@infuro/cms-core 1.0.53 → 1.0.55

package/dist/{chunk-3BPD5NGU.cjs → chunk-JGR4ZUON.cjs}

@@ -1914,6 +1914,32 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   }
 }
 chunkUSNT2KNT_cjs.__name(ensureUniqueProductSlug, "ensureUniqueProductSlug");
+function isSlugUniqueViolation(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return /duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg);
+}
+chunkUSNT2KNT_cjs.__name(isSlugUniqueViolation, "isSlugUniqueViolation");
+async function assertUniqueEventSlug(repo, slugRaw, vendorId, excludeId) {
+  const slug = typeof slugRaw === "string" ? slugRaw.trim() : "";
+  if (!slug) return "Slug is required";
+  await chunkOY2YTBMP_cjs.retireSoftDeletedUniqueValue(repo, "slug", slug);
+  const where = excludeId != null ? {
+    slug,
+    vendorId,
+    deleted: false,
+    id: typeorm.Not(excludeId)
+  } : {
+    slug,
+    vendorId,
+    deleted: false
+  };
+  const dup = await repo.findOne({
+    where
+  });
+  if (dup) return "An event with this slug already exists";
+  return null;
+}
+chunkUSNT2KNT_cjs.__name(assertUniqueEventSlug, "assertUniqueEventSlug");
 async function normalizeComboNameAndSlug(repo, body, vendorId, existing, excludeId) {
   const incomingName = typeof body.name === "string" ? body.name.trim() : "";
   const incomingSlugRaw = typeof body.slug === "string" ? body.slug.trim() : "";
@@ -4784,6 +4810,17 @@ function createCrudHandler(dataSource, entityMap, options) {
           status: 400
         });
       }
+      if (resource === "events") {
+        const vendorIdForSlug = scopeCreate.type === "vendor" ? scopeCreate.vendorId : Number(persistBody.vendorId);
+        if (Number.isFinite(vendorIdForSlug) && vendorIdForSlug > 0) {
+          const eventSlugErr = await assertUniqueEventSlug(repo, persistBody.slug, vendorIdForSlug);
+          if (eventSlugErr) return json({
+            error: eventSlugErr
+          }, {
+            status: 400
+          });
+        }
+      }
       sanitizeBodyForEntity(repo, persistBody);
       let created;
       try {
@@ -5063,6 +5100,13 @@ function createCrudHandler(dataSource, entityMap, options) {
         }
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
+        if (resource === "events" && isSlugUniqueViolation(err)) {
+          return json({
+            error: "An event with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         logCrudServerError("POST create save failed", {
           resource,
           message,
@@ -6339,6 +6383,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             });
           }
         }
+        if ("slug" in updatePayload) {
+          const vendorIdForSlug = scopePut.type === "vendor" ? scopePut.vendorId : Number(currentEvent.vendorId);
+          if (Number.isFinite(vendorIdForSlug) && vendorIdForSlug > 0) {
+            const eventSlugErr = await assertUniqueEventSlug(repo, updatePayload.slug, vendorIdForSlug, numericId);
+            if (eventSlugErr) return json({
+              error: eventSlugErr
+            }, {
+              status: 400
+            });
+          }
+        }
       }
       if (resource === "product_categories" && scopePut.type === "all") {
         const existingCatalogCat = await repo.findOne({
@@ -6502,7 +6557,18 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         }
         sanitizeBodyForEntity(repo, updatePayload);
         await retireSoftDeletedUniquesFromBody(repo, updatePayload);
-        await repo.update(numericId, updatePayload);
+        try {
+          await repo.update(numericId, updatePayload);
+        } catch (err) {
+          if (resource === "events" && isSlugUniqueViolation(err)) {
+            return json({
+              error: "An event with this slug already exists"
+            }, {
+              status: 400
+            });
+          }
+          throw err;
+        }
       }
       if (resource === "orders" && rawBody && entityMap["order_addresses"]) {
         const addressRawScalar = String(rawBody["contact.address"] ?? "").trim();
@@ -8695,11 +8761,21 @@ function createUploadHandler(config) {
       const storageService = raw instanceof Promise ? await raw : raw;
       if (storageService) {
         const fileUrl = await storageService.upload(buffer, `uploads/${relativeUnderUploads}`, contentType);
+        console.info("[upload] stored via storage plugin", {
+          key: `uploads/${relativeUnderUploads}`,
+          contentType,
+          bytes: buffer.length,
+          fileUrl
+        });
         return json({
           filePath: fileUrl,
           parentId
         });
       }
+      console.warn("[upload] no storage plugin \u2014 writing local disk (broken on most deploys)", {
+        localUploadDir,
+        key: relativeUnderUploads
+      });
       const fs2 = await import('fs/promises');
       const path2 = await import('path');
       const dir = path2.join(process.cwd(), localUploadDir);
@@ -8715,11 +8791,13 @@ function createUploadHandler(config) {
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
+      const awsMeta = err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0;
       console.error("[upload] File upload failed", {
         error: message,
         stack: err instanceof Error ? err.stack : void 0,
         name: err instanceof Error ? err.name : void 0,
-        metadata: err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0
+        code: err && typeof err === "object" && ("Code" in err || "code" in err) ? err.Code ?? err.code : void 0,
+        metadata: awsMeta
       });
       if (/Failed to parse body as FormData/i.test(message)) {
         return json({
@@ -8729,7 +8807,8 @@ function createUploadHandler(config) {
         });
       }
       return json({
-        error: "File upload failed"
+        error: "File upload failed",
+        details: message
       }, {
         status: 500
       });
@@ -30870,9 +30949,51 @@ function createStorefrontApiHandler(config) {
     "items.product.taxes",
     "items.product.taxes.tax"
   ];
-  function resolveSingleVendorIdFromCart(cart) {
+  function comboIdFromCartItem(it) {
+    const meta = it.metadata && typeof it.metadata === "object" && !Array.isArray(it.metadata) ? it.metadata : {};
+    const fromMeta = Number(meta.comboId ?? meta.combo_id);
+    if (Number.isInteger(fromMeta) && fromMeta > 0) return fromMeta;
+    if (meta.isCombo === true || meta.type === "combo" || meta.lineType === "combo") {
+      const pid = Number(it.productId);
+      if (Number.isInteger(pid) && pid > 0) return pid;
+    }
+    return null;
+  }
+  chunkUSNT2KNT_cjs.__name(comboIdFromCartItem, "comboIdFromCartItem");
+  async function resolveSingleVendorIdFromCart(cart) {
     const vendorIds = /* @__PURE__ */ new Set();
+    const comboRepo = entityMap.combos ? dataSource.getRepository(entityMap.combos) : null;
+    const comboVendorCache = /* @__PURE__ */ new Map();
+    async function vendorIdForCombo(comboId) {
+      if (comboVendorCache.has(comboId)) return comboVendorCache.get(comboId);
+      if (!comboRepo) return null;
+      const combo = await comboRepo.findOne({
+        where: {
+          id: comboId,
+          deleted: false
+        },
+        select: [
+          "id",
+          "vendorId"
+        ]
+      });
+      const vid = Number(combo?.vendorId);
+      if (Number.isInteger(vid) && vid > 0) {
+        comboVendorCache.set(comboId, vid);
+        return vid;
+      }
+      return null;
+    }
+    chunkUSNT2KNT_cjs.__name(vendorIdForCombo, "vendorIdForCombo");
     for (const it of cart.items || []) {
+      const comboId = comboIdFromCartItem(it);
+      if (comboId != null) {
+        const comboVendorId = await vendorIdForCombo(comboId);
+        if (comboVendorId != null) {
+          vendorIds.add(comboVendorId);
+          continue;
+        }
+      }
       const p = it.product;
       if (!p || p.deleted || p.status !== "available") continue;
       const vid = Number(p.vendorId);
@@ -33198,7 +33319,7 @@ function createStorefrontApiHandler(config) {
           }, {
             status: prepOrd.status
           });
-          const vendorRes = resolveSingleVendorIdFromCart(cart);
+          const vendorRes = await resolveSingleVendorIdFromCart(cart);
           if ("error" in vendorRes) return json({
             error: vendorRes.error
           }, {
@@ -33274,7 +33395,7 @@ function createStorefrontApiHandler(config) {
           }, {
             status: prepChk.status
           });
-          const vendorResChk = resolveSingleVendorIdFromCart(cart);
+          const vendorResChk = await resolveSingleVendorIdFromCart(cart);
           if ("error" in vendorResChk) return json({
             error: vendorResChk.error
           }, {
@@ -33344,17 +33465,48 @@ function createStorefrontApiHandler(config) {
           if (!contact) return json({
             orders: []
           });
-          const orders = await orderRepo().find({
-            where: {
-              contactId: contact.id,
-              deleted: false,
-              orderKind: "sale"
-            },
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
+          const visibleOrders = await orderRepo().find({
+            where: [
+              {
+                contactId: contact.id,
+                deleted: false,
+                orderKind: "sale"
+              },
+              ...linkedCustomerContactIds.length ? [
+                {
+                  customerContactId: typeorm.In(linkedCustomerContactIds),
+                  deleted: false,
+                  orderKind: "sale"
+                }
+              ] : []
+            ],
             order: {
               createdAt: "DESC"
             },
             take: 50
           });
+          const orders = visibleOrders.filter((o) => {
+            const row = o;
+            const orderContactId = Number(row.contactId);
+            const customerContactId = Number(row.customerContactId);
+            if (Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id)) {
+              return true;
+            }
+            if (Number.isFinite(customerContactId) && customerContactId > 0) {
+              return linkedCustomerContactIds.includes(customerContactId);
+            }
+            return false;
+          });
           const orderIds = orders.map((o) => o.id);
           const previewByOrder = {};
           if (orderIds.length) {
@@ -33447,10 +33599,19 @@ function createStorefrontApiHandler(config) {
             status: 404
           });
           const orderId = parseInt(path2[1], 10);
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
           let order = await orderRepo().findOne({
             where: {
               id: orderId,
-              contactId: contact.id,
               deleted: false
             },
             relations: [
@@ -33463,13 +33624,20 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const orderContactId = Number(order.contactId);
+          const orderCustomerContactId = Number(order.customerContactId);
+          const isOwner = Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id) || Number.isFinite(orderCustomerContactId) && orderCustomerContactId > 0 && linkedCustomerContactIds.includes(orderCustomerContactId);
+          if (!isOwner) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           if (getCms) {
             const cms = await getCms();
             await tryRefreshOrderFromErpForStorefront(cms, dataSource, entityMap, order);
             order = await orderRepo().findOne({
               where: {
                 id: orderId,
-                contactId: contact.id,
                 deleted: false
               },
               relations: [
@@ -33483,6 +33651,14 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const refreshedOrderContactId = Number(order.contactId);
+          const refreshedCustomerContactId = Number(order.customerContactId);
+          const isOwnerAfterRefresh = Number.isFinite(refreshedOrderContactId) && refreshedOrderContactId > 0 && refreshedOrderContactId === Number(contact.id) || Number.isFinite(refreshedCustomerContactId) && refreshedCustomerContactId > 0 && linkedCustomerContactIds.includes(refreshedCustomerContactId);
+          if (!isOwnerAfterRefresh) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           const o = order;
           const lines = (o.items || []).map((line) => {
             const p = line.product;

package/dist/{chunk-UO5Q5RXB.js → chunk-LI3CUI54.js}

@@ -1904,6 +1904,32 @@ async function ensureUniqueProductSlug(repo, baseSlug, vendorId, excludeId) {
   }
 }
 __name(ensureUniqueProductSlug, "ensureUniqueProductSlug");
+function isSlugUniqueViolation(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return /duplicate key|unique constraint/i.test(msg) && /slug/i.test(msg);
+}
+__name(isSlugUniqueViolation, "isSlugUniqueViolation");
+async function assertUniqueEventSlug(repo, slugRaw, vendorId, excludeId) {
+  const slug = typeof slugRaw === "string" ? slugRaw.trim() : "";
+  if (!slug) return "Slug is required";
+  await retireSoftDeletedUniqueValue(repo, "slug", slug);
+  const where = excludeId != null ? {
+    slug,
+    vendorId,
+    deleted: false,
+    id: Not(excludeId)
+  } : {
+    slug,
+    vendorId,
+    deleted: false
+  };
+  const dup = await repo.findOne({
+    where
+  });
+  if (dup) return "An event with this slug already exists";
+  return null;
+}
+__name(assertUniqueEventSlug, "assertUniqueEventSlug");
 async function normalizeComboNameAndSlug(repo, body, vendorId, existing, excludeId) {
   const incomingName = typeof body.name === "string" ? body.name.trim() : "";
   const incomingSlugRaw = typeof body.slug === "string" ? body.slug.trim() : "";
@@ -4774,6 +4800,17 @@ function createCrudHandler(dataSource, entityMap, options) {
           status: 400
         });
       }
+      if (resource === "events") {
+        const vendorIdForSlug = scopeCreate.type === "vendor" ? scopeCreate.vendorId : Number(persistBody.vendorId);
+        if (Number.isFinite(vendorIdForSlug) && vendorIdForSlug > 0) {
+          const eventSlugErr = await assertUniqueEventSlug(repo, persistBody.slug, vendorIdForSlug);
+          if (eventSlugErr) return json({
+            error: eventSlugErr
+          }, {
+            status: 400
+          });
+        }
+      }
       sanitizeBodyForEntity(repo, persistBody);
       let created;
       try {
@@ -5053,6 +5090,13 @@ function createCrudHandler(dataSource, entityMap, options) {
         }
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
+        if (resource === "events" && isSlugUniqueViolation(err)) {
+          return json({
+            error: "An event with this slug already exists"
+          }, {
+            status: 400
+          });
+        }
         logCrudServerError("POST create save failed", {
           resource,
           message,
@@ -6329,6 +6373,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             });
           }
         }
+        if ("slug" in updatePayload) {
+          const vendorIdForSlug = scopePut.type === "vendor" ? scopePut.vendorId : Number(currentEvent.vendorId);
+          if (Number.isFinite(vendorIdForSlug) && vendorIdForSlug > 0) {
+            const eventSlugErr = await assertUniqueEventSlug(repo, updatePayload.slug, vendorIdForSlug, numericId);
+            if (eventSlugErr) return json({
+              error: eventSlugErr
+            }, {
+              status: 400
+            });
+          }
+        }
       }
       if (resource === "product_categories" && scopePut.type === "all") {
         const existingCatalogCat = await repo.findOne({
@@ -6492,7 +6547,18 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         }
         sanitizeBodyForEntity(repo, updatePayload);
         await retireSoftDeletedUniquesFromBody(repo, updatePayload);
-        await repo.update(numericId, updatePayload);
+        try {
+          await repo.update(numericId, updatePayload);
+        } catch (err) {
+          if (resource === "events" && isSlugUniqueViolation(err)) {
+            return json({
+              error: "An event with this slug already exists"
+            }, {
+              status: 400
+            });
+          }
+          throw err;
+        }
       }
       if (resource === "orders" && rawBody && entityMap["order_addresses"]) {
         const addressRawScalar = String(rawBody["contact.address"] ?? "").trim();
@@ -8685,11 +8751,21 @@ function createUploadHandler(config) {
       const storageService = raw instanceof Promise ? await raw : raw;
       if (storageService) {
         const fileUrl = await storageService.upload(buffer, `uploads/${relativeUnderUploads}`, contentType);
+        console.info("[upload] stored via storage plugin", {
+          key: `uploads/${relativeUnderUploads}`,
+          contentType,
+          bytes: buffer.length,
+          fileUrl
+        });
         return json({
           filePath: fileUrl,
           parentId
         });
       }
+      console.warn("[upload] no storage plugin \u2014 writing local disk (broken on most deploys)", {
+        localUploadDir,
+        key: relativeUnderUploads
+      });
       const fs2 = await import('fs/promises');
       const path2 = await import('path');
       const dir = path2.join(process.cwd(), localUploadDir);
@@ -8705,11 +8781,13 @@ function createUploadHandler(config) {
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
+      const awsMeta = err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0;
       console.error("[upload] File upload failed", {
         error: message,
         stack: err instanceof Error ? err.stack : void 0,
         name: err instanceof Error ? err.name : void 0,
-        metadata: err && typeof err === "object" && "$metadata" in err ? err.$metadata : void 0
+        code: err && typeof err === "object" && ("Code" in err || "code" in err) ? err.Code ?? err.code : void 0,
+        metadata: awsMeta
       });
       if (/Failed to parse body as FormData/i.test(message)) {
         return json({
@@ -8719,7 +8797,8 @@ function createUploadHandler(config) {
         });
       }
       return json({
-        error: "File upload failed"
+        error: "File upload failed",
+        details: message
       }, {
         status: 500
       });
@@ -30860,9 +30939,51 @@ function createStorefrontApiHandler(config) {
     "items.product.taxes",
     "items.product.taxes.tax"
   ];
-  function resolveSingleVendorIdFromCart(cart) {
+  function comboIdFromCartItem(it) {
+    const meta = it.metadata && typeof it.metadata === "object" && !Array.isArray(it.metadata) ? it.metadata : {};
+    const fromMeta = Number(meta.comboId ?? meta.combo_id);
+    if (Number.isInteger(fromMeta) && fromMeta > 0) return fromMeta;
+    if (meta.isCombo === true || meta.type === "combo" || meta.lineType === "combo") {
+      const pid = Number(it.productId);
+      if (Number.isInteger(pid) && pid > 0) return pid;
+    }
+    return null;
+  }
+  __name(comboIdFromCartItem, "comboIdFromCartItem");
+  async function resolveSingleVendorIdFromCart(cart) {
     const vendorIds = /* @__PURE__ */ new Set();
+    const comboRepo = entityMap.combos ? dataSource.getRepository(entityMap.combos) : null;
+    const comboVendorCache = /* @__PURE__ */ new Map();
+    async function vendorIdForCombo(comboId) {
+      if (comboVendorCache.has(comboId)) return comboVendorCache.get(comboId);
+      if (!comboRepo) return null;
+      const combo = await comboRepo.findOne({
+        where: {
+          id: comboId,
+          deleted: false
+        },
+        select: [
+          "id",
+          "vendorId"
+        ]
+      });
+      const vid = Number(combo?.vendorId);
+      if (Number.isInteger(vid) && vid > 0) {
+        comboVendorCache.set(comboId, vid);
+        return vid;
+      }
+      return null;
+    }
+    __name(vendorIdForCombo, "vendorIdForCombo");
     for (const it of cart.items || []) {
+      const comboId = comboIdFromCartItem(it);
+      if (comboId != null) {
+        const comboVendorId = await vendorIdForCombo(comboId);
+        if (comboVendorId != null) {
+          vendorIds.add(comboVendorId);
+          continue;
+        }
+      }
       const p = it.product;
       if (!p || p.deleted || p.status !== "available") continue;
       const vid = Number(p.vendorId);
@@ -33188,7 +33309,7 @@ function createStorefrontApiHandler(config) {
           }, {
             status: prepOrd.status
           });
-          const vendorRes = resolveSingleVendorIdFromCart(cart);
+          const vendorRes = await resolveSingleVendorIdFromCart(cart);
           if ("error" in vendorRes) return json({
             error: vendorRes.error
           }, {
@@ -33264,7 +33385,7 @@ function createStorefrontApiHandler(config) {
           }, {
             status: prepChk.status
           });
-          const vendorResChk = resolveSingleVendorIdFromCart(cart);
+          const vendorResChk = await resolveSingleVendorIdFromCart(cart);
           if ("error" in vendorResChk) return json({
             error: vendorResChk.error
           }, {
@@ -33334,17 +33455,48 @@ function createStorefrontApiHandler(config) {
           if (!contact) return json({
             orders: []
           });
-          const orders = await orderRepo().find({
-            where: {
-              contactId: contact.id,
-              deleted: false,
-              orderKind: "sale"
-            },
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
+          const visibleOrders = await orderRepo().find({
+            where: [
+              {
+                contactId: contact.id,
+                deleted: false,
+                orderKind: "sale"
+              },
+              ...linkedCustomerContactIds.length ? [
+                {
+                  customerContactId: In(linkedCustomerContactIds),
+                  deleted: false,
+                  orderKind: "sale"
+                }
+              ] : []
+            ],
             order: {
               createdAt: "DESC"
             },
             take: 50
           });
+          const orders = visibleOrders.filter((o) => {
+            const row = o;
+            const orderContactId = Number(row.contactId);
+            const customerContactId = Number(row.customerContactId);
+            if (Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id)) {
+              return true;
+            }
+            if (Number.isFinite(customerContactId) && customerContactId > 0) {
+              return linkedCustomerContactIds.includes(customerContactId);
+            }
+            return false;
+          });
           const orderIds = orders.map((o) => o.id);
           const previewByOrder = {};
           if (orderIds.length) {
@@ -33437,10 +33589,19 @@ function createStorefrontApiHandler(config) {
             status: 404
           });
           const orderId = parseInt(path2[1], 10);
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
           let order = await orderRepo().findOne({
             where: {
               id: orderId,
-              contactId: contact.id,
               deleted: false
             },
             relations: [
@@ -33453,13 +33614,20 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const orderContactId = Number(order.contactId);
+          const orderCustomerContactId = Number(order.customerContactId);
+          const isOwner = Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id) || Number.isFinite(orderCustomerContactId) && orderCustomerContactId > 0 && linkedCustomerContactIds.includes(orderCustomerContactId);
+          if (!isOwner) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           if (getCms) {
             const cms = await getCms();
             await tryRefreshOrderFromErpForStorefront(cms, dataSource, entityMap, order);
             order = await orderRepo().findOne({
               where: {
                 id: orderId,
-                contactId: contact.id,
                 deleted: false
               },
               relations: [
@@ -33473,6 +33641,14 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const refreshedOrderContactId = Number(order.contactId);
+          const refreshedCustomerContactId = Number(order.customerContactId);
+          const isOwnerAfterRefresh = Number.isFinite(refreshedOrderContactId) && refreshedOrderContactId > 0 && refreshedOrderContactId === Number(contact.id) || Number.isFinite(refreshedCustomerContactId) && refreshedCustomerContactId > 0 && linkedCustomerContactIds.includes(refreshedCustomerContactId);
+          if (!isOwnerAfterRefresh) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           const o = order;
           const lines = (o.items || []).map((line) => {
             const p = line.product;