@infuro/cms-core 1.0.46 → 1.0.50

package/dist/chunk-3EOM4V2M.cjs

@@ -0,0 +1,452 @@
+'use strict';
+
+var chunk77NUXO6A_cjs = require('./chunk-77NUXO6A.cjs');
+var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
+var typeorm = require('typeorm');
+
+async function linkUnclaimedContactToUser(dataSource, contactsEntity, userId, email) {
+  const repo = dataSource.getRepository(contactsEntity);
+  const found = await repo.findOne({
+    where: {
+      email,
+      userId: typeorm.IsNull(),
+      deleted: false
+    }
+  });
+  if (found) await repo.update(found.id, {
+    userId
+  });
+}
+chunkUSNT2KNT_cjs.__name(linkUnclaimedContactToUser, "linkUnclaimedContactToUser");
+
+// src/lib/ensure-customer-for-user.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+chunkUSNT2KNT_cjs.__name(normalizeEmail, "normalizeEmail");
+function pgErrorCode(err) {
+  if (!err || typeof err !== "object") return void 0;
+  const driver = err.driverError;
+  return driver?.code ?? err.code;
+}
+chunkUSNT2KNT_cjs.__name(pgErrorCode, "pgErrorCode");
+function normalizeCustomerPhone(phone) {
+  const p = typeof phone === "string" ? phone.trim() : "";
+  return p || null;
+}
+chunkUSNT2KNT_cjs.__name(normalizeCustomerPhone, "normalizeCustomerPhone");
+function isSyntheticCustomerPhone(phone) {
+  const p = String(phone ?? "").trim();
+  if (!p) return true;
+  if (p.startsWith("e-") || p.startsWith("u-")) return true;
+  if (p.includes("@")) return true;
+  return false;
+}
+chunkUSNT2KNT_cjs.__name(isSyntheticCustomerPhone, "isSyntheticCustomerPhone");
+function customerPhoneForUser(_userId, phone) {
+  return normalizeCustomerPhone(phone);
+}
+chunkUSNT2KNT_cjs.__name(customerPhoneForUser, "customerPhoneForUser");
+function customerPhoneForEmail(_email, phone) {
+  return normalizeCustomerPhone(phone);
+}
+chunkUSNT2KNT_cjs.__name(customerPhoneForEmail, "customerPhoneForEmail");
+function resolveNextPhone(inputPhone, existingPhone) {
+  if (inputPhone) return inputPhone;
+  const existing = normalizeCustomerPhone(existingPhone);
+  if (!existing || isSyntheticCustomerPhone(existing)) return null;
+  return existing;
+}
+chunkUSNT2KNT_cjs.__name(resolveNextPhone, "resolveNextPhone");
+async function ensureCustomerRecord(dsOrEm, customerEntity, input) {
+  const repo = dsOrEm.getRepository(customerEntity);
+  const email = normalizeEmail(input.email);
+  if (!email) return null;
+  const name = String(input.name ?? "").trim() || email.split("@")[0] || "Customer";
+  const userId = input.userId != null && Number.isFinite(Number(input.userId)) && Number(input.userId) > 0 ? Number(input.userId) : null;
+  const phone = normalizeCustomerPhone(input.phone);
+  let row = await repo.findOne({
+    where: {
+      email,
+      deleted: false
+    }
+  });
+  if (!row) {
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+  }
+  if (row) {
+    const existingUserId = row.userId;
+    if (userId != null && existingUserId != null && existingUserId !== userId) {
+      return null;
+    }
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    const patch = {
+      name,
+      phone: nextPhone,
+      deleted: false,
+      deletedAt: null,
+      deletedBy: null,
+      updatedAt: /* @__PURE__ */ new Date()
+    };
+    if (userId != null && existingUserId == null) {
+      patch.userId = userId;
+    }
+    await repo.update(row.id, patch);
+    return {
+      id: row.id
+    };
+  }
+  try {
+    const created = await repo.save(repo.create({
+      userId,
+      name,
+      email,
+      phone,
+      deleted: false
+    }));
+    return {
+      id: created.id
+    };
+  } catch (err) {
+    const code = pgErrorCode(err);
+    if (code === "25P02") throw err;
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+    if (row) {
+      const existingUserId = row.userId;
+      if (userId != null && existingUserId != null && existingUserId !== userId) return null;
+      await repo.update(row.id, {
+        name,
+        phone: resolveNextPhone(phone, row.phone),
+        ...userId != null && existingUserId == null ? {
+          userId
+        } : {},
+        deleted: false,
+        deletedAt: null,
+        deletedBy: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      return {
+        id: row.id
+      };
+    }
+    if (code === "23505") return null;
+    throw err;
+  }
+}
+chunkUSNT2KNT_cjs.__name(ensureCustomerRecord, "ensureCustomerRecord");
+async function restoreCustomerRow(repo, row, user, name, email, phone) {
+  const id = row.id;
+  await repo.update(id, {
+    userId: user.id,
+    name,
+    email,
+    phone,
+    deleted: false,
+    deletedAt: null,
+    deletedBy: null,
+    updatedAt: /* @__PURE__ */ new Date()
+  });
+  return {
+    id
+  };
+}
+chunkUSNT2KNT_cjs.__name(restoreCustomerRow, "restoreCustomerRow");
+async function ensureCustomerForUser(dsOrEm, customerEntity, user, overrides) {
+  const repo = dsOrEm.getRepository(customerEntity);
+  const email = normalizeEmail(user.email);
+  const name = String(user.name ?? "").trim() || email.split("@")[0] || "User";
+  const phone = normalizeCustomerPhone(overrides?.phone ?? user.phone);
+  let row = await repo.findOne({
+    where: {
+      userId: user.id,
+      deleted: false
+    }
+  });
+  if (row) {
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    await repo.update(row.id, {
+      name,
+      email,
+      phone: nextPhone,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    return {
+      id: row.id
+    };
+  }
+  row = await repo.findOne({
+    where: {
+      email,
+      deleted: false
+    }
+  });
+  if (row) {
+    const existingUserId = row.userId;
+    if (existingUserId != null && existingUserId !== user.id) {
+      return null;
+    }
+    const nextPhone = resolveNextPhone(phone, row.phone);
+    await repo.update(row.id, {
+      userId: user.id,
+      name,
+      phone: nextPhone,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    return {
+      id: row.id
+    };
+  }
+  const deletedByEmail = await repo.findOne({
+    where: {
+      email
+    }
+  });
+  if (deletedByEmail) {
+    const existingUserId = deletedByEmail.userId;
+    if (existingUserId != null && existingUserId !== user.id) return null;
+    return restoreCustomerRow(repo, deletedByEmail, user, name, email, resolveNextPhone(phone, deletedByEmail.phone));
+  }
+  if (phone) {
+    const deletedByPhone = await repo.findOne({
+      where: {
+        phone
+      }
+    });
+    if (deletedByPhone) {
+      const existingUserId = deletedByPhone.userId;
+      if (existingUserId != null && existingUserId !== user.id) {
+        return ensureCustomerForUser(dsOrEm, customerEntity, user, {
+          phone: null
+        });
+      }
+      return restoreCustomerRow(repo, deletedByPhone, user, name, email, phone);
+    }
+  }
+  try {
+    const created = await repo.save(repo.create({
+      userId: user.id,
+      name,
+      email,
+      phone,
+      deleted: false
+    }));
+    return {
+      id: created.id
+    };
+  } catch (err) {
+    const code = pgErrorCode(err);
+    if (code === "25P02") throw err;
+    row = await repo.findOne({
+      where: {
+        userId: user.id
+      }
+    });
+    if (row) {
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
+    }
+    row = await repo.findOne({
+      where: {
+        email
+      }
+    });
+    if (row && (row.userId ?? user.id) === user.id) {
+      return restoreCustomerRow(repo, row, user, name, email, resolveNextPhone(phone, row.phone));
+    }
+    if (code === "23505") return null;
+    throw err;
+  }
+}
+chunkUSNT2KNT_cjs.__name(ensureCustomerForUser, "ensureCustomerForUser");
+
+// src/auth/helpers.ts
+var RBAC_ADMIN_ONLY_ENTITIES = /* @__PURE__ */ new Set([
+  "users",
+  "user_groups",
+  "permissions"
+]);
+function sessionHasEntityAccess(user, entity, action) {
+  return chunk77NUXO6A_cjs.explainSessionEntityAccess(user, entity, action).allowed;
+}
+chunkUSNT2KNT_cjs.__name(sessionHasEntityAccess, "sessionHasEntityAccess");
+function canManageRoles(user) {
+  return !!(user?.email && user.isRBACAdmin);
+}
+chunkUSNT2KNT_cjs.__name(canManageRoles, "canManageRoles");
+var OPEN_ENDPOINTS = [
+  {
+    "/api/contacts": [
+      "POST"
+    ]
+  },
+  {
+    "/api/form-submissions": [
+      "POST"
+    ]
+  },
+  {
+    "/api/blogs": [
+      "GET"
+    ]
+  }
+];
+var PERMISSION_REQUIRED_ENDPOINTS = {};
+function isOpenEndpoint(pathname) {
+  return OPEN_ENDPOINTS.some((endpoint) => pathname.startsWith(Object.keys(endpoint)[0]));
+}
+chunkUSNT2KNT_cjs.__name(isOpenEndpoint, "isOpenEndpoint");
+function getRequiredPermission(pathname) {
+  return null;
+}
+chunkUSNT2KNT_cjs.__name(getRequiredPermission, "getRequiredPermission");
+function isPublicMethod(pathname, method) {
+  for (const endpoint of OPEN_ENDPOINTS) {
+    const key = Object.keys(endpoint)[0];
+    if (pathname.startsWith(key) && endpoint[key].includes(method)) return true;
+  }
+  return false;
+}
+chunkUSNT2KNT_cjs.__name(isPublicMethod, "isPublicMethod");
+function createAuthHelpers(getSession, NextResponse) {
+  return createAuthHelpersFromGetSession(getSession, NextResponse);
+}
+chunkUSNT2KNT_cjs.__name(createAuthHelpers, "createAuthHelpers");
+function createCmsAuthBundle(getSession, NextResponse) {
+  const auth = createAuthHelpers(getSession, NextResponse);
+  return {
+    requireAuth: auth.requireAuth,
+    requireAdminAccess: auth.requireAdminAccess,
+    requireEntityPermission: auth.requireEntityPermission,
+    getSessionUser: auth.getAuthenticatedUser,
+    getAuthenticatedUser: auth.getAuthenticatedUser
+  };
+}
+chunkUSNT2KNT_cjs.__name(createCmsAuthBundle, "createCmsAuthBundle");
+function createAuthHelpersFromGetSession(getSession, NextResponse) {
+  return {
+    async requireAuth(_req) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      return null;
+    },
+    async requirePermission(_req, _permission) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      return null;
+    },
+    async requireEntityPermission(_req, entity, action) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      const u = session.user;
+      const allowed = sessionHasEntityAccess(u, entity, action);
+      const { reason } = chunk77NUXO6A_cjs.explainSessionEntityAccess(u, entity, action);
+      chunk77NUXO6A_cjs.logRbac("authHelpers.requireEntityPermission", {
+        entity,
+        action,
+        allowed,
+        reason,
+        email: u.email,
+        groupName: u.groupName,
+        vendorIds: u.vendorIds,
+        isVendorPortal: u.isVendorPortal,
+        isVendorOwner: u.isVendorOwner
+      });
+      if (allowed) return null;
+      return NextResponse.json({
+        error: "Forbidden",
+        entity,
+        action,
+        reason
+      }, {
+        status: 403
+      });
+    },
+    async requireAdminAccess(_req) {
+      const session = await getSession();
+      if (!session?.user?.email) {
+        return NextResponse.json({
+          error: "Unauthorized"
+        }, {
+          status: 401
+        });
+      }
+      const u = session.user;
+      if (u.isRBACAdmin) return null;
+      if (chunk77NUXO6A_cjs.isVendorPortalUser(u)) return null;
+      if (u.adminAccess === true) return null;
+      if (u.adminAccess === false) {
+        chunk77NUXO6A_cjs.logRbac("requireAdminAccess denied (adminAccess:false)", {
+          email: u.email,
+          groupName: u.groupName,
+          isVendorPortal: u.isVendorPortal
+        });
+        return NextResponse.json({
+          error: "Forbidden",
+          reason: "admin_access"
+        }, {
+          status: 403
+        });
+      }
+      chunk77NUXO6A_cjs.logRbac("requireAdminAccess denied (no matching rule)", {
+        email: u.email,
+        adminAccess: u.adminAccess,
+        groupName: u.groupName,
+        isVendorPortal: u.isVendorPortal
+      });
+      return NextResponse.json({
+        error: "Forbidden",
+        reason: "admin_access"
+      }, {
+        status: 403
+      });
+    },
+    async getAuthenticatedUser() {
+      const session = await getSession();
+      return session?.user ?? null;
+    }
+  };
+}
+chunkUSNT2KNT_cjs.__name(createAuthHelpersFromGetSession, "createAuthHelpersFromGetSession");
+
+exports.OPEN_ENDPOINTS = OPEN_ENDPOINTS;
+exports.PERMISSION_REQUIRED_ENDPOINTS = PERMISSION_REQUIRED_ENDPOINTS;
+exports.RBAC_ADMIN_ONLY_ENTITIES = RBAC_ADMIN_ONLY_ENTITIES;
+exports.canManageRoles = canManageRoles;
+exports.createAuthHelpers = createAuthHelpers;
+exports.createCmsAuthBundle = createCmsAuthBundle;
+exports.customerPhoneForEmail = customerPhoneForEmail;
+exports.customerPhoneForUser = customerPhoneForUser;
+exports.ensureCustomerForUser = ensureCustomerForUser;
+exports.ensureCustomerRecord = ensureCustomerRecord;
+exports.getRequiredPermission = getRequiredPermission;
+exports.isOpenEndpoint = isOpenEndpoint;
+exports.isPublicMethod = isPublicMethod;
+exports.isSyntheticCustomerPhone = isSyntheticCustomerPhone;
+exports.linkUnclaimedContactToUser = linkUnclaimedContactToUser;
+exports.normalizeCustomerPhone = normalizeCustomerPhone;
+exports.sessionHasEntityAccess = sessionHasEntityAccess;

package/dist/{chunk-X6UQFV4X.cjs → chunk-77NUXO6A.cjs}

@@ -50,12 +50,13 @@ chunkUSNT2KNT_cjs.__name(getPermissionableEntityKeys, "getPermissionableEntityKe
 function permissionRowsToRecord(rows) {
   const out = {};
   if (!rows?.length) return out;
+  const flag = /* @__PURE__ */ chunkUSNT2KNT_cjs.__name((v) => v === true || v === 1 || v === "1" || v === "t" || v === "true", "flag");
   for (const p of rows) {
     out[p.entity] = {
-      c: !!p.canCreate,
-      r: !!p.canRead,
-      u: !!p.canUpdate,
-      d: !!p.canDelete
+      c: flag(p.canCreate),
+      r: flag(p.canRead),
+      u: flag(p.canUpdate),
+      d: flag(p.canDelete)
     };
   }
   return out;
@@ -138,11 +139,12 @@ var VENDOR_STORE_RBAC_ENTITIES = /* @__PURE__ */ new Set([
   "order_addresses",
   "event_products"
 ]);
-var VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+var VENDOR_GROUP_NAME = "Vendor";
+var VENDOR_OWNER_GROUP_NAME = VENDOR_GROUP_NAME;
 function isVendorGroupName(name) {
   if (!name?.trim()) return false;
   const n = name.trim().toLowerCase();
-  return n === VENDOR_OWNER_GROUP_NAME.toLowerCase() || n.includes("vendor");
+  return n === "vendor" || n === "vendor owner" || n.includes("vendor");
 }
 chunkUSNT2KNT_cjs.__name(isVendorGroupName, "isVendorGroupName");
 function isPlatformAdministrator(user) {
@@ -165,10 +167,8 @@ function isVendorOwner(user) {
   if (user?.isVendorOwner === true) return true;
   if (!user?.email || isPlatformAdministrator(user)) return false;
   if (user.isVendorRoleOwner === true) return true;
-  if (user.vendorRole === "staff") return false;
   if (user.vendorRole === "owner") return true;
-  if (!isVendorPortalUser(user)) return false;
-  return user.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase();
+  return false;
 }
 chunkUSNT2KNT_cjs.__name(isVendorOwner, "isVendorOwner");
 function canManageVendorTeam(user) {
@@ -206,7 +206,7 @@ chunkUSNT2KNT_cjs.__name(resolveVendorScopeFromSessionUser, "resolveVendorScopeF
 function vendorPortalFlagsFromUser(input) {
   const vendorIds = input.vendorIds ?? [];
   const isVendorPortal = !input.isRBACAdmin && (vendorIds.length > 0 || isVendorGroupName(input.groupName));
-  const isVendorOwner2 = isVendorPortal && (input.isVendorRoleOwner === true || input.vendorRole !== "staff" && (input.vendorRole === "owner" || input.groupName?.trim().toLowerCase() === VENDOR_OWNER_GROUP_NAME.toLowerCase()));
+  const isVendorOwner2 = isVendorPortal && (input.isVendorRoleOwner === true || input.vendorRole === "owner");
   return {
     isVendorPortal,
     isVendorOwner: isVendorOwner2
@@ -463,7 +463,8 @@ function explainSessionEntityAccess(user, entity, action) {
   const isStaff = user.vendorRole === "staff";
   const vendorPerms = user.vendorEntityPerms;
   const hasVendorRolePerms = vendorPerms != null && Object.keys(vendorPerms).length > 0;
-  if (vendorIds.length > 0 && hasVendorRolePerms) {
+  const enforceVendorRoleMatrix = vendorIds.length > 0 && (hasVendorRolePerms || user.vendorRoleId != null);
+  if (enforceVendorRoleMatrix) {
     const vendorRbacSet = new Set(VENDOR_RBAC_ENTITIES);
     if (vendorRbacSet.has(entity) || entity === "analytics") {
       if (entity === "analytics" && action === "read") {
@@ -605,7 +606,7 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
     const id = Number(user.id);
     if (Number.isFinite(id)) {
       try {
-        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-4Z6A425H.cjs');
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-6PWTLBEL.cjs');
         dbPermissions = await loadDbPermissionsForUser(dataSource, id);
       } catch (e) {
         dbPermissions = {
@@ -630,6 +631,7 @@ exports.ADMIN_GROUP_NAME = ADMIN_GROUP_NAME;
 exports.DEFAULT_VENDOR_ROLE_DEFS = DEFAULT_VENDOR_ROLE_DEFS;
 exports.SUPER_ADMIN_GROUP_ID = SUPER_ADMIN_GROUP_ID;
 exports.VENDOR_ADMIN_GROUP_ID = VENDOR_ADMIN_GROUP_ID;
+exports.VENDOR_GROUP_NAME = VENDOR_GROUP_NAME;
 exports.VENDOR_OWNER_GROUP_NAME = VENDOR_OWNER_GROUP_NAME;
 exports.VENDOR_RBAC_ENTITIES = VENDOR_RBAC_ENTITIES;
 exports.VENDOR_SCOPED_STORE_ENTITIES = VENDOR_SCOPED_STORE_ENTITIES;

package/dist/{chunk-KFFB6EMZ.js → chunk-AYERBA7I.js}

@@ -4,6 +4,7 @@ import { __name } from './chunk-SHUYVCID.js';
 var EVENT_ORDER_TEMPLATE_KEY = "eventOrderPlaced";
 var EVENT_ORDER_TEMPLATE_VARIABLES = [
   "eventName",
+  "vendorName",
   "eventSlug",
   "venue",
   "startDate",
@@ -15,7 +16,6 @@ var EVENT_ORDER_TEMPLATE_VARIABLES = [
   "customerPhone",
   "productNames",
   "trackUrl",
-  "qrImageUrl",
   "orderDetails",
   "orderDetailsHtml"
 ];
@@ -31,6 +31,7 @@ var EVENT_ORDER_WHATSAPP_PARAM_KEYS = [
 ];
 var EVENT_ORDER_TEMPLATE_VARIABLE_HINTS = {
   eventName: "Event title",
+  vendorName: "Vendor / store name",
   eventSlug: "Event URL slug",
   venue: "Venue name",
   startDate: "Formatted event start",
@@ -41,8 +42,7 @@ var EVENT_ORDER_TEMPLATE_VARIABLE_HINTS = {
   customerEmail: "Buyer email",
   customerPhone: "Buyer phone",
   productNames: "Comma-separated ticket names",
-  trackUrl: "Public order tracking link (QR destination)",
-  qrImageUrl: 'QR code image URL for email (use in <img src="\u2026">)',
+  trackUrl: "Public order tracking link",
   orderDetails: "Plain-text order summary with line items",
   orderDetailsHtml: "HTML order summary block",
   trackUrlWhatsApp: "Same as trackUrl \u2014 include in Meta template as last param"
@@ -58,10 +58,6 @@ var EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS = [
 {{orderDetailsHtml}}
 <p><strong>Venue:</strong> {{venue}}<br/>
 <strong>Date:</strong> {{startDate}}</p>
-<p>Show this QR code at the venue or scan to open your order:</p>
-<p style="text-align:center;margin:20px 0">
-  <img src="{{qrImageUrl}}" alt="Order QR" width="180" height="180" style="border:1px solid #e5e7eb;border-radius:8px" />
-</p>
 <p style="text-align:center"><a href="{{trackUrl}}">View order online</a></p>
 <p>We look forward to seeing you there.</p>`
   },

package/dist/chunk-EIZKW2PF.js

@@ -0,0 +1,13 @@
+import { __name } from './chunk-SHUYVCID.js';
+import React from 'react';
+
+function ForceLightMode() {
+  return React.createElement("script", {
+    dangerouslySetInnerHTML: {
+      __html: `(function(){try{var r=document.documentElement,b=document.body;if(r){r.classList.remove('dark');r.style.colorScheme='light';}if(b){b.classList.remove('dark');b.style.colorScheme='light';}}catch(e){}})();`
+    }
+  });
+}
+__name(ForceLightMode, "ForceLightMode");
+
+export { ForceLightMode };