@porulle/core 0.11.0 → 0.14.0

package/dist/modules/webhooks/service.d.ts

@@ -1,9 +1,11 @@
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import { type Result } from "../../kernel/result.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import type { WebhooksRepository, WebhookEndpoint } from "./repository/index.js";
 interface WebhookServiceDeps {
     repository: WebhooksRepository;
+    config: CommerceConfig;
 }
 export declare class WebhookService {
     private deps;

package/dist/modules/webhooks/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4CjF,UAAU,kBAAkB;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAEtB,IAAI,EAAE,kBAAkB;IAItC,cAAc,CAClB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAyB7B,aAAa,CACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAM/B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAWlB,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;CAItC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4CjF,UAAU,kBAAkB;IAC1B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAEtB,IAAI,EAAE,kBAAkB;IAItC,cAAc,CAClB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAyB7B,aAAa,CACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAM/B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAWlB,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;CAItC"}

package/dist/modules/webhooks/service.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok } from "../../kernel/result.js";
 /**
@@ -62,7 +62,7 @@ export class WebhookService {
         if (isPrivateUrl(input.url)) {
             return Err(new CommerceValidationError("Webhook URL must not point to a private or internal address."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const endpoint = await this.repo.createEndpoint({
             organizationId: orgId,
             url: input.url,
@@ -74,12 +74,12 @@ export class WebhookService {
         return Ok(endpoint);
     }
     async listEndpoints(actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const endpoints = await this.repo.findAllEndpoints(orgId, ctx);
         return Ok(endpoints);
     }
     async deleteEndpoint(id, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existing = await this.repo.findEndpointById(id, orgId, ctx);
         if (!existing) {
             return Err(new CommerceNotFoundError("Webhook endpoint not found."));

package/dist/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAyVxB,MAAM,UAAU,MAAM;GA2FtD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AASzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAOtE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAwWxB,MAAM,UAAU,MAAM;GA8GtD"}

package/dist/runtime/server.js

@@ -7,12 +7,16 @@ import { rateLimiter } from "hono-rate-limiter";
 import { createHash } from "node:crypto";
 import { createClientIpResolver } from "./client-ip.js";
 import { authMiddleware } from "../auth/middleware.js";
+import { organizationGuard } from "../auth/organization-guard.js";
 import { CommerceCsrfError } from "../kernel/errors.js";
 import { createRestRoutes } from "../interfaces/rest/index.js";
 import { createCustomerPortalRoutes } from "../interfaces/rest/customer-portal.js";
 import { createCommerce } from "./commerce.js";
 import { rewriteCommerceAliasRequest } from "./url-alias-rewrite.js";
 import { mapErrorToResponse } from "../kernel/error-mapper.js";
+import { assertRouteCoverage } from "../interfaces/rest/route-coverage.js";
+import { markRoutePermissionGuard } from "../interfaces/rest/utils.js";
+import { isStrictOrgResolution } from "../auth/strict-org-resolution.js";
 /**
  * Returns true if running in a Node-like runtime that supports
  * `process.on()` + `process.exit()`. Edge runtimes (Cloudflare Workers,
@@ -209,10 +213,16 @@ export async function createServer(config) {
     const signInEmailRateKeyCache = new WeakMap();
     const getClientIp = createClientIpResolver(config);
     const keyGenerator = getClientIp;
+    app.use("/api/auth/get-session", rateLimiter({
+        windowMs: 60 * 1000,
+        limit: config.rateLimits?.session ?? 120,
+        keyGenerator,
+    }));
     app.use("/api/auth/*", rateLimiter({
         windowMs: 60 * 1000,
         limit: config.rateLimits?.auth ?? 10,
         keyGenerator,
+        skip: (c) => c.req.path === "/api/auth/get-session",
     }));
     app.use("/api/auth/sign-in/email", async (c, next) => {
         if (c.req.method !== "POST") {
@@ -265,6 +275,10 @@ export async function createServer(config) {
         }
     }
     // ─── Auth ──────────────────────────────────────────────────────────
+    // Better Auth's organization endpoints are mounted below but governed here:
+    // `admin/staff.ts` owns membership, and this guard keeps the plugin's own
+    // paths from minting members outside those rules.
+    app.use("/api/auth/organization/*", organizationGuard(kernel.database.db, config));
     app.use("/api/auth/*", async (c, next) => {
         if (c.req.path.startsWith("/api/auth/pos/")) {
             await next();
@@ -367,7 +381,7 @@ export async function createServer(config) {
     // Strategy 1: Built-in cron endpoint for serverless deployments.
     // Point Vercel Cron or Cloudflare Cron Trigger at GET /api/jobs/run
     // Optional query params: ?queue=emails&limit=20
-    app.get("/api/jobs/run", async (c) => {
+    app.get("/api/jobs/run", markRoutePermissionGuard(async (c) => {
         // Always require admin — cron triggers must authenticate
         const actor = c.get("actor");
         if (!actor?.permissions?.includes("*:*")) {
@@ -383,7 +397,7 @@ export async function createServer(config) {
             logger.error({ err }, "Job runner endpoint failed");
             return c.json({ error: { code: "INTERNAL_ERROR", message: "Job processing failed" } }, 500);
         }
-    });
+    }));
     // Strategy 2: In-process polling for long-running servers (ECS, Cloud Run, Docker).
     // Enable via config.jobs.autorun.enabled = true
     if (config.jobs?.autorun?.enabled) {
@@ -413,6 +427,18 @@ export async function createServer(config) {
                 "or set config.jobs.autorun.enabled = true for in-process polling.");
         }
     }
+    const defaultOrganizationId = config.auth?.defaultOrganizationId;
+    const hasDefaultOrganization = typeof defaultOrganizationId === "string" && defaultOrganizationId.trim().length > 0;
+    if (isStrictOrgResolution(config) &&
+        !hasDefaultOrganization &&
+        !config.auth?.storeResolver) {
+        throw new Error("Cannot resolve an organization for a request with no actor. Set " +
+            "auth.defaultOrganizationId for a single-tenant deployment, or " +
+            "auth.storeResolver for a multi-tenant one. To keep the previous " +
+            "permissive behaviour during a migration, set " +
+            "auth.strictOrgResolution: false (or STRICT_ORG_RESOLUTION=false).");
+    }
+    assertRouteCoverage(app);
     const dispatchFetch = app.fetch.bind(app);
     app.fetch = ((input, env, executionCtx) => {
         const req = input instanceof Request ? input : new Request(input);

package/dist/test-utils/create-pglite-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CA+DD"}
+{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqFD"}

package/dist/test-utils/create-pglite-adapter.js

@@ -62,21 +62,43 @@ export async function createPGliteTestAdapter() {
     /**
      * PGlite-compatible transaction wrapper.
      *
-     * Drizzle's transaction() method can hang with PGlite due to how
-     * the adapter manages transaction state. This implementation uses
-     * manual BEGIN/COMMIT control which works more reliably.
+     * Drizzle's transaction() method can hang with PGlite due to how the adapter
+     * manages transaction state, so this drives BEGIN/COMMIT manually.
+     *
+     * PGlite is a single connection, so two transaction bodies awaiting
+     * concurrently would otherwise interleave their statements between one
+     * BEGIN and one COMMIT — the second BEGIN is a no-op Postgres only warns
+     * about. Merged that way, two callers share a snapshot and hold each other's
+     * row locks, so an isolation bug reads as if the guard failed. Bodies are
+     * queued instead, which is what a connection pool would do to two
+     * transactions competing for the same rows.
+     *
+     * A nested call joins the transaction already open rather than deadlocking
+     * on the queue; without savepoints that is the only sound reading.
      */
+    let transactionQueue = Promise.resolve();
+    let inTransaction = false;
     async function transaction(fn) {
-        await pg.exec("BEGIN");
-        try {
-            const result = await fn(db);
-            await pg.exec("COMMIT");
-            return result;
-        }
-        catch (error) {
-            await pg.exec("ROLLBACK");
-            throw error;
-        }
+        if (inTransaction)
+            return fn(db);
+        const run = transactionQueue.then(async () => {
+            inTransaction = true;
+            await pg.exec("BEGIN");
+            try {
+                const result = await fn(db);
+                await pg.exec("COMMIT");
+                return result;
+            }
+            catch (error) {
+                await pg.exec("ROLLBACK");
+                throw error;
+            }
+            finally {
+                inTransaction = false;
+            }
+        });
+        transactionQueue = run.catch(() => undefined);
+        return run;
     }
     const adapter = {
         provider: "postgresql",

package/dist/test-utils/create-test-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAiHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}
+{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}

package/dist/test-utils/create-test-config.js

@@ -67,11 +67,13 @@ export async function createTestConfig(overrides = {}) {
                         "catalog:update",
                         "catalog:delete",
                         "catalog:read",
+                        "catalog:read:unpublished",
                         "inventory:adjust",
                         "orders:create",
                         "orders:read",
                         "orders:update",
                         "orders:manage",
+                        "orders:create:on-behalf",
                         "cart:create",
                         "cart:update",
                         "customers:update:self",
@@ -80,10 +82,12 @@ export async function createTestConfig(overrides = {}) {
                 ai_agent: {
                     permissions: [
                         "catalog:read",
+                        "catalog:read:unpublished",
                         "catalog:create",
                         "inventory:read",
                         "inventory:adjust",
                         "orders:read",
+                        "orders:create:on-behalf",
                         "cart:create",
                         "cart:update",
                     ],

package/dist/test-utils/rest-api-test-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAoCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}
+{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAsCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}

package/dist/test-utils/rest-api-test-utils.js

@@ -125,9 +125,11 @@ export const testActor = {
         "catalog:create",
         "catalog:update",
         "catalog:read",
+        "catalog:read:unpublished",
         "inventory:adjust",
         "inventory:read",
         "orders:create",
+        "orders:create:on-behalf",
         "orders:read",
         "orders:update",
         "orders:manage",

package/dist/test-utils/test-actors.js

@@ -27,8 +27,8 @@ export const testStaffActor = {
     organizationId: TEST_ORG_ID,
     role: "staff",
     permissions: [
-        "catalog:read", "catalog:create", "catalog:update",
-        "inventory:adjust", "orders:read", "orders:create", "orders:update", "orders:manage",
+        "catalog:read", "catalog:read:unpublished", "catalog:create", "catalog:update",
+        "inventory:adjust", "orders:read", "orders:create", "orders:create:on-behalf", "orders:update", "orders:manage",
     ],
 };
 /** Customer with minimal read/write-own permissions. */

package/dist/utils/id.d.ts

@@ -1,3 +1,5 @@
+import type { Actor } from "../auth/types.js";
 export declare function makeId(): string;
 export declare function makeDeterministicId(value: string): Promise<string>;
+export declare function makeIdempotencyScope(actor: Actor | null | undefined, guestCredential?: string, fallbackBinding?: string): Promise<string>;
 //# sourceMappingURL=id.d.ts.map

package/dist/utils/id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE"}
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,eAAe,CAAC,EAAE,MAAM,EACxB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/dist/utils/id.js

@@ -9,3 +9,14 @@ export async function makeDeterministicId(value) {
     const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
+export async function makeIdempotencyScope(actor, guestCredential, fallbackBinding) {
+    const binding = actor?.userId
+        ? `actor:${actor.type}:${actor.userId}`
+        : guestCredential
+            ? `guest:${guestCredential}`
+            : fallbackBinding
+                ? `resource:${fallbackBinding}`
+                : "anonymous";
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(binding)));
+    return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.11.0",
+  "version": "0.14.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -36,11 +36,11 @@
     }
   },
   "dependencies": {
-    "@better-auth/api-key": "^1.3.8",
-    "@better-auth/drizzle-adapter": "^1.3.8",
+    "@better-auth/api-key": "^1.7.1",
+    "@better-auth/drizzle-adapter": "^1.7.1",
     "@hono/zod-openapi": "^1.2.2",
     "@scalar/hono-api-reference": "^0.10.5",
-    "better-auth": "^1.3.8",
+    "better-auth": "^1.7.1",
     "drizzle-orm": "^0.45.1",
     "drizzle-zod": "^0.8.3",
     "hono": "^4.9.8",
@@ -81,7 +81,8 @@
   "scripts": {
     "generate:plugins": "node ./scripts/generate-plugin-types.mjs",
     "check:store-guard": "node ./scripts/check-store-guard.mjs",
-    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run generate:plugins && npm run check:store-guard && tsc -p tsconfig.build.json",
+    "check:auth-schema": "vitest run test/auth-schema-better-auth-parity.test.ts",
+    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run generate:plugins && npm run check:store-guard && npm run check:auth-schema && tsc -p tsconfig.build.json",
     "check-types": "npm run generate:plugins && npm run check:store-guard && tsc --noEmit",
     "lint": "eslint . --max-warnings 1000",
     "test": "vitest run"

package/src/auth/actor.ts

@@ -0,0 +1,110 @@
+import type { AuthSessionLike, CommerceConfig } from "../config/types.js";
+import type { Actor } from "./types.js";
+import type { AuthInstance } from "./setup.js";
+import { DEFAULT_ORG_ID } from "./org.js";
+
+export const AUTH_COOKIE_PREFIX = "uc";
+export const SESSION_COOKIE_NAME = `${AUTH_COOKIE_PREFIX}.session_token`;
+
+export const DEFAULT_CUSTOMER_PERMISSIONS = [
+  "catalog:read",
+  "cart:create",
+  "cart:read",
+  "cart:update",
+  "orders:create",
+  "orders:read:own",
+  "customers:read:self",
+  "customers:update:self",
+] as const;
+
+export function getCustomerPermissions(config: CommerceConfig): string[] {
+  return config.auth?.customerPermissions ?? [...DEFAULT_CUSTOMER_PERMISSIONS];
+}
+
+function resolvePermissions(
+  session: AuthSessionLike,
+  config: CommerceConfig,
+): string[] {
+  const role = session.session.activeOrganizationRole;
+  if (!role) return getCustomerPermissions(config);
+  const roleConfig = config.auth?.roles?.[role];
+  return roleConfig ? roleConfig.permissions : [];
+}
+
+/** Resolve a better-auth session and its porulle organization permissions. */
+export async function resolveActor(
+  headers: Headers,
+  auth: AuthInstance,
+  config: CommerceConfig,
+  request: Request = new Request("http://localhost", { headers }),
+): Promise<Actor | null> {
+  let session: AuthSessionLike | null;
+  try {
+    session = (await auth.api.getSession({
+      headers,
+    })) as AuthSessionLike | null;
+  } catch {
+    return null;
+  }
+
+  if (!session) return null;
+
+  const defaultOrgId = config.auth?.defaultOrganizationId ?? DEFAULT_ORG_ID;
+  let role = session.session.activeOrganizationRole as string | undefined;
+  let orgId = session.session.activeOrganizationId as string | null;
+
+  if (!role && auth.api.getFullOrganization) {
+    try {
+      const org = await auth.api.getFullOrganization({
+        query: { organizationId: orgId ?? defaultOrgId },
+        headers,
+      });
+      if (org?.members) {
+        const membership = org.members.find(
+          (m) => m.userId === session.user.id,
+        );
+        if (membership) {
+          role = membership.role;
+          orgId = orgId ?? defaultOrgId;
+        }
+      }
+    } catch {
+      // fall through — treat as customer
+    }
+  }
+
+  if (!role && orgId && auth.api.getActiveMemberRole) {
+    try {
+      const roleResult = await auth.api.getActiveMemberRole({ headers });
+      role = (roleResult as Record<string, unknown>)?.role as
+        | string
+        | undefined;
+    } catch {
+      // fall through — treat as customer
+    }
+  }
+
+  if (!orgId && config.auth?.storeResolver) {
+    try {
+      const resolved = await config.auth.storeResolver(request);
+      if (resolved) orgId = resolved;
+    } catch {
+      // fall through — use defaultOrgId
+    }
+  }
+
+  const enrichedSession = {
+    ...session,
+    session: { ...session.session, activeOrganizationRole: role ?? null },
+  };
+  return {
+    type: "user",
+    userId: session.user.id,
+    email: session.user.email ?? null,
+    name: session.user.name ?? "User",
+    vendorId: session.user.vendorId ?? null,
+    organizationId: orgId ?? defaultOrgId,
+    role: role ?? "customer",
+    permissions: resolvePermissions(enrichedSession, config),
+  } satisfies Actor;
+}

package/src/auth/auth-schema-guard.ts

@@ -0,0 +1,143 @@
+/**
+ * Compares Porulle's Drizzle auth tables against better-auth's canonical
+ * {@link getAuthTables} output so a dependency minor bump cannot add a column
+ * the declared schema omits.
+ */
+
+import { getTableColumns, getTableName } from "drizzle-orm";
+import type { PgColumn, PgTable } from "drizzle-orm/pg-core";
+import { getAuthTables } from "better-auth/db";
+import type { BetterAuthOptions } from "better-auth";
+import { apiKey } from "@better-auth/api-key";
+import { organization, twoFactor, phoneNumber, jwt, bearer } from "better-auth/plugins";
+import * as authSchema from "./auth-schema.js";
+
+/**
+ * Every plugin {@link createAuth} can enable, not only the ones it enables by
+ * default. The shipped schema has to satisfy any configuration a merchant
+ * chooses, so the guard compares against the maximal table set: a column that
+ * only `twoFactor` needs is still a column this package must declare.
+ */
+export const AUTH_SCHEMA_GUARD_OPTIONS = {
+  plugins: [
+    organization({ roles: {} }),
+    bearer(),
+    jwt(),
+    twoFactor({ issuer: "porulle-auth-schema-guard" }),
+    apiKey(),
+    phoneNumber(),
+  ],
+  user: {
+    additionalFields: {
+      vendorId: { type: "string", required: false },
+      posOperatorPin: { type: "string", required: false },
+    },
+  },
+} satisfies BetterAuthOptions;
+
+/**
+ * Drizzle tables keyed by the SQL table name they declare, so the guard walks
+ * whatever models better-auth reports rather than a list someone has to
+ * remember to extend. A hand-maintained model list is how `jwks.alg` shipped
+ * missing while this guard passed.
+ */
+function drizzleTablesByName(): Map<string, PgTable> {
+  const byName = new Map<string, PgTable>();
+  for (const value of Object.values(authSchema)) {
+    try {
+      byName.set(getTableName(value as PgTable), value as PgTable);
+    } catch {
+      // Not a Drizzle table (type export, index helper) — skip.
+    }
+  }
+  return byName;
+}
+
+function drizzleColumnForField(
+  table: PgTable,
+  fieldKey: string,
+  fieldName: string,
+): PgColumn | undefined {
+  const columns = getTableColumns(table);
+  if (fieldKey in columns) {
+    return columns[fieldKey] as PgColumn;
+  }
+  for (const column of Object.values(columns)) {
+    if (column.name === fieldName) {
+      return column as PgColumn;
+    }
+  }
+  return undefined;
+}
+
+export type AuthSchemaParityMismatch = {
+  model: string;
+  field: string;
+  issue: string;
+};
+
+/**
+ * Returns every mismatch between better-auth's expected auth tables and the
+ * Drizzle definitions Porulle ships. An empty array means parity holds.
+ */
+export function findAuthSchemaParityMismatches(
+  options: BetterAuthOptions = AUTH_SCHEMA_GUARD_OPTIONS,
+): AuthSchemaParityMismatch[] {
+  const mismatches: AuthSchemaParityMismatch[] = [];
+  const authTables = getAuthTables(options);
+  const byName = drizzleTablesByName();
+
+  for (const [model, tableDef] of Object.entries(authTables)) {
+    if (!tableDef) continue;
+    const drizzleTable = byName.get(tableDef.modelName);
+    if (!drizzleTable) {
+      mismatches.push({
+        model,
+        field: "*",
+        issue: `no drizzle table declares better-auth model "${tableDef.modelName}"`,
+      });
+      continue;
+    }
+
+    for (const [fieldKey, fieldAttr] of Object.entries(tableDef.fields)) {
+      const column = drizzleColumnForField(
+        drizzleTable,
+        fieldKey,
+        fieldAttr.fieldName ?? fieldKey,
+      );
+      if (!column) {
+        mismatches.push({
+          model,
+          field: fieldKey,
+          issue: `drizzle column missing for better-auth field "${fieldKey}"`,
+        });
+        continue;
+      }
+
+      const required = fieldAttr.required !== false;
+      if (required && !column.notNull) {
+        mismatches.push({
+          model,
+          field: fieldKey,
+          issue: `column "${column.name}" must be NOT NULL (better-auth required)`,
+        });
+      }
+    }
+  }
+
+  return mismatches;
+}
+
+export function assertAuthSchemaParity(
+  options: BetterAuthOptions = AUTH_SCHEMA_GUARD_OPTIONS,
+): void {
+  const mismatches = findAuthSchemaParityMismatches(options);
+  if (mismatches.length === 0) return;
+
+  const detail = mismatches
+    .map((m) => `  ${m.model}.${m.field}: ${m.issue}`)
+    .join("\n");
+  throw new Error(
+    `Porulle auth-schema.ts is out of sync with installed better-auth:\n${detail}`,
+  );
+}