms",
-      "form_submissions",
-      "dashboard",
-      "upload",
-      "settings",
-      "analytics",
-      "chat"
-    ];
-    ADMIN_GROUP_NAME = "Administrator";
-  }
-});
-
-// src/auth/vendor-scope.ts
-function isVendorGroupName(name) {
-  if (!name?.trim()) return false;
-  const n = name.trim().toLowerCase();
-  return n === VENDOR_OWNER_GROUP_NAME.toLowerCase() || n.includes("vendor");
-}
-function isPlatformAdministrator(user) {
-  if (!user?.email) return false;
-  return !!(user.isRBACAdmin || isSuperAdminGroupName(user.groupName));
-}
-function isVendorPortalUser(user) {
-  if (user?.isVendorPortal === true) return true;
-  if (!user?.email || isPlatformAdministrator(user)) return false;
-  if ((user.vendorIds?.length ?? 0) > 0) return true;
-  return isVendorGroupName(user.groupName);
-}
-function isVendorStaff(user) {
-  return isVendorPortalUser(user);
-}
-function isVendorOwner(user) {
-  if (user?.isVendorOwner === true) return true;
-  if (!user?.email || isPlatformAdministrator(user)) return false;
-  if (user.vendorRole === "staff") return false;
-  if (user.vendorRole === "owner") return true;
-  if (!isVendorPortalUser(user)) return false;
-  return user.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase();
-}
-function canManageVendorTeam(user) {
-  return isPlatformAdministrator(user) || isVendorOwner(user);
-}
-function canManageVendorRoles(user) {
-  return isPlatformAdministrator(user) || isVendorOwner(user);
-}
-function canOnboardVendors(user) {
-  return isPlatformAdministrator(user);
-}
-function resolveVendorScopeFromSessionUser(user) {
-  if (!user?.email) return { type: "deny" };
-  if (isPlatformAdministrator(user)) return { type: "all" };
-  const vendorIds = user.vendorIds ?? [];
-  if (vendorIds.length === 0) return { type: "deny" };
-  const preferred = user.activeVendorId ?? vendorIds[0];
-  const vendorId = vendorIds.includes(preferred) ? preferred : vendorIds[0];
-  return { type: "vendor", vendorId, vendorIds };
-}
-function vendorPortalFlagsFromUser(input) {
-  const vendorIds = input.vendorIds ?? [];
-  const isVendorPortal = !input.isRBACAdmin && (vendorIds.length > 0 || isVendorGroupName(input.groupName));
-  const isVendorOwner2 = isVendorPortal && input.vendorRole !== "staff" && (input.vendorRole === "owner" || input.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase());
-  return { isVendorPortal, isVendorOwner: isVendorOwner2 };
-}
-var VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_OWNER_GROUP_NAME;
-var init_vendor_scope = __esm({
-  "src/auth/vendor-scope.ts"() {
-    "use strict";
-    init_permission_entities();
-    VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
-      "products",
-      "collections",
-      "brands",
-      "product_categories",
-      "orders",
-      "payments",
-      "taxes",
-      "attributes",
-      "vendor_customers",
-      "discounts"
-    ]);
-    VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
-      ...VENDOR_SCOPED_STORE_ENTITIES,
-      "order_discounts",
-      "order_addresses"
-    ]);
-    VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
-  }
-});
-
-// src/auth/rbac-debug-db.ts
-var rbac_debug_db_exports = {};
-__export(rbac_debug_db_exports, {
-  loadDbPermissionsForUser: () => loadDbPermissionsForUser
-});
-async function loadDbPermissionsForUser(dataSource, userId) {
-  const rows = await dataSource.query(
-    `
-    SELECT u."groupId" AS "groupId", g.name AS "groupName",
-           p.entity, p."canCreate", p."canRead", p."canUpdate", p."canDelete"
-    FROM users u
-    LEFT JOIN user_groups g ON g.id = u."groupId" AND g.deleted = false
-    LEFT JOIN permissions p ON p."groupId" = g.id
-    WHERE u.id = $1
-    `,
-    [userId]
-  );
-  const groupId = rows[0]?.groupId ?? null;
-  const groupName = rows[0]?.groupName ?? null;
-  const permRows = rows.filter((r) => r.entity).map((r) => ({
-    entity: r.entity,
-    canCreate: !!r.canCreate,
-    canRead: !!r.canRead,
-    canUpdate: !!r.canUpdate,
-    canDelete: !!r.canDelete
-  }));
-  return {
-    groupId,
-    groupName,
-    dbEntityPerms: summarizeEntityPerms(permissionRowsToRecord(permRows))
-  };
-}
-var init_rbac_debug_db = __esm({
-  "src/auth/rbac-debug-db.ts"() {
-    "use strict";
-    init_permission_entities();
-    init_rbac_debug();
-  }
-});
-
-// src/auth/rbac-debug.ts
-function isRbacDebugEnabled() {
-  const v = process.env.CMS_RBAC_DEBUG?.trim().toLowerCase();
-  if (v === "1" || v === "true" || v === "yes") return true;
-  if (v === "0" || v === "false" || v === "no") return false;
-  return process.env.NODE_ENV === "development";
-}
-function logRbac(message, data) {
-  if (!isRbacDebugEnabled()) return;
-  if (data) console.info(LOG_PREFIX, message, data);
-  else console.info(LOG_PREFIX, message);
-}
-function summarizeEntityPerms(entityPerms) {
-  const out = {};
-  if (!entityPerms) return out;
-  for (const [entity, p] of Object.entries(entityPerms)) {
-    out[entity] = { c: p.c, r: p.r, u: p.u, d: p.d };
-  }
-  return out;
-}
-function vendorPortalFallbackReason(user, entity, action) {
-  if (!isVendorPortalUser(user)) return null;
-  if (entity === "dashboard" && action === "read") return "vendor_portal_dashboard_fallback";
-  if (entity === "analytics" && action === "read") return "vendor_portal_analytics_fallback";
-  if (entity === "settings" && action === "read") return "vendor_portal_settings_read_fallback";
-  if (VENDOR_STORE_RBAC_ENTITIES.has(entity) && action === "read") return "vendor_portal_store_read_fallback";
-  return null;
-}
-function explainSessionEntityAccess(user, entity, action) {
-  const userSnapshot = {
-    email: user?.email ?? null,
-    id: user?.id ?? null,
-    groupId: user?.groupId ?? null,
-    groupName: user?.groupName ?? null,
-    isRBACAdmin: user?.isRBACAdmin ?? false,
-    adminAccess: user?.adminAccess ?? null,
-    vendorIds: user?.vendorIds ?? [],
-    activeVendorId: user?.activeVendorId ?? null,
-    vendorRole: user?.vendorRole ?? null,
-    isVendorPortal: user?.isVendorPortal ?? false,
-    isVendorOwner: user?.isVendorOwner ?? false,
-    isVendorPortalComputed: isVendorPortalUser(user),
-    isVendorOwnerComputed: isVendorOwner(user),
-    jwtEntityPerms: summarizeEntityPerms(user?.entityPerms),
-    jwtEntityPermForTarget: user?.entityPerms?.[entity] ?? null
-  };
-  if (!user?.email) {
-    return { allowed: false, reason: "no_session_email", userSnapshot };
-  }
-  if (user.isRBACAdmin) {
-    return { allowed: true, reason: "platform_administrator", userSnapshot };
-  }
-  const vendorIds = user.vendorIds ?? [];
-  const isStaff = user.vendorRole === "staff";
-  if (vendorIds.length > 0) {
-    if (entity === "dashboard" && action === "read") {
-      return { allowed: true, reason: "vendor_link_dashboard_read", userSnapshot };
-    }
-    if (entity === "analytics" && action === "read") {
-      return { allowed: true, reason: "vendor_link_analytics_read", userSnapshot };
-    }
-    if (entity === "settings") {
-      if (action === "read") {
-        return { allowed: true, reason: "vendor_link_settings_read", userSnapshot };
-      }
-      if (action === "update" && !isStaff) {
-        return { allowed: true, reason: "vendor_link_settings_update", userSnapshot };
-      }
-    }
-    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
-      if (isStaff && action === "read") {
-        return { allowed: true, reason: "vendor_staff_store_read", userSnapshot };
-      }
-      if (!isStaff) {
-        return { allowed: true, reason: "vendor_link_store_full", userSnapshot };
-      }
-      return {
-        allowed: false,
-        reason: "vendor_staff_store_write_denied",
-        userSnapshot
-      };
-    }
-  }
-  if (isVendorPortalUser(user) && isVendorOwner(user)) {
-    if (entity === "dashboard" && action === "read") {
-      return { allowed: true, reason: "vendor_owner_group_dashboard", userSnapshot };
-    }
-    if (entity === "analytics" && action === "read") {
-      return { allowed: true, reason: "vendor_owner_group_analytics", userSnapshot };
-    }
-    if (entity === "settings" && (action === "read" || action === "update")) {
-      return { allowed: true, reason: "vendor_owner_group_settings", userSnapshot };
-    }
-    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
-      return { allowed: true, reason: "vendor_owner_group_store", userSnapshot };
-    }
-  }
-  const vendorPortalReason = vendorPortalFallbackReason(user, entity, action);
-  if (vendorPortalReason) {
-    return { allowed: true, reason: vendorPortalReason, userSnapshot };
-  }
-  const explicit = user.entityPerms?.[entity];
-  if (explicit !== void 0) {
-    const allowed2 = hasEntityPermission(user.entityPerms, entity, action);
-    return {
-      allowed: allowed2,
-      reason: allowed2 ? "jwt_entity_perms_allow" : "jwt_entity_perms_deny",
-      userSnapshot
-    };
-  }
-  const allowed = hasEntityPermission(user.entityPerms, entity, action);
-  return {
-    allowed,
-    reason: allowed ? "entity_perms_fallback_allow" : "no_matching_rule",
-    userSnapshot
-  };
-}
-async function logEntityAccessDecision(dataSource, context, user, entity, action, extra) {
-  if (!isRbacDebugEnabled()) return;
-  const explanation = explainSessionEntityAccess(user, entity, action);
-  let dbPermissions;
-  if (dataSource && user?.id) {
-    const id = Number(user.id);
-    if (Number.isFinite(id)) {
-      try {
-        const { loadDbPermissionsForUser: loadDbPermissionsForUser2 } = await Promise.resolve().then(() => (init_rbac_debug_db(), rbac_debug_db_exports));
-        dbPermissions = await loadDbPermissionsForUser2(dataSource, id);
-      } catch (e) {
-        dbPermissions = { error: e instanceof Error ? e.message : String(e) };
-      }
-    }
-  }
-  logRbac(context, {
-    entity,
-    action,
-    allowed: explanation.allowed,
-    reason: explanation.reason,
-    ...explanation.userSnapshot,
-    dbPermissions,
-    ...extra
-  });
-}
-var LOG_PREFIX;
-var init_rbac_debug = __esm({
-  "src/auth/rbac-debug.ts"() {
-    "use strict";
-    init_permission_entities();
-    init_vendor_scope();
-    LOG_PREFIX = "[cms-rbac]";
-  }
-});
-
-// src/auth/helpers.ts
-init_rbac_debug();
-init_vendor_scope();
-var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set(["users", "user_groups", "permissions"]);
-function sessionHasEntityAccess(user, entity, action) {
-  return explainSessionEntityAccess(user, entity, action).allowed;
-}
-function canManageRoles(user) {
-  return !!(user?.email && user.isRBACAdmin);
-}
-var OPEN_ENDPOINTS = [
-  { "/api/contacts": ["POST"] },
-  { "/api/form-submissions": ["POST"] },
-  { "/api/blogs": ["GET"] }
-];
-var PERMISSION_REQUIRED_ENDPOINTS = {};
-function isOpenEndpoint(pathname) {
-  return OPEN_ENDPOINTS.some((endpoint) => pathname.startsWith(Object.keys(endpoint)[0]));
-}
-function getRequiredPermission(pathname) {
-  return null;
-}
-function isPublicMethod(pathname, method) {
-  for (const endpoint of OPEN_ENDPOINTS) {
-    const key = Object.keys(endpoint)[0];
-    if (pathname.startsWith(key) && endpoint[key].includes(method)) return true;
-  }
-  return false;
-}
-function createAuthHelpers(getSession, NextResponse) {
-  return createAuthHelpersFromGetSession(getSession, NextResponse);
-}
-function createCmsAuthBundle(getSession, NextResponse) {
-  const auth = createAuthHelpers(getSession, NextResponse);
-  return {
-    requireAuth: auth.requireAuth,
-    requireAdminAccess: auth.requireAdminAccess,
-    requireEntityPermission: auth.requireEntityPermission,
-    getSessionUser: auth.getAuthenticatedUser,
-    getAuthenticatedUser: auth.getAuthenticatedUser
-  };
-}
-function createAuthHelpersFromGetSession(getSession, NextResponse) {
-  return {
-    async requireAuth() {
-      const session = await getSession();
-      if (!session?.user?.email) {
-        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-      }
-      return null;
-    },
-    async requirePermission() {
-      const session = await getSession();
-      if (!session?.user?.email) {
-        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-      }
-      return null;
-    },
-    async requireEntityPermission(_req, entity, action) {
-      const session = await getSession();
-      if (!session?.user?.email) {
-        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-      }
-      const u = session.user;
-      const allowed = sessionHasEntityAccess(u, entity, action);
-      const { reason } = explainSessionEntityAccess(u, entity, action);
-      logRbac("authHelpers.requireEntityPermission", {
-        entity,
-        action,
-        allowed,
-        reason,
-        email: u.email,
-        groupName: u.groupName,
-        vendorIds: u.vendorIds,
-        isVendorPortal: u.isVendorPortal,
-        isVendorOwner: u.isVendorOwner
-      });
-      if (allowed) return null;
-      return NextResponse.json({ error: "Forbidden", entity, action, reason }, { status: 403 });
-    },
-    async requireAdminAccess() {
-      const session = await getSession();
-      if (!session?.user?.email) {
-        return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-      }
-      const u = session.user;
-      if (u.isRBACAdmin) return null;
-      if (isVendorPortalUser(u)) return null;
-      if (u.adminAccess === true) return null;
-      if (u.adminAccess === false) {
-        logRbac("requireAdminAccess denied (adminAccess:false)", {
-          email: u.email,
-          groupName: u.groupName,
-          isVendorPortal: u.isVendorPortal
-        });
-        return NextResponse.json({ error: "Forbidden", reason: "admin_access" }, { status: 403 });
-      }
-      logRbac("requireAdminAccess denied (no matching rule)", {
-        email: u.email,
-        adminAccess: u.adminAccess,
-        groupName: u.groupName,
-        isVendorPortal: u.isVendorPortal
-      });
-      return NextResponse.json({ error: "Forbidden", reason: "admin_access" }, { status: 403 });
-    },
-    async getAuthenticatedUser() {
-      const session = await getSession();
-      return session?.user ?? null;
-    }
-  };
-}
-
-// src/auth/index.ts
-init_rbac_debug();
-init_vendor_scope();
-init_permission_entities();
-
-// src/auth/seed-permissions.ts
-init_permission_entities();
-async function seedAdministratorPermissions(dataSource, entityMap) {
-  const entities = getPermissionableEntityKeys(entityMap);
-  const groupRepo = dataSource.getRepository(entityMap.user_groups);
-  const permRepo = dataSource.getRepository(entityMap.permissions);
-  const adminGroup = await groupRepo.findOne({ where: { name: ADMIN_GROUP_NAME, deleted: false } });
-  console.log("ADMIN GROUP", adminGroup);
-  if (!adminGroup) return;
-  const fullCrud = { canCreate: true, canRead: true, canUpdate: true, canDelete: true };
-  for (const entity of entities) {
-    const existing = await permRepo.findOne({
-      where: { groupId: adminGroup.id, entity }
-    });
-    console.log("EXISTING", existing);
-    if (existing) {
-      existing.canCreate = true;
-      existing.canRead = true;
-      existing.canUpdate = true;
-      existing.canDelete = true;
-      await permRepo.save(existing);
-    } else {
-      await permRepo.save(
-        permRepo.create({
-          groupId: adminGroup.id,
-          entity,
-          ...fullCrud
-        })
-      );
-    }
-  }
-}
-
-// src/auth/middleware.ts
-import { getToken } from "next-auth/jwt";
-
-// src/auth/auth-debug.ts
-var LOG_PREFIX2 = "[cms-auth]";
-function isAuthDebugEnabled() {
-  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
-  if (v === "1" || v === "true" || v === "yes") return true;
-  if (v === "0" || v === "false" || v === "no") return false;
-  return process.env.NODE_ENV === "development";
-}
-function isAuthDebugClientEnabled() {
-  if (typeof window === "undefined") return false;
-  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
-  if (v === "1" || v === "true" || v === "yes") return true;
-  if (v === "0" || v === "false" || v === "no") return false;
-  return process.env.NODE_ENV === "development";
-}
-function logAuth(message, data) {
-  if (!isAuthDebugEnabled()) return;
-  if (data) console.info(LOG_PREFIX2, message, data);
-  else console.info(LOG_PREFIX2, message);
-}
-function logAuthClient(message, data) {
-  if (!isAuthDebugClientEnabled()) return;
-  if (data) console.info(LOG_PREFIX2, message, data);
-  else console.info(LOG_PREFIX2, message);
-}
-function summarizeSessionUserForLog(user) {
-  if (!user || typeof user !== "object") return { present: false };
-  const u = user;
-  return {
-    present: true,
-    email: u.email ?? null,
-    id: u.id ?? null,
-    adminAccess: u.adminAccess ?? null,
-    isRBACAdmin: u.isRBACAdmin ?? null,
-    isVendorPortal: u.isVendorPortal ?? null,
-    groupName: u.groupName ?? null
-  };
-}
-function nextAuthCookieDebugInfo() {
-  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
-  const isHttps = nextAuthUrl.startsWith("https");
-  return {
-    nextAuthUrl,
-    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
-    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
-    cookieSecure: isHttps,
-    nodeEnv: process.env.NODE_ENV ?? "(unset)"
-  };
-}
-
-// src/auth/middleware.ts
-var defaultPublicApiMethods = {
-  "/api/contacts": ["POST"],
-  "/api/form-submissions": ["POST"],
-  "/api/blogs": ["GET"],
-  "/api/forms": ["GET"],
-  "/api/auth": ["GET", "POST"],
-  "/api/health": ["GET"],
-  "/api/users/forgot-password": ["POST"],
-  "/api/users/set-password": ["POST"],
-  "/api/users/invite": ["POST"]
-};
-function legacyGetSessionToken(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  return secure ?? regular;
-}
-function sessionCookiePresence(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
-  return {
-    hasSecureToken: Boolean(secure),
-    hasRegularToken: Boolean(regular),
-    hasChunkedToken: hasChunked,
-    resolved: Boolean(secure ?? regular)
-  };
-}
-function isPublicMethod2(pathname, method, publicApiMethods) {
-  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
-    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;
-  }
-  return false;
-}
-async function hasValidSession(request, secret, legacyGetToken) {
-  if (request.req) {
-    const token = await getToken({ req: request.req, secret });
-    return token != null;
-  }
-  return Boolean(legacyGetToken(request));
-}
-function createCmsMiddleware(config = {}) {
-  const {
-    publicAdminPaths = ["/admin/signin", "/admin/forgot-password", "/admin/reset-password", "/admin/invite"],
-    publicApiMethods = defaultPublicApiMethods,
-    signInPath = "/admin/signin",
-    getSessionToken = legacyGetSessionToken,
-    secret = process.env.NEXTAUTH_SECRET
-  } = config;
-  return async function cmsMiddleware(request) {
-    const pathname = request.nextUrl.pathname;
-    const method = request.method;
-    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
-      return { type: "next" };
-    }
-    if (pathname.startsWith("/admin")) {
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      const cookies = sessionCookiePresence(request);
-      if (!authenticated) {
-        logAuth("middleware: admin redirect to signin (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...cookies,
-          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
-        });
-        return { type: "redirect", url: new URL(signInPath, request.url).toString() };
-      }
-      logAuth("middleware: admin allowed", {
-        pathname,
-        method,
-        usesGetToken: Boolean(request.req),
-        ...cookies
-      });
-    }
-    if (pathname.startsWith("/api")) {
-      if (isPublicMethod2(pathname, method, publicApiMethods)) {
-        return { type: "next" };
-      }
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      if (!authenticated) {
-        logAuth("middleware: api 401 (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...sessionCookiePresence(request)
-        });
-        return { type: "json", status: 401, body: { error: "Unauthorized" } };
-      }
-    }
-    return { type: "next" };
-  };
-}
-
-// src/auth/nextauth-options.ts
-init_permission_entities();
-init_vendor_scope();
-import _CredentialsProvider from "next-auth/providers/credentials";
-var CredentialsProvider = _CredentialsProvider.default ?? _CredentialsProvider;
-function sessionUserFromNextAuthUser(user) {
-  const g = user.group;
-  const isRBACAdmin = isSuperAdminGroupName(g?.name);
-  const entityPerms = permissionRowsToRecord(g?.permissions);
-  const rawAdminAccess = user.adminAccess;
-  const adminAccess = rawAdminAccess === true ? true : rawAdminAccess === false ? false : void 0;
-  const vendorIds = user.vendorIds ?? [];
-  const vendorRole = user.vendorRole ?? null;
-  const { isVendorPortal, isVendorOwner: isVendorOwner2 } = vendorPortalFlagsFromUser({
-    email: user.email,
-    isRBACAdmin,
-    groupName: g?.name,
-    vendorIds,
-    vendorRole
-  });
-  return {
-    id: user.id.toString(),
-    email: user.email,
-    name: user.name,
-    groupId: user.groupId ?? void 0,
-    groupName: g?.name ?? void 0,
-    isRBACAdmin,
-    entityPerms,
-    adminAccess,
-    vendorIds,
-    activeVendorId: user.activeVendorId ?? vendorIds[0] ?? null,
-    vendorRole,
-    isVendorPortal,
-    isVendorOwner: isVendorOwner2
-  };
-}
-function getNextAuthOptions(config) {
-  const {
-    getUserByEmail,
-    comparePassword,
-    signInPage = "/admin/signin",
-    secret,
-    extend,
-    enablePasswordLogin = true,
-    enableOtpLogin = false,
-    authorizeOtp
-  } = config;
-  logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
-  const providers = [];
-  if (enablePasswordLogin) {
-    providers.push(
-      CredentialsProvider({
-        name: "credentials",
-        credentials: {
-          email: { label: "Email", type: "email" },
-          password: { label: "Password", type: "password" }
-        },
-        async authorize(credentials) {
-          const email = credentials?.email?.trim() ?? "";
-          if (!email || !credentials?.password) {
-            logAuth("authorize(credentials) rejected", { reason: "missing_email_or_password" });
-            return null;
-          }
-          try {
-            const user = await getUserByEmail(email);
-            if (!user) {
-              logAuth("authorize(credentials) rejected", { reason: "user_not_found", email });
-              return null;
-            }
-            if (user.blocked) {
-              logAuth("authorize(credentials) rejected", { reason: "blocked", email, userId: user.id });
-              return null;
-            }
-            if (user.deleted) {
-              logAuth("authorize(credentials) rejected", { reason: "deleted", email, userId: user.id });
-              return null;
-            }
-            if (!user.password) {
-              logAuth("authorize(credentials) rejected", { reason: "no_password", email, userId: user.id });
-              return null;
-            }
-            const valid = await comparePassword(credentials.password, user.password);
-            if (!valid) {
-              logAuth("authorize(credentials) rejected", { reason: "invalid_password", email, userId: user.id });
-              return null;
-            }
-            const sessionUser = sessionUserFromNextAuthUser(user);
-            logAuth("authorize(credentials) ok", summarizeSessionUserForLog(sessionUser));
-            return sessionUser;
-          } catch (err) {
-            console.error("[cms-auth] authorize error (credentials):", err instanceof Error ? err.message : err);
-            logAuth("authorize(credentials) error", {
-              email,
-              message: err instanceof Error ? err.message : String(err)
-            });
-            return null;
-          }
-        }
-      })
-    );
-  }
-  if (enableOtpLogin && authorizeOtp) {
-    providers.push(
-      CredentialsProvider({
-        id: "otp",
-        name: "otp",
-        credentials: {
-          identifier: { label: "Email or phone", type: "text" },
-          code: { label: "Code", type: "text" },
-          channel: { label: "Channel", type: "text" }
-        },
-        async authorize(credentials) {
-          const identifier = typeof credentials?.identifier === "string" ? credentials.identifier.trim() : "";
-          const code = typeof credentials?.code === "string" ? credentials.code.trim() : "";
-          const ch = credentials?.channel === "sms" ? "sms" : "email";
-          if (!identifier || !code) return null;
-          try {
-            const user = await authorizeOtp({ identifier, channel: ch, code });
-            if (!user || user.blocked || user.deleted) return null;
-            return sessionUserFromNextAuthUser(user);
-          } catch (err) {
-            console.error("[cms-auth] authorize error (otp):", err instanceof Error ? err.message : err);
-            return null;
-          }
-        }
-      })
-    );
-  }
-  const options = {
-    secret: secret ?? process.env.NEXTAUTH_SECRET,
-    providers,
-    session: { strategy: "jwt" },
-    pages: { signIn: signInPage },
-    cookies: {
-      sessionToken: {
-        name: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token",
-        options: {
-          httpOnly: true,
-          sameSite: "lax",
-          path: "/",
-          secure: process.env.NEXTAUTH_URL?.startsWith("https") ?? false
-        }
-      }
-    },
-    callbacks: {
-      async jwt({ token, user, trigger, session }) {
-        if (user) {
-          logAuth("jwt callback: new sign-in", {
-            trigger,
-            user: summarizeSessionUserForLog(user)
-          });
-          const u = user;
-          token.id = u.id;
-          token.groupId = u.groupId;
-          token.groupName = u.groupName;
-          token.isRBACAdmin = u.isRBACAdmin;
-          token.entityPerms = u.entityPerms;
-          token.adminAccess = u.adminAccess;
-          token.vendorIds = u.vendorIds;
-          token.activeVendorId = u.activeVendorId;
-          token.vendorRole = u.vendorRole;
-          token.isVendorPortal = u.isVendorPortal;
-          token.isVendorOwner = u.isVendorOwner;
-        }
-        if (trigger === "update" && session && typeof session === "object") {
-          logAuth("jwt callback: session update", { trigger });
-          const s = session;
-          const t = token;
-          if (typeof s.name === "string") t.name = s.name;
-          if (typeof s.email === "string") t.email = s.email;
-          if (typeof s.activeVendorId === "number") t.activeVendorId = s.activeVendorId;
-        }
-        return token;
-      },
-      async session({ session, token }) {
-        const t = token;
-        logAuth("session callback", {
-          tokenHasId: t.id != null,
-          tokenEmail: typeof t.email === "string" ? t.email : null,
-          sessionUser: summarizeSessionUserForLog(session.user)
-        });
-        if (session.user) {
-          if (typeof t.name === "string") session.user.name = t.name;
-          if (typeof t.email === "string") session.user.email = t.email;
-          session.user.id = t.id;
-          session.user.groupId = t.groupId;
-          session.user.groupName = t.groupName;
-          session.user.isRBACAdmin = t.isRBACAdmin;
-          session.user.entityPerms = t.entityPerms;
-          session.user.adminAccess = t.adminAccess;
-          session.user.vendorIds = t.vendorIds;
-          session.user.activeVendorId = t.activeVendorId;
-          session.user.vendorRole = t.vendorRole;
-          session.user.isVendorPortal = t.isVendorPortal;
-          session.user.isVendorOwner = t.isVendorOwner;
-        }
-        return session;
-      }
-    }
-  };
-  return extend ? extend(options) : options;
-}
-export {
-  ADMIN_GROUP_NAME,
-  OPEN_ENDPOINTS,
-  PERMISSION_REQUIRED_ENDPOINTS,
-  RBAC_ADMIN_ONLY_ENTITIES,
-  VENDOR_OWNER_GROUP_NAME,
-  VENDOR_SCOPED_STORE_ENTITIES,
-  VENDOR_STORE_RBAC_ENTITIES,
-  canManageRoles,
-  canManageVendorRoles,
-  canManageVendorTeam,
-  canOnboardVendors,
-  createAuthHelpers,
-  createCmsAuthBundle,
-  createCmsMiddleware,
-  defaultPublicApiMethods,
-  explainSessionEntityAccess,
-  getNextAuthOptions,
-  getPermissionableEntityKeys,
-  getRequiredPermission,
-  hasEntityPermission,
-  isAuthDebugClientEnabled,
-  isAuthDebugEnabled,
-  isOpenEndpoint,
-  isPlatformAdministrator,
-  isPublicMethod,
-  isRbacDebugEnabled,
-  isSuperAdminGroupName,
-  isVendorGroupName,
-  isVendorOwner,
-  isVendorPortalUser,
-  isVendorStaff,
-  logAuth,
-  logAuthClient,
-  logEntityAccessDecision,
-  logRbac,
-  nextAuthCookieDebugInfo,
-  permissionRowsToRecord,
-  resolveVendorScopeFromSessionUser,
-  seedAdministratorPermissions,
-  sessionHasEntityAccess,
-  summarizeEntityPerms,
-  summarizeSessionUserForLog,
-  vendorPortalFlagsFromUser
-};
-//# sourceMappingURL=auth.js.map
+export { createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeSessionUserForLog } from './chunk-EQPITOP6.js';
+export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, getRequiredPermission, isOpenEndpoint, isPublicMethod, sessionHasEntityAccess } from './chunk-6KPQWRFW.js';
+export { ADMIN_GROUP_NAME, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser } from './chunk-4TRPKBKO.js';
+import './chunk-SHUYVCID.js';