@mercurjs/core 2.3.6-canary.0 → 2.3.6-canary.10

package/.medusa/server/src/api/utils/permissions-middleware.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSIONS_FIELD = exports.REQUIRED_PERMISSION = void 0;
+exports.isPermissionsModuleEnabled = isPermissionsModuleEnabled;
+exports.resolvePermissionsMiddleware = resolvePermissionsMiddleware;
+exports.requirePermission = requirePermission;
+exports.requireAnyPermission = requireAnyPermission;
+exports.takePermissionsField = takePermissionsField;
+exports.attachPermissions = attachPermissions;
+const utils_1 = require("@medusajs/framework/utils");
+const types_1 = require("@mercurjs/types");
+const permissions_1 = require("../../permissions");
+function isPermissionsModuleEnabled(config) {
+    const modules = config.modules;
+    const entry = modules?.[types_1.PERMISSIONS_MODULE];
+    if (!entry) {
+        return false;
+    }
+    return !(typeof entry === "object" && "disable" in entry && entry.disable);
+}
+function getResolver(req) {
+    const config = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+    if (!isPermissionsModuleEnabled(config)) {
+        return undefined;
+    }
+    return req.scope.resolve(types_1.PERMISSIONS_MODULE);
+}
+let catalogValidated = false;
+function resolvePermissionsMiddleware(surface) {
+    return async (req, _res, next) => {
+        const catalog = (0, permissions_1.getPermissionCatalog)();
+        if (!catalogValidated) {
+            (0, permissions_1.validatePermissionCatalog)(catalog);
+            catalogValidated = true;
+        }
+        const resolver = getResolver(req);
+        const actorId = req.auth_context?.actor_id;
+        if (!resolver || !actorId) {
+            req.permissions = (0, permissions_1.grantAll)(catalog);
+            req.permissions_enforced = false;
+            return next();
+        }
+        const actor = {
+            actor_type: req.auth_context.actor_type,
+            actor_id: actorId,
+            surface,
+            seller_id: req.seller_context?.seller_id,
+            seller_member_id: req.seller_context?.seller_member?.id,
+        };
+        try {
+            req.permissions = await resolver.resolvePermissions(actor, catalog);
+            req.permissions_enforced = true;
+            next();
+        }
+        catch (error) {
+            next(error);
+        }
+    };
+}
+exports.REQUIRED_PERMISSION = Symbol.for("mercur:required-permission");
+function requirePermission(key, right) {
+    const middleware = (req, res, next) => {
+        req.required_permissions ??= [];
+        req.required_permissions.push({ key, right });
+        // Routes reached before the resolving middleware (public or pre-seller
+        // routes) have nothing to enforce against.
+        if (!req.permissions_enforced) {
+            return next();
+        }
+        if ((0, permissions_1.satisfiesRight)(req.permissions?.[key], right)) {
+            return next();
+        }
+        res.status(403).json({
+            type: "not_allowed",
+            code: types_1.MISSING_PERMISSION_CODE,
+            message: `Missing required permission: ${key}:${right}`,
+            permission: key,
+            right,
+        });
+    };
+    return Object.assign(middleware, {
+        [exports.REQUIRED_PERMISSION]: { key, right },
+    });
+}
+/**
+ * Passes when the actor holds any one of the requirements. For routes shared
+ * by several domains, e.g. uploads used by both products and the store profile.
+ */
+function requireAnyPermission(requirements) {
+    const middleware = (req, res, next) => {
+        req.required_permissions ??= [];
+        req.required_permissions.push(...requirements);
+        if (!req.permissions_enforced) {
+            return next();
+        }
+        if (requirements.some(({ key, right }) => (0, permissions_1.satisfiesRight)(req.permissions?.[key], right))) {
+            return next();
+        }
+        const [{ key, right }] = requirements;
+        res.status(403).json({
+            type: "not_allowed",
+            code: types_1.MISSING_PERMISSION_CODE,
+            message: `Missing required permission: ${requirements
+                .map((requirement) => `${requirement.key}:${requirement.right}`)
+                .join(" or ")}`,
+            permission: key,
+            right,
+        });
+    };
+    return Object.assign(middleware, {
+        [exports.REQUIRED_PERMISSION]: requirements[0],
+    });
+}
+exports.PERMISSIONS_FIELD = "permissions";
+/**
+ * `permissions` is a virtual field: pull it out of the query config before it
+ * reaches `query.graph`, and report whether the client asked for it.
+ */
+function takePermissionsField(req) {
+    const fields = req.queryConfig?.fields ?? [];
+    const requested = fields.includes(exports.PERMISSIONS_FIELD);
+    if (requested) {
+        req.queryConfig.fields = fields.filter((field) => field !== exports.PERMISSIONS_FIELD);
+    }
+    return requested;
+}
+function attachPermissions(req, entity, requested) {
+    if (!requested || !req.permissions_enforced || !req.permissions) {
+        return entity;
+    }
+    return { ...entity, permissions: req.permissions };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbnMtbWlkZGxld2FyZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvdXRpbHMvcGVybWlzc2lvbnMtbWlkZGxld2FyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFpQ0EsZ0VBU0M7QUFrQkQsb0VBb0NDO0FBSUQsOENBK0JDO0FBTUQsb0RBcUNDO0FBUUQsb0RBU0M7QUFFRCw4Q0FTQztBQXBNRCxxREFBcUU7QUFDckUsMkNBU3dCO0FBRXhCLG1EQUswQjtBQVUxQixTQUFnQiwwQkFBMEIsQ0FBQyxNQUFvQjtJQUM3RCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBOEMsQ0FBQTtJQUNyRSxNQUFNLEtBQUssR0FBRyxPQUFPLEVBQUUsQ0FBQywwQkFBa0IsQ0FBQyxDQUFBO0lBRTNDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNYLE9BQU8sS0FBSyxDQUFBO0lBQ2QsQ0FBQztJQUVELE9BQU8sQ0FBQyxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxTQUFTLElBQUksS0FBSyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQTtBQUM1RSxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQ2xCLEdBQStCO0lBRS9CLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUM5QixpQ0FBeUIsQ0FBQyxhQUFhLENBQ3hDLENBQUE7SUFFRCxJQUFJLENBQUMsMEJBQTBCLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN4QyxPQUFPLFNBQVMsQ0FBQTtJQUNsQixDQUFDO0lBRUQsT0FBTyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBc0IsMEJBQWtCLENBQUMsQ0FBQTtBQUNuRSxDQUFDO0FBRUQsSUFBSSxnQkFBZ0IsR0FBRyxLQUFLLENBQUE7QUFFNUIsU0FBZ0IsNEJBQTRCLENBQUMsT0FBMEI7SUFDckUsT0FBTyxLQUFLLEVBQ1YsR0FBK0IsRUFDL0IsSUFBb0IsRUFDcEIsSUFBd0IsRUFDeEIsRUFBRTtRQUNGLE1BQU0sT0FBTyxHQUFHLElBQUEsa0NBQW9CLEdBQUUsQ0FBQTtRQUN0QyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUN0QixJQUFBLHVDQUF5QixFQUFDLE9BQU8sQ0FBQyxDQUFBO1lBQ2xDLGdCQUFnQixHQUFHLElBQUksQ0FBQTtRQUN6QixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ2pDLE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxZQUFZLEVBQUUsUUFBUSxDQUFBO1FBRTFDLElBQUksQ0FBQyxRQUFRLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUMxQixHQUFHLENBQUMsV0FBVyxHQUFHLElBQUEsc0JBQVEsRUFBQyxPQUFPLENBQUMsQ0FBQTtZQUNuQyxHQUFHLENBQUMsb0JBQW9CLEdBQUcsS0FBSyxDQUFBO1lBQ2hDLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDZixDQUFDO1FBRUQsTUFBTSxLQUFLLEdBQW9CO1lBQzdCLFVBQVUsRUFBRSxHQUFHLENBQUMsWUFBWSxDQUFDLFVBQVU7WUFDdkMsUUFBUSxFQUFFLE9BQU87WUFDakIsT0FBTztZQUNQLFNBQVMsRUFBRSxHQUFHLENBQUMsY0FBYyxFQUFFLFNBQVM7WUFDeEMsZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLGNBQWMsRUFBRSxhQUFhLEVBQUUsRUFBRTtTQUN4RCxDQUFBO1FBRUQsSUFBSSxDQUFDO1lBQ0gsR0FBRyxDQUFDLFdBQVcsR0FBRyxNQUFNLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUE7WUFDbkUsR0FBRyxDQUFDLG9CQUFvQixHQUFHLElBQUksQ0FBQTtZQUMvQixJQUFJLEVBQUUsQ0FBQTtRQUNSLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQ2IsQ0FBQztJQUNILENBQUMsQ0FBQTtBQUNILENBQUM7QUFFWSxRQUFBLG1CQUFtQixHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsNEJBQTRCLENBQUMsQ0FBQTtBQUUzRSxTQUFnQixpQkFBaUIsQ0FBQyxHQUFXLEVBQUUsS0FBc0I7SUFDbkUsTUFBTSxVQUFVLEdBQUcsQ0FDakIsR0FBK0IsRUFDL0IsR0FBbUIsRUFDbkIsSUFBd0IsRUFDeEIsRUFBRTtRQUNGLEdBQUcsQ0FBQyxvQkFBb0IsS0FBSyxFQUFFLENBQUE7UUFDL0IsR0FBRyxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFBO1FBRTdDLHVFQUF1RTtRQUN2RSwyQ0FBMkM7UUFDM0MsSUFBSSxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1lBQzlCLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDZixDQUFDO1FBRUQsSUFBSSxJQUFBLDRCQUFjLEVBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDbEQsT0FBTyxJQUFJLEVBQUUsQ0FBQTtRQUNmLENBQUM7UUFFRCxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUNuQixJQUFJLEVBQUUsYUFBYTtZQUNuQixJQUFJLEVBQUUsK0JBQXVCO1lBQzdCLE9BQU8sRUFBRSxnQ0FBZ0MsR0FBRyxJQUFJLEtBQUssRUFBRTtZQUN2RCxVQUFVLEVBQUUsR0FBRztZQUNmLEtBQUs7U0FDTixDQUFDLENBQUE7SUFDSixDQUFDLENBQUE7SUFFRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFO1FBQy9CLENBQUMsMkJBQW1CLENBQUMsRUFBRSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQTJCO0tBQy9ELENBQUMsQ0FBQTtBQUNKLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFnQixvQkFBb0IsQ0FBQyxZQUFxQztJQUN4RSxNQUFNLFVBQVUsR0FBRyxDQUNqQixHQUErQixFQUMvQixHQUFtQixFQUNuQixJQUF3QixFQUN4QixFQUFFO1FBQ0YsR0FBRyxDQUFDLG9CQUFvQixLQUFLLEVBQUUsQ0FBQTtRQUMvQixHQUFHLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLEdBQUcsWUFBWSxDQUFDLENBQUE7UUFFOUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1lBQzlCLE9BQU8sSUFBSSxFQUFFLENBQUE7UUFDZixDQUFDO1FBRUQsSUFDRSxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxDQUNuQyxJQUFBLDRCQUFjLEVBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUM5QyxFQUNELENBQUM7WUFDRCxPQUFPLElBQUksRUFBRSxDQUFBO1FBQ2YsQ0FBQztRQUVELE1BQU0sQ0FBQyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsQ0FBQyxHQUFHLFlBQVksQ0FBQTtRQUVyQyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUNuQixJQUFJLEVBQUUsYUFBYTtZQUNuQixJQUFJLEVBQUUsK0JBQXVCO1lBQzdCLE9BQU8sRUFBRSxnQ0FBZ0MsWUFBWTtpQkFDbEQsR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxHQUFHLFdBQVcsQ0FBQyxHQUFHLElBQUksV0FBVyxDQUFDLEtBQUssRUFBRSxDQUFDO2lCQUMvRCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDakIsVUFBVSxFQUFFLEdBQUc7WUFDZixLQUFLO1NBQ04sQ0FBQyxDQUFBO0lBQ0osQ0FBQyxDQUFBO0lBRUQsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRTtRQUMvQixDQUFDLDJCQUFtQixDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztLQUN2QyxDQUFDLENBQUE7QUFDSixDQUFDO0FBRVksUUFBQSxpQkFBaUIsR0FBRyxhQUFhLENBQUE7QUFFOUM7OztHQUdHO0FBQ0gsU0FBZ0Isb0JBQW9CLENBQUMsR0FBK0I7SUFDbEUsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLFdBQVcsRUFBRSxNQUFNLElBQUksRUFBRSxDQUFBO0lBQzVDLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMseUJBQWlCLENBQUMsQ0FBQTtJQUVwRCxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ2QsR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxLQUFLLHlCQUFpQixDQUFDLENBQUE7SUFDaEYsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFBO0FBQ2xCLENBQUM7QUFFRCxTQUFnQixpQkFBaUIsQ0FDL0IsR0FBK0IsRUFDL0IsTUFBUyxFQUNULFNBQWtCO0lBRWxCLElBQUksQ0FBQyxTQUFTLElBQUksQ0FBQyxHQUFHLENBQUMsb0JBQW9CLElBQUksQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDaEUsT0FBTyxNQUFNLENBQUE7SUFDZixDQUFDO0lBQ0QsT0FBTyxFQUFFLEdBQUcsTUFBTSxFQUFFLFdBQVcsRUFBRSxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUE7QUFDcEQsQ0FBQyJ9

package/.medusa/server/src/api/utils/scan-unauthenticated-routes.d.ts

@@ -1 +1,7 @@
+import type { MedusaRequest } from "@medusajs/framework";
 export declare function scanUnauthenticatedRoutes(projectRoot: string): RegExp[];
+/**
+ * Plugin routes are resolved on the first request: the vendor middlewares are
+ * built at import time, before the config module is available.
+ */
+export declare const resolvePluginUnauthenticatedRoutes: (req: MedusaRequest) => Promise<RegExp[]>;

package/.medusa/server/src/api/utils/scan-unauthenticated-routes.js

@@ -3,9 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePluginUnauthenticatedRoutes = void 0;
 exports.scanUnauthenticatedRoutes = scanUnauthenticatedRoutes;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const utils_1 = require("@medusajs/framework/utils");
 const VALID_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
 function crawlRoutes(dir) {
     const files = [];
@@ -32,7 +34,9 @@ function hasAuthenticateFalse(filePath) {
     try {
         const content = fs_1.default.readFileSync(filePath, "utf-8");
         return (/export\s+const\s+AUTHENTICATE\s*=\s*false/.test(content) ||
-            /export\s*\{[^}]*\bAUTHENTICATE\b[^}]*\}/.test(content));
+            /export\s*\{[^}]*\bAUTHENTICATE\b[^}]*\}/.test(content) ||
+            // Plugin routes are scanned in their compiled CommonJS output.
+            /\bexports\.AUTHENTICATE\s*=\s*false\b/.test(content));
     }
     catch {
         return false;
@@ -50,10 +54,9 @@ function filePathToRegex(filePath, apiDir) {
     });
     return new RegExp("^\\/" + regexSegments.join("\\/") + "$");
 }
-function scanUnauthenticatedRoutes(projectRoot) {
-    const vendorApiDir = path_1.default.join(projectRoot, "src", "api", "vendor");
-    const apiDir = path_1.default.join(projectRoot, "src", "api");
-    const routeFiles = crawlRoutes(vendorApiDir);
+function scanSourceDir(srcDir) {
+    const apiDir = path_1.default.join(srcDir, "api");
+    const routeFiles = crawlRoutes(path_1.default.join(apiDir, "vendor"));
     const patterns = [];
     for (const file of routeFiles) {
         if (hasAuthenticateFalse(file)) {
@@ -62,4 +65,24 @@ function scanUnauthenticatedRoutes(projectRoot) {
     }
     return patterns;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Nhbi11bmF1dGhlbnRpY2F0ZWQtcm91dGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS91dGlscy9zY2FuLXVuYXV0aGVudGljYXRlZC1yb3V0ZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUEyREEsOERBYUM7QUF4RUQsNENBQW1CO0FBQ25CLGdEQUF1QjtBQUV2QixNQUFNLGdCQUFnQixHQUFHLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUE7QUFFdkQsU0FBUyxXQUFXLENBQUMsR0FBVztJQUM5QixNQUFNLEtBQUssR0FBYSxFQUFFLENBQUE7SUFFMUIsSUFBSSxDQUFDLFlBQUUsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN4QixPQUFPLEtBQUssQ0FBQTtJQUNkLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxZQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRSxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBRTVELEtBQUssTUFBTSxLQUFLLElBQUksT0FBTyxFQUFFLENBQUM7UUFDNUIsTUFBTSxRQUFRLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFBO1FBRTNDLElBQUksS0FBSyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7WUFDeEIsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFBO1FBQ3RDLENBQUM7YUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzFCLE1BQU0sR0FBRyxHQUFHLGNBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFBO1lBQ3BDLE1BQU0sUUFBUSxHQUFHLGNBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQTtZQUUvQyxJQUFJLFFBQVEsS0FBSyxPQUFPLElBQUksZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzNELEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUE7WUFDdEIsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQsT0FBTyxLQUFLLENBQUE7QUFDZCxDQUFDO0FBRUQsU0FBUyxvQkFBb0IsQ0FBQyxRQUFnQjtJQUM1QyxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxZQUFFLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQTtRQUNsRCxPQUFPLENBQ0wsMkNBQTJDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUN6RCx5Q0FBeUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQ3hELENBQUE7SUFDSCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxLQUFLLENBQUE7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsZUFBZSxDQUFDLFFBQWdCLEVBQUUsTUFBYztJQUN2RCxNQUFNLFlBQVksR0FBRyxjQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFBO0lBQ3hFLE1BQU0sT0FBTyxHQUFHLFlBQVksQ0FBQyxPQUFPLENBQUMsMkJBQTJCLEVBQUUsRUFBRSxDQUFDLENBQUE7SUFFckUsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUNuQyxNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUU7UUFDN0MsSUFBSSxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDN0IsT0FBTyxPQUFPLENBQUE7UUFDaEIsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFBO0lBQ2hCLENBQUMsQ0FBQyxDQUFBO0lBRUYsT0FBTyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQTtBQUM3RCxDQUFDO0FBRUQsU0FBZ0IseUJBQXlCLENBQUMsV0FBbUI7SUFDM0QsTUFBTSxZQUFZLEdBQUcsY0FBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQTtJQUNuRSxNQUFNLE1BQU0sR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUE7SUFDbkQsTUFBTSxVQUFVLEdBQUcsV0FBVyxDQUFDLFlBQVksQ0FBQyxDQUFBO0lBQzVDLE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQTtJQUU3QixLQUFLLE1BQU0sSUFBSSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQzlCLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUMvQixRQUFRLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQTtRQUM5QyxDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU8sUUFBUSxDQUFBO0FBQ2pCLENBQUMifQ==
+function scanUnauthenticatedRoutes(projectRoot) {
+    return scanSourceDir(path_1.default.join(projectRoot, "src"));
+}
+let pluginPatterns;
+/**
+ * Plugin routes are resolved on the first request: the vendor middlewares are
+ * built at import time, before the config module is available.
+ */
+const resolvePluginUnauthenticatedRoutes = (req) => {
+    pluginPatterns ??= (async () => {
+        const configModule = req.scope.resolve(utils_1.ContainerRegistrationKeys.CONFIG_MODULE);
+        const plugins = await (0, utils_1.getResolvedPlugins)(process.cwd(), configModule);
+        return plugins.flatMap((plugin) => scanSourceDir(plugin.resolve));
+    })().catch((error) => {
+        pluginPatterns = undefined;
+        throw error;
+    });
+    return pluginPatterns;
+};
+exports.resolvePluginUnauthenticatedRoutes = resolvePluginUnauthenticatedRoutes;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Nhbi11bmF1dGhlbnRpY2F0ZWQtcm91dGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS91dGlscy9zY2FuLXVuYXV0aGVudGljYXRlZC1yb3V0ZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBZ0ZBLDhEQUVDO0FBbEZELDRDQUFtQjtBQUNuQixnREFBdUI7QUFFdkIscURBR2tDO0FBRWxDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQTtBQUV2RCxTQUFTLFdBQVcsQ0FBQyxHQUFXO0lBQzlCLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQTtJQUUxQixJQUFJLENBQUMsWUFBRSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE9BQU8sS0FBSyxDQUFBO0lBQ2QsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFlBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUE7SUFFNUQsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLEVBQUUsQ0FBQztRQUM1QixNQUFNLFFBQVEsR0FBRyxjQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUE7UUFFM0MsSUFBSSxLQUFLLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztZQUN4QixLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUE7UUFDdEMsQ0FBQzthQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDMUIsTUFBTSxHQUFHLEdBQUcsY0FBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUE7WUFDcEMsTUFBTSxRQUFRLEdBQUcsY0FBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFBO1lBRS9DLElBQUksUUFBUSxLQUFLLE9BQU8sSUFBSSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDM0QsS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQTtZQUN0QixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQTtBQUNkLENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUFDLFFBQWdCO0lBQzVDLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLFlBQUUsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFBO1FBQ2xELE9BQU8sQ0FDTCwyQ0FBMkMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQ3pELHlDQUF5QyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7WUFDdkQsK0RBQStEO1lBQy9ELHVDQUF1QyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FDdEQsQ0FBQTtJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQTtJQUNkLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsUUFBZ0IsRUFBRSxNQUFjO0lBQ3ZELE1BQU0sWUFBWSxHQUFHLGNBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUE7SUFDeEUsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLE9BQU8sQ0FBQywyQkFBMkIsRUFBRSxFQUFFLENBQUMsQ0FBQTtJQUVyRSxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFBO0lBQ25DLE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRTtRQUM3QyxJQUFJLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUM3QixPQUFPLE9BQU8sQ0FBQTtRQUNoQixDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUE7SUFDaEIsQ0FBQyxDQUFDLENBQUE7SUFFRixPQUFPLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFBO0FBQzdELENBQUM7QUFFRCxTQUFTLGFBQWEsQ0FBQyxNQUFjO0lBQ25DLE1BQU0sTUFBTSxHQUFHLGNBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFBO0lBQ3ZDLE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFBO0lBQzNELE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQTtJQUU3QixLQUFLLE1BQU0sSUFBSSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQzlCLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUMvQixRQUFRLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQTtRQUM5QyxDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU8sUUFBUSxDQUFBO0FBQ2pCLENBQUM7QUFFRCxTQUFnQix5QkFBeUIsQ0FBQyxXQUFtQjtJQUMzRCxPQUFPLGFBQWEsQ0FBQyxjQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFBO0FBQ3JELENBQUM7QUFFRCxJQUFJLGNBQTZDLENBQUE7QUFFakQ7OztHQUdHO0FBQ0ksTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxHQUFrQixFQUNDLEVBQUU7SUFDckIsY0FBYyxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUU7UUFDN0IsTUFBTSxZQUFZLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQ3BDLGlDQUF5QixDQUFDLGFBQWEsQ0FDeEMsQ0FBQTtRQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBQSwwQkFBa0IsRUFBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUE7UUFDckUsT0FBTyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUE7SUFDbkUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtRQUNuQixjQUFjLEdBQUcsU0FBUyxDQUFBO1FBQzFCLE1BQU0sS0FBSyxDQUFBO0lBQ2IsQ0FBQyxDQUFDLENBQUE7SUFFRixPQUFPLGNBQWMsQ0FBQTtBQUN2QixDQUFDLENBQUE7QUFmWSxRQUFBLGtDQUFrQyxzQ0FlOUMifQ==

package/.medusa/server/src/api/utils/split-order-payment-status.d.ts

@@ -1,6 +1,8 @@
 type OrderWithCartPaymentCollection = {
     cart?: {
-        payment_collection?: unknown;
+        payment_collection?: {
+            metadata?: Record<string, unknown> | null;
+        } | null;
     } | null;
     payment_collections?: unknown[];
     payment_status?: string;

package/.medusa/server/src/api/utils/split-order-payment-status.js

@@ -3,36 +3,40 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeOrderPaymentCollections = exports.withCartPaymentCollectionFields = void 0;
 const utils_1 = require("@medusajs/framework/utils");
 const aggregate_status_1 = require("../../workflows/order-group/utils/aggregate-status");
-// The shared cart payment collection is reached through the cart, not linked
-// to the order. These fields must always be loaded so the routes can normalize
-// them back onto `payment_collections` and recompute `payment_status` — even
-// when the client sends an absolute `fields=` list that would otherwise replace
-// the route defaults.
-const CART_PAYMENT_COLLECTION_FIELDS = [
-    "cart.payment_collection.*",
-    "cart.payment_collection.payments.*",
-    "cart.payment_collection.payments.refunds.*",
-    "cart.payment_collection.payments.refunds.refund_reason.*",
-    "cart.payment_collection.payment_sessions.*",
+const split_order_payment_group_1 = require("../../workflows/payment/utils/split-order-payment-group");
+// An order is paid through the cart's shared payment collection until that
+// payment is captured, and through its own linked collection afterwards. Both
+// are always loaded so the routes can pick the right one and recompute
+// `payment_status`, even when the client sends an absolute `fields=` list that
+// would otherwise replace the route defaults.
+const PAYMENT_COLLECTION_FIELDS = [
+    "*",
+    "payments.*",
+    "payments.refunds.*",
+    "payments.refunds.refund_reason.*",
+    "payment_sessions.*",
 ];
 const withCartPaymentCollectionFields = (fields) => {
-    return (0, utils_1.deduplicate)([...fields, ...CART_PAYMENT_COLLECTION_FIELDS]);
+    return (0, utils_1.deduplicate)([
+        ...fields,
+        ...PAYMENT_COLLECTION_FIELDS.map((f) => `payment_collections.${f}`),
+        ...PAYMENT_COLLECTION_FIELDS.map((f) => `cart.payment_collection.${f}`),
+    ]);
 };
 exports.withCartPaymentCollectionFields = withCartPaymentCollectionFields;
-// The shared cart payment collection is fetched via `cart.payment_collection`
-// (it is not linked directly to an order). Expose it back on the order under
-// `payment_collections` so consumers keep the familiar shape, and recompute
-// `payment_status` from it — Medusa's aggregation reads the linked payment
-// collections, which are always empty for split orders under the cart-path model.
+// Exposes the order's payment collections under `payment_collections` whichever
+// way they are attached, and recomputes `payment_status` from them: Medusa's
+// aggregation only reads the linked ones.
 const normalizeOrderPaymentCollections = (order) => {
-    const paymentCollection = order.cart?.payment_collection;
+    const hadCart = !!order.cart;
+    const paymentCollections = (0, split_order_payment_group_1.resolveOrderPaymentCollections)(order);
     delete order.cart;
-    if (!paymentCollection) {
+    if (!hadCart && !order.payment_collections) {
         return order;
     }
-    order.payment_collections = [paymentCollection];
+    order.payment_collections = paymentCollections;
     order.payment_status = (0, aggregate_status_1.getLastPaymentStatus)(order);
     return order;
 };
 exports.normalizeOrderPaymentCollections = normalizeOrderPaymentCollections;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3BsaXQtb3JkZXItcGF5bWVudC1zdGF0dXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3V0aWxzL3NwbGl0LW9yZGVyLXBheW1lbnQtc3RhdHVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHFEQUF1RDtBQUV2RCx5RkFBeUY7QUFRekYsNkVBQTZFO0FBQzdFLCtFQUErRTtBQUMvRSw2RUFBNkU7QUFDN0UsZ0ZBQWdGO0FBQ2hGLHNCQUFzQjtBQUN0QixNQUFNLDhCQUE4QixHQUFHO0lBQ3JDLDJCQUEyQjtJQUMzQixvQ0FBb0M7SUFDcEMsNENBQTRDO0lBQzVDLDBEQUEwRDtJQUMxRCw0Q0FBNEM7Q0FDN0MsQ0FBQTtBQUVNLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxNQUFnQixFQUFZLEVBQUU7SUFDNUUsT0FBTyxJQUFBLG1CQUFXLEVBQUMsQ0FBQyxHQUFHLE1BQU0sRUFBRSxHQUFHLDhCQUE4QixDQUFDLENBQUMsQ0FBQTtBQUNwRSxDQUFDLENBQUE7QUFGWSxRQUFBLCtCQUErQixtQ0FFM0M7QUFFRCw4RUFBOEU7QUFDOUUsNkVBQTZFO0FBQzdFLDRFQUE0RTtBQUM1RSwyRUFBMkU7QUFDM0Usa0ZBQWtGO0FBQzNFLE1BQU0sZ0NBQWdDLEdBQUcsQ0FHOUMsS0FBUSxFQUNMLEVBQUU7SUFDTCxNQUFNLGlCQUFpQixHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLENBQUE7SUFFeEQsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFBO0lBRWpCLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3ZCLE9BQU8sS0FBSyxDQUFBO0lBQ2QsQ0FBQztJQUVELEtBQUssQ0FBQyxtQkFBbUIsR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUE7SUFDL0MsS0FBSyxDQUFDLGNBQWMsR0FBRyxJQUFBLHVDQUFvQixFQUN6QyxLQUFrQyxDQUNuQyxDQUFBO0lBRUQsT0FBTyxLQUFLLENBQUE7QUFDZCxDQUFDLENBQUE7QUFuQlksUUFBQSxnQ0FBZ0Msb0NBbUI1QyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3BsaXQtb3JkZXItcGF5bWVudC1zdGF0dXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3V0aWxzL3NwbGl0LW9yZGVyLXBheW1lbnQtc3RhdHVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHFEQUF1RDtBQUV2RCx5RkFBeUY7QUFFekYsdUdBQXdHO0FBUXhHLDJFQUEyRTtBQUMzRSw4RUFBOEU7QUFDOUUsdUVBQXVFO0FBQ3ZFLCtFQUErRTtBQUMvRSw4Q0FBOEM7QUFDOUMsTUFBTSx5QkFBeUIsR0FBRztJQUNoQyxHQUFHO0lBQ0gsWUFBWTtJQUNaLG9CQUFvQjtJQUNwQixrQ0FBa0M7SUFDbEMsb0JBQW9CO0NBQ3JCLENBQUE7QUFFTSxNQUFNLCtCQUErQixHQUFHLENBQUMsTUFBZ0IsRUFBWSxFQUFFO0lBQzVFLE9BQU8sSUFBQSxtQkFBVyxFQUFDO1FBQ2pCLEdBQUcsTUFBTTtRQUNULEdBQUcseUJBQXlCLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyx1QkFBdUIsQ0FBQyxFQUFFLENBQUM7UUFDbkUsR0FBRyx5QkFBeUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLDJCQUEyQixDQUFDLEVBQUUsQ0FBQztLQUN4RSxDQUFDLENBQUE7QUFDSixDQUFDLENBQUE7QUFOWSxRQUFBLCtCQUErQixtQ0FNM0M7QUFFRCxnRkFBZ0Y7QUFDaEYsNkVBQTZFO0FBQzdFLDBDQUEwQztBQUNuQyxNQUFNLGdDQUFnQyxHQUFHLENBRzlDLEtBQVEsRUFDTCxFQUFFO0lBQ0wsTUFBTSxPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUE7SUFDNUIsTUFBTSxrQkFBa0IsR0FBRyxJQUFBLDBEQUE4QixFQUFDLEtBQUssQ0FBQyxDQUFBO0lBRWhFLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQTtJQUVqQixJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFDM0MsT0FBTyxLQUFLLENBQUE7SUFDZCxDQUFDO0lBRUQsS0FBSyxDQUFDLG1CQUFtQixHQUFHLGtCQUFrQixDQUFBO0lBQzlDLEtBQUssQ0FBQyxjQUFjLEdBQUcsSUFBQSx1Q0FBb0IsRUFDekMsS0FBa0MsQ0FDbkMsQ0FBQTtJQUVELE9BQU8sS0FBSyxDQUFBO0FBQ2QsQ0FBQyxDQUFBO0FBcEJZLFFBQUEsZ0NBQWdDLG9DQW9CNUMifQ==

package/.medusa/server/src/api/utils/unless-base-url.d.ts

@@ -1,10 +1,12 @@
 import { MedusaNextFunction } from '@medusajs/framework';
 import { MedusaResponse, MiddlewareFunction } from '@medusajs/framework';
 import { MedusaRequest } from '@medusajs/framework';
+type PathMatcher = RegExp | RegExp[] | ((req: MedusaRequest) => RegExp[] | Promise<RegExp[]>);
 /**
  * Due to Medusa's `unlessPath` function bug, we need to use this function to skip middlewares for particular routes.
- * @param onPath - Regular expression or array of regular expressions to match against the base URL
+ * @param onPath - Regular expression(s) to match against the base URL, or a resolver returning them per request
  * @param middleware - The middleware function to execute
  * @param methods - Optional array of HTTP methods to match against. If not provided, matches all methods.
  */
-export declare const unlessBaseUrl: (onPath: RegExp | RegExp[], middleware: MiddlewareFunction, methods?: string[]) => (req: MedusaRequest, res: MedusaResponse, next: MedusaNextFunction) => any;
+export declare const unlessBaseUrl: (onPath: PathMatcher, middleware: MiddlewareFunction, methods?: string[]) => (req: MedusaRequest, res: MedusaResponse, next: MedusaNextFunction) => Promise<any>;
+export {};

package/.medusa/server/src/api/utils/unless-base-url.js

@@ -3,13 +3,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.unlessBaseUrl = void 0;
 /**
  * Due to Medusa's `unlessPath` function bug, we need to use this function to skip middlewares for particular routes.
- * @param onPath - Regular expression or array of regular expressions to match against the base URL
+ * @param onPath - Regular expression(s) to match against the base URL, or a resolver returning them per request
  * @param middleware - The middleware function to execute
  * @param methods - Optional array of HTTP methods to match against. If not provided, matches all methods.
  */
-const unlessBaseUrl = (onPath, middleware, methods) => (req, res, next) => {
+const unlessBaseUrl = (onPath, middleware, methods) => async (req, res, next) => {
     const methodMatches = !methods || methods.includes(req.method.toUpperCase());
-    const paths = Array.isArray(onPath) ? onPath : [onPath];
+    let paths;
+    try {
+        paths = typeof onPath === "function"
+            ? await onPath(req)
+            : Array.isArray(onPath) ? onPath : [onPath];
+    }
+    catch (error) {
+        return next(error);
+    }
     const pathMatches = paths.some(p => p.test(req.baseUrl));
     if (pathMatches && methodMatches) {
         return next();
@@ -19,4 +27,4 @@ const unlessBaseUrl = (onPath, middleware, methods) => (req, res, next) => {
     }
 };
 exports.unlessBaseUrl = unlessBaseUrl;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5sZXNzLWJhc2UtdXJsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS91dGlscy91bmxlc3MtYmFzZS11cmwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBSUE7Ozs7O0dBS0c7QUFDSSxNQUFNLGFBQWEsR0FDdEIsQ0FBQyxNQUF5QixFQUFFLFVBQThCLEVBQUUsT0FBa0IsRUFBRSxFQUFFLENBQzlFLENBQUMsR0FBa0IsRUFBRSxHQUFtQixFQUFFLElBQXdCLEVBQUUsRUFBRTtJQUNsRSxNQUFNLGFBQWEsR0FBRyxDQUFDLE9BQU8sSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQTtJQUM1RSxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUE7SUFDdkQsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUE7SUFDeEQsSUFBSSxXQUFXLElBQUksYUFBYSxFQUFFLENBQUM7UUFDL0IsT0FBTyxJQUFJLEVBQUUsQ0FBQTtJQUNqQixDQUFDO1NBQU0sQ0FBQztRQUNKLE9BQU8sVUFBVSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUE7SUFDckMsQ0FBQztBQUNMLENBQUMsQ0FBQTtBQVhJLFFBQUEsYUFBYSxpQkFXakIifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5sZXNzLWJhc2UtdXJsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS91dGlscy91bmxlc3MtYmFzZS11cmwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBU0E7Ozs7O0dBS0c7QUFDSSxNQUFNLGFBQWEsR0FDdEIsQ0FBQyxNQUFtQixFQUFFLFVBQThCLEVBQUUsT0FBa0IsRUFBRSxFQUFFLENBQ3hFLEtBQUssRUFBRSxHQUFrQixFQUFFLEdBQW1CLEVBQUUsSUFBd0IsRUFBRSxFQUFFO0lBQ3hFLE1BQU0sYUFBYSxHQUFHLENBQUMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFBO0lBQzVFLElBQUksS0FBZSxDQUFBO0lBQ25CLElBQUksQ0FBQztRQUNELEtBQUssR0FBRyxPQUFPLE1BQU0sS0FBSyxVQUFVO1lBQ2hDLENBQUMsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxHQUFHLENBQUM7WUFDbkIsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUNuRCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNiLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3RCLENBQUM7SUFDRCxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQTtJQUN4RCxJQUFJLFdBQVcsSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUMvQixPQUFPLElBQUksRUFBRSxDQUFBO0lBQ2pCLENBQUM7U0FBTSxDQUFDO1FBQ0osT0FBTyxVQUFVLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQTtJQUNyQyxDQUFDO0FBQ0wsQ0FBQyxDQUFBO0FBbEJJLFFBQUEsYUFBYSxpQkFrQmpCIn0=

package/.medusa/server/src/api/vendor/campaigns/middlewares.js

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.vendorCampaignsMiddlewares = void 0;
-const policy_resources_1 = require("../../utils/policy-resources");
-const utils_1 = require("@medusajs/framework/utils");
+const utils_1 = require("../../utils");
 const http_1 = require("@medusajs/framework/http");
 const framework_1 = require("@medusajs/framework");
 const validators_1 = require("@medusajs/medusa/api/utils/validators");
@@ -22,82 +21,53 @@ exports.vendorCampaignsMiddlewares = [
         method: ["GET"],
         matcher: "/vendor/campaigns",
         middlewares: [
+            (0, utils_1.requirePermission)("campaigns", "view"),
             (0, framework_1.validateAndTransformQuery)(validators_2.VendorGetCampaignsParams, query_config_1.vendorCampaignQueryConfig.list),
             applySellerCampaignLinkFilter,
             helpers_1.applyCampaignFilters,
         ],
-        policies: [
-            {
-                resource: policy_resources_1.PolicyResource.campaign,
-                operation: utils_1.PolicyOperation.read,
-            },
-        ],
     },
     {
         method: ["POST"],
         matcher: "/vendor/campaigns",
         middlewares: [
+            (0, utils_1.requirePermission)("campaigns", "edit"),
             (0, framework_1.validateAndTransformBody)(validators_2.VendorCreateCampaign),
             (0, framework_1.validateAndTransformQuery)(validators_2.VendorGetCampaignParams, query_config_1.vendorCampaignQueryConfig.retrieve),
         ],
-        policies: [
-            {
-                resource: policy_resources_1.PolicyResource.campaign,
-                operation: utils_1.PolicyOperation.create,
-            },
-        ],
     },
     {
         method: ["GET"],
         matcher: "/vendor/campaigns/:id",
         middlewares: [
+            (0, utils_1.requirePermission)("campaigns", "view"),
             (0, framework_1.validateAndTransformQuery)(validators_2.VendorGetCampaignParams, query_config_1.vendorCampaignQueryConfig.retrieve),
         ],
-        policies: [
-            {
-                resource: policy_resources_1.PolicyResource.campaign,
-                operation: utils_1.PolicyOperation.read,
-            },
-        ],
     },
     {
         method: ["POST"],
         matcher: "/vendor/campaigns/:id",
         middlewares: [
+            (0, utils_1.requirePermission)("campaigns", "edit"),
             (0, framework_1.validateAndTransformBody)(validators_2.VendorUpdateCampaign),
             (0, framework_1.validateAndTransformQuery)(validators_2.VendorGetCampaignParams, query_config_1.vendorCampaignQueryConfig.retrieve),
         ],
-        policies: [
-            {
-                resource: policy_resources_1.PolicyResource.campaign,
-                operation: utils_1.PolicyOperation.update,
-            },
-        ],
     },
     {
         method: ["DELETE"],
         matcher: "/vendor/campaigns/:id",
-        middlewares: [],
-        policies: [
-            {
-                resource: policy_resources_1.PolicyResource.campaign,
-                operation: utils_1.PolicyOperation.delete,
-            },
+        middlewares: [
+            (0, utils_1.requirePermission)("campaigns", "manage"),
         ],
     },
     {
         method: ["POST"],
         matcher: "/vendor/campaigns/:id/promotions",
         middlewares: [
+            (0, utils_1.requirePermission)("campaigns", "edit"),
             (0, framework_1.validateAndTransformBody)((0, validators_1.createLinkBody)()),
             (0, framework_1.validateAndTransformQuery)(validators_2.VendorGetCampaignParams, query_config_1.vendorCampaignQueryConfig.retrieve),
         ],
-        policies: [
-            {
-                resource: policy_resources_1.PolicyResource.campaign,
-                operation: utils_1.PolicyOperation.update,
-            },
-        ],
     },
 ];
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3ZlbmRvci9jYW1wYWlnbnMvbWlkZGxld2FyZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbUVBQTZEO0FBQzdELHFEQUEyRDtBQUMzRCxtREFNaUM7QUFDakMsbURBRzRCO0FBQzVCLHNFQUFzRTtBQUV0RSx1Q0FBZ0Q7QUFDaEQsaURBQTBEO0FBQzFELDZDQUtxQjtBQUVyQixNQUFNLDZCQUE2QixHQUFHLENBQ3BDLEdBQStCLEVBQy9CLEdBQW1CLEVBQ25CLElBQXdCLEVBQ3hCLEVBQUU7SUFDRixHQUFHLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxHQUFHLEdBQUcsQ0FBQyxjQUFlLENBQUMsU0FBUyxDQUFBO0lBRTlELE9BQU8sSUFBQSwyQkFBb0IsRUFBQztRQUMxQixVQUFVLEVBQUUsaUJBQWlCO1FBQzdCLFVBQVUsRUFBRSxhQUFhO1FBQ3pCLGVBQWUsRUFBRSxXQUFXO0tBQzdCLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFBO0FBQ3BCLENBQUMsQ0FBQTtBQUVZLFFBQUEsMEJBQTBCLEdBQXNCO0lBQzNEO1FBQ0UsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDO1FBQ2YsT0FBTyxFQUFFLG1CQUFtQjtRQUM1QixXQUFXLEVBQUU7WUFDWCxJQUFBLHFDQUF5QixFQUN2QixxQ0FBd0IsRUFDeEIsd0NBQXlCLENBQUMsSUFBSSxDQUMvQjtZQUNELDZCQUE2QjtZQUM3Qiw4QkFBb0I7U0FDckI7UUFDRCxRQUFRLEVBQUU7WUFDUjtnQkFDRSxRQUFRLEVBQUUsaUNBQWMsQ0FBQyxRQUFRO2dCQUNqQyxTQUFTLEVBQUUsdUJBQWUsQ0FBQyxJQUFJO2FBQ2hDO1NBQ0Y7S0FDRjtJQUNEO1FBQ0UsTUFBTSxFQUFFLENBQUMsTUFBTSxDQUFDO1FBQ2hCLE9BQU8sRUFBRSxtQkFBbUI7UUFDNUIsV0FBVyxFQUFFO1lBQ1gsSUFBQSxvQ0FBd0IsRUFBQyxpQ0FBb0IsQ0FBQztZQUM5QyxJQUFBLHFDQUF5QixFQUN2QixvQ0FBdUIsRUFDdkIsd0NBQXlCLENBQUMsUUFBUSxDQUNuQztTQUNGO1FBQ0QsUUFBUSxFQUFFO1lBQ1I7Z0JBQ0UsUUFBUSxFQUFFLGlDQUFjLENBQUMsUUFBUTtnQkFDakMsU0FBUyxFQUFFLHVCQUFlLENBQUMsTUFBTTthQUNsQztTQUNGO0tBQ0Y7SUFDRDtRQUNFLE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQztRQUNmLE9BQU8sRUFBRSx1QkFBdUI7UUFDaEMsV0FBVyxFQUFFO1lBQ1gsSUFBQSxxQ0FBeUIsRUFDdkIsb0NBQXVCLEVBQ3ZCLHdDQUF5QixDQUFDLFFBQVEsQ0FDbkM7U0FDRjtRQUNELFFBQVEsRUFBRTtZQUNSO2dCQUNFLFFBQVEsRUFBRSxpQ0FBYyxDQUFDLFFBQVE7Z0JBQ2pDLFNBQVMsRUFBRSx1QkFBZSxDQUFDLElBQUk7YUFDaEM7U0FDRjtLQUNGO0lBQ0Q7UUFDRSxNQUFNLEVBQUUsQ0FBQyxNQUFNLENBQUM7UUFDaEIsT0FBTyxFQUFFLHVCQUF1QjtRQUNoQyxXQUFXLEVBQUU7WUFDWCxJQUFBLG9DQUF3QixFQUFDLGlDQUFvQixDQUFDO1lBQzlDLElBQUEscUNBQXlCLEVBQ3ZCLG9DQUF1QixFQUN2Qix3Q0FBeUIsQ0FBQyxRQUFRLENBQ25DO1NBQ0Y7UUFDRCxRQUFRLEVBQUU7WUFDUjtnQkFDRSxRQUFRLEVBQUUsaUNBQWMsQ0FBQyxRQUFRO2dCQUNqQyxTQUFTLEVBQUUsdUJBQWUsQ0FBQyxNQUFNO2FBQ2xDO1NBQ0Y7S0FDRjtJQUNEO1FBQ0UsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDO1FBQ2xCLE9BQU8sRUFBRSx1QkFBdUI7UUFDaEMsV0FBVyxFQUFFLEVBQUU7UUFDZixRQUFRLEVBQUU7WUFDUjtnQkFDRSxRQUFRLEVBQUUsaUNBQWMsQ0FBQyxRQUFRO2dCQUNqQyxTQUFTLEVBQUUsdUJBQWUsQ0FBQyxNQUFNO2FBQ2xDO1NBQ0Y7S0FDRjtJQUNEO1FBQ0UsTUFBTSxFQUFFLENBQUMsTUFBTSxDQUFDO1FBQ2hCLE9BQU8sRUFBRSxrQ0FBa0M7UUFDM0MsV0FBVyxFQUFFO1lBQ1gsSUFBQSxvQ0FBd0IsRUFBQyxJQUFBLDJCQUFjLEdBQUUsQ0FBQztZQUMxQyxJQUFBLHFDQUF5QixFQUN2QixvQ0FBdUIsRUFDdkIsd0NBQXlCLENBQUMsUUFBUSxDQUNuQztTQUNGO1FBQ0QsUUFBUSxFQUFFO1lBQ1I7Z0JBQ0UsUUFBUSxFQUFFLGlDQUFjLENBQUMsUUFBUTtnQkFDakMsU0FBUyxFQUFFLHVCQUFlLENBQUMsTUFBTTthQUNsQztTQUNGO0tBQ0Y7Q0FDRixDQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlkZGxld2FyZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3ZlbmRvci9jYW1wYWlnbnMvbWlkZGxld2FyZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsdUNBQStDO0FBQy9DLG1EQU1pQztBQUNqQyxtREFHNEI7QUFDNUIsc0VBQXNFO0FBRXRFLHVDQUFnRDtBQUNoRCxpREFBMEQ7QUFDMUQsNkNBS3FCO0FBRXJCLE1BQU0sNkJBQTZCLEdBQUcsQ0FDcEMsR0FBK0IsRUFDL0IsR0FBbUIsRUFDbkIsSUFBd0IsRUFDeEIsRUFBRTtJQUNGLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLEdBQUcsR0FBRyxDQUFDLGNBQWUsQ0FBQyxTQUFTLENBQUE7SUFFOUQsT0FBTyxJQUFBLDJCQUFvQixFQUFDO1FBQzFCLFVBQVUsRUFBRSxpQkFBaUI7UUFDN0IsVUFBVSxFQUFFLGFBQWE7UUFDekIsZUFBZSxFQUFFLFdBQVc7S0FDN0IsQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUE7QUFDcEIsQ0FBQyxDQUFBO0FBRVksUUFBQSwwQkFBMEIsR0FBc0I7SUFDM0Q7UUFDRSxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUM7UUFDZixPQUFPLEVBQUUsbUJBQW1CO1FBQzVCLFdBQVcsRUFBRTtZQUNYLElBQUEseUJBQWlCLEVBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQztZQUN0QyxJQUFBLHFDQUF5QixFQUN2QixxQ0FBd0IsRUFDeEIsd0NBQXlCLENBQUMsSUFBSSxDQUMvQjtZQUNELDZCQUE2QjtZQUM3Qiw4QkFBb0I7U0FDckI7S0FDRjtJQUNEO1FBQ0UsTUFBTSxFQUFFLENBQUMsTUFBTSxDQUFDO1FBQ2hCLE9BQU8sRUFBRSxtQkFBbUI7UUFDNUIsV0FBVyxFQUFFO1lBQ1gsSUFBQSx5QkFBaUIsRUFBQyxXQUFXLEVBQUUsTUFBTSxDQUFDO1lBQ3RDLElBQUEsb0NBQXdCLEVBQUMsaUNBQW9CLENBQUM7WUFDOUMsSUFBQSxxQ0FBeUIsRUFDdkIsb0NBQXVCLEVBQ3ZCLHdDQUF5QixDQUFDLFFBQVEsQ0FDbkM7U0FDRjtLQUNGO0lBQ0Q7UUFDRSxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUM7UUFDZixPQUFPLEVBQUUsdUJBQXVCO1FBQ2hDLFdBQVcsRUFBRTtZQUNYLElBQUEseUJBQWlCLEVBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQztZQUN0QyxJQUFBLHFDQUF5QixFQUN2QixvQ0FBdUIsRUFDdkIsd0NBQXlCLENBQUMsUUFBUSxDQUNuQztTQUNGO0tBQ0Y7SUFDRDtRQUNFLE1BQU0sRUFBRSxDQUFDLE1BQU0sQ0FBQztRQUNoQixPQUFPLEVBQUUsdUJBQXVCO1FBQ2hDLFdBQVcsRUFBRTtZQUNYLElBQUEseUJBQWlCLEVBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQztZQUN0QyxJQUFBLG9DQUF3QixFQUFDLGlDQUFvQixDQUFDO1lBQzlDLElBQUEscUNBQXlCLEVBQ3ZCLG9DQUF1QixFQUN2Qix3Q0FBeUIsQ0FBQyxRQUFRLENBQ25DO1NBQ0Y7S0FDRjtJQUNEO1FBQ0UsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDO1FBQ2xCLE9BQU8sRUFBRSx1QkFBdUI7UUFDaEMsV0FBVyxFQUFFO1lBQ1gsSUFBQSx5QkFBaUIsRUFBQyxXQUFXLEVBQUUsUUFBUSxDQUFDO1NBQ3pDO0tBQ0Y7SUFDRDtRQUNFLE1BQU0sRUFBRSxDQUFDLE1BQU0sQ0FBQztRQUNoQixPQUFPLEVBQUUsa0NBQWtDO1FBQzNDLFdBQVcsRUFBRTtZQUNYLElBQUEseUJBQWlCLEVBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQztZQUN0QyxJQUFBLG9DQUF3QixFQUFDLElBQUEsMkJBQWMsR0FBRSxDQUFDO1lBQzFDLElBQUEscUNBQXlCLEVBQ3ZCLG9DQUF1QixFQUN2Qix3Q0FBeUIsQ0FBQyxRQUFRLENBQ25DO1NBQ0Y7S0FDRjtDQUNGLENBQUEifQ==