@porulle/core 0.10.8 → 0.13.0

package/src/modules/shipping/service.ts

@@ -1,5 +1,5 @@
 import type { CommerceConfig } from "../../config/types.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
@@ -147,7 +147,7 @@ export class ShippingService {
     if (input.countries.length === 0) {
       return Err(new CommerceValidationError("A shipping zone requires at least one country (\"*\" matches any)."));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const zone = await this.deps.repository.createZone(
       {
         organizationId: orgId,
@@ -163,7 +163,7 @@ export class ShippingService {
   }
 
   async listZones(actor?: Actor | null, ctx?: TxContext): Promise<Result<ShippingZone[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     return Ok(await this.deps.repository.findZones(orgId, ctx));
   }
 
@@ -179,7 +179,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingZone>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findZoneById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping zone not found."));
     const updated = await this.deps.repository.updateZone(
@@ -201,7 +201,7 @@ export class ShippingService {
   }
 
   async deleteZone(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<{ deleted: true }>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findZoneById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping zone not found."));
     await this.deps.repository.deleteZone(id, ctx);
@@ -224,7 +224,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingRate>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const zone = await this.deps.repository.findZoneById(orgId, input.zoneId, ctx);
     if (!zone) return Err(new CommerceNotFoundError("Shipping zone not found."));
     const rate = await this.deps.repository.createRate(
@@ -251,7 +251,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingRate[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     return Ok(
       await this.deps.repository.findRates(
         orgId,
@@ -277,7 +277,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingRate>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findRateById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping rate not found."));
     const updated = await this.deps.repository.updateRate(
@@ -301,7 +301,7 @@ export class ShippingService {
   }
 
   async deleteRate(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<{ deleted: true }>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findRateById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping rate not found."));
     await this.deps.repository.deleteRate(id, ctx);

package/src/modules/tax/module.ts

@@ -16,5 +16,6 @@ export const taxModule = defineModule<
     new TaxService({
       adapter: (deps.config as CommerceConfig).tax?.adapter,
       repository: new TaxRatesRepository(deps.db.db as DrizzleDatabase),
+      config: deps.config as CommerceConfig,
     }),
 });

package/src/modules/tax/service.ts

@@ -1,5 +1,6 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
@@ -15,15 +16,18 @@ import type { TaxClass, TaxRate, TaxRatesRepository } from "./repository/index.j
 interface TaxServiceDeps {
   adapter: TaxAdapter | undefined;
   repository?: TaxRatesRepository;
+  config: CommerceConfig;
 }
 
 export class TaxService {
   private adapter: TaxAdapter | undefined;
   private repository: TaxRatesRepository | undefined;
+  private config: CommerceConfig;
 
   constructor(deps: TaxServiceDeps) {
     this.adapter = deps.adapter;
     this.repository = deps.repository;
+    this.config = deps.config;
   }
 
   /**
@@ -176,7 +180,7 @@ export class TaxService {
     if (input.rateBps < 0) {
       return Err(new CommerceValidationError("rateBps must be non-negative."));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     if (input.isDefault) await repo.value.clearDefaultClass(orgId, ctx);
     const created = await repo.value.createClass(
       {
@@ -194,7 +198,7 @@ export class TaxService {
   async listTaxClasses(actor?: Actor | null, ctx?: TxContext): Promise<Result<TaxClass[]>> {
     const repo = this.requireRepository();
     if (!repo.ok) return repo;
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     return Ok(await repo.value.findAllClasses(orgId, ctx));
   }
 
@@ -206,7 +210,7 @@ export class TaxService {
   ): Promise<Result<TaxClass>> {
     const repo = this.requireRepository();
     if (!repo.ok) return repo;
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     const existing = await repo.value.findClassById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Tax class not found."));
     if (patch.isDefault) await repo.value.clearDefaultClass(orgId, ctx);
@@ -226,7 +230,7 @@ export class TaxService {
   async deleteTaxClass(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<{ deleted: true }>> {
     const repo = this.requireRepository();
     if (!repo.ok) return repo;
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     const existing = await repo.value.findClassById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Tax class not found."));
     await repo.value.deleteClass(id, ctx);
@@ -297,7 +301,7 @@ export class TaxService {
     if (input.rateBps < 0) {
       return Err(new CommerceValidationError("rateBps must be non-negative."));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     const rate = await repo.value.create(
       {
         organizationId: orgId,
@@ -317,7 +321,7 @@ export class TaxService {
   async listTaxRates(actor?: Actor | null, ctx?: TxContext): Promise<Result<TaxRate[]>> {
     const repo = this.requireRepository();
     if (!repo.ok) return repo;
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     return Ok(await repo.value.findAll(orgId, ctx));
   }
 
@@ -337,7 +341,7 @@ export class TaxService {
   ): Promise<Result<TaxRate>> {
     const repo = this.requireRepository();
     if (!repo.ok) return repo;
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     const existing = await repo.value.findById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Tax rate not found."));
     const updated = await repo.value.update(
@@ -361,7 +365,7 @@ export class TaxService {
   async deleteTaxRate(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<{ deleted: true }>> {
     const repo = this.requireRepository();
     if (!repo.ok) return repo;
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     const existing = await repo.value.findById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Tax rate not found."));
     await repo.value.delete(id, ctx);

package/src/modules/webhooks/hook.ts

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { AfterHook } from "../../kernel/hooks/types.js";
 
 /**
@@ -20,7 +20,7 @@ export const deliverWebhooks: AfterHook<unknown> = async ({ result, operation, c
   // VAPT r2 (codex) finding: fan-out queried ALL endpoints across the
   // database, so Tenant B's webhooks fired on Tenant A's events —
   // payload-level cross-tenant data leak. Now scoped to the actor's org.
-  const orgId = resolveOrgId(context.actor);
+  const orgId = resolveOrgIdForCommerce(context.actor, context.commerceConfig);
 
   const endpoints = await webhooksService.getEndpointsForEvent(eventName, orgId);
   if (!endpoints.ok) return;

package/src/modules/webhooks/module.ts

@@ -1,3 +1,4 @@
+import type { CommerceConfig } from "../../config/types.js";
 import { defineModule } from "../../kernel/module/index.js";
 import type { DrizzleDatabase } from "../../kernel/database/drizzle-db.js";
 import { WebhooksRepository } from "./repository/index.js";
@@ -18,5 +19,6 @@ export const webhooksModule = defineModule({
   service: (deps) =>
     new WebhookService({
       repository: new WebhooksRepository(deps.db.db as DrizzleDatabase),
+      config: deps.config as CommerceConfig,
     }),
 });

package/src/modules/webhooks/service.ts

@@ -1,5 +1,6 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
@@ -49,6 +50,7 @@ function isPrivateUrl(urlStr: string): boolean {
 
 interface WebhookServiceDeps {
   repository: WebhooksRepository;
+  config: CommerceConfig;
 }
 
 export class WebhookService {
@@ -76,7 +78,7 @@ export class WebhookService {
       );
     }
 
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
 
     const endpoint = await this.repo.createEndpoint(
       {
@@ -96,7 +98,7 @@ export class WebhookService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<WebhookEndpoint[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const endpoints = await this.repo.findAllEndpoints(orgId, ctx);
     return Ok(endpoints);
   }
@@ -106,7 +108,7 @@ export class WebhookService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<void>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.repo.findEndpointById(id, orgId, ctx);
     if (!existing) {
       return Err(new CommerceNotFoundError("Webhook endpoint not found."));

package/src/runtime/server.ts

@@ -11,6 +11,8 @@ import type { Actor } from "../auth/types.js";
 import type { AuthInstance } from "../auth/setup.js";
 import type { CommerceConfig } from "../config/types.js";
 import { authMiddleware } from "../auth/middleware.js";
+import { organizationGuard } from "../auth/organization-guard.js";
+import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
 import { CommerceCsrfError } from "../kernel/errors.js";
 import { createRestRoutes } from "../interfaces/rest/index.js";
 import { createCustomerPortalRoutes } from "../interfaces/rest/customer-portal.js";
@@ -20,6 +22,8 @@ import { createLogger, type Logger } from "./logger.js";
 import { createCommerce, type CommerceInstance } from "./commerce.js";
 import { rewriteCommerceAliasRequest } from "./url-alias-rewrite.js";
 import { mapErrorToResponse } from "../kernel/error-mapper.js";
+import { assertRouteCoverage } from "../interfaces/rest/route-coverage.js";
+import { markRoutePermissionGuard } from "../interfaces/rest/utils.js";
 
 type ServerEnv = {
   Variables: {
@@ -320,6 +324,14 @@ export async function createServer(config: CommerceConfig) {
   }
 
   // ─── Auth ──────────────────────────────────────────────────────────
+  // Better Auth's organization endpoints are mounted below but governed here:
+  // `admin/staff.ts` owns membership, and this guard keeps the plugin's own
+  // paths from minting members outside those rules.
+  app.use(
+    "/api/auth/organization/*",
+    organizationGuard(kernel.database.db as DrizzleDatabase, config),
+  );
+
   app.use("/api/auth/*", async (c, next) => {
     if (c.req.path.startsWith("/api/auth/pos/")) {
       await next();
@@ -433,7 +445,7 @@ export async function createServer(config: CommerceConfig) {
   // Strategy 1: Built-in cron endpoint for serverless deployments.
   // Point Vercel Cron or Cloudflare Cron Trigger at GET /api/jobs/run
   // Optional query params: ?queue=emails&limit=20
-  app.get("/api/jobs/run", async (c) => {
+  app.get("/api/jobs/run", markRoutePermissionGuard(async (c) => {
     // Always require admin — cron triggers must authenticate
     const actor = c.get("actor") as { permissions?: string[] } | null;
     if (!actor?.permissions?.includes("*:*")) {
@@ -450,7 +462,7 @@ export async function createServer(config: CommerceConfig) {
       logger.error({ err }, "Job runner endpoint failed");
       return c.json({ error: { code: "INTERNAL_ERROR", message: "Job processing failed" } }, 500);
     }
-  });
+  }));
 
   // Strategy 2: In-process polling for long-running servers (ECS, Cloud Run, Docker).
   // Enable via config.jobs.autorun.enabled = true
@@ -488,6 +500,8 @@ export async function createServer(config: CommerceConfig) {
     }
   }
 
+  assertRouteCoverage(app);
+
   const dispatchFetch = app.fetch.bind(app);
   app.fetch = ((input: RequestInfo | URL, env?: unknown, executionCtx?: unknown) => {
     const req = input instanceof Request ? input : new Request(input);

package/src/test-utils/create-pglite-adapter.ts

@@ -82,20 +82,42 @@ export async function createPGliteTestAdapter(): Promise<{
   /**
    * PGlite-compatible transaction wrapper.
    *
-   * Drizzle's transaction() method can hang with PGlite due to how
-   * the adapter manages transaction state. This implementation uses
-   * manual BEGIN/COMMIT control which works more reliably.
+   * Drizzle's transaction() method can hang with PGlite due to how the adapter
+   * manages transaction state, so this drives BEGIN/COMMIT manually.
+   *
+   * PGlite is a single connection, so two transaction bodies awaiting
+   * concurrently would otherwise interleave their statements between one
+   * BEGIN and one COMMIT — the second BEGIN is a no-op Postgres only warns
+   * about. Merged that way, two callers share a snapshot and hold each other's
+   * row locks, so an isolation bug reads as if the guard failed. Bodies are
+   * queued instead, which is what a connection pool would do to two
+   * transactions competing for the same rows.
+   *
+   * A nested call joins the transaction already open rather than deadlocking
+   * on the queue; without savepoints that is the only sound reading.
    */
+  let transactionQueue: Promise<unknown> = Promise.resolve();
+  let inTransaction = false;
+
   async function transaction<T>(fn: (tx: unknown) => Promise<T>): Promise<T> {
-    await pg.exec("BEGIN");
-    try {
-      const result = await fn(db);
-      await pg.exec("COMMIT");
-      return result;
-    } catch (error) {
-      await pg.exec("ROLLBACK");
-      throw error;
-    }
+    if (inTransaction) return fn(db);
+
+    const run = transactionQueue.then(async () => {
+      inTransaction = true;
+      await pg.exec("BEGIN");
+      try {
+        const result = await fn(db);
+        await pg.exec("COMMIT");
+        return result;
+      } catch (error) {
+        await pg.exec("ROLLBACK");
+        throw error;
+      } finally {
+        inTransaction = false;
+      }
+    });
+    transactionQueue = run.catch(() => undefined);
+    return run as Promise<T>;
   }
 
   const adapter: DatabaseAdapter = {

package/src/test-utils/create-test-config.ts

@@ -78,11 +78,13 @@ export async function createTestConfig(
             "catalog:update",
             "catalog:delete",
             "catalog:read",
+            "catalog:read:unpublished",
             "inventory:adjust",
             "orders:create",
             "orders:read",
             "orders:update",
             "orders:manage",
+            "orders:create:on-behalf",
             "cart:create",
             "cart:update",
             "customers:update:self",
@@ -91,14 +93,16 @@ export async function createTestConfig(
         ai_agent: {
           permissions: [
             "catalog:read",
+            "catalog:read:unpublished",
             "catalog:create",
             "inventory:read",
-          "inventory:adjust",
-          "orders:read",
-          "cart:create",
-          "cart:update",
-        ],
-      },
+            "inventory:adjust",
+            "orders:read",
+            "orders:create:on-behalf",
+            "cart:create",
+            "cart:update",
+          ],
+        },
       },
       customerPermissions: [
         "catalog:read",

package/src/test-utils/rest-api-test-utils.ts

@@ -158,9 +158,11 @@ export const testActor: Actor = {
     "catalog:create",
     "catalog:update",
     "catalog:read",
+    "catalog:read:unpublished",
     "inventory:adjust",
     "inventory:read",
     "orders:create",
+    "orders:create:on-behalf",
     "orders:read",
     "orders:update",
     "orders:manage",

package/src/test-utils/test-actors.ts

@@ -31,8 +31,8 @@ export const testStaffActor: Actor = {
   organizationId: TEST_ORG_ID,
   role: "staff",
   permissions: [
-    "catalog:read", "catalog:create", "catalog:update",
-    "inventory:adjust", "orders:read", "orders:create", "orders:update", "orders:manage",
+    "catalog:read", "catalog:read:unpublished", "catalog:create", "catalog:update",
+    "inventory:adjust", "orders:read", "orders:create", "orders:create:on-behalf", "orders:update", "orders:manage",
   ],
 };
 

package/src/utils/id.ts

@@ -1,3 +1,5 @@
+import type { Actor } from "../auth/types.js";
+
 export function makeId(): string {
   return crypto.randomUUID();
 }
@@ -12,3 +14,21 @@ export async function makeDeterministicId(value: string): Promise<string> {
   const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
+
+export async function makeIdempotencyScope(
+  actor: Actor | null | undefined,
+  guestCredential?: string,
+  fallbackBinding?: string,
+): Promise<string> {
+  const binding = actor?.userId
+    ? `actor:${actor.type}:${actor.userId}`
+    : guestCredential
+      ? `guest:${guestCredential}`
+      : fallbackBinding
+        ? `resource:${fallbackBinding}`
+        : "anonymous";
+  const digest = new Uint8Array(
+    await crypto.subtle.digest("SHA-256", new TextEncoder().encode(binding)),
+  );
+  return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}