@rovela-ai/sdk 0.8.0 → 0.9.0

package/dist/core/db/queries.js

@@ -1644,6 +1644,51 @@ export async function setCustomerGroup(customerId, groupId) {
 // =============================================================================
 // Payment Methods (merchant-managed payment options beyond native Stripe)
 // =============================================================================
+// =============================================================================
+// Group gating (Phase 4) — visible_to_groups on payment methods / shipping
+// rates / tax zones. Empty array = visible to everyone (opt-in gating).
+// =============================================================================
+let visibilityColumnsEnsured = false;
+/**
+ * Self-heal the `visible_to_groups` column on the three gateable tables.
+ * Empty-array default keeps every existing row visible to everyone.
+ * Idempotent + module-cached.
+ */
+export async function ensureVisibilityColumns() {
+    if (visibilityColumnsEnsured)
+        return;
+    const db = getDb();
+    try {
+        await db.execute(sql `ALTER TABLE payment_methods ADD COLUMN IF NOT EXISTS visible_to_groups jsonb NOT NULL DEFAULT '[]'::jsonb`);
+        await db.execute(sql `ALTER TABLE shipping_rates ADD COLUMN IF NOT EXISTS visible_to_groups jsonb NOT NULL DEFAULT '[]'::jsonb`);
+        await db.execute(sql `ALTER TABLE tax_zones ADD COLUMN IF NOT EXISTS visible_to_groups jsonb NOT NULL DEFAULT '[]'::jsonb`);
+        visibilityColumnsEnsured = true;
+    }
+    catch (err) {
+        console.error('[ensureVisibilityColumns] migration failed:', err);
+        throw err;
+    }
+}
+/** Best-effort variant for hot read paths. */
+async function ensureVisibilityColumnsSafe() {
+    try {
+        await ensureVisibilityColumns();
+    }
+    catch {
+        // logged inside ensureVisibilityColumns
+    }
+}
+/**
+ * The single gating predicate: an entry with an empty `visibleToGroups` list
+ * is visible to EVERYONE (guests included); a non-empty list requires the
+ * trusted customer's group to be in it.
+ */
+export function isVisibleToGroup(visibleToGroups, groupId) {
+    const groups = Array.isArray(visibleToGroups) ? visibleToGroups : [];
+    if (groups.length === 0)
+        return true;
+    return !!groupId && groups.includes(groupId);
+}
 let paymentMethodsSchemaEnsured = false;
 /**
  * Self-heal the payment-methods schema on stores provisioned before this
@@ -1682,6 +1727,8 @@ export async function ensurePaymentMethodsSchema() {
         // FK-free (soft reference, like orders.customer_id) so this ALTER never
         // depends on the store_locations table existing first.
         await db.execute(sql `ALTER TABLE orders ADD COLUMN IF NOT EXISTS pickup_location_id uuid`);
+        // Group gating (Phase 4) — payment_methods reads all pass through here.
+        await ensureVisibilityColumns();
         paymentMethodsSchemaEnsured = true;
     }
     catch (err) {
@@ -1707,15 +1754,20 @@ export async function findPaymentMethods() {
         .from(schema.paymentMethods)
         .orderBy(asc(schema.paymentMethods.sortOrder), asc(schema.paymentMethods.createdAt));
 }
-/** Enabled methods only — what checkout offers alongside native Stripe. */
-export async function findEnabledPaymentMethods() {
+/**
+ * Enabled methods only — what checkout offers alongside native Stripe.
+ * `groupId` is the TRUSTED customer group (resolveCheckoutCustomer);
+ * group-gated methods are hidden from guests and non-members.
+ */
+export async function findEnabledPaymentMethods(groupId) {
     await ensurePaymentMethodsSchema();
     const db = getDb();
-    return db
+    const methods = await db
         .select()
         .from(schema.paymentMethods)
         .where(eq(schema.paymentMethods.enabled, true))
         .orderBy(asc(schema.paymentMethods.sortOrder), asc(schema.paymentMethods.createdAt));
+    return methods.filter((m) => isVisibleToGroup(m.visibleToGroups, groupId));
 }
 export async function findPaymentMethodById(id) {
     await ensurePaymentMethodsSchema();
@@ -1739,6 +1791,7 @@ export async function createPaymentMethod(data) {
         enabled: data.enabled ?? true,
         sortOrder: data.sortOrder ?? 0,
         config: data.config ?? {},
+        visibleToGroups: data.visibleToGroups ?? [],
     })
         .returning();
     return method;
@@ -1759,6 +1812,8 @@ export async function updatePaymentMethod(id, data) {
         set.sortOrder = data.sortOrder;
     if (data.config !== undefined)
         set.config = data.config;
+    if (data.visibleToGroups !== undefined)
+        set.visibleToGroups = data.visibleToGroups;
     const [method] = await db
         .update(schema.paymentMethods)
         .set(set)
@@ -2574,6 +2629,8 @@ export async function findCarriersWithZonesAndRates() {
  * Find all shipping zones with their rates and carrier info
  */
 export async function findShippingZones() {
+    // Rate SELECTs enumerate visible_to_groups — self-heal older stores first.
+    await ensureVisibilityColumnsSafe();
     const db = getDb();
     // Get all zones with carrier info via join
     const zonesWithCarriers = await db
@@ -2625,6 +2682,7 @@ export async function findShippingZones() {
             estimatedDays: rate.estimatedDays,
             isActive: rate.isActive,
             sortOrder: rate.sortOrder,
+            visibleToGroups: Array.isArray(rate.visibleToGroups) ? rate.visibleToGroups : [],
         })),
     }));
 }
@@ -2686,6 +2744,7 @@ export async function deleteShippingZone(id) {
  * Create a shipping rate for a zone
  */
 export async function createShippingRate(data) {
+    await ensureVisibilityColumnsSafe();
     const db = getDb();
     const [rate] = await db
         .insert(schema.shippingRates)
@@ -2699,6 +2758,7 @@ export async function createShippingRate(data) {
         estimatedDays: data.estimatedDays || null,
         isActive: data.isActive ?? true,
         sortOrder: data.sortOrder ?? 0,
+        visibleToGroups: data.visibleToGroups ?? [],
     })
         .returning();
     return rate;
@@ -2707,6 +2767,7 @@ export async function createShippingRate(data) {
  * Update a shipping rate
  */
 export async function updateShippingRate(id, data) {
+    await ensureVisibilityColumnsSafe();
     const db = getDb();
     const updateData = {};
     if (data.name !== undefined)
@@ -2725,6 +2786,8 @@ export async function updateShippingRate(id, data) {
         updateData.isActive = data.isActive;
     if (data.sortOrder !== undefined)
         updateData.sortOrder = data.sortOrder;
+    if (data.visibleToGroups !== undefined)
+        updateData.visibleToGroups = data.visibleToGroups;
     const [rate] = await db
         .update(schema.shippingRates)
         .set(updateData)
@@ -2751,7 +2814,7 @@ export async function deleteShippingRate(id) {
  * @param orderAmount - Order subtotal in dollars
  * @returns Array of applicable shipping rates with carrier info
  */
-export async function findShippingRatesForCountry(country, orderAmount) {
+export async function findShippingRatesForCountry(country, orderAmount, groupId) {
     const zones = await findActiveShippingZones();
     const applicableRates = [];
     for (const zone of zones) {
@@ -2767,6 +2830,10 @@ export async function findShippingRatesForCountry(country, orderAmount) {
         for (const rate of zone.rates) {
             if (!rate.isActive)
                 continue;
+            // Group gating: a rate restricted to groups the customer isn't in is
+            // simply not offered (guests see only unrestricted rates).
+            if (!isVisibleToGroup(rate.visibleToGroups, groupId))
+                continue;
             // Check min/max order amount constraints
             if (rate.minOrderAmount !== null && orderAmount < rate.minOrderAmount)
                 continue;
@@ -2795,8 +2862,8 @@ export async function findShippingRatesForCountry(country, orderAmount) {
  * @param orderAmount - Order subtotal in dollars
  * @returns Shipping options grouped by carrier
  */
-export async function findShippingOptionsForCountry(country, orderAmount) {
-    const rates = await findShippingRatesForCountry(country, orderAmount);
+export async function findShippingOptionsForCountry(country, orderAmount, groupId) {
+    const rates = await findShippingRatesForCountry(country, orderAmount, groupId);
     // Group by carrier
     const carrierMap = new Map();
     for (const rate of rates) {
@@ -2831,6 +2898,8 @@ export async function findShippingOptionsForCountry(country, orderAmount) {
  * Find all tax zones ordered by priority (sortOrder ascending)
  */
 export async function findTaxZones() {
+    // The SELECT enumerates visible_to_groups — self-heal older stores first.
+    await ensureVisibilityColumnsSafe();
     const db = getDb();
     const zones = await db
         .select()
@@ -2844,6 +2913,7 @@ export async function findTaxZones() {
         taxRate: Number(zone.taxRate),
         isActive: zone.isActive,
         sortOrder: zone.sortOrder,
+        visibleToGroups: Array.isArray(zone.visibleToGroups) ? zone.visibleToGroups : [],
         createdAt: zone.createdAt,
         updatedAt: zone.updatedAt,
     }));
@@ -2866,6 +2936,7 @@ export async function findTaxZoneById(id) {
  * Create a new tax zone
  */
 export async function createTaxZone(data) {
+    await ensureVisibilityColumnsSafe();
     const db = getDb();
     const [zone] = await db
         .insert(schema.taxZones)
@@ -2876,6 +2947,7 @@ export async function createTaxZone(data) {
         taxRate: String(data.taxRate),
         isActive: data.isActive ?? true,
         sortOrder: data.sortOrder ?? 0,
+        visibleToGroups: data.visibleToGroups ?? [],
     })
         .returning();
     return zone;
@@ -2884,6 +2956,7 @@ export async function createTaxZone(data) {
  * Update a tax zone
  */
 export async function updateTaxZone(id, data) {
+    await ensureVisibilityColumnsSafe();
     const db = getDb();
     const updateData = { updatedAt: new Date() };
     if (data.name !== undefined)
@@ -2898,6 +2971,8 @@ export async function updateTaxZone(id, data) {
         updateData.isActive = data.isActive;
     if (data.sortOrder !== undefined)
         updateData.sortOrder = data.sortOrder;
+    if (data.visibleToGroups !== undefined)
+        updateData.visibleToGroups = data.visibleToGroups;
     const [zone] = await db
         .update(schema.taxZones)
         .set(updateData)
@@ -2929,11 +3004,16 @@ export async function deleteTaxZone(id) {
  * @param state - State/province code for US (e.g., 'CA', 'NY')
  * @returns Tax rate info or null if no matching zone
  */
-export async function findTaxRateForAddress(country, state) {
+export async function findTaxRateForAddress(country, state, groupId) {
     const zones = await findActiveTaxZones();
     const upperCountry = country.toUpperCase();
     const upperState = state?.toUpperCase() || '';
     for (const zone of zones) {
+        // Group gating: a gated zone is SKIPPED for non-members, who fall
+        // through to the next matching zone by priority (e.g. a pro-only 0%
+        // zone listed above the standard rate).
+        if (!isVisibleToGroup(zone.visibleToGroups, groupId))
+            continue;
         // Check if zone covers this country
         const hasWildcard = zone.countries.includes('*');
         const hasCountry = zone.countries.includes(upperCountry);