@infuro/cms-core 1.0.46 → 1.0.50

package/dist/chunk-RK5ETF2I.js

@@ -0,0 +1,434 @@
+import { explainSessionEntityAccess, isVendorPortalUser, logRbac } from './chunk-JIWUVQ6B.js';
+import { __name } from './chunk-SHUYVCID.js';
+import { IsNull } from 'typeorm';
+
+async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
+  const repo = dataSource.getRepository(contactsEntity);
+  const found = await repo.findOne({
+    where: {
+      email,
+      userId: IsNull(),
+      deleted: false
+    }
+  });
+  if (found) await repo.update(found.id, {
+    userId
+  });
+}
+__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
+
+// src/lib/ensure-customer-for-user.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+__name(normalizeEmail, "normalizeEmail");
+function pgErrorCode(err) {
+  if (!err || typeof err !== "object") return void 0;
+  const driver = err.driverError;
+  return driver?.code ?? err.code;
+}
+__name(pgErrorCode, "pgErrorCode");
+function normalizeCustomerPhone(phone) {
+  const p = typeof phone === "string" ? phone.trim() : "";
+  return p || null;
+}
+__name(normalizeCustomerPhone, "normalizeCustomerPhone");
+function isSyntheticCustomerPhone(phone) {
+  const p = String(phone ?? "").trim();
+  if (!p) return true;
+  if (p.startsWith("e-") || p.startsWith("u-")) return true;
+  if (p.includes("@")) return true;
+  return false;
+}
+__name(isSyntheticCustomerPhone, "isSyntheticCustomerPhone");
+function customerPhoneForUser(_userId, phone) {
+  return normalizeCustomerPhone(phone);
+}
+__name(customerPhoneForUser, "customerPhoneForUser");
+function customerPhoneForEmail(_email, phone) {
+  return normalizeCustomerPhone(phone);
+}
+__name(customerPhoneForEmail, "customerPhoneForEmail");
+function resolveNextPhone(inputPhone, existingPhone) {
+  if (inputPhone) return inputPhone;
+  const existing = normalizeCustomerPhone(existingPhone);
+  if (!existing || isSyntheticCustomerPhone(existing)) return null;
+  return existing;
+}
+__name(resolveNextPhone, "resolveNextPhone");
+async function ensureCustomerRecord(dsOrEm, customerEntity, input) {
+  const repo = dsOrEm.getRepository(customerEntity);
+  const email = normalizeEmail(input.email);
+  if (!email) return null;
+  const name = String(input.name ?? "").trim() || email.split("@")[0] || "Customer";
+  const userId = input.userId != null && Number.isFinite(Number(input.userId)) && Number(input.userId) > 0 ? Number(input.userId) : null;
+  const phone = normalizeCustomerPhone(input.phone);
+  let row = await repo.findOne({
+    where: {
+      email,
+      deleted: false
+    }
+  });
+  if (!row) {
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+  }
+  if (row) {
+    const existingUserId = row.userId;
+    if (userId != null && existingUserId != null && existingUserId !== userId) {
+      return null;
+    }
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    const patch = {
+      name,
+      phone: nextPhone,
+      deleted: false,
+      deletedAt: null,
+      deletedBy: null,
+      updatedAt: /* @__PURE__ */ new Date()
+    };
+    if (userId != null && existingUserId == null) {
+      patch.userId = userId;
+    }
+    await repo.update(row.id, patch);
+    return {
+      id: row.id
+    };
+  }
+  try {
+    const created = await repo.save(repo.create({
+      userId,
+      name,
+      email,
+      phone,
+      deleted: false
+    }));
+    return {
+      id: created.id
+    };
+  } catch (err) {
+    const code = pgErrorCode(err);
+    if (code === "25P02") throw err;
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+    if (row) {
+      const existingUserId = row.userId;
+      if (userId != null && existingUserId != null && existingUserId !== userId) return null;
+      await repo.update(row.id, {
+        name,
+        phone: resolveNextPhone(phone, row.phone),
+        ...userId != null && existingUserId == null ? {
+          userId
+        } : {},
+        deleted: false,
+        deletedAt: null,
+        deletedBy: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return {
+        id: row.id
+      };
+    }
+    if (code === "23505") return null;
+    throw err;
+  }
+}
+__name(ensureCustomerRecord, "ensureCustomerRecord");
+async function restoreCustomerRow(repo, row, user, name, email, phone) {
+  const id = row.id;
+  await repo.update(id, {
+    userId: user.id,
+    name,
+    email,
+    phone,
+    deleted: false,
+    deletedAt: null,
+    deletedBy: null,
+    updatedAt: /* @__PURE__ */ new Date()
+  });
+  return {
+    id
+  };
+}
+__name(restoreCustomerRow, "restoreCustomerRow");
+async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
+  const repo = dsOrEm.getRepository(customerEntity);
+  const email = normalizeEmail(user.email);
+  const name = String(user.name ?? "").trim() || email.split("@")[0] || "User";
+  const phone = normalizeCustomerPhone(overrides?.phone ?? user.phone);
+  let row = await repo.findOne({
+    where: {
+      userId: user.id,
+      deleted: false
+    }
+  });
+  if (row) {
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    await repo.update(row.id, {
+      name,
+      email,
+      phone: nextPhone,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    return {
+      id: row.id
+    };
+  }
+  row = await repo.findOne({
+    where: {
+      email,
+      deleted: false
+    }
+  });
+  if (row) {
+    const existingUserId = row.userId;
+    if (existingUserId != null && existingUserId !== user.id) {
+      return null;
+    }
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    await repo.update(row.id, {
+      userId: user.id,
+      name,
+      phone: nextPhone,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    return {
+      id: row.id
+    };
+  }
+  const deletedByEmail = await repo.findOne({
+    where: {
+      email
+    }
+  });
+  if (deletedByEmail) {
+    const existingUserId = deletedByEmail.userId;
+    if (existingUserId != null && existingUserId !== user.id) return null;
+    return restoreCustomerRow(repo, deletedByEmail, user, name, email, resolveNextPhone(phone, deletedByEmail.phone));
+  }
+  if (phone) {
+    const deletedByPhone = await repo.findOne({
+      where: {
+        phone
+      }
+    });
+    if (deletedByPhone) {
+      const existingUserId = deletedByPhone.userId;
+      if (existingUserId != null && existingUserId !== user.id) {
+        return ensureCustomerForUser(dsOrEm, customerEntity, user, {
+          phone: null
+        });
+      }
+      return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
+    }
+  }
+  try {
+    const created = await repo.save(repo.create({
+      userId: user.id,
+      name,
+      email,
+      phone,
+      deleted: false
+    }));
+    return {
+      id: created.id
+    };
+  } catch (err) {
+    const code = pgErrorCode(err);
+    if (code === "25P02") throw err;
+    row = await repo.findOne({
+      where: {
+        userId: user.id
+      }
+    });
+    if (row) {
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
+    }
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+    if (row && (row.userId ?? user.id) === user.id) {
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
+    }
+    if (code === "23505") return null;
+    throw err;
+  }
+}
+__name(ensureCustomerForUser, "ensureCustomerForUser");
+
+// src/auth/helpers.ts
+var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set([
+  "users",
+  "user_groups",
+  "permissions"
+]);
+function sessionHasEntityAccess(user, entity, action) {
+  return explainSessionEntityAccess(user, entity, action).allowed;
+}
+__name(sessionHasEntityAccess, "sessionHasEntityAccess");
+function canManageRoles(user) {
+  return !!(user?.email && user.isRBACAdmin);
+}
+__name(canManageRoles, "canManageRoles");
+var OPEN_ENDPOINTS = [
+  {
+    "/api/contacts": [
+      "POST"
+    ]
+  },
+  {
+    "/api/form-submissions": [
+      "POST"
+    ]
+  },
+  {
+    "/api/blogs": [
+      "GET"
+    ]
+  }
+];
+var PERMISSION_REQUIRED_ENDPOINTS = {};
+function isOpenEndpoint(pathname) {
+  return OPEN_ENDPOINTS.some((endpoint) => pathname.startsWith(Object.keys(endpoint)[0]));
+}
+__name(isOpenEndpoint, "isOpenEndpoint");
+function getRequiredPermission(pathname) {
+  return null;
+}
+__name(getRequiredPermission, "getRequiredPermission");
+function isPublicMethod(pathname, method) {
+  for (const endpoint of OPEN_ENDPOINTS) {
+    const key = Object.keys(endpoint)[0];
+    if (pathname.startsWith(key) && endpoint[key].includes(method)) return true;
+  }
+  return false;
+}
+__name(isPublicMethod, "isPublicMethod");
+function createAuthHelpers(getSession, NextResponse) {
+  return createAuthHelpersFromGetSession(getSession, NextResponse);
+}
+__name(createAuthHelpers, "createAuthHelpers");
+function createCmsAuthBundle(getSession, NextResponse) {
+  const auth = createAuthHelpers(getSession, NextResponse);
+  return {
+    requireAuth: auth.requireAuth,
+    requireAdminAccess: auth.requireAdminAccess,
+    requireEntityPermission: auth.requireEntityPermission,
+    getSessionUser: auth.getAuthenticatedUser,
+    getAuthenticatedUser: auth.getAuthenticatedUser
+  };
+}
+__name(createCmsAuthBundle, "createCmsAuthBundle");
+function createAuthHelpersFromGetSession(getSession, NextResponse) {
+  return {
+    async requireAuth(_req) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      return null;
+    },
+    async requirePermission(_req, _permission) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      return null;
+    },
+    async requireEntityPermission(_req, entity, action) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      const u = session.user;
+      const allowed = sessionHasEntityAccess(u, entity, action);
+      const { reason } = explainSessionEntityAccess(u, entity, action);
+      logRbac("authHelpers.requireEntityPermission", {
+        entity,
+        action,
+        allowed,
+        reason,
+        email: u.email,
+        groupName: u.groupName,
+        vendorIds: u.vendorIds,
+        isVendorPortal: u.isVendorPortal,
+        isVendorOwner: u.isVendorOwner
+      });
+      if (allowed) return null;
+      return NextResponse.json({
+        error: "Forbidden",
+        entity,
+        action,
+        reason
+      }, {
+        status: 403
+      });
+    },
+    async requireAdminAccess(_req) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      const u = session.user;
+      if (u.isRBACAdmin) return null;
+      if (isVendorPortalUser(u)) return null;
+      if (u.adminAccess === true) return null;
+      if (u.adminAccess === false) {
+        logRbac("requireAdminAccess denied (adminAccess:false)", {
+          email: u.email,
+          groupName: u.groupName,
+          isVendorPortal: u.isVendorPortal
+        });
+        return NextResponse.json({
+          error: "Forbidden",
+          reason: "admin_access"
+        }, {
+          status: 403
+        });
+      }
+      logRbac("requireAdminAccess denied (no matching rule)", {
+        email: u.email,
+        adminAccess: u.adminAccess,
+        groupName: u.groupName,
+        isVendorPortal: u.isVendorPortal
+      });
+      return NextResponse.json({
+        error: "Forbidden",
+        reason: "admin_access"
+      }, {
+        status: 403
+      });
+    },
+    async getAuthenticatedUser() {
+      const session = await getSession();
+      return session?.user ?? null;
+    }
+  };
+}
+__name(createAuthHelpersFromGetSession, "createAuthHelpersFromGetSession");
+
+export { OPEN_ENDPOINTS, PERMISSION_REQUIRED_ENDPOINTS, RBAC_ADMIN_ONLY_ENTITIES, canManageRoles, createAuthHelpers, createCmsAuthBundle, customerPhoneForEmail, customerPhoneForUser, ensureCustomerForUser, ensureCustomerRecord, getRequiredPermission, isOpenEndpoint, isPublicMethod, isSyntheticCustomerPhone, linkUnclaimedContactToUser, normalizeCustomerPhone, sessionHasEntityAccess };

package/dist/{chunk-SPQFNIYJ.cjs → chunk-TJ2MIQUT.cjs}

@@ -6,6 +6,7 @@ var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 var EVENT_ORDER_TEMPLATE_KEY = "eventOrderPlaced";
 var EVENT_ORDER_TEMPLATE_VARIABLES = [
   "eventName",
+  "vendorName",
   "eventSlug",
   "venue",
   "startDate",
@@ -17,7 +18,6 @@ var EVENT_ORDER_TEMPLATE_VARIABLES = [
   "customerPhone",
   "productNames",
   "trackUrl",
-  "qrImageUrl",
   "orderDetails",
   "orderDetailsHtml"
 ];
@@ -33,6 +33,7 @@ var EVENT_ORDER_WHATSAPP_PARAM_KEYS = [
 ];
 var EVENT_ORDER_TEMPLATE_VARIABLE_HINTS = {
   eventName: "Event title",
+  vendorName: "Vendor / store name",
   eventSlug: "Event URL slug",
   venue: "Venue name",
   startDate: "Formatted event start",
@@ -43,8 +44,7 @@ var EVENT_ORDER_TEMPLATE_VARIABLE_HINTS = {
   customerEmail: "Buyer email",
   customerPhone: "Buyer phone",
   productNames: "Comma-separated ticket names",
-  trackUrl: "Public order tracking link (QR destination)",
-  qrImageUrl: 'QR code image URL for email (use in <img src="\u2026">)',
+  trackUrl: "Public order tracking link",
   orderDetails: "Plain-text order summary with line items",
   orderDetailsHtml: "HTML order summary block",
   trackUrlWhatsApp: "Same as trackUrl \u2014 include in Meta template as last param"
@@ -60,10 +60,6 @@ var EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS = [
 {{orderDetailsHtml}}
 <p><strong>Venue:</strong> {{venue}}<br/>
 <strong>Date:</strong> {{startDate}}</p>
-<p>Show this QR code at the venue or scan to open your order:</p>
-<p style="text-align:center;margin:20px 0">
-  <img src="{{qrImageUrl}}" alt="Order QR" width="180" height="180" style="border:1px solid #e5e7eb;border-radius:8px" />
-</p>
 <p style="text-align:center"><a href="{{trackUrl}}">View order online</a></p>
 <p>We look forward to seeing you there.</p>`
   },