@infuro/cms-core 1.0.45 → 1.0.47

package/dist/{chunk-I6NH72MO.js → chunk-YC4NUZCS.js}

@@ -1,4 +1,4 @@
-import { getPermissionableEntityKeys, ADMIN_GROUP_NAME, isSuperAdmin, permissionRowsToRecord, vendorPortalFlagsFromUser } from './chunk-DN65KDIA.js';
+import { getPermissionableEntityKeys, ADMIN_GROUP_NAME, isSuperAdmin, permissionRowsToRecord, vendorPortalFlagsFromUser } from './chunk-JIWUVQ6B.js';
 import { __name } from './chunk-SHUYVCID.js';
 import { getToken } from 'next-auth/jwt';
 import _CredentialsProvider from 'next-auth/providers/credentials';
@@ -399,6 +399,14 @@ function getNextAuthOptions(config) {
             });
             return null;
           }
+          if (user.inviteStatus === "pending") {
+            logAuth("authorize(credentials) rejected", {
+              reason: "invite_pending",
+              email,
+              userId: user.id
+            });
+            return null;
+          }
           if (user.deleted) {
             logAuth("authorize(credentials) rejected", {
               reason: "deleted",
@@ -488,7 +496,7 @@ function getNextAuthOptions(config) {
             channel: ch,
             code
           });
-          if (!user || user.blocked || user.deleted) return null;
+          if (!user || user.blocked || user.inviteStatus === "pending" || user.deleted) return null;
           if (isCustomerGroupUser(user) && !permitsCustomerLogin(allowCustomerLogin, creds)) {
             logAuth("authorize(otp) rejected", {
               reason: "customer_group",