@open-mercato/checkout 0.6.4-develop.4210.1.d412061cfe → 0.6.4-develop.4236.1.9fa6806b34

package/dist/modules/checkout/acl.js

@@ -1,10 +1,35 @@
 const features = [
   { id: "checkout.view", title: "View checkout links and transactions", module: "checkout" },
-  { id: "checkout.create", title: "Create checkout links and templates", module: "checkout" },
-  { id: "checkout.edit", title: "Edit checkout links and templates", module: "checkout" },
-  { id: "checkout.delete", title: "Delete checkout links and templates", module: "checkout" },
-  { id: "checkout.viewPii", title: "View checkout customer PII", module: "checkout" },
-  { id: "checkout.export", title: "Export checkout transactions", module: "checkout" }
+  {
+    id: "checkout.create",
+    title: "Create checkout links and templates",
+    module: "checkout",
+    dependsOn: ["checkout.view", "sales.orders.view", "customers.people.view"]
+  },
+  {
+    id: "checkout.edit",
+    title: "Edit checkout links and templates",
+    module: "checkout",
+    dependsOn: ["checkout.view"]
+  },
+  {
+    id: "checkout.delete",
+    title: "Delete checkout links and templates",
+    module: "checkout",
+    dependsOn: ["checkout.view"]
+  },
+  {
+    id: "checkout.viewPii",
+    title: "View checkout customer PII",
+    module: "checkout",
+    dependsOn: ["checkout.view", "customers.people.view"]
+  },
+  {
+    id: "checkout.export",
+    title: "Export checkout transactions",
+    module: "checkout",
+    dependsOn: ["checkout.view"]
+  }
 ];
 var acl_default = features;
 export {

package/dist/modules/checkout/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/checkout/acl.ts"],
-  "sourcesContent": ["export const features = [\n  { id: 'checkout.view', title: 'View checkout links and transactions', module: 'checkout' },\n  { id: 'checkout.create', title: 'Create checkout links and templates', module: 'checkout' },\n  { id: 'checkout.edit', title: 'Edit checkout links and templates', module: 'checkout' },\n  { id: 'checkout.delete', title: 'Delete checkout links and templates', module: 'checkout' },\n  { id: 'checkout.viewPii', title: 'View checkout customer PII', module: 'checkout' },\n  { id: 'checkout.export', title: 'Export checkout transactions', module: 'checkout' },\n]\n\nexport default features\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,iBAAiB,OAAO,wCAAwC,QAAQ,WAAW;AAAA,EACzF,EAAE,IAAI,mBAAmB,OAAO,uCAAuC,QAAQ,WAAW;AAAA,EAC1F,EAAE,IAAI,iBAAiB,OAAO,qCAAqC,QAAQ,WAAW;AAAA,EACtF,EAAE,IAAI,mBAAmB,OAAO,uCAAuC,QAAQ,WAAW;AAAA,EAC1F,EAAE,IAAI,oBAAoB,OAAO,8BAA8B,QAAQ,WAAW;AAAA,EAClF,EAAE,IAAI,mBAAmB,OAAO,gCAAgC,QAAQ,WAAW;AACrF;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["export const features = [\n  { id: 'checkout.view', title: 'View checkout links and transactions', module: 'checkout' },\n  {\n    id: 'checkout.create',\n    title: 'Create checkout links and templates',\n    module: 'checkout',\n    dependsOn: ['checkout.view', 'sales.orders.view', 'customers.people.view'],\n  },\n  {\n    id: 'checkout.edit',\n    title: 'Edit checkout links and templates',\n    module: 'checkout',\n    dependsOn: ['checkout.view'],\n  },\n  {\n    id: 'checkout.delete',\n    title: 'Delete checkout links and templates',\n    module: 'checkout',\n    dependsOn: ['checkout.view'],\n  },\n  {\n    id: 'checkout.viewPii',\n    title: 'View checkout customer PII',\n    module: 'checkout',\n    dependsOn: ['checkout.view', 'customers.people.view'],\n  },\n  {\n    id: 'checkout.export',\n    title: 'Export checkout transactions',\n    module: 'checkout',\n    dependsOn: ['checkout.view'],\n  },\n]\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,iBAAiB,OAAO,wCAAwC,QAAQ,WAAW;AAAA,EACzF;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,iBAAiB,qBAAqB,uBAAuB;AAAA,EAC3E;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,eAAe;AAAA,EAC7B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,eAAe;AAAA,EAC7B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,iBAAiB,uBAAuB;AAAA,EACtD;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,eAAe;AAAA,EAC7B;AACF;AAEA,IAAO,cAAQ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/checkout",
-  "version": "0.6.4-develop.4210.1.d412061cfe",
+  "version": "0.6.4-develop.4236.1.9fa6806b34",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -61,18 +61,18 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.6.4-develop.4210.1.d412061cfe",
-    "@open-mercato/ui": "0.6.4-develop.4210.1.d412061cfe",
+    "@open-mercato/core": "0.6.4-develop.4236.1.9fa6806b34",
+    "@open-mercato/ui": "0.6.4-develop.4236.1.9fa6806b34",
     "bcryptjs": "^3.0.3"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^7.0.14",
-    "@open-mercato/shared": "0.6.4-develop.4210.1.d412061cfe",
+    "@open-mercato/shared": "0.6.4-develop.4236.1.9fa6806b34",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.4-develop.4210.1.d412061cfe",
+    "@open-mercato/shared": "0.6.4-develop.4236.1.9fa6806b34",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.15",
     "@types/react-dom": "^19.2.3",

package/src/modules/checkout/__tests__/acl-dependencies.test.ts

@@ -0,0 +1,61 @@
+/** @jest-environment node */
+
+import { describe, test, expect } from '@jest/globals'
+import {
+  resolveAclDependencyDiagnostics,
+  type FeatureDescriptor,
+} from '@open-mercato/shared/security/aclDependencies'
+import { features as checkoutFeatures } from '../acl'
+import { features as salesFeatures } from '@open-mercato/core/modules/sales/acl'
+import { features as customersFeatures } from '@open-mercato/core/modules/customers/acl'
+
+// The checkout dependency table (spec §6.30) references features from the
+// sales and customers modules, so the catalog the resolver checks against must
+// include them or those cross-module ids would surface as unknown references.
+const combinedCatalog: FeatureDescriptor[] = [
+  ...(checkoutFeatures as FeatureDescriptor[]),
+  ...(salesFeatures as FeatureDescriptor[]),
+  ...(customersFeatures as FeatureDescriptor[]),
+]
+
+const checkoutFeatureIds = (checkoutFeatures as FeatureDescriptor[]).map((feature) => feature.id)
+
+describe('checkout ACL dependency declarations', () => {
+  test('every checkout dependency resolves to a known feature (no unknown references)', () => {
+    const diagnostics = resolveAclDependencyDiagnostics(
+      combinedCatalog.map((feature) => feature.id),
+      combinedCatalog,
+    )
+    const checkoutUnknown = diagnostics.unknownReferences.filter((entry) =>
+      entry.feature.startsWith('checkout.'),
+    )
+    expect(checkoutUnknown).toEqual([])
+  })
+
+  test('write features depend on checkout.view', () => {
+    const byId = new Map(
+      (checkoutFeatures as FeatureDescriptor[]).map((feature) => [feature.id, feature]),
+    )
+    for (const id of ['checkout.create', 'checkout.edit', 'checkout.delete', 'checkout.viewPii', 'checkout.export']) {
+      expect(byId.get(id)?.dependsOn).toContain('checkout.view')
+    }
+  })
+
+  test('granting checkout.create alone surfaces the cross-module read dependencies', () => {
+    const diagnostics = resolveAclDependencyDiagnostics(['checkout.create'], combinedCatalog)
+    const createEntry = diagnostics.missingDependencies.find(
+      (entry) => entry.feature === 'checkout.create',
+    )
+    expect(createEntry).toBeDefined()
+    expect([...(createEntry?.missing ?? [])].sort()).toEqual(
+      ['checkout.view', 'customers.people.view', 'sales.orders.view'].sort(),
+    )
+  })
+
+  test('checkout.viewPii depends on the customers people read feature', () => {
+    const viewPii = (checkoutFeatures as FeatureDescriptor[]).find(
+      (feature) => feature.id === 'checkout.viewPii',
+    )
+    expect(viewPii?.dependsOn).toContain('customers.people.view')
+  })
+})

package/src/modules/checkout/acl.ts

@@ -1,10 +1,35 @@
 export const features = [
   { id: 'checkout.view', title: 'View checkout links and transactions', module: 'checkout' },
-  { id: 'checkout.create', title: 'Create checkout links and templates', module: 'checkout' },
-  { id: 'checkout.edit', title: 'Edit checkout links and templates', module: 'checkout' },
-  { id: 'checkout.delete', title: 'Delete checkout links and templates', module: 'checkout' },
-  { id: 'checkout.viewPii', title: 'View checkout customer PII', module: 'checkout' },
-  { id: 'checkout.export', title: 'Export checkout transactions', module: 'checkout' },
+  {
+    id: 'checkout.create',
+    title: 'Create checkout links and templates',
+    module: 'checkout',
+    dependsOn: ['checkout.view', 'sales.orders.view', 'customers.people.view'],
+  },
+  {
+    id: 'checkout.edit',
+    title: 'Edit checkout links and templates',
+    module: 'checkout',
+    dependsOn: ['checkout.view'],
+  },
+  {
+    id: 'checkout.delete',
+    title: 'Delete checkout links and templates',
+    module: 'checkout',
+    dependsOn: ['checkout.view'],
+  },
+  {
+    id: 'checkout.viewPii',
+    title: 'View checkout customer PII',
+    module: 'checkout',
+    dependsOn: ['checkout.view', 'customers.people.view'],
+  },
+  {
+    id: 'checkout.export',
+    title: 'Export checkout transactions',
+    module: 'checkout',
+    dependsOn: ['checkout.view'],
+  },
 ]
 
 export default features