@infuro/cms-core 1.0.50 → 1.0.52

package/dist/{chunk-WRKV6MHB.js → chunk-BNKZNLEX.js}

@@ -1,8 +1,8 @@
 import { linkUnclaimedContactToUser, ensureCustomerForUser } from './chunk-RK5ETF2I.js';
 import { retireSoftDeletedUniqueValue } from './chunk-DBPSJYLZ.js';
 import { getPermissionableEntityKeys, ADMIN_GROUP_NAME, isSuperAdmin, permissionRowsToRecord, vendorPortalFlagsFromUser } from './chunk-JIWUVQ6B.js';
+import { logAuth, nextAuthCookieDebugInfo, summarizeSessionUserForLog } from './chunk-WUQAOTHA.js';
 import { __name } from './chunk-SHUYVCID.js';
-import { getToken } from 'next-auth/jwt';
 import _CredentialsProvider from 'next-auth/providers/credentials';
 import _GoogleProvider from 'next-auth/providers/google';
 
@@ -48,200 +48,6 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
 }
 __name(seedAdministratorPermissions, "seedAdministratorPermissions");
 
-// src/auth/auth-debug.ts
-var LOG_PREFIX = "[cms-auth]";
-function isAuthDebugEnabled() {
-  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes";
-}
-__name(isAuthDebugEnabled, "isAuthDebugEnabled");
-function isAuthDebugClientEnabled() {
-  if (typeof window === "undefined") return false;
-  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes";
-}
-__name(isAuthDebugClientEnabled, "isAuthDebugClientEnabled");
-function logAuth(message, data) {
-  if (!isAuthDebugEnabled()) return;
-  if (data) console.info(LOG_PREFIX, message, data);
-  else console.info(LOG_PREFIX, message);
-}
-__name(logAuth, "logAuth");
-function logAuthClient(message, data) {
-  if (!isAuthDebugClientEnabled()) return;
-  if (data) console.info(LOG_PREFIX, message, data);
-  else console.info(LOG_PREFIX, message);
-}
-__name(logAuthClient, "logAuthClient");
-function summarizeSessionUserForLog(user) {
-  if (!user || typeof user !== "object") return {
-    present: false
-  };
-  const u = user;
-  return {
-    present: true,
-    email: u.email ?? null,
-    id: u.id ?? null,
-    adminAccess: u.adminAccess ?? null,
-    isRBACAdmin: u.isRBACAdmin ?? null,
-    isVendorPortal: u.isVendorPortal ?? null,
-    groupName: u.groupName ?? null
-  };
-}
-__name(summarizeSessionUserForLog, "summarizeSessionUserForLog");
-function nextAuthCookieDebugInfo() {
-  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
-  const isHttps = nextAuthUrl.startsWith("https");
-  return {
-    nextAuthUrl,
-    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
-    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
-    cookieSecure: isHttps,
-    nodeEnv: process.env.NODE_ENV ?? "(unset)"
-  };
-}
-__name(nextAuthCookieDebugInfo, "nextAuthCookieDebugInfo");
-
-// src/auth/middleware.ts
-var defaultPublicApiMethods = {
-  "/api/contacts": [
-    "POST"
-  ],
-  "/api/form-submissions": [
-    "POST"
-  ],
-  "/api/blogs": [
-    "GET"
-  ],
-  "/api/forms": [
-    "GET"
-  ],
-  "/api/auth": [
-    "GET",
-    "POST"
-  ],
-  "/api/health": [
-    "GET"
-  ],
-  "/api/users/forgot-password": [
-    "POST"
-  ],
-  "/api/users/set-password": [
-    "POST"
-  ],
-  "/api/users/invite": [
-    "GET",
-    "POST"
-  ],
-  /** Public keys only (e.g. googleEnabled); secrets stay private in the settings handler. */
-  "/api/settings/auth_providers": [
-    "GET"
-  ]
-};
-function legacyGetSessionToken(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  return secure ?? regular;
-}
-__name(legacyGetSessionToken, "legacyGetSessionToken");
-function sessionCookiePresence(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
-  return {
-    hasSecureToken: Boolean(secure),
-    hasRegularToken: Boolean(regular),
-    hasChunkedToken: hasChunked,
-    resolved: Boolean(secure ?? regular)
-  };
-}
-__name(sessionCookiePresence, "sessionCookiePresence");
-function isPublicMethod(pathname, method, publicApiMethods) {
-  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
-    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;
-  }
-  return false;
-}
-__name(isPublicMethod, "isPublicMethod");
-async function hasValidSession(request, secret, legacyGetToken) {
-  if (request.req) {
-    const token = await getToken({
-      req: request.req,
-      secret
-    });
-    return token != null;
-  }
-  return Boolean(legacyGetToken(request));
-}
-__name(hasValidSession, "hasValidSession");
-function createCmsMiddleware(config = {}) {
-  const { publicAdminPaths = [
-    "/admin/signin",
-    "/admin/forgot-password",
-    "/admin/reset-password",
-    "/admin/invite"
-  ], publicApiMethods = defaultPublicApiMethods, signInPath = "/admin/signin", getSessionToken = legacyGetSessionToken, secret = process.env.NEXTAUTH_SECRET } = config;
-  return /* @__PURE__ */ __name(async function cmsMiddleware(request) {
-    const pathname = request.nextUrl.pathname;
-    const method = request.method;
-    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
-      return {
-        type: "next"
-      };
-    }
-    if (pathname.startsWith("/admin")) {
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      const cookies = sessionCookiePresence(request);
-      if (!authenticated) {
-        logAuth("middleware: admin redirect to signin (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...cookies,
-          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
-        });
-        return {
-          type: "redirect",
-          url: new URL(signInPath, request.url).toString()
-        };
-      }
-      logAuth("middleware: admin allowed", {
-        pathname,
-        method,
-        usesGetToken: Boolean(request.req),
-        ...cookies
-      });
-    }
-    if (pathname.startsWith("/api")) {
-      if (isPublicMethod(pathname, method, publicApiMethods)) {
-        return {
-          type: "next"
-        };
-      }
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      if (!authenticated) {
-        logAuth("middleware: api 401 (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...sessionCookiePresence(request)
-        });
-        return {
-          type: "json",
-          status: 401,
-          body: {
-            error: "Unauthorized"
-          }
-        };
-      }
-    }
-    return {
-      type: "next"
-    };
-  }, "cmsMiddleware");
-}
-__name(createCmsMiddleware, "createCmsMiddleware");
-
 // src/auth/auth-providers-settings.ts
 var AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
 function parseEnabled(raw) {
@@ -1022,4 +828,4 @@ async function buildStorefrontNextAuthOptions(config) {
 }
 __name(buildStorefrontNextAuthOptions, "buildStorefrontNextAuthOptions");
 
-export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, resolveGoogleAuthConfig, seedAdministratorPermissions, summarizeSessionUserForLog };
+export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCustomerUserFromGoogleOAuth, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isGoogleAuthPubliclyEnabled, resolveGoogleAuthConfig, seedAdministratorPermissions };

package/dist/{chunk-IPDHT2UV.js → chunk-CTXBYO2J.js}

@@ -57,6 +57,9 @@ function buildEventOrderTemplateVariables(input) {
     currency: String(order.currency ?? "INR"),
     lines: orderLines
   };
+  const qrToken = order.qrToken?.trim() || order.orderNumber?.trim() || "";
+  const fallbackQrUrl = qrToken ? `https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=${encodeURIComponent(qrToken)}` : "";
+  const fallbackTicketQr = fallbackQrUrl ? `<img src="${fallbackQrUrl}" alt="Ticket QR Code" width="200" height="200" style="display:block;margin:12px 0;border:1px solid #e5e7eb;border-radius:8px;" />` : "";
   return {
     eventName: event.name ?? productNames ?? "",
     vendorName: vendorName.trim(),
@@ -73,6 +76,8 @@ function buildEventOrderTemplateVariables(input) {
     trackUrl,
     invoiceNumber,
     invoiceUrl,
+    ticketQr: fallbackTicketQr,
+    qrImageUrl: fallbackQrUrl,
     orderDetails: formatOrderDetailsText(orderDetailsPayload),
     orderDetailsHtml: formatOrderDetailsHtml(orderDetailsPayload)
   };
@@ -2099,72 +2104,27 @@ async function getGoogleAccessToken(clientEmail, privateKey) {
   return tokenData.access_token;
 }
 __name(getGoogleAccessToken, "getGoogleAccessToken");
-async function resolveFcmServiceAccount(dataSource, entityMap) {
-  const pushSettings = await getSettingsGroup(dataSource, entityMap, "push");
-  let projectId = pushSettings.firebase_project_id?.trim();
-  let clientEmail = pushSettings.firebase_client_email?.trim();
-  let privateKey = pushSettings.firebase_private_key?.trim();
-  if (pushSettings.firebase_service_account_json?.trim()) {
-    try {
-      const parsed = JSON.parse(pushSettings.firebase_service_account_json.trim());
-      if (parsed.project_id) projectId = parsed.project_id;
-      if (parsed.client_email) clientEmail = parsed.client_email;
-      if (parsed.private_key) privateKey = parsed.private_key;
-    } catch {
-    }
-  }
-  if (!projectId || !clientEmail || !privateKey) {
-    return {
-      ok: false,
-      error: "Firebase Service Account JSON / credentials are not configured"
-    };
-  }
-  return {
-    ok: true,
-    account: {
-      projectId,
-      clientEmail,
-      privateKey
-    }
-  };
-}
-__name(resolveFcmServiceAccount, "resolveFcmServiceAccount");
-async function validateFcmCredentials(dataSource, entityMap) {
-  try {
-    const resolved = await resolveFcmServiceAccount(dataSource, entityMap);
-    if (!resolved.ok) {
-      return {
-        success: false,
-        error: resolved.error
-      };
-    }
-    const { projectId, clientEmail, privateKey } = resolved.account;
-    await getGoogleAccessToken(clientEmail, privateKey);
-    return {
-      success: true,
-      projectId,
-      clientEmail
-    };
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : "Unknown credential validation error";
-    console.error("[fcm-push] Exception in validateFcmCredentials", errorMsg);
-    return {
-      success: false,
-      error: errorMsg
-    };
-  }
-}
-__name(validateFcmCredentials, "validateFcmCredentials");
 async function sendFcmPushNotification(dataSource, entityMap, msg) {
   try {
-    const resolved = await resolveFcmServiceAccount(dataSource, entityMap);
-    if (!resolved.ok) {
+    const pushSettings = await getSettingsGroup(dataSource, entityMap, "push");
+    let projectId = pushSettings.firebase_project_id?.trim();
+    let clientEmail = pushSettings.firebase_client_email?.trim();
+    let privateKey = pushSettings.firebase_private_key?.trim();
+    if (pushSettings.firebase_service_account_json?.trim()) {
+      try {
+        const parsed = JSON.parse(pushSettings.firebase_service_account_json.trim());
+        if (parsed.project_id) projectId = parsed.project_id;
+        if (parsed.client_email) clientEmail = parsed.client_email;
+        if (parsed.private_key) privateKey = parsed.private_key;
+      } catch {
+      }
+    }
+    if (!projectId || !clientEmail || !privateKey) {
       return {
         success: false,
-        error: resolved.error
+        error: "Firebase Service Account JSON / credentials are not configured"
       };
     }
-    const { projectId, clientEmail, privateKey } = resolved.account;
     const accessToken = await getGoogleAccessToken(clientEmail, privateKey);
     const fcmEndpoint = `https://fcm.googleapis.com/v1/projects/${projectId}/messages:send`;
     const fcmPayload = {
@@ -2275,59 +2235,69 @@ async function loadBoundTemplate(triggerKey, channel, audienceType = "customers"
     console.warn("[order-notifications] order_notification_bindings or message_templates missing from entityMap");
     return null;
   }
-  const bindingRepo = dataSource.getRepository(entityMap.order_notification_bindings);
-  let binding = await bindingRepo.findOne({
-    where: {
-      triggerKey,
-      channel,
-      type: audienceType,
-      enabled: true
-    }
-  });
-  if (!binding && audienceType === "customers") {
-    binding = await bindingRepo.findOne({
+  try {
+    const bindingRepo = dataSource.getRepository(entityMap.order_notification_bindings);
+    let binding = await bindingRepo.findOne({
       where: {
         triggerKey,
         channel,
+        type: audienceType,
         enabled: true
       }
-    });
-  }
-  if (!binding) {
-    console.warn("[order-notifications] no order_notification_bindings row", {
-      triggerKey,
-      channel,
-      audienceType
-    });
-    return null;
-  }
-  const templateId = binding.messageTemplateId;
-  if (templateId == null) {
-    console.warn("[order-notifications] binding exists but no template selected", {
-      triggerKey,
-      channel,
-      audienceType
-    });
-    return null;
-  }
-  const template = await dataSource.getRepository(entityMap.message_templates).findOne({
-    where: {
-      id: templateId,
-      channel,
-      deleted: false,
-      enabled: true
+    }).catch(() => null);
+    if (!binding && audienceType === "customers") {
+      binding = await bindingRepo.findOne({
+        where: {
+          triggerKey,
+          channel,
+          enabled: true
+        }
+      }).catch(() => null);
     }
-  });
-  if (!template) {
-    console.warn("[order-notifications] bound template not found or disabled", {
+    if (!binding) {
+      console.warn("[order-notifications] no order_notification_bindings row", {
+        triggerKey,
+        channel,
+        audienceType
+      });
+      return null;
+    }
+    const templateId = binding.messageTemplateId;
+    if (templateId == null) {
+      console.warn("[order-notifications] binding exists but no template selected", {
+        triggerKey,
+        channel,
+        audienceType
+      });
+      return null;
+    }
+    const template = await dataSource.getRepository(entityMap.message_templates).findOne({
+      where: {
+        id: templateId,
+        channel,
+        deleted: false,
+        enabled: true
+      }
+    }).catch(() => null);
+    if (!template) {
+      console.warn("[order-notifications] bound template not found or disabled", {
+        triggerKey,
+        channel,
+        audienceType,
+        templateId
+      });
+      return null;
+    }
+    return template;
+  } catch (err) {
+    console.warn("[order-notifications] loadBoundTemplate query failed", {
       triggerKey,
       channel,
       audienceType,
-      templateId
+      error: err instanceof Error ? err.message : String(err)
     });
     return null;
   }
-  return template;
 }
 __name(loadBoundTemplate, "loadBoundTemplate");
 function mergeTriggerVariables(payload, rich) {
@@ -2344,9 +2314,11 @@ function mergeTriggerVariables(payload, rich) {
       refundAmount: String(payload.refundAmount)
     } : {}
   };
+  const extraVars = payload.extraVariables ?? {};
   return {
     ...basic,
-    ...rich ?? {}
+    ...rich ?? {},
+    ...extraVars
   };
 }
 __name(mergeTriggerVariables, "mergeTriggerVariables");
@@ -2542,7 +2514,23 @@ async function getAdminRecipientEmails(dataSource, entityMap) {
     }
   } catch {
   }
-  return Array.from(emails);
+  const vendorEmails = /* @__PURE__ */ new Set();
+  try {
+    const vRows = await dataSource.query(`SELECT DISTINCT LOWER(TRIM(email)) AS email FROM vendors WHERE COALESCE(deleted, false) = false AND email IS NOT NULL AND TRIM(email) != ''`).catch(() => []);
+    for (const r of vRows) {
+      if (r.email) vendorEmails.add(r.email.toLowerCase());
+    }
+    const vuRows = await dataSource.query(`SELECT DISTINCT LOWER(TRIM(u.email)) AS email
+           FROM users u
+      LEFT JOIN user_groups g ON g.id = u."groupId"
+          WHERE COALESCE(u.deleted, false) = false
+            AND (LOWER(g.name) LIKE '%vendor%' OR u."groupId" = 5)`).catch(() => []);
+    for (const r of vuRows) {
+      if (r.email) vendorEmails.add(r.email.toLowerCase());
+    }
+  } catch {
+  }
+  return Array.from(emails).filter((e) => !vendorEmails.has(e.toLowerCase()));
 }
 __name(getAdminRecipientEmails, "getAdminRecipientEmails");
 function formatBodyForEmailHtml(body) {
@@ -2776,6 +2764,8 @@ function initWhatsappTriggerDispatcher(deps) {
   if (initialized) return;
   initialized = true;
   const { dataSource, entityMap, getCms } = deps;
+  void dataSource.query(`ALTER TYPE "order_notification_bindings_channel_enum" ADD VALUE IF NOT EXISTS 'mobile'`).catch(() => {
+  });
   notificationTriggerEmitter.onAnyTrigger((triggerKey, payload) => {
     void handleTrigger(triggerKey, payload, dataSource, entityMap, getCms).catch((err) => {
       console.error("[order-notifications]", triggerKey, err);
@@ -2835,4 +2825,4 @@ async function resendOrderNotification(triggerKey, orderId, deps) {
 }
 __name(resendOrderNotification, "resendOrderNotification");
 
-export { CHAT_EMAIL_LOG, EmailService, WhatsAppService, buildChatbotSystemPromptWithEmailTool, buildEventOrderTemplateVariables, buildTranscriptForLeadEmail, detectChatLeadIntent, emailPlugin, emailTemplates, getSettingsGroup, initWhatsappTriggerDispatcher, isWhatsAppPluginEnabled, joinRecipientsForSend, mergeWhatsAppConfigLayers, parseEmailRecipientsFromConfig, parseIntentRecipientEmails, queueWhatsApp, registerWhatsAppQueueProcessor, renderEmail, renderLayout, resendOrderNotification, resolveChatEmailToolSettings, sendChatLeadEmail, sendFcmPushNotification, serializeEmailRecipients, validateFcmCredentials, whatsAppConfigured };
+export { CHAT_EMAIL_LOG, EmailService, WhatsAppService, buildChatbotSystemPromptWithEmailTool, buildEventOrderTemplateVariables, buildTranscriptForLeadEmail, detectChatLeadIntent, emailPlugin, emailTemplates, getSettingsGroup, initWhatsappTriggerDispatcher, isWhatsAppPluginEnabled, joinRecipientsForSend, mergeWhatsAppConfigLayers, parseEmailRecipientsFromConfig, parseIntentRecipientEmails, queueWhatsApp, registerWhatsAppQueueProcessor, renderEmail, renderLayout, resendOrderNotification, resolveChatEmailToolSettings, sendChatLeadEmail, sendFcmPushNotification, serializeEmailRecipients, whatsAppConfigured };