@mercurjs/core 2.3.2-canary.0 → 2.3.2-canary.2

package/.medusa/server/src/api/store/product-attributes/validators.d.ts

@@ -32,10 +32,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -45,10 +45,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -72,10 +72,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -85,10 +85,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -140,10 +140,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -153,10 +153,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -180,10 +180,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -193,10 +193,10 @@ export declare const StoreGetProductAttributesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;

package/.medusa/server/src/api/store/product-categories/validators.d.ts

@@ -40,10 +40,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -53,10 +53,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -80,10 +80,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -93,10 +93,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -148,10 +148,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -161,10 +161,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -188,10 +188,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -201,10 +201,10 @@ export declare const StoreGetProductCategoriesParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;

package/.medusa/server/src/api/store/products/validators.d.ts

@@ -6,13 +6,13 @@ export declare const StoreGetProductParams: z.ZodObject<{
     region_id: z.ZodOptional<z.ZodString>;
     currency_code: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
+    currency_code?: string | undefined;
     fields?: string | undefined;
     region_id?: string | undefined;
-    currency_code?: string | undefined;
 }, {
+    currency_code?: string | undefined;
     fields?: string | undefined;
     region_id?: string | undefined;
-    currency_code?: string | undefined;
 }>;
 export type StoreGetProductsParamsType = z.infer<typeof StoreGetProductsParams>;
 export declare const StoreGetProductsParams: z.ZodObject<{} & {
@@ -43,10 +43,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -56,10 +56,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -83,10 +83,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -96,10 +96,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -169,10 +169,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -182,10 +182,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -209,10 +209,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt: any;
             $lte: any;
         }, z.core.$strip, z.ZodTypeAny, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;
@@ -222,10 +222,10 @@ export declare const StoreGetProductsParams: z.ZodObject<{} & {
             $lt?: any;
             $lte?: any;
         }, {
+            $nin?: any;
             $eq?: any;
             $ne?: any;
             $in?: any;
-            $nin?: any;
             $like?: any;
             $ilike?: any;
             $re?: any;

package/.medusa/server/src/api/store/sellers/validators.d.ts

@@ -26,10 +26,10 @@ export declare const StoreGetSellersParams: z.ZodObject<{
         $lt: any;
         $lte: any;
     }, z.core.$strip, z.ZodTypeAny, {
+        $nin?: any;
         $eq?: any;
         $ne?: any;
         $in?: any;
-        $nin?: any;
         $like?: any;
         $ilike?: any;
         $re?: any;
@@ -39,10 +39,10 @@ export declare const StoreGetSellersParams: z.ZodObject<{
         $lt?: any;
         $lte?: any;
     }, {
+        $nin?: any;
         $eq?: any;
         $ne?: any;
         $in?: any;
-        $nin?: any;
         $like?: any;
         $ilike?: any;
         $re?: any;
@@ -66,10 +66,10 @@ export declare const StoreGetSellersParams: z.ZodObject<{
         $lt: any;
         $lte: any;
     }, z.core.$strip, z.ZodTypeAny, {
+        $nin?: any;
         $eq?: any;
         $ne?: any;
         $in?: any;
-        $nin?: any;
         $like?: any;
         $ilike?: any;
         $re?: any;
@@ -79,10 +79,10 @@ export declare const StoreGetSellersParams: z.ZodObject<{
         $lt?: any;
         $lte?: any;
     }, {
+        $nin?: any;
         $eq?: any;
         $ne?: any;
         $in?: any;
-        $nin?: any;
         $like?: any;
         $ilike?: any;
         $re?: any;

package/.medusa/server/src/api/utils/ensure-seller-middleware.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureSellerMiddleware = ensureSellerMiddleware;
 const utils_1 = require("@medusajs/framework/utils");
+const types_1 = require("@mercurjs/types");
 const ensure_seller_default_roles_1 = require("../../modules/seller/utils/ensure-seller-default-roles");
 const SELLER_ID_HEADER = "x-seller-id";
 async function ensureSellerMiddleware(req, res, next) {
@@ -28,14 +29,18 @@ async function ensureSellerMiddleware(req, res, next) {
         seller_member: sellerMember,
         currency_code: sellerMember.seller.currency_code,
     };
-    if (sellerMember.role_id) {
-        const rbacService = req.scope.resolve(utils_1.Modules.RBAC);
-        await (0, ensure_seller_default_roles_1.ensureSellerDefaultRoles)(rbacService);
-        req.auth_context.app_metadata = {
-            ...req.auth_context.app_metadata,
-            roles: [sellerMember.role_id],
-        };
+    if (!utils_1.FeatureFlag.isFeatureEnabled("rbac")) {
+        return next();
     }
+    const rbacService = req.scope.resolve(utils_1.Modules.RBAC);
+    await (0, ensure_seller_default_roles_1.ensureSellerDefaultRoles)(rbacService);
+    req.auth_context.app_metadata = {
+        ...req.auth_context.app_metadata,
+        // Members predating RBAC have no role. Route policy checks reject an actor
+        // with an empty role list outright, so fall back to the administration role
+        // rather than locking them out of their own store.
+        roles: [sellerMember.role_id || types_1.SellerRole.SELLER_ADMINISTRATION],
+    };
     next();
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5zdXJlLXNlbGxlci1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS91dGlscy9lbnN1cmUtc2VsbGVyLW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFnQkEsd0RBNERDO0FBdkVELHFEQUlrQztBQUVsQyx3R0FBaUc7QUFHakcsTUFBTSxnQkFBZ0IsR0FBRyxhQUFhLENBQUE7QUFFL0IsS0FBSyxVQUFVLHNCQUFzQixDQUMxQyxHQUErQixFQUMvQixHQUFtQixFQUNuQixJQUF3QjtJQUV4QixJQUFJLFFBQVEsR0FBRyxHQUFHLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDLElBQUksR0FBRyxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUE7SUFFbEUsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ2QsT0FBTyxJQUFJLENBQ1QsSUFBSSxtQkFBVyxDQUNiLG1CQUFXLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFDN0IsR0FBRyxnQkFBZ0IsdUNBQXVDLENBQzNELENBQ0YsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxHQUFHLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQTtJQUMxQyxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUVoRSxNQUFNLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FDL0M7UUFDRSxNQUFNLEVBQUUsZUFBZTtRQUN2QixNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDO1FBQy9ELE9BQU8sRUFBRTtZQUNQLFNBQVMsRUFBRSxRQUFRO1lBQ25CLFNBQVMsRUFBRSxRQUFRO1NBQ3BCO0tBQ0YsRUFDRCxFQUFFLEtBQUssRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUM1QixDQUFBO0lBRUQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUMxQixPQUFPLElBQUksQ0FDVCxJQUFJLG1CQUFXLENBQ2IsbUJBQVcsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUM3Qiw2Q0FBNkMsQ0FDOUMsQ0FDRixDQUFBO0lBQ0gsQ0FBQztJQUVELE1BQU0sWUFBWSxHQUFHLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUVyQyxHQUFHLENBQUMsY0FBYyxHQUFHO1FBQ25CLFNBQVMsRUFBRSxRQUFRO1FBQ25CLGFBQWEsRUFBRSxZQUFZO1FBQzNCLGFBQWEsRUFBRSxZQUFZLENBQUMsTUFBTSxDQUFDLGFBQWE7S0FDaEMsQ0FBQTtJQUVsQixJQUFJLFlBQVksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN6QixNQUFNLFdBQVcsR0FBdUIsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBTyxDQUFDLElBQUksQ0FBQyxDQUFBO1FBRXZFLE1BQU0sSUFBQSxzREFBd0IsRUFBQyxXQUFXLENBQUMsQ0FBQTtRQUUzQyxHQUFHLENBQUMsWUFBWSxDQUFDLFlBQVksR0FBRztZQUM5QixHQUFHLEdBQUcsQ0FBQyxZQUFZLENBQUMsWUFBWTtZQUNoQyxLQUFLLEVBQUUsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDO1NBQzlCLENBQUE7SUFDSCxDQUFDO0lBRUQsSUFBSSxFQUFFLENBQUE7QUFDUixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5zdXJlLXNlbGxlci1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS91dGlscy9lbnN1cmUtc2VsbGVyLW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFrQkEsd0RBaUVDO0FBOUVELHFEQUtrQztBQUVsQywyQ0FBNEM7QUFDNUMsd0dBQWlHO0FBR2pHLE1BQU0sZ0JBQWdCLEdBQUcsYUFBYSxDQUFBO0FBRS9CLEtBQUssVUFBVSxzQkFBc0IsQ0FDMUMsR0FBK0IsRUFDL0IsR0FBbUIsRUFDbkIsSUFBd0I7SUFFeEIsSUFBSSxRQUFRLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFBO0lBRWxFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNkLE9BQU8sSUFBSSxDQUNULElBQUksbUJBQVcsQ0FDYixtQkFBVyxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQzdCLEdBQUcsZ0JBQWdCLHVDQUF1QyxDQUMzRCxDQUNGLENBQUE7SUFDSCxDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUE7SUFDMUMsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsaUNBQXlCLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFaEUsTUFBTSxFQUFFLElBQUksRUFBRSxhQUFhLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQy9DO1FBQ0UsTUFBTSxFQUFFLGVBQWU7UUFDdkIsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQztRQUMvRCxPQUFPLEVBQUU7WUFDUCxTQUFTLEVBQUUsUUFBUTtZQUNuQixTQUFTLEVBQUUsUUFBUTtTQUNwQjtLQUNGLEVBQ0QsRUFBRSxLQUFLLEVBQUUsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FDNUIsQ0FBQTtJQUVELElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsT0FBTyxJQUFJLENBQ1QsSUFBSSxtQkFBVyxDQUNiLG1CQUFXLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFDN0IsNkNBQTZDLENBQzlDLENBQ0YsQ0FBQTtJQUNILENBQUM7SUFFRCxNQUFNLFlBQVksR0FBRyxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFFckMsR0FBRyxDQUFDLGNBQWMsR0FBRztRQUNuQixTQUFTLEVBQUUsUUFBUTtRQUNuQixhQUFhLEVBQUUsWUFBWTtRQUMzQixhQUFhLEVBQUUsWUFBWSxDQUFDLE1BQU0sQ0FBQyxhQUFhO0tBQ2hDLENBQUE7SUFFbEIsSUFBSSxDQUFDLG1CQUFXLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUMxQyxPQUFPLElBQUksRUFBRSxDQUFBO0lBQ2YsQ0FBQztJQUVELE1BQU0sV0FBVyxHQUF1QixHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxlQUFPLENBQUMsSUFBSSxDQUFDLENBQUE7SUFFdkUsTUFBTSxJQUFBLHNEQUF3QixFQUFDLFdBQVcsQ0FBQyxDQUFBO0lBRTNDLEdBQUcsQ0FBQyxZQUFZLENBQUMsWUFBWSxHQUFHO1FBQzlCLEdBQUcsR0FBRyxDQUFDLFlBQVksQ0FBQyxZQUFZO1FBQ2hDLDJFQUEyRTtRQUMzRSw0RUFBNEU7UUFDNUUsbURBQW1EO1FBQ25ELEtBQUssRUFBRSxDQUFDLFlBQVksQ0FBQyxPQUFPLElBQUksa0JBQVUsQ0FBQyxxQkFBcUIsQ0FBQztLQUNsRSxDQUFBO0lBRUQsSUFBSSxFQUFFLENBQUE7QUFDUixDQUFDIn0=

package/.medusa/server/src/api/utils/index.d.ts

@@ -1,6 +1,8 @@
 export * from "./unless-base-url";
 export * from "./scan-unauthenticated-routes";
 export * from "./ensure-seller-middleware";
+export * from "./resolve-admin-roles-middleware";
+export * from "./policy-resources";
 export * from "./filter-by-seller-id";
 export * from "./vendor-cors-middleware";
 export * from "./format-product-attributes";

package/.medusa/server/src/api/utils/index.js

@@ -17,10 +17,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./unless-base-url"), exports);
 __exportStar(require("./scan-unauthenticated-routes"), exports);
 __exportStar(require("./ensure-seller-middleware"), exports);
+__exportStar(require("./resolve-admin-roles-middleware"), exports);
+__exportStar(require("./policy-resources"), exports);
 __exportStar(require("./filter-by-seller-id"), exports);
 __exportStar(require("./vendor-cors-middleware"), exports);
 __exportStar(require("./format-product-attributes"), exports);
 __exportStar(require("./product-attribute-fields"), exports);
 __exportStar(require("./filter-attributes-by-category-link"), exports);
 __exportStar(require("./offers"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3V0aWxzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxvREFBaUM7QUFDakMsZ0VBQTZDO0FBQzdDLDZEQUEwQztBQUMxQyx3REFBcUM7QUFDckMsMkRBQXdDO0FBQ3hDLDhEQUEyQztBQUMzQyw2REFBMEM7QUFDMUMsdUVBQW9EO0FBQ3BELDJDQUF3QiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3V0aWxzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxvREFBaUM7QUFDakMsZ0VBQTZDO0FBQzdDLDZEQUEwQztBQUMxQyxtRUFBZ0Q7QUFDaEQscURBQWtDO0FBQ2xDLHdEQUFxQztBQUNyQywyREFBd0M7QUFDeEMsOERBQTJDO0FBQzNDLDZEQUEwQztBQUMxQyx1RUFBb0Q7QUFDcEQsMkNBQXdCIn0=

package/.medusa/server/src/api/utils/policy-resources.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Resource names used in route `policies` declarations. Mercur-owned resources
+ * are declared in `src/policies/*`; the rest come from Medusa's own catalog.
+ *
+ * Keep the values in sync with those catalogs — an unknown resource name is
+ * not a type error, it silently never matches a granted policy.
+ */
+export declare const PolicyResource: {
+    readonly seller: "seller";
+    readonly seller_member: "seller_member";
+    readonly member_invite: "member_invite";
+    readonly order_group: "order_group";
+    readonly offer: "offer";
+    readonly commission_rule: "commission_rule";
+    readonly commission_rate: "commission_rate";
+    readonly commission_line: "commission_line";
+    readonly payout: "payout";
+    readonly payout_account: "payout_account";
+    readonly product_attribute: "product_attribute";
+    readonly product_attribute_value: "product_attribute_value";
+    readonly product_change: "product_change";
+    readonly review: "review";
+    readonly product: "product";
+    readonly product_variant: "product_variant";
+    readonly product_option: "product_option";
+    readonly product_tag: "product_tag";
+    readonly product_type: "product_type";
+    readonly product_category: "product_category";
+    readonly product_collection: "product_collection";
+    readonly order: "order";
+    readonly order_change: "order_change";
+    readonly order_claim: "order_claim";
+    readonly order_exchange: "order_exchange";
+    readonly return: "return";
+    readonly return_reason: "return_reason";
+    readonly refund_reason: "refund_reason";
+    readonly customer: "customer";
+    readonly customer_group: "customer_group";
+    readonly inventory_item: "inventory_item";
+    readonly reservation_item: "reservation_item";
+    readonly stock_location: "stock_location";
+    readonly price_list: "price_list";
+    readonly price_preference: "price_preference";
+    readonly currency: "currency";
+    readonly promotion: "promotion";
+    readonly campaign: "campaign";
+    readonly region: "region";
+    readonly sales_channel: "sales_channel";
+    readonly store: "store";
+    readonly payment: "payment";
+    readonly shipping_option: "shipping_option";
+    readonly shipping_option_type: "shipping_option_type";
+    readonly shipping_profile: "shipping_profile";
+    readonly fulfillment: "fulfillment";
+    readonly fulfillment_provider: "fulfillment_provider";
+    readonly fulfillment_set: "fulfillment_set";
+    readonly file: "file";
+};
+export type PolicyResourceName = (typeof PolicyResource)[keyof typeof PolicyResource];

package/.medusa/server/src/api/utils/policy-resources.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyResource = void 0;
+/**
+ * Resource names used in route `policies` declarations. Mercur-owned resources
+ * are declared in `src/policies/*`; the rest come from Medusa's own catalog.
+ *
+ * Keep the values in sync with those catalogs — an unknown resource name is
+ * not a type error, it silently never matches a granted policy.
+ */
+exports.PolicyResource = {
+    // Mercur
+    seller: "seller",
+    seller_member: "seller_member",
+    member_invite: "member_invite",
+    order_group: "order_group",
+    offer: "offer",
+    commission_rule: "commission_rule",
+    commission_rate: "commission_rate",
+    commission_line: "commission_line",
+    payout: "payout",
+    payout_account: "payout_account",
+    product_attribute: "product_attribute",
+    product_attribute_value: "product_attribute_value",
+    product_change: "product_change",
+    review: "review",
+    // Medusa
+    product: "product",
+    product_variant: "product_variant",
+    product_option: "product_option",
+    product_tag: "product_tag",
+    product_type: "product_type",
+    product_category: "product_category",
+    product_collection: "product_collection",
+    order: "order",
+    order_change: "order_change",
+    order_claim: "order_claim",
+    order_exchange: "order_exchange",
+    return: "return",
+    return_reason: "return_reason",
+    refund_reason: "refund_reason",
+    customer: "customer",
+    customer_group: "customer_group",
+    inventory_item: "inventory_item",
+    reservation_item: "reservation_item",
+    stock_location: "stock_location",
+    price_list: "price_list",
+    price_preference: "price_preference",
+    currency: "currency",
+    promotion: "promotion",
+    campaign: "campaign",
+    region: "region",
+    sales_channel: "sales_channel",
+    store: "store",
+    payment: "payment",
+    shipping_option: "shipping_option",
+    shipping_option_type: "shipping_option_type",
+    shipping_profile: "shipping_profile",
+    fulfillment: "fulfillment",
+    fulfillment_provider: "fulfillment_provider",
+    fulfillment_set: "fulfillment_set",
+    file: "file",
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9saWN5LXJlc291cmNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvdXRpbHMvcG9saWN5LXJlc291cmNlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQTs7Ozs7O0dBTUc7QUFDVSxRQUFBLGNBQWMsR0FBRztJQUM1QixTQUFTO0lBQ1QsTUFBTSxFQUFFLFFBQVE7SUFDaEIsYUFBYSxFQUFFLGVBQWU7SUFDOUIsYUFBYSxFQUFFLGVBQWU7SUFDOUIsV0FBVyxFQUFFLGFBQWE7SUFDMUIsS0FBSyxFQUFFLE9BQU87SUFDZCxlQUFlLEVBQUUsaUJBQWlCO0lBQ2xDLGVBQWUsRUFBRSxpQkFBaUI7SUFDbEMsZUFBZSxFQUFFLGlCQUFpQjtJQUNsQyxNQUFNLEVBQUUsUUFBUTtJQUNoQixjQUFjLEVBQUUsZ0JBQWdCO0lBQ2hDLGlCQUFpQixFQUFFLG1CQUFtQjtJQUN0Qyx1QkFBdUIsRUFBRSx5QkFBeUI7SUFDbEQsY0FBYyxFQUFFLGdCQUFnQjtJQUNoQyxNQUFNLEVBQUUsUUFBUTtJQUVoQixTQUFTO0lBQ1QsT0FBTyxFQUFFLFNBQVM7SUFDbEIsZUFBZSxFQUFFLGlCQUFpQjtJQUNsQyxjQUFjLEVBQUUsZ0JBQWdCO0lBQ2hDLFdBQVcsRUFBRSxhQUFhO0lBQzFCLFlBQVksRUFBRSxjQUFjO0lBQzVCLGdCQUFnQixFQUFFLGtCQUFrQjtJQUNwQyxrQkFBa0IsRUFBRSxvQkFBb0I7SUFDeEMsS0FBSyxFQUFFLE9BQU87SUFDZCxZQUFZLEVBQUUsY0FBYztJQUM1QixXQUFXLEVBQUUsYUFBYTtJQUMxQixjQUFjLEVBQUUsZ0JBQWdCO0lBQ2hDLE1BQU0sRUFBRSxRQUFRO0lBQ2hCLGFBQWEsRUFBRSxlQUFlO0lBQzlCLGFBQWEsRUFBRSxlQUFlO0lBQzlCLFFBQVEsRUFBRSxVQUFVO0lBQ3BCLGNBQWMsRUFBRSxnQkFBZ0I7SUFDaEMsY0FBYyxFQUFFLGdCQUFnQjtJQUNoQyxnQkFBZ0IsRUFBRSxrQkFBa0I7SUFDcEMsY0FBYyxFQUFFLGdCQUFnQjtJQUNoQyxVQUFVLEVBQUUsWUFBWTtJQUN4QixnQkFBZ0IsRUFBRSxrQkFBa0I7SUFDcEMsUUFBUSxFQUFFLFVBQVU7SUFDcEIsU0FBUyxFQUFFLFdBQVc7SUFDdEIsUUFBUSxFQUFFLFVBQVU7SUFDcEIsTUFBTSxFQUFFLFFBQVE7SUFDaEIsYUFBYSxFQUFFLGVBQWU7SUFDOUIsS0FBSyxFQUFFLE9BQU87SUFDZCxPQUFPLEVBQUUsU0FBUztJQUNsQixlQUFlLEVBQUUsaUJBQWlCO0lBQ2xDLG9CQUFvQixFQUFFLHNCQUFzQjtJQUM1QyxnQkFBZ0IsRUFBRSxrQkFBa0I7SUFDcEMsV0FBVyxFQUFFLGFBQWE7SUFDMUIsb0JBQW9CLEVBQUUsc0JBQXNCO0lBQzVDLGVBQWUsRUFBRSxpQkFBaUI7SUFDbEMsSUFBSSxFQUFFLE1BQU07Q0FDSixDQUFBIn0=

package/.medusa/server/src/api/utils/resolve-admin-roles-middleware.d.ts

@@ -0,0 +1,19 @@
+import { MedusaNextFunction, MedusaResponse } from "@medusajs/framework";
+import { AuthenticatedMedusaRequest } from "@medusajs/framework/http";
+/**
+ * Seeded by the RBAC module's initial-data loader; holds the `*:*` policy.
+ */
+export declare const SUPER_ADMIN_ROLE_ID = "role_super_admin";
+/**
+ * Resolves the acting admin user's RBAC roles per request.
+ *
+ * Medusa bakes roles into the JWT at login, which means a role change only
+ * takes effect once the token is re-issued. Reading them here instead keeps
+ * enforcement current, and mirrors what `ensureSellerMiddleware` already does
+ * on the vendor side.
+ *
+ * A user with no roles falls back to super admin rather than being denied.
+ * Route policy checks reject an actor with an empty role list outright, so
+ * without this fallback every admin predating RBAC would lose access.
+ */
+export declare function resolveAdminRolesMiddleware(req: AuthenticatedMedusaRequest, _res: MedusaResponse, next: MedusaNextFunction): Promise<void>;

package/.medusa/server/src/api/utils/resolve-admin-roles-middleware.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPER_ADMIN_ROLE_ID = void 0;
+exports.resolveAdminRolesMiddleware = resolveAdminRolesMiddleware;
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * Seeded by the RBAC module's initial-data loader; holds the `*:*` policy.
+ */
+exports.SUPER_ADMIN_ROLE_ID = "role_super_admin";
+/**
+ * Resolves the acting admin user's RBAC roles per request.
+ *
+ * Medusa bakes roles into the JWT at login, which means a role change only
+ * takes effect once the token is re-issued. Reading them here instead keeps
+ * enforcement current, and mirrors what `ensureSellerMiddleware` already does
+ * on the vendor side.
+ *
+ * A user with no roles falls back to super admin rather than being denied.
+ * Route policy checks reject an actor with an empty role list outright, so
+ * without this fallback every admin predating RBAC would lose access.
+ */
+async function resolveAdminRolesMiddleware(req, _res, next) {
+    const actorId = req.auth_context?.actor_id;
+    // Route policies are only enforced while the flag is on, so skip the lookup
+    // entirely otherwise — this runs on every admin request.
+    if (!actorId || !utils_1.FeatureFlag.isFeatureEnabled("rbac")) {
+        return next();
+    }
+    const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    let roles = [];
+    try {
+        const { data } = await query.graph({
+            entity: "user",
+            fields: ["rbac_roles.id"],
+            filters: { id: actorId },
+        }, { cache: { enable: true } });
+        roles = (data?.[0]?.rbac_roles ?? [])
+            .map((role) => role.id)
+            .filter(Boolean);
+    }
+    catch {
+        // The user <-> role link only exists while the rbac flag is on. Treat a
+        // failed lookup the same as "no roles assigned".
+    }
+    // The link is the source of truth, but fall back to whatever the token
+    // carries so callers that assign roles outside the link keep working.
+    const tokenRoles = req.auth_context.app_metadata?.roles ?? [];
+    const resolved = roles.length ? roles : tokenRoles;
+    req.auth_context.app_metadata = {
+        ...req.auth_context.app_metadata,
+        roles: resolved.length ? resolved : [exports.SUPER_ADMIN_ROLE_ID],
+    };
+    return next();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS1hZG1pbi1yb2xlcy1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS91dGlscy9yZXNvbHZlLWFkbWluLXJvbGVzLW1pZGRsZXdhcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBd0JBLGtFQThDQztBQXBFRCxxREFHa0M7QUFFbEM7O0dBRUc7QUFDVSxRQUFBLG1CQUFtQixHQUFHLGtCQUFrQixDQUFBO0FBRXJEOzs7Ozs7Ozs7OztHQVdHO0FBQ0ksS0FBSyxVQUFVLDJCQUEyQixDQUMvQyxHQUErQixFQUMvQixJQUFvQixFQUNwQixJQUF3QjtJQUV4QixNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQTtJQUUxQyw0RUFBNEU7SUFDNUUseURBQXlEO0lBQ3pELElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxtQkFBVyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdEQsT0FBTyxJQUFJLEVBQUUsQ0FBQTtJQUNmLENBQUM7SUFFRCxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUVoRSxJQUFJLEtBQUssR0FBYSxFQUFFLENBQUE7SUFFeEIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FDaEM7WUFDRSxNQUFNLEVBQUUsTUFBTTtZQUNkLE1BQU0sRUFBRSxDQUFDLGVBQWUsQ0FBQztZQUN6QixPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsT0FBTyxFQUFFO1NBQ3pCLEVBQ0QsRUFBRSxLQUFLLEVBQUUsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FDNUIsQ0FBQTtRQUVELEtBQUssR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsSUFBSSxFQUFFLENBQUM7YUFDbEMsR0FBRyxDQUFDLENBQUMsSUFBb0IsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQzthQUN0QyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUE7SUFDcEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLHdFQUF3RTtRQUN4RSxpREFBaUQ7SUFDbkQsQ0FBQztJQUVELHVFQUF1RTtJQUN2RSxzRUFBc0U7SUFDdEUsTUFBTSxVQUFVLEdBQUksR0FBRyxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsS0FBa0IsSUFBSSxFQUFFLENBQUE7SUFDM0UsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUE7SUFFbEQsR0FBRyxDQUFDLFlBQVksQ0FBQyxZQUFZLEdBQUc7UUFDOUIsR0FBRyxHQUFHLENBQUMsWUFBWSxDQUFDLFlBQVk7UUFDaEMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQywyQkFBbUIsQ0FBQztLQUMxRCxDQUFBO0lBRUQsT0FBTyxJQUFJLEVBQUUsQ0FBQTtBQUNmLENBQUMifQ==