@nextblock-cms/ecom 0.22.0 → 0.22.2

package/lib/pages/cms/products/server-actions.es.js

@@ -1,28 +1,29 @@
 "use server";
 import { normalizeCurrencyRecord as e } from "../../../currency.es.js";
-import { createProduct as t, deleteProduct as n, syncCategoriesForTranslationGroup as r } from "../../../product-actions.es.js";
-import { sanitizeProductFormValuesForStoreManagedCurrencies as i } from "./product-price-sync.es.js";
-import { syncProductSaleCouponToFreemius as a } from "../../../freemius-coupons.es.js";
-import { createClient as o, getServiceRoleSupabaseClient as s } from "@nextblock-cms/db/server";
-import { redirect as c } from "next/navigation";
-import { revalidatePath as l } from "next/cache";
+import { requireEcomStaff as t } from "../../../server-actions/require-ecom-role.es.js";
+import { createProduct as n, deleteProduct as r, syncCategoriesForTranslationGroup as i } from "../../../product-actions.es.js";
+import { sanitizeProductFormValuesForStoreManagedCurrencies as a } from "./product-price-sync.es.js";
+import { syncProductSaleCouponToFreemius as o } from "../../../freemius-coupons.es.js";
+import { createClient as s, getServiceRoleSupabaseClient as c } from "@nextblock-cms/db/server";
+import { redirect as l } from "next/navigation";
+import { revalidatePath as u } from "next/cache";
 //#region src/lib/pages/cms/products/server-actions.ts
-function u(e) {
+function d(e) {
 	return e.toLowerCase().trim().replace(/\s+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
-async function d(n) {
-	let r = o(), { data: u } = await r.from("currencies").select("code, symbol, exchange_rate, is_default, is_active, auto_sync_product_prices, auto_update_exchange_rate, exchange_rate_source, exchange_rate_updated_at, rounding_mode, rounding_increment, rounding_charm_amount").eq("is_active", !0).order("code", { ascending: !0 }), d = i(n, (u || []).map((t) => e(t))), f = await t(r, d);
+async function f(t) {
+	let r = s(), { data: i } = await r.from("currencies").select("code, symbol, exchange_rate, is_default, is_active, auto_sync_product_prices, auto_update_exchange_rate, exchange_rate_source, exchange_rate_updated_at, rounding_mode, rounding_increment, rounding_charm_amount").eq("is_active", !0).order("code", { ascending: !0 }), d = a(t, (i || []).map((t) => e(t))), f = await n(r, d);
 	if (d.payment_provider === "freemius" && f?.id) try {
-		await a({
+		await o({
 			productId: f.id,
-			client: s()
+			client: c()
 		});
 	} catch (e) {
 		console.error("Failed to sync Freemius sale coupon on create:", e);
 	}
-	l("/cms/products"), c("/cms/products");
+	u("/cms/products"), l("/cms/products");
 }
-async function f(e, t, n, r) {
+async function p(e, t, n, r) {
 	let i = {
 		author_id: n,
 		meta: r,
@@ -51,107 +52,107 @@ async function f(e, t, n, r) {
 		throw Error(`Failed to save product draft: ${u.message}`);
 	}
 }
-async function p(t, n) {
-	let r = o(), { data: { user: a } } = await r.auth.getUser();
-	if (!a) throw Error("User not authenticated.");
-	let { data: s } = await r.from("currencies").select("code, symbol, exchange_rate, is_default, is_active, auto_sync_product_prices, auto_update_exchange_rate, exchange_rate_source, exchange_rate_updated_at, rounding_mode, rounding_increment, rounding_charm_amount").eq("is_active", !0).order("code", { ascending: !0 }), c = i(n, (s || []).map((t) => e(t)));
-	return await f(r, t, a.id, c), { success: !0 };
+async function m(t, n) {
+	let r = s(), { data: { user: i } } = await r.auth.getUser();
+	if (!i) throw Error("User not authenticated.");
+	let { data: o } = await r.from("currencies").select("code, symbol, exchange_rate, is_default, is_active, auto_sync_product_prices, auto_update_exchange_rate, exchange_rate_source, exchange_rate_updated_at, rounding_mode, rounding_increment, rounding_charm_amount").eq("is_active", !0).order("code", { ascending: !0 }), c = a(n, (o || []).map((t) => e(t)));
+	return await p(r, t, i.id, c), { success: !0 };
 }
-async function m(e) {
-	let t = o();
-	await n(t, e), l("/cms/products");
+async function h(e) {
+	let t = s();
+	await r(t, e), u("/cms/products");
 }
-function h(e) {
+function g(e) {
 	return Array.from(new Set(e.map((e) => e.trim()).filter(Boolean)));
 }
-async function g(e) {
-	let t = h(e);
+async function _(e) {
+	let t = g(e);
 	if (t.length === 0) return {
 		success: !1,
 		error: "Select at least one product."
 	};
-	let { error: n } = await o().from("products").delete().in("id", t);
+	let { error: n } = await s().from("products").delete().in("id", t);
 	return n ? {
 		success: !1,
 		error: n.message
-	} : (l("/cms/products"), {
+	} : (u("/cms/products"), {
 		success: !0,
 		count: t.length
 	});
 }
-async function _(e) {
-	let t = h(e);
+async function v(e) {
+	let t = g(e);
 	if (t.length === 0) return {
 		success: !1,
 		error: "Select at least one product."
 	};
-	let { error: n } = await o().from("products").update({
+	let { error: n } = await s().from("products").update({
 		status: "draft",
 		updated_at: (/* @__PURE__ */ new Date()).toISOString()
 	}).in("id", t);
 	return n ? {
 		success: !1,
 		error: n.message
-	} : (l("/cms/products"), {
+	} : (u("/cms/products"), {
 		success: !0,
 		count: t.length
 	});
 }
-async function v(e) {
+async function y(e) {
 	let t = String(e || "").trim();
 	if (!t) return { error: "Missing product id." };
-	let n = o(), { data: { user: r } } = await n.auth.getUser();
+	let n = s(), { data: { user: r } } = await n.auth.getUser();
 	if (!r) return { error: "You must be signed in to publish a product." };
 	let { data: i, error: a } = await n.from("products").update({
 		status: "active",
 		updated_at: (/* @__PURE__ */ new Date()).toISOString()
 	}).eq("id", t).select("slug").single();
-	return a || !i ? { error: a?.message || "Could not publish the product." } : (l("/cms/products"), l(`/cms/products/${t}/edit`), i.slug && l(`/product/${i.slug}`), {});
+	return a || !i ? { error: a?.message || "Could not publish the product." } : (u("/cms/products"), u(`/cms/products/${t}/edit`), i.slug && u(`/product/${i.slug}`), {});
 }
-async function y(e) {
-	let t = s(), n = e.name.trim(), r = u(e.slug?.trim() || e.name);
-	if (!n || !r) return {
+async function b(e) {
+	let n = await t(), r = e.name.trim(), i = d(e.slug?.trim() || e.name);
+	if (!r || !i) return {
 		success: !1,
 		error: "Attribute name is required."
 	};
-	let { error: i } = await t.from("product_attributes").insert({
-		name: n,
-		slug: r
+	let { error: a } = await n.from("product_attributes").insert({
+		name: r,
+		slug: i
 	});
-	return i ? {
+	return a ? {
 		success: !1,
-		error: i.message
-	} : (l("/cms/products/attributes"), l("/cms/products/new"), l("/cms/products"), { success: !0 });
+		error: a.message
+	} : (u("/cms/products/attributes"), u("/cms/products/new"), u("/cms/products"), { success: !0 });
 }
-async function b(e) {
-	let { error: t } = await s().from("product_attributes").delete().eq("id", e);
-	return t ? {
+async function x(e) {
+	let { error: n } = await (await t()).from("product_attributes").delete().eq("id", e);
+	return n ? {
 		success: !1,
-		error: t.message
-	} : (l("/cms/products/attributes"), l("/cms/products/new"), l("/cms/products"), { success: !0 });
+		error: n.message
+	} : (u("/cms/products/attributes"), u("/cms/products/new"), u("/cms/products"), { success: !0 });
 }
-async function x(e) {
-	let t = s(), n = e.value.trim(), r = u(e.slug?.trim() || e.value);
-	if (!n || !r) return {
+async function S(e) {
+	let n = await t(), r = e.value.trim(), i = d(e.slug?.trim() || e.value);
+	if (!r || !i) return {
 		success: !1,
 		error: "Term value is required."
 	};
-	let { data: i } = await t.from("product_attribute_terms").select("sort_order").eq("attribute_id", e.attributeId).order("sort_order", { ascending: !1 }).limit(1), a = typeof i?.[0]?.sort_order == "number" ? i[0].sort_order + 1 : 0, { error: o } = await t.from("product_attribute_terms").insert({
+	let { data: a } = await n.from("product_attribute_terms").select("sort_order").eq("attribute_id", e.attributeId).order("sort_order", { ascending: !1 }).limit(1), o = typeof a?.[0]?.sort_order == "number" ? a[0].sort_order + 1 : 0, { error: s } = await n.from("product_attribute_terms").insert({
 		attribute_id: e.attributeId,
-		value: n,
-		slug: r,
-		sort_order: a
+		value: r,
+		slug: i,
+		sort_order: o
 	});
-	return o ? {
+	return s ? {
 		success: !1,
-		error: o.message
-	} : (l("/cms/products/attributes"), l("/cms/products/new"), l("/cms/products"), { success: !0 });
+		error: s.message
+	} : (u("/cms/products/attributes"), u("/cms/products/new"), u("/cms/products"), { success: !0 });
 }
-async function S(e) {
-	let t = s();
-	for (let [n, r] of e.orderedTermIds.entries()) {
-		let { error: i } = await t.from("product_attribute_terms").update({
-			sort_order: n,
+async function C(e) {
+	let n = await t();
+	for (let [t, r] of e.orderedTermIds.entries()) {
+		let { error: i } = await n.from("product_attribute_terms").update({
+			sort_order: t,
 			updated_at: (/* @__PURE__ */ new Date()).toISOString()
 		}).eq("id", r).eq("attribute_id", e.attributeId);
 		if (i) return {
@@ -159,86 +160,86 @@ async function S(e) {
 			error: i.message
 		};
 	}
-	return l("/cms/products/attributes"), l("/cms/products/new"), l("/cms/products"), { success: !0 };
+	return u("/cms/products/attributes"), u("/cms/products/new"), u("/cms/products"), { success: !0 };
 }
-async function C(e) {
-	let t = s(), { error: n } = await t.from("product_attributes").update({
+async function w(e) {
+	let n = await t(), { error: r } = await n.from("product_attributes").update({
 		name_translations: e.nameTranslations,
 		updated_at: (/* @__PURE__ */ new Date()).toISOString()
 	}).eq("id", e.attributeId);
-	if (n) return {
+	if (r) return {
 		success: !1,
-		error: n.message
+		error: r.message
 	};
-	for (let n of e.termTranslations) {
-		let { error: r } = await t.from("product_attribute_terms").update({
-			value_translations: n.valueTranslations,
+	for (let t of e.termTranslations) {
+		let { error: r } = await n.from("product_attribute_terms").update({
+			value_translations: t.valueTranslations,
 			updated_at: (/* @__PURE__ */ new Date()).toISOString()
-		}).eq("id", n.termId).eq("attribute_id", e.attributeId);
+		}).eq("id", t.termId).eq("attribute_id", e.attributeId);
 		if (r) return {
 			success: !1,
 			error: r.message
 		};
 	}
-	return l("/cms/products/attributes"), l("/cms/products/new"), l("/cms/products"), { success: !0 };
+	return u("/cms/products/attributes"), u("/cms/products/new"), u("/cms/products"), { success: !0 };
 }
-async function w(e) {
-	let { error: t } = await s().from("product_attribute_terms").delete().eq("id", e);
-	return t ? {
+async function T(e) {
+	let { error: n } = await (await t()).from("product_attribute_terms").delete().eq("id", e);
+	return n ? {
 		success: !1,
-		error: t.message
-	} : (l("/cms/products/attributes"), l("/cms/products/new"), l("/cms/products"), { success: !0 });
+		error: n.message
+	} : (u("/cms/products/attributes"), u("/cms/products/new"), u("/cms/products"), { success: !0 });
 }
-async function T(e) {
-	let t = s(), n = e.name.trim(), r = u(e.slug?.trim() || e.name);
-	if (!n || !r) return {
+async function E(e) {
+	let n = await t(), r = e.name.trim(), i = d(e.slug?.trim() || e.name);
+	if (!r || !i) return {
 		success: !1,
 		error: "Category name is required."
 	};
-	let { data: i, error: a } = await t.from("categories").insert({
-		name: n,
-		slug: r,
+	let { data: a, error: o } = await n.from("categories").insert({
+		name: r,
+		slug: i,
 		description: e.description?.trim() || null,
 		name_translations: e.nameTranslations || {},
 		description_translations: e.descriptionTranslations || {}
 	}).select().single();
-	return a ? {
+	return o ? {
 		success: !1,
-		error: a.message
-	} : (l("/cms/products/categories"), l("/cms/products/new"), l("/cms/products"), {
+		error: o.message
+	} : (u("/cms/products/categories"), u("/cms/products/new"), u("/cms/products"), {
 		success: !0,
-		category: i
+		category: a
 	});
 }
-async function E(e, t) {
-	let n = s(), r = t.name.trim(), i = u(t.slug?.trim() || t.name);
-	if (!r || !i) return {
+async function D(e, n) {
+	let r = await t(), i = n.name.trim(), a = d(n.slug?.trim() || n.name);
+	if (!i || !a) return {
 		success: !1,
 		error: "Category name is required."
 	};
-	let { error: a } = await n.from("categories").update({
-		name: r,
-		slug: i,
-		description: t.description?.trim() || null,
-		name_translations: t.nameTranslations || {},
-		description_translations: t.descriptionTranslations || {}
+	let { error: o } = await r.from("categories").update({
+		name: i,
+		slug: a,
+		description: n.description?.trim() || null,
+		name_translations: n.nameTranslations || {},
+		description_translations: n.descriptionTranslations || {}
 	}).eq("id", e);
-	return a ? {
+	return o ? {
 		success: !1,
-		error: a.message
-	} : (l("/cms/products/categories"), l("/cms/products/new"), l("/cms/products"), { success: !0 });
+		error: o.message
+	} : (u("/cms/products/categories"), u("/cms/products/new"), u("/cms/products"), { success: !0 });
 }
-async function D(e) {
-	let { error: t } = await s().from("categories").delete().eq("id", e);
-	return t ? {
+async function O(e) {
+	let { error: n } = await (await t()).from("categories").delete().eq("id", e);
+	return n ? {
 		success: !1,
-		error: t.message
-	} : (l("/cms/products/categories"), l("/cms/products/new"), l("/cms/products"), { success: !0 });
+		error: n.message
+	} : (u("/cms/products/categories"), u("/cms/products/new"), u("/cms/products"), { success: !0 });
 }
-async function O(e, t) {
-	let n = s();
+async function k(e, n) {
+	let r = await t();
 	try {
-		return await r(n, e, t), l("/cms/products"), l(`/cms/products/${e}/edit`), { success: !0 };
+		return await i(r, e, n), u("/cms/products"), u(`/cms/products/${e}/edit`), { success: !0 };
 	} catch (e) {
 		return {
 			success: !1,
@@ -247,4 +248,4 @@ async function O(e, t) {
 	}
 }
 //#endregion
-export { g as bulkDeleteProductsAction, _ as bulkDraftProductsAction, T as createCategoryAction, d as createProductAction, y as createProductAttributeAction, x as createProductAttributeTermAction, D as deleteCategoryAction, m as deleteProductAction, b as deleteProductAttributeAction, w as deleteProductAttributeTermAction, v as publishProductAction, S as reorderProductAttributeTermsAction, O as syncProductCategoriesAction, E as updateCategoryAction, p as updateProductAction, C as updateProductAttributeTranslationsAction };
+export { _ as bulkDeleteProductsAction, v as bulkDraftProductsAction, E as createCategoryAction, f as createProductAction, b as createProductAttributeAction, S as createProductAttributeTermAction, O as deleteCategoryAction, h as deleteProductAction, x as deleteProductAttributeAction, T as deleteProductAttributeTermAction, y as publishProductAction, C as reorderProductAttributeTermsAction, k as syncProductCategoriesAction, D as updateCategoryAction, m as updateProductAction, w as updateProductAttributeTranslationsAction };

package/lib/pages/cms/shipping/server-actions.cjs

@@ -1 +1 @@
-"use server";const e=require("../../../currency.cjs"),t=require("../../../countries.cjs"),n=require("../../../shipping-rate-currency.cjs"),r=require("../../../states.cjs"),i=require("../../../inventory-settings.cjs");let a=require("@nextblock-cms/db/server"),o=require("next/navigation"),s=require("next/cache");function c(e){return Object.entries(e||{}).reduce((e,[t,n])=>{let r=t.trim().toLowerCase(),i=n.trim();return r&&i&&(e[r]=i),e},{})}async function l(e){let t=(0,a.createClient)(),{data:{user:n}}=await t.auth.getUser();if(!n)throw Error(`Unauthorized`);let{data:r}=await t.from(`profiles`).select(`role`).eq(`id`,n.id).single();if(!r||r.role!==`ADMIN`)throw Error(`Forbidden`);let c=e.getAll(`trackQuantities`).includes(`true`),l=await i.getEcommerceInventorySettings(t),{error:u}=await i.upsertEcommerceInventorySettings(t,{trackQuantities:c,enableTaxes:l.enableTaxes,taxCalculationMode:l.taxCalculationMode});if(u)throw Error(u.message);(0,s.revalidatePath)(`/cms/shipping`),(0,o.redirect)(`/cms/shipping?success=Inventory settings updated`)}function u(e){let n=new Map;for(let i of e){let e=t.normalizeCountryCode(i.country_code);if(!e)continue;let a=r.normalizeSubdivisionCode(e,i.state_code)||null,o=`${e}:${a??`*`}`;n.set(o,{country_code:e,state_code:a})}return[...n.values()]}async function d(e){let{data:t,error:n}=await e.from(`currencies`).select(`code, is_default`).eq(`is_active`,!0).order(`is_default`,{ascending:!1}).order(`code`,{ascending:!0});return n?{error:n.message}:{currencies:t||[]}}async function f(e,t,n){let r=(0,a.getServiceRoleSupabaseClient)(),i=u(n),{data:o,error:c}=await r.from(`shipping_zones`).insert({name:e,priority_order:t}).select().single();if(c||!o)return{error:c?.message||`Failed to create zone`};if(i.length>0){let e=i.map(e=>({zone_id:o.id,country_code:e.country_code,state_code:e.state_code??null})),{error:t}=await r.from(`shipping_zone_locations`).insert(e);if(t)return{error:t.message}}return(0,s.revalidatePath)(`/cms/shipping`),{success:!0}}async function p(e,t,n,r){let i=(0,a.getServiceRoleSupabaseClient)(),o=u(r),{error:c}=await i.from(`shipping_zones`).update({name:t,priority_order:n,updated_at:new Date().toISOString()}).eq(`id`,e);if(c)return{error:c.message||`Failed to update zone`};let{error:l}=await i.from(`shipping_zone_locations`).delete().eq(`zone_id`,e);if(l)return{error:`Failed to refresh locations`};if(o.length>0){let t=o.map(t=>({zone_id:e,country_code:t.country_code,state_code:t.state_code??null})),{error:n}=await i.from(`shipping_zone_locations`).insert(t);if(n)return{error:n.message}}return(0,s.revalidatePath)(`/cms/shipping`),{success:!0}}async function m(e){let{error:t}=await(0,a.getServiceRoleSupabaseClient)().from(`shipping_zones`).delete().eq(`id`,e);return t?{error:t.message}:((0,s.revalidatePath)(`/cms/shipping`),{success:!0})}async function h(t,r){let i=(0,a.getServiceRoleSupabaseClient)(),o=await d(i);if(`error`in o)return{error:o.error};let l=n.sanitizeShippingRateAmountMaps({currencies:o.currencies.map(t=>e.normalizeCurrencyRecord(t)),mode:r.currencyPricingMode,sourceCurrencyCode:r.sourceCurrencyCode,costAmounts:r.costAmounts,minOrderAmounts:r.minOrderAmounts,fallbackCostAmount:r.cost,fallbackMinOrderAmount:r.minOrderAmount}),{error:u}=await i.from(`shipping_zone_methods`).insert({zone_id:t,name:r.name.trim(),name_translations:c(r.nameTranslations),method_type:r.type,currency_pricing_mode:l.mode,cost_amount:l.costAmounts[l.sourceCurrencyCode],cost_amounts:l.costAmounts,cost_currency:l.sourceCurrencyCode,min_order_amount:l.minOrderAmounts[l.sourceCurrencyCode],min_order_amounts:l.minOrderAmounts});return u?{error:u.message}:((0,s.revalidatePath)(`/cms/shipping`),{success:!0})}async function g(t,r){let i=(0,a.getServiceRoleSupabaseClient)(),o=await d(i);if(`error`in o)return{error:o.error};let l=n.sanitizeShippingRateAmountMaps({currencies:o.currencies.map(t=>e.normalizeCurrencyRecord(t)),mode:r.currencyPricingMode,sourceCurrencyCode:r.sourceCurrencyCode,costAmounts:r.costAmounts,minOrderAmounts:r.minOrderAmounts,fallbackCostAmount:r.cost,fallbackMinOrderAmount:r.minOrderAmount}),{error:u}=await i.from(`shipping_zone_methods`).update({name:r.name.trim(),name_translations:c(r.nameTranslations),method_type:r.type,currency_pricing_mode:l.mode,cost_amount:l.costAmounts[l.sourceCurrencyCode],cost_amounts:l.costAmounts,cost_currency:l.sourceCurrencyCode,min_order_amount:l.minOrderAmounts[l.sourceCurrencyCode],min_order_amounts:l.minOrderAmounts,updated_at:new Date().toISOString()}).eq(`id`,t);return u?{error:u.message}:((0,s.revalidatePath)(`/cms/shipping`),{success:!0})}async function _(e){let{error:t}=await(0,a.getServiceRoleSupabaseClient)().from(`shipping_zone_methods`).delete().eq(`id`,e);return t?{error:t.message}:((0,s.revalidatePath)(`/cms/shipping`),{success:!0})}exports.createShippingRate=h,exports.createShippingZone=f,exports.deleteShippingRate=_,exports.deleteShippingZone=m,exports.updateInventoryTrackingAction=l,exports.updateShippingRate=g,exports.updateShippingZone=p;
+"use server";const e=require("../../../currency.cjs"),t=require("../../../countries.cjs"),n=require("../../../shipping-rate-currency.cjs"),r=require("../../../states.cjs"),i=require("../../../inventory-settings.cjs"),a=require("../../../server-actions/require-ecom-role.cjs");let o=require("@nextblock-cms/db/server"),s=require("next/navigation"),c=require("next/cache");function l(e){return Object.entries(e||{}).reduce((e,[t,n])=>{let r=t.trim().toLowerCase(),i=n.trim();return r&&i&&(e[r]=i),e},{})}async function u(e){let t=(0,o.createClient)(),{data:{user:n}}=await t.auth.getUser();if(!n)throw Error(`Unauthorized`);let{data:r}=await t.from(`profiles`).select(`role`).eq(`id`,n.id).single();if(!r||r.role!==`ADMIN`)throw Error(`Forbidden`);let a=e.getAll(`trackQuantities`).includes(`true`),l=await i.getEcommerceInventorySettings(t),{error:u}=await i.upsertEcommerceInventorySettings(t,{trackQuantities:a,enableTaxes:l.enableTaxes,taxCalculationMode:l.taxCalculationMode});if(u)throw Error(u.message);(0,c.revalidatePath)(`/cms/shipping`),(0,s.redirect)(`/cms/shipping?success=Inventory settings updated`)}function d(e){let n=new Map;for(let i of e){let e=t.normalizeCountryCode(i.country_code);if(!e)continue;let a=r.normalizeSubdivisionCode(e,i.state_code)||null,o=`${e}:${a??`*`}`;n.set(o,{country_code:e,state_code:a})}return[...n.values()]}async function f(e){let{data:t,error:n}=await e.from(`currencies`).select(`code, is_default`).eq(`is_active`,!0).order(`is_default`,{ascending:!1}).order(`code`,{ascending:!0});return n?{error:n.message}:{currencies:t||[]}}async function p(e,t,n){let r=await a.requireEcomAdmin(),i=d(n),{data:o,error:s}=await r.from(`shipping_zones`).insert({name:e,priority_order:t}).select().single();if(s||!o)return{error:s?.message||`Failed to create zone`};if(i.length>0){let e=i.map(e=>({zone_id:o.id,country_code:e.country_code,state_code:e.state_code??null})),{error:t}=await r.from(`shipping_zone_locations`).insert(e);if(t)return{error:t.message}}return(0,c.revalidatePath)(`/cms/shipping`),{success:!0}}async function m(e,t,n,r){let i=await a.requireEcomAdmin(),o=d(r),{error:s}=await i.from(`shipping_zones`).update({name:t,priority_order:n,updated_at:new Date().toISOString()}).eq(`id`,e);if(s)return{error:s.message||`Failed to update zone`};let{error:l}=await i.from(`shipping_zone_locations`).delete().eq(`zone_id`,e);if(l)return{error:`Failed to refresh locations`};if(o.length>0){let t=o.map(t=>({zone_id:e,country_code:t.country_code,state_code:t.state_code??null})),{error:n}=await i.from(`shipping_zone_locations`).insert(t);if(n)return{error:n.message}}return(0,c.revalidatePath)(`/cms/shipping`),{success:!0}}async function h(e){let{error:t}=await(await a.requireEcomAdmin()).from(`shipping_zones`).delete().eq(`id`,e);return t?{error:t.message}:((0,c.revalidatePath)(`/cms/shipping`),{success:!0})}async function g(t,r){let i=await a.requireEcomAdmin(),o=await f(i);if(`error`in o)return{error:o.error};let s=n.sanitizeShippingRateAmountMaps({currencies:o.currencies.map(t=>e.normalizeCurrencyRecord(t)),mode:r.currencyPricingMode,sourceCurrencyCode:r.sourceCurrencyCode,costAmounts:r.costAmounts,minOrderAmounts:r.minOrderAmounts,fallbackCostAmount:r.cost,fallbackMinOrderAmount:r.minOrderAmount}),{error:u}=await i.from(`shipping_zone_methods`).insert({zone_id:t,name:r.name.trim(),name_translations:l(r.nameTranslations),method_type:r.type,currency_pricing_mode:s.mode,cost_amount:s.costAmounts[s.sourceCurrencyCode],cost_amounts:s.costAmounts,cost_currency:s.sourceCurrencyCode,min_order_amount:s.minOrderAmounts[s.sourceCurrencyCode],min_order_amounts:s.minOrderAmounts});return u?{error:u.message}:((0,c.revalidatePath)(`/cms/shipping`),{success:!0})}async function _(t,r){let i=await a.requireEcomAdmin(),o=await f(i);if(`error`in o)return{error:o.error};let s=n.sanitizeShippingRateAmountMaps({currencies:o.currencies.map(t=>e.normalizeCurrencyRecord(t)),mode:r.currencyPricingMode,sourceCurrencyCode:r.sourceCurrencyCode,costAmounts:r.costAmounts,minOrderAmounts:r.minOrderAmounts,fallbackCostAmount:r.cost,fallbackMinOrderAmount:r.minOrderAmount}),{error:u}=await i.from(`shipping_zone_methods`).update({name:r.name.trim(),name_translations:l(r.nameTranslations),method_type:r.type,currency_pricing_mode:s.mode,cost_amount:s.costAmounts[s.sourceCurrencyCode],cost_amounts:s.costAmounts,cost_currency:s.sourceCurrencyCode,min_order_amount:s.minOrderAmounts[s.sourceCurrencyCode],min_order_amounts:s.minOrderAmounts,updated_at:new Date().toISOString()}).eq(`id`,t);return u?{error:u.message}:((0,c.revalidatePath)(`/cms/shipping`),{success:!0})}async function v(e){let{error:t}=await(await a.requireEcomAdmin()).from(`shipping_zone_methods`).delete().eq(`id`,e);return t?{error:t.message}:((0,c.revalidatePath)(`/cms/shipping`),{success:!0})}exports.createShippingRate=g,exports.createShippingZone=p,exports.deleteShippingRate=v,exports.deleteShippingZone=h,exports.updateInventoryTrackingAction=u,exports.updateShippingRate=_,exports.updateShippingZone=m;

package/lib/pages/cms/shipping/server-actions.es.js

@@ -4,7 +4,8 @@ import { normalizeCountryCode as t } from "../../../countries.es.js";
 import { sanitizeShippingRateAmountMaps as n } from "../../../shipping-rate-currency.es.js";
 import { normalizeSubdivisionCode as r } from "../../../states.es.js";
 import { getEcommerceInventorySettings as i, upsertEcommerceInventorySettings as a } from "../../../inventory-settings.es.js";
-import { createClient as o, getServiceRoleSupabaseClient as s } from "@nextblock-cms/db/server";
+import { requireEcomAdmin as o } from "../../../server-actions/require-ecom-role.es.js";
+import { createClient as s } from "@nextblock-cms/db/server";
 import { redirect as c } from "next/navigation";
 import { revalidatePath as l } from "next/cache";
 //#region src/lib/pages/cms/shipping/server-actions.ts
@@ -15,12 +16,12 @@ function u(e) {
 	}, {});
 }
 async function d(e) {
-	let t = o(), { data: { user: n } } = await t.auth.getUser();
+	let t = s(), { data: { user: n } } = await t.auth.getUser();
 	if (!n) throw Error("Unauthorized");
 	let { data: r } = await t.from("profiles").select("role").eq("id", n.id).single();
 	if (!r || r.role !== "ADMIN") throw Error("Forbidden");
-	let s = e.getAll("trackQuantities").includes("true"), u = await i(t), { error: d } = await a(t, {
-		trackQuantities: s,
+	let o = e.getAll("trackQuantities").includes("true"), u = await i(t), { error: d } = await a(t, {
+		trackQuantities: o,
 		enableTaxes: u.enableTaxes,
 		taxCalculationMode: u.taxCalculationMode
 	});
@@ -45,11 +46,11 @@ async function p(e) {
 	return n ? { error: n.message } : { currencies: t || [] };
 }
 async function m(e, t, n) {
-	let r = s(), i = f(n), { data: a, error: o } = await r.from("shipping_zones").insert({
+	let r = await o(), i = f(n), { data: a, error: s } = await r.from("shipping_zones").insert({
 		name: e,
 		priority_order: t
 	}).select().single();
-	if (o || !a) return { error: o?.message || "Failed to create zone" };
+	if (s || !a) return { error: s?.message || "Failed to create zone" };
 	if (i.length > 0) {
 		let e = i.map((e) => ({
 			zone_id: a.id,
@@ -61,12 +62,12 @@ async function m(e, t, n) {
 	return l("/cms/shipping"), { success: !0 };
 }
 async function h(e, t, n, r) {
-	let i = s(), a = f(r), { error: o } = await i.from("shipping_zones").update({
+	let i = await o(), a = f(r), { error: s } = await i.from("shipping_zones").update({
 		name: t,
 		priority_order: n,
 		updated_at: (/* @__PURE__ */ new Date()).toISOString()
 	}).eq("id", e);
-	if (o) return { error: o.message || "Failed to update zone" };
+	if (s) return { error: s.message || "Failed to update zone" };
 	let { error: c } = await i.from("shipping_zone_locations").delete().eq("zone_id", e);
 	if (c) return { error: "Failed to refresh locations" };
 	if (a.length > 0) {
@@ -80,13 +81,13 @@ async function h(e, t, n, r) {
 	return l("/cms/shipping"), { success: !0 };
 }
 async function g(e) {
-	let { error: t } = await s().from("shipping_zones").delete().eq("id", e);
+	let { error: t } = await (await o()).from("shipping_zones").delete().eq("id", e);
 	return t ? { error: t.message } : (l("/cms/shipping"), { success: !0 });
 }
 async function _(t, r) {
-	let i = s(), a = await p(i);
+	let i = await o(), a = await p(i);
 	if ("error" in a) return { error: a.error };
-	let o = n({
+	let s = n({
 		currencies: a.currencies.map((t) => e(t)),
 		mode: r.currencyPricingMode,
 		sourceCurrencyCode: r.sourceCurrencyCode,
@@ -99,19 +100,19 @@ async function _(t, r) {
 		name: r.name.trim(),
 		name_translations: u(r.nameTranslations),
 		method_type: r.type,
-		currency_pricing_mode: o.mode,
-		cost_amount: o.costAmounts[o.sourceCurrencyCode],
-		cost_amounts: o.costAmounts,
-		cost_currency: o.sourceCurrencyCode,
-		min_order_amount: o.minOrderAmounts[o.sourceCurrencyCode],
-		min_order_amounts: o.minOrderAmounts
+		currency_pricing_mode: s.mode,
+		cost_amount: s.costAmounts[s.sourceCurrencyCode],
+		cost_amounts: s.costAmounts,
+		cost_currency: s.sourceCurrencyCode,
+		min_order_amount: s.minOrderAmounts[s.sourceCurrencyCode],
+		min_order_amounts: s.minOrderAmounts
 	});
 	return c ? { error: c.message } : (l("/cms/shipping"), { success: !0 });
 }
 async function v(t, r) {
-	let i = s(), a = await p(i);
+	let i = await o(), a = await p(i);
 	if ("error" in a) return { error: a.error };
-	let o = n({
+	let s = n({
 		currencies: a.currencies.map((t) => e(t)),
 		mode: r.currencyPricingMode,
 		sourceCurrencyCode: r.sourceCurrencyCode,
@@ -123,18 +124,18 @@ async function v(t, r) {
 		name: r.name.trim(),
 		name_translations: u(r.nameTranslations),
 		method_type: r.type,
-		currency_pricing_mode: o.mode,
-		cost_amount: o.costAmounts[o.sourceCurrencyCode],
-		cost_amounts: o.costAmounts,
-		cost_currency: o.sourceCurrencyCode,
-		min_order_amount: o.minOrderAmounts[o.sourceCurrencyCode],
-		min_order_amounts: o.minOrderAmounts,
+		currency_pricing_mode: s.mode,
+		cost_amount: s.costAmounts[s.sourceCurrencyCode],
+		cost_amounts: s.costAmounts,
+		cost_currency: s.sourceCurrencyCode,
+		min_order_amount: s.minOrderAmounts[s.sourceCurrencyCode],
+		min_order_amounts: s.minOrderAmounts,
 		updated_at: (/* @__PURE__ */ new Date()).toISOString()
 	}).eq("id", t);
 	return c ? { error: c.message } : (l("/cms/shipping"), { success: !0 });
 }
 async function y(e) {
-	let { error: t } = await s().from("shipping_zone_methods").delete().eq("id", e);
+	let { error: t } = await (await o()).from("shipping_zone_methods").delete().eq("id", e);
 	return t ? { error: t.message } : (l("/cms/shipping"), { success: !0 });
 }
 //#endregion

package/lib/payment-config.cjs

@@ -1 +1 @@
-let e=require("@nextblock-cms/db/server");var t=`payment_secret`,n=`payment_public`,r=6e4,i=null;function a(e){return e&&typeof e==`object`&&!Array.isArray(e)?e:{}}async function o(o=!1){let s=Date.now();if(!o&&i&&s-i.at<r)return{secret:i.secret,public:i.public};let c={},l={};try{let r=(0,e.getServiceRoleSupabaseClient)(),[{data:i},{data:o}]=await Promise.all([r.from(`site_settings`).select(`value`).eq(`key`,t).maybeSingle(),r.from(`site_settings`).select(`value`).eq(`key`,n).maybeSingle()]);c=a(i?.value),l=a(o?.value)}catch{}return i={at:s,secret:c,public:l},{secret:c,public:l}}function s(){i=null}function c(t,n){return(0,e.tryDecryptWithEnvKey)(t[n])}async function l(){let{secret:t}=await o();return(0,e.resolveConfigValue)(c(t,`stripeSecretKey`),`STRIPE_SECRET_KEY`)}async function u(){let{secret:t}=await o();return(0,e.resolveConfigValue)(c(t,`stripeWebhookSecret`),`STRIPE_WEBHOOK_SECRET`)}async function d(){let{public:t}=await o(),n=a(t.stripe).publishableKey;return(0,e.resolveConfigValue)(typeof n==`string`?n:null,`NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY`)}async function f(){try{let{secret:e,public:t}=await o(),n=a(t.freemius),r=(e,t)=>{t&&t.trim()&&(process.env[e]=t.trim())};r(`FREEMIUS_SECRET_KEY`,c(e,`freemiusSecretKey`)),r(`FREEMIUS_API_KEY`,c(e,`freemiusApiKey`)),r(`FREEMIUS_ECOMMERCE_SANDBOX_SECRET_KEY`,c(e,`freemiusSandboxSecretKey`)),r(`FREEMIUS_PUBLIC_KEY`,typeof n.publicKey==`string`?n.publicKey:null),r(`FREEMIUS_PRODUCT_ID`,typeof n.productId==`string`?n.productId:null),r(`FREEMIUS_DEVELOPER_ID`,typeof n.developerId==`string`?n.developerId:null)}catch(e){console.warn(`[payment-config] Could not hydrate Freemius credentials from the database:`,e)}}async function p(){let{secret:t,public:n}=await o(),r=a(n.freemius),i=a(n.stripe),s=[];(0,e.resolveConfigValue)(c(t,`stripeSecretKey`),`STRIPE_SECRET_KEY`)||s.push(`Secret key`),(0,e.resolveConfigValue)(typeof i.publishableKey==`string`?i.publishableKey:null,`NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY`)||s.push(`Publishable key`),(0,e.resolveConfigValue)(c(t,`stripeWebhookSecret`),`STRIPE_WEBHOOK_SECRET`)||s.push(`Webhook secret`);let l=[];return(0,e.resolveConfigValue)(typeof r.publicKey==`string`?r.publicKey:null,`FREEMIUS_PUBLIC_KEY`)||l.push(`Public key`),(0,e.resolveConfigValue)(c(t,`freemiusSecretKey`),`FREEMIUS_SECRET_KEY`)||l.push(`Secret key`),{stripe:{hasKeys:s.length===0,missing:s},freemius:{hasKeys:l.length===0,missing:l}}}async function m(){let r=(0,e.createClient)(),[{data:i},{data:o}]=await Promise.all([r.from(`site_settings`).select(`value`).eq(`key`,t).maybeSingle(),r.from(`site_settings`).select(`value`).eq(`key`,n).maybeSingle()]),s=a(i?.value),c=a(o?.value),l=a(c.stripe),u=a(c.freemius),d=e=>typeof e==`string`?e:``;return{stripe:{publishableKey:d(l.publishableKey),hasSecretKey:(0,e.getSecretEnvelopeStatus)(s.stripeSecretKey).hasStoredValue,hasWebhookSecret:(0,e.getSecretEnvelopeStatus)(s.stripeWebhookSecret).hasStoredValue},freemius:{developerId:d(u.developerId),publicKey:d(u.publicKey),productId:d(u.productId),hasSecretKey:(0,e.getSecretEnvelopeStatus)(s.freemiusSecretKey).hasStoredValue,hasApiKey:(0,e.getSecretEnvelopeStatus)(s.freemiusApiKey).hasStoredValue},envFallbackActive:!(s.stripeSecretKey||!process.env.STRIPE_SECRET_KEY)}}async function h(r){let i=(0,e.createClient)(),o={stripe:{publishableKey:r.stripe.publishableKey.trim()},freemius:{developerId:r.freemius.developerId.trim(),publicKey:r.freemius.publicKey.trim(),productId:r.freemius.productId.trim(),sandboxEnabled:!1}},{error:c}=await i.from(`site_settings`).upsert({key:n,value:o});if(c)throw console.error(`Error saving payment_public settings:`,c.message),Error(`Failed to save payment settings.`);let l=[[`stripeSecretKey`,r.stripe.secretKey],[`stripeWebhookSecret`,r.stripe.webhookSecret],[`freemiusSecretKey`,r.freemius.secretKey],[`freemiusApiKey`,r.freemius.apiKey]];if(l.some(([,e])=>e&&e.trim())){if((0,e.isSandboxEnvironment)())throw Error(`The sandbox cannot store live payment credentials.`);let{data:n}=await i.from(`site_settings`).select(`value`).eq(`key`,t).maybeSingle(),r={...a(n?.value)};for(let[t,n]of l)n&&n.trim()&&(r[t]=(0,e.encryptWithEnvKey)(n.trim()));let{error:o}=await i.from(`site_settings`).upsert({key:t,value:r});if(o)throw console.error(`Error saving payment_secret settings:`,o.message),Error(`Failed to save payment credentials.`)}s()}exports.clearPaymentConfigCache=s,exports.getPaymentConfigStatus=p,exports.getPaymentCredentialsView=m,exports.hydrateFreemiusEnvFromDb=f,exports.resolveStripePublishableKey=d,exports.resolveStripeSecretKey=l,exports.resolveStripeWebhookSecret=u,exports.savePaymentCredentials=h;
+const e=require("./server-actions/require-ecom-role.cjs");let t=require("@nextblock-cms/db/server");var n=`payment_secret`,r=`payment_public`,i=6e4,a=null;function o(e){return e&&typeof e==`object`&&!Array.isArray(e)?e:{}}async function s(e=!1){let s=Date.now();if(!e&&a&&s-a.at<i)return{secret:a.secret,public:a.public};let c={},l={};try{let e=(0,t.getServiceRoleSupabaseClient)(),[{data:i},{data:a}]=await Promise.all([e.from(`site_settings`).select(`value`).eq(`key`,n).maybeSingle(),e.from(`site_settings`).select(`value`).eq(`key`,r).maybeSingle()]);c=o(i?.value),l=o(a?.value)}catch{}return a={at:s,secret:c,public:l},{secret:c,public:l}}function c(){a=null}function l(e,n){return(0,t.tryDecryptWithEnvKey)(e[n])}async function u(){let{secret:e}=await s();return(0,t.resolveConfigValue)(l(e,`stripeSecretKey`),`STRIPE_SECRET_KEY`)}async function d(){let{secret:e}=await s();return(0,t.resolveConfigValue)(l(e,`stripeWebhookSecret`),`STRIPE_WEBHOOK_SECRET`)}async function f(){let{public:e}=await s(),n=o(e.stripe).publishableKey;return(0,t.resolveConfigValue)(typeof n==`string`?n:null,`NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY`)}async function p(){try{let{secret:e,public:t}=await s(),n=o(t.freemius),r=(e,t)=>{t&&t.trim()&&(process.env[e]=t.trim())};r(`FREEMIUS_SECRET_KEY`,l(e,`freemiusSecretKey`)),r(`FREEMIUS_API_KEY`,l(e,`freemiusApiKey`)),r(`FREEMIUS_ECOMMERCE_SANDBOX_SECRET_KEY`,l(e,`freemiusSandboxSecretKey`)),r(`FREEMIUS_PUBLIC_KEY`,typeof n.publicKey==`string`?n.publicKey:null),r(`FREEMIUS_PRODUCT_ID`,typeof n.productId==`string`?n.productId:null),r(`FREEMIUS_DEVELOPER_ID`,typeof n.developerId==`string`?n.developerId:null)}catch(e){console.warn(`[payment-config] Could not hydrate Freemius credentials from the database:`,e)}}async function m(){let{secret:e,public:n}=await s(),r=o(n.freemius),i=o(n.stripe),a=[];(0,t.resolveConfigValue)(l(e,`stripeSecretKey`),`STRIPE_SECRET_KEY`)||a.push(`Secret key`),(0,t.resolveConfigValue)(typeof i.publishableKey==`string`?i.publishableKey:null,`NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY`)||a.push(`Publishable key`),(0,t.resolveConfigValue)(l(e,`stripeWebhookSecret`),`STRIPE_WEBHOOK_SECRET`)||a.push(`Webhook secret`);let c=[];return(0,t.resolveConfigValue)(typeof r.publicKey==`string`?r.publicKey:null,`FREEMIUS_PUBLIC_KEY`)||c.push(`Public key`),(0,t.resolveConfigValue)(l(e,`freemiusSecretKey`),`FREEMIUS_SECRET_KEY`)||c.push(`Secret key`),{stripe:{hasKeys:a.length===0,missing:a},freemius:{hasKeys:c.length===0,missing:c}}}async function h(){let i=await e.getEcomActorRole()===`ADMIN`?(0,t.getServiceRoleSupabaseClient)():(0,t.createClient)(),[{data:a},{data:s}]=await Promise.all([i.from(`site_settings`).select(`value`).eq(`key`,n).maybeSingle(),i.from(`site_settings`).select(`value`).eq(`key`,r).maybeSingle()]),c=o(a?.value),l=o(s?.value),u=o(l.stripe),d=o(l.freemius),f=e=>typeof e==`string`?e:``;return{stripe:{publishableKey:f(u.publishableKey),hasSecretKey:(0,t.getSecretEnvelopeStatus)(c.stripeSecretKey).hasStoredValue,hasWebhookSecret:(0,t.getSecretEnvelopeStatus)(c.stripeWebhookSecret).hasStoredValue},freemius:{developerId:f(d.developerId),publicKey:f(d.publicKey),productId:f(d.productId),hasSecretKey:(0,t.getSecretEnvelopeStatus)(c.freemiusSecretKey).hasStoredValue,hasApiKey:(0,t.getSecretEnvelopeStatus)(c.freemiusApiKey).hasStoredValue},envFallbackActive:!(c.stripeSecretKey||!process.env.STRIPE_SECRET_KEY)}}async function g(i){let a=await e.requireEcomAdmin(),s={stripe:{publishableKey:i.stripe.publishableKey.trim()},freemius:{developerId:i.freemius.developerId.trim(),publicKey:i.freemius.publicKey.trim(),productId:i.freemius.productId.trim(),sandboxEnabled:!1}},{error:l}=await a.from(`site_settings`).upsert({key:r,value:s});if(l)throw console.error(`Error saving payment_public settings:`,l.message),Error(`Failed to save payment settings.`);let u=[[`stripeSecretKey`,i.stripe.secretKey],[`stripeWebhookSecret`,i.stripe.webhookSecret],[`freemiusSecretKey`,i.freemius.secretKey],[`freemiusApiKey`,i.freemius.apiKey]];if(u.some(([,e])=>e&&e.trim())){if((0,t.isSandboxEnvironment)())throw Error(`The sandbox cannot store live payment credentials.`);let{data:e}=await a.from(`site_settings`).select(`value`).eq(`key`,n).maybeSingle(),r={...o(e?.value)};for(let[e,n]of u)n&&n.trim()&&(r[e]=(0,t.encryptWithEnvKey)(n.trim()));let{error:i}=await a.from(`site_settings`).upsert({key:n,value:r});if(i)throw console.error(`Error saving payment_secret settings:`,i.message),Error(`Failed to save payment credentials.`)}c()}exports.clearPaymentConfigCache=c,exports.getPaymentConfigStatus=m,exports.getPaymentCredentialsView=h,exports.hydrateFreemiusEnvFromDb=p,exports.resolveStripePublishableKey=f,exports.resolveStripeSecretKey=u,exports.resolveStripeWebhookSecret=d,exports.savePaymentCredentials=g;

package/lib/payment-config.d.ts

@@ -51,7 +51,9 @@ export interface SavePaymentCredentialsInput {
 /**
  * Persist payment credentials. Public fields always overwrite; secret fields are
  * encrypted and only written when a new value is supplied (blank keeps the stored
- * secret). Refuses to store real secrets in the sandbox. Caller enforces ADMIN; RLS
- * double-enforces.
+ * secret). Refuses to store real secrets in the sandbox. Enforces ADMIN itself (throws
+ * otherwise) and writes with the service role: `payment_secret` is in the ADMIN-only write
+ * tier that migration 02023 gates behind `is_admin_mfa()`, which a "remember this device"
+ * (aal1) admin cannot satisfy through the cookie client.
  */
 export declare function savePaymentCredentials(input: SavePaymentCredentialsInput): Promise<void>;