@infuro/cms-core 1.0.41 → 1.0.43

package/dist/{chunk-ETZN4OQI.cjs → chunk-TAHX46EI.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkWMXPKKXU_cjs = require('./chunk-WMXPKKXU.cjs');
+var chunkX6UQFV4X_cjs = require('./chunk-X6UQFV4X.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 var jwt = require('next-auth/jwt');
 var _CredentialsProvider = require('next-auth/providers/credentials');
@@ -11,12 +11,12 @@ var _CredentialsProvider__default = /*#__PURE__*/_interopDefault(_CredentialsPro
 
 // src/auth/seed-permissions.ts
 async function seedAdministratorPermissions(dataSource, entityMap) {
-  const entities = chunkWMXPKKXU_cjs.getPermissionableEntityKeys(entityMap);
+  const entities = chunkX6UQFV4X_cjs.getPermissionableEntityKeys(entityMap);
   const groupRepo = dataSource.getRepository(entityMap.user_groups);
   const permRepo = dataSource.getRepository(entityMap.permissions);
   const adminGroup = await groupRepo.findOne({
     where: {
-      name: chunkWMXPKKXU_cjs.ADMIN_GROUP_NAME,
+      name: chunkX6UQFV4X_cjs.ADMIN_GROUP_NAME,
       deleted: false
     }
   });
@@ -299,18 +299,18 @@ async function checkMultiVendorEnabledViaSettingsApi() {
 chunkUSNT2KNT_cjs.__name(checkMultiVendorEnabledViaSettingsApi, "checkMultiVendorEnabledViaSettingsApi");
 function sessionUserFromNextAuthUser(user) {
   const g = user.group;
-  const isRBACAdmin = chunkWMXPKKXU_cjs.isSuperAdmin({
+  const isRBACAdmin = chunkX6UQFV4X_cjs.isSuperAdmin({
     groupId: user.groupId ?? void 0,
     groupName: g?.name,
     isRBACAdmin: false
   });
-  const entityPerms = chunkWMXPKKXU_cjs.permissionRowsToRecord(g?.permissions);
+  const entityPerms = chunkX6UQFV4X_cjs.permissionRowsToRecord(g?.permissions);
   const rawAdminAccess = user.adminAccess;
   const adminAccess = rawAdminAccess === true ? true : rawAdminAccess === false ? false : void 0;
   const vendorIds = user.vendorIds ?? [];
   const vendorRole = user.vendorRole ?? null;
   const isVendorRoleOwner = user.isVendorRoleOwner ?? false;
-  const { isVendorPortal, isVendorOwner: isVendorOwner2 } = chunkWMXPKKXU_cjs.vendorPortalFlagsFromUser({
+  const { isVendorPortal, isVendorOwner: isVendorOwner2 } = chunkX6UQFV4X_cjs.vendorPortalFlagsFromUser({
     email: user.email,
     isRBACAdmin,
     groupName: g?.name,

package/dist/{chunk-WMXPKKXU.cjs → chunk-X6UQFV4X.cjs}

@@ -409,6 +409,9 @@ function vendorPortalFallbackReason(user, entity, action) {
   if (entity === "dashboard" && action === "read") return "vendor_portal_dashboard_fallback";
   if (entity === "analytics" && action === "read") return "vendor_portal_analytics_fallback";
   if (entity === "settings" && action === "read") return "vendor_portal_settings_read_fallback";
+  if (entity === "upload" && (action === "create" || action === "read")) {
+    return "vendor_portal_upload_fallback";
+  }
   if (VENDOR_STORE_RBAC_ENTITIES.has(entity) && action === "read") return "vendor_portal_store_read_fallback";
   return null;
 }
@@ -449,6 +452,13 @@ function explainSessionEntityAccess(user, entity, action) {
       userSnapshot
     };
   }
+  if ((isVendorPortalUser(user) || (user.vendorIds?.length ?? 0) > 0) && entity === "upload" && (action === "create" || action === "read")) {
+    return {
+      allowed: true,
+      reason: "vendor_portal_upload",
+      userSnapshot
+    };
+  }
   const vendorIds = user.vendorIds ?? [];
   const isStaff = user.vendorRole === "staff";
   const vendorPerms = user.vendorEntityPerms;
@@ -595,7 +605,7 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
     const id = Number(user.id);
     if (Number.isFinite(id)) {
       try {
-        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-KHG4FJC3.cjs');
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-4Z6A425H.cjs');
         dbPermissions = await loadDbPermissionsForUser(dataSource, id);
       } catch (e) {
         dbPermissions = {

package/dist/{chunk-OIGCAGH7.cjs → chunk-ZMRQ72F6.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkWMXPKKXU_cjs = require('./chunk-WMXPKKXU.cjs');
+var chunkX6UQFV4X_cjs = require('./chunk-X6UQFV4X.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 
 // src/auth/helpers.ts
@@ -10,7 +10,7 @@ var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set([
   "permissions"
 ]);
 function sessionHasEntityAccess(user, entity, action) {
-  return chunkWMXPKKXU_cjs.explainSessionEntityAccess(user, entity, action).allowed;
+  return chunkX6UQFV4X_cjs.explainSessionEntityAccess(user, entity, action).allowed;
 }
 chunkUSNT2KNT_cjs.__name(sessionHasEntityAccess, "sessionHasEntityAccess");
 function canManageRoles(user) {
@@ -101,8 +101,8 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
       }
       const u = session.user;
       const allowed = sessionHasEntityAccess(u, entity, action);
-      const { reason } = chunkWMXPKKXU_cjs.explainSessionEntityAccess(u, entity, action);
-      chunkWMXPKKXU_cjs.logRbac("authHelpers.requireEntityPermission", {
+      const { reason } = chunkX6UQFV4X_cjs.explainSessionEntityAccess(u, entity, action);
+      chunkX6UQFV4X_cjs.logRbac("authHelpers.requireEntityPermission", {
         entity,
         action,
         allowed,
@@ -134,10 +134,10 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
       }
       const u = session.user;
       if (u.isRBACAdmin) return null;
-      if (chunkWMXPKKXU_cjs.isVendorPortalUser(u)) return null;
+      if (chunkX6UQFV4X_cjs.isVendorPortalUser(u)) return null;
       if (u.adminAccess === true) return null;
       if (u.adminAccess === false) {
-        chunkWMXPKKXU_cjs.logRbac("requireAdminAccess denied (adminAccess:false)", {
+        chunkX6UQFV4X_cjs.logRbac("requireAdminAccess denied (adminAccess:false)", {
           email: u.email,
           groupName: u.groupName,
           isVendorPortal: u.isVendorPortal
@@ -149,7 +149,7 @@ function createAuthHelpersFromGetSession(getSession, NextResponse) {
           status: 403
         });
       }
-      chunkWMXPKKXU_cjs.logRbac("requireAdminAccess denied (no matching rule)", {
+      chunkX6UQFV4X_cjs.logRbac("requireAdminAccess denied (no matching rule)", {
         email: u.email,
         adminAccess: u.adminAccess,
         groupName: u.groupName,