@rovela-ai/sdk 0.2.1 → 0.3.1

package/dist/admin/server/admin-self-service.js

@@ -0,0 +1,188 @@
+/**
+ * @rovela/sdk/admin/server/admin-self-service
+ *
+ * Self-service helpers for logged-in admins — change their own password,
+ * edit their own profile. Never accepts an `actor` vs `target` distinction:
+ * these operations always act on the caller themselves, enforced by the
+ * API layer passing `session.user.id` as the adminId.
+ *
+ * # What these do that admin-service.ts doesn't
+ *
+ * `admin-service.ts` has the raw CRUD helpers (`updateAdmin`,
+ * `updateAdminPassword`). Those are called from multiple contexts —
+ * forgot-password flow, invite acceptance, emergency reset, user-management
+ * actions. This file wraps them in self-service semantics:
+ *
+ *   1. `changeOwnPassword` requires the current password as proof of
+ *      identity. Mere session possession isn't enough — we want defense
+ *      against "attacker on coffee shop laptop" scenarios where the
+ *      session cookie is borrowed.
+ *
+ *   2. `updateOwnProfile` checks email uniqueness against every other
+ *      admin (not just-not-self) before persisting, to surface clean
+ *      error codes to the caller.
+ *
+ * Both helpers return typed discriminated unions — they never throw on
+ * business errors, only on unexpected infra failures (DB connectivity,
+ * which the API layer catches).
+ */
+import { eq, and, ne } from 'drizzle-orm';
+import { getDb } from '../../core/db/client';
+import * as schema from '../../core/db/schema';
+import { verifyPassword, validatePassword } from '../../auth/server/password';
+import { findAdminById, updateAdminPassword, updateAdmin } from './admin-service';
+import { deleteAdminPasswordResetTokens } from './admin-password-reset';
+import { invalidateAdminSession } from './admin-session';
+// =============================================================================
+// Change own password
+// =============================================================================
+/**
+ * Change the logged-in admin's password.
+ *
+ * Requires the current password as proof of identity. Validates the new
+ * password via the shared `validatePassword` helper (min 8 chars). On
+ * success, bumps `session_version` (via `updateAdminPassword`), cleans up
+ * any stale reset tokens, and invalidates the in-memory session cache so
+ * other active sessions for this admin are kicked out on their next
+ * request.
+ *
+ * The admin's CURRENT session (the one that initiated this change) also
+ * carries a now-stale `sessionVersion` JWT claim, which means the next
+ * request from that session will also fail `requireAdmin`'s version
+ * check → forced logout. That's correct behavior: after a password
+ * rotation, the user must re-authenticate with the new password.
+ *
+ * If that's undesirable (the UI would need to immediately re-sign-in),
+ * the API handler can call `nextAuthSignIn` server-side after a
+ * successful change. For Phase 4, we accept the forced re-login as the
+ * honest behavior.
+ */
+export async function changeOwnPassword(adminId, currentPassword, newPassword) {
+    // 1. Load the current admin
+    const admin = await findAdminById(adminId);
+    if (!admin) {
+        return {
+            ok: false,
+            error: { code: 'NOT_FOUND', message: 'Admin not found.' },
+        };
+    }
+    // 2. No password on file → invited admin can't self-service
+    if (!admin.passwordHash) {
+        return {
+            ok: false,
+            error: {
+                code: 'INVALID_CREDENTIALS',
+                message: 'Current password is incorrect.',
+            },
+        };
+    }
+    // 3. Verify current password — same generic error message on failure
+    // so we never reveal whether the account exists or is in a weird state.
+    const isValid = await verifyPassword(currentPassword, admin.passwordHash);
+    if (!isValid) {
+        return {
+            ok: false,
+            error: {
+                code: 'INVALID_CREDENTIALS',
+                message: 'Current password is incorrect.',
+            },
+        };
+    }
+    // 4. Validate new password strength
+    const check = validatePassword(newPassword);
+    if (!check.valid) {
+        return {
+            ok: false,
+            error: {
+                code: 'VALIDATION_ERROR',
+                message: check.error || 'Invalid new password.',
+            },
+        };
+    }
+    // 5. Update (bumps session_version internally)
+    await updateAdminPassword(adminId, newPassword);
+    // 6. Defensive cleanup — any stale reset tokens shouldn't grant
+    // post-rotation access.
+    await deleteAdminPasswordResetTokens(adminId);
+    // 7. Flush the 30s per-admin status cache so the next request reads
+    // the new session_version immediately.
+    invalidateAdminSession(adminId);
+    return { ok: true };
+}
+// =============================================================================
+// Update own profile
+// =============================================================================
+/**
+ * Update the logged-in admin's name and/or email.
+ *
+ * Email uniqueness is checked against every OTHER admin (not self). If
+ * both fields are omitted, returns a VALIDATION_ERROR so the caller gets
+ * a clean error rather than a silent no-op.
+ *
+ * Changing email does NOT require a separate re-verification — the admin
+ * is already authenticated and the client-side confirmation dialog in
+ * `AdminAccountPage` warns them about the forgot-password implication.
+ *
+ * No sessionVersion bump — profile changes don't invalidate sessions.
+ */
+export async function updateOwnProfile(adminId, data) {
+    const name = typeof data.name === 'string' ? data.name.trim() : undefined;
+    const email = typeof data.email === 'string' ? data.email.trim().toLowerCase() : undefined;
+    if (name === undefined && email === undefined) {
+        return {
+            ok: false,
+            error: {
+                code: 'VALIDATION_ERROR',
+                message: 'Provide at least one field to update (name or email).',
+            },
+        };
+    }
+    // Validate name length (if provided)
+    if (name !== undefined && name.length < 2) {
+        return {
+            ok: false,
+            error: {
+                code: 'VALIDATION_ERROR',
+                message: 'Name must be at least 2 characters.',
+            },
+        };
+    }
+    // Validate email format (if provided)
+    if (email !== undefined && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        return {
+            ok: false,
+            error: {
+                code: 'VALIDATION_ERROR',
+                message: 'Please enter a valid email address.',
+            },
+        };
+    }
+    // Email uniqueness — only if email is being changed
+    if (email !== undefined) {
+        const db = getDb();
+        const [collision] = await db
+            .select({ id: schema.storeAdmins.id })
+            .from(schema.storeAdmins)
+            .where(and(eq(schema.storeAdmins.email, email), ne(schema.storeAdmins.id, adminId)))
+            .limit(1);
+        if (collision) {
+            return {
+                ok: false,
+                error: {
+                    code: 'EMAIL_EXISTS',
+                    message: 'Another admin already uses this email.',
+                },
+            };
+        }
+    }
+    // Delegate to the shared helper
+    const updated = await updateAdmin(adminId, { name, email });
+    if (!updated) {
+        return {
+            ok: false,
+            error: { code: 'NOT_FOUND', message: 'Admin not found.' },
+        };
+    }
+    return { ok: true, admin: updated };
+}
+//# sourceMappingURL=admin-self-service.js.map

package/dist/admin/server/admin-self-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-self-service.js","sourceRoot":"","sources":["../../../src/admin/server/admin-self-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAwBxD,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,eAAuB,EACvB,WAAmB;IAEnB,4BAA4B;IAC5B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE;SAC1D,CAAA;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,gCAAgC;aAC1C;SACF,CAAA;IACH,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,gCAAgC;aAC1C;SACF,CAAA;IACH,CAAC;IAED,oCAAoC;IACpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,uBAAuB;aAChD;SACF,CAAA;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAE/C,gEAAgE;IAChE,wBAAwB;IACxB,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAA;IAE7C,oEAAoE;IACpE,uCAAuC;IACvC,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAE/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,IAAuC;IAEvC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAE1F,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,uDAAuD;aACjE;SACF,CAAA;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,qCAAqC;aAC/C;SACF,CAAA;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,qCAAqC;aAC/C;SACF,CAAA;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;aACzB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;aACrC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;aACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EACnC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QAEX,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,wCAAwC;iBAClD;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE;SAC1D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACrC,CAAC"}

package/dist/admin/server/admin-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-service.d.ts","sourceRoot":"","sources":["../../../src/admin/server/admin-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAM5C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAA;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAA;IACb,KAAK,EAAE,MAAM,CAAC,UAAU,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAAA;CAChD;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,GAAG,sBAAsB,CAAC,CA6B3D;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,OAAO,GAAG,OAAiB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CA0B5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAwB9B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAUnC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAUnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAyBnC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGtE;AAED;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAQnD"}
+{"version":3,"file":"admin-service.d.ts","sourceRoot":"","sources":["../../../src/admin/server/admin-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAM5C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAA;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAA;IACb,KAAK,EAAE,MAAM,CAAC,UAAU,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAAA;CAChD;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,GAAG,sBAAsB,CAAC,CA0C3D;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,OAAO,GAAG,OAAiB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CA0B5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAwB9B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAUnC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAUnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAyBnC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGtE;AAED;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAQnD"}

package/dist/admin/server/admin-service.js

@@ -4,7 +4,7 @@
  * Admin CRUD operations.
  * Each store has its own database (via Neon branches) - no tenant isolation needed.
  */
-import { eq } from 'drizzle-orm';
+import { eq, sql } from 'drizzle-orm';
 import { getDb } from '../../core/db/client';
 import * as schema from '../../core/db/schema';
 import { hashPassword, verifyPassword } from '../../auth/server/password';
@@ -43,6 +43,18 @@ export async function authenticateAdmin(email, password) {
             code: 'INVALID_CREDENTIALS',
         };
     }
+    // Block 'deactivated' and 'invited' admins. 'invited' admins have no
+    // password hash yet (they must accept their invite first); 'deactivated'
+    // admins are blocked entirely. Return the same generic error message as
+    // wrong-password so we don't reveal account state.
+    const adminStatus = admin.status ?? 'active';
+    if (adminStatus !== 'active' || !admin.passwordHash) {
+        return {
+            success: false,
+            error: 'Invalid email or password',
+            code: 'INVALID_CREDENTIALS',
+        };
+    }
     // Verify password
     const isValidPassword = await verifyPassword(password, admin.passwordHash);
     if (!isValidPassword) {
@@ -215,9 +227,16 @@ export async function updateAdmin(adminId, data) {
 export async function updateAdminPassword(adminId, newPassword) {
     const db = getDb();
     const passwordHash = await hashPassword(newPassword);
+    // Bump session_version atomically so all existing JWTs for this admin
+    // are invalidated on their next request. Every caller (self-service,
+    // forgot-password reset, accept-invite, emergency reset) gets this
+    // invalidation semantics consistently.
     await db
         .update(schema.storeAdmins)
-        .set({ passwordHash })
+        .set({
+        passwordHash,
+        sessionVersion: sql `${schema.storeAdmins.sessionVersion} + 1`,
+    })
         .where(eq(schema.storeAdmins.id, adminId));
 }
 /**

package/dist/admin/server/admin-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-service.js","sourceRoot":"","sources":["../../../src/admin/server/admin-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAsBzE,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,QAAgB;IAEhB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,sBAAsB;IACtB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IAC1E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACjC,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,OAA0B,OAAO;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,gBAAgB;IAChB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAEjD,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,YAAY;YACZ,IAAI;SACL,CAAC;aACD,SAAS,EAAE,CAAA;QAEd,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wCAAwC;QACxC,MAAM,GAAG,GAAG,KAAqD,CAAA;QACjE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe;IAEf,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK;QAC/B,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI;QAC7B,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI;KAC9B,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa;IAEb,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe;IAEf,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,IAAuC;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,UAAU,GAAkC,EAAE,CAAA;IAEpD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACpC,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,0CAA0C;QAC1C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC,UAAU,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SACzC,SAAS,EAAE,CAAA;IAEd,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,WAAmB;IAEnB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;SACrC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAE3B,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}
+{"version":3,"file":"admin-service.js","sourceRoot":"","sources":["../../../src/admin/server/admin-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAsBzE,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,QAAgB;IAEhB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,sBAAsB;IACtB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,WAAW,GAAI,KAA6B,CAAC,MAAM,IAAI,QAAQ,CAAA;IACrE,IAAI,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,kBAAkB;IAClB,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IAC1E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,qBAAqB;SAC5B,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACjC,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,OAA0B,OAAO;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,gBAAgB;IAChB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAEjD,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YACjB,YAAY;YACZ,IAAI;SACL,CAAC;aACD,SAAS,EAAE,CAAA;QAEd,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,wCAAwC;QACxC,MAAM,GAAG,GAAG,KAAqD,CAAA;QACjE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe;IAEf,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK;QAC/B,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI;QAC7B,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI;KAC9B,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa;IAEb,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/D,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe;IAEf,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,IAAuC;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,UAAU,GAAkC,EAAE,CAAA;IAEpD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACpC,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,0CAA0C;QAC1C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC,UAAU,CAAC;SACf,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SACzC,SAAS,EAAE,CAAA;IAEd,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,WAAmB;IAEnB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAEpD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,uCAAuC;IACvC,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC;QACH,YAAY;QACZ,cAAc,EAAE,GAAG,CAAA,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,MAAM;KAC9D,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAC3C,OAAO,CAAC,CAAC,KAAK,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAElB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;SACrC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAE3B,OAAO,MAAM,CAAC,MAAM,CAAA;AACtB,CAAC"}

package/dist/admin/server/admin-session.d.ts

@@ -0,0 +1,137 @@
+/**
+ * @rovela/sdk/admin/server/admin-session
+ *
+ * Centralized session + permission check for admin API routes.
+ *
+ * # Why this exists
+ *
+ * Before this module, every admin API handler had its own local copy of a
+ * `requireAdmin()` helper — ten copies across products, orders, customers,
+ * refund, return, settings, stats, stripe-status, categories, shipping, and
+ * tax-zones. None of them enforced role-based permissions.
+ *
+ * # Which auth config we read
+ *
+ * The sandbox template mounts exactly ONE NextAuth endpoint at
+ * `/api/auth/[...nextauth]/route.ts`, wired to `createAuthOptions()` from
+ * `@rovela-ai/sdk/auth`. That unified config handles BOTH `credentials`
+ * (customer) and `admin-credentials` providers, and it's the config that
+ * writes the session cookie the browser sends back on every request.
+ *
+ * `requireAdmin` MUST read through the same config. Reading from a separate
+ * `createAdminAuthOptions()` (which used its own cookie name + SameSite) —
+ * as an earlier iteration of this file did — produced a read/write mismatch
+ * that rejected every admin API call with 401 regardless of DB state.
+ *
+ * This module replaces all ten legacy helpers with a single gatekeeper that:
+ *   1. Reads the NextAuth session via the unified `createAuthOptions()`.
+ *   2. Fetches a fresh admin row from the DB and confirms `status = 'active'`
+ *      so that deactivated users are kicked out on their next request without
+ *      waiting for the JWT to expire.
+ *   3. Optionally checks a specific `Permission` from the permission matrix.
+ *   4. Optionally enforces a minimum role rank via `meetsMinRole`.
+ *   5. Ensures the runtime schema migration has run (once per process) so
+ *      stores on an older schema still work with the new SDK code paths.
+ *
+ * # Caching
+ *
+ * The DB status check is cached in-memory for 30 seconds per admin ID. This
+ * keeps the hot path fast (most admin routes already do a DB query for their
+ * actual work; one extra read would add ~10ms, and we want to avoid even
+ * that for back-to-back requests). Cache is invalidated via
+ * `invalidateAdminSession(adminId)` after any user-management operation that
+ * changes the admin's role or status, so the next request sees the new state
+ * without waiting for the 30-second TTL.
+ *
+ * # Schema assumptions
+ *
+ * This helper assumes the store's Neon database is already on the latest
+ * admin schema (v2). Schema is applied manually via Neon MCP once per store
+ * (master branch for new stores, per-branch for existing stores that want
+ * the feature). The helper tolerates missing fields gracefully: if the
+ * `status` column doesn't exist on an older store, it's read as undefined
+ * and defaulted to 'active' so existing owner sessions keep working.
+ *
+ * # Return contract
+ *
+ * `requireAdmin()` returns a discriminated union:
+ *   - `{ ok: true, admin }`  — caller proceeds
+ *   - `{ ok: false, response }` — caller returns `response` directly
+ *
+ * This pattern keeps the happy path terse at call sites:
+ *
+ * ```ts
+ * const guard = await requireAdmin({ permission: 'products.write' })
+ * if (!guard.ok) return guard.response
+ * const { admin } = guard
+ * // ...proceed with admin.id, admin.role, etc.
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { type Permission } from '../permissions';
+import type { AdminRole } from '../../core/types';
+import type { StoreAdmin } from '../../core/db/schema';
+import type { AdminApiError } from '../types';
+export interface RequireAdminOptions {
+    /** Require a specific permission from the permission matrix. */
+    permission?: Permission;
+    /** Require at least this role rank (e.g. 'administrator' means owner OR administrator). */
+    minRole?: AdminRole;
+}
+export type RequireAdminResult = {
+    ok: true;
+    admin: StoreAdmin;
+} | {
+    ok: false;
+    response: NextResponse<AdminApiError>;
+};
+/**
+ * Invalidate the session cache for a specific admin. Call this after any
+ * user-management operation that changes the admin's role or status, so the
+ * next request sees the new state without waiting for the 30s TTL.
+ *
+ * @example
+ * ```ts
+ * await deactivateAdmin(adminId)
+ * invalidateAdminSession(adminId)
+ * ```
+ */
+export declare function invalidateAdminSession(adminId: string): void;
+/**
+ * Clear the entire admin session cache. Exposed for tests; rarely needed in
+ * production since per-admin invalidation is sufficient.
+ * @internal
+ */
+export declare function __clearAdminSessionCache(): void;
+/**
+ * Authenticate + authorize the current request as an admin.
+ *
+ * Resolves with either `{ ok: true, admin }` (caller may proceed) or
+ * `{ ok: false, response }` (caller returns `response` to the client).
+ *
+ * Never throws — any internal error is converted to a 401/403/500 response
+ * that's safe to return directly.
+ *
+ * @example
+ * ```ts
+ * // List products (any authenticated admin with 'products.read')
+ * export async function GET(request: NextRequest) {
+ *   const guard = await requireAdmin({ permission: 'products.read' })
+ *   if (!guard.ok) return guard.response
+ *   const { admin } = guard
+ *   // ...proceed, admin.role is known, admin.status === 'active'
+ * }
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Change a user's role (only owners)
+ * export async function PATCH(request: NextRequest) {
+ *   const guard = await requireAdmin({ permission: 'users.write' })
+ *   if (!guard.ok) return guard.response
+ *   // ...
+ * }
+ * ```
+ */
+export declare function requireAdmin(options?: RequireAdminOptions): Promise<RequireAdminResult>;
+//# sourceMappingURL=admin-session.d.ts.map

package/dist/admin/server/admin-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-session.d.ts","sourceRoot":"","sources":["../../../src/admin/server/admin-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI1C,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAM7C,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,SAAS,CAAA;CACpB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC,aAAa,CAAC,CAAA;CAAE,CAAA;AA+BxD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,YAAY,CAChC,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CA+E7B"}

package/dist/admin/server/admin-session.js

@@ -0,0 +1,229 @@
+/**
+ * @rovela/sdk/admin/server/admin-session
+ *
+ * Centralized session + permission check for admin API routes.
+ *
+ * # Why this exists
+ *
+ * Before this module, every admin API handler had its own local copy of a
+ * `requireAdmin()` helper — ten copies across products, orders, customers,
+ * refund, return, settings, stats, stripe-status, categories, shipping, and
+ * tax-zones. None of them enforced role-based permissions.
+ *
+ * # Which auth config we read
+ *
+ * The sandbox template mounts exactly ONE NextAuth endpoint at
+ * `/api/auth/[...nextauth]/route.ts`, wired to `createAuthOptions()` from
+ * `@rovela-ai/sdk/auth`. That unified config handles BOTH `credentials`
+ * (customer) and `admin-credentials` providers, and it's the config that
+ * writes the session cookie the browser sends back on every request.
+ *
+ * `requireAdmin` MUST read through the same config. Reading from a separate
+ * `createAdminAuthOptions()` (which used its own cookie name + SameSite) —
+ * as an earlier iteration of this file did — produced a read/write mismatch
+ * that rejected every admin API call with 401 regardless of DB state.
+ *
+ * This module replaces all ten legacy helpers with a single gatekeeper that:
+ *   1. Reads the NextAuth session via the unified `createAuthOptions()`.
+ *   2. Fetches a fresh admin row from the DB and confirms `status = 'active'`
+ *      so that deactivated users are kicked out on their next request without
+ *      waiting for the JWT to expire.
+ *   3. Optionally checks a specific `Permission` from the permission matrix.
+ *   4. Optionally enforces a minimum role rank via `meetsMinRole`.
+ *   5. Ensures the runtime schema migration has run (once per process) so
+ *      stores on an older schema still work with the new SDK code paths.
+ *
+ * # Caching
+ *
+ * The DB status check is cached in-memory for 30 seconds per admin ID. This
+ * keeps the hot path fast (most admin routes already do a DB query for their
+ * actual work; one extra read would add ~10ms, and we want to avoid even
+ * that for back-to-back requests). Cache is invalidated via
+ * `invalidateAdminSession(adminId)` after any user-management operation that
+ * changes the admin's role or status, so the next request sees the new state
+ * without waiting for the 30-second TTL.
+ *
+ * # Schema assumptions
+ *
+ * This helper assumes the store's Neon database is already on the latest
+ * admin schema (v2). Schema is applied manually via Neon MCP once per store
+ * (master branch for new stores, per-branch for existing stores that want
+ * the feature). The helper tolerates missing fields gracefully: if the
+ * `status` column doesn't exist on an older store, it's read as undefined
+ * and defaulted to 'active' so existing owner sessions keep working.
+ *
+ * # Return contract
+ *
+ * `requireAdmin()` returns a discriminated union:
+ *   - `{ ok: true, admin }`  — caller proceeds
+ *   - `{ ok: false, response }` — caller returns `response` directly
+ *
+ * This pattern keeps the happy path terse at call sites:
+ *
+ * ```ts
+ * const guard = await requireAdmin({ permission: 'products.write' })
+ * if (!guard.ok) return guard.response
+ * const { admin } = guard
+ * // ...proceed with admin.id, admin.role, etc.
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { createAuthOptions } from '../../auth/config';
+import { findAdminById } from './admin-service';
+import { hasPermission, meetsMinRole, } from '../permissions';
+const STATUS_CACHE_TTL_MS = 30 * 1000;
+const statusCache = new Map();
+function getCachedAdmin(adminId) {
+    const entry = statusCache.get(adminId);
+    if (!entry)
+        return null;
+    if (Date.now() > entry.expiresAt) {
+        statusCache.delete(adminId);
+        return null;
+    }
+    return entry.admin;
+}
+function setCachedAdmin(adminId, admin) {
+    statusCache.set(adminId, {
+        admin,
+        expiresAt: Date.now() + STATUS_CACHE_TTL_MS,
+    });
+}
+/**
+ * Invalidate the session cache for a specific admin. Call this after any
+ * user-management operation that changes the admin's role or status, so the
+ * next request sees the new state without waiting for the 30s TTL.
+ *
+ * @example
+ * ```ts
+ * await deactivateAdmin(adminId)
+ * invalidateAdminSession(adminId)
+ * ```
+ */
+export function invalidateAdminSession(adminId) {
+    statusCache.delete(adminId);
+}
+/**
+ * Clear the entire admin session cache. Exposed for tests; rarely needed in
+ * production since per-admin invalidation is sufficient.
+ * @internal
+ */
+export function __clearAdminSessionCache() {
+    statusCache.clear();
+}
+// =============================================================================
+// Response helpers
+// =============================================================================
+function unauthorized() {
+    return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHORIZED' }, { status: 401 });
+}
+function forbidden() {
+    return NextResponse.json({ error: 'Forbidden', code: 'FORBIDDEN' }, { status: 403 });
+}
+// =============================================================================
+// Main helper
+// =============================================================================
+/**
+ * Authenticate + authorize the current request as an admin.
+ *
+ * Resolves with either `{ ok: true, admin }` (caller may proceed) or
+ * `{ ok: false, response }` (caller returns `response` to the client).
+ *
+ * Never throws — any internal error is converted to a 401/403/500 response
+ * that's safe to return directly.
+ *
+ * @example
+ * ```ts
+ * // List products (any authenticated admin with 'products.read')
+ * export async function GET(request: NextRequest) {
+ *   const guard = await requireAdmin({ permission: 'products.read' })
+ *   if (!guard.ok) return guard.response
+ *   const { admin } = guard
+ *   // ...proceed, admin.role is known, admin.status === 'active'
+ * }
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Change a user's role (only owners)
+ * export async function PATCH(request: NextRequest) {
+ *   const guard = await requireAdmin({ permission: 'users.write' })
+ *   if (!guard.ok) return guard.response
+ *   // ...
+ * }
+ * ```
+ */
+export async function requireAdmin(options = {}) {
+    // 1. NextAuth session — read through the UNIFIED auth config. The sandbox
+    // template mounts one NextAuth endpoint (`/api/auth/[...nextauth]`) wired
+    // to `createAuthOptions()`, so that's the config that writes the session
+    // cookie. Reading from the same config guarantees the cookie name and
+    // SameSite policy match between write and read. See the file-level comment
+    // for the full rationale.
+    // The `as unknown as` dance is unavoidable: getServerSession's overloaded
+    // return type infers to `{}` in this generic context, and our session user
+    // carries a custom `role` field we need to read.
+    let rawSession;
+    try {
+        rawSession = await getServerSession(createAuthOptions());
+    }
+    catch (err) {
+        console.error('[requireAdmin] Failed to read session:', err);
+        return { ok: false, response: unauthorized() };
+    }
+    const sessionUser = rawSession?.user;
+    if (!sessionUser?.id) {
+        return { ok: false, response: unauthorized() };
+    }
+    // 2. Fresh DB status check (cached 30s per admin).
+    let admin = getCachedAdmin(sessionUser.id);
+    if (!admin) {
+        try {
+            const fetched = await findAdminById(sessionUser.id);
+            if (!fetched) {
+                return { ok: false, response: unauthorized() };
+            }
+            admin = fetched;
+            setCachedAdmin(sessionUser.id, admin);
+        }
+        catch (err) {
+            console.error('[requireAdmin] Failed to fetch admin row:', err);
+            return { ok: false, response: unauthorized() };
+        }
+    }
+    // 3. Status must be 'active'. 'invited' admins cannot use the dashboard
+    // until they accept their invite; 'deactivated' admins are blocked entirely.
+    // The `status` column may not exist on stores running an older schema — in
+    // that case the field is undefined and we treat it as 'active' (backward
+    // compatible for stores that haven't run the v2 migration yet).
+    const status = admin.status ?? 'active';
+    if (status !== 'active') {
+        return { ok: false, response: unauthorized() };
+    }
+    // 4. Session version check (Phase 4). Compare the JWT's embedded
+    // `sessionVersion` to the DB row's current version. On any mismatch,
+    // treat as forced logout.
+    //
+    // Backward compatibility: JWTs issued before Phase 4 have no
+    // sessionVersion claim (→ undefined → 0), and all DB rows start at 0
+    // after the migration, so pre-Phase-4 sessions match cleanly. The
+    // first password change for any admin bumps the DB version to 1;
+    // their old JWTs fail the match on the next request and get kicked
+    // out — which is exactly what we want.
+    const jwtVersion = sessionUser.sessionVersion ?? 0;
+    const dbVersion = admin.sessionVersion ?? 0;
+    if (jwtVersion !== dbVersion) {
+        return { ok: false, response: unauthorized() };
+    }
+    // 5. Permission check (if requested).
+    if (options.permission && !hasPermission(admin.role, options.permission)) {
+        return { ok: false, response: forbidden() };
+    }
+    // 6. Min-role check (if requested).
+    if (options.minRole && !meetsMinRole(admin.role, options.minRole)) {
+        return { ok: false, response: forbidden() };
+    }
+    return { ok: true, admin };
+}
+//# sourceMappingURL=admin-session.js.map

package/dist/admin/server/admin-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-session.js","sourceRoot":"","sources":["../../../src/admin/server/admin-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EACL,aAAa,EACb,YAAY,GAEb,MAAM,gBAAgB,CAAA;AA6BvB,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAA;AACrC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAA;AAEvD,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,KAAiB;IACxD,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QACvB,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB;KAC5C,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,WAAW,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,SAAS,YAAY;IACnB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAA+B,EAAE;IAEjC,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,2EAA2E;IAC3E,0BAA0B;IAC1B,0EAA0E;IAC1E,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,gBAAgB,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAA;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,WAAW,GAAI,UAEZ,EAAE,IAAI,CAAA;IACf,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,mDAAmD;IACnD,IAAI,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;YAChD,CAAC;YACD,KAAK,GAAG,OAAgC,CAAA;YACxC,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,MAAM,GAAI,KAAwC,CAAC,MAAM,IAAI,QAAQ,CAAA;IAC3E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,iEAAiE;IACjE,qEAAqE;IACrE,0BAA0B;IAC1B,EAAE;IACF,6DAA6D;IAC7D,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,uCAAuC;IACvC,MAAM,UAAU,GAAG,WAAW,CAAC,cAAc,IAAI,CAAC,CAAA;IAClD,MAAM,SAAS,GACZ,KAAgD,CAAC,cAAc,IAAI,CAAC,CAAA;IACvE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,oCAAoC;IACpC,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC"}