@infuro/cms-core 1.0.54 → 1.0.56

package/dist/admin.cjs

@@ -887,7 +887,7 @@ var init_admin_config_context = __esm({
 var CMS_VERSION;
 var init_cms_version = __esm({
   "src/lib/cms-version.ts"() {
-    CMS_VERSION = "1.0.54" ;
+    CMS_VERSION = "1.0.56" ;
   }
 });
 function useCatalogCategories(enabled = true) {
@@ -33696,7 +33696,7 @@ function EventEditPage({ eventId }) {
         setExhibitors(parseNamedListFromApi(data.exhibitors, "exhibitor"));
         setPartners(parseNamedListFromApi(data.partners, "partner"));
         setSpeakers(parseNamedListFromApi(data.speakers, "speaker"));
-        setSortOrder(Number(data.sortOrder) ?? 0);
+        setSortOrder(data.sortOrder != null ? Number(data.sortOrder) : 0);
         setContactFormId(data.contactFormId != null && Number.isFinite(Number(data.contactFormId)) ? Number(data.contactFormId) : null);
         const loadedDefault = String(data.defaultCurrency ?? DEFAULT_EVENT_CURRENCY).trim().toUpperCase() || DEFAULT_EVENT_CURRENCY;
         setDefaultCurrency(loadedDefault);
@@ -33808,7 +33808,7 @@ function EventEditPage({ eventId }) {
       exhibitors: namedListToPayload(exhibitors),
       partners: namedListToPayload(partners),
       speakers: namedListToPayload(speakers),
-      sortOrder,
+      sortOrder: sortOrder === "" ? 0 : sortOrder,
       contactFormId
     };
     if (approvalOn) {
@@ -34075,8 +34075,19 @@ function EventEditPage({ eventId }) {
       className: labelCls6
     }, "Sort order"), /* @__PURE__ */ React.createElement("input", {
       type: "number",
+      min: 0,
       value: sortOrder,
-      onChange: /* @__PURE__ */ __name((e) => setSortOrder(Number(e.target.value) || 0), "onChange"),
+      onChange: /* @__PURE__ */ __name((e) => {
+        const value = e.target.value;
+        if (value === "") {
+          setSortOrder("");
+          return;
+        }
+        const number = Number(value);
+        if (number >= 0) {
+          setSortOrder(number);
+        }
+      }, "onChange"),
       className: inputCls6
     })), /* @__PURE__ */ React.createElement("div", {
       className: "sm:col-span-2"
@@ -34353,17 +34364,15 @@ function EventEditPage({ eventId }) {
     }))))
   }), /* @__PURE__ */ React.createElement("div", {
     className: "flex items-center justify-between border-t border-gray-200 px-4 py-4 sm:px-6"
-  }, /* @__PURE__ */ React.createElement("button", {
+  }, activeTabIndex > 0 ? /* @__PURE__ */ React.createElement("button", {
     type: "button",
     onClick: goToPreviousTab,
-    disabled: activeTabIndex === 0,
-    className: "rounded-md border border-gray-300 bg-white px-4 py-2 text-sm font-medium text-gray-700 hover:bg-gray-50 disabled:cursor-not-allowed disabled:opacity-40"
-  }, "Previous"), /* @__PURE__ */ React.createElement("button", {
+    className: "rounded-md border border-gray-300 bg-white px-4 py-2 text-sm font-medium text-gray-700 hover:bg-gray-50"
+  }, "Previous") : /* @__PURE__ */ React.createElement("div", null), activeTabIndex < eventTabs.length - 1 ? /* @__PURE__ */ React.createElement("button", {
     type: "button",
     onClick: goToNextTab,
-    disabled: activeTabIndex === eventTabs.length - 1,
-    className: "rounded-md bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-800 disabled:cursor-not-allowed disabled:opacity-40"
-  }, "Next")), showEventProducts ? /* @__PURE__ */ React.createElement("div", {
+    className: "rounded-md bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-800"
+  }, "Next") : /* @__PURE__ */ React.createElement("div", null)), showEventProducts ? /* @__PURE__ */ React.createElement("div", {
     className: "border-t border-gray-200 px-4 py-4 sm:px-6"
   }, /* @__PURE__ */ React.createElement(EventProductsSection, {
     eventId: eventRecordId,

package/dist/admin.js

@@ -853,7 +853,7 @@ var init_admin_config_context = __esm({
 var CMS_VERSION;
 var init_cms_version = __esm({
   "src/lib/cms-version.ts"() {
-    CMS_VERSION = "1.0.54" ;
+    CMS_VERSION = "1.0.56" ;
   }
 });
 function useCatalogCategories(enabled = true) {
@@ -33662,7 +33662,7 @@ function EventEditPage({ eventId }) {
         setExhibitors(parseNamedListFromApi(data.exhibitors, "exhibitor"));
         setPartners(parseNamedListFromApi(data.partners, "partner"));
         setSpeakers(parseNamedListFromApi(data.speakers, "speaker"));
-        setSortOrder(Number(data.sortOrder) ?? 0);
+        setSortOrder(data.sortOrder != null ? Number(data.sortOrder) : 0);
         setContactFormId(data.contactFormId != null && Number.isFinite(Number(data.contactFormId)) ? Number(data.contactFormId) : null);
         const loadedDefault = String(data.defaultCurrency ?? DEFAULT_EVENT_CURRENCY).trim().toUpperCase() || DEFAULT_EVENT_CURRENCY;
         setDefaultCurrency(loadedDefault);
@@ -33774,7 +33774,7 @@ function EventEditPage({ eventId }) {
       exhibitors: namedListToPayload(exhibitors),
       partners: namedListToPayload(partners),
       speakers: namedListToPayload(speakers),
-      sortOrder,
+      sortOrder: sortOrder === "" ? 0 : sortOrder,
       contactFormId
     };
     if (approvalOn) {
@@ -34041,8 +34041,19 @@ function EventEditPage({ eventId }) {
       className: labelCls6
     }, "Sort order"), /* @__PURE__ */ React.createElement("input", {
       type: "number",
+      min: 0,
       value: sortOrder,
-      onChange: /* @__PURE__ */ __name((e) => setSortOrder(Number(e.target.value) || 0), "onChange"),
+      onChange: /* @__PURE__ */ __name((e) => {
+        const value = e.target.value;
+        if (value === "") {
+          setSortOrder("");
+          return;
+        }
+        const number = Number(value);
+        if (number >= 0) {
+          setSortOrder(number);
+        }
+      }, "onChange"),
       className: inputCls6
     })), /* @__PURE__ */ React.createElement("div", {
       className: "sm:col-span-2"
@@ -34319,17 +34330,15 @@ function EventEditPage({ eventId }) {
     }))))
   }), /* @__PURE__ */ React.createElement("div", {
     className: "flex items-center justify-between border-t border-gray-200 px-4 py-4 sm:px-6"
-  }, /* @__PURE__ */ React.createElement("button", {
+  }, activeTabIndex > 0 ? /* @__PURE__ */ React.createElement("button", {
     type: "button",
     onClick: goToPreviousTab,
-    disabled: activeTabIndex === 0,
-    className: "rounded-md border border-gray-300 bg-white px-4 py-2 text-sm font-medium text-gray-700 hover:bg-gray-50 disabled:cursor-not-allowed disabled:opacity-40"
-  }, "Previous"), /* @__PURE__ */ React.createElement("button", {
+    className: "rounded-md border border-gray-300 bg-white px-4 py-2 text-sm font-medium text-gray-700 hover:bg-gray-50"
+  }, "Previous") : /* @__PURE__ */ React.createElement("div", null), activeTabIndex < eventTabs.length - 1 ? /* @__PURE__ */ React.createElement("button", {
     type: "button",
     onClick: goToNextTab,
-    disabled: activeTabIndex === eventTabs.length - 1,
-    className: "rounded-md bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-800 disabled:cursor-not-allowed disabled:opacity-40"
-  }, "Next")), showEventProducts ? /* @__PURE__ */ React.createElement("div", {
+    className: "rounded-md bg-gray-900 px-4 py-2 text-sm font-medium text-white hover:bg-gray-800"
+  }, "Next") : /* @__PURE__ */ React.createElement("div", null)), showEventProducts ? /* @__PURE__ */ React.createElement("div", {
     className: "border-t border-gray-200 px-4 py-4 sm:px-6"
   }, /* @__PURE__ */ React.createElement(EventProductsSection, {
     eventId: eventRecordId,

package/dist/api.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkCJ2YAVCO_cjs = require('./chunk-CJ2YAVCO.cjs');
+var chunkJGR4ZUON_cjs = require('./chunk-JGR4ZUON.cjs');
 require('./chunk-XQ3QUHWR.cjs');
 require('./chunk-HY3AXLOI.cjs');
 require('./chunk-JN4AFHZ4.cjs');
@@ -22,127 +22,127 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "createAnalyticsHandlers", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createAnalyticsHandlers; }
+  get: function () { return chunkJGR4ZUON_cjs.createAnalyticsHandlers; }
 });
 Object.defineProperty(exports, "createBlogBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createBlogBySlugHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createBlogBySlugHandler; }
 });
 Object.defineProperty(exports, "createChangePasswordHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createChangePasswordHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createChangePasswordHandler; }
 });
 Object.defineProperty(exports, "createCmsApiHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createCmsApiHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createCmsApiHandler; }
 });
 Object.defineProperty(exports, "createCrudByIdHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createCrudByIdHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createCrudByIdHandler; }
 });
 Object.defineProperty(exports, "createCrudHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createCrudHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createCrudHandler; }
 });
 Object.defineProperty(exports, "createDashboardStatsHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createDashboardStatsHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createDashboardStatsHandler; }
 });
 Object.defineProperty(exports, "createEcommerceAnalyticsHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createEcommerceAnalyticsHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createEcommerceAnalyticsHandler; }
 });
 Object.defineProperty(exports, "createForgotPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createForgotPasswordHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createForgotPasswordHandler; }
 });
 Object.defineProperty(exports, "createFormBySlugHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createFormBySlugHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createFormBySlugHandler; }
 });
 Object.defineProperty(exports, "createInviteAcceptHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createInviteAcceptHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createInviteAcceptHandler; }
 });
 Object.defineProperty(exports, "createJobScheduleHandlers", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createJobScheduleHandlers; }
+  get: function () { return chunkJGR4ZUON_cjs.createJobScheduleHandlers; }
 });
 Object.defineProperty(exports, "createLlmAgentKnowledgeHandlers", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createLlmAgentKnowledgeHandlers; }
+  get: function () { return chunkJGR4ZUON_cjs.createLlmAgentKnowledgeHandlers; }
 });
 Object.defineProperty(exports, "createMediaZipExtractHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createMediaZipExtractHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createMediaZipExtractHandler; }
 });
 Object.defineProperty(exports, "createSetPasswordHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createSetPasswordHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createSetPasswordHandler; }
 });
 Object.defineProperty(exports, "createSettingsApiHandlers", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createSettingsApiHandlers; }
+  get: function () { return chunkJGR4ZUON_cjs.createSettingsApiHandlers; }
 });
 Object.defineProperty(exports, "createStorefrontApiHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createStorefrontApiHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createStorefrontApiHandler; }
 });
 Object.defineProperty(exports, "createUploadHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createUploadHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createUploadHandler; }
 });
 Object.defineProperty(exports, "createUserAuthApiRouter", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createUserAuthApiRouter; }
+  get: function () { return chunkJGR4ZUON_cjs.createUserAuthApiRouter; }
 });
 Object.defineProperty(exports, "createUserAvatarHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createUserAvatarHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createUserAvatarHandler; }
 });
 Object.defineProperty(exports, "createUserProfileHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createUserProfileHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createUserProfileHandler; }
 });
 Object.defineProperty(exports, "createUsersApiHandlers", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createUsersApiHandlers; }
+  get: function () { return chunkJGR4ZUON_cjs.createUsersApiHandlers; }
 });
 Object.defineProperty(exports, "createVendorDashboardHandler", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createVendorDashboardHandler; }
+  get: function () { return chunkJGR4ZUON_cjs.createVendorDashboardHandler; }
 });
 Object.defineProperty(exports, "createVendorOnboardHandlers", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.createVendorOnboardHandlers; }
+  get: function () { return chunkJGR4ZUON_cjs.createVendorOnboardHandlers; }
 });
 Object.defineProperty(exports, "getPublicSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.getPublicSettingsGroup; }
+  get: function () { return chunkJGR4ZUON_cjs.getPublicSettingsGroup; }
 });
 Object.defineProperty(exports, "mergeGuardrailsIntoSystemPrompt", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.mergeGuardrailsIntoSystemPrompt; }
+  get: function () { return chunkJGR4ZUON_cjs.mergeGuardrailsIntoSystemPrompt; }
 });
 Object.defineProperty(exports, "parseLlmAgentValidationRules", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.parseLlmAgentValidationRules; }
+  get: function () { return chunkJGR4ZUON_cjs.parseLlmAgentValidationRules; }
 });
 Object.defineProperty(exports, "simpleDecrypt", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.simpleDecrypt; }
+  get: function () { return chunkJGR4ZUON_cjs.simpleDecrypt; }
 });
 Object.defineProperty(exports, "simpleEncrypt", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.simpleEncrypt; }
+  get: function () { return chunkJGR4ZUON_cjs.simpleEncrypt; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstAgentRules", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.validateUserMessageAgainstAgentRules; }
+  get: function () { return chunkJGR4ZUON_cjs.validateUserMessageAgainstAgentRules; }
 });
 Object.defineProperty(exports, "validateUserMessageAgainstStructuredRules", {
   enumerable: true,
-  get: function () { return chunkCJ2YAVCO_cjs.validateUserMessageAgainstStructuredRules; }
+  get: function () { return chunkJGR4ZUON_cjs.validateUserMessageAgainstStructuredRules; }
 });
 Object.defineProperty(exports, "createCmsAuthBundle", {
   enumerable: true,

package/dist/api.js

@@ -1,4 +1,4 @@
-export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-PDA4L2LS.js';
+export { createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createSetPasswordHandler, createSettingsApiHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, getPublicSettingsGroup, mergeGuardrailsIntoSystemPrompt, parseLlmAgentValidationRules, simpleDecrypt, simpleEncrypt, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules } from './chunk-LI3CUI54.js';
 import './chunk-GO7PPYNU.js';
 import './chunk-3K5AIEIZ.js';
 import './chunk-CTXBYO2J.js';

package/dist/{chunk-CJ2YAVCO.cjs → chunk-JGR4ZUON.cjs}

@@ -33465,17 +33465,48 @@ function createStorefrontApiHandler(config) {
           if (!contact) return json({
             orders: []
           });
-          const orders = await orderRepo().find({
-            where: {
-              contactId: contact.id,
-              deleted: false,
-              orderKind: "sale"
-            },
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
+          const visibleOrders = await orderRepo().find({
+            where: [
+              {
+                contactId: contact.id,
+                deleted: false,
+                orderKind: "sale"
+              },
+              ...linkedCustomerContactIds.length ? [
+                {
+                  customerContactId: typeorm.In(linkedCustomerContactIds),
+                  deleted: false,
+                  orderKind: "sale"
+                }
+              ] : []
+            ],
             order: {
               createdAt: "DESC"
             },
             take: 50
           });
+          const orders = visibleOrders.filter((o) => {
+            const row = o;
+            const orderContactId = Number(row.contactId);
+            const customerContactId = Number(row.customerContactId);
+            if (Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id)) {
+              return true;
+            }
+            if (Number.isFinite(customerContactId) && customerContactId > 0) {
+              return linkedCustomerContactIds.includes(customerContactId);
+            }
+            return false;
+          });
           const orderIds = orders.map((o) => o.id);
           const previewByOrder = {};
           if (orderIds.length) {
@@ -33568,10 +33599,19 @@ function createStorefrontApiHandler(config) {
             status: 404
           });
           const orderId = parseInt(path2[1], 10);
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
           let order = await orderRepo().findOne({
             where: {
               id: orderId,
-              contactId: contact.id,
               deleted: false
             },
             relations: [
@@ -33584,13 +33624,20 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const orderContactId = Number(order.contactId);
+          const orderCustomerContactId = Number(order.customerContactId);
+          const isOwner = Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id) || Number.isFinite(orderCustomerContactId) && orderCustomerContactId > 0 && linkedCustomerContactIds.includes(orderCustomerContactId);
+          if (!isOwner) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           if (getCms) {
             const cms = await getCms();
             await tryRefreshOrderFromErpForStorefront(cms, dataSource, entityMap, order);
             order = await orderRepo().findOne({
               where: {
                 id: orderId,
-                contactId: contact.id,
                 deleted: false
               },
               relations: [
@@ -33604,6 +33651,14 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const refreshedOrderContactId = Number(order.contactId);
+          const refreshedCustomerContactId = Number(order.customerContactId);
+          const isOwnerAfterRefresh = Number.isFinite(refreshedOrderContactId) && refreshedOrderContactId > 0 && refreshedOrderContactId === Number(contact.id) || Number.isFinite(refreshedCustomerContactId) && refreshedCustomerContactId > 0 && linkedCustomerContactIds.includes(refreshedCustomerContactId);
+          if (!isOwnerAfterRefresh) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           const o = order;
           const lines = (o.items || []).map((line) => {
             const p = line.product;

package/dist/{chunk-PDA4L2LS.js → chunk-LI3CUI54.js}

@@ -33455,17 +33455,48 @@ function createStorefrontApiHandler(config) {
           if (!contact) return json({
             orders: []
           });
-          const orders = await orderRepo().find({
-            where: {
-              contactId: contact.id,
-              deleted: false,
-              orderKind: "sale"
-            },
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
+          const visibleOrders = await orderRepo().find({
+            where: [
+              {
+                contactId: contact.id,
+                deleted: false,
+                orderKind: "sale"
+              },
+              ...linkedCustomerContactIds.length ? [
+                {
+                  customerContactId: In(linkedCustomerContactIds),
+                  deleted: false,
+                  orderKind: "sale"
+                }
+              ] : []
+            ],
             order: {
               createdAt: "DESC"
             },
             take: 50
           });
+          const orders = visibleOrders.filter((o) => {
+            const row = o;
+            const orderContactId = Number(row.contactId);
+            const customerContactId = Number(row.customerContactId);
+            if (Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id)) {
+              return true;
+            }
+            if (Number.isFinite(customerContactId) && customerContactId > 0) {
+              return linkedCustomerContactIds.includes(customerContactId);
+            }
+            return false;
+          });
           const orderIds = orders.map((o) => o.id);
           const previewByOrder = {};
           if (orderIds.length) {
@@ -33558,10 +33589,19 @@ function createStorefrontApiHandler(config) {
             status: 404
           });
           const orderId = parseInt(path2[1], 10);
+          let linkedCustomerContactIds = [];
+          if (entityMap.customer && entityMap.customer_contacts) {
+            const rows = await dataSource.query(`SELECT cc.id
+               FROM customer_contacts cc
+               JOIN customer c ON c.id = cc."customerId"
+               WHERE c."userId" = $1`, [
+              uid
+            ]);
+            linkedCustomerContactIds = rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id) && id > 0);
+          }
           let order = await orderRepo().findOne({
             where: {
               id: orderId,
-              contactId: contact.id,
               deleted: false
             },
             relations: [
@@ -33574,13 +33614,20 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const orderContactId = Number(order.contactId);
+          const orderCustomerContactId = Number(order.customerContactId);
+          const isOwner = Number.isFinite(orderContactId) && orderContactId > 0 && orderContactId === Number(contact.id) || Number.isFinite(orderCustomerContactId) && orderCustomerContactId > 0 && linkedCustomerContactIds.includes(orderCustomerContactId);
+          if (!isOwner) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           if (getCms) {
             const cms = await getCms();
             await tryRefreshOrderFromErpForStorefront(cms, dataSource, entityMap, order);
             order = await orderRepo().findOne({
               where: {
                 id: orderId,
-                contactId: contact.id,
                 deleted: false
               },
               relations: [
@@ -33594,6 +33641,14 @@ function createStorefrontApiHandler(config) {
           }, {
             status: 404
           });
+          const refreshedOrderContactId = Number(order.contactId);
+          const refreshedCustomerContactId = Number(order.customerContactId);
+          const isOwnerAfterRefresh = Number.isFinite(refreshedOrderContactId) && refreshedOrderContactId > 0 && refreshedOrderContactId === Number(contact.id) || Number.isFinite(refreshedCustomerContactId) && refreshedCustomerContactId > 0 && linkedCustomerContactIds.includes(refreshedCustomerContactId);
+          if (!isOwnerAfterRefresh) return json({
+            error: "Not found"
+          }, {
+            status: 404
+          });
           const o = order;
           const lines = (o.items || []).map((line) => {
             const p = line.product;