@infuro/cms-core 1.0.66 → 1.0.67

package/dist/{chunk-T33KU5G5.js → chunk-GLLCLRCQ.js}

@@ -10,9 +10,9 @@ import { isErpIntegrationEnabled } from './chunk-JC6DLWTE.js';
 import { mergeEmailLayoutCompanyDetails } from './chunk-YRCKEGL2.js';
 import { getSmsTemplateDefault, SMS_MESSAGE_TEMPLATE_DEFAULTS } from './chunk-MQBT33IV.js';
 import { EVENT_ORDER_MESSAGE_TEMPLATE_DEFAULTS, EVENT_ORDER_TEMPLATE_KEY, EVENT_ORDER_TEMPLATE_VARIABLES } from './chunk-AYERBA7I.js';
-import { ensureCustomerRecord, linkUnclaimedContactToUser, ensureCustomerForUser, canManageRoles, sessionHasEntityAccess } from './chunk-NR44CK5E.js';
+import { ensureCustomerRecord, linkUnclaimedContactToUser, ensureCustomerForUser, canManageRoles, sessionHasEntityAccess } from './chunk-ZY64VJMS.js';
 import { retireSoftDeletedUniqueValue, activeUniqueValueExists } from './chunk-DBPSJYLZ.js';
-import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-MVHDC3XF.js';
+import { permissionRowsToRecord, logRbac, isSuperAdmin, vendorPortalFlagsFromUser, VENDOR_SCOPED_STORE_ENTITIES, isVendorPortalUser, getPermissionableEntityKeys, VENDOR_STORE_RBAC_ENTITIES, isSuperAdminGroupName, VENDOR_RBAC_ENTITIES, VENDOR_VIEWER_ROLE_NAME, DEFAULT_VENDOR_ROLE_DEFS, VENDOR_GROUP_NAME, resolveVendorScopeFromSessionUser, canManageVendorRoles, isPlatformAdministrator, canManageVendorTeam, resolveDisabledMultiVendorScope, logEntityAccessDecision, explainSessionEntityAccess } from './chunk-5NOZSG6J.js';
 import { queueErp } from './chunk-SYBOCAWB.js';
 import { __name } from './chunk-SHUYVCID.js';
 import { PrimaryGeneratedColumn, Column, Entity, ManyToOne, JoinColumn, CreateDateColumn, UpdateDateColumn, Unique, OneToMany, Index, ManyToMany, JoinTable, In, ILike, Between, MoreThanOrEqual, LessThanOrEqual, Not, MoreThan, IsNull } from 'typeorm';
@@ -1674,6 +1674,30 @@ function entityHasSoftDelete(repo) {
   return repo.metadata.columns.some((c) => c.propertyName === "deleted");
 }
 __name(entityHasSoftDelete, "entityHasSoftDelete");
+async function recordOrderAssigneeHistory(dataSource, entityMap, orderId, userId, vendorId) {
+  if (!entityMap.order_assignees) return 1;
+  const assigneeRepo = dataSource.getRepository(entityMap.order_assignees);
+  const maxRow = await assigneeRepo.findOne({
+    where: {
+      orderId
+    },
+    order: {
+      sortOrder: "DESC"
+    }
+  });
+  const currentMax = Number(maxRow?.sortOrder ?? 0);
+  const nextSortOrder = currentMax + 1;
+  await assigneeRepo.save({
+    orderId,
+    userId,
+    vendorId,
+    sortOrder: nextSortOrder,
+    assignedAt: /* @__PURE__ */ new Date()
+  });
+  console.log(`[ORDERS-DEBUG][ASSIGNEE_HISTORY] Recorded assignment for order ${orderId}: user ${userId}, vendor ${vendorId}, sortOrder ${nextSortOrder}`);
+  return nextSortOrder;
+}
+__name(recordOrderAssigneeHistory, "recordOrderAssigneeHistory");
 var LIST_QUERY_RESERVED = /* @__PURE__ */ new Set([
   "page",
   "limit",
@@ -3556,10 +3580,38 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
-        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").andWhere("order.deleted = :orderDel", {
+        const qb = repo2.createQueryBuilder("order").leftJoinAndSelect("order.contact", "contact").leftJoinAndSelect("order.items", "items").leftJoinAndSelect("items.product", "product").leftJoinAndSelect("product.collection", "collection").leftJoinAndSelect("order.payments", "payments").leftJoinAndSelect("order.assignedUser", "assignedUser").leftJoinAndSelect("order.vendor", "vendor").andWhere("order.deleted = :orderDel", {
           orderDel: false
         }).orderBy(`order.${sortField2}`, sortOrderOrders).skip(skip).take(limit);
-        applyVendorScopeToQueryBuilder(qb, "order", scope);
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][LIST] Querying orders. Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorPortal: session?.isVendorPortal,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          vendorIds: session?.vendorIds,
+          activeVendorId: session?.activeVendorId
+        }, "Scope:", scope);
+        if (scope.type === "deny") {
+          qb.andWhere("1 = 0");
+        } else if (scope.type === "vendor") {
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          console.log("[ORDERS-DEBUG][LIST] Vendor scope applied. isOwner:", isOwner, "vendorId:", scope.vendorId);
+          if (isOwner) {
+            qb.andWhere('(order.vendorId = :vendorScopeId OR order.assignedUserId IN (SELECT vu."userId" FROM vendor_users vu WHERE vu."vendorId" = :vendorScopeId))', {
+              vendorScopeId: scope.vendorId
+            });
+          } else {
+            const teamMemberId = Number(session?.id);
+            console.log("[ORDERS-DEBUG][LIST] Team member scoping to teamMemberId:", teamMemberId);
+            qb.andWhere("order.assignedUserId = :teamMemberId", {
+              teamMemberId
+            });
+          }
+        }
         const vendorIdFilter = searchParams.get("vendorId")?.trim();
         if (vendorIdFilter) {
           const n = Number(vendorIdFilter);
@@ -3612,7 +3664,15 @@ function createCrudHandler(dataSource, entityMap, options) {
             });
           }
         }
+        console.log("[ORDERS-DEBUG][LIST] Executing SQL:", qb.getSql(), "Params:", qb.getParameters());
         const [rows, total2] = await qb.getManyAndCount();
+        console.log("[ORDERS-DEBUG][LIST] Query result: total =", total2, "rows length =", rows.length, "Orders:", rows.map((r) => ({
+          id: r.id,
+          orderNumber: r.orderNumber,
+          vendorId: r.vendorId,
+          assignedUserId: r.assignedUserId,
+          status: r.status
+        })));
         const data2 = await Promise.all(rows.map(async (order) => {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
           const contact = order.contact;
@@ -3656,6 +3716,7 @@ function createCrudHandler(dataSource, entityMap, options) {
           if (orderStatus === "cancelled" && rawPayStatus !== "paid" && rawPayStatus !== "captured" && rawPayStatus !== "refunded") {
             paymentStatus2 = "unpaid";
           }
+          const vendorObj = order.vendor;
           return {
             ...orderWithoutPayments,
             contact: contact ? {
@@ -3669,6 +3730,11 @@ function createCrudHandler(dataSource, entityMap, options) {
               name: assignedUserObj.name || assignedUserObj.email,
               email: assignedUserObj.email
             } : null,
+            vendor: vendorObj ? {
+              id: vendorObj.id,
+              name: vendorObj.name || vendorObj.slug || `Vendor #${vendorObj.id}`,
+              slug: vendorObj.slug
+            } : null,
             itemsSummary,
             paymentStatus: paymentStatus2
           };
@@ -4201,6 +4267,18 @@ function createCrudHandler(dataSource, entityMap, options) {
               isCatalog: true
             });
           }
+        } else if (resource === "orders" && scope.type === "vendor") {
+          const session = await getHydratedSessionUser?.() ?? null;
+          const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+          if (!isOwner) {
+            const teamMemberId = Number(session?.id);
+            where = mergeListWhereAnd(where, {
+              vendorId: scope.vendorId,
+              assignedUserId: teamMemberId
+            });
+          } else {
+            where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
+          }
         } else {
           where = mergeVendorScopeIntoWhere(where, scope, resource, catalogFlags);
         }
@@ -5165,6 +5243,12 @@ function createCrudHandler(dataSource, entityMap, options) {
               shippingAddressId: savedShipping?.id ?? null
             });
           }
+          if (persistBody.assignedUserId) {
+            const initAssignee = Number(persistBody.assignedUserId);
+            if (Number.isFinite(initAssignee) && initAssignee > 0) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, created.id, initAssignee, Number(created.vendorId) || null);
+            }
+          }
           const reloadedOrder = await repo.findOne({
             where: {
               id: created.id,
@@ -5484,7 +5568,16 @@ function createCrudHandler(dataSource, entityMap, options) {
       const scope = await resolveScope();
       const flags = await getVendorCatalogCreateFlags(dataSource);
       if (scope.type !== "all") {
-        data = data.filter((row) => vendorScopeRowAccess(row, scope, resource, flags) === "ok");
+        const session = await getHydratedSessionUser?.() ?? null;
+        const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+        const teamMemberId = Number(session?.id);
+        data = data.filter((row) => {
+          if (vendorScopeRowAccess(row, scope, resource, flags) !== "ok") return false;
+          if (resource === "orders" && scope.type === "vendor" && !isOwner) {
+            return Number(row?.assignedUserId) === teamMemberId;
+          }
+          return true;
+        });
       }
       const excludeCols = /* @__PURE__ */ new Set([
         "deletedAt",
@@ -5522,6 +5615,51 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
     type: "all"
   }));
   async function vendorScopeAccessJson(row, scope, resource) {
+    if (!row) return json({
+      message: "Not found"
+    }, {
+      status: 404
+    });
+    if (resource === "orders" && scope.type === "vendor") {
+      const rowVendorId = Number(row?.vendorId);
+      let orderBelongsToVendorScope = rowVendorId === scope.vendorId;
+      if (!orderBelongsToVendorScope) {
+        const aId = Number(row?.assignedUserId);
+        if (Number.isFinite(aId) && aId > 0 && entityMap["vendor_users"]) {
+          const vuRepo = dataSource.getRepository(entityMap["vendor_users"]);
+          const isTeamMember = await vuRepo.count({
+            where: {
+              vendorId: scope.vendorId,
+              userId: aId
+            }
+          });
+          if (isTeamMember > 0) {
+            orderBelongsToVendorScope = true;
+          }
+        }
+      }
+      if (!orderBelongsToVendorScope) {
+        return json({
+          error: "Forbidden"
+        }, {
+          status: 403
+        });
+      }
+      const session = await getHydratedSessionUser?.() ?? null;
+      const isOwner = Boolean(session?.isVendorOwner || session?.isVendorRoleOwner || session?.isRBACAdmin);
+      if (!isOwner) {
+        const sessionUserId = Number(session?.id);
+        const orderAssignee = Number(row?.assignedUserId);
+        if (!Number.isFinite(orderAssignee) || orderAssignee !== sessionUserId) {
+          return json({
+            error: "Forbidden: You can only access orders assigned directly to you"
+          }, {
+            status: 403
+          });
+        }
+      }
+      return null;
+    }
     const flags = await getVendorCatalogCreateFlags(dataSource);
     const access = vendorScopeRowAccess(row, scope, resource, flags);
     if (access === "ok") return null;
@@ -5646,6 +5784,17 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       if (resource === "orders") {
         const scope2 = await resolveScopeById();
+        const session = await getHydratedSessionUser?.() ?? null;
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Fetching order id:", id, "Scope:", scope2, "Session:", {
+          id: session?.id,
+          email: session?.email,
+          role: session?.role,
+          isRBACAdmin: session?.isRBACAdmin,
+          isVendorOwner: session?.isVendorOwner,
+          isVendorRoleOwner: session?.isVendorRoleOwner,
+          activeVendorId: session?.activeVendorId,
+          vendorIds: session?.vendorIds
+        });
         const order = await repo.findOne({
           where: {
             id: Number(id)
@@ -5658,14 +5807,26 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             "items.product",
             "items.product.collection",
             "payments",
-            "assignedUser"
+            "assignedUser",
+            "vendor"
           ]
         });
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Order found in DB:", order ? {
+          id: order.id,
+          orderNumber: order.orderNumber,
+          vendorId: order.vendorId,
+          assignedUserId: order.assignedUserId,
+          status: order.status
+        } : null);
         if (order) {
           await autoExpireOrderIfPaymentTimeExceeded(dataSource, entityMap, order);
         }
         const orderDenied = await vendorScopeAccessJson(order, scope2, resource);
-        if (orderDenied) return orderDenied;
+        if (orderDenied) {
+          console.log("[ORDERS-DEBUG][GET_BY_ID] Access DENIED for order id:", id);
+          return orderDenied;
+        }
+        console.log("[ORDERS-DEBUG][GET_BY_ID] Access GRANTED for order id:", id);
         const relatedOrders = await repo.find({
           where: {
             parentOrderId: Number(id)
@@ -6049,21 +6210,67 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             lines: []
           } : await calculateOrderTotalsFromLines(dataSource, entityMap, orderLinesNorm, effectiveCurrency, putDiscountId, Number.isFinite(putOrderVendorId) ? putOrderVendorId : null);
           const scalarUpdate = pickColumnUpdates(repo, rawBody);
-          if (rawBody && typeof rawBody === "object" && "assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
-            const aId = Number(rawBody.assignedUserId);
-            if (Number.isFinite(aId) && aId > 0) {
-              scalarUpdate.assignedUserId = aId;
-              scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
-            } else {
-              scalarUpdate.assignedUserId = null;
-              scalarUpdate.assignedAt = null;
+          if (rawBody && typeof rawBody === "object") {
+            if (scopePutEarly.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+              const vId = Number(rawBody.vendorId);
+              if (Number.isFinite(vId) && vId > 0) {
+                scalarUpdate.vendorId = vId;
+              }
+            }
+            if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
+              const aId = Number(rawBody.assignedUserId);
+              if (Number.isFinite(aId) && aId > 0) {
+                if (scopePutEarly.type === "vendor" && entityMap.vendor_users) {
+                  const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+                  const vuLink = await vuRepo.findOne({
+                    where: {
+                      vendorId: scopePutEarly.vendorId,
+                      userId: aId
+                    }
+                  });
+                  if (!vuLink) {
+                    return json({
+                      error: "Cannot assign order to a user outside your vendor team."
+                    }, {
+                      status: 403
+                    });
+                  }
+                  scalarUpdate.vendorId = scopePutEarly.vendorId;
+                } else if (scopePutEarly.type === "all" && entityMap.vendor_users) {
+                  if (entityMap.vendors) {
+                    const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                       FROM vendor_users vu
+                       JOIN vendors v ON v.id = vu."vendorId"
+                       WHERE vu."userId" = $1 AND v.deleted = false
+                       ORDER BY vu.id DESC
+                       LIMIT 1`, [
+                      aId
+                    ]);
+                    if (activeVu.length > 0 && activeVu[0].vendorId) {
+                      scalarUpdate.vendorId = Number(activeVu[0].vendorId);
+                    }
+                  }
+                }
+                const prevAssigned = Number(existingOrderRow?.assignedUserId);
+                const prevVendor = Number(existingOrderRow?.vendorId);
+                const targetVendor = Number.isFinite(Number(scalarUpdate.vendorId)) ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId) || null;
+                if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+                  await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+                }
+                scalarUpdate.assignedUserId = aId;
+                scalarUpdate.assignedAt = /* @__PURE__ */ new Date();
+              } else {
+                scalarUpdate.assignedUserId = null;
+                scalarUpdate.assignedAt = null;
+              }
             }
           }
           if (scalarUpdate.status === "processing") {
             const effectiveAssignee = scalarUpdate.assignedUserId !== void 0 ? scalarUpdate.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-            if (!effectiveAssignee) {
+            const effectiveVendor = scalarUpdate.vendorId !== void 0 ? Number(scalarUpdate.vendorId) : Number(existingOrderRow?.vendorId);
+            if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
               return json({
-                error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+                error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
               }, {
                 status: 400
               });
@@ -6480,7 +6687,9 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
       }
       const updatePayload = rawBody && typeof rawBody === "object" ? pickColumnUpdates(repo, rawBody) : {};
       if (resourceUsesVendorScope(resource)) {
-        delete updatePayload.vendorId;
+        if (!(resource === "orders" && scopePut.type === "all")) {
+          delete updatePayload.vendorId;
+        }
       }
       if (resource === "contacts" && "type" in updatePayload) {
         const t = updatePayload.type;
@@ -6876,9 +7085,59 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
         }
       }
       if (resource === "orders" && orderInvPrev && rawBody && typeof rawBody === "object") {
+        console.log("[ORDERS-DEBUG][UPDATE] PUT /api/orders/" + numericId, "Scope:", scopePut, "rawBody:", rawBody, "existingOrder:", {
+          id: existingOrderRow?.id,
+          vendorId: existingOrderRow?.vendorId,
+          assignedUserId: existingOrderRow?.assignedUserId,
+          status: existingOrderRow?.status
+        });
+        if (scopePut.type === "all" && "vendorId" in rawBody && rawBody.vendorId !== void 0) {
+          const vId = Number(rawBody.vendorId);
+          if (Number.isFinite(vId) && vId > 0) {
+            updatePayload.vendorId = vId;
+          }
+        }
         if ("assignedUserId" in rawBody && rawBody.assignedUserId !== void 0) {
           const aId = Number(rawBody.assignedUserId);
+          console.log("[ORDERS-DEBUG][UPDATE] Updating assignedUserId to:", aId);
           if (Number.isFinite(aId) && aId > 0) {
+            if (scopePut.type === "vendor" && entityMap.vendor_users) {
+              const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+              const vuLink = await vuRepo.findOne({
+                where: {
+                  vendorId: scopePut.vendorId,
+                  userId: aId
+                }
+              });
+              if (!vuLink) {
+                return json({
+                  error: "Cannot assign order to a user outside your vendor team."
+                }, {
+                  status: 403
+                });
+              }
+              updatePayload.vendorId = scopePut.vendorId;
+            } else if (scopePut.type === "all" && entityMap.vendor_users) {
+              if (entityMap.vendors) {
+                const activeVu = await dataSource.query(`SELECT vu."vendorId"
+                   FROM vendor_users vu
+                   JOIN vendors v ON v.id = vu."vendorId"
+                   WHERE vu."userId" = $1 AND v.deleted = false
+                   ORDER BY vu.id DESC
+                   LIMIT 1`, [
+                  aId
+                ]);
+                if (activeVu.length > 0 && activeVu[0].vendorId) {
+                  updatePayload.vendorId = Number(activeVu[0].vendorId);
+                }
+              }
+            }
+            const prevAssigned = Number(existingOrderRow?.assignedUserId);
+            const prevVendor = Number(existingOrderRow?.vendorId);
+            const targetVendor = Number.isFinite(Number(updatePayload.vendorId)) ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId) || null;
+            if (aId !== prevAssigned || targetVendor && targetVendor !== prevVendor) {
+              await recordOrderAssigneeHistory(dataSource, entityMap, numericId, aId, targetVendor);
+            }
             updatePayload.assignedUserId = aId;
             updatePayload.assignedAt = /* @__PURE__ */ new Date();
           } else {
@@ -6886,11 +7145,13 @@ function createCrudByIdHandler(dataSource, entityMap, options) {
             updatePayload.assignedAt = null;
           }
         }
+        console.log("[ORDERS-DEBUG][UPDATE] Final updatePayload for order:", updatePayload);
         if (updatePayload.status === "processing") {
           const effectiveAssignee = updatePayload.assignedUserId !== void 0 ? updatePayload.assignedUserId : existingOrderRow?.assignedUserId ?? null;
-          if (!effectiveAssignee) {
+          const effectiveVendor = updatePayload.vendorId !== void 0 ? Number(updatePayload.vendorId) : Number(existingOrderRow?.vendorId);
+          if (!effectiveAssignee && (!Number.isFinite(effectiveVendor) || effectiveVendor <= 0)) {
             return json({
-              error: "Cannot start processing without assigning a teammate. Please assign a teammate first."
+              error: "Cannot start processing without assigning a vendor or teammate. Please assign first."
             }, {
               status: 400
             });
@@ -25135,6 +25396,109 @@ _ts_decorate69([
 OrderNotificationTrigger = _ts_decorate69([
   Entity("order_notification_triggers")
 ], OrderNotificationTrigger);
+function _ts_decorate70(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate70, "_ts_decorate");
+function _ts_metadata70(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata70, "_ts_metadata");
+var OrderAssignee = class {
+  static {
+    __name(this, "OrderAssignee");
+  }
+  id;
+  orderId;
+  userId;
+  vendorId;
+  sortOrder;
+  assignedAt;
+  createdAt;
+  order;
+  user;
+  vendor;
+};
+_ts_decorate70([
+  PrimaryGeneratedColumn(),
+  _ts_metadata70("design:type", Number)
+], OrderAssignee.prototype, "id", void 0);
+_ts_decorate70([
+  Column("int"),
+  _ts_metadata70("design:type", Number)
+], OrderAssignee.prototype, "orderId", void 0);
+_ts_decorate70([
+  Column("int"),
+  _ts_metadata70("design:type", Number)
+], OrderAssignee.prototype, "userId", void 0);
+_ts_decorate70([
+  Column("int", {
+    nullable: true
+  }),
+  _ts_metadata70("design:type", Object)
+], OrderAssignee.prototype, "vendorId", void 0);
+_ts_decorate70([
+  Column("int", {
+    default: 1
+  }),
+  _ts_metadata70("design:type", Number)
+], OrderAssignee.prototype, "sortOrder", void 0);
+_ts_decorate70([
+  Column({
+    type: "timestamp with time zone",
+    default: /* @__PURE__ */ __name(() => "CURRENT_TIMESTAMP", "default")
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], OrderAssignee.prototype, "assignedAt", void 0);
+_ts_decorate70([
+  CreateDateColumn({
+    type: "timestamp with time zone"
+  }),
+  _ts_metadata70("design:type", typeof Date === "undefined" ? Object : Date)
+], OrderAssignee.prototype, "createdAt", void 0);
+_ts_decorate70([
+  ManyToOne(() => Order, {
+    onDelete: "CASCADE"
+  }),
+  JoinColumn({
+    name: "orderId"
+  }),
+  _ts_metadata70("design:type", typeof Order === "undefined" ? Object : Order)
+], OrderAssignee.prototype, "order", void 0);
+_ts_decorate70([
+  ManyToOne(() => User, {
+    onDelete: "CASCADE"
+  }),
+  JoinColumn({
+    name: "userId"
+  }),
+  _ts_metadata70("design:type", typeof User === "undefined" ? Object : User)
+], OrderAssignee.prototype, "user", void 0);
+_ts_decorate70([
+  ManyToOne(() => Vendor, {
+    nullable: true,
+    onDelete: "SET NULL"
+  }),
+  JoinColumn({
+    name: "vendorId"
+  }),
+  _ts_metadata70("design:type", Object)
+], OrderAssignee.prototype, "vendor", void 0);
+OrderAssignee = _ts_decorate70([
+  Entity("order_assignees"),
+  Index("idx_order_assignees_order", [
+    "orderId"
+  ]),
+  Index("idx_order_assignees_user", [
+    "userId"
+  ]),
+  Index("idx_order_assignees_vendor", [
+    "vendorId"
+  ])
+], OrderAssignee);
 
 // src/entities/index.ts
 var CMS_ENTITY_MAP = {
@@ -25206,7 +25570,8 @@ var CMS_ENTITY_MAP = {
   attendees: Attendee,
   order_notification_bindings: OrderNotificationBinding,
   order_notification_triggers: OrderNotificationTrigger,
-  user_device_tokens: UserDeviceToken
+  user_device_tokens: UserDeviceToken,
+  order_assignees: OrderAssignee
 };
 
 // src/plugins/blog-generator/blog-generator-agent-defaults.ts
@@ -31102,8 +31467,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-LFRHXWK4.js');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-HFGCPC4O.js');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.getChannels(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "send" && m === "POST" && getCms) {
@@ -31117,8 +31482,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-LFRHXWK4.js');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-HFGCPC4O.js');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.sendOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 4 && path2[2] === "completion-otp" && path2[3] === "verify" && m === "POST" && getCms) {
@@ -31132,8 +31497,8 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-LFRHXWK4.js');
-        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms);
+        const { createOrderCompletionOtpHandlers } = await import('./order-completion-otp-handlers-HFGCPC4O.js');
+        const handlers = createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser);
         return handlers.verifyOtp(req, orderId);
       }
       if (path2[0] === "orders" && path2.length === 3 && path2[2] === "eligible-assignees" && m === "GET") {
@@ -31147,7 +31512,7 @@ function createCmsApiHandler(config) {
         }, {
           status: 400
         });
-        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-LKMAGLG6.js');
+        const { createOrderAssigneesHandlers } = await import('./order-assignees-handlers-L3RVKUBS.js');
         const handlers = createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionUser);
         return handlers.listEligibleAssignees(req, orderId);
       }
@@ -34735,4 +35100,4 @@ function createStorefrontApiHandler(config) {
 }
 __name(createStorefrontApiHandler, "createStorefrontApiHandler");
 
-export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, autoExpireOrderIfPaymentTimeExceeded, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, whatsappPlugin, wrapGetCmsWithMessaging };
+export { Address, Attendee, Attribute, BLOG_GENERATOR_AGENT_NAME, BLOG_GENERATOR_DEFAULT_SYSTEM_INSTRUCTION, BLOG_GENERATOR_DEFAULT_VALIDATION_RULES, BLOG_GENERATOR_LLM_AGENT_SLUG, BLOG_GENERATOR_MARKDOWN_ARTICLE_SEPARATOR, BLOG_METADATA_ENRICHER_AGENT_NAME, BLOG_METADATA_ENRICHER_DEFAULT_SYSTEM_INSTRUCTION, BLOG_METADATA_ENRICHER_DEFAULT_VALIDATION_RULES, BLOG_METADATA_ENRICHER_LLM_AGENT_SLUG, Blog, BlogGeneratorService, Brand, CMS_ENTITY_MAP, Cart, CartItem, Category, ChatConversation, ChatMessage, Collection, Combo, ComboItem, Comment, Config, Contact, Currency, CurrencyExchange, Customer, Customer_Contacts, Discount, DiscountRules, Event, EventProduct, Form, FormField, FormSubmission, JobSchedule, JobScheduleRun, KnowledgeBaseChunk, KnowledgeBaseDocument, LlmAgent, LlmAgentKnowledgeDocument, Media, MessageTemplate, Order, OrderAddresses, OrderAssignee, OrderDiscounts, OrderItem, OrderNotificationBinding, OrderNotificationTrigger, OtpChallenge, Page, PasswordResetToken, Payment, Permission, Product, ProductAttribute, ProductCategory, ProductConfig, ProductVariant, RefundPolicy, RefundRequest, RssArticle, RssFeed, Seo, Tag, Tax, User, UserDeviceToken, UserGroup, Vendor, VendorCustomer, VendorRole, VendorRolePermission, VendorUser, VendorUserProfile, Wishlist, WishlistItem, ZIP_MIME_TYPES, applyApprovalStatusSideEffects, applyEventApprovalStatusSideEffects, applyRotatingVendorInvite, applyVendorCustomersContactFilter, applyVendorEventCreateApproval, applyVendorProductCreateApproval, assertCaptchaOk, assertContactAllowedForVendorOrder, assertEventApprovalUpdate, assertProductApprovalUpdate, autoExpireOrderIfPaymentTimeExceeded, buildBlogMetadataUserPrompt, buildCronFromSchedule, buildRssUserPromptFromFeeds, buildUserInviteLink, buildVendorInviteLink, calculateOrderRefundPreview, calculateRefundFromPolicy, checkAndIncrementDiscountUsage, checkEventsEnabled, checkMultiVendorEnabled, completeUserInviteAccept, consumeAppliedDiscountUsages, contactIsVendorCustomer, countDiscountOrdersForContact, createAnalyticsHandlers, createBlogBySlugHandler, createChangePasswordHandler, createCmsApiHandler, createCmsApp, createCmsAppWithMessaging, createCrudByIdHandler, createCrudHandler, createDashboardStatsHandler, createEcommerceAnalyticsHandler, createEventOrderMessageTemplateHandlers, createForgotPasswordHandler, createFormBySlugHandler, createInviteAcceptHandler, createJobScheduleHandlers, createLlmAgentKnowledgeHandlers, createMediaZipExtractHandler, createMessageTemplateRowLoader, createSetPasswordHandler, createSettingsApiHandlers, createSocialMediaHandlers, createStorefrontApiHandler, createUploadHandler, createUserAuthApiRouter, createUserAvatarHandler, createUserProfileHandler, createUsersApiHandlers, createVendorDashboardHandler, createVendorOnboardHandlers, daysBeforeEventStart, decrementDiscountUsage, describeEventTierPolicy, ensureMessagingPluginsOnCms, ensureScheduleQueueWorker, ensureVendorCustomerForOrderContact, ensureVendorCustomersForOrder, findActiveRefundPolicyForVendor, findUserByInviteToken, findVendorByInviteToken, formatTierRange, getPublicSettingsGroup, getRequireEventApproval, getRequireProductApproval, getRssArticleSummaryFromItem, getVendorCatalogCreateFlags, hydrateVendorSessionUser, invalidateEventsCache, invalidateMultiVendorCache, invalidateRequireEventApprovalCache, invalidateRequireProductApprovalCache, invalidateVendorCatalogCreateFlagsCache, isCustomerTypeContact, isMaxPerUserUsageReached, isMaxTotalUsageReached, isZipMedia, llmAgentToChatAgentOptions, loadSettingsGroupFromDb, loadUserVendorContext, mergeGuardrailsIntoSystemPrompt, messagingPlugins, metaFetchUserManagedPages, metaPostPageFeed, metaPostPagePhoto, metaResolvePageAccessToken, newUserInviteToken, normalizeRefundTiers, overlayCmsPlugins, parseBlogGeneratorAgentContent, parseBlogGeneratorModelOutput, parseBlogMetadataEnrichmentJson, parseLlmAgentValidationRules, pgBossScheduleNameForId, queueErpCreateContactIfEnabled, queueJobScheduleNow, queuePlugin, recordDiscountUsage, registerJobRunnerWorker, registerMessagingQueueProcessors, relativePathFromMediaParentId, resolveBlogCategoryIdByName, resolveSettingsEncryptionKey, resolveVendorIdForContactCheck, sanitizeMediaFolderPath, sanitizeStorageSegment, sendVendorOnboardEmails, simpleDecrypt, simpleEncrypt, syncJobScheduleToPgBoss, validateRefundTiers, validateScheduleInput, validateUserMessageAgainstAgentRules, validateUserMessageAgainstStructuredRules, whatsappPlugin, wrapGetCmsWithMessaging };

package/dist/{chunk-J7FMZK66.cjs → chunk-O4AFPDQ4.cjs}

@@ -192,23 +192,34 @@ function canOnboardVendors(user) {
 }
 chunkUSNT2KNT_cjs.__name(canOnboardVendors, "canOnboardVendors");
 function resolveVendorScopeFromSessionUser(user) {
-  if (!user?.email) return {
-    type: "deny"
-  };
-  if (isPlatformAdministrator(user)) return {
-    type: "all"
-  };
+  if (!user?.email) {
+    console.log("[ORDERS-DEBUG][RESOLVE_VENDOR_SCOPE] No user email -> deny");
+    return {
+      type: "deny"
+    };
+  }
+  if (isPlatformAdministrator(user)) {
+    console.log("[ORDERS-DEBUG][RESOLVE_VENDOR_SCOPE] User is Platform Admin -> all");
+    return {
+      type: "all"
+    };
+  }
   const vendorIds = user.vendorIds ?? [];
-  if (vendorIds.length === 0) return {
-    type: "deny"
-  };
+  if (vendorIds.length === 0) {
+    console.log("[ORDERS-DEBUG][RESOLVE_VENDOR_SCOPE] User has 0 vendorIds -> deny. User:", user.email);
+    return {
+      type: "deny"
+    };
+  }
   const preferred = user.activeVendorId ?? vendorIds[0];
   const vendorId = vendorIds.includes(preferred) ? preferred : vendorIds[0];
-  return {
+  const res = {
     type: "vendor",
     vendorId,
     vendorIds
   };
+  console.log("[ORDERS-DEBUG][RESOLVE_VENDOR_SCOPE] User:", user.email, "-> scope:", res);
+  return res;
 }
 chunkUSNT2KNT_cjs.__name(resolveVendorScopeFromSessionUser, "resolveVendorScopeFromSessionUser");
 function vendorPortalFlagsFromUser(input) {
@@ -614,7 +625,7 @@ async function logEntityAccessDecision(dataSource, context, user, entity, action
     const id = Number(user.id);
     if (Number.isFinite(id)) {
       try {
-        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-JKK2MCWF.cjs');
+        const { loadDbPermissionsForUser } = await import('./rbac-debug-db-KWV7D5PQ.cjs');
         dbPermissions = await loadDbPermissionsForUser(dataSource, id);
       } catch (e) {
         dbPermissions = {