@infuro/cms-core 1.0.51 → 1.0.52

package/dist/{chunk-WRKV6MHB.js → chunk-BNKZNLEX.js}

@@ -1,8 +1,8 @@
 import { linkUnclaimedContactToUser, ensureCustomerForUser } from './chunk-RK5ETF2I.js';
 import { retireSoftDeletedUniqueValue } from './chunk-DBPSJYLZ.js';
 import { getPermissionableEntityKeys, ADMIN_GROUP_NAME, isSuperAdmin, permissionRowsToRecord, vendorPortalFlagsFromUser } from './chunk-JIWUVQ6B.js';
+import { logAuth, nextAuthCookieDebugInfo, summarizeSessionUserForLog } from './chunk-WUQAOTHA.js';
 import { __name } from './chunk-SHUYVCID.js';
-import { getToken } from 'next-auth/jwt';
 import _CredentialsProvider from 'next-auth/providers/credentials';
 import _GoogleProvider from 'next-auth/providers/google';
 
@@ -48,200 +48,6 @@ async function seedAdministratorPermissions(dataSource, entityMap) {
 }
 __name(seedAdministratorPermissions, "seedAdministratorPermissions");
 
-// src/auth/auth-debug.ts
-var LOG_PREFIX = "[cms-auth]";
-function isAuthDebugEnabled() {
-  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes";
-}
-__name(isAuthDebugEnabled, "isAuthDebugEnabled");
-function isAuthDebugClientEnabled() {
-  if (typeof window === "undefined") return false;
-  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes";
-}
-__name(isAuthDebugClientEnabled, "isAuthDebugClientEnabled");
-function logAuth(message, data) {
-  if (!isAuthDebugEnabled()) return;
-  if (data) console.info(LOG_PREFIX, message, data);
-  else console.info(LOG_PREFIX, message);
-}
-__name(logAuth, "logAuth");
-function logAuthClient(message, data) {
-  if (!isAuthDebugClientEnabled()) return;
-  if (data) console.info(LOG_PREFIX, message, data);
-  else console.info(LOG_PREFIX, message);
-}
-__name(logAuthClient, "logAuthClient");
-function summarizeSessionUserForLog(user) {
-  if (!user || typeof user !== "object") return {
-    present: false
-  };
-  const u = user;
-  return {
-    present: true,
-    email: u.email ?? null,
-    id: u.id ?? null,
-    adminAccess: u.adminAccess ?? null,
-    isRBACAdmin: u.isRBACAdmin ?? null,
-    isVendorPortal: u.isVendorPortal ?? null,
-    groupName: u.groupName ?? null
-  };
-}
-__name(summarizeSessionUserForLog, "summarizeSessionUserForLog");
-function nextAuthCookieDebugInfo() {
-  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
-  const isHttps = nextAuthUrl.startsWith("https");
-  return {
-    nextAuthUrl,
-    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
-    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
-    cookieSecure: isHttps,
-    nodeEnv: process.env.NODE_ENV ?? "(unset)"
-  };
-}
-__name(nextAuthCookieDebugInfo, "nextAuthCookieDebugInfo");
-
-// src/auth/middleware.ts
-var defaultPublicApiMethods = {
-  "/api/contacts": [
-    "POST"
-  ],
-  "/api/form-submissions": [
-    "POST"
-  ],
-  "/api/blogs": [
-    "GET"
-  ],
-  "/api/forms": [
-    "GET"
-  ],
-  "/api/auth": [
-    "GET",
-    "POST"
-  ],
-  "/api/health": [
-    "GET"
-  ],
-  "/api/users/forgot-password": [
-    "POST"
-  ],
-  "/api/users/set-password": [
-    "POST"
-  ],
-  "/api/users/invite": [
-    "GET",
-    "POST"
-  ],
-  /** Public keys only (e.g. googleEnabled); secrets stay private in the settings handler. */
-  "/api/settings/auth_providers": [
-    "GET"
-  ]
-};
-function legacyGetSessionToken(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  return secure ?? regular;
-}
-__name(legacyGetSessionToken, "legacyGetSessionToken");
-function sessionCookiePresence(request) {
-  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
-  const regular = request.cookies.get("next-auth.session-token")?.value;
-  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
-  return {
-    hasSecureToken: Boolean(secure),
-    hasRegularToken: Boolean(regular),
-    hasChunkedToken: hasChunked,
-    resolved: Boolean(secure ?? regular)
-  };
-}
-__name(sessionCookiePresence, "sessionCookiePresence");
-function isPublicMethod(pathname, method, publicApiMethods) {
-  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
-    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;
-  }
-  return false;
-}
-__name(isPublicMethod, "isPublicMethod");
-async function hasValidSession(request, secret, legacyGetToken) {
-  if (request.req) {
-    const token = await getToken({
-      req: request.req,
-      secret
-    });
-    return token != null;
-  }
-  return Boolean(legacyGetToken(request));
-}
-__name(hasValidSession, "hasValidSession");
-function createCmsMiddleware(config = {}) {
-  const { publicAdminPaths = [
-    "/admin/signin",
-    "/admin/forgot-password",
-    "/admin/reset-password",
-    "/admin/invite"
-  ], publicApiMethods = defaultPublicApiMethods, signInPath = "/admin/signin", getSessionToken = legacyGetSessionToken, secret = process.env.NEXTAUTH_SECRET } = config;
-  return /* @__PURE__ */ __name(async function cmsMiddleware(request) {
-    const pathname = request.nextUrl.pathname;
-    const method = request.method;
-    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
-      return {
-        type: "next"
-      };
-    }
-    if (pathname.startsWith("/admin")) {
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      const cookies = sessionCookiePresence(request);
-      if (!authenticated) {
-        logAuth("middleware: admin redirect to signin (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...cookies,
-          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
-        });
-        return {
-          type: "redirect",
-          url: new URL(signInPath, request.url).toString()
-        };
-      }
-      logAuth("middleware: admin allowed", {
-        pathname,
-        method,
-        usesGetToken: Boolean(request.req),
-        ...cookies
-      });
-    }
-    if (pathname.startsWith("/api")) {
-      if (isPublicMethod(pathname, method, publicApiMethods)) {
-        return {
-          type: "next"
-        };
-      }
-      const authenticated = await hasValidSession(request, secret, getSessionToken);
-      if (!authenticated) {
-        logAuth("middleware: api 401 (no session)", {
-          pathname,
-          method,
-          usesGetToken: Boolean(request.req),
-          ...sessionCookiePresence(request)
-        });
-        return {
-          type: "json",
-          status: 401,
-          body: {
-            error: "Unauthorized"
-          }
-        };
-      }
-    }
-    return {
-      type: "next"
-    };
-  }, "cmsMiddleware");
-}
-__name(createCmsMiddleware, "createCmsMiddleware");
-
 // src/auth/auth-providers-settings.ts
 var AUTH_PROVIDERS_SETTINGS_GROUP = "auth_providers";
 function parseEnabled(raw) {
@@ -1022,4 +828,4 @@ async function buildStorefrontNextAuthOptions(config) {
 }
 __name(buildStorefrontNextAuthOptions, "buildStorefrontNextAuthOptions");
 
-export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCmsMiddleware, createCustomerUserFromGoogleOAuth, defaultPublicApiMethods, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isAuthDebugClientEnabled, isAuthDebugEnabled, isGoogleAuthPubliclyEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, resolveGoogleAuthConfig, seedAdministratorPermissions, summarizeSessionUserForLog };
+export { AUTH_PROVIDERS_SETTINGS_GROUP, buildNextAuthOptions, buildStorefrontNextAuthOptions, createCustomerUserFromGoogleOAuth, getNextAuthOptions, getStorefrontNextAuthOptions, googleOAuthRedirectUri, isGoogleAuthPubliclyEnabled, resolveGoogleAuthConfig, seedAdministratorPermissions };

package/dist/chunk-WUQAOTHA.js

@@ -0,0 +1,203 @@
+import { __name } from './chunk-SHUYVCID.js';
+
+// src/auth/auth-debug.ts
+var LOG_PREFIX = "[cms-auth]";
+function isAuthDebugEnabled() {
+  const v = process.env.CMS_AUTH_DEBUG?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+__name(isAuthDebugEnabled, "isAuthDebugEnabled");
+function isAuthDebugClientEnabled() {
+  if (typeof window === "undefined") return false;
+  const v = process.env.NEXT_PUBLIC_CMS_AUTH_DEBUG?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+__name(isAuthDebugClientEnabled, "isAuthDebugClientEnabled");
+function logAuth(message, data) {
+  if (!isAuthDebugEnabled()) return;
+  if (data) console.info(LOG_PREFIX, message, data);
+  else console.info(LOG_PREFIX, message);
+}
+__name(logAuth, "logAuth");
+function logAuthClient(message, data) {
+  if (!isAuthDebugClientEnabled()) return;
+  if (data) console.info(LOG_PREFIX, message, data);
+  else console.info(LOG_PREFIX, message);
+}
+__name(logAuthClient, "logAuthClient");
+function summarizeSessionUserForLog(user) {
+  if (!user || typeof user !== "object") return {
+    present: false
+  };
+  const u = user;
+  return {
+    present: true,
+    email: u.email ?? null,
+    id: u.id ?? null,
+    adminAccess: u.adminAccess ?? null,
+    isRBACAdmin: u.isRBACAdmin ?? null,
+    isVendorPortal: u.isVendorPortal ?? null,
+    groupName: u.groupName ?? null
+  };
+}
+__name(summarizeSessionUserForLog, "summarizeSessionUserForLog");
+function nextAuthCookieDebugInfo() {
+  const nextAuthUrl = process.env.NEXTAUTH_URL ?? "(unset)";
+  const isHttps = nextAuthUrl.startsWith("https");
+  return {
+    nextAuthUrl,
+    hasSecret: Boolean(process.env.NEXTAUTH_SECRET),
+    cookieName: isHttps ? "__Secure-next-auth.session-token" : "next-auth.session-token",
+    cookieSecure: isHttps,
+    nodeEnv: process.env.NODE_ENV ?? "(unset)"
+  };
+}
+__name(nextAuthCookieDebugInfo, "nextAuthCookieDebugInfo");
+
+// src/auth/middleware.ts
+var defaultPublicApiMethods = {
+  "/api/contacts": [
+    "POST"
+  ],
+  "/api/form-submissions": [
+    "POST"
+  ],
+  "/api/blogs": [
+    "GET"
+  ],
+  "/api/forms": [
+    "GET"
+  ],
+  "/api/auth": [
+    "GET",
+    "POST"
+  ],
+  "/api/health": [
+    "GET"
+  ],
+  "/api/users/forgot-password": [
+    "POST"
+  ],
+  "/api/users/set-password": [
+    "POST"
+  ],
+  "/api/users/invite": [
+    "GET",
+    "POST"
+  ],
+  /** Public keys only (e.g. googleEnabled); secrets stay private in the settings handler. */
+  "/api/settings/auth_providers": [
+    "GET"
+  ]
+};
+function legacyGetSessionToken(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  return secure ?? regular;
+}
+__name(legacyGetSessionToken, "legacyGetSessionToken");
+function sessionCookiePresence(request) {
+  const secure = request.cookies.get("__Secure-next-auth.session-token")?.value;
+  const regular = request.cookies.get("next-auth.session-token")?.value;
+  const hasChunked = Boolean(request.cookies.get("next-auth.session-token.0")?.value) || Boolean(request.cookies.get("__Secure-next-auth.session-token.0")?.value);
+  return {
+    hasSecureToken: Boolean(secure),
+    hasRegularToken: Boolean(regular),
+    hasChunkedToken: hasChunked,
+    resolved: Boolean(secure ?? regular ?? hasChunked)
+  };
+}
+__name(sessionCookiePresence, "sessionCookiePresence");
+function isPublicMethod(pathname, method, publicApiMethods) {
+  for (const [endpoint, methods] of Object.entries(publicApiMethods)) {
+    if (pathname.startsWith(endpoint) && methods.includes(method)) return true;
+  }
+  return false;
+}
+__name(isPublicMethod, "isPublicMethod");
+async function hasValidSession(request, secret, legacyGetToken) {
+  const presence = sessionCookiePresence(request);
+  if (presence.resolved || presence.hasChunkedToken) return true;
+  if (request.req) {
+    try {
+      const { getToken } = await import('next-auth/jwt');
+      const token = await getToken({
+        req: request.req,
+        secret
+      });
+      if (token != null) return true;
+    } catch {
+    }
+  }
+  return Boolean(legacyGetToken(request));
+}
+__name(hasValidSession, "hasValidSession");
+function createCmsMiddleware(config = {}) {
+  const { publicAdminPaths = [
+    "/admin/signin",
+    "/admin/forgot-password",
+    "/admin/reset-password",
+    "/admin/invite"
+  ], publicApiMethods = defaultPublicApiMethods, signInPath = "/admin/signin", getSessionToken = legacyGetSessionToken, secret = process.env.NEXTAUTH_SECRET } = config;
+  return /* @__PURE__ */ __name(async function cmsMiddleware(request) {
+    const pathname = request.nextUrl.pathname;
+    const method = request.method;
+    if (publicAdminPaths.some((p) => pathname === p || pathname.startsWith(p + "/"))) {
+      return {
+        type: "next"
+      };
+    }
+    if (pathname.startsWith("/admin")) {
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      const cookies = sessionCookiePresence(request);
+      if (!authenticated) {
+        logAuth("middleware: admin redirect to signin (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...cookies,
+          expectedCookieName: process.env.NEXTAUTH_URL?.startsWith("https") ? "__Secure-next-auth.session-token" : "next-auth.session-token"
+        });
+        return {
+          type: "redirect",
+          url: new URL(signInPath, request.url).toString()
+        };
+      }
+      logAuth("middleware: admin allowed", {
+        pathname,
+        method,
+        usesGetToken: Boolean(request.req),
+        ...cookies
+      });
+    }
+    if (pathname.startsWith("/api")) {
+      if (isPublicMethod(pathname, method, publicApiMethods)) {
+        return {
+          type: "next"
+        };
+      }
+      const authenticated = await hasValidSession(request, secret, getSessionToken);
+      if (!authenticated) {
+        logAuth("middleware: api 401 (no session)", {
+          pathname,
+          method,
+          usesGetToken: Boolean(request.req),
+          ...sessionCookiePresence(request)
+        });
+        return {
+          type: "json",
+          status: 401,
+          body: {
+            error: "Unauthorized"
+          }
+        };
+      }
+    }
+    return {
+      type: "next"
+    };
+  }, "cmsMiddleware");
+}
+__name(createCmsMiddleware, "createCmsMiddleware");
+
+export { createCmsMiddleware, defaultPublicApiMethods, isAuthDebugClientEnabled, isAuthDebugEnabled, logAuth, logAuthClient, nextAuthCookieDebugInfo, summarizeSessionUserForLog };