@unifiedcommerce/core 0.4.4 → 0.5.0

package/dist/adapters/console-email.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Development email adapter that logs emails to the console.
+ *
+ * Zero dependencies. Use this during local development to see email
+ * content in the terminal without configuring Resend or an SMTP server.
+ *
+ * @example
+ * ```typescript
+ * import { consoleEmailAdapter } from "@unifiedcommerce/core";
+ *
+ * export default defineConfig({
+ *   email: consoleEmailAdapter(),
+ * });
+ * ```
+ */
+export declare function consoleEmailAdapter(): {
+    send(input: {
+        template: string;
+        to: string;
+        data?: Record<string, unknown>;
+    }): Promise<void>;
+};
+//# sourceMappingURL=console-email.d.ts.map

package/dist/adapters/console-email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-email.d.ts","sourceRoot":"","sources":["../../src/adapters/console-email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,IAAI,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9F,CAyBA"}

package/dist/adapters/console-email.js

@@ -0,0 +1,38 @@
+/**
+ * Development email adapter that logs emails to the console.
+ *
+ * Zero dependencies. Use this during local development to see email
+ * content in the terminal without configuring Resend or an SMTP server.
+ *
+ * @example
+ * ```typescript
+ * import { consoleEmailAdapter } from "@unifiedcommerce/core";
+ *
+ * export default defineConfig({
+ *   email: consoleEmailAdapter(),
+ * });
+ * ```
+ */
+export function consoleEmailAdapter() {
+    return {
+        async send(input) {
+            const divider = "=".repeat(60);
+            const lines = [
+                "",
+                divider,
+                `  EMAIL: ${input.template}`,
+                divider,
+                `  To:       ${input.to}`,
+                `  Template: ${input.template}`,
+            ];
+            if (input.data && Object.keys(input.data).length > 0) {
+                lines.push(`  Data:`);
+                for (const [key, value] of Object.entries(input.data)) {
+                    lines.push(`    ${key}: ${JSON.stringify(value)}`);
+                }
+            }
+            lines.push(divider, "");
+            console.log(lines.join("\n"));
+        },
+    };
+}

package/dist/auth/access.d.ts

@@ -0,0 +1,101 @@
+import type { Actor } from "./types.js";
+/**
+ * A WhereClause is a plain object representing database filter conditions.
+ * The shape mirrors what services and repositories can accept to narrow queries.
+ *
+ * Example: { customerId: "abc-123" } narrows results to that customer's records.
+ * Composite: { or: [{ customerId: "x" }, { organizationId: "y" }] }
+ */
+export type WhereClause = Record<string, unknown>;
+/**
+ * AccessResult: the return value of an access function.
+ *
+ * - `true`: full access, no filter needed
+ * - `false`: no access at all
+ * - `WhereClause`: partial access — the caller should apply this as a query filter
+ */
+export type AccessResult = boolean | WhereClause;
+/**
+ * AccessContext carries everything an access function needs to make a decision.
+ *
+ * - `actor`: the authenticated user/api-key/null (anonymous)
+ * - `data`: the document being accessed (for document-level checks)
+ * - `id`: the document ID (when data isn't loaded yet)
+ */
+export interface AccessContext<TData = unknown> {
+    actor: Actor | null;
+    data?: TData;
+    id?: string;
+    req?: Request;
+}
+/**
+ * An AccessFn evaluates access for a given context.
+ * Returns boolean (full/no access) or WhereClause (filtered access).
+ */
+export type AccessFn<TData = unknown> = (ctx: AccessContext<TData>) => AccessResult | Promise<AccessResult>;
+/**
+ * Composes access functions with OR semantics.
+ *
+ * - If ANY function returns `true`, grants full access immediately (short-circuit).
+ * - If one or more return WhereClause, combines them with OR.
+ * - If ALL return `false`, denies access.
+ *
+ * Example:
+ * ```typescript
+ * const orderReadAccess = accessOR(isAdmin, isDocumentOwner("customerId"))
+ * // Admins see all orders; customers see only their own
+ * ```
+ */
+export declare const accessOR: <TData = unknown>(...fns: Array<AccessFn<TData>>) => AccessFn<TData>;
+/**
+ * Composes access functions with AND semantics.
+ *
+ * - If ANY function returns `false`, denies access immediately (short-circuit).
+ * - If one or more return WhereClause, combines them with AND.
+ * - If ALL return `true`, grants full access.
+ *
+ * Example:
+ * ```typescript
+ * const restrictedAccess = accessAND(isAuthenticated, isDocumentOwner("customerId"))
+ * // Must be logged in AND own the document
+ * ```
+ */
+export declare const accessAND: <TData = unknown>(...fns: Array<AccessFn<TData>>) => AccessFn<TData>;
+/**
+ * Switches between two access functions based on a condition.
+ *
+ * Example:
+ * ```typescript
+ * const accessByRole = conditional(
+ *   ({ actor }) => actor?.role === "vendor",
+ *   isDocumentOwner("vendorId"),
+ *   isAdmin,
+ * )
+ * ```
+ */
+export declare const conditional: <TData = unknown>(condition: ((ctx: AccessContext<TData>) => boolean) | boolean, accessFn: AccessFn<TData>, fallback?: AccessFn<TData>) => AccessFn<TData>;
+/**
+ * Grants access if the actor has admin or owner role (wildcard permissions).
+ */
+export declare const isAdmin: AccessFn;
+/**
+ * Grants access if the actor is authenticated (any role).
+ */
+export declare const isAuthenticated: AccessFn;
+/**
+ * Returns a WhereClause that filters to documents owned by the actor.
+ * The ownerField is the column name that holds the owner's user ID.
+ *
+ * For document-level checks (when data is provided), returns true/false.
+ * For list-level checks (when data is not provided), returns a WhereClause.
+ */
+export declare const isDocumentOwner: (ownerField?: string) => AccessFn;
+/**
+ * Grants access to everyone, including anonymous users.
+ */
+export declare const publicAccess: AccessFn;
+/**
+ * Denies access to everyone.
+ */
+export declare const denyAll: AccessFn;
+//# sourceMappingURL=access.d.ts.map

package/dist/auth/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/auth/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,WAAW,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa,CAAC,KAAK,GAAG,OAAO;IAC5C,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,CAAC,KAAK,GAAG,OAAO,IAAI,CACtC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,KACtB,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAc1C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,QAAQ,GAAI,KAAK,GAAG,OAAO,EACtC,GAAG,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAC7B,QAAQ,CAAC,KAAK,CAWhB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,GAAI,KAAK,GAAG,OAAO,EACvC,GAAG,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAC7B,QAAQ,CAAC,KAAK,CAahB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,GAAG,OAAO,EACzC,WAAW,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,GAAG,OAAO,EAC7D,UAAU,QAAQ,CAAC,KAAK,CAAC,EACzB,WAAU,QAAQ,CAAC,KAAK,CAAe,KACtC,QAAQ,CAAC,KAAK,CAMhB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,QAGrB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,QAE7B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,mBAAyB,KACxB,QAYF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,QAAqB,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,OAAO,EAAE,QAAsB,CAAC"}

package/dist/auth/access.js

@@ -0,0 +1,128 @@
+/**
+ * Combines multiple WhereClause objects with a logical operator.
+ * If there's only one clause, returns it directly (no unnecessary nesting).
+ */
+function combineWhere(queries, operator) {
+    if (queries.length === 1)
+        return queries[0];
+    return { [operator]: queries };
+}
+/**
+ * Composes access functions with OR semantics.
+ *
+ * - If ANY function returns `true`, grants full access immediately (short-circuit).
+ * - If one or more return WhereClause, combines them with OR.
+ * - If ALL return `false`, denies access.
+ *
+ * Example:
+ * ```typescript
+ * const orderReadAccess = accessOR(isAdmin, isDocumentOwner("customerId"))
+ * // Admins see all orders; customers see only their own
+ * ```
+ */
+export const accessOR = (...fns) => {
+    return async (ctx) => {
+        const queries = [];
+        for (const fn of fns) {
+            const result = await fn(ctx);
+            if (result === true)
+                return true;
+            if (result && typeof result === "object")
+                queries.push(result);
+        }
+        if (queries.length > 0)
+            return combineWhere(queries, "or");
+        return false;
+    };
+};
+/**
+ * Composes access functions with AND semantics.
+ *
+ * - If ANY function returns `false`, denies access immediately (short-circuit).
+ * - If one or more return WhereClause, combines them with AND.
+ * - If ALL return `true`, grants full access.
+ *
+ * Example:
+ * ```typescript
+ * const restrictedAccess = accessAND(isAuthenticated, isDocumentOwner("customerId"))
+ * // Must be logged in AND own the document
+ * ```
+ */
+export const accessAND = (...fns) => {
+    return async (ctx) => {
+        const queries = [];
+        for (const fn of fns) {
+            const result = await fn(ctx);
+            if (result === false)
+                return false;
+            if (result !== true && result && typeof result === "object") {
+                queries.push(result);
+            }
+        }
+        if (queries.length > 0)
+            return combineWhere(queries, "and");
+        return true;
+    };
+};
+/**
+ * Switches between two access functions based on a condition.
+ *
+ * Example:
+ * ```typescript
+ * const accessByRole = conditional(
+ *   ({ actor }) => actor?.role === "vendor",
+ *   isDocumentOwner("vendorId"),
+ *   isAdmin,
+ * )
+ * ```
+ */
+export const conditional = (condition, accessFn, fallback = () => false) => {
+    return async (ctx) => {
+        const applies = typeof condition === "function" ? condition(ctx) : condition;
+        return applies ? accessFn(ctx) : fallback(ctx);
+    };
+};
+// ─────────────────────────────────────────────────────────────────────────────
+// Built-in access functions
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Grants access if the actor has admin or owner role (wildcard permissions).
+ */
+export const isAdmin = ({ actor }) => {
+    if (!actor)
+        return false;
+    return actor.permissions.includes("*:*");
+};
+/**
+ * Grants access if the actor is authenticated (any role).
+ */
+export const isAuthenticated = ({ actor }) => {
+    return actor != null;
+};
+/**
+ * Returns a WhereClause that filters to documents owned by the actor.
+ * The ownerField is the column name that holds the owner's user ID.
+ *
+ * For document-level checks (when data is provided), returns true/false.
+ * For list-level checks (when data is not provided), returns a WhereClause.
+ */
+export const isDocumentOwner = (ownerField = "customerId") => {
+    return ({ actor, data }) => {
+        if (!actor)
+            return false;
+        // Document-level check: compare directly
+        if (data) {
+            return data[ownerField] === actor.userId;
+        }
+        // List-level check: return a filter clause
+        return { [ownerField]: actor.userId };
+    };
+};
+/**
+ * Grants access to everyone, including anonymous users.
+ */
+export const publicAccess = () => true;
+/**
+ * Denies access to everyone.
+ */
+export const denyAll = () => false;