@infuro/cms-core 1.0.65 → 1.0.67

package/dist/{order-completion-otp-handlers-RW5RSXH3.cjs → order-completion-otp-handlers-DZAXK4GQ.cjs}

@@ -1,9 +1,9 @@
 'use strict';
 
-var chunkV6EYAC7X_cjs = require('./chunk-V6EYAC7X.cjs');
+var chunkWMMZZRDJ_cjs = require('./chunk-WMMZZRDJ.cjs');
 var chunkWFMVD567_cjs = require('./chunk-WFMVD567.cjs');
 var chunkH3IVLIPR_cjs = require('./chunk-H3IVLIPR.cjs');
-require('./chunk-BXAKL2TF.cjs');
+require('./chunk-PA6YDMFZ.cjs');
 var chunkXFDIIVZB_cjs = require('./chunk-XFDIIVZB.cjs');
 require('./chunk-GLD263KW.cjs');
 require('./chunk-UPLVMVRX.cjs');
@@ -65,7 +65,55 @@ async function getOtpChannelsConfig(dataSource, entityMap) {
   };
 }
 chunkUSNT2KNT_cjs.__name(getOtpChannelsConfig, "getOtpChannelsConfig");
-function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
+function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser) {
+  async function verifyOrderAccess(order) {
+    const session = await getHydratedSessionUser?.() ?? null;
+    if (!session) return null;
+    const isPlatformAdmin = Boolean(session.isRBACAdmin && !session.isVendorPortal);
+    if (isPlatformAdmin) return null;
+    const userVendorIds = session.vendorIds ?? [];
+    const orderVendorId = Number(order.vendorId);
+    let hasVendorOrderAccess = Boolean(orderVendorId && userVendorIds.includes(orderVendorId));
+    if (!hasVendorOrderAccess) {
+      const aId = Number(order.assignedUserId);
+      if (Number.isFinite(aId) && aId > 0 && entityMap.vendor_users) {
+        const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+        for (const vId of userVendorIds) {
+          const count = await vuRepo.count({
+            where: {
+              vendorId: vId,
+              userId: aId
+            }
+          });
+          if (count > 0) {
+            hasVendorOrderAccess = true;
+            break;
+          }
+        }
+      }
+    }
+    if (!hasVendorOrderAccess) {
+      return json({
+        error: "Forbidden: Access denied to vendor order"
+      }, {
+        status: 403
+      });
+    }
+    const isVendorOwner = Boolean(session.isVendorOwner || session.isVendorRoleOwner);
+    if (!isVendorOwner) {
+      const sessionUserId = Number(session.id);
+      const assignedUserId = Number(order.assignedUserId);
+      if (!Number.isFinite(assignedUserId) || assignedUserId !== sessionUserId) {
+        return json({
+          error: "Forbidden: You can only process orders assigned directly to you"
+        }, {
+          status: 403
+        });
+      }
+    }
+    return null;
+  }
+  chunkUSNT2KNT_cjs.__name(verifyOrderAccess, "verifyOrderAccess");
   return {
     /** GET /api/orders/:id/completion-otp/channels */
     async getChannels(req, orderId) {
@@ -93,6 +141,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       const cfg = await getOtpChannelsConfig(dataSource, entityMap);
       const customerEmail = o.contact?.email?.trim();
@@ -147,6 +197,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       if (o.status === "completed") {
         return json({
@@ -304,18 +356,6 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 400
         });
       }
-      const verifyResult = await chunkWFMVD567_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
-        purpose: "order_completion",
-        identifier: `order:${orderId}`,
-        code
-      });
-      if (!verifyResult.ok) {
-        return json({
-          error: verifyResult.error
-        }, {
-          status: verifyResult.status
-        });
-      }
       const orderRepo = dataSource.getRepository(entityMap.orders);
       const order = await orderRepo.findOne({
         where: {
@@ -333,13 +373,27 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
+      const verifyResult = await chunkWFMVD567_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
+        purpose: "order_completion",
+        identifier: `order:${orderId}`,
+        code
+      });
+      if (!verifyResult.ok) {
+        return json({
+          error: verifyResult.error
+        }, {
+          status: verifyResult.status
+        });
+      }
       const now = /* @__PURE__ */ new Date();
       order.status = "completed";
       order.completedAt = now;
       order.updatedAt = now;
       await orderRepo.save(order);
       try {
-        await chunkV6EYAC7X_cjs.fireOrderNotificationTrigger("order_completed", orderId, {
+        await chunkWMMZZRDJ_cjs.fireOrderNotificationTrigger("order_completed", orderId, {
           dataSource,
           entityMap
         });

package/dist/{order-completion-otp-handlers-CH22ZRAI.js → order-completion-otp-handlers-HFGCPC4O.js}

@@ -1,7 +1,7 @@
-import { fireOrderNotificationTrigger } from './chunk-RDEVZMO5.js';
+import { fireOrderNotificationTrigger } from './chunk-RCE5SJBA.js';
 import { verifyAndConsumeOtpChallenge, generateNumericOtp, createOtpChallenge, queueSms } from './chunk-OVTOP42W.js';
 import { queueWhatsApp } from './chunk-GWDI752Q.js';
-import './chunk-YEAXE4U2.js';
+import './chunk-FLUF2GZH.js';
 import { queueEmail } from './chunk-TU23GJPJ.js';
 import './chunk-OPJEV44S.js';
 import './chunk-JC6DLWTE.js';
@@ -63,7 +63,55 @@ async function getOtpChannelsConfig(dataSource, entityMap) {
   };
 }
 __name(getOtpChannelsConfig, "getOtpChannelsConfig");
-function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
+function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser) {
+  async function verifyOrderAccess(order) {
+    const session = await getHydratedSessionUser?.() ?? null;
+    if (!session) return null;
+    const isPlatformAdmin = Boolean(session.isRBACAdmin && !session.isVendorPortal);
+    if (isPlatformAdmin) return null;
+    const userVendorIds = session.vendorIds ?? [];
+    const orderVendorId = Number(order.vendorId);
+    let hasVendorOrderAccess = Boolean(orderVendorId && userVendorIds.includes(orderVendorId));
+    if (!hasVendorOrderAccess) {
+      const aId = Number(order.assignedUserId);
+      if (Number.isFinite(aId) && aId > 0 && entityMap.vendor_users) {
+        const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+        for (const vId of userVendorIds) {
+          const count = await vuRepo.count({
+            where: {
+              vendorId: vId,
+              userId: aId
+            }
+          });
+          if (count > 0) {
+            hasVendorOrderAccess = true;
+            break;
+          }
+        }
+      }
+    }
+    if (!hasVendorOrderAccess) {
+      return json({
+        error: "Forbidden: Access denied to vendor order"
+      }, {
+        status: 403
+      });
+    }
+    const isVendorOwner = Boolean(session.isVendorOwner || session.isVendorRoleOwner);
+    if (!isVendorOwner) {
+      const sessionUserId = Number(session.id);
+      const assignedUserId = Number(order.assignedUserId);
+      if (!Number.isFinite(assignedUserId) || assignedUserId !== sessionUserId) {
+        return json({
+          error: "Forbidden: You can only process orders assigned directly to you"
+        }, {
+          status: 403
+        });
+      }
+    }
+    return null;
+  }
+  __name(verifyOrderAccess, "verifyOrderAccess");
   return {
     /** GET /api/orders/:id/completion-otp/channels */
     async getChannels(req, orderId) {
@@ -91,6 +139,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       const cfg = await getOtpChannelsConfig(dataSource, entityMap);
       const customerEmail = o.contact?.email?.trim();
@@ -145,6 +195,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       if (o.status === "completed") {
         return json({
@@ -302,18 +354,6 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 400
         });
       }
-      const verifyResult = await verifyAndConsumeOtpChallenge(dataSource, entityMap, {
-        purpose: "order_completion",
-        identifier: `order:${orderId}`,
-        code
-      });
-      if (!verifyResult.ok) {
-        return json({
-          error: verifyResult.error
-        }, {
-          status: verifyResult.status
-        });
-      }
       const orderRepo = dataSource.getRepository(entityMap.orders);
       const order = await orderRepo.findOne({
         where: {
@@ -331,6 +371,20 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
+      const verifyResult = await verifyAndConsumeOtpChallenge(dataSource, entityMap, {
+        purpose: "order_completion",
+        identifier: `order:${orderId}`,
+        code
+      });
+      if (!verifyResult.ok) {
+        return json({
+          error: verifyResult.error
+        }, {
+          status: verifyResult.status
+        });
+      }
       const now = /* @__PURE__ */ new Date();
       order.status = "completed";
       order.completedAt = now;

package/dist/{order-notification-dispatcher-3TXUAJ7L.js → order-notification-dispatcher-ECPFI7CD.js}

@@ -1,6 +1,6 @@
-export { dispatchOrderNotificationDirectly, emitOrderNotificationTrigger, getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-ACBN6UWZ.js';
+export { dispatchOrderNotificationDirectly, emitOrderNotificationTrigger, getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-NV5IRHI3.js';
 import './chunk-GWDI752Q.js';
-import './chunk-YEAXE4U2.js';
+import './chunk-FLUF2GZH.js';
 import './chunk-6YOQ7G5O.js';
 import './chunk-TU23GJPJ.js';
 import './chunk-OPJEV44S.js';

package/dist/{order-notification-dispatcher-Y7NZAALH.cjs → order-notification-dispatcher-LL7ETKLU.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkNIRYYJIJ_cjs = require('./chunk-NIRYYJIJ.cjs');
+var chunk5MZFQRDW_cjs = require('./chunk-5MZFQRDW.cjs');
 require('./chunk-H3IVLIPR.cjs');
-require('./chunk-BXAKL2TF.cjs');
+require('./chunk-PA6YDMFZ.cjs');
 require('./chunk-VM6OVUUM.cjs');
 require('./chunk-XFDIIVZB.cjs');
 require('./chunk-GLD263KW.cjs');
@@ -15,21 +15,21 @@ require('./chunk-USNT2KNT.cjs');
 
 Object.defineProperty(exports, "dispatchOrderNotificationDirectly", {
   enumerable: true,
-  get: function () { return chunkNIRYYJIJ_cjs.dispatchOrderNotificationDirectly; }
+  get: function () { return chunk5MZFQRDW_cjs.dispatchOrderNotificationDirectly; }
 });
 Object.defineProperty(exports, "emitOrderNotificationTrigger", {
   enumerable: true,
-  get: function () { return chunkNIRYYJIJ_cjs.emitOrderNotificationTrigger; }
+  get: function () { return chunk5MZFQRDW_cjs.emitOrderNotificationTrigger; }
 });
 Object.defineProperty(exports, "getSettingsGroup", {
   enumerable: true,
-  get: function () { return chunkNIRYYJIJ_cjs.getSettingsGroup; }
+  get: function () { return chunk5MZFQRDW_cjs.getSettingsGroup; }
 });
 Object.defineProperty(exports, "initWhatsappTriggerDispatcher", {
   enumerable: true,
-  get: function () { return chunkNIRYYJIJ_cjs.initWhatsappTriggerDispatcher; }
+  get: function () { return chunk5MZFQRDW_cjs.initWhatsappTriggerDispatcher; }
 });
 Object.defineProperty(exports, "resendOrderNotification", {
   enumerable: true,
-  get: function () { return chunkNIRYYJIJ_cjs.resendOrderNotification; }
+  get: function () { return chunk5MZFQRDW_cjs.resendOrderNotification; }
 });

package/dist/{rbac-debug-db-5R6XFPSV.js → rbac-debug-db-DFZWZ6GV.js}

@@ -1,4 +1,4 @@
-import { summarizeEntityPerms, permissionRowsToRecord } from './chunk-MVHDC3XF.js';
+import { summarizeEntityPerms, permissionRowsToRecord } from './chunk-5NOZSG6J.js';
 import { __name } from './chunk-SHUYVCID.js';
 
 // src/auth/rbac-debug-db.ts

package/dist/{rbac-debug-db-JKK2MCWF.cjs → rbac-debug-db-KWV7D5PQ.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkJ7FMZK66_cjs = require('./chunk-J7FMZK66.cjs');
+var chunkO4AFPDQ4_cjs = require('./chunk-O4AFPDQ4.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 
 // src/auth/rbac-debug-db.ts
@@ -27,7 +27,7 @@ async function loadDbPermissionsForUser(dataSource, userId) {
   return {
     groupId,
     groupName,
-    dbEntityPerms: chunkJ7FMZK66_cjs.summarizeEntityPerms(chunkJ7FMZK66_cjs.permissionRowsToRecord(permRows))
+    dbEntityPerms: chunkO4AFPDQ4_cjs.summarizeEntityPerms(chunkO4AFPDQ4_cjs.permissionRowsToRecord(permRows))
   };
 }
 chunkUSNT2KNT_cjs.__name(loadDbPermissionsForUser, "loadDbPermissionsForUser");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infuro/cms-core",
-  "version": "1.0.65",
+  "version": "1.0.67",
   "private": false,
   "type": "module",
   "main": "./dist/index.cjs",