@infuro/cms-core 1.0.46 → 1.0.50

package/dist/{chunk-X47PBV4I.js → chunk-JE22VP6S.js}

@@ -59,6 +59,7 @@ async function emitOrderNotificationTrigger(triggerKey, orderId, deps, extra) {
     total: fo.total ?? 0,
     currency: String(fo.currency ?? "INR"),
     vendorId: fo.vendorId ?? null,
+    ...extra?.extraVariables ?? {},
     ...extra?.refundAmount != null ? {
       refundAmount: extra.refundAmount
     } : {}

package/dist/{chunk-DN65KDIA.js → chunk-JIWUVQ6B.js}

@@ -48,12 +48,13 @@ __name(getPermissionableEntityKeys, "getPermissionableEntityKeys");
 function permissionRowsToRecord(rows) {
   const out = {};
   if (!rows?.length) return out;
+  const flag = /* @__PURE__ */ __name((v) => v === true || v === 1 || v === "1" || v === "t" || v === "true", "flag");
   for (const p of rows) {
     out[p.entity] = {
-      c: !!p.canCreate,
-      r: !!p.canRead,
-      u: !!p.canUpdate,
-      d: !!p.canDelete
+      c: flag(p.canCreate),
+      r: flag(p.canRead),
+      u: flag(p.canUpdate),
+      d: flag(p.canDelete)
     };
   }
   return out;
@@ -136,11 +137,12 @@ var VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
   "order_addresses",
   "event_products"
 ]);
-var VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+var VENDOR_GROUP_NAME = "Vendor";
+var VENDOR_OWNER_GROUP_NAME = VENDOR_GROUP_NAME;
 function isVendorGroupName(name) {
   if (!name?.trim()) return false;
   const n = name.trim().toLowerCase();
-  return n === VENDOR_OWNER_GROUP_NAME.toLowerCase() || n.includes("vendor");
+  return n === "vendor" || n === "vendor owner" || n.includes("vendor");
 }
 __name(isVendorGroupName, "isVendorGroupName");
 function isPlatformAdministrator(user) {
@@ -163,10 +165,8 @@ function isVendorOwner(user) {
   if (user?.isVendorOwner === true) return true;
   if (!user?.email || isPlatformAdministrator(user)) return false;
   if (user.isVendorRoleOwner === true) return true;
-  if (user.vendorRole === "staff") return false;
   if (user.vendorRole === "owner") return true;
-  if (!isVendorPortalUser(user)) return false;
-  return user.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase();
+  return false;
 }
 __name(isVendorOwner, "isVendorOwner");
 function canManageVendorTeam(user) {
@@ -204,7 +204,7 @@ __name(resolveVendorScopeFromSessionUser, "resolveVendorScopeFromSessionUser");
 function vendorPortalFlagsFromUser(input) {
   const vendorIds = input.vendorIds ?? [];
   const isVendorPortal = !input.isRBACAdmin && (vendorIds.length > 0 || isVendorGroupName(input.groupName));
-  const isVendorOwner2 = isVendorPortal && (input.isVendorRoleOwner === true || input.vendorRole !== "staff" && (input.vendorRole === "owner" || input.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase()));
+  const isVendorOwner2 = isVendorPortal && (input.isVendorRoleOwner === true || input.vendorRole === "owner");
   return {
     isVendorPortal,
     isVendorOwner: isVendorOwner2
@@ -461,7 +461,8 @@ function explainSessionEntityAccess(user, entity, action) {
   const isStaff = user.vendorRole === "staff";
   const vendorPerms = user.vendorEntityPerms;
   const hasVendorRolePerms = vendorPerms != null && Object.keys(vendorPerms).length > 0;
-  if (vendorIds.length > 0 && hasVendorRolePerms) {
+  const enforceVendorRoleMatrix = vendorIds.length > 0 && (hasVendorRolePerms || user.vendorRoleId != null);
+  if (enforceVendorRoleMatrix) {
     const vendorRbacSet = new Set(VENDOR_RBAC_ENTITIES);
     if (vendorRbacSet.has(entity) || entity === "analytics") {
       if (entity === "analytics" && action === "read") {
@@ -603,7 +604,7 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
     const id = Number(user.id);
     if (Number.isFinite(id)) {
       try {
-        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-2SGNLANF.js');
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-6EMIVMGF.js');
         dbPermissions = await loadDbPermissionsForUser(dataSource, id);
       } catch (e) {
         dbPermissions = {
@@ -624,4 +625,4 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
 }
 __name(logEntityAccessDecision, "logEntityAccessDecision");
 
-export { ADMIN_GROUP_NAME, DEFAULT_VENDOR_ROLE_DEFS, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_OWNER_GROUP_NAME, VENDOR_RBAC_ENTITIES, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveDisabledMultiVendorScope, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser };
+export { ADMIN_GROUP_NAME, DEFAULT_VENDOR_ROLE_DEFS, SUPER_ADMIN_GROUP_ID, VENDOR_ADMIN_GROUP_ID, VENDOR_GROUP_NAME, VENDOR_OWNER_GROUP_NAME, VENDOR_RBAC_ENTITIES, VENDOR_SCOPED_STORE_ENTITIES, VENDOR_STORE_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, canManageVendorRoles, canManageVendorTeam, canOnboardVendors, explainSessionEntityAccess, getPermissionableEntityKeys, hasEntityPermission, isPlatformAdministrator, isRbacDebugEnabled, isSuperAdmin, isSuperAdminGroupName, isVendorAdmin, isVendorGroupName, isVendorOwner, isVendorPortalUser, isVendorStaff, logEntityAccessDecision, logRbac, permissionRowsToRecord, resolveDisabledMultiVendorScope, resolveVendorScopeFromSessionUser, summarizeEntityPerms, vendorPortalFlagsFromUser };

package/dist/{chunk-HT5DI3XW.cjs → chunk-KOTXDSQB.cjs}

@@ -61,6 +61,7 @@ async function emitOrderNotificationTrigger(triggerKey, orderId, deps, extra) {
     total: fo.total ?? 0,
     currency: String(fo.currency ?? "INR"),
     vendorId: fo.vendorId ?? null,
+    ...extra?.extraVariables ?? {},
     ...extra?.refundAmount != null ? {
       refundAmount: extra.refundAmount
     } : {}