@nuxt-customer-portal/core 0.3.2 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @nuxt-customer-portal/core
 
+## 0.4.0
+
+### Minor Changes
+
+- 59c8921: Support organization and personal clients with optional verified self-registration, single-person access safeguards, and shared provider, client, and user timezone preferences. Preserve existing B2B defaults, module references, invoice history, and Timesheets timezone behavior.
+
+  Collect and store first and last names during signup and personal onboarding. Route ordinary personal registration and verified users without memberships or pending invitations through onboarding.
+
+  Allow users to edit first name, last name, and an independent display name in profile settings.
+
+  Synchronize display-name edits with the linked private client name and current billing name in the same transaction, preserving organizations and historical invoices.
+
+  Let private clients edit their own billing address in profile settings, independently of the active organization, with server-side ownership checks.
+
+  Private clients use their own invoice email without contact persons; hide contact management and reject private-client contact creation or selection server-side.
+
+  Add a B2C-only Invite private client action to the Users page, supporting new and existing private clients with atomic record creation, request retry protection, and pending invitation recovery when email delivery fails.
+
+- 59c8921: Replace the Products-specific API key implementation with organization-owned Better Auth API keys. Restrict key ownership and use to the provider organization, restrict administration to system administrators, and let modules declare the API scopes administrators can assign.
+
+  Move API-key management from Products store settings to a dedicated system Administration page.
+
+- 59c8921: Allow SaaS administrators to configure allowed client types and personal self-registration in Portal Settings. Apply saved preferences to server authorization, onboarding, client forms and navigation, preserving configuration defaults for existing portals. Prevent disabling client types that still have records, including during concurrent creation.
+- 59c8921: Configure supported store content and SaaS interface languages using the shared bundled language list. Preserve disabled translations and switch unavailable UI locales to an enabled language.
+
+### Patch Changes
+
+- 59c8921: Share appointment time formatting across Planning and checkout, respecting browser locale preferences and displaying midnight concisely.
+
+  Present checkout booking details with distinct date, time, and provider rows and a stable live reservation countdown.
+
+- 59c8921: Restore anonymous booking availability and session-bound hold operations through the authentication gate. Preserve endpoint rate limits, origin checks, and reservation credentials.
+- 59c8921: Add the Products store module and product invoice integration: translated digital products and services, secret catalog API keys, Stripe one-time checkout, guest invitations, purchaser-only delivery, exact multi-currency invoices, and refund credit notes. Add narrowly scoped external authentication routes, API documentation contracts, and configurable module activation. Existing stores remain closed until explicitly configured and enabled.
+- 59c8921: Store the sender country as structured invoice data, show it in invoice settings, and preserve it on generated invoices.
+
+## 0.3.3
+
 ## 0.3.2
 
 ### Patch Changes

package/README.md

@@ -30,6 +30,10 @@ const products = usePaginatedResource<Product, ProductFilters>({
 })
 ```
 
+A failed page load never rejects: it resolves with no result and exposes the
+cause on `error`, so a list awaited at the top level of `setup()` still renders.
+Callers check the returned result before using it and render `error` themselves.
+
 Use `useAutoPagination` with a list container and trailing sentinel when the next
 page should load automatically. Conventional pagination controls can use the
 same `pagination` state alongside it.

package/app/components/PortalTimezoneSelect.vue

@@ -0,0 +1,28 @@
+<script setup lang="ts">
+const model = defineModel<string | null>({ default: null })
+const props = withDefaults(defineProps<{ inheritedTimezone?: string; allowInherit?: boolean }>(), {
+  allowInherit: true
+})
+const { t } = useI18n()
+const value = computed({
+  get: () => model.value ?? '__inherit__',
+  set: (value: string) => {
+    model.value = value === '__inherit__' ? null : value
+  }
+})
+const options = computed(() => [
+  ...(props.allowInherit !== false
+    ? [
+        {
+          label: t('timezones.inherit', { timezone: props.inheritedTimezone || 'Europe/Amsterdam' }),
+          value: '__inherit__'
+        }
+      ]
+    : []),
+  ...[...new Set(['UTC', ...Intl.supportedValuesOf('timeZone'), ...(model.value ? [model.value] : [])])]
+    .sort()
+    .map((zone) => ({ label: zone, value: zone }))
+])
+</script>
+
+<template><USelectMenu v-model="value" :items="options" value-key="value" class="w-full" /></template>

package/app/composables/useClientConfiguration.ts

@@ -0,0 +1,8 @@
+export const useClientConfiguration = () => {
+  const runtime = useRuntimeConfig()
+  const settings = useState<{ clients?: { allowedTypes: string[]; personalSelfRegistration: boolean } } | null>(
+    'portal-runtime-settings',
+    () => null
+  )
+  return computed(() => ({ ...runtime.public.clients, ...settings.value?.clients }))
+}

package/app/composables/usePaginatedResource.ts

@@ -95,8 +95,9 @@ export const usePaginatedResource = <Item, Filters extends object>(
       if (sequence !== requestSequence || (cause instanceof Error && cause.name === 'AbortError')) {
         return
       }
+      // Resolve with no result rather than rejecting: callers await this at the top level of
+      // `setup()`, where a rejection aborts the whole route instead of rendering `error`.
       error.value = cause instanceof Error ? cause : new Error('Failed to load data')
-      throw cause
     } finally {
       if (sequence === requestSequence) {
         pending.value = false

package/app/composables/usePortalSession.ts

@@ -4,6 +4,7 @@ export const usePortalSession = () => {
     activeOrganizationId,
     activeOrganizationRole,
     activeOrganizationType,
+    activeOrganizationIsPersonal,
     currentUser,
     isAdmin,
     isAuthenticated
@@ -13,6 +14,7 @@ export const usePortalSession = () => {
     activeOrganizationId: readonly(activeOrganizationId),
     activeOrganizationRole: readonly(activeOrganizationRole),
     activeOrganizationType: readonly(activeOrganizationType),
+    activeOrganizationIsPersonal: readonly(activeOrganizationIsPersonal),
     currentUser: readonly(currentUser),
     isSystemAdmin: readonly(isAdmin),
     isAuthenticated: readonly(isAuthenticated)

package/app/composables/useUserStore.ts

@@ -14,6 +14,7 @@ interface PermissionsResponse {
   organizationRole: string | null
   activeOrganization: Organization | null
   organizationType: 'PROVIDER' | 'CLIENT' | null
+  isPersonalClient: boolean
 }
 
 export const useUserStore = defineStore('user', () => {
@@ -95,6 +96,7 @@ export const useUserStore = defineStore('user', () => {
   const role = ref<string | null>(null)
   const organizationRole = ref<string | null>(null)
   const activeOrganizationFromPermissions = ref<Organization | null>(null)
+  const activeOrganizationIsPersonal = ref(false)
   const isLoading = ref(false)
   const activeOrganization = computed(() => {
     // Prefer the one from permissions API if available, otherwise use organizationsHelper
@@ -201,6 +203,7 @@ export const useUserStore = defineStore('user', () => {
         role.value = data.role
         organizationRole.value = data.organizationRole
         activeOrganizationFromPermissions.value = data.activeOrganization
+        activeOrganizationIsPersonal.value = data.isPersonalClient
       } else {
         console.warn('Permissions API returned no data. Clearing user data as a precaution.')
         clearUserData() // Clear data if API returns nothing, as state is uncertain
@@ -217,6 +220,7 @@ export const useUserStore = defineStore('user', () => {
     role.value = null
     organizationRole.value = null
     activeOrganizationFromPermissions.value = null
+    activeOrganizationIsPersonal.value = false
     currentSession.value = null
     currentUser.value = null
     activeOrganizationRoleValue.value = null
@@ -445,6 +449,7 @@ export const useUserStore = defineStore('user', () => {
     activeOrganization,
     activeOrganizationRole,
     activeOrganizationType,
+    activeOrganizationIsPersonal,
     myOrganizations,
     loadingOrganization,
     refreshOrganizations,

package/app/utils/auth-client.ts

@@ -1,5 +1,5 @@
 import { createAuthClient } from 'better-auth/vue' // Use the Vue-specific import
-import { adminClient, emailOTPClient, organizationClient } from 'better-auth/client/plugins'
+import { adminClient, emailOTPClient, organizationClient, inferAdditionalFields } from 'better-auth/client/plugins'
 import { ac, user, admin as adminRole } from '@nuxt-customer-portal/core/shared/permissions'
 
 const baseURL = process.env.BETTER_AUTH_URL
@@ -7,6 +7,9 @@ const baseURL = process.env.BETTER_AUTH_URL
 export const authClient = createAuthClient({
   baseURL: baseURL,
   plugins: [
+    inferAdditionalFields({
+      user: { firstName: { type: 'string', required: false }, lastName: { type: 'string', required: false } }
+    }),
     adminClient({
       ac,
       roles: {

package/i18n/locales/en.json

@@ -5,9 +5,12 @@
     "edit": "Change invitation role",
     "role": "Role",
     "save": "Save role",
+    "resend": "Resend invitation",
     "revoke": "Revoke invitation",
     "confirmRevoke": "Revoke the invitation for {email}? This invitation link will no longer work.",
     "updated": "Invitation role updated",
+    "resent": "Invitation resent",
+    "resendFailed": "The invitation could not be resent. Try again.",
     "revoked": "Invitation revoked",
     "failed": "Could not change this invitation. Refresh the page and try again."
   },
@@ -15,6 +18,7 @@
     "refresh": "Refresh",
     "cancel": "Cancel",
     "close": "Close",
+    "collapseSidebar": "Collapse sidebar",
     "confirm": "Confirm",
     "create": "Create",
     "createdAt": "Created at",
@@ -22,6 +26,7 @@
     "descending": "Descending",
     "direction": "Direction",
     "edit": "Edit",
+    "expandSidebar": "Expand sidebar",
     "error": "An error occurred",
     "filters": "Filters",
     "loaded": "Loaded",
@@ -77,5 +82,22 @@
     "admin": "Admin",
     "blog": "Blog",
     "contact": "Contact"
+  },
+  "timezones": {
+    "label": "Timezone",
+    "provider": "Business timezone",
+    "preference": "Display timezone",
+    "inherit": "Use default timezone ({timezone})",
+    "invalid": "Choose a valid timezone",
+    "savedPreference": "Your saved timezone stays the same when you travel.",
+    "current": "Currently: {timezone}",
+    "useDevice": "Use device timezone",
+    "save": "Save",
+    "saved": "Timezone saved",
+    "failed": "Could not save timezone",
+    "openPersonalAccount": "Open personal account",
+    "personalAccount": "Personal account",
+    "selectAccount": "Select account",
+    "accountSettings": "Account details"
   }
 }

package/i18n/locales/nl.json

@@ -5,9 +5,12 @@
     "edit": "Rol van uitnodiging wijzigen",
     "role": "Rol",
     "save": "Rol opslaan",
+    "resend": "Uitnodiging opnieuw versturen",
     "revoke": "Uitnodiging intrekken",
     "confirmRevoke": "De uitnodiging voor {email} intrekken? Deze uitnodigingslink werkt daarna niet meer.",
     "updated": "Rol van uitnodiging gewijzigd",
+    "resent": "Uitnodiging opnieuw verstuurd",
+    "resendFailed": "De uitnodiging kon niet opnieuw worden verstuurd. Probeer het opnieuw.",
     "revoked": "Uitnodiging ingetrokken",
     "failed": "Deze uitnodiging kon niet worden gewijzigd. Vernieuw de pagina en probeer opnieuw."
   },
@@ -15,12 +18,14 @@
     "refresh": "Verversen",
     "cancel": "Annuleren",
     "close": "Sluiten",
+    "collapseSidebar": "Zijbalk inklappen",
     "create": "Aanmaken",
     "createdAt": "Aangemaakt op",
     "delete": "Verwijderen",
     "descending": "Aflopend",
     "direction": "Richting",
     "edit": "Bewerken",
+    "expandSidebar": "Zijbalk uitklappen",
     "error": "Er is een fout opgetreden",
     "filters": "Filters",
     "loaded": "Geladen",
@@ -77,5 +82,22 @@
     "admin": "Beheer",
     "blog": "Blog",
     "contact": "Contact"
+  },
+  "timezones": {
+    "label": "Tijdzone",
+    "provider": "Tijdzone van het bedrijf",
+    "preference": "Weergavetijdzone",
+    "inherit": "Standaardtijdzone gebruiken ({timezone})",
+    "invalid": "Kies een geldige tijdzone",
+    "savedPreference": "Je opgeslagen tijdzone blijft hetzelfde wanneer je reist.",
+    "current": "Momenteel: {timezone}",
+    "useDevice": "Tijdzone van apparaat gebruiken",
+    "save": "Opslaan",
+    "saved": "Tijdzone opgeslagen",
+    "failed": "Tijdzone opslaan mislukt",
+    "openPersonalAccount": "Persoonlijk account openen",
+    "personalAccount": "Persoonlijk account",
+    "selectAccount": "Account selecteren",
+    "accountSettings": "Accountgegevens"
   }
 }

package/migrations/0006_timezone_preferences.sql

@@ -0,0 +1,22 @@
+ALTER TABLE "user" ADD COLUMN timezone text;
+CREATE TABLE organization_settings (
+ organization_id text PRIMARY KEY REFERENCES organization(id) ON DELETE CASCADE,
+ timezone text NOT NULL DEFAULT 'Europe/Amsterdam'
+);
+INSERT INTO organization_settings (organization_id) SELECT id FROM organization WHERE organization_type = 'PROVIDER';
+DO $$ BEGIN
+ IF to_regclass('timesheets.workspace_settings') IS NOT NULL THEN
+  EXECUTE 'UPDATE organization_settings s SET timezone = w.timezone FROM timesheets.workspace_settings w WHERE w.organization_id = s.organization_id';
+ END IF;
+END $$;
+
+-- Bootstrap paths can create the provider after migrations have completed.
+CREATE FUNCTION initialize_provider_timezone() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+ IF NEW.organization_type = 'PROVIDER' THEN
+  INSERT INTO organization_settings (organization_id) VALUES (NEW.id) ON CONFLICT DO NOTHING;
+ END IF;
+ RETURN NEW;
+END $$;
+CREATE TRIGGER initialize_provider_timezone AFTER INSERT OR UPDATE OF organization_type ON organization
+ FOR EACH ROW EXECUTE FUNCTION initialize_provider_timezone();

package/migrations/0007_user_names.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "user" ADD COLUMN IF NOT EXISTS first_name text;
+ALTER TABLE "user" ADD COLUMN IF NOT EXISTS last_name text;

package/migrations/0008_better_auth_api_keys.sql

@@ -0,0 +1,27 @@
+CREATE TABLE IF NOT EXISTS "apikey" (
+  "id" text PRIMARY KEY NOT NULL,
+  "config_id" text DEFAULT 'default' NOT NULL,
+  "name" text,
+  "start" text,
+  "reference_id" text NOT NULL REFERENCES "organization"("id") ON DELETE CASCADE,
+  "prefix" text,
+  "key" text NOT NULL,
+  "refill_interval" integer,
+  "refill_amount" integer,
+  "last_refill_at" timestamp,
+  "enabled" boolean DEFAULT true NOT NULL,
+  "rate_limit_enabled" boolean DEFAULT true NOT NULL,
+  "rate_limit_time_window" integer,
+  "rate_limit_max" integer,
+  "request_count" integer DEFAULT 0 NOT NULL,
+  "remaining" integer,
+  "last_request" timestamp,
+  "expires_at" timestamp,
+  "created_at" timestamp DEFAULT now() NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL,
+  "permissions" text,
+  "metadata" text
+);
+CREATE INDEX IF NOT EXISTS "apikey_config_id_idx" ON "apikey" ("config_id");
+CREATE INDEX IF NOT EXISTS "apikey_reference_id_idx" ON "apikey" ("reference_id");
+CREATE UNIQUE INDEX IF NOT EXISTS "apikey_key_uidx" ON "apikey" ("key");

package/nuxt.config.ts

@@ -1,13 +1,24 @@
 import { fileURLToPath } from 'node:url'
+import { socialAuthProviderEnabled } from './shared/social-auth'
 
-const envFlag = (value: string | undefined, fallback = true) => (value === undefined ? fallback : value === 'true')
 const registrationMode = ['open', 'invitation-only', 'disabled'].includes(process.env.PORTAL_REGISTRATION_MODE || '')
   ? (process.env.PORTAL_REGISTRATION_MODE as 'open' | 'invitation-only' | 'disabled')
   : 'open'
+const githubEnabled = socialAuthProviderEnabled(
+  process.env.PORTAL_GITHUB_ENABLED,
+  process.env.GITHUB_CLIENT_ID,
+  process.env.GITHUB_CLIENT_SECRET
+)
+const googleEnabled = socialAuthProviderEnabled(
+  process.env.PORTAL_GOOGLE_ENABLED,
+  process.env.GOOGLE_CLIENT_ID,
+  process.env.GOOGLE_CLIENT_SECRET
+)
 
 export default defineNuxtConfig({
   $meta: { name: 'nuxt-customer-portal-core' },
   compatibilityDate: '2025-10-24',
+  components: [{ path: fileURLToPath(new URL('./app/components', import.meta.url)), global: true }],
   modules: ['@nuxtjs/i18n', '@vueuse/nuxt'],
   i18n: {
     defaultLocale: 'en',
@@ -33,14 +44,14 @@ export default defineNuxtConfig({
     },
     portalAuth: {
       registrationMode,
-      githubEnabled: envFlag(process.env.PORTAL_GITHUB_ENABLED),
-      googleEnabled: envFlag(process.env.PORTAL_GOOGLE_ENABLED)
+      githubEnabled,
+      googleEnabled
     },
     public: {
       portalAuth: {
         registrationMode,
-        githubEnabled: envFlag(process.env.PORTAL_GITHUB_ENABLED),
-        googleEnabled: envFlag(process.env.PORTAL_GOOGLE_ENABLED),
+        githubEnabled,
+        googleEnabled,
         termsUrl: process.env.PORTAL_TERMS_URL || '/'
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt-customer-portal/core",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "license": "MIT",
   "homepage": "https://nuxt-customer-portal.com",
   "repository": {
@@ -37,7 +37,11 @@
     "access": "public"
   },
   "dependencies": {
+    "@better-auth/api-key": "1.6.25",
+    "@better-auth/core": "1.6.25",
+    "@better-auth/utils": "0.4.2",
     "@internationalized/date": "^3.10.0",
+    "@nuxt/ui": "^4.10.0",
     "@nuxtjs/i18n": "^10.6.0",
     "@pinia/nuxt": "^1.0.1",
     "@standard-schema/spec": "^1.1.0",
@@ -45,15 +49,16 @@
     "@vueuse/core": "^14.4.0",
     "@vueuse/nuxt": "^14.4.0",
     "better-auth": "1.6.25",
+    "better-call": "1.3.7",
     "date-fns": "^4.4.0",
     "drizzle-orm": "^0.45.2",
     "h3": "^1.15.4",
+    "marked": "^16.2.1",
     "nanoid": "^5.1.6",
     "pg": "^8.22.0",
     "pinia": "^4.0.2",
     "resend": "^6.18.1",
-    "zod": "^4.4.3",
-    "@nuxt/ui": "^4.10.0"
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "nuxt": "^4.5.1",

package/portal.manifest.mjs

@@ -1,6 +1,6 @@
 export default {
   id: 'core',
-  version: '0.3.2',
+  version: '0.4.0',
   source: '@nuxt-customer-portal/core',
   dependsOn: [],
   schema: './server/db/schema/index.ts',

package/server/api/auth/permissions.get.ts

@@ -2,6 +2,7 @@ import { defineEventHandler, createError } from 'h3'
 import { statement } from '@nuxt-customer-portal/core/shared/permissions'
 import { auth } from '@nuxt-customer-portal/core/server/utils/auth'
 import { getUserPermissions } from '@nuxt-customer-portal/core/server/utils/permissions'
+import { isPersonalClient } from '@nuxt-customer-portal/core/server/utils/client-account-policy'
 
 defineRouteMeta({
   openAPI: {
@@ -59,6 +60,8 @@ export default defineEventHandler(async (event) => {
     role: currentRole,
     organizationRole: orgRole || null,
     activeOrganization: activeOrganization,
-    organizationType: activeOrganization?.organizationType ?? null
+    organizationType: activeOrganization?.organizationType ?? null,
+    isPersonalClient:
+      activeOrganization?.organizationType === 'CLIENT' && (await isPersonalClient(activeOrganization.id))
   }
 })

package/server/api/timezones.get.ts

@@ -0,0 +1,9 @@
+import { requireSession, requireOrganizationContext } from '../portal'
+import { getActiveOrganizationId } from '../../shared/portal-session'
+import { getResolvedTimezones } from '../utils/timezones'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireSession(event)
+  const context = getActiveOrganizationId(session) ? await requireOrganizationContext(session) : null
+  return getResolvedTimezones(session.user.id, context?.organizationType === 'CLIENT' ? context.organizationId : null)
+})

package/server/db/schema/auth-schema.ts

@@ -1,7 +1,7 @@
 // Core authentication and organization schema owned by portal core.
 
 import { sql } from 'drizzle-orm'
-import { pgTable, text, timestamp, boolean, check, index, uniqueIndex, jsonb } from 'drizzle-orm/pg-core'
+import { pgTable, text, timestamp, boolean, check, index, uniqueIndex, jsonb, integer } from 'drizzle-orm/pg-core'
 
 export const user = pgTable(
   'user',
@@ -9,6 +9,9 @@ export const user = pgTable(
     id: text('id').primaryKey(),
     name: text('name').notNull(),
     email: text('email').notNull().unique(),
+    timezone: text('timezone'),
+    firstName: text('first_name'),
+    lastName: text('last_name'),
     emailVerified: boolean('email_verified').default(false).notNull(),
     image: text('image'),
     createdAt: timestamp('created_at').defaultNow().notNull(),
@@ -115,6 +118,13 @@ export const organization = pgTable(
   ]
 )
 
+export const organizationSettings = pgTable('organization_settings', {
+  organizationId: text('organization_id')
+    .primaryKey()
+    .references(() => organization.id, { onDelete: 'cascade' }),
+  timezone: text('timezone').default('Europe/Amsterdam').notNull()
+})
+
 export const member = pgTable(
   'member',
   {
@@ -196,3 +206,38 @@ export const invitation = pgTable(
     index('invitation_email_idx').on(table.email)
   ]
 )
+
+export const apiKey = pgTable(
+  'apikey',
+  {
+    id: text('id').primaryKey(),
+    configId: text('config_id').default('default').notNull(),
+    name: text('name'),
+    start: text('start'),
+    referenceId: text('reference_id')
+      .notNull()
+      .references(() => organization.id, { onDelete: 'cascade' }),
+    prefix: text('prefix'),
+    key: text('key').notNull(),
+    refillInterval: integer('refill_interval'),
+    refillAmount: integer('refill_amount'),
+    lastRefillAt: timestamp('last_refill_at'),
+    enabled: boolean('enabled').default(true).notNull(),
+    rateLimitEnabled: boolean('rate_limit_enabled').default(true).notNull(),
+    rateLimitTimeWindow: integer('rate_limit_time_window'),
+    rateLimitMax: integer('rate_limit_max'),
+    requestCount: integer('request_count').default(0).notNull(),
+    remaining: integer('remaining'),
+    lastRequest: timestamp('last_request'),
+    expiresAt: timestamp('expires_at'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at').defaultNow().notNull(),
+    permissions: text('permissions'),
+    metadata: text('metadata')
+  },
+  (table) => [
+    index('apikey_config_id_idx').on(table.configId),
+    index('apikey_reference_id_idx').on(table.referenceId),
+    uniqueIndex('apikey_key_uidx').on(table.key)
+  ]
+)

package/server/middleware/auth.ts

@@ -1,5 +1,7 @@
 import { defineEventHandler, type H3Event, createError } from 'h3'
 import { auth } from '../utils/auth'
+import { isPublicStoreRoute } from '../utils/public-api-route'
+import { isPublicInvitationRoute } from '../utils/public-invitation-route'
 
 async function isAuthenticated(event: H3Event): Promise<boolean> {
   const session = await auth.api.getSession({
@@ -17,6 +19,14 @@ export default defineEventHandler(async (event) => {
   if (!url || !url.startsWith('/api/')) {
     return
   }
+  // Products routes implement their own catalog-key, signature, or public-entry checks.
+  const pathname = new URL(url, 'http://localhost').pathname
+  if (isPublicStoreRoute(event.method, pathname)) {
+    return
+  }
+  if (isPublicInvitationRoute(event.method, pathname)) {
+    return
+  }
   const unprotectedPaths = [
     '/api/auth/',
     '/api/_nuxt_icon',