@infuro/cms-core 1.0.47 → 1.0.50

package/dist/{chunk-YC4NUZCS.js → chunk-WRKV6MHB.js}

@@ -1,7 +1,10 @@
+import { linkUnclaimedContactToUser, ensureCustomerForUser } from './chunk-RK5ETF2I.js';
+import { retireSoftDeletedUniqueValue } from './chunk-DBPSJYLZ.js';
 import { getPermissionableEntityKeys, ADMIN_GROUP_NAME, isSuperAdmin, permissionRowsToRecord, vendorPortalFlagsFromUser } from './chunk-JIWUVQ6B.js';
 import { __name } from './chunk-SHUYVCID.js';
 import { getToken } from 'next-auth/jwt';
 import _CredentialsProvider from 'next-auth/providers/credentials';
+import _GoogleProvider from 'next-auth/providers/google';
 
 // src/auth/seed-permissions.ts
 async function seedAdministratorPermissions(dataSource, entityMap) {
@@ -129,6 +132,10 @@ var defaultPublicApiMethods = {
   "/api/users/invite": [
     "GET",
     "POST"
+  ],
+  /** Public keys only (e.g. googleEnabled); secrets stay private in the settings handler. */
+  "/api/settings/auth_providers": [
+    "GET"
   ]
 };
 function legacyGetSessionToken(request) {
@@ -234,7 +241,281 @@ function createCmsMiddleware(config = {}) {
   }, "cmsMiddleware");
 }
 __name(createCmsMiddleware, "createCmsMiddleware");
+
+// src/auth/auth-providers-settings.ts
+var AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
+function parseEnabled(raw) {
+  if (typeof raw === "boolean") return raw;
+  if (typeof raw === "number") return raw !== 0;
+  if (typeof raw === "string") {
+    const n = raw.trim().toLowerCase();
+    return n === "true" || n === "1" || n === "yes" || n === "on";
+  }
+  return false;
+}
+__name(parseEnabled, "parseEnabled");
+function resolveSettingsEncryptionKey() {
+  if (typeof process === "undefined") return void 0;
+  return process.env.SETTINGS_ENCRYPTION_KEY?.trim() || process.env.NEXTAUTH_SECRET?.trim() || void 0;
+}
+__name(resolveSettingsEncryptionKey, "resolveSettingsEncryptionKey");
+function decryptSettingValue(encoded, key) {
+  const buf = Buffer.from(encoded, "base64");
+  const keyBuf = Buffer.from(key.padEnd(32, "0").slice(0, 32), "utf8");
+  const out = Buffer.alloc(buf.length);
+  for (let i = 0; i < buf.length; i++) out[i] = buf[i] ^ keyBuf[i % keyBuf.length];
+  return out.toString("utf8");
+}
+__name(decryptSettingValue, "decryptSettingValue");
+async function loadAuthProvidersSettingsFromDb(dataSource, entityMap, encryptionKey) {
+  if (!entityMap.configs) return {};
+  const key = encryptionKey ?? resolveSettingsEncryptionKey();
+  const rows = await dataSource.getRepository(entityMap.configs).find({
+    where: {
+      settings: AUTH_PROVIDERS_SETTINGS_GROUP,
+      deleted: false
+    }
+  });
+  const out = {};
+  for (const row of rows) {
+    let val = row.value;
+    if (row.encrypted && key) {
+      try {
+        val = decryptSettingValue(val, key);
+      } catch {
+      }
+    }
+    out[row.key] = val;
+  }
+  return out;
+}
+__name(loadAuthProvidersSettingsFromDb, "loadAuthProvidersSettingsFromDb");
+function fromSettingsMap(map) {
+  const clientId = String(map.googleClientId ?? map.GOOGLE_CLIENT_ID ?? "").trim();
+  const clientSecret = String(map.googleClientSecret ?? map.GOOGLE_CLIENT_SECRET ?? "").trim();
+  const enabledFlag = map.googleEnabled !== void 0 && map.googleEnabled !== "" ? parseEnabled(map.googleEnabled) : parseEnabled(map.enabled);
+  if (!enabledFlag || !clientId || !clientSecret) return null;
+  return {
+    enabled: true,
+    clientId,
+    clientSecret
+  };
+}
+__name(fromSettingsMap, "fromSettingsMap");
+function fromEnv() {
+  const env = typeof process !== "undefined" ? process.env : void 0;
+  if (!env) return null;
+  const clientId = String(env.GOOGLE_CLIENT_ID ?? "").trim();
+  const clientSecret = String(env.GOOGLE_CLIENT_SECRET ?? "").trim();
+  const enabledRaw = env.GOOGLE_AUTH_ENABLED;
+  const enabled = enabledRaw === void 0 || enabledRaw === "" ? Boolean(clientId && clientSecret) : parseEnabled(enabledRaw);
+  if (!enabled || !clientId || !clientSecret) return null;
+  return {
+    enabled: true,
+    clientId,
+    clientSecret
+  };
+}
+__name(fromEnv, "fromEnv");
+async function resolveGoogleAuthConfig(input = {}) {
+  if (input.settings) {
+    const fromExplicit = fromSettingsMap(input.settings);
+    if (fromExplicit?.enabled) {
+      logAuth("resolveGoogleAuthConfig: from explicit settings", {
+        enabled: true
+      });
+      return fromExplicit;
+    }
+  }
+  if (input.dataSource && input.entityMap?.configs) {
+    try {
+      const map = await loadAuthProvidersSettingsFromDb(input.dataSource, input.entityMap, input.encryptionKey);
+      const fromDb = fromSettingsMap(map);
+      if (fromDb?.enabled) {
+        logAuth("resolveGoogleAuthConfig: from DB settings", {
+          enabled: true
+        });
+        return fromDb;
+      }
+      if (map.googleEnabled !== void 0 || map.googleClientId !== void 0) {
+        logAuth("resolveGoogleAuthConfig: DB present but incomplete/disabled", {
+          googleEnabled: map.googleEnabled ?? null,
+          hasClientId: Boolean(String(map.googleClientId ?? "").trim()),
+          hasClientSecret: Boolean(String(map.googleClientSecret ?? "").trim())
+        });
+      }
+    } catch (err) {
+      logAuth("resolveGoogleAuthConfig: DB load failed", {
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  if (!input.skipEnvFallback) {
+    const envCfg = fromEnv();
+    if (envCfg) {
+      logAuth("resolveGoogleAuthConfig: from env", {
+        enabled: true
+      });
+      return envCfg;
+    }
+  }
+  return null;
+}
+__name(resolveGoogleAuthConfig, "resolveGoogleAuthConfig");
+function googleOAuthRedirectUri(baseUrl) {
+  const base = (baseUrl ?? process.env.NEXTAUTH_URL ?? "").replace(/\/$/, "");
+  return base ? `${base}/api/auth/callback/google` : "/api/auth/callback/google";
+}
+__name(googleOAuthRedirectUri, "googleOAuthRedirectUri");
+function isGoogleAuthPubliclyEnabled(settings) {
+  if (!settings) return false;
+  if (settings.googleEnabled !== void 0 && settings.googleEnabled !== "") {
+    return parseEnabled(settings.googleEnabled);
+  }
+  return parseEnabled(settings.enabled);
+}
+__name(isGoogleAuthPubliclyEnabled, "isGoogleAuthPubliclyEnabled");
+
+// src/auth/create-google-customer.ts
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+__name(normalizeEmail, "normalizeEmail");
+async function createCustomerUserFromGoogleOAuth(input) {
+  const email = normalizeEmail(input.email);
+  if (!email || !input.entityMap.users || !input.entityMap.user_groups) {
+    logAuth("createCustomerUserFromGoogleOAuth skipped", {
+      reason: "missing_email_or_entities",
+      hasUsers: Boolean(input.entityMap.users),
+      hasGroups: Boolean(input.entityMap.user_groups)
+    });
+    return null;
+  }
+  const userRepo = input.dataSource.getRepository(input.entityMap.users);
+  const groupRepo = input.dataSource.getRepository(input.entityMap.user_groups);
+  try {
+    await retireSoftDeletedUniqueValue(userRepo, "email", email);
+  } catch {
+  }
+  const existing = await userRepo.findOne({
+    where: {
+      email,
+      deleted: false
+    },
+    relations: [
+      "group",
+      "group.permissions"
+    ]
+  });
+  if (existing) {
+    return existing;
+  }
+  const customerG = await groupRepo.findOne({
+    where: {
+      name: "Customer",
+      deleted: false
+    }
+  });
+  const groupId = customerG ? Number(customerG.id) : null;
+  if (!Number.isFinite(groupId) || groupId == null) {
+    logAuth("createCustomerUserFromGoogleOAuth failed", {
+      reason: "customer_group_missing",
+      email
+    });
+    return null;
+  }
+  const displayName = typeof input.name === "string" && input.name.trim() || email.split("@")[0] || "Customer";
+  try {
+    const created = await userRepo.save(userRepo.create({
+      name: displayName,
+      email,
+      password: null,
+      blocked: false,
+      adminAccess: false,
+      groupId,
+      inviteStatus: "active",
+      inviteToken: null,
+      emailVerifiedAt: /* @__PURE__ */ new Date()
+    }));
+    const userId = Number(created.id);
+    if (!Number.isFinite(userId)) {
+      logAuth("createCustomerUserFromGoogleOAuth failed", {
+        reason: "invalid_id",
+        email
+      });
+      return null;
+    }
+    if (input.entityMap.contacts) {
+      try {
+        await linkUnclaimedContactToUser(input.dataSource, input.entityMap.contacts, userId, email);
+      } catch {
+      }
+    }
+    if (input.entityMap.customer) {
+      try {
+        await ensureCustomerForUser(input.dataSource, input.entityMap.customer, {
+          id: userId,
+          name: displayName,
+          email,
+          phone: null
+        }, {
+          phone: null
+        });
+      } catch {
+      }
+    }
+    const loaded = await userRepo.findOne({
+      where: {
+        id: userId
+      },
+      relations: [
+        "group",
+        "group.permissions"
+      ]
+    });
+    if (!loaded) {
+      logAuth("createCustomerUserFromGoogleOAuth failed", {
+        reason: "reload_failed",
+        email,
+        userId
+      });
+      return null;
+    }
+    logAuth("createCustomerUserFromGoogleOAuth ok", {
+      email,
+      userId
+    });
+    return loaded;
+  } catch (err) {
+    const raced = await userRepo.findOne({
+      where: {
+        email,
+        deleted: false
+      },
+      relations: [
+        "group",
+        "group.permissions"
+      ]
+    });
+    if (raced) {
+      logAuth("createCustomerUserFromGoogleOAuth raced_to_existing", {
+        email,
+        userId: raced.id
+      });
+      return raced;
+    }
+    logAuth("createCustomerUserFromGoogleOAuth error", {
+      email,
+      message: err instanceof Error ? err.message : String(err)
+    });
+    return null;
+  }
+}
+__name(createCustomerUserFromGoogleOAuth, "createCustomerUserFromGoogleOAuth");
+
+// src/auth/nextauth-options.ts
 var CredentialsProvider = _CredentialsProvider.default ?? _CredentialsProvider;
+var GoogleProvider = _GoogleProvider.default ?? _GoogleProvider;
 function parseBooleanSetting(value) {
   if (typeof value === "boolean") return value;
   if (typeof value === "number") return value !== 0;
@@ -356,8 +637,12 @@ function permitsCustomerLogin(allowCustomerLogin, credentials) {
   return !callbackUrlTargetsAdmin(callbackUrl);
 }
 __name(permitsCustomerLogin, "permitsCustomerLogin");
+function applySessionUserToAuthUser(target, sessionUser) {
+  Object.assign(target, sessionUser);
+}
+__name(applySessionUserToAuthUser, "applySessionUserToAuthUser");
 function getNextAuthOptions(config) {
-  const { getUserByEmail, comparePassword, signInPage = "/admin/signin", secret, extend, enablePasswordLogin = true, enableOtpLogin = false, authorizeOtp, allowCustomerLogin } = config;
+  const { getUserByEmail, comparePassword, signInPage = "/admin/signin", secret, extend, enablePasswordLogin = true, enableOtpLogin = false, authorizeOtp, allowCustomerLogin, google, createCustomerUserFromGoogle } = config;
   logAuth("getNextAuthOptions init", nextAuthCookieDebugInfo());
   const providers = [];
   if (enablePasswordLogin) {
@@ -513,6 +798,14 @@ function getNextAuthOptions(config) {
       }
     }));
   }
+  if (google?.enabled && google.clientId && google.clientSecret) {
+    providers.push(GoogleProvider({
+      clientId: google.clientId,
+      clientSecret: google.clientSecret,
+      allowDangerousEmailAccountLinking: true
+    }));
+    logAuth("getNextAuthOptions: GoogleProvider registered");
+  }
   const options = {
     secret: secret ?? process.env.NEXTAUTH_SECRET,
     providers,
@@ -534,6 +827,94 @@ function getNextAuthOptions(config) {
       }
     },
     callbacks: {
+      async signIn({ user, account, profile }) {
+        if (account?.provider !== "google") return true;
+        const emailRaw = typeof user?.email === "string" && user.email || (profile && typeof profile.email === "string" ? profile.email : "");
+        const email = emailRaw.trim().toLowerCase();
+        if (!email) {
+          logAuth("signIn(google) rejected", {
+            reason: "missing_email"
+          });
+          return false;
+        }
+        try {
+          let dbUser = await getUserByEmail(email);
+          if (!dbUser && allowCustomerLogin === true && createCustomerUserFromGoogle) {
+            const profileName = typeof user?.name === "string" && user.name || (profile && typeof profile.name === "string" ? profile.name : null);
+            dbUser = await createCustomerUserFromGoogle({
+              email,
+              name: profileName
+            });
+            if (dbUser) {
+              logAuth("signIn(google) created customer", {
+                email,
+                userId: dbUser.id
+              });
+            }
+          }
+          if (!dbUser) {
+            logAuth("signIn(google) rejected", {
+              reason: "user_not_found",
+              email
+            });
+            return false;
+          }
+          if (dbUser.blocked) {
+            logAuth("signIn(google) rejected", {
+              reason: "blocked",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          if (dbUser.inviteStatus === "pending") {
+            logAuth("signIn(google) rejected", {
+              reason: "invite_pending",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          if (dbUser.deleted) {
+            logAuth("signIn(google) rejected", {
+              reason: "deleted",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          if (isCustomerGroupUser(dbUser) && allowCustomerLogin !== true) {
+            logAuth("signIn(google) rejected", {
+              reason: "customer_group",
+              email,
+              userId: dbUser.id
+            });
+            return false;
+          }
+          const sessionUser = sessionUserFromNextAuthUser(dbUser);
+          if (sessionUser.isVendorPortal && !sessionUser.isRBACAdmin) {
+            const multiVendorEnabled = await checkMultiVendorEnabledViaSettingsApi();
+            if (!multiVendorEnabled) {
+              logAuth("signIn(google) rejected", {
+                reason: "multi_vendor_disabled",
+                email,
+                userId: dbUser.id
+              });
+              return false;
+            }
+          }
+          applySessionUserToAuthUser(user, sessionUser);
+          logAuth("signIn(google) ok", summarizeSessionUserForLog(sessionUser));
+          return true;
+        } catch (err) {
+          console.error("[cms-auth] signIn error (google):", err instanceof Error ? err.message : err);
+          logAuth("signIn(google) error", {
+            email,
+            message: err instanceof Error ? err.message : String(err)
+          });
+          return false;
+        }
+      },
       async jwt({ token, user, trigger, session }) {
         if (user) {
           logAuth("jwt callback: new sign-in", {
@@ -602,6 +983,30 @@ function getNextAuthOptions(config) {
   return extend ? extend(options) : options;
 }
 __name(getNextAuthOptions, "getNextAuthOptions");
+async function buildNextAuthOptions(config) {
+  const { dataSource, entityMap, settingsEncryptionKey, googleResolve, google, createCustomerUserFromGoogle, ...rest } = config;
+  const resolved = google ?? await resolveGoogleAuthConfig({
+    dataSource,
+    entityMap,
+    encryptionKey: settingsEncryptionKey,
+    ...googleResolve
+  });
+  let createCustomer = createCustomerUserFromGoogle;
+  if (!createCustomer && rest.allowCustomerLogin === true && dataSource && entityMap && entityMap.users && entityMap.user_groups) {
+    createCustomer = /* @__PURE__ */ __name((input) => createCustomerUserFromGoogleOAuth({
+      dataSource,
+      entityMap,
+      email: input.email,
+      name: input.name
+    }), "createCustomer");
+  }
+  return getNextAuthOptions({
+    ...rest,
+    google: resolved,
+    createCustomerUserFromGoogle: createCustomer
+  });
+}
+__name(buildNextAuthOptions, "buildNextAuthOptions");
 function getStorefrontNextAuthOptions(config) {
   return getNextAuthOptions({
     ...config,
@@ -609,5 +1014,12 @@ function getStorefrontNextAuthOptions(config) {
   });
 }
 __name(getStorefrontNextAuthOptions, "getStorefrontNextAuthOptions");
+async function buildStorefrontNextAuthOptions(config) {
+  return buildNextAuthOptions({
+    ...config,
+    allowCustomerLogin: true
+  });
+}
+__name(buildStorefrontNextAuthOptions, "buildStorefrontNextAuthOptions");
 
-export { createCmsMiddleware, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, seedAdministratorPermissions, summarizeSessionUserForLog };
+export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, resolveGoogleAuthConfig, seedAdministratorPermissions, summarizeSessionUserForLog };