@infuro/cms-core 1.0.34 → 1.0.36

package/dist/chunk-KPKFNLQQ.cjs

@@ -0,0 +1,648 @@
+'use strict';
+
+var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
+
+// src/auth/permission-entities.ts
+var PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
+  "users",
+  "password_reset_tokens",
+  "user_groups",
+  "permissions",
+  "comments",
+  "form_fields",
+  "configs",
+  "knowledge_base_chunks",
+  "carts",
+  "cart_items",
+  "wishlists",
+  "wishlist_items",
+  "message_templates",
+  "order_notification_triggers",
+  "whatsapp_trigger_bindings",
+  "vendor_users",
+  "vendor_roles",
+  "vendor_role_permissions"
+]);
+var PERMISSION_LOGICAL_ENTITIES = [
+  "users",
+  "forms",
+  "form_submissions",
+  "dashboard",
+  "upload",
+  "settings",
+  "analytics",
+  "chat"
+];
+var ADMIN_GROUP_NAME = "Administrator";
+function isSuperAdminGroupName(name) {
+  return name === ADMIN_GROUP_NAME;
+}
+chunkUSNT2KNT_cjs.__name(isSuperAdminGroupName, "isSuperAdminGroupName");
+function getPermissionableEntityKeys(entityMap) {
+  const fromMap = Object.keys(entityMap).filter((k) => !PERMISSION_ENTITY_INTERNAL_EXCLUDE.has(k));
+  const logical = PERMISSION_LOGICAL_ENTITIES.filter((k) => !fromMap.includes(k));
+  return [
+    ...fromMap.sort(),
+    ...logical
+  ].filter((k, i, a) => a.indexOf(k) === i);
+}
+chunkUSNT2KNT_cjs.__name(getPermissionableEntityKeys, "getPermissionableEntityKeys");
+function permissionRowsToRecord(rows) {
+  const out = {};
+  if (!rows?.length) return out;
+  for (const p of rows) {
+    out[p.entity] = {
+      c: !!p.canCreate,
+      r: !!p.canRead,
+      u: !!p.canUpdate,
+      d: !!p.canDelete
+    };
+  }
+  return out;
+}
+chunkUSNT2KNT_cjs.__name(permissionRowsToRecord, "permissionRowsToRecord");
+function hasEntityPermission(record, entity, action) {
+  const p = record?.[entity];
+  if (!p) return false;
+  if (action === "create") return p.c;
+  if (action === "read") return p.r;
+  if (action === "update") return p.u;
+  return p.d;
+}
+chunkUSNT2KNT_cjs.__name(hasEntityPermission, "hasEntityPermission");
+
+// src/auth/role-helpers.ts
+var SUPER_ADMIN_GROUP_ID = 1;
+var VENDOR_ADMIN_GROUP_ID = 5;
+function isSuperAdmin(user) {
+  if (!user) return false;
+  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
+  if (user.isRBACAdmin === true) return true;
+  return isSuperAdminGroupName(user.groupName);
+}
+chunkUSNT2KNT_cjs.__name(isSuperAdmin, "isSuperAdmin");
+function isVendorAdmin(user) {
+  if (!user?.email || isSuperAdmin(user)) return false;
+  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
+  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  return isVendorGroupName(user.groupName);
+}
+chunkUSNT2KNT_cjs.__name(isVendorAdmin, "isVendorAdmin");
+
+// src/auth/vendor-scope.ts
+var DEFAULT_VENDOR_SLUG = "default";
+async function resolveDefaultVendorId(dataSource) {
+  try {
+    const rows = await dataSource.query(`SELECT id FROM vendors WHERE slug = $1 AND deleted = false LIMIT 1`, [
+      DEFAULT_VENDOR_SLUG
+    ]);
+    const id = rows[0]?.id;
+    return typeof id === "number" ? id : null;
+  } catch {
+    return null;
+  }
+}
+chunkUSNT2KNT_cjs.__name(resolveDefaultVendorId, "resolveDefaultVendorId");
+async function resolveDisabledMultiVendorScope(dataSource) {
+  const defaultVendorId = await resolveDefaultVendorId(dataSource);
+  if (defaultVendorId == null) return {
+    type: "deny"
+  };
+  return {
+    type: "vendor",
+    vendorId: defaultVendorId,
+    vendorIds: [
+      defaultVendorId
+    ]
+  };
+}
+chunkUSNT2KNT_cjs.__name(resolveDisabledMultiVendorScope, "resolveDisabledMultiVendorScope");
+var VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
+  "products",
+  "collections",
+  "brands",
+  "product_categories",
+  "orders",
+  "payments",
+  "taxes",
+  "attributes",
+  "vendor_customers",
+  "discounts",
+  "events",
+  "refund_policies"
+]);
+var VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
+  ...VENDOR_SCOPED_STORE_ENTITIES,
+  "order_discounts",
+  "order_addresses",
+  "event_products"
+]);
+var VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+function isVendorGroupName(name) {
+  if (!name?.trim()) return false;
+  const n = name.trim().toLowerCase();
+  return n === VENDOR_OWNER_GROUP_NAME.toLowerCase() || n.includes("vendor");
+}
+chunkUSNT2KNT_cjs.__name(isVendorGroupName, "isVendorGroupName");
+function isPlatformAdministrator(user) {
+  if (!user?.email) return false;
+  return isSuperAdmin(user);
+}
+chunkUSNT2KNT_cjs.__name(isPlatformAdministrator, "isPlatformAdministrator");
+function isVendorPortalUser(user) {
+  if (user?.isVendorPortal === true) return true;
+  if (!user?.email || isPlatformAdministrator(user)) return false;
+  if (isVendorAdmin(user)) return true;
+  return isVendorGroupName(user.groupName);
+}
+chunkUSNT2KNT_cjs.__name(isVendorPortalUser, "isVendorPortalUser");
+function isVendorStaff(user) {
+  return isVendorPortalUser(user);
+}
+chunkUSNT2KNT_cjs.__name(isVendorStaff, "isVendorStaff");
+function isVendorOwner(user) {
+  if (user?.isVendorOwner === true) return true;
+  if (!user?.email || isPlatformAdministrator(user)) return false;
+  if (user.isVendorRoleOwner === true) return true;
+  if (user.vendorRole === "staff") return false;
+  if (user.vendorRole === "owner") return true;
+  if (!isVendorPortalUser(user)) return false;
+  return user.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase();
+}
+chunkUSNT2KNT_cjs.__name(isVendorOwner, "isVendorOwner");
+function canManageVendorTeam(user) {
+  return isPlatformAdministrator(user) || isVendorOwner(user);
+}
+chunkUSNT2KNT_cjs.__name(canManageVendorTeam, "canManageVendorTeam");
+function canManageVendorRoles(user) {
+  return isPlatformAdministrator(user) || isVendorOwner(user);
+}
+chunkUSNT2KNT_cjs.__name(canManageVendorRoles, "canManageVendorRoles");
+function canOnboardVendors(user) {
+  return isPlatformAdministrator(user);
+}
+chunkUSNT2KNT_cjs.__name(canOnboardVendors, "canOnboardVendors");
+function resolveVendorScopeFromSessionUser(user) {
+  if (!user?.email) return {
+    type: "deny"
+  };
+  if (isPlatformAdministrator(user)) return {
+    type: "all"
+  };
+  const vendorIds = user.vendorIds ?? [];
+  if (vendorIds.length === 0) return {
+    type: "deny"
+  };
+  const preferred = user.activeVendorId ?? vendorIds[0];
+  const vendorId = vendorIds.includes(preferred) ? preferred : vendorIds[0];
+  return {
+    type: "vendor",
+    vendorId,
+    vendorIds
+  };
+}
+chunkUSNT2KNT_cjs.__name(resolveVendorScopeFromSessionUser, "resolveVendorScopeFromSessionUser");
+function vendorPortalFlagsFromUser(input) {
+  const vendorIds = input.vendorIds ?? [];
+  const isVendorPortal = !input.isRBACAdmin && (vendorIds.length > 0 || isVendorGroupName(input.groupName));
+  const isVendorOwner2 = isVendorPortal && (input.isVendorRoleOwner === true || input.vendorRole !== "staff" && (input.vendorRole === "owner" || input.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase()));
+  return {
+    isVendorPortal,
+    isVendorOwner: isVendorOwner2
+  };
+}
+chunkUSNT2KNT_cjs.__name(vendorPortalFlagsFromUser, "vendorPortalFlagsFromUser");
+
+// src/lib/vendor-role-defaults.ts
+var VENDOR_RBAC_ENTITIES = [
+  ...VENDOR_STORE_RBAC_ENTITIES,
+  "dashboard",
+  "settings",
+  "team",
+  "roles"
+];
+var STORE_ENTITIES = [
+  ...VENDOR_STORE_RBAC_ENTITIES
+];
+function full() {
+  return {
+    canCreate: true,
+    canRead: true,
+    canUpdate: true,
+    canDelete: true
+  };
+}
+chunkUSNT2KNT_cjs.__name(full, "full");
+function read() {
+  return {
+    canCreate: false,
+    canRead: true,
+    canUpdate: false,
+    canDelete: false
+  };
+}
+chunkUSNT2KNT_cjs.__name(read, "read");
+function none() {
+  return {
+    canCreate: false,
+    canRead: false,
+    canUpdate: false,
+    canDelete: false
+  };
+}
+chunkUSNT2KNT_cjs.__name(none, "none");
+function readUpdate() {
+  return {
+    canCreate: false,
+    canRead: true,
+    canUpdate: true,
+    canDelete: false
+  };
+}
+chunkUSNT2KNT_cjs.__name(readUpdate, "readUpdate");
+function storePerms(spec) {
+  const resolve = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((v) => {
+    if (v === "full") return full();
+    if (v === "read") return read();
+    if (v === "none") return none();
+    return v;
+  }, "resolve");
+  const out = {};
+  for (const entity of STORE_ENTITIES) {
+    out[entity] = resolve(spec[entity] ?? "none");
+  }
+  return out;
+}
+chunkUSNT2KNT_cjs.__name(storePerms, "storePerms");
+var DEFAULT_VENDOR_ROLE_DEFS = [
+  {
+    name: "Owner",
+    description: "Full store access and team/role management",
+    isSystem: true,
+    isOwnerRole: true,
+    permissions: {
+      ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
+        e,
+        "full"
+      ]))),
+      dashboard: read(),
+      settings: readUpdate(),
+      team: full(),
+      roles: full()
+    }
+  },
+  {
+    name: "Manager",
+    description: "Day-to-day store operations",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms({
+        products: "full",
+        collections: "full",
+        brands: "full",
+        product_categories: "full",
+        orders: "full",
+        vendor_customers: "full",
+        discounts: "full",
+        order_discounts: "full",
+        order_addresses: "full",
+        payments: "read",
+        taxes: "read",
+        attributes: "read"
+      }),
+      dashboard: read(),
+      settings: read(),
+      team: none(),
+      roles: none()
+    }
+  },
+  {
+    name: "Catalog Staff",
+    description: "Manage products and catalog content",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms({
+        products: "full",
+        collections: "full",
+        brands: "full",
+        product_categories: "full",
+        attributes: "full",
+        orders: "read",
+        vendor_customers: "read"
+      }),
+      dashboard: read(),
+      settings: none(),
+      team: none(),
+      roles: none()
+    }
+  },
+  {
+    name: "Fulfillment",
+    description: "Orders and fulfillment",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms({
+        products: "read",
+        orders: "full",
+        order_addresses: "full",
+        order_discounts: "read",
+        vendor_customers: "read"
+      }),
+      dashboard: read(),
+      settings: none(),
+      team: none(),
+      roles: none()
+    }
+  },
+  {
+    name: "Viewer",
+    description: "Read-only access to store data",
+    isSystem: true,
+    isOwnerRole: false,
+    permissions: {
+      ...storePerms(Object.fromEntries(STORE_ENTITIES.map((e) => [
+        e,
+        "read"
+      ]))),
+      dashboard: read(),
+      settings: none(),
+      team: none(),
+      roles: none()
+    }
+  }
+];
+var VENDOR_VIEWER_ROLE_NAME = "Viewer";
+
+// src/auth/rbac-debug.ts
+var LOG_PREFIX = "[cms-rbac]";
+function isRbacDebugEnabled() {
+  const v = process.env.CMS_RBAC_DEBUG?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+chunkUSNT2KNT_cjs.__name(isRbacDebugEnabled, "isRbacDebugEnabled");
+function logRbac(message, data) {
+  if (!isRbacDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX, message, data);
+  else console.info(LOG_PREFIX, message);
+}
+chunkUSNT2KNT_cjs.__name(logRbac, "logRbac");
+function summarizeEntityPerms(entityPerms) {
+  const out = {};
+  if (!entityPerms) return out;
+  for (const [entity, p] of Object.entries(entityPerms)) {
+    out[entity] = {
+      c: p.c,
+      r: p.r,
+      u: p.u,
+      d: p.d
+    };
+  }
+  return out;
+}
+chunkUSNT2KNT_cjs.__name(summarizeEntityPerms, "summarizeEntityPerms");
+function vendorPortalFallbackReason(user, entity, action) {
+  if (!isVendorPortalUser(user)) return null;
+  if (entity === "dashboard" && action === "read") return "vendor_portal_dashboard_fallback";
+  if (entity === "analytics" && action === "read") return "vendor_portal_analytics_fallback";
+  if (entity === "settings" && action === "read") return "vendor_portal_settings_read_fallback";
+  if (VENDOR_STORE_RBAC_ENTITIES.has(entity) && action === "read") return "vendor_portal_store_read_fallback";
+  return null;
+}
+chunkUSNT2KNT_cjs.__name(vendorPortalFallbackReason, "vendorPortalFallbackReason");
+function explainSessionEntityAccess(user, entity, action) {
+  const userSnapshot = {
+    email: user?.email ?? null,
+    id: user?.id ?? null,
+    groupId: user?.groupId ?? null,
+    groupName: user?.groupName ?? null,
+    isRBACAdmin: user?.isRBACAdmin ?? false,
+    adminAccess: user?.adminAccess ?? null,
+    vendorIds: user?.vendorIds ?? [],
+    activeVendorId: user?.activeVendorId ?? null,
+    vendorRole: user?.vendorRole ?? null,
+    vendorRoleId: user?.vendorRoleId ?? null,
+    vendorRoleName: user?.vendorRoleName ?? null,
+    isVendorRoleOwner: user?.isVendorRoleOwner ?? false,
+    vendorEntityPerms: summarizeEntityPerms(user?.vendorEntityPerms),
+    isVendorPortal: user?.isVendorPortal ?? false,
+    isVendorOwner: user?.isVendorOwner ?? false,
+    isVendorPortalComputed: isVendorPortalUser(user),
+    isVendorOwnerComputed: isVendorOwner(user),
+    jwtEntityPerms: summarizeEntityPerms(user?.entityPerms),
+    jwtEntityPermForTarget: user?.entityPerms?.[entity] ?? null
+  };
+  if (!user?.email) {
+    return {
+      allowed: false,
+      reason: "no_session_email",
+      userSnapshot
+    };
+  }
+  if (user.isRBACAdmin) {
+    return {
+      allowed: true,
+      reason: "platform_administrator",
+      userSnapshot
+    };
+  }
+  const vendorIds = user.vendorIds ?? [];
+  const isStaff = user.vendorRole === "staff";
+  const vendorPerms = user.vendorEntityPerms;
+  const hasVendorRolePerms = vendorPerms != null && Object.keys(vendorPerms).length > 0;
+  if (vendorIds.length > 0 && hasVendorRolePerms) {
+    const vendorRbacSet = new Set(VENDOR_RBAC_ENTITIES);
+    if (vendorRbacSet.has(entity) || entity === "analytics") {
+      if (entity === "analytics" && action === "read") {
+        const allowed3 = hasEntityPermission(vendorPerms, "dashboard", "read");
+        return {
+          allowed: allowed3,
+          reason: allowed3 ? "vendor_role_analytics_via_dashboard" : "vendor_role_analytics_denied",
+          userSnapshot
+        };
+      }
+      if (user.isVendorRoleOwner === true) {
+        return {
+          allowed: true,
+          reason: "vendor_owner_role_full",
+          userSnapshot
+        };
+      }
+      const allowed2 = hasEntityPermission(vendorPerms, entity, action);
+      return {
+        allowed: allowed2,
+        reason: allowed2 ? "vendor_role_permissions_allow" : "vendor_role_permissions_deny",
+        userSnapshot
+      };
+    }
+  }
+  if (vendorIds.length > 0) {
+    if (entity === "dashboard" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_link_dashboard_read",
+        userSnapshot
+      };
+    }
+    if (entity === "analytics" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_link_analytics_read",
+        userSnapshot
+      };
+    }
+    if (entity === "settings") {
+      if (action === "read") {
+        return {
+          allowed: true,
+          reason: "vendor_link_settings_read",
+          userSnapshot
+        };
+      }
+      if (action === "update" && !isStaff) {
+        return {
+          allowed: true,
+          reason: "vendor_link_settings_update",
+          userSnapshot
+        };
+      }
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      if (isStaff && action === "read") {
+        return {
+          allowed: true,
+          reason: "vendor_staff_store_read",
+          userSnapshot
+        };
+      }
+      if (!isStaff) {
+        return {
+          allowed: true,
+          reason: "vendor_link_store_full",
+          userSnapshot
+        };
+      }
+      return {
+        allowed: false,
+        reason: "vendor_staff_store_write_denied",
+        userSnapshot
+      };
+    }
+  }
+  if (isVendorPortalUser(user) && isVendorOwner(user)) {
+    if (entity === "dashboard" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_dashboard",
+        userSnapshot
+      };
+    }
+    if (entity === "analytics" && action === "read") {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_analytics",
+        userSnapshot
+      };
+    }
+    if (entity === "settings" && (action === "read" || action === "update")) {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_settings",
+        userSnapshot
+      };
+    }
+    if (VENDOR_STORE_RBAC_ENTITIES.has(entity)) {
+      return {
+        allowed: true,
+        reason: "vendor_owner_group_store",
+        userSnapshot
+      };
+    }
+  }
+  const vendorPortalReason = vendorPortalFallbackReason(user, entity, action);
+  if (vendorPortalReason) {
+    return {
+      allowed: true,
+      reason: vendorPortalReason,
+      userSnapshot
+    };
+  }
+  const explicit = user.entityPerms?.[entity];
+  if (explicit !== void 0) {
+    const allowed2 = hasEntityPermission(user.entityPerms, entity, action);
+    return {
+      allowed: allowed2,
+      reason: allowed2 ? "jwt_entity_perms_allow" : "jwt_entity_perms_deny",
+      userSnapshot
+    };
+  }
+  const allowed = hasEntityPermission(user.entityPerms, entity, action);
+  return {
+    allowed,
+    reason: allowed ? "entity_perms_fallback_allow" : "no_matching_rule",
+    userSnapshot
+  };
+}
+chunkUSNT2KNT_cjs.__name(explainSessionEntityAccess, "explainSessionEntityAccess");
+async function logEntityAccessDecision(dataSource, context, user, entity, action, extra) {
+  if (!isRbacDebugEnabled()) return;
+  const explanation = explainSessionEntityAccess(user, entity, action);
+  let dbPermissions;
+  if (dataSource && user?.id) {
+    const id = Number(user.id);
+    if (Number.isFinite(id)) {
+      try {
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-HWP65A4O.cjs');
+        dbPermissions = await loadDbPermissionsForUser(dataSource, id);
+      } catch (e) {
+        dbPermissions = {
+          error: e instanceof Error ? e.message : String(e)
+        };
+      }
+    }
+  }
+  logRbac(context, {
+    entity,
+    action,
+    allowed: explanation.allowed,
+    reason: explanation.reason,
+    ...explanation.userSnapshot,
+    dbPermissions,
+    ...extra
+  });
+}
+chunkUSNT2KNT_cjs.__name(logEntityAccessDecision, "logEntityAccessDecision");
+
+exports.ADMIN_GROUP_NAME = ADMIN_GROUP_NAME;
+exports.DEFAULT_VENDOR_ROLE_DEFS = DEFAULT_VENDOR_ROLE_DEFS;
+exports.SUPER_ADMIN_GROUP_ID = SUPER_ADMIN_GROUP_ID;
+exports.VENDOR_ADMIN_GROUP_ID = VENDOR_ADMIN_GROUP_ID;
+exports.VENDOR_OWNER_GROUP_NAME = VENDOR_OWNER_GROUP_NAME;
+exports.VENDOR_RBAC_ENTITIES = VENDOR_RBAC_ENTITIES;
+exports.VENDOR_SCOPED_STORE_ENTITIES = VENDOR_SCOPED_STORE_ENTITIES;
+exports.VENDOR_STORE_RBAC_ENTITIES = VENDOR_STORE_RBAC_ENTITIES;
+exports.VENDOR_VIEWER_ROLE_NAME = VENDOR_VIEWER_ROLE_NAME;
+exports.canManageVendorRoles = canManageVendorRoles;
+exports.canManageVendorTeam = canManageVendorTeam;
+exports.canOnboardVendors = canOnboardVendors;
+exports.explainSessionEntityAccess = explainSessionEntityAccess;
+exports.getPermissionableEntityKeys = getPermissionableEntityKeys;
+exports.hasEntityPermission = hasEntityPermission;
+exports.isPlatformAdministrator = isPlatformAdministrator;
+exports.isRbacDebugEnabled = isRbacDebugEnabled;
+exports.isSuperAdmin = isSuperAdmin;
+exports.isSuperAdminGroupName = isSuperAdminGroupName;
+exports.isVendorAdmin = isVendorAdmin;
+exports.isVendorGroupName = isVendorGroupName;
+exports.isVendorOwner = isVendorOwner;
+exports.isVendorPortalUser = isVendorPortalUser;
+exports.isVendorStaff = isVendorStaff;
+exports.logEntityAccessDecision = logEntityAccessDecision;
+exports.logRbac = logRbac;
+exports.permissionRowsToRecord = permissionRowsToRecord;
+exports.resolveDisabledMultiVendorScope = resolveDisabledMultiVendorScope;
+exports.resolveVendorScopeFromSessionUser = resolveVendorScopeFromSessionUser;
+exports.summarizeEntityPerms = summarizeEntityPerms;
+exports.vendorPortalFlagsFromUser = vendorPortalFlagsFromUser;