@porulle/core 0.10.8 → 0.13.0

package/src/modules/inventory/service.ts

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { assertPermission } from "../../auth/permissions.js";
 import type { Actor } from "../../auth/types.js";
 import type { CommerceConfig } from "../../config/types.js";
@@ -57,7 +57,7 @@ export class InventoryService {
   ): Promise<string> {
     const orgId =
       orgIdOverride ??
-      resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+      resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const warehouses = await this.repo.findAllWarehouses(orgId, ctx);
     const sorted = warehouses.sort((a, b) => a.priority - b.priority);
     if (sorted.length > 0) {
@@ -90,9 +90,8 @@ export class InventoryService {
       );
     }
 
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
 
@@ -113,9 +112,8 @@ export class InventoryService {
   }
 
   async listWarehouses(actor?: Actor | null, ctx?: TxContext): Promise<Result<Warehouse[]>> {
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     const warehouses = await this.repo.findAllWarehouses(orgId, ctx);
@@ -128,9 +126,8 @@ export class InventoryService {
     ctx?: TxContext,
     actor?: Actor | null,
   ): Promise<Result<number>> {
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     const available = await this.repo.getAvailableQuantity(
@@ -147,9 +144,8 @@ export class InventoryService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<InventoryLevel[]>> {
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     if (params?.entityId) {
@@ -177,9 +173,8 @@ export class InventoryService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<Record<string, number>>> {
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     const data = await this.repo.getAvailableQuantities(orgId, entityIds, ctx);
@@ -191,9 +186,8 @@ export class InventoryService {
     ctx?: TxContext,
     actor?: Actor | null,
   ): Promise<Result<InventoryLevel[]>> {
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     const levels = await this.repo.findLevelsByEntityId(orgId, entityId, ctx);
@@ -213,9 +207,8 @@ export class InventoryService {
       );
     }
 
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     const warehouseId = input.warehouseId ?? (await this.pickWarehouse(actor, ctx));
@@ -267,9 +260,8 @@ export class InventoryService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<void>> {
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     const warehouseId = input.warehouseId ?? (await this.pickWarehouse(actor, ctx));
@@ -360,7 +352,7 @@ export class InventoryService {
     const performedBy = input.performedBy ?? actor?.userId ?? "system";
 
     const doAdjust = async (txCtx: TxContext) => {
-      const orgId = resolveOrgId(actor ?? txCtx.actor ?? null, undefined, this.deps.config);
+      const orgId = resolveOrgIdForCommerce(actor ?? txCtx.actor ?? null, this.deps.config);
 
       // Lock the level first so `before` and the write are atomic.
       const existing = await this.repo.findLevelForUpdate(
@@ -444,6 +436,7 @@ export class InventoryService {
         services: this.deps.services,
         context: { moduleName: "inventory" },
         database: { db: this.deps.database.db as PluginDb },
+        commerceConfig: this.deps.config,
       });
 
       const afterHooks = this.deps.hooks.resolve("inventory.afterAdjust");
@@ -496,9 +489,8 @@ export class InventoryService {
     ctx?: TxContext,
   ): Promise<Result<InventoryLevel>> {
     const warehouseId = input.warehouseId ?? (await this.pickWarehouse(actor, ctx));
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       actor ?? ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
 
@@ -551,7 +543,7 @@ export class InventoryService {
   ): Promise<Result<void>> {
     const orgId =
       input.orgId ??
-      resolveOrgId(ctx?.actor ?? null, undefined, this.deps.config);
+      resolveOrgIdForCommerce(ctx?.actor ?? null, this.deps.config);
     const warehouseId =
       input.warehouseId ?? (await this.pickWarehouse(null, ctx, orgId));
     const variantId = input.variantId ?? null;
@@ -602,9 +594,8 @@ export class InventoryService {
     variantId?: string,
     ctx?: TxContext,
   ): Promise<Result<InventoryLevel>> {
-    const orgId = resolveOrgId(
+    const orgId = resolveOrgIdForCommerce(
       ctx?.actor ?? null,
-      undefined,
       this.deps.config,
     );
     const level = await this.repo.findLevelByKey(

package/src/modules/media/module.ts

@@ -20,6 +20,8 @@ export const mediaModule = defineModule({
       catalogRepository: new CatalogRepository(db),
       storage,
       config: deps.config as CommerceConfig,
+      database: deps.db,
+      services: deps.services,
     });
   },
 });

package/src/modules/media/schema.ts

@@ -1,7 +1,12 @@
-import { index, integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import type { AnyPgColumn } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+import { index, integer, jsonb, numeric, pgEnum, pgTable, text, timestamp, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 import { organization } from "../../auth/auth-schema.js";
 import { sellableEntities, variants } from "../catalog/schema.js";
 
+export const mediaAssetOrigin = pgEnum("media_asset_origin", ["merchant", "generated", "imported"]);
+export type MediaAssetOrigin = (typeof mediaAssetOrigin.enumValues)[number];
+
 export const mediaAssets = pgTable(
   "media_assets",
   {
@@ -17,6 +22,11 @@ export const mediaAssets = pgTable(
     height: integer("height"),
     alt: text("alt"),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}),
+    origin: mediaAssetOrigin("origin").notNull().default("merchant"),
+    confidence: numeric("confidence", { precision: 4, scale: 3 }),
+    derivedFromAssetId: uuid("derived_from_asset_id").references((): AnyPgColumn => mediaAssets.id, {
+      onDelete: "set null",
+    }),
     uploadedAt: timestamp("uploaded_at", { withTimezone: true }).defaultNow().notNull(),
   },
   (table) => ({
@@ -38,4 +48,15 @@ export const entityMedia = pgTable("entity_media", {
     enum: ["primary", "gallery", "thumbnail", "video", "document"],
   }).notNull(),
   sortOrder: integer("sort_order").notNull().default(0),
-});
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+}, (table) => ({
+  // Two partial indexes instead of one NULLS DISTINCT index: Postgres treats
+  // null variant ids as distinct, so a single index cannot reject duplicate
+  // entity-level rows.
+  entityLevelUnique: uniqueIndex("entity_media_entity_level_unique")
+    .on(table.entityId, table.mediaAssetId)
+    .where(sql`${table.variantId} IS NULL`),
+  variantLevelUnique: uniqueIndex("entity_media_variant_level_unique")
+    .on(table.entityId, table.variantId, table.mediaAssetId)
+    .where(sql`${table.variantId} IS NOT NULL`),
+}));

package/src/modules/media/service.ts

@@ -1,16 +1,22 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
+import { assertPermission } from "../../auth/permissions.js";
 import type { Actor } from "../../auth/types.js";
 import type { CommerceConfig } from "../../config/types.js";
 import type { StorageAdapter, StoredFile } from "./adapter.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
 import {
+  CommerceConflictError,
   CommerceNotFoundError,
   CommerceValidationError,
+  toCommerceError,
 } from "../../kernel/errors.js";
-import type { MediaRepository } from "./repository/index.js";
+import type { MediaRepository, MediaAsset } from "./repository/index.js";
 import type { CatalogRepository } from "../catalog/repository/index.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
+import { createTxContext } from "../../kernel/database/tx-context.js";
+import type { DatabaseAdapter } from "../../kernel/database/adapter.js";
 import { makeId } from "../../utils/id.js";
+import type { MediaAssetOrigin } from "./schema.js";
 
 export interface UploadMediaInput {
   filename: string;
@@ -18,6 +24,7 @@ export interface UploadMediaInput {
   data: ArrayBuffer;
   alt?: string;
   metadata?: Record<string, unknown>;
+  origin?: MediaAssetOrigin;
 }
 
 export interface AttachMediaInput {
@@ -43,6 +50,8 @@ interface MediaServiceDeps {
   catalogRepository: CatalogRepository;
   storage: StorageAdapter;
   config: CommerceConfig;
+  database?: DatabaseAdapter;
+  services?: Record<string, unknown>;
 }
 
 const DEFAULT_ALLOWED_MIME_TYPES = [
@@ -53,6 +62,17 @@ const DEFAULT_ALLOWED_MIME_TYPES = [
   "application/pdf",
 ];
 
+export function assertMediaWritable(asset: Pick<MediaAsset, "origin">, actor: Actor | null): void {
+  if (asset.origin === "merchant") assertPermission(actor, "media:write");
+}
+
+function isUniqueViolation(error: unknown): boolean {
+  if (error == null || typeof error !== "object") return false;
+  const value = error as { code?: unknown; cause?: unknown };
+  if (value.code === "23505") return true;
+  return isUniqueViolation(value.cause);
+}
+
 function isSvgOrXml(buffer: Uint8Array): boolean {
   const prefix = new TextDecoder()
     .decode(buffer.slice(0, 256))
@@ -97,6 +117,16 @@ export class MediaService {
     this.catalogRepo = deps.catalogRepository;
   }
 
+  private async withTransaction<T>(
+    actor: Actor | null,
+    ctx: TxContext | undefined,
+    fn: (txCtx: TxContext) => Promise<T>,
+  ): Promise<T> {
+    if (ctx?.tx != null) return fn(ctx);
+    if (this.deps.database == null) throw new Error("Database is required for media mutations.");
+    return this.deps.database.transaction(async (tx) => fn(createTxContext(tx, { actor })));
+  }
+
   async upload(
     input: UploadMediaInput,
     actor?: Actor | null,
@@ -108,7 +138,7 @@ export class MediaService {
       );
     }
 
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const bytes = new Uint8Array(input.data);
     const detectedMime = detectMimeFromBuffer(bytes);
     const allowSvg = this.deps.config.media?.allowSvg === true;
@@ -148,6 +178,7 @@ export class MediaService {
         contentType: effectiveMime,
         size: input.data.byteLength,
         metadata: input.metadata ?? {},
+        origin: input.origin ?? "merchant",
         uploadedAt: new Date(),
         ...(input.alt !== undefined ? { alt: input.alt } : {}),
       },
@@ -172,7 +203,7 @@ export class MediaService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<string>> {
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     const asset = await this.repo.findAssetById(id, ctx, orgId);
     if (!asset) return Err(new CommerceNotFoundError("Media asset not found."));
     return this.deps.storage.getUrl(asset.storageKey);
@@ -184,7 +215,7 @@ export class MediaService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<string>> {
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     const asset = await this.repo.findAssetById(id, ctx, orgId);
     if (!asset) return Err(new CommerceNotFoundError("Media asset not found."));
     return this.deps.storage.getSignedUrl(asset.storageKey, expiresIn);
@@ -195,10 +226,16 @@ export class MediaService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<void>> {
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     const asset = await this.repo.findAssetById(id, ctx, orgId);
     if (!asset) return Err(new CommerceNotFoundError("Media asset not found."));
 
+    try {
+      assertMediaWritable(asset, actor ?? ctx?.actor ?? null);
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
+
     const deleted = await this.deps.storage.delete(asset.storageKey);
     if (!deleted.ok) return deleted;
 
@@ -218,31 +255,55 @@ export class MediaService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<void>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
-    const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
-    if (!entity) {
-      return Err(new CommerceNotFoundError("Entity not found."));
-    }
+    try {
+      return await this.withTransaction(actor ?? ctx?.actor ?? null, ctx, async (txCtx) => {
+        const orgId = resolveOrgIdForCommerce(actor ?? txCtx.actor, this.deps.config);
+        const entity = await this.catalogRepo.findEntityById(input.entityId, txCtx, orgId);
+        if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
 
-    const asset = await this.repo.findAssetById(input.mediaAssetId, ctx, orgId);
-    if (!asset) {
-      return Err(new CommerceNotFoundError("Media asset not found."));
-    }
+        const asset = await this.repo.findAssetById(input.mediaAssetId, txCtx, orgId);
+        if (!asset) return Err(new CommerceNotFoundError("Media asset not found."));
 
-    await this.repo.createEntityMedia(
-      {
-        entityId: input.entityId,
-        mediaAssetId: input.mediaAssetId,
-        role: input.role,
-        sortOrder: input.sortOrder ?? 0,
-        ...(input.variantId !== undefined
-          ? { variantId: input.variantId }
-          : {}),
-      },
-      ctx,
-    );
+        const existing = await this.repo.findEntityMedia(input.entityId, input.variantId, txCtx);
+        if (existing.some((link) => link.mediaAssetId === input.mediaAssetId)) {
+          return Err(new CommerceConflictError("Media asset is already attached at this level."));
+        }
 
-    return Ok(undefined);
+        await this.repo.createEntityMedia(
+          {
+            entityId: input.entityId,
+            mediaAssetId: input.mediaAssetId,
+            role: input.role,
+            sortOrder: input.sortOrder ?? 0,
+            ...(input.variantId !== undefined
+              ? { variantId: input.variantId }
+              : {}),
+          },
+          txCtx,
+        );
+
+        const catalog = this.deps.services?.catalog;
+        if (catalog == null || typeof catalog !== "object") {
+          throw new Error("Catalog service is required for media revision capture.");
+        }
+        const catalogService = catalog as {
+          recordEntityRevision: (
+            entityId: string,
+            actor: Actor | null,
+            reason?: "create" | "update" | "import" | "enrichment" | "push" | "restore",
+            ctx?: TxContext,
+          ) => Promise<Result<unknown>>;
+        };
+        const revision = await catalogService.recordEntityRevision(input.entityId, actor ?? txCtx.actor, "update", txCtx);
+        if (!revision.ok) throw revision.error;
+        return Ok(undefined);
+      });
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        return Err(new CommerceConflictError("Media asset is already attached at this level."));
+      }
+      return Err(toCommerceError(error));
+    }
   }
 
   /**

package/src/modules/orders/guest-access.ts

@@ -0,0 +1,55 @@
+import type { GuestOrderAccessStrategy } from "../../config/types.js";
+
+const UNIT_MS: Record<string, number> = {
+  s: 1_000,
+  m: 60_000,
+  h: 3_600_000,
+  d: 86_400_000,
+};
+
+/**
+ * Parses a window like `"7d"`, `"2h"`, `"30m"`, `"45s"`.
+ * Throws at configuration time rather than silently admitting everything —
+ * a typo in a security window must not read as "no limit".
+ */
+export function parseAccessWindow(duration: string): number {
+  const match = /^(\d+)(s|m|h|d)$/.exec(duration.trim());
+  if (!match) {
+    throw new Error(
+      `Invalid guest order access window "${duration}". Use a whole number followed by s, m, h, or d — for example "7d".`,
+    );
+  }
+  return Number(match[1]) * UNIT_MS[match[2]!]!;
+}
+
+/**
+ * Grants a guest bearer credential access to a placed order for a fixed window
+ * after it was placed.
+ *
+ * Anchored on `placedAt`, never on the cart's expiry: a shopper who checks out
+ * on the sixth day of a seven-day cart would otherwise get one day of receipt
+ * access. The two lifetimes are independent by construction.
+ */
+export function windowedGuestOrderAccess(duration: string): GuestOrderAccessStrategy {
+  const windowMs = parseAccessWindow(duration);
+  return {
+    canAccessOrder(order, now) {
+      const placedAt =
+        order.placedAt instanceof Date ? order.placedAt : new Date(order.placedAt);
+      const elapsed = now.getTime() - placedAt.getTime();
+      return Number.isFinite(elapsed) && elapsed <= windowMs;
+    },
+  };
+}
+
+/**
+ * The default window. Seven days matches `config.cart.ttlMinutes` so the
+ * product carries one number rather than two.
+ *
+ * Deliberately not Vendure's two hours: that figure is calibrated for a
+ * guessable order code, and a cart secret is a 122-bit random UUID. Guessing is
+ * not the exposure here — a secret that leaked through a referrer, a shared
+ * link or a log line is, and a bounded window is what expires it.
+ */
+export const defaultGuestOrderAccess: GuestOrderAccessStrategy =
+  windowedGuestOrderAccess("7d");

package/src/modules/orders/module.ts

@@ -52,6 +52,7 @@ export const ordersModule = defineModule<
     return new OrderService({
       repository: new OrdersRepository(deps.db.db as DrizzleDatabase),
       hooks: deps.hooks,
+      config,
       services: deps.services,
       database: deps.db,
       ...(config.orders?.customTransitions

package/src/modules/orders/quote.ts

@@ -101,6 +101,7 @@ export async function computeOrderPricing(
     context: { moduleName: "orders" },
     origin: "rest",
     database: { db: kernel.database.db as PluginDb },
+    commerceConfig: kernel.config,
   });
   if (tx !== undefined) context.tx = tx as typeof context.tx;
 

package/src/modules/orders/repository/index.ts

@@ -166,6 +166,7 @@ export class OrdersRepository {
   async findByIdempotencyKey(
     orgId: string,
     idempotencyKey: string,
+    idempotencyScope: string,
     ctx?: TxContext,
   ): Promise<Order | undefined> {
     const db = this.getDb(ctx);
@@ -175,6 +176,7 @@ export class OrdersRepository {
       .where(
         and(
           eq(orders.organizationId, orgId),
+          eq(orders.idempotencyScope, idempotencyScope),
           eq(orders.idempotencyKey, idempotencyKey),
         ),
       );

package/src/modules/orders/schema.ts

@@ -21,6 +21,8 @@ export const orders = pgTable("orders", {
   // Client-supplied key making order creation safely retryable (offline POS
   // queues, network retries) — replays return the original order.
   idempotencyKey: text("idempotency_key"),
+  // Hash of the authenticated actor or guest credential that owns the key.
+  idempotencyScope: text("idempotency_scope"),
   metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}),
   placedAt: timestamp("placed_at", { withTimezone: true }).defaultNow().notNull(),
   fulfilledAt: timestamp("fulfilled_at", { withTimezone: true }),
@@ -32,9 +34,9 @@ export const orders = pgTable("orders", {
   customerIdIdx: index("idx_orders_customer_id").on(table.customerId),
   placedAtIdx: index("idx_orders_placed_at").on(table.placedAt),
   paymentIntentIdx: index("idx_orders_payment_intent").on(table.paymentIntentId),
-  orgIdempotencyKeyUnique: uniqueIndex("orders_org_idempotency_key_unique")
-    .on(table.organizationId, table.idempotencyKey)
-    .where(sql`idempotency_key IS NOT NULL`),
+  orgIdempotencyKeyUnique: uniqueIndex("orders_org_idempotency_scope_key_unique")
+    .on(table.organizationId, table.idempotencyScope, table.idempotencyKey)
+    .where(sql`idempotency_scope IS NOT NULL AND idempotency_key IS NOT NULL`),
 }));
 
 export const orderLineItems = pgTable("order_line_items", {