@porulle/core 0.8.0 → 0.10.0

package/dist/interfaces/rest/routes/checkout.js

@@ -5,7 +5,52 @@ import { runAfterHooks, runBeforeHooks } from "../../../kernel/hooks/executor.js
 import { createHookContext } from "../../../kernel/hooks/create-context.js";
 import { mapErrorToResponse, mapErrorToStatus } from "../utils.js";
 import { isCommerceError } from "../../../kernel/errors.js";
+import { assertPermission } from "../../../auth/permissions.js";
 import { makeId } from "../../../utils/id.js";
+/**
+ * SEC-07 — resolve the customer profile a checkout order is attributed to.
+ * A self-service actor may ONLY attribute the order to its own customer
+ * profile; only actors with org-level `customers:read` (staff/clienteling) may
+ * name an arbitrary `customerId`. Returns undefined for guests / unresolved
+ * (guest checkout). Exported for unit testing.
+ */
+export async function resolveCheckoutCustomerUuid(customers, actor, customerId) {
+    const actorUserId = actor?.userId;
+    let canActForOthers = false;
+    if (actorUserId) {
+        try {
+            assertPermission(actor, "customers:read");
+            canActForOthers = true;
+        }
+        catch {
+            canActForOthers = false;
+        }
+    }
+    if (customerId) {
+        const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+        if (uuidRe.test(customerId)) {
+            const byId = await customers.getById(customerId, actor);
+            // Honor a profile UUID only if it is the actor's own, or the actor may
+            // act for other customers.
+            if (byId.ok && (canActForOthers || byId.value.userId === actorUserId)) {
+                return byId.value.id;
+            }
+        }
+        if (canActForOthers) {
+            // Staff may resolve/create a customer by a supplied user_id.
+            const byUser = await customers.getByUserId(customerId, actor);
+            if (byUser.ok)
+                return byUser.value.id;
+        }
+    }
+    // Self-service default: the authenticated actor's own customer profile.
+    if (actorUserId && !canActForOthers) {
+        const own = await customers.getByUserId(actorUserId, actor);
+        if (own.ok)
+            return own.value.id;
+    }
+    return undefined;
+}
 export function checkoutRoutes(kernel) {
     const router = new OpenAPIHono();
     // @ts-expect-error -- openapi() enforces strict response typing but our handler
@@ -20,7 +65,32 @@ export function checkoutRoutes(kernel) {
         if (body.idempotencyKey) {
             const replay = await kernel.services.orders.getByIdempotencyKey(body.idempotencyKey, actor);
             if (replay.ok && replay.value) {
-                return c.json({ data: replay.value }, 201);
+                // IDOR guard: an idempotency key must only replay the requester's OWN
+                // order. Without this, a same-org customer who supplies/guesses another
+                // customer's key would receive that customer's order (PII, totals, lines).
+                let canActForOthers = false;
+                try {
+                    assertPermission(actor, "customers:read");
+                    canActForOthers = true;
+                }
+                catch {
+                    canActForOthers = false;
+                }
+                const ownCustomer = actor
+                    ? await resolveCheckoutCustomerUuid(kernel.services.customers, actor, undefined)
+                    : undefined;
+                const replayCustomer = replay.value.customerId ?? null;
+                const ownsOrder = (replayCustomer !== null && replayCustomer === ownCustomer) ||
+                    (replayCustomer === null && !ownCustomer);
+                if (canActForOthers || ownsOrder) {
+                    return c.json({ data: replay.value }, 201);
+                }
+                return c.json({
+                    error: {
+                        code: "IDEMPOTENCY_CONFLICT",
+                        message: "Idempotency key does not belong to this account.",
+                    },
+                }, 409);
             }
         }
         const checkoutData = {
@@ -93,26 +163,10 @@ export function checkoutRoutes(kernel) {
             // If Stripe takes 5s, the DB connection pool is not affected.
             context.tx = null;
             const processed = await runBeforeHooks(paymentHooks, validated, "create", context);
-            // Resolve customer profile UUID from customerId (may be a profile UUID or a Better Auth user_id)
-            let customerUuid = undefined;
-            if (processed.customerId) {
-                const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-                if (uuidRe.test(processed.customerId)) {
-                    // Looks like a profile UUID — try direct lookup (no auto-create)
-                    const byIdResult = await kernel.services.customers.getById(processed.customerId, actor);
-                    if (byIdResult.ok) {
-                        customerUuid = byIdResult.value.id;
-                    }
-                }
-                if (!customerUuid) {
-                    // Fall back to user_id lookup (auto-creates customer profile if needed)
-                    const byUserIdResult = await kernel.services.customers.getByUserId(processed.customerId, actor);
-                    if (byUserIdResult.ok) {
-                        customerUuid = byUserIdResult.value.id;
-                    }
-                }
-                // If both lookups fail, we still allow guest checkout (customerUuid remains undefined)
-            }
+            // SEC-07: resolve the order's customer server-side. A self-service actor
+            // can only attribute the order to its own profile; a client-supplied
+            // foreign customerId is ignored unless the actor is staff.
+            const customerUuid = await resolveCheckoutCustomerUuid(kernel.services.customers, actor, processed.customerId);
             const orderPayload = {
                 ...(body.idempotencyKey !== undefined
                     ? { idempotencyKey: body.idempotencyKey }
@@ -159,13 +213,19 @@ export function checkoutRoutes(kernel) {
                     ? { customerId: customerUuid }
                     : {}),
             };
-            const order = await kernel.services.orders.create(orderPayload, actor);
+            // Checkout is a trusted, already-server-priced pipeline (resolveCurrentPrices
+            // + promotions/tax) and reserves stock in its own after-hooks — so it hands
+            // the order primitive precomputed totals rather than re-deriving them.
+            const order = await kernel.services.orders.create(orderPayload, actor, undefined, {
+                trustedPricing: true,
+            });
             if (!order.ok) {
                 return c.json(mapErrorToResponse(order.error), mapErrorToStatus(order.error));
             }
             if (order.ok && (processed.appliedPromotions?.length ?? 0) > 0) {
                 await kernel.services.promotions.recordUsage({
                     promotions: processed.appliedPromotions ?? [],
+                    organizationId: order.value.organizationId,
                     orderId: order.value.id,
                     ...(customerUuid !== undefined
                         ? { customerId: customerUuid }

package/dist/interfaces/rest/routes/inventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAUzD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,aAAa,CAAC;AAE7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,gCAiF7C"}
+{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAUzD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,aAAa,CAAC;AAE7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,gCA+F7C"}

package/dist/interfaces/rest/routes/inventory.js

@@ -5,6 +5,13 @@ export function inventoryRoutes(kernel) {
     const router = new OpenAPIHono();
     // Inventory levels listing requires inventory:read
     router.use("/levels", requirePerm("inventory:read"));
+    // Warehouse config + reservation are staff operations, never public. Gate them
+    // at the route (reserve/release are also called internally by checkout with the
+    // customer's actor, so the service itself must stay callable — the boundary is
+    // the HTTP route). Blocks anonymous (401) and customers lacking the perm (403).
+    router.use("/warehouses", requirePerm("inventory:read"));
+    router.use("/reserve", requirePerm("inventory:adjust"));
+    router.use("/release", requirePerm("inventory:adjust"));
     // @ts-expect-error -- openapi handler union return type
     router.openapi(listInventoryLevelsRoute, async (c) => {
         const actor = c.get("actor");
@@ -59,6 +66,12 @@ export function inventoryRoutes(kernel) {
     router.openapi(createWarehouseRoute, async (c) => {
         const body = c.req.valid("json");
         const actor = c.get("actor");
+        // Creating a warehouse (write) needs the higher inventory:adjust perm; the
+        // router.use above already requires inventory:read for the /warehouses path.
+        const perms = actor?.permissions ?? [];
+        if (!(perms.includes("inventory:adjust") || perms.includes("inventory:*") || perms.includes("*:*"))) {
+            return c.json({ error: { code: "FORBIDDEN", message: "Permission 'inventory:adjust' is required." } }, 403);
+        }
         const result = await kernel.services.inventory.createWarehouse(body, actor);
         if (!result.ok)
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));

package/dist/interfaces/rest/routes/orders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orders.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,KAAK,MAAM,EAAiE,MAAM,aAAa,CAAC;AAGzG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,gCAsQzC"}
+{"version":3,"file":"orders.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,KAAK,MAAM,EAAiE,MAAM,aAAa,CAAC;AAIzG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,gCAgRzC"}

package/dist/interfaces/rest/routes/orders.js

@@ -1,6 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { changeOrderStatusRoute, listOrdersRoute, orderLookupRoute, getOrderRoute, getOrderFulfillmentsRoute, createOrderRoute, refundOrderRoute, captureOrderRoute, createOrderFulfillmentRoute, addOrderLineItemRoute, updateOrderLineItemRoute, removeOrderLineItemRoute, refundOrderLinesRoute, undoOrderRefundRoute, listOrderRefundsRoute, refundCapStatusRoute, createOrderNoteRoute, listOrderNotesRoute, deleteOrderNoteRoute, orderTimelineRoute } from "../schemas/orders.js";
 import { isUUID, mapErrorToResponse, mapErrorToStatus, parsePagination } from "../utils.js";
+import { assertPermission } from "../../../auth/permissions.js";
 export function orderRoutes(kernel) {
     const router = new OpenAPIHono();
     // @ts-expect-error -- openapi handler union return type
@@ -55,6 +56,12 @@ export function orderRoutes(kernel) {
     });
     // @ts-expect-error -- openapi handler union return type
     router.openapi(createOrderRoute, async (c) => {
+        try {
+            assertPermission(c.get("actor"), "orders:manage");
+        }
+        catch (error) {
+            return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+        }
         const body = c.req.valid("json");
         const result = await kernel.services.orders.create(body, c.get("actor"));
         if (!result.ok)
@@ -139,6 +146,12 @@ export function orderRoutes(kernel) {
     });
     // @ts-expect-error -- openapi handler union return type
     router.openapi(addOrderLineItemRoute, async (c) => {
+        try {
+            assertPermission(c.get("actor"), "orders:manage");
+        }
+        catch (error) {
+            return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+        }
         const body = c.req.valid("json");
         const result = await kernel.services.orders.addLineItem(c.req.param("id"), body, c.get("actor"));
         if (!result.ok)