@medusajs/framework 2.13.1 → 2.13.2-preview-20260129180641

package/dist/http/middleware-file-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-file-loader.d.ts","sourceRoot":"","sources":["../../src/http/middleware-file-loader.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAE1B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAE1B,MAAM,SAAS,CAAA;AAOhB;;;;GAIG;AACH,qBAAa,oBAAoB;;IAyI/B;;;;OAIG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM;IAa/B;;OAEG;IACH,eAAe;IAIf;;OAEG;IACH,cAAc;IAId;;OAEG;IACH,yBAAyB;IAIzB;;;OAGG;IACH,gCAAgC;CAGjC"}
+{"version":3,"file":"middleware-file-loader.d.ts","sourceRoot":"","sources":["../../src/http/middleware-file-loader.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAE1B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAE1B,MAAM,SAAS,CAAA;AAOhB;;;;GAIG;AACH,qBAAa,oBAAoB;;IAgJ/B;;;;OAIG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM;IAa/B;;OAEG;IACH,eAAe;IAIf;;OAEG;IACH,cAAc;IAId;;OAEG;IACH,yBAAyB;IAIzB;;;OAGG;IACH,gCAAgC;CAGjC"}

package/dist/http/middleware-file-loader.js

@@ -13,9 +13,9 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var _MiddlewareFileLoader_instances, _MiddlewareFileLoader_errorHandler, _MiddlewareFileLoader_middleware, _MiddlewareFileLoader_additionalDataValidatorRoutes, _MiddlewareFileLoader_bodyParserConfigRoutes, _MiddlewareFileLoader_processMiddlewareFile;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MiddlewareFileLoader = void 0;
+const zod_1 = require("@medusajs/deps/zod");
 const utils_1 = require("@medusajs/utils");
 const path_1 = require("path");
-const zod_1 = require("@medusajs/deps/zod");
 const logger_1 = require("../logger");
 const types_1 = require("./types");
 /**
@@ -153,8 +153,14 @@ async function _MiddlewareFileLoader_processMiddlewareFile(absolutePath) {
                 validator: zod_1.z.object(route.additionalDataValidator).nullish(),
             });
         }
-        if (route.middlewares) {
-            route.middlewares.forEach((middleware) => {
+        if (route.middlewares || route.policies) {
+            const middlewares = route.middlewares ?? [];
+            if (route.policies && !route.middlewares?.length) {
+                middlewares.push((_, __, next) => {
+                    next();
+                });
+            }
+            middlewares.forEach((middleware) => {
                 result.middleware.push({
                     handler: middleware,
                     matcher: matcher,

package/dist/http/middleware-file-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware-file-loader.js","sourceRoot":"","sources":["../../src/http/middleware-file-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0E;AAC1E,+BAA2B;AAC3B,4CAAsC;AAEtC,sCAAkC;AAClC,mCAOgB;AAEhB;;GAEG;AACH,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAE1C;;;;GAIG;AACH,MAAa,oBAAoB;IAAjC;;QACE;;WAEG;QACH,qDAA0C;QAE1C;;WAEG;QACH,2CAAsC,EAAE;QAExC;;;WAGG;UALqC;QAExC;;;WAGG;QACH,8DAAiE,EAAE;QAEnE;;WAEG;UAJgE;QAEnE;;WAEG;QACH,uDAAmD,EAAE;QAErD;;;WAGG;UALkD;IAmKvD,CAAC;IA9CC;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,EAAE,GAAG,IAAI,kBAAU,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,oBAAoB,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,uBAAA,IAAI,oFAAuB,MAA3B,IAAI,EACR,IAAA,WAAI,EAAC,SAAS,EAAE,GAAG,oBAAoB,KAAK,CAAC,CAC9C,CAAA;QACH,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,oBAAoB,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,uBAAA,IAAI,oFAAuB,MAA3B,IAAI,EACR,IAAA,WAAI,EAAC,SAAS,EAAE,GAAG,oBAAoB,KAAK,CAAC,CAC9C,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,uBAAA,IAAI,0CAAc,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,uBAAA,IAAI,wCAAY,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,yBAAyB;QACvB,OAAO,uBAAA,IAAI,oDAAwB,CAAA;IACrC,CAAC;IAED;;;OAGG;IACH,gCAAgC;QAC9B,OAAO,uBAAA,IAAI,2DAA+B,CAAA;IAC5C,CAAC;CACF;AAvLD,oDAuLC;;AAjKC;;;GAGG;AACH,KAAK,sDAAwB,YAAoB;IAC/C,MAAM,iBAAiB,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAA;IAE3D,IAAI,IAAA,qBAAa,EAAC,iBAAiB,CAAC,EAAE,CAAC;QACrC,OAAM;IACR,CAAC;IAED,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAA;IAClD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,eAAM,CAAC,IAAI,CACT,wCAAwC,YAAY,sCAAsC,CAC3F,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAqC,CAAA;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,eAAM,CAAC,IAAI,CACT,mCAAmC,YAAY,wEAAwE,CACxH,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAK1B,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,IAAI,CAAC,SAAS,CACpH,KAAK,EACL,IAAI,EACJ,CAAC,CACF,EAAE,CACJ,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAErC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,oBAAY,CAAC,CAAA;YAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,GAAG,CAAC,GAAG,oBAAY,CAAC,CAAA;YAC7B,CAAC;YAED,eAAM,CAAC,KAAK,CACV,6CAA6C,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CACxE,CAAA;YAED,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,OAAO;gBAChB,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,UAAU;aACzB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAChD,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,oBAAY,CAAC,CAAA;YAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,GAAG,CAAC,GAAG,oBAAY,CAAC,CAAA;YAC7B,CAAC;YAED,eAAM,CAAC,KAAK,CACV,iDAAiD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAC5E,CAAA;YAED,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC;gBACxC,OAAO,EAAE,OAAO;gBAChB,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,uBAAuB;gBACrC,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;aAC7D,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;gBACvC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,EACD;QACE,sBAAsB,EAAE,EAAE;QAC1B,6BAA6B,EAAE,EAAE;QACjC,UAAU,EAAE,EAAE;KACf,CACF,CAAA;IAED,MAAM,YAAY,GAChB,gBAAgB,CAAC,YAAiD,CAAA;IAEpE,IAAI,YAAY,EAAE,CAAC;QACjB,uBAAA,IAAI,sCAAiB,YAAY,MAAA,CAAA;IACnC,CAAC;IACD,uBAAA,IAAI,oCAAe,uBAAA,IAAI,wCAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAA,CAAA;IAC7D,uBAAA,IAAI,gDAA2B,uBAAA,IAAI,oDAAwB,CAAC,MAAM,CAChE,MAAM,CAAC,sBAAsB,CAC9B,MAAA,CAAA;IACD,uBAAA,IAAI,uDACF,uBAAA,IAAI,2DAA+B,CAAC,MAAM,CACxC,MAAM,CAAC,6BAA6B,CACrC,MAAA,CAAA;AACL,CAAC"}
+{"version":3,"file":"middleware-file-loader.js","sourceRoot":"","sources":["../../src/http/middleware-file-loader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4CAAsC;AACtC,2CAA0E;AAC1E,+BAA2B;AAE3B,sCAAkC;AAClC,mCAOgB;AAEhB;;GAEG;AACH,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAE1C;;;;GAIG;AACH,MAAa,oBAAoB;IAAjC;;QACE;;WAEG;QACH,qDAA0C;QAE1C;;WAEG;QACH,2CAAsC,EAAE;QAExC;;;WAGG;UALqC;QAExC;;;WAGG;QACH,8DAAiE,EAAE;QAEnE;;WAEG;UAJgE;QAEnE;;WAEG;QACH,uDAAmD,EAAE;QAErD;;;WAGG;UALkD;IA0KvD,CAAC;IA9CC;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,EAAE,GAAG,IAAI,kBAAU,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,oBAAoB,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,uBAAA,IAAI,oFAAuB,MAA3B,IAAI,EACR,IAAA,WAAI,EAAC,SAAS,EAAE,GAAG,oBAAoB,KAAK,CAAC,CAC9C,CAAA;QACH,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,oBAAoB,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,uBAAA,IAAI,oFAAuB,MAA3B,IAAI,EACR,IAAA,WAAI,EAAC,SAAS,EAAE,GAAG,oBAAoB,KAAK,CAAC,CAC9C,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,uBAAA,IAAI,0CAAc,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,uBAAA,IAAI,wCAAY,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,yBAAyB;QACvB,OAAO,uBAAA,IAAI,oDAAwB,CAAA;IACrC,CAAC;IAED;;;OAGG;IACH,gCAAgC;QAC9B,OAAO,uBAAA,IAAI,2DAA+B,CAAA;IAC5C,CAAC;CACF;AA9LD,oDA8LC;;AAxKC;;;GAGG;AACH,KAAK,sDAAwB,YAAoB;IAC/C,MAAM,iBAAiB,GAAG,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAA;IAE3D,IAAI,IAAA,qBAAa,EAAC,iBAAiB,CAAC,EAAE,CAAC;QACrC,OAAM;IACR,CAAC;IAED,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAA;IAClD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,eAAM,CAAC,IAAI,CACT,wCAAwC,YAAY,sCAAsC,CAC3F,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAqC,CAAA;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,eAAM,CAAC,IAAI,CACT,mCAAmC,YAAY,wEAAwE,CACxH,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAK1B,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wGAAwG,IAAI,CAAC,SAAS,CACpH,KAAK,EACL,IAAI,EACJ,CAAC,CACF,EAAE,CACJ,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAErC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,oBAAY,CAAC,CAAA;YAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,GAAG,CAAC,GAAG,oBAAY,CAAC,CAAA;YAC7B,CAAC;YAED,eAAM,CAAC,KAAK,CACV,6CAA6C,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CACxE,CAAA;YAED,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,OAAO;gBAChB,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,UAAU;aACzB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAChD,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,oBAAY,CAAC,CAAA;YAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,GAAG,CAAC,GAAG,oBAAY,CAAC,CAAA;YAC7B,CAAC;YAED,eAAM,CAAC,KAAK,CACV,iDAAiD,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAC5E,CAAA;YAED,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC;gBACxC,OAAO,EAAE,OAAO;gBAChB,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,uBAAuB;gBACrC,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE;aAC7D,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAA;YAC3C,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;gBACjD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;oBAC/B,IAAI,EAAE,CAAA;gBACR,CAAC,CAAC,CAAA;YACJ,CAAC;YAED,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;gBACjC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;oBACrB,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,EACD;QACE,sBAAsB,EAAE,EAAE;QAC1B,6BAA6B,EAAE,EAAE;QACjC,UAAU,EAAE,EAAE;KACf,CACF,CAAA;IAED,MAAM,YAAY,GAChB,gBAAgB,CAAC,YAAiD,CAAA;IAEpE,IAAI,YAAY,EAAE,CAAC;QACjB,uBAAA,IAAI,sCAAiB,YAAY,MAAA,CAAA;IACnC,CAAC;IACD,uBAAA,IAAI,oCAAe,uBAAA,IAAI,wCAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAA,CAAA;IAC7D,uBAAA,IAAI,gDAA2B,uBAAA,IAAI,oDAAwB,CAAC,MAAM,CAChE,MAAM,CAAC,sBAAsB,CAC9B,MAAA,CAAA;IACD,uBAAA,IAAI,uDACF,uBAAA,IAAI,2DAA+B,CAAC,MAAM,CACxC,MAAM,CAAC,6BAA6B,CACrC,MAAA,CAAA;AACL,CAAC"}

package/dist/http/middlewares/check-permissions.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wrapWithPoliciesCheck = wrapWithPoliciesCheck;
 const utils_1 = require("@medusajs/utils");
-const has_permission_1 = require("../../utils/has-permission");
+const has_permission_1 = require("../../policies/has-permission");
 /**
  * Core permission checking logic for middleware and routes
  */
@@ -16,7 +16,7 @@ async function checkPermissions(policies, req) {
     // Get roles from JWT token's app_metadata
     const roleIds = authContext?.app_metadata?.roles || [];
     if (!roleIds.length) {
-        throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, "Unauthorized");
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.FORBIDDEN, "Forbidden");
     }
     const hasAccess = await (0, has_permission_1.hasPermission)({
         roles: roleIds,
@@ -27,7 +27,7 @@ async function checkPermissions(policies, req) {
         const policyKeys = policyList
             .map((p) => `${p.resource}:${p.operation}`)
             .join(", ");
-        throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, `Insufficient permissions. Required policies: ${policyKeys}`);
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.FORBIDDEN, `Insufficient permissions. Required policies: ${policyKeys}`);
     }
 }
 /**

package/dist/http/middlewares/check-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-permissions.js","sourceRoot":"","sources":["../../../src/http/middlewares/check-permissions.ts"],"names":[],"mappings":";;AA8DA,sDAmBC;AAjFD,2CAA6C;AAC7C,+DAA0D;AAa1D;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAuC,EACvC,GAA+B;IAE/B,8BAA8B;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAElE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAA;IACpC,0CAA0C;IAC1C,MAAM,OAAO,GAAI,WAAW,EAAE,YAAY,EAAE,KAAkB,IAAI,EAAE,CAAA;IAEpE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAW,CAAC,mBAAW,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAa,EAAC;QACpC,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,GAAG,CAAC,KAAK;KACrB,CAAC,CAAA;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,UAAU;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,CAAA;QAEb,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,gDAAgD,UAAU,EAAE,CAC7D,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CACnC,OAA2B,EAC3B,QAAuC;IAEvC,OAAO,KAAK,EACV,GAA+B,EAC/B,GAAmB,EACnB,IAAwB,EACxB,EAAE;QACF,IAAI,CAAC;YACH,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;YACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;YAEvE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACrC,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"check-permissions.js","sourceRoot":"","sources":["../../../src/http/middlewares/check-permissions.ts"],"names":[],"mappings":";;AA8DA,sDAmBC;AAjFD,2CAA6C;AAC7C,kEAA6D;AAa7D;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAuC,EACvC,GAA+B;IAE/B,8BAA8B;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAElE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAA;IACpC,0CAA0C;IAC1C,MAAM,OAAO,GAAI,WAAW,EAAE,YAAY,EAAE,KAAkB,IAAI,EAAE,CAAA;IAEpE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,mBAAW,CAAC,mBAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAa,EAAC;QACpC,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,GAAG,CAAC,KAAK;KACrB,CAAC,CAAA;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,UAAU;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,CAAA;QAEb,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,SAAS,EAC3B,gDAAgD,UAAU,EAAE,CAC7D,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CACnC,OAA2B,EAC3B,QAAuC;IAEvC,OAAO,KAAK,EACV,GAA+B,EAC/B,GAAmB,EACnB,IAAwB,EACxB,EAAE;QACF,IAAI,CAAC;YACH,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;YACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;YAEvE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;YACrC,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/http/middlewares/error-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../src/http/middlewares/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAA0B,MAAM,SAAS,CAAA;AAerE,wBAAgB,YAAY,IAoFV,mBAAmB,CACpC;AAED;;;;;;;;;;;;;;;;;GAiBG"}
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../src/http/middlewares/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAA0B,MAAM,SAAS,CAAA;AAerE,wBAAgB,YAAY,IAuFV,mBAAmB,CACpC;AAED;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/http/middlewares/error-handler.js

@@ -39,6 +39,9 @@ function errorHandler() {
             case utils_1.MedusaError.Types.UNAUTHORIZED:
                 statusCode = 401;
                 break;
+            case utils_1.MedusaError.Types.FORBIDDEN:
+                statusCode = 403;
+                break;
             case utils_1.MedusaError.Types.PAYMENT_AUTHORIZATION_ERROR:
                 statusCode = 422;
                 break;

package/dist/http/middlewares/error-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../../src/http/middlewares/error-handler.ts"],"names":[],"mappings":";;AAeA,oCAqFC;AAnGD,+DAAmD;AAEnD,2CAAwE;AAExE,+DAAuD;AAEvD,MAAM,qBAAqB,GAAG,iCAAiC,CAAA;AAC/D,MAAM,mBAAmB,GAAG,gCAAgC,CAAA;AAC5D,MAAM,uBAAuB,GAAG,4BAA4B,CAAA;AAE5D,MAAM,SAAS,GAAG,WAAW,CAAA;AAC7B,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AACrD,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD,SAAgB,YAAY;IAC1B,OAAO,SAAS,gBAAgB,CAC9B,GAAgB,EAChB,GAAkB,EAClB,GAAa,EACb,CAAe;QAEf,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK;YACtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,iCAAyB,CAAC,MAAM,CAAC;YACrD,CAAC,CAAC,OAAO,CAAA;QAEX,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,0EAA0E,CAC3E,CAAA;QACH,CAAC;QAED,GAAG,GAAG,IAAA,qCAAe,EAAC,GAAG,CAAC,CAAA;QAE1B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAA;QACtC,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAA;QAED,IAAI,UAAU,GAAG,GAAG,CAAA;QACpB,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,qBAAqB,CAAC;YAC3B,KAAK,mBAAmB,CAAC;YACzB,KAAK,uBAAuB,CAAC;YAC7B,KAAK,mBAAW,CAAC,KAAK,CAAC,QAAQ;gBAC7B,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAM,CAAC,IAAI,GAAG,mBAAmB,CAAA;gBACjC,MAAM,CAAC,OAAO;oBACZ,2GAA2G,CAAA;gBAC7G,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,YAAY;gBACjC,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,2BAA2B;gBAChD,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,eAAe;gBACpC,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAA;gBACnC,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YACnC,KAAK,mBAAW,CAAC,KAAK,CAAC,YAAY;gBACjC,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,SAAS;gBAC9B,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,QAAQ;gBAC7B,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAM,CAAC,IAAI,GAAG,SAAS,CAAA;gBACvB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACxC,KAAK,mBAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,MAAK;YACP;gBACE,MAAM,CAAC,IAAI,GAAG,eAAe,CAAA;gBAC7B,MAAM,CAAC,OAAO,GAAG,4BAA4B,CAAA;gBAC7C,MAAM,CAAC,IAAI,GAAG,eAAe,CAAA;gBAC7B,MAAK;QACT,CAAC;QAED,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;QAED,IAAI,QAAQ,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,mCAAY,EAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBAC1B,IAAI,EAAE,mBAAW,CAAC,KAAK,CAAC,YAAY;gBACpC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,CAAmC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG"}
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../../src/http/middlewares/error-handler.ts"],"names":[],"mappings":";;AAeA,oCAwFC;AAtGD,+DAAmD;AAEnD,2CAAwE;AAExE,+DAAuD;AAEvD,MAAM,qBAAqB,GAAG,iCAAiC,CAAA;AAC/D,MAAM,mBAAmB,GAAG,gCAAgC,CAAA;AAC5D,MAAM,uBAAuB,GAAG,4BAA4B,CAAA;AAE5D,MAAM,SAAS,GAAG,WAAW,CAAA;AAC7B,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AACrD,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD,SAAgB,YAAY;IAC1B,OAAO,SAAS,gBAAgB,CAC9B,GAAgB,EAChB,GAAkB,EAClB,GAAa,EACb,CAAe;QAEf,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK;YACtB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,iCAAyB,CAAC,MAAM,CAAC;YACrD,CAAC,CAAC,OAAO,CAAA;QAEX,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,0EAA0E,CAC3E,CAAA;QACH,CAAC;QAED,GAAG,GAAG,IAAA,qCAAe,EAAC,GAAG,CAAC,CAAA;QAE1B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAA;QACtC,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAA;QAED,IAAI,UAAU,GAAG,GAAG,CAAA;QACpB,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,qBAAqB,CAAC;YAC3B,KAAK,mBAAmB,CAAC;YACzB,KAAK,uBAAuB,CAAC;YAC7B,KAAK,mBAAW,CAAC,KAAK,CAAC,QAAQ;gBAC7B,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAM,CAAC,IAAI,GAAG,mBAAmB,CAAA;gBACjC,MAAM,CAAC,OAAO;oBACZ,2GAA2G,CAAA;gBAC7G,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,YAAY;gBACjC,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,SAAS;gBAC9B,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,2BAA2B;gBAChD,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,eAAe;gBACpC,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAA;gBACnC,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YACnC,KAAK,mBAAW,CAAC,KAAK,CAAC,YAAY;gBACjC,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,SAAS;gBAC9B,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,QAAQ;gBAC7B,UAAU,GAAG,GAAG,CAAA;gBAChB,MAAM,CAAC,IAAI,GAAG,SAAS,CAAA;gBACvB,MAAK;YACP,KAAK,mBAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACxC,KAAK,mBAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,MAAK;YACP;gBACE,MAAM,CAAC,IAAI,GAAG,eAAe,CAAA;gBAC7B,MAAM,CAAC,OAAO,GAAG,4BAA4B,CAAA;gBAC7C,MAAM,CAAC,IAAI,GAAG,eAAe,CAAA;gBAC7B,MAAK;QACT,CAAC;QAED,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;QAED,IAAI,QAAQ,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,mCAAY,EAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBAC1B,IAAI,EAAE,mBAAW,CAAC,KAAK,CAAC,YAAY;gBACpC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;aAC7B,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,CAAmC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/http/utils/field-filtering/field-parser.d.ts

@@ -0,0 +1,32 @@
+import { ParsedFields } from "./index";
+/**
+ * Handles parsing of field strings into structured field sets
+ * Supports various field modifiers:
+ * - `+field` or ` field`: Add to defaults
+ * - `-field`: Remove from defaults
+ * - `*field` or `field.*`: Select all properties of a relation
+ */
+export declare class FieldParser {
+    /**
+     * Parse field string and defaults into structured field sets
+     * @param fields - Comma-separated field string from query
+     * @param defaults - Default fields to include
+     * @returns ParsedFields with fields and starFields sets
+     */
+    static parse(fields: string | undefined, defaults?: string[]): ParsedFields;
+    /**
+     * Determines if custom fields should replace defaults
+     * Fields replace defaults when any field doesn't have a modifier prefix
+     */
+    private static shouldReplaceDefaults;
+    /**
+     * Apply field modifiers (+, -, etc) to the field set
+     */
+    private static applyFieldModifiers;
+    /**
+     * Extract star fields (* prefix or .* suffix) from allFields into starFields set
+     * Star fields represent "select all properties" for a relation
+     */
+    private static extractStarFields;
+}
+//# sourceMappingURL=field-parser.d.ts.map

package/dist/http/utils/field-filtering/field-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-parser.d.ts","sourceRoot":"","sources":["../../../../src/http/utils/field-filtering/field-parser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEtC;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CACV,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,GAAE,MAAM,EAAO,GACtB,YAAY;IAsBf;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAepC;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAwBlC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;CAWjC"}

package/dist/http/utils/field-filtering/field-parser.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldParser = void 0;
+const utils_1 = require("@medusajs/utils");
+/**
+ * Handles parsing of field strings into structured field sets
+ * Supports various field modifiers:
+ * - `+field` or ` field`: Add to defaults
+ * - `-field`: Remove from defaults
+ * - `*field` or `field.*`: Select all properties of a relation
+ */
+class FieldParser {
+    /**
+     * Parse field string and defaults into structured field sets
+     * @param fields - Comma-separated field string from query
+     * @param defaults - Default fields to include
+     * @returns ParsedFields with fields and starFields sets
+     */
+    static parse(fields, defaults = []) {
+        const starFields = new Set();
+        let allFields = new Set(defaults);
+        if ((0, utils_1.isDefined)(fields)) {
+            const customFields = fields.split(",").filter(Boolean);
+            const shouldReplaceDefaultFields = this.shouldReplaceDefaults(customFields);
+            if (shouldReplaceDefaultFields) {
+                allFields = new Set(customFields.map((f) => f.replace(/^[+ -]/, "")));
+            }
+            else {
+                this.applyFieldModifiers(customFields, allFields);
+            }
+            allFields.add("id");
+        }
+        this.extractStarFields(allFields, starFields);
+        return { fields: allFields, starFields };
+    }
+    /**
+     * Determines if custom fields should replace defaults
+     * Fields replace defaults when any field doesn't have a modifier prefix
+     */
+    static shouldReplaceDefaults(customFields) {
+        return (!customFields.length ||
+            customFields.some((field) => {
+                return !(field.startsWith("-") ||
+                    field.startsWith("+") ||
+                    field.startsWith(" ") ||
+                    field.startsWith("*") ||
+                    field.endsWith(".*"));
+            }));
+    }
+    /**
+     * Apply field modifiers (+, -, etc) to the field set
+     */
+    static applyFieldModifiers(customFields, allFields) {
+        customFields.forEach((field) => {
+            if (field.startsWith("+") || field.startsWith(" ")) {
+                allFields.add(field.trim().replace(/^\+/, ""));
+            }
+            else if (field.startsWith("-")) {
+                const fieldName = field.replace(/^-/, "");
+                for (const reqField of allFields) {
+                    const reqFieldName = reqField.replace(/^\*/, "");
+                    if (reqFieldName === fieldName ||
+                        reqFieldName.startsWith(fieldName + ".")) {
+                        allFields.delete(reqField);
+                    }
+                }
+            }
+            else {
+                allFields.add(field);
+            }
+        });
+    }
+    /**
+     * Extract star fields (* prefix or .* suffix) from allFields into starFields set
+     * Star fields represent "select all properties" for a relation
+     */
+    static extractStarFields(allFields, starFields) {
+        allFields.forEach((field) => {
+            if (field.startsWith("*") || field.endsWith(".*")) {
+                starFields.add(field.replace(/(^\*|\.\*$)/, ""));
+                allFields.delete(field);
+            }
+        });
+    }
+}
+exports.FieldParser = FieldParser;
+//# sourceMappingURL=field-parser.js.map

package/dist/http/utils/field-filtering/field-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-parser.js","sourceRoot":"","sources":["../../../../src/http/utils/field-filtering/field-parser.ts"],"names":[],"mappings":";;;AAAA,2CAA2C;AAG3C;;;;;;GAMG;AACH,MAAa,WAAW;IACtB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CACV,MAA0B,EAC1B,WAAqB,EAAE;QAEvB,MAAM,UAAU,GAAgB,IAAI,GAAG,EAAE,CAAA;QACzC,IAAI,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAgB,CAAA;QAEhD,IAAI,IAAA,iBAAS,EAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACtD,MAAM,0BAA0B,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAA;YAE3E,IAAI,0BAA0B,EAAE,CAAC;gBAC/B,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;YACnD,CAAC;YAED,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;QAE7C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;IAC1C,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,qBAAqB,CAAC,YAAsB;QACzD,OAAO,CACL,CAAC,YAAY,CAAC,MAAM;YACpB,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC1B,OAAO,CAAC,CACN,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;oBACrB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;oBACrB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;oBACrB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;oBACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrB,CAAA;YACH,CAAC,CAAC,CACH,CAAA;IACH,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,mBAAmB,CAChC,YAAsB,EACtB,SAAsB;QAEtB,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;YAChD,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;oBAChD,IACE,YAAY,KAAK,SAAS;wBAC1B,YAAY,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,EACxC,CAAC;wBACD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,iBAAiB,CAC9B,SAAsB,EACtB,UAAuB;QAEvB,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAA;gBAChD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AA7FD,kCA6FC"}

package/dist/http/utils/field-filtering/field-validator.d.ts

@@ -0,0 +1,24 @@
+import { FieldFilterContext, IFieldFilter } from "./index";
+/**
+ * Filter that only allows explicitly specified fields
+ * Fields not in the allowed list are returned as not allowed
+ */
+export declare class AllowedFieldFilter implements IFieldFilter {
+    private allowed;
+    constructor({ allowed }: {
+        allowed: string[];
+    });
+    getNotAllowedFields(context: FieldFilterContext): string[];
+}
+/**
+ * Filter that restricts specific fields
+ * Fields containing any restricted segment are returned as not allowed
+ */
+export declare class RestrictedFieldFilter implements IFieldFilter {
+    private restricted;
+    constructor({ restricted }: {
+        restricted: string[];
+    });
+    getNotAllowedFields(context: FieldFilterContext): string[];
+}
+//# sourceMappingURL=field-validator.d.ts.map

package/dist/http/utils/field-filtering/field-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-validator.d.ts","sourceRoot":"","sources":["../../../../src/http/utils/field-filtering/field-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE1D;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,OAAO,CAAU;gBAEb,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE;IAI9C,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,EAAE;CAmC3D;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,YAAY;IACxD,OAAO,CAAC,UAAU,CAAU;gBAEhB,EAAE,UAAU,EAAE,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;IAIpD,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,EAAE;CAqB3D"}

package/dist/http/utils/field-filtering/field-validator.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RestrictedFieldFilter = exports.AllowedFieldFilter = void 0;
+/**
+ * Filter that only allows explicitly specified fields
+ * Fields not in the allowed list are returned as not allowed
+ */
+class AllowedFieldFilter {
+    constructor({ allowed }) {
+        this.allowed = allowed;
+    }
+    getNotAllowedFields(context) {
+        const { parsedFields } = context;
+        const { fields, starFields } = parsedFields;
+        const fieldsToCheck = [...fields, ...Array.from(starFields)];
+        const notAllowedFields = [];
+        fieldsToCheck.forEach((field) => {
+            const hasAllowedField = this.allowed.includes(field);
+            if (hasAllowedField) {
+                return;
+            }
+            // Select full relation - must match an allowed field fully
+            // e.g product.variants must have product.variants in allowedFields
+            if (starFields.has(field)) {
+                if (hasAllowedField) {
+                    return;
+                }
+                notAllowedFields.push(field);
+                return;
+            }
+            const fieldStartsWithAllowedField = this.allowed.some((allowedField) => field.startsWith(allowedField));
+            if (!fieldStartsWithAllowedField) {
+                notAllowedFields.push(field);
+                return;
+            }
+        });
+        return notAllowedFields;
+    }
+}
+exports.AllowedFieldFilter = AllowedFieldFilter;
+/**
+ * Filter that restricts specific fields
+ * Fields containing any restricted segment are returned as not allowed
+ */
+class RestrictedFieldFilter {
+    constructor({ restricted }) {
+        this.restricted = restricted;
+    }
+    getNotAllowedFields(context) {
+        const { parsedFields } = context;
+        const { fields, starFields } = parsedFields;
+        const fieldsToCheck = [...fields, ...Array.from(starFields)];
+        const notAllowedFields = [];
+        fieldsToCheck.forEach((field) => {
+            const fieldSegments = field.split(".");
+            const hasRestrictedField = this.restricted.some((restrictedField) => fieldSegments.includes(restrictedField));
+            if (hasRestrictedField) {
+                notAllowedFields.push(field);
+                return;
+            }
+            return;
+        });
+        return notAllowedFields;
+    }
+}
+exports.RestrictedFieldFilter = RestrictedFieldFilter;
+//# sourceMappingURL=field-validator.js.map

package/dist/http/utils/field-filtering/field-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-validator.js","sourceRoot":"","sources":["../../../../src/http/utils/field-filtering/field-validator.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,MAAa,kBAAkB;IAG7B,YAAY,EAAE,OAAO,EAAyB;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAED,mBAAmB,CAAC,OAA2B;QAC7C,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;QAChC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,YAAY,CAAA;QAC3C,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAC5D,MAAM,gBAAgB,GAAa,EAAE,CAAA;QAErC,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAEpD,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAM;YACR,CAAC;YAED,2DAA2D;YAC3D,mEAAmE;YACnE,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAM;gBACR,CAAC;gBACD,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YAED,MAAM,2BAA2B,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACrE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAC/B,CAAA;YAED,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,gBAAgB,CAAA;IACzB,CAAC;CACF;AA1CD,gDA0CC;AAED;;;GAGG;AACH,MAAa,qBAAqB;IAGhC,YAAY,EAAE,UAAU,EAA4B;QAClD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED,mBAAmB,CAAC,OAA2B;QAC7C,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;QAChC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,YAAY,CAAA;QAC3C,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAC5D,MAAM,gBAAgB,GAAa,EAAE,CAAA;QAErC,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACtC,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAClE,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,CACxC,CAAA;YACD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YAED,OAAM;QACR,CAAC,CAAC,CAAA;QAEF,OAAO,gBAAgB,CAAA;IACzB,CAAC;CACF;AA5BD,sDA4BC"}

package/dist/http/utils/field-filtering/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Parsed fields structure after processing field strings
+ */
+export interface ParsedFields {
+    /** Regular fields to select */
+    fields: Set<string>;
+    /** Star fields representing full relation selections (e.g., *product.variants) */
+    starFields: Set<string>;
+}
+/**
+ * Context passed to field filters for determining access
+ */
+export interface FieldFilterContext {
+    /** The main entity being queried (e.g., "product", "order") */
+    entity: string;
+    /** Parsed fields to filter */
+    parsedFields: ParsedFields;
+}
+/**
+ * Interface for field filters following the Strategy pattern
+ * Allows adding new field filtering logic without modifying prepareListQuery
+ */
+export interface IFieldFilter {
+    /**
+     * Returns fields that should be excluded from the query
+     * @param context - The filter context containing entity and parsed fields
+     * @returns Array of field names that are not allowed
+     */
+    getNotAllowedFields(context: FieldFilterContext): Promise<string[]> | string[];
+}
+export { FieldParser } from "./field-parser";
+export { AllowedFieldFilter, RestrictedFieldFilter } from "./field-validator";
+//# sourceMappingURL=index.d.ts.map

package/dist/http/utils/field-filtering/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/http/utils/field-filtering/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACnB,kFAAkF;IAClF,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAA;IACd,8BAA8B;IAC9B,YAAY,EAAE,YAAY,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAA;CAC/E;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/http/utils/field-filtering/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RestrictedFieldFilter = exports.AllowedFieldFilter = exports.FieldParser = void 0;
+var field_parser_1 = require("./field-parser");
+Object.defineProperty(exports, "FieldParser", { enumerable: true, get: function () { return field_parser_1.FieldParser; } });
+var field_validator_1 = require("./field-validator");
+Object.defineProperty(exports, "AllowedFieldFilter", { enumerable: true, get: function () { return field_validator_1.AllowedFieldFilter; } });
+Object.defineProperty(exports, "RestrictedFieldFilter", { enumerable: true, get: function () { return field_validator_1.RestrictedFieldFilter; } });
+//# sourceMappingURL=index.js.map

package/dist/http/utils/field-filtering/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/http/utils/field-filtering/index.ts"],"names":[],"mappings":";;;AAiCA,+CAA4C;AAAnC,2GAAA,WAAW,OAAA;AACpB,qDAA6E;AAApE,qHAAA,kBAAkB,OAAA;AAAE,wHAAA,qBAAqB,OAAA"}

package/dist/http/utils/get-query-config.d.ts

@@ -1,8 +1,13 @@
 import { FindConfig, QueryConfig, RequestQueryFields } from "@medusajs/types";
+import { PolicyDefinition } from "@medusajs/utils";
+import { AuthContext, MedusaRequest } from "../types";
 export declare function pickByConfig<TModel>(obj: TModel | TModel[], config: FindConfig<TModel>): Partial<TModel> | Partial<TModel>[];
 export declare function prepareListQuery<T extends RequestQueryFields, TEntity>(validated: T, queryConfig?: QueryConfig<TEntity> & {
     restricted?: string[];
-}): {
+}, req?: MedusaRequest & {
+    policies?: PolicyDefinition[];
+    auth_context?: AuthContext;
+}): Promise<{
     listConfig: {
         select: string[] | undefined;
         relations: string[];
@@ -12,6 +17,7 @@ export declare function prepareListQuery<T extends RequestQueryFields, TEntity>(
         withDeleted: boolean | undefined;
     };
     remoteQueryConfig: {
+        entity: string | TEntity | undefined;
         fields: string[];
         pagination: {
             skip: number;
@@ -24,10 +30,13 @@ export declare function prepareListQuery<T extends RequestQueryFields, TEntity>(
         };
         withDeleted: boolean | undefined;
     };
-};
+}>;
 export declare function prepareRetrieveQuery<T extends RequestQueryFields, TEntity>(validated: T, queryConfig?: QueryConfig<TEntity> & {
     restricted?: string[];
-}): {
+}, req?: MedusaRequest & {
+    policies?: PolicyDefinition[];
+    auth_context?: AuthContext;
+}): Promise<{
     retrieveConfig: {
         select: string[] | undefined;
         relations: string[];
@@ -37,5 +46,5 @@ export declare function prepareRetrieveQuery<T extends RequestQueryFields, TEnti
         pagination: {};
         withDeleted: boolean | undefined;
     };
-};
+}>;
 //# sourceMappingURL=get-query-config.d.ts.map

package/dist/http/utils/get-query-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-query-config.d.ts","sourceRoot":"","sources":["../../../src/http/utils/get-query-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAU7E,wBAAgB,YAAY,CAAC,MAAM,EACjC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EACtB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAWrC;AAoED,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EACpE,SAAS,EAAE,CAAC,EACZ,WAAW,GAAE,WAAW,CAAC,OAAO,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;EAwJnE;AAED,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EACxE,SAAS,EAAE,CAAC,EACZ,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;;;;;;;;;;EAkB/D"}
+{"version":3,"file":"get-query-config.d.ts","sourceRoot":"","sources":["../../../src/http/utils/get-query-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EAOL,gBAAgB,EAGjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AASrD,wBAAgB,YAAY,CAAC,MAAM,EACjC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EACtB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAWrC;AAED,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,kBAAkB,EAAE,OAAO,EAC1E,SAAS,EAAE,CAAC,EACZ,WAAW,GAAE,WAAW,CAAC,OAAO,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,EAClE,GAAG,CAAC,EAAE,aAAa,GAAG;IACpB,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B,YAAY,CAAC,EAAE,WAAW,CAAA;CAC3B;;;;;;;;;;;;;;;;;;;;;;;GA8GF;AAED,wBAAsB,oBAAoB,CACxC,CAAC,SAAS,kBAAkB,EAC5B,OAAO,EAEP,SAAS,EAAE,CAAC,EACZ,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAC9D,GAAG,CAAC,EAAE,aAAa,GAAG;IACpB,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B,YAAY,CAAC,EAAE,WAAW,CAAA;CAC3B;;;;;;;;;;GAmBF"}

package/dist/http/utils/get-query-config.js

@@ -4,6 +4,8 @@ exports.pickByConfig = pickByConfig;
 exports.prepareListQuery = prepareListQuery;
 exports.prepareRetrieveQuery = prepareRetrieveQuery;
 const utils_1 = require("@medusajs/utils");
+const field_filtering_1 = require("./field-filtering");
+const rbac_field_filter_1 = require("./policies/rbac-field-filter");
 function pickByConfig(obj, config) {
     const fields = [...(config.select ?? []), ...(config.relations ?? [])];
     if (fields.length) {
@@ -16,111 +18,33 @@ function pickByConfig(obj, config) {
     }
     return obj;
 }
-function checkRestrictedFields({ fields, restricted, }) {
-    const notAllowedFields = [];
-    fields.forEach((field) => {
-        const fieldSegments = field.split(".");
-        const hasRestrictedField = restricted.some((restrictedField) => fieldSegments.includes(restrictedField));
-        if (hasRestrictedField) {
-            notAllowedFields.push(field);
-            return;
-        }
-        return;
-    });
-    return notAllowedFields;
-}
-function checkAllowedFields({ fields, allowed, starFields, }) {
-    const notAllowedFields = [];
-    fields.forEach((field) => {
-        const hasAllowedField = allowed.includes(field);
-        if (hasAllowedField) {
-            return;
-        }
-        // Select full relation in that case it must match an allowed field fully
-        // e.g product.variants in that case we must have a product.variants in the allowedFields
-        if (starFields.has(field)) {
-            if (hasAllowedField) {
-                return;
-            }
-            notAllowedFields.push(field);
-            return;
-        }
-        const fieldStartsWithAllowedField = allowed.some((allowedField) => field.startsWith(allowedField));
-        if (!fieldStartsWithAllowedField) {
-            notAllowedFields.push(field);
-            return;
-        }
-    });
-    return notAllowedFields;
-}
-function prepareListQuery(validated, queryConfig = {}) {
-    let { allowed = [], restricted = [], defaults = [], defaultLimit = 50, isList, } = queryConfig;
+async function prepareListQuery(validated, queryConfig = {}, req) {
+    let { allowed = [], restricted = [], defaults = [], defaultLimit = 50, isList, entity, } = queryConfig;
     const { order, fields, limit = defaultLimit, offset = 0, with_deleted, } = validated;
-    // e.g *product.variants meaning that we want all fields from the product.variants
-    // in that case it wont be part of the select but it will be part of the relations.
-    // For the remote query we will have to add the fields to the fields array as product.variants.*
-    const starFields = new Set();
-    let allFields = new Set(defaults);
-    if ((0, utils_1.isDefined)(fields)) {
-        const customFields = fields.split(",").filter(Boolean);
-        const shouldReplaceDefaultFields = !customFields.length ||
-            customFields.some((field) => {
-                return !(field.startsWith("-") ||
-                    field.startsWith("+") ||
-                    field.startsWith(" ") ||
-                    field.startsWith("*") ||
-                    field.endsWith(".*"));
-            });
-        if (shouldReplaceDefaultFields) {
-            allFields = new Set(customFields.map((f) => f.replace(/^[+ -]/, "")));
-        }
-        else {
-            customFields.forEach((field) => {
-                if (field.startsWith("+") || field.startsWith(" ")) {
-                    allFields.add(field.trim().replace(/^\+/, ""));
-                }
-                else if (field.startsWith("-")) {
-                    const fieldName = field.replace(/^-/, "");
-                    for (const reqField of allFields) {
-                        const reqFieldName = reqField.replace(/^\*/, "");
-                        if (reqFieldName === fieldName ||
-                            reqFieldName.startsWith(fieldName + ".")) {
-                            allFields.delete(reqField);
-                        }
-                    }
-                }
-                else {
-                    allFields.add(field);
-                }
-            });
-        }
-        allFields.add("id");
+    const parsedFields = field_filtering_1.FieldParser.parse(fields, defaults);
+    const { fields: allFields, starFields } = parsedFields;
+    const rbacFilterFieldsFeatureFlag = utils_1.FeatureFlag.isFeatureEnabled("rbac_filter_fields");
+    const filters = [];
+    if (req?.policies && entity && rbacFilterFieldsFeatureFlag) {
+        filters.push(new rbac_field_filter_1.RBACFieldFilter({
+            policies: req.policies,
+            userRoles: req.auth_context?.app_metadata?.roles || [],
+            container: req.scope,
+        }));
     }
-    allFields.forEach((field) => {
-        if (field.startsWith("*") || field.endsWith(".*")) {
-            starFields.add(field.replace(/(^\*|\.\*$)/, ""));
-            allFields.delete(field);
-        }
-    });
-    let notAllowedFields = [];
-    if (allowed.length || restricted.length) {
-        const fieldsToCheck = [...allFields, ...Array.from(starFields)];
-        if (allowed.length) {
-            notAllowedFields = checkAllowedFields({
-                fields: fieldsToCheck,
-                starFields,
-                allowed,
-            });
-        }
-        else if (restricted.length) {
-            notAllowedFields = checkRestrictedFields({
-                fields: fieldsToCheck,
-                restricted,
-            });
-        }
+    if (allowed.length) {
+        filters.push(new field_filtering_1.AllowedFieldFilter({ allowed }));
     }
-    if (notAllowedFields.length) {
-        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Requested fields [${Array.from(notAllowedFields).join(", ")}] are not valid`);
+    else if (restricted.length) {
+        filters.push(new field_filtering_1.RestrictedFieldFilter({ restricted }));
+    }
+    const notAllowedArrays = await (0, utils_1.promiseAll)(filters.map((f) => f.getNotAllowedFields({ entity: entity, parsedFields })));
+    const notAllowedFields = [...new Set(notAllowedArrays.flat())];
+    if (notAllowedFields.length && rbacFilterFieldsFeatureFlag) {
+        notAllowedFields.forEach((field) => {
+            allFields.delete(field);
+            starFields.delete(field);
+        });
     }
     // TODO: maintain backward compatibility, remove in the future
     const { select, relations } = (0, utils_1.stringToSelectRelationObject)(Array.from(allFields));
@@ -151,6 +75,7 @@ function prepareListQuery(validated, queryConfig = {}) {
             withDeleted: with_deleted,
         },
         remoteQueryConfig: {
+            entity,
             // Add starFields that are relations only on which we want all properties with a dedicated format to the remote query
             fields: [
                 ...Array.from(allFields),
@@ -167,8 +92,8 @@ function prepareListQuery(validated, queryConfig = {}) {
         },
     };
 }
-function prepareRetrieveQuery(validated, queryConfig) {
-    const { listConfig, remoteQueryConfig } = prepareListQuery(validated, queryConfig);
+async function prepareRetrieveQuery(validated, queryConfig, req) {
+    const { listConfig, remoteQueryConfig } = await prepareListQuery(validated, queryConfig, req);
     return {
         retrieveConfig: {
             select: listConfig.select,