@porulle/core 0.10.8 → 0.13.0

package/dist/modules/catalog/entity-service.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { assertPermission } from "../../auth/permissions.js";
 import { CommerceConflictError, CommerceNotFoundError, CommerceValidationError, toCommerceError, } from "../../kernel/errors.js";
 import { mergeHookReports, runAfterHooks, runBeforeHooks, } from "../../kernel/hooks/executor.js";
@@ -6,9 +6,25 @@ import { createHookContext } from "../../kernel/hooks/create-context.js";
 import { Err, Ok } from "../../kernel/result.js";
 import { createLogger } from "../../utils/logger.js";
 import { paginate } from "../../utils/pagination.js";
+import { isWriteContextTransactional } from "../../kernel/database/tx-context.js";
+import { canReadUnpublishedCatalog, isCatalogEntityVisible } from "./read-policy.js";
+import { isValidFieldPath } from "./ownership.js";
 function hookDatabaseArg(database) {
     return { database: { db: database.db } };
 }
+const attributeFields = ["title", "subtitle", "description", "richDescription", "seoTitle", "seoDescription"];
+function catalogHookContext(deps, actor, ctx, operation) {
+    return createHookContext({
+        actor,
+        tx: isWriteContextTransactional(ctx) ? ctx.tx : null,
+        logger: createLogger(`catalog.${operation}`),
+        services: deps.services,
+        ...(deps.services.jobs ? { jobs: deps.services.jobs } : {}),
+        context: { moduleName: "catalog", ...(ctx?.hookContext ?? {}) },
+        ...hookDatabaseArg(deps.database),
+        commerceConfig: deps.config,
+    });
+}
 function cartesian(arrays) {
     return arrays.reduce((acc, values) => acc.flatMap((entry) => values.map((value) => [...entry, value])), [[]]);
 }
@@ -16,6 +32,7 @@ function getCustomFieldValue(field) {
     switch (field.fieldType) {
         case "text":
         case "relation":
+        case "select":
             return field.textValue;
         case "number":
             return field.numberValue;
@@ -31,8 +48,10 @@ function getCustomFieldValue(field) {
 }
 export class EntityService {
     deps;
-    constructor(deps) {
+    resolveEntityFieldDefinitions;
+    constructor(deps, resolveEntityFieldDefinitions) {
         this.deps = deps;
+        this.resolveEntityFieldDefinitions = resolveEntityFieldDefinitions;
     }
     get repo() {
         return this.deps.repository;
@@ -40,7 +59,7 @@ export class EntityService {
     assertSameOrg(resource, actor) {
         if (!resource)
             return;
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         if (resource.organizationId && resource.organizationId !== orgId) {
             throw new CommerceNotFoundError("Entity not found.");
         }
@@ -49,25 +68,42 @@ export class EntityService {
         if (entity.sourceStoreId != null)
             assertPermission(actor, "catalog:sync");
     }
-    async validateAndCreateCustomFields(entityId, entityType, customFields, ctx) {
+    async validateCustomFields(entityType, customFields, actor, ctx) {
         if (!customFields)
-            return Ok(undefined);
+            return Ok([]);
         const entityConfig = this.deps.config.entities?.[entityType];
-        if (!entityConfig)
-            return Ok(undefined);
-        const definitionMap = new Map(entityConfig.fields.map((f) => [f.name, f]));
+        const definitions = await this.resolveEntityFieldDefinitions(entityType, actor ?? ctx?.actor ?? null, ctx);
+        if (!entityConfig && definitions.length === 0)
+            return Ok([]);
+        const definitionMap = new Map(definitions.map((f) => [f.name, f]));
+        const validated = [];
         for (const [name, value] of Object.entries(customFields)) {
             const def = definitionMap.get(name);
             if (!def)
                 return Err(new CommerceValidationError(`Unknown custom field: ${name}`));
+            if (value === null) {
+                validated.push({ fieldName: name, locale: "en", data: null });
+                continue;
+            }
             const type = def.type;
+            let normalized = value;
             let valid = false;
             switch (type) {
                 case "text":
                 case "relation":
-                case "select":
                     valid = typeof value === "string";
                     break;
+                case "select": {
+                    if (typeof value !== "string")
+                        break;
+                    const trimmed = value.trim();
+                    if (def.options && !def.options.includes(trimmed)) {
+                        return Err(new CommerceValidationError(`Value "${trimmed}" is not permitted for field ${name}. Allowed: ${def.options.join(", ")}`));
+                    }
+                    normalized = trimmed;
+                    valid = true;
+                    break;
+                }
                 case "number":
                     valid = typeof value === "number";
                     break;
@@ -85,29 +121,51 @@ export class EntityService {
             }
             if (!valid)
                 return Err(new CommerceValidationError(`Custom field ${name} expected type ${type}.`));
-            const fieldType = (type === "select" ? "text" : type);
-            const insertData = { entityId, fieldName: name, fieldType };
+            const fieldType = type;
+            const insertData = {
+                fieldType,
+                source: "merchant",
+                status: "approved",
+                confidence: null,
+                evidence: null,
+                approvedAt: null,
+                approvedBy: null,
+            };
             switch (fieldType) {
                 case "text":
                 case "relation":
-                    insertData.textValue = value;
+                case "select":
+                    insertData.textValue = normalized;
                     break;
                 case "number":
-                    insertData.numberValue = value;
+                    insertData.numberValue = normalized;
                     break;
                 case "boolean":
-                    insertData.booleanValue = value;
+                    insertData.booleanValue = normalized;
                     break;
                 case "date":
-                    insertData.dateValue = value instanceof Date ? value : new Date(value);
+                    insertData.dateValue = normalized instanceof Date ? normalized : new Date(normalized);
                     break;
                 case "json":
-                    insertData.jsonValue = value;
+                    insertData.jsonValue = normalized;
                     break;
             }
-            await this.repo.createCustomField(insertData, ctx);
+            validated.push({ fieldName: name, locale: "en", data: insertData });
+        }
+        return Ok(validated);
+    }
+    async writeCustomFields(entityId, customFields, ctx, upsert = false) {
+        for (const customField of customFields) {
+            if (customField.data === null) {
+                await this.repo.deleteCustomField(entityId, customField.fieldName, customField.locale, ctx);
+            }
+            else if (upsert) {
+                await this.repo.upsertCustomField(entityId, customField.fieldName, customField.locale, customField.data, ctx);
+            }
+            else {
+                await this.repo.createCustomField({ ...customField.data, entityId, fieldName: customField.fieldName, locale: customField.locale }, ctx);
+            }
         }
-        return Ok(undefined);
     }
     async hydrateEntity(entity, options, ctx) {
         const hydrated = { ...entity };
@@ -138,9 +196,11 @@ export class EntityService {
             hydrated.categories = await this.repo.findEntityCategories(entity.id, ctx);
         if (options?.includeBrands)
             hydrated.brands = await this.repo.findEntityBrands(entity.id, ctx);
+        if (options?.includeCustomFields)
+            hydrated.customFields = await this.repo.findCustomFieldsByEntityId(entity.id, ctx);
         if (options?.includeMedia) {
             const mediaService = this.deps.services.media;
-            const mediaResult = await mediaService?.listEntityMedia?.(entity.id, { orgId: entity.organizationId });
+            const mediaResult = await mediaService?.listEntityMedia?.(entity.id, { orgId: entity.organizationId }, ctx);
             hydrated.media = mediaResult?.ok && mediaResult.value ? mediaResult.value : [];
         }
         if (options?.includePricing) {
@@ -158,23 +218,26 @@ export class EntityService {
     async create(input, actor, ctx) {
         try {
             assertPermission(actor, "catalog:create");
-            const orgId = resolveOrgId(actor);
+            const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
             const existingBySlug = await this.repo.findEntityBySlug(orgId, input.slug, ctx);
             if (existingBySlug)
                 return Err(new CommerceConflictError(`Entity with slug ${input.slug} already exists.`));
             const beforeHooks = this.deps.hooks.resolve("catalog.beforeCreate");
             const afterHooks = this.deps.hooks.resolve("catalog.afterCreate");
-            const context = createHookContext({ actor, tx: ctx?.tx ?? null, logger: createLogger("catalog.create"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
+            const context = createHookContext({ actor, tx: ctx?.tx ?? null, logger: createLogger("catalog.create"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database), commerceConfig: this.deps.config });
             const processedInput = await runBeforeHooks(beforeHooks, input, "create", context);
             if (processedInput.sourceStoreId != null)
                 assertPermission(actor, "catalog:sync");
-            const entity = await this.repo.createEntity({ organizationId: orgId, type: processedInput.type, slug: processedInput.slug, status: "draft", isVisible: false, ...(processedInput.sourceStoreId !== undefined ? { sourceStoreId: processedInput.sourceStoreId } : {}), ...(processedInput.taxClass !== undefined ? { taxClass: processedInput.taxClass } : {}), metadata: processedInput.metadata ?? {} }, ctx);
+            const customFieldsResult = await this.validateCustomFields(processedInput.type, processedInput.customFields, actor, ctx);
+            if (!customFieldsResult.ok)
+                return customFieldsResult;
+            const statuses = ["draft", "active", "archived", "discontinued"];
+            const status = statuses.find((value) => value === processedInput.status) ?? "draft";
+            const entity = await this.repo.createEntity({ organizationId: orgId, type: processedInput.type, slug: processedInput.slug, status, isVisible: status === "active", ...(processedInput.sourceStoreId !== undefined ? { sourceStoreId: processedInput.sourceStoreId } : {}), ...(processedInput.taxClass !== undefined ? { taxClass: processedInput.taxClass } : {}), metadata: processedInput.metadata ?? {} }, ctx);
             if (processedInput.attributes) {
                 await this.repo.createAttribute({ entityId: entity.id, locale: processedInput.attributes.locale ?? "en", title: processedInput.attributes.title, subtitle: processedInput.attributes.subtitle, description: processedInput.attributes.description, richDescription: processedInput.attributes.richDescription, seoTitle: processedInput.attributes.seoTitle, seoDescription: processedInput.attributes.seoDescription }, ctx);
             }
-            const customFieldsResult = await this.validateAndCreateCustomFields(entity.id, entity.type, processedInput.customFields, ctx);
-            if (!customFieldsResult.ok)
-                return customFieldsResult;
+            await this.writeCustomFields(entity.id, customFieldsResult.value, ctx);
             const hookReport = await runAfterHooks(afterHooks, null, entity, "create", context);
             const hydrated = await this.hydrateEntity(entity, undefined, ctx);
             return Ok(hydrated, hookReport.hasErrors ? { hookErrors: hookReport.errors } : undefined);
@@ -185,21 +248,26 @@ export class EntityService {
     }
     async update(id, input, actor, ctx) {
         try {
+            const txCtx = isWriteContextTransactional(ctx) ? ctx : undefined;
             assertPermission(actor, "catalog:update");
-            const existing = await this.repo.findEntityById(id, ctx);
+            const existing = await this.repo.findEntityById(id, txCtx);
             if (!existing)
                 return Err(new CommerceNotFoundError("Entity not found."));
             this.assertSameOrg(existing, actor);
             this.assertEntityWritable(existing, actor);
             const beforeHooks = this.deps.hooks.resolve("catalog.beforeUpdate");
             const afterHooks = this.deps.hooks.resolve("catalog.afterUpdate");
-            const context = createHookContext({ actor, tx: ctx?.tx ?? null, logger: createLogger("catalog.update"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
+            const context = catalogHookContext(this.deps, actor, ctx, "update");
             const processed = await runBeforeHooks(beforeHooks, input, "update", context);
-            const updated = await this.repo.updateEntity(id, { ...(processed.slug !== undefined ? { slug: processed.slug } : {}), ...(processed.status !== undefined ? { status: processed.status } : {}), ...(processed.taxClass !== undefined ? { taxClass: processed.taxClass } : {}), ...(processed.metadata !== undefined ? { metadata: processed.metadata } : {}), ...(processed.isVisible !== undefined ? { isVisible: processed.isVisible } : {}) }, ctx);
+            const customFieldsResult = await this.validateCustomFields(existing.type, processed.customFields, actor, txCtx);
+            if (!customFieldsResult.ok)
+                return customFieldsResult;
+            const updated = await this.repo.updateEntity(id, { ...(processed.slug !== undefined ? { slug: processed.slug } : {}), ...(processed.status !== undefined ? { status: processed.status } : {}), ...(processed.taxClass !== undefined ? { taxClass: processed.taxClass } : {}), ...(processed.metadata !== undefined ? { metadata: processed.metadata } : {}), ...(processed.isVisible !== undefined ? { isVisible: processed.isVisible } : {}) }, txCtx);
             if (!updated)
                 return Err(new CommerceNotFoundError("Entity not found."));
+            await this.writeCustomFields(existing.id, customFieldsResult.value, txCtx, true);
             const hookReport = await runAfterHooks(afterHooks, existing, updated, "update", context);
-            const hydrated = await this.hydrateEntity(updated, undefined, ctx);
+            const hydrated = await this.hydrateEntity(updated, undefined, txCtx);
             return Ok(hydrated, hookReport.hasErrors ? { hookErrors: hookReport.errors } : undefined);
         }
         catch (error) {
@@ -228,25 +296,30 @@ export class EntityService {
         }
     }
     async getById(id, options, actor, ctx) {
-        const context = createHookContext({ actor: actor ?? null, tx: ctx?.tx ?? null, logger: createLogger("catalog.read"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
+        const resolvedActor = actor ?? ctx?.actor ?? null;
+        const orgId = resolveOrgIdForCommerce(resolvedActor, this.deps.config);
+        const context = createHookContext({ actor: resolvedActor, tx: ctx?.tx ?? null, logger: createLogger("catalog.read"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database), commerceConfig: this.deps.config });
         const globalBeforeHooks = this.deps.hooks.resolve("catalog.beforeRead");
         const globalAfterHooks = this.deps.hooks.resolve("catalog.afterRead");
         let processed = await runBeforeHooks(globalBeforeHooks, { id, ...(options !== undefined ? { options } : {}) }, "read", context);
-        let entity = await this.repo.findEntityById(processed.id ?? id, ctx);
+        let entity = await this.repo.findEntityById(processed.id ?? id, ctx, orgId);
         if (!entity)
             return Err(new CommerceNotFoundError("Entity not found."));
+        if (!isCatalogEntityVisible(entity, resolvedActor))
+            return Err(new CommerceNotFoundError("Entity not found."));
         const entityBeforeHooks = this.deps.hooks.resolve(`catalog.${entity.type}.beforeRead`);
         if (entityBeforeHooks.length > 0) {
             processed = await runBeforeHooks(entityBeforeHooks, { ...processed, id: entity.id }, "read", context);
             const resolvedId = processed.id ?? entity.id;
             if (resolvedId !== entity.id) {
-                const refetched = await this.repo.findEntityById(resolvedId, ctx);
+                const refetched = await this.repo.findEntityById(resolvedId, ctx, orgId);
                 if (!refetched)
                     return Err(new CommerceNotFoundError("Entity not found."));
+                if (!isCatalogEntityVisible(refetched, resolvedActor))
+                    return Err(new CommerceNotFoundError("Entity not found."));
                 entity = refetched;
             }
         }
-        const resolvedActor = actor ?? ctx?.actor ?? null;
         try {
             this.assertSameOrg(entity, resolvedActor);
         }
@@ -258,25 +331,41 @@ export class EntityService {
         const report = mergeHookReports(await runAfterHooks(globalAfterHooks, null, result, "read", context), await runAfterHooks(entityAfterHooks, null, result, "read", context));
         return Ok(result, report.hasErrors ? { hookErrors: report.errors } : undefined);
     }
+    /**
+     * Reads an entity for a trusted server pipeline after the request boundary
+     * has already authorized the caller. Organization scope is explicit; the
+     * storefront visibility policy is intentionally not applied, so an internal
+     * invariant check never depends on the caller's catalog permissions.
+     */
+    async getByIdForInternalUse(id, organizationId, options, ctx) {
+        const entity = await this.repo.findEntityById(id, ctx, organizationId);
+        if (!entity)
+            return Err(new CommerceNotFoundError("Entity not found."));
+        return Ok(await this.hydrateEntity(entity, options, ctx));
+    }
     async getBySlug(slug, options, actor, ctx) {
-        const context = createHookContext({ actor: actor ?? null, tx: ctx?.tx ?? null, logger: createLogger("catalog.read"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
+        const context = createHookContext({ actor: actor ?? null, tx: ctx?.tx ?? null, logger: createLogger("catalog.read"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database), commerceConfig: this.deps.config });
         const globalBeforeHooks = this.deps.hooks.resolve("catalog.beforeRead");
         const globalAfterHooks = this.deps.hooks.resolve("catalog.afterRead");
         let processed = await runBeforeHooks(globalBeforeHooks, { slug, ...(options !== undefined ? { options } : {}) }, "read", context);
         let resolvedSlug = processed.slug ?? slug;
-        const orgId = resolveOrgId(actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
         let entity = await this.repo.findEntityBySlug(orgId, resolvedSlug, ctx);
         if (!entity)
             return Err(new CommerceNotFoundError("Entity not found."));
+        if (!isCatalogEntityVisible(entity, actor ?? null))
+            return Err(new CommerceNotFoundError("Entity not found."));
         const entityBeforeHooks = this.deps.hooks.resolve(`catalog.${entity.type}.beforeRead`);
         if (entityBeforeHooks.length > 0) {
             processed = await runBeforeHooks(entityBeforeHooks, { ...processed, id: entity.id }, "read", context);
             const nextId = processed.id ?? entity.id;
             const nextSlug = processed.slug ?? resolvedSlug;
             if (nextId !== entity.id) {
-                const refetched = await this.repo.findEntityById(nextId, ctx);
+                const refetched = await this.repo.findEntityById(nextId, ctx, orgId);
                 if (!refetched)
                     return Err(new CommerceNotFoundError("Entity not found."));
+                if (!isCatalogEntityVisible(refetched, actor ?? null))
+                    return Err(new CommerceNotFoundError("Entity not found."));
                 entity = refetched;
                 resolvedSlug = nextSlug;
             }
@@ -284,6 +373,8 @@ export class EntityService {
                 const refetched = await this.repo.findEntityBySlug(orgId, nextSlug, ctx);
                 if (!refetched)
                     return Err(new CommerceNotFoundError("Entity not found."));
+                if (!isCatalogEntityVisible(refetched, actor ?? null))
+                    return Err(new CommerceNotFoundError("Entity not found."));
                 entity = refetched;
             }
         }
@@ -294,7 +385,7 @@ export class EntityService {
     }
     async list(params, actor, ctx) {
         const resolvedActor = actor ?? ctx?.actor ?? null;
-        const context = createHookContext({ actor: resolvedActor, tx: ctx?.tx ?? null, logger: createLogger("catalog.list"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
+        const context = createHookContext({ actor: resolvedActor, tx: ctx?.tx ?? null, logger: createLogger("catalog.list"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database), commerceConfig: this.deps.config });
         const globalBeforeHooks = this.deps.hooks.resolve("catalog.beforeList");
         const globalAfterHooks = this.deps.hooks.resolve("catalog.afterList");
         let processed = await runBeforeHooks(globalBeforeHooks, params, "list", context);
@@ -304,14 +395,20 @@ export class EntityService {
             if (entityBeforeHooks.length > 0)
                 processed = await runBeforeHooks(entityBeforeHooks, processed, "list", context);
         }
-        const listOrgId = resolveOrgId(resolvedActor);
-        let entities = await this.repo.findEntities(listOrgId, { ...(processed.filter?.type ? { type: processed.filter.type } : {}), ...(processed.filter?.status ? { status: processed.filter.status } : {}) }, ctx);
+        const listOrgId = resolveOrgIdForCommerce(resolvedActor, this.deps.config);
+        const canReadUnpublished = canReadUnpublishedCatalog(resolvedActor);
+        let entities = await this.repo.findEntities(listOrgId, {
+            ...(processed.filter?.type ? { type: processed.filter.type } : {}),
+            ...(canReadUnpublished
+                ? (processed.filter?.status ? { status: processed.filter.status } : {})
+                : { status: "active", isVisible: true }),
+        }, ctx);
+        const isUUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
         if (processed.filter?.category) {
             const catInput = processed.filter.category;
-            const isUUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
             let category = await this.repo.findCategoryBySlug(listOrgId, catInput, ctx);
             if (!category && isUUID.test(catInput))
-                category = await this.repo.findCategoryById(catInput, ctx);
+                category = await this.repo.findCategoryById(catInput, ctx, listOrgId);
             if (!category)
                 return Err(new CommerceValidationError(`Category not found: "${catInput}".`));
             const entityIds = await this.repo.findEntitiesByCategory(category.id, ctx);
@@ -319,8 +416,9 @@ export class EntityService {
         }
         if (processed.filter?.brand) {
             let brand = await this.repo.findBrandBySlug(listOrgId, processed.filter.brand, ctx);
-            if (!brand)
-                brand = await this.repo.findBrandById(processed.filter.brand, ctx);
+            if (!brand && isUUID.test(processed.filter.brand)) {
+                brand = await this.repo.findBrandById(processed.filter.brand, ctx, listOrgId);
+            }
             if (brand) {
                 const brandEntityIds = [];
                 for (const entity of entities) {
@@ -403,7 +501,8 @@ export class EntityService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const entity = await this.repo.findEntityById(entityId, ctx);
+        const txCtx = isWriteContextTransactional(ctx) ? ctx : undefined;
+        const entity = await this.repo.findEntityById(entityId, txCtx);
         if (!entity)
             return Err(new CommerceNotFoundError("Entity not found."));
         try {
@@ -412,14 +511,44 @@ export class EntityService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        await this.repo.upsertAttribute(entityId, locale, { title: attrs.title, subtitle: attrs.subtitle, description: attrs.description, richDescription: attrs.richDescription, seoTitle: attrs.seoTitle, seoDescription: attrs.seoDescription }, ctx);
+        const beforeAttr = await this.repo.findAttributeByLocale(entityId, locale, txCtx);
+        const changedFieldPaths = [];
+        for (const field of attributeFields) {
+            if (attrs[field] === undefined)
+                continue;
+            const before = beforeAttr?.[field] ?? null;
+            const after = attrs[field] ?? null;
+            if (before !== after) {
+                const path = `attributes.${locale}.${field}`;
+                if (isValidFieldPath(path))
+                    changedFieldPaths.push(path);
+            }
+        }
+        await this.repo.upsertAttribute(entityId, locale, { title: attrs.title, subtitle: attrs.subtitle, description: attrs.description, richDescription: attrs.richDescription, seoTitle: attrs.seoTitle, seoDescription: attrs.seoDescription }, txCtx);
+        if (changedFieldPaths.length > 0) {
+            const afterHooks = this.deps.hooks.resolve("catalog.afterUpdate");
+            const context = catalogHookContext(this.deps, actor, ctx, "update");
+            context.context.changedFieldPaths = changedFieldPaths;
+            await runAfterHooks(afterHooks, entity, entity, "update", context);
+        }
         return Ok(undefined);
     }
-    async getAttributes(entityId, locale, ctx) {
-        const attr = await this.repo.findAttributeByLocale(entityId, locale, ctx);
-        if (!attr)
-            return Err(new CommerceNotFoundError(`Attributes for locale ${locale} not found.`));
-        return Ok(attr);
+    async getAttributes(entityId, locale, actor, ctx) {
+        try {
+            assertPermission(actor, "catalog:read");
+            const entity = await this.repo.findEntityById(entityId, ctx, resolveOrgIdForCommerce(actor, this.deps.config));
+            if (!entity)
+                return Err(new CommerceNotFoundError("Entity not found."));
+            if (!isCatalogEntityVisible(entity, actor))
+                return Err(new CommerceNotFoundError("Entity not found."));
+            const attr = await this.repo.findAttributeByLocale(entity.id, locale, ctx);
+            if (!attr)
+                return Err(new CommerceNotFoundError(`Attributes for locale ${locale} not found.`));
+            return Ok(attr);
+        }
+        catch (error) {
+            return Err(toCommerceError(error));
+        }
     }
     async createOptionType(input, actor, ctx) {
         assertPermission(actor, "catalog:update");
@@ -479,7 +608,7 @@ export class EntityService {
                 return Err(new CommerceValidationError(`Option value "${optVal}" does not exist for option type "${optName}".`));
             optionValueIds.push(ov.id);
         }
-        const variant = await this.repo.createVariant({ entityId: input.entityId, status: "active", sortOrder: 0, metadata: {}, ...(input.sku !== undefined ? { sku: input.sku } : {}), ...(input.taxClass !== undefined ? { taxClass: input.taxClass } : {}) }, ctx);
+        const variant = await this.repo.createVariant({ entityId: input.entityId, status: "active", sortOrder: 0, metadata: {}, ...(input.sku !== undefined ? { sku: input.sku } : {}), ...(input.barcode !== undefined ? { barcode: input.barcode } : {}), ...(input.taxClass !== undefined ? { taxClass: input.taxClass } : {}) }, ctx);
         await this.repo.createVariantOptionValues(optionValueIds.map((optionValueId) => ({ variantId: variant.id, optionValueId })), ctx);
         return Ok(variant);
     }

package/dist/modules/catalog/module.d.ts

@@ -1,5 +1,5 @@
 import type { PricingService } from "../pricing/service.js";
-import { brands, categories, entityBrands, entityCategories, optionTypes, optionValues, sellableAttributes, sellableCustomFields, sellableEntities, variantOptionValues, variants } from "./schema.js";
+import { brands, categories, tags, entityTags, entityBrands, entityCategories, optionTypes, optionValues, sellableAttributes, sellableCustomFields, entityFieldDefinitions, sellableEntityRevisions, sellableEntities, variantOptionValues, variants, catalogFieldOwnership } from "./schema.js";
 import { CatalogServiceImpl } from "./service.js";
 type CatalogModuleDeps = {
     pricing: PricingService;
@@ -8,14 +8,19 @@ export declare const catalogModule: import("../../kernel/module/define.js").AppM
     sellableEntities: typeof sellableEntities;
     sellableAttributes: typeof sellableAttributes;
     sellableCustomFields: typeof sellableCustomFields;
+    entityFieldDefinitions: typeof entityFieldDefinitions;
+    sellableEntityRevisions: typeof sellableEntityRevisions;
     categories: typeof categories;
     entityCategories: typeof entityCategories;
     brands: typeof brands;
     entityBrands: typeof entityBrands;
+    tags: typeof tags;
+    entityTags: typeof entityTags;
     optionTypes: typeof optionTypes;
     optionValues: typeof optionValues;
     variants: typeof variants;
     variantOptionValues: typeof variantOptionValues;
+    catalogFieldOwnership: typeof catalogFieldOwnership;
 }, CatalogServiceImpl, CatalogModuleDeps>;
 export {};
 //# sourceMappingURL=module.d.ts.map

package/dist/modules/catalog/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/catalog/module.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EACL,MAAM,EACN,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,QAAQ,EACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,cAAc,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,aAAa;sBAEJ,OAAO,gBAAgB;wBACrB,OAAO,kBAAkB;0BACvB,OAAO,oBAAoB;gBACrC,OAAO,UAAU;sBACX,OAAO,gBAAgB;YACjC,OAAO,MAAM;kBACP,OAAO,YAAY;iBACpB,OAAO,WAAW;kBACjB,OAAO,YAAY;cACvB,OAAO,QAAQ;yBACJ,OAAO,mBAAmB;yCA4BjD,CAAC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/catalog/module.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EACL,MAAM,EACN,UAAU,EACV,IAAI,EACJ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,cAAc,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,aAAa;sBAEJ,OAAO,gBAAgB;wBACrB,OAAO,kBAAkB;0BACvB,OAAO,oBAAoB;4BACzB,OAAO,sBAAsB;6BAC5B,OAAO,uBAAuB;gBAC3C,OAAO,UAAU;sBACX,OAAO,gBAAgB;YACjC,OAAO,MAAM;kBACP,OAAO,YAAY;UAC3B,OAAO,IAAI;gBACL,OAAO,UAAU;iBAChB,OAAO,WAAW;kBACjB,OAAO,YAAY;cACvB,OAAO,QAAQ;yBACJ,OAAO,mBAAmB;2BACxB,OAAO,qBAAqB;yCAiCrD,CAAC"}

package/dist/modules/catalog/module.js

@@ -1,6 +1,6 @@
 import { defineModule } from "../../kernel/module/index.js";
 import { CatalogRepository } from "./repository/index.js";
-import { brands, categories, entityBrands, entityCategories, optionTypes, optionValues, sellableAttributes, sellableCustomFields, sellableEntities, variantOptionValues, variants, } from "./schema.js";
+import { brands, categories, tags, entityTags, entityBrands, entityCategories, optionTypes, optionValues, sellableAttributes, sellableCustomFields, entityFieldDefinitions, sellableEntityRevisions, sellableEntities, variantOptionValues, variants, catalogFieldOwnership, } from "./schema.js";
 import { CatalogServiceImpl } from "./service.js";
 export const catalogModule = defineModule({
     id: "catalog",
@@ -9,14 +9,19 @@ export const catalogModule = defineModule({
         sellableEntities,
         sellableAttributes,
         sellableCustomFields,
+        entityFieldDefinitions,
+        sellableEntityRevisions,
         categories,
         entityCategories,
         brands,
         entityBrands,
+        tags,
+        entityTags,
         optionTypes,
         optionValues,
         variants,
         variantOptionValues,
+        catalogFieldOwnership,
     }),
     service: (deps) => new CatalogServiceImpl({
         repository: new CatalogRepository(deps.db.db),

package/dist/modules/catalog/ownership.d.ts

@@ -0,0 +1,5 @@
+export type FieldPath = string;
+export type FieldOwner = "platform" | "store" | "shared";
+export declare function isValidFieldPath(value: string): value is FieldPath;
+export declare function validateFieldPath(value: string): FieldPath;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/modules/catalog/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../../src/modules/catalog/ownership.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAC/B,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAIzD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,SAAS,CAElE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAK1D"}

package/dist/modules/catalog/ownership.js

@@ -0,0 +1,11 @@
+import { CommerceValidationError } from "../../kernel/errors.js";
+const fieldPathPattern = /^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/;
+export function isValidFieldPath(value) {
+    return fieldPathPattern.test(value);
+}
+export function validateFieldPath(value) {
+    if (!isValidFieldPath(value)) {
+        throw new CommerceValidationError("Field path must contain dot-separated alphanumeric, underscore, or hyphen segments.");
+    }
+    return value;
+}

package/dist/modules/catalog/read-policy.d.ts

@@ -0,0 +1,9 @@
+import type { Actor } from "../../auth/types.js";
+type CatalogVisibility = {
+    status: string;
+    isVisible: boolean;
+};
+export declare function canReadUnpublishedCatalog(actor: Actor | null): boolean;
+export declare function isCatalogEntityVisible(entity: CatalogVisibility, actor: Actor | null): boolean;
+export {};
+//# sourceMappingURL=read-policy.d.ts.map

package/dist/modules/catalog/read-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-policy.d.ts","sourceRoot":"","sources":["../../../src/modules/catalog/read-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,KAAK,iBAAiB,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,OAAO,CAEtE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,OAAO,CAG9F"}

package/dist/modules/catalog/read-policy.js

@@ -0,0 +1,8 @@
+import { hasPermission } from "../../auth/permissions.js";
+export function canReadUnpublishedCatalog(actor) {
+    return hasPermission(actor, "catalog:read:unpublished");
+}
+export function isCatalogEntityVisible(entity, actor) {
+    return canReadUnpublishedCatalog(actor) ||
+        (entity.status === "active" && entity.isVisible);
+}