@infuro/cms-core 1.0.66 → 1.0.68

package/dist/{order-assignees-handlers-LKMAGLG6.js → order-assignees-handlers-L3RVKUBS.js}

@@ -45,8 +45,39 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
       const session = await getHydratedSessionUser?.() ?? null;
       const userVendorIds = session?.vendorIds ?? [];
       const isVendorSession = Boolean(session?.isVendorPortal || !session?.isRBACAdmin && userVendorIds.length > 0);
-      Boolean(session?.isRBACAdmin && !session?.isVendorPortal);
-      if (isVendorSession && orderVendorId && !userVendorIds.includes(orderVendorId)) {
+      const isPlatformAdmin = Boolean(session?.isRBACAdmin && !session?.isVendorPortal);
+      console.log("[ORDERS-DEBUG][ELIGIBLE_ASSIGNEES] Fetching for order:", orderId, "orderVendorId:", orderVendorId, "session:", {
+        id: session?.id,
+        email: session?.email,
+        isVendorSession,
+        isPlatformAdmin,
+        userVendorIds
+      });
+      let hasVendorAccess = false;
+      if (!isVendorSession) {
+        hasVendorAccess = true;
+      } else if (orderVendorId && userVendorIds.includes(orderVendorId)) {
+        hasVendorAccess = true;
+      } else {
+        const aId = Number(order?.assignedUserId);
+        if (Number.isFinite(aId) && aId > 0 && entityMap.vendor_users) {
+          const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+          for (const vId of userVendorIds) {
+            const count = await vuRepo.count({
+              where: {
+                vendorId: vId,
+                userId: aId
+              }
+            });
+            if (count > 0) {
+              hasVendorAccess = true;
+              break;
+            }
+          }
+        }
+      }
+      if (!hasVendorAccess) {
+        console.log("[ORDERS-DEBUG][ELIGIBLE_ASSIGNEES] Forbidden: user not in orderVendorId or assignee not in team");
         return json({
           error: "Forbidden: Access denied to vendor order"
         }, {
@@ -54,8 +85,9 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
         });
       }
       const assigneesMap = /* @__PURE__ */ new Map();
+      let vendorsList = [];
       if (isVendorSession) {
-        const targetVendorId = orderVendorId ?? session?.activeVendorId ?? userVendorIds[0];
+        const targetVendorId = session?.activeVendorId ?? (orderVendorId && userVendorIds.includes(orderVendorId) ? orderVendorId : userVendorIds[0]);
         if (entityMap.vendor_users && targetVendorId) {
           const vuRepo = dataSource.getRepository(entityMap.vendor_users);
           const vendorUsers = await vuRepo.find({
@@ -64,42 +96,72 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
             },
             relations: [
               "user",
-              "vendorRole"
+              "vendorRole",
+              "vendor"
             ]
           });
           for (const vu of vendorUsers) {
             const u = vu.user;
             const r = vu.vendorRole;
+            const v = vu.vendor;
             if (u && u.id && !u.deleted && !u.blocked && u.inviteStatus === "active") {
               const roleName = r?.name || (r?.isOwnerRole ? "Owner" : "Vendor Staff");
               assigneesMap.set(u.id, {
                 id: u.id,
                 name: u.name || u.email?.split("@")[0] || `User #${u.id}`,
                 email: u.email || "",
-                role: roleName
+                role: roleName,
+                vendorId: targetVendorId,
+                vendorName: v?.name || `Vendor #${targetVendorId}`
               });
             }
           }
         }
       } else {
+        if (entityMap.vendors) {
+          const vRepo = dataSource.getRepository(entityMap.vendors);
+          const allVendors = await vRepo.find({
+            where: {
+              deleted: false
+            },
+            order: {
+              name: "ASC"
+            },
+            select: [
+              "id",
+              "name",
+              "slug"
+            ]
+          });
+          vendorsList = allVendors.map((v) => ({
+            id: v.id,
+            name: v.name || v.slug || `Vendor #${v.id}`,
+            slug: v.slug || ""
+          }));
+        }
         if (entityMap.vendor_users) {
           const vuRepo = dataSource.getRepository(entityMap.vendor_users);
           const vendorUsers = await vuRepo.find({
             relations: [
               "user",
-              "vendorRole"
+              "vendorRole",
+              "vendor"
             ]
           });
           for (const vu of vendorUsers) {
             const u = vu.user;
             const r = vu.vendorRole;
+            const v = vu.vendor;
             if (u && u.id && !u.deleted && !u.blocked && u.inviteStatus === "active") {
+              if (v && v.deleted) continue;
               const roleName = r?.name || (r?.isOwnerRole ? "Owner" : "Vendor Staff");
               assigneesMap.set(u.id, {
                 id: u.id,
                 name: u.name || u.email?.split("@")[0] || `User #${u.id}`,
                 email: u.email || "",
-                role: roleName
+                role: roleName,
+                vendorId: vu.vendorId,
+                vendorName: v?.name || `Vendor #${vu.vendorId}`
               });
             }
           }
@@ -133,13 +195,20 @@ function createOrderAssigneesHandlers(dataSource, entityMap, getHydratedSessionU
               id: u.id,
               name: u.name || u.email?.split("@")[0] || `User #${u.id}`,
               email: u.email || "",
-              role: roleLabel
+              role: roleLabel,
+              vendorId: null,
+              vendorName: "Platform Staff"
             });
           }
         }
       }
+      console.log("[ORDERS-DEBUG][ELIGIBLE_ASSIGNEES] Returning vendors count:", vendorsList.length, "assignees count:", assigneesMap.size, "currentVendorId:", order.vendorId, "currentAssignedUserId:", order.assignedUserId);
       return json({
+        isPlatformAdmin,
+        isVendorSession,
+        vendors: vendorsList,
         assignees: Array.from(assigneesMap.values()),
+        currentVendorId: order.vendorId ?? null,
         currentAssignedUserId: order.assignedUserId ?? null
       });
     }

package/dist/{order-completion-otp-handlers-NK65LOLV.cjs → order-completion-otp-handlers-DDQREULW.cjs}

@@ -1,12 +1,15 @@
 'use strict';
 
-var chunkWMMZZRDJ_cjs = require('./chunk-WMMZZRDJ.cjs');
+var chunkGN4LKG4V_cjs = require('./chunk-GN4LKG4V.cjs');
 var chunkWFMVD567_cjs = require('./chunk-WFMVD567.cjs');
 var chunkH3IVLIPR_cjs = require('./chunk-H3IVLIPR.cjs');
 require('./chunk-PA6YDMFZ.cjs');
-var chunkXFDIIVZB_cjs = require('./chunk-XFDIIVZB.cjs');
-require('./chunk-GLD263KW.cjs');
+var chunkUMC7W5G3_cjs = require('./chunk-UMC7W5G3.cjs');
+require('./chunk-SUUD7OUG.cjs');
 require('./chunk-UPLVMVRX.cjs');
+require('./chunk-ZX5U3VCB.cjs');
+require('./chunk-M5GPOPGX.cjs');
+require('./chunk-P6S4XFZO.cjs');
 require('./chunk-TZEMLHSP.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 
@@ -65,7 +68,55 @@ async function getOtpChannelsConfig(dataSource, entityMap) {
   };
 }
 chunkUSNT2KNT_cjs.__name(getOtpChannelsConfig, "getOtpChannelsConfig");
-function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
+function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser) {
+  async function verifyOrderAccess(order) {
+    const session = await getHydratedSessionUser?.() ?? null;
+    if (!session) return null;
+    const isPlatformAdmin = Boolean(session.isRBACAdmin && !session.isVendorPortal);
+    if (isPlatformAdmin) return null;
+    const userVendorIds = session.vendorIds ?? [];
+    const orderVendorId = Number(order.vendorId);
+    let hasVendorOrderAccess = Boolean(orderVendorId && userVendorIds.includes(orderVendorId));
+    if (!hasVendorOrderAccess) {
+      const aId = Number(order.assignedUserId);
+      if (Number.isFinite(aId) && aId > 0 && entityMap.vendor_users) {
+        const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+        for (const vId of userVendorIds) {
+          const count = await vuRepo.count({
+            where: {
+              vendorId: vId,
+              userId: aId
+            }
+          });
+          if (count > 0) {
+            hasVendorOrderAccess = true;
+            break;
+          }
+        }
+      }
+    }
+    if (!hasVendorOrderAccess) {
+      return json({
+        error: "Forbidden: Access denied to vendor order"
+      }, {
+        status: 403
+      });
+    }
+    const isVendorOwner = Boolean(session.isVendorOwner || session.isVendorRoleOwner);
+    if (!isVendorOwner) {
+      const sessionUserId = Number(session.id);
+      const assignedUserId = Number(order.assignedUserId);
+      if (!Number.isFinite(assignedUserId) || assignedUserId !== sessionUserId) {
+        return json({
+          error: "Forbidden: You can only process orders assigned directly to you"
+        }, {
+          status: 403
+        });
+      }
+    }
+    return null;
+  }
+  chunkUSNT2KNT_cjs.__name(verifyOrderAccess, "verifyOrderAccess");
   return {
     /** GET /api/orders/:id/completion-otp/channels */
     async getChannels(req, orderId) {
@@ -93,6 +144,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       const cfg = await getOtpChannelsConfig(dataSource, entityMap);
       const customerEmail = o.contact?.email?.trim();
@@ -147,6 +200,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       if (o.status === "completed") {
         return json({
@@ -226,7 +281,7 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
               <p style="color: #6b7280; font-size: 13px;">This code is valid for 10 minutes. If you did not authorize this completion, please contact support immediately.</p>
             </div>
           `;
-          await chunkXFDIIVZB_cjs.queueEmail(cms, {
+          await chunkUMC7W5G3_cjs.queueEmail(cms, {
             to: customerEmail,
             subject: `Completion Code ${code} for Order #${o.orderNumber}`,
             html,
@@ -304,18 +359,6 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 400
         });
       }
-      const verifyResult = await chunkWFMVD567_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
-        purpose: "order_completion",
-        identifier: `order:${orderId}`,
-        code
-      });
-      if (!verifyResult.ok) {
-        return json({
-          error: verifyResult.error
-        }, {
-          status: verifyResult.status
-        });
-      }
       const orderRepo = dataSource.getRepository(entityMap.orders);
       const order = await orderRepo.findOne({
         where: {
@@ -333,13 +376,27 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
+      const verifyResult = await chunkWFMVD567_cjs.verifyAndConsumeOtpChallenge(dataSource, entityMap, {
+        purpose: "order_completion",
+        identifier: `order:${orderId}`,
+        code
+      });
+      if (!verifyResult.ok) {
+        return json({
+          error: verifyResult.error
+        }, {
+          status: verifyResult.status
+        });
+      }
       const now = /* @__PURE__ */ new Date();
       order.status = "completed";
       order.completedAt = now;
       order.updatedAt = now;
       await orderRepo.save(order);
       try {
-        await chunkWMMZZRDJ_cjs.fireOrderNotificationTrigger("order_completed", orderId, {
+        await chunkGN4LKG4V_cjs.fireOrderNotificationTrigger("order_completed", orderId, {
           dataSource,
           entityMap
         });

package/dist/{order-completion-otp-handlers-LFRHXWK4.js → order-completion-otp-handlers-NROWBGXN.js}

@@ -1,10 +1,13 @@
-import { fireOrderNotificationTrigger } from './chunk-RCE5SJBA.js';
+import { fireOrderNotificationTrigger } from './chunk-SKJH7PX4.js';
 import { verifyAndConsumeOtpChallenge, generateNumericOtp, createOtpChallenge, queueSms } from './chunk-OVTOP42W.js';
 import { queueWhatsApp } from './chunk-GWDI752Q.js';
 import './chunk-FLUF2GZH.js';
-import { queueEmail } from './chunk-TU23GJPJ.js';
-import './chunk-OPJEV44S.js';
+import { queueEmail } from './chunk-7JCCPQEF.js';
+import './chunk-ZIT4IP6N.js';
 import './chunk-JC6DLWTE.js';
+import './chunk-Z5OB5QGN.js';
+import './chunk-WKDBMDUX.js';
+import './chunk-IKTBZJHT.js';
 import './chunk-YRCKEGL2.js';
 import { __name } from './chunk-SHUYVCID.js';
 
@@ -63,7 +66,55 @@ async function getOtpChannelsConfig(dataSource, entityMap) {
   };
 }
 __name(getOtpChannelsConfig, "getOtpChannelsConfig");
-function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
+function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms, getHydratedSessionUser) {
+  async function verifyOrderAccess(order) {
+    const session = await getHydratedSessionUser?.() ?? null;
+    if (!session) return null;
+    const isPlatformAdmin = Boolean(session.isRBACAdmin && !session.isVendorPortal);
+    if (isPlatformAdmin) return null;
+    const userVendorIds = session.vendorIds ?? [];
+    const orderVendorId = Number(order.vendorId);
+    let hasVendorOrderAccess = Boolean(orderVendorId && userVendorIds.includes(orderVendorId));
+    if (!hasVendorOrderAccess) {
+      const aId = Number(order.assignedUserId);
+      if (Number.isFinite(aId) && aId > 0 && entityMap.vendor_users) {
+        const vuRepo = dataSource.getRepository(entityMap.vendor_users);
+        for (const vId of userVendorIds) {
+          const count = await vuRepo.count({
+            where: {
+              vendorId: vId,
+              userId: aId
+            }
+          });
+          if (count > 0) {
+            hasVendorOrderAccess = true;
+            break;
+          }
+        }
+      }
+    }
+    if (!hasVendorOrderAccess) {
+      return json({
+        error: "Forbidden: Access denied to vendor order"
+      }, {
+        status: 403
+      });
+    }
+    const isVendorOwner = Boolean(session.isVendorOwner || session.isVendorRoleOwner);
+    if (!isVendorOwner) {
+      const sessionUserId = Number(session.id);
+      const assignedUserId = Number(order.assignedUserId);
+      if (!Number.isFinite(assignedUserId) || assignedUserId !== sessionUserId) {
+        return json({
+          error: "Forbidden: You can only process orders assigned directly to you"
+        }, {
+          status: 403
+        });
+      }
+    }
+    return null;
+  }
+  __name(verifyOrderAccess, "verifyOrderAccess");
   return {
     /** GET /api/orders/:id/completion-otp/channels */
     async getChannels(req, orderId) {
@@ -91,6 +142,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       const cfg = await getOtpChannelsConfig(dataSource, entityMap);
       const customerEmail = o.contact?.email?.trim();
@@ -145,6 +198,8 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
       const o = order;
       if (o.status === "completed") {
         return json({
@@ -302,18 +357,6 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 400
         });
       }
-      const verifyResult = await verifyAndConsumeOtpChallenge(dataSource, entityMap, {
-        purpose: "order_completion",
-        identifier: `order:${orderId}`,
-        code
-      });
-      if (!verifyResult.ok) {
-        return json({
-          error: verifyResult.error
-        }, {
-          status: verifyResult.status
-        });
-      }
       const orderRepo = dataSource.getRepository(entityMap.orders);
       const order = await orderRepo.findOne({
         where: {
@@ -331,6 +374,20 @@ function createOrderCompletionOtpHandlers(dataSource, entityMap, getCms) {
           status: 404
         });
       }
+      const accessError = await verifyOrderAccess(order);
+      if (accessError) return accessError;
+      const verifyResult = await verifyAndConsumeOtpChallenge(dataSource, entityMap, {
+        purpose: "order_completion",
+        identifier: `order:${orderId}`,
+        code
+      });
+      if (!verifyResult.ok) {
+        return json({
+          error: verifyResult.error
+        }, {
+          status: verifyResult.status
+        });
+      }
       const now = /* @__PURE__ */ new Date();
       order.status = "completed";
       order.completedAt = now;

package/dist/{order-notification-dispatcher-LL7ETKLU.cjs → order-notification-dispatcher-6HCJ6Q75.cjs}

@@ -1,35 +1,38 @@
 'use strict';
 
-var chunk5MZFQRDW_cjs = require('./chunk-5MZFQRDW.cjs');
+var chunkSMHQV3WL_cjs = require('./chunk-SMHQV3WL.cjs');
 require('./chunk-H3IVLIPR.cjs');
 require('./chunk-PA6YDMFZ.cjs');
+require('./chunk-OOTLNH63.cjs');
 require('./chunk-VM6OVUUM.cjs');
-require('./chunk-XFDIIVZB.cjs');
-require('./chunk-GLD263KW.cjs');
+require('./chunk-UMC7W5G3.cjs');
+require('./chunk-SUUD7OUG.cjs');
 require('./chunk-UPLVMVRX.cjs');
+require('./chunk-ZX5U3VCB.cjs');
+require('./chunk-M5GPOPGX.cjs');
+require('./chunk-P6S4XFZO.cjs');
 require('./chunk-TZEMLHSP.cjs');
-require('./chunk-OOTLNH63.cjs');
 require('./chunk-USNT2KNT.cjs');
 
 
 
 Object.defineProperty(exports, "dispatchOrderNotificationDirectly", {
   enumerable: true,
-  get: function () { return chunk5MZFQRDW_cjs.dispatchOrderNotificationDirectly; }
+  get: function () { return chunkSMHQV3WL_cjs.dispatchOrderNotificationDirectly; }
 });
 Object.defineProperty(exports, "emitOrderNotificationTrigger", {
   enumerable: true,
-  get: function () { return chunk5MZFQRDW_cjs.emitOrderNotificationTrigger; }
+  get: function () { return chunkSMHQV3WL_cjs.emitOrderNotificationTrigger; }
 });
 Object.defineProperty(exports, "getSettingsGroup", {
   enumerable: true,
-  get: function () { return chunk5MZFQRDW_cjs.getSettingsGroup; }
+  get: function () { return chunkSMHQV3WL_cjs.getSettingsGroup; }
 });
 Object.defineProperty(exports, "initWhatsappTriggerDispatcher", {
   enumerable: true,
-  get: function () { return chunk5MZFQRDW_cjs.initWhatsappTriggerDispatcher; }
+  get: function () { return chunkSMHQV3WL_cjs.initWhatsappTriggerDispatcher; }
 });
 Object.defineProperty(exports, "resendOrderNotification", {
   enumerable: true,
-  get: function () { return chunk5MZFQRDW_cjs.resendOrderNotification; }
+  get: function () { return chunkSMHQV3WL_cjs.resendOrderNotification; }
 });

package/dist/{order-notification-dispatcher-ECPFI7CD.js → order-notification-dispatcher-KM2SY7TX.js}

@@ -1,10 +1,13 @@
-export { dispatchOrderNotificationDirectly, emitOrderNotificationTrigger, getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-NV5IRHI3.js';
+export { dispatchOrderNotificationDirectly, emitOrderNotificationTrigger, getSettingsGroup, initWhatsappTriggerDispatcher, resendOrderNotification } from './chunk-N4LBZXBG.js';
 import './chunk-GWDI752Q.js';
 import './chunk-FLUF2GZH.js';
+import './chunk-CRFV5WJK.js';
 import './chunk-6YOQ7G5O.js';
-import './chunk-TU23GJPJ.js';
-import './chunk-OPJEV44S.js';
+import './chunk-7JCCPQEF.js';
+import './chunk-ZIT4IP6N.js';
 import './chunk-JC6DLWTE.js';
+import './chunk-Z5OB5QGN.js';
+import './chunk-WKDBMDUX.js';
+import './chunk-IKTBZJHT.js';
 import './chunk-YRCKEGL2.js';
-import './chunk-CRFV5WJK.js';
 import './chunk-SHUYVCID.js';

package/dist/{rbac-debug-db-5R6XFPSV.js → rbac-debug-db-DFZWZ6GV.js}

@@ -1,4 +1,4 @@
-import { summarizeEntityPerms, permissionRowsToRecord } from './chunk-MVHDC3XF.js';
+import { summarizeEntityPerms, permissionRowsToRecord } from './chunk-5NOZSG6J.js';
 import { __name } from './chunk-SHUYVCID.js';
 
 // src/auth/rbac-debug-db.ts

package/dist/{rbac-debug-db-JKK2MCWF.cjs → rbac-debug-db-KWV7D5PQ.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkJ7FMZK66_cjs = require('./chunk-J7FMZK66.cjs');
+var chunkO4AFPDQ4_cjs = require('./chunk-O4AFPDQ4.cjs');
 var chunkUSNT2KNT_cjs = require('./chunk-USNT2KNT.cjs');
 
 // src/auth/rbac-debug-db.ts
@@ -27,7 +27,7 @@ async function loadDbPermissionsForUser(dataSource, userId) {
   return {
     groupId,
     groupName,
-    dbEntityPerms: chunkJ7FMZK66_cjs.summarizeEntityPerms(chunkJ7FMZK66_cjs.permissionRowsToRecord(permRows))
+    dbEntityPerms: chunkO4AFPDQ4_cjs.summarizeEntityPerms(chunkO4AFPDQ4_cjs.permissionRowsToRecord(permRows))
   };
 }
 chunkUSNT2KNT_cjs.__name(loadDbPermissionsForUser, "loadDbPermissionsForUser");

package/dist/resolve-invoice-asset-url-JEZRENJW.cjs

@@ -0,0 +1,11 @@
+'use strict';
+
+var chunkP6S4XFZO_cjs = require('./chunk-P6S4XFZO.cjs');
+require('./chunk-USNT2KNT.cjs');
+
+
+
+Object.defineProperty(exports, "resolveInvoiceAssetUrl", {
+  enumerable: true,
+  get: function () { return chunkP6S4XFZO_cjs.resolveInvoiceAssetUrl; }
+});

package/dist/resolve-invoice-asset-url-QZ2FRDHI.js

@@ -0,0 +1,2 @@
+export { resolveInvoiceAssetUrl } from './chunk-IKTBZJHT.js';
+import './chunk-SHUYVCID.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infuro/cms-core",
-  "version": "1.0.66",
+  "version": "1.0.68",
   "private": false,
   "type": "module",
   "main": "./dist/index.cjs",