@infuro/cms-core 1.0.35 → 1.0.38

package/dist/{chunk-TIAEXJLI.cjs → chunk-OIGCAGH7.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk3KPNTQBV_cjs = require('./chunk-3KPNTQBV.cjs');
+var chunkWMXPKKXU_cjs = require('./chunk-WMXPKKXU.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 
 // src/auth/helpers.ts
@@ -10,7 +10,7 @@ var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set([
   "permissions"
 ]);
 function sessionHasEntityAccess(user, entity, action) {
-  return chunk3KPNTQBV_cjs.explainSessionEntityAccess(user, entity, action).allowed;
+  return chunkWMXPKKXU_cjs.explainSessionEntityAccess(user, entity, action).allowed;
 }
 chunkUSNT2KNT_cjs.__name(sessionHasEntityAccess, "sessionHasEntityAccess");
 function canManageRoles(user) {
@@ -101,8 +101,8 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
       }
       const u = session.user;
       const allowed = sessionHasEntityAccess(u, entity, action);
-      const { reason } = chunk3KPNTQBV_cjs.explainSessionEntityAccess(u, entity, action);
-      chunk3KPNTQBV_cjs.logRbac("authHelpers.requireEntityPermission", {
+      const { reason } = chunkWMXPKKXU_cjs.explainSessionEntityAccess(u, entity, action);
+      chunkWMXPKKXU_cjs.logRbac("authHelpers.requireEntityPermission", {
         entity,
         action,
         allowed,
@@ -134,10 +134,10 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
       }
       const u = session.user;
       if (u.isRBACAdmin) return null;
-      if (chunk3KPNTQBV_cjs.isVendorPortalUser(u)) return null;
+      if (chunkWMXPKKXU_cjs.isVendorPortalUser(u)) return null;
       if (u.adminAccess === true) return null;
       if (u.adminAccess === false) {
-        chunk3KPNTQBV_cjs.logRbac("requireAdminAccess denied (adminAccess:false)", {
+        chunkWMXPKKXU_cjs.logRbac("requireAdminAccess denied (adminAccess:false)", {
           email: u.email,
           groupName: u.groupName,
           isVendorPortal: u.isVendorPortal
@@ -149,7 +149,7 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
           status: 403
         });
       }
-      chunk3KPNTQBV_cjs.logRbac("requireAdminAccess denied (no matching rule)", {
+      chunkWMXPKKXU_cjs.logRbac("requireAdminAccess denied (no matching rule)", {
         email: u.email,
         adminAccess: u.adminAccess,
         groupName: u.groupName,

package/dist/{chunk-4TRPKBKO.js → chunk-P7QCLE5W.js}

@@ -15,6 +15,8 @@ var PERMISSION_ENTITY_INTERNAL_EXCLUDE = /* @__PURE__ */ new Set([
   "wishlists",
   "wishlist_items",
   "message_templates",
+  "order_notification_triggers",
+  "order_notification_bindings",
   "vendor_users",
   "vendor_roles",
   "vendor_role_permissions"
@@ -67,7 +69,52 @@ function hasEntityPermission(record, entity, action) {
 }
 __name(hasEntityPermission, "hasEntityPermission");
 
+// src/auth/role-helpers.ts
+var SUPER_ADMIN_GROUP_ID = 1;
+var VENDOR_ADMIN_GROUP_ID = 5;
+function isSuperAdmin(user) {
+  if (!user) return false;
+  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
+  if (user.isRBACAdmin === true) return true;
+  return isSuperAdminGroupName(user.groupName);
+}
+__name(isSuperAdmin, "isSuperAdmin");
+function isVendorAdmin(user) {
+  if (!user?.email || isSuperAdmin(user)) return false;
+  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
+  if ((user.vendorIds?.length ?? 0) > 0) return true;
+  return isVendorGroupName(user.groupName);
+}
+__name(isVendorAdmin, "isVendorAdmin");
+
 // src/auth/vendor-scope.ts
+var DEFAULT_VENDOR_SLUG = "default";
+async function resolveDefaultVendorId(dataSource) {
+  try {
+    const rows = await dataSource.query(`SELECT id FROM vendors WHERE slug = $1 AND deleted = false LIMIT 1`, [
+      DEFAULT_VENDOR_SLUG
+    ]);
+    const id = rows[0]?.id;
+    return typeof id === "number" ? id : null;
+  } catch {
+    return null;
+  }
+}
+__name(resolveDefaultVendorId, "resolveDefaultVendorId");
+async function resolveDisabledMultiVendorScope(dataSource) {
+  const defaultVendorId = await resolveDefaultVendorId(dataSource);
+  if (defaultVendorId == null) return {
+    type: "deny"
+  };
+  return {
+    type: "vendor",
+    vendorId: defaultVendorId,
+    vendorIds: [
+      defaultVendorId
+    ]
+  };
+}
+__name(resolveDisabledMultiVendorScope, "resolveDisabledMultiVendorScope");
 var VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
   "products",
   "collections",
@@ -80,7 +127,8 @@ var VENDOR_SCOPED_STORE_ENTITIES = /* @__PURE__ */ new Set([
   "vendor_customers",
   "discounts",
   "events",
-  "refund_policies"
+  "refund_policies",
+  "combos"
 ]);
 var VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
   ...VENDOR_SCOPED_STORE_ENTITIES,
@@ -164,24 +212,6 @@ function vendorPortalFlagsFromUser(input) {
 }
 __name(vendorPortalFlagsFromUser, "vendorPortalFlagsFromUser");
 
-// src/auth/role-helpers.ts
-var SUPER_ADMIN_GROUP_ID = 1;
-var VENDOR_ADMIN_GROUP_ID = 5;
-function isSuperAdmin(user) {
-  if (!user) return false;
-  if (user.groupId === SUPER_ADMIN_GROUP_ID) return true;
-  if (user.isRBACAdmin === true) return true;
-  return isSuperAdminGroupName(user.groupName);
-}
-__name(isSuperAdmin, "isSuperAdmin");
-function isVendorAdmin(user) {
-  if (!user?.email || isSuperAdmin(user)) return false;
-  if (user.groupId === VENDOR_ADMIN_GROUP_ID) return true;
-  if ((user.vendorIds?.length ?? 0) > 0) return true;
-  return isVendorGroupName(user.groupName);
-}
-__name(isVendorAdmin, "isVendorAdmin");
-
 // src/lib/vendor-role-defaults.ts
 var VENDOR_RBAC_ENTITIES = [
   ...VENDOR_STORE_RBAC_ENTITIES,
@@ -349,9 +379,7 @@ var VENDOR_VIEWER_ROLE_NAME = "Viewer";
 var LOG_PREFIX = "[cms-rbac]";
 function isRbacDebugEnabled() {
   const v = process.env.CMS_RBAC_DEBUG?.trim().toLowerCase();
-  if (v === "1" || v === "true" || v === "yes") return true;
-  if (v === "0" || v === "false" || v === "no") return false;
-  return process.env.NODE_ENV === "development";
+  return v === "1" || v === "true" || v === "yes";
 }
 __name(isRbacDebugEnabled, "isRbacDebugEnabled");
 function logRbac(message, data) {
@@ -565,7 +593,7 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
     const id = Number(user.id);
     if (Number.isFinite(id)) {
       try {
-        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-MTCTVNNM.js');
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-QWHOENBR.js');
         dbPermissions = await loadDbPermissionsForUser(dataSource, id);
       } catch (e) {
         dbPermissions = {
@@ -586,4 +614,4 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
 }
 __name(logEntityAccessDecision, "logEntityAccessDecision");
 
-export { ADMIN_GROUP_NAME, DEFAULT_VENDOR_ROLE_DEFS, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_RBAC_ENTITIES, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, DEFAULT_VENDOR_ROLE_DEFS, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_RBAC_ENTITIES, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveDisabledMultiVendorScope, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser };