@voyant-travel/auth 0.136.0 → 0.138.0

package/dist/storefront-local-adapter.js

@@ -0,0 +1,313 @@
+/**
+ * Local storefront runtime provider — backs {@link storefrontRuntimePort} with
+ * the deployment's own runtime DB (self-host). Mirrors the team-management
+ * local adapter: every operator write is bounded to `context.organizationId`,
+ * and request-time resolution (`resolveStorefrontByApiKey`) is org-agnostic.
+ */
+import { storefrontApiKeys, storefrontCustomerAuthCredentials, storefronts, } from "@voyant-travel/db/schema/iam";
+import { and, desc, eq } from "drizzle-orm";
+import { validateStorefrontCredentialBundle, } from "./storefront-credentials.js";
+import { classifyStorefrontApiKey, generateStorefrontApiKey, hashStorefrontApiKey, } from "./storefront-keys.js";
+import { enabledStorefrontSocialProviders, normalizeStorefrontAllowedOrigins, normalizeStorefrontCustomerAccountPolicy, normalizeStorefrontCustomerAuthMethods, StorefrontInputError, } from "./storefront-origins.js";
+export { isStorefrontOriginAllowed } from "./storefront-origins.js";
+function toStorefrontDto(row) {
+    return {
+        id: row.id,
+        organizationId: row.organizationId,
+        name: row.name,
+        slug: row.slug,
+        hostingKind: row.hostingKind,
+        siteId: row.siteId ?? null,
+        allowedOrigins: [...row.allowedOrigins],
+        methods: row.methods,
+        accountPolicy: row.accountPolicy,
+        hostOnlyCookies: row.hostOnlyCookies,
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+    };
+}
+function toApiKeyDto(row) {
+    return {
+        id: row.id,
+        storefrontId: row.storefrontId,
+        kind: row.kind,
+        tokenPreview: row.tokenPreview,
+        name: row.name ?? null,
+        lastUsedAt: row.lastUsedAt?.toISOString() ?? null,
+        revokedAt: row.revokedAt?.toISOString() ?? null,
+        createdAt: row.createdAt.toISOString(),
+    };
+}
+export function createLocalStorefrontAdapter(options) {
+    const { resolveCipher } = options;
+    /** Load a storefront and prove it belongs to the acting organization. */
+    async function requireOwnedStorefront(context, storefrontId) {
+        const [row] = await context.db
+            .select()
+            .from(storefronts)
+            .where(and(eq(storefronts.id, storefrontId), eq(storefronts.organizationId, context.organizationId)))
+            .limit(1);
+        if (!row)
+            throw new StorefrontInputError("Storefront was not found.");
+        return row;
+    }
+    async function requireCredentialsForEnabledSocialMethods(context, storefrontId, methods) {
+        const providers = enabledStorefrontSocialProviders(methods);
+        if (providers.length === 0)
+            return;
+        const rows = await context.db
+            .select({ provider: storefrontCustomerAuthCredentials.provider })
+            .from(storefrontCustomerAuthCredentials)
+            .where(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId));
+        const configured = new Set(rows.map((row) => row.provider));
+        for (const provider of providers) {
+            if (!configured.has(provider)) {
+                throw new StorefrontInputError(`Customer auth provider ${provider} cannot be enabled without a stored credential.`);
+            }
+        }
+    }
+    async function persistStorefrontPatch(context, storefrontId, patch) {
+        const [row] = await context.db
+            .update(storefronts)
+            .set({ ...patch, updatedAt: new Date() })
+            .where(and(eq(storefronts.id, storefrontId), eq(storefronts.organizationId, context.organizationId)))
+            .returning();
+        if (!row)
+            throw new StorefrontInputError("Storefront was not found.");
+        return toStorefrontDto(row);
+    }
+    async function issueKeyRow(context, storefront, kind, name) {
+        const generated = await generateStorefrontApiKey(kind);
+        const [row] = await context.db
+            .insert(storefrontApiKeys)
+            .values({
+            storefrontId: storefront.id,
+            organizationId: storefront.organizationId,
+            kind,
+            tokenHash: generated.tokenHash,
+            tokenPreview: generated.tokenPreview,
+            name: name?.trim() || null,
+        })
+            .returning();
+        if (!row)
+            throw new StorefrontInputError("Failed to issue storefront access key.");
+        return { ...toApiKeyDto(row), token: generated.token };
+    }
+    return {
+        async listStorefronts(context) {
+            const rows = await context.db
+                .select()
+                .from(storefronts)
+                .where(eq(storefronts.organizationId, context.organizationId))
+                .orderBy(desc(storefronts.createdAt));
+            return rows.map(toStorefrontDto);
+        },
+        async getStorefront(context, storefrontId) {
+            return toStorefrontDto(await requireOwnedStorefront(context, storefrontId));
+        },
+        async createStorefront(context, input) {
+            const methods = normalizeStorefrontCustomerAuthMethods(input.methods);
+            if (enabledStorefrontSocialProviders(methods).length > 0) {
+                throw new StorefrontInputError("Add the provider credential before creating a storefront with a social method enabled.");
+            }
+            const accountPolicy = normalizeStorefrontCustomerAccountPolicy(input.accountPolicy ?? {
+                allowedKinds: ["personal"],
+                personalSignup: "open",
+                businessOnboarding: "disabled",
+            });
+            const allowedOrigins = normalizeStorefrontAllowedOrigins(input.allowedOrigins);
+            if (input.hostingKind === "external" && input.siteId) {
+                throw new StorefrontInputError("External storefronts cannot reference a hosting site.");
+            }
+            const slug = input.slug.trim();
+            if (!slug)
+                throw new StorefrontInputError("Storefront slug is required.");
+            const [row] = await context.db
+                .insert(storefronts)
+                .values({
+                organizationId: context.organizationId,
+                name: input.name.trim(),
+                slug,
+                hostingKind: input.hostingKind,
+                siteId: input.hostingKind === "cloud_site" ? (input.siteId ?? null) : null,
+                methods,
+                accountPolicy,
+                allowedOrigins,
+                hostOnlyCookies: true,
+            })
+                .returning();
+            if (!row)
+                throw new StorefrontInputError("Failed to create storefront.");
+            return toStorefrontDto(row);
+        },
+        async updateStorefront(context, storefrontId, patch) {
+            await requireOwnedStorefront(context, storefrontId);
+            const update = {};
+            if (patch.name !== undefined)
+                update.name = patch.name.trim();
+            if (patch.allowedOrigins !== undefined) {
+                update.allowedOrigins = normalizeStorefrontAllowedOrigins(patch.allowedOrigins);
+            }
+            if (patch.accountPolicy !== undefined) {
+                update.accountPolicy = normalizeStorefrontCustomerAccountPolicy(patch.accountPolicy);
+            }
+            if (patch.methods !== undefined) {
+                const methods = normalizeStorefrontCustomerAuthMethods(patch.methods);
+                await requireCredentialsForEnabledSocialMethods(context, storefrontId, methods);
+                update.methods = methods;
+            }
+            return persistStorefrontPatch(context, storefrontId, update);
+        },
+        async deleteStorefront(context, storefrontId) {
+            await requireOwnedStorefront(context, storefrontId);
+            await context.db
+                .delete(storefronts)
+                .where(and(eq(storefronts.id, storefrontId), eq(storefronts.organizationId, context.organizationId)));
+        },
+        async setAllowedOrigins(context, storefrontId, origins) {
+            await requireOwnedStorefront(context, storefrontId);
+            return persistStorefrontPatch(context, storefrontId, {
+                allowedOrigins: normalizeStorefrontAllowedOrigins(origins),
+            });
+        },
+        async listApiKeys(context, storefrontId) {
+            await requireOwnedStorefront(context, storefrontId);
+            const rows = await context.db
+                .select()
+                .from(storefrontApiKeys)
+                .where(eq(storefrontApiKeys.storefrontId, storefrontId))
+                .orderBy(desc(storefrontApiKeys.createdAt));
+            return rows.map(toApiKeyDto);
+        },
+        async issueApiKey(context, storefrontId, kind, name) {
+            const storefront = await requireOwnedStorefront(context, storefrontId);
+            return issueKeyRow(context, storefront, kind, name);
+        },
+        async rotateApiKey(context, storefrontId, keyId) {
+            const storefront = await requireOwnedStorefront(context, storefrontId);
+            const [existing] = await context.db
+                .select()
+                .from(storefrontApiKeys)
+                .where(and(eq(storefrontApiKeys.id, keyId), eq(storefrontApiKeys.storefrontId, storefrontId)))
+                .limit(1);
+            if (!existing)
+                throw new StorefrontInputError("Storefront access key was not found.");
+            await context.db
+                .update(storefrontApiKeys)
+                .set({ revokedAt: new Date(), updatedAt: new Date() })
+                .where(eq(storefrontApiKeys.id, keyId));
+            return issueKeyRow(context, storefront, existing.kind, existing.name);
+        },
+        async revokeApiKey(context, storefrontId, keyId) {
+            await requireOwnedStorefront(context, storefrontId);
+            await context.db
+                .update(storefrontApiKeys)
+                .set({ revokedAt: new Date(), updatedAt: new Date() })
+                .where(and(eq(storefrontApiKeys.id, keyId), eq(storefrontApiKeys.storefrontId, storefrontId)));
+        },
+        async resolveStorefrontByApiKey(context, token) {
+            if (classifyStorefrontApiKey(token) === null)
+                return null;
+            const tokenHash = await hashStorefrontApiKey(token);
+            const [key] = await context.db
+                .select()
+                .from(storefrontApiKeys)
+                .where(eq(storefrontApiKeys.tokenHash, tokenHash))
+                .limit(1);
+            if (!key || key.revokedAt)
+                return null;
+            const [storefront] = await context.db
+                .select()
+                .from(storefronts)
+                .where(eq(storefronts.id, key.storefrontId))
+                .limit(1);
+            if (!storefront)
+                return null;
+            try {
+                await context.db
+                    .update(storefrontApiKeys)
+                    .set({ lastUsedAt: new Date() })
+                    .where(eq(storefrontApiKeys.id, key.id));
+            }
+            catch {
+                // Best-effort usage stamping; never fail the request on it.
+            }
+            return { storefront: toStorefrontDto(storefront), key: toApiKeyDto(key) };
+        },
+        async updateAccountPolicy(context, storefrontId, policy) {
+            await requireOwnedStorefront(context, storefrontId);
+            return persistStorefrontPatch(context, storefrontId, {
+                accountPolicy: normalizeStorefrontCustomerAccountPolicy(policy),
+            });
+        },
+        async updateMethods(context, storefrontId, methods) {
+            await requireOwnedStorefront(context, storefrontId);
+            const normalized = normalizeStorefrontCustomerAuthMethods(methods);
+            await requireCredentialsForEnabledSocialMethods(context, storefrontId, normalized);
+            return persistStorefrontPatch(context, storefrontId, { methods: normalized });
+        },
+        async listProviderCredentials(context, storefrontId) {
+            await requireOwnedStorefront(context, storefrontId);
+            const rows = await context.db
+                .select()
+                .from(storefrontCustomerAuthCredentials)
+                .where(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId));
+            const byProvider = new Map(rows.map((row) => [row.provider, row]));
+            return ["google", "facebook", "apple"].map((provider) => {
+                const row = byProvider.get(provider);
+                return {
+                    provider,
+                    configured: Boolean(row),
+                    updatedAt: row?.updatedAt.toISOString() ?? null,
+                };
+            });
+        },
+        async putProviderCredential(context, storefrontId, provider, credentials) {
+            const storefront = await requireOwnedStorefront(context, storefrontId);
+            const bundle = validateStorefrontCredentialBundle(provider, credentials);
+            const encrypted = await resolveCipher(context.bindings).encrypt(JSON.stringify(bundle));
+            const [existing] = await context.db
+                .select({ id: storefrontCustomerAuthCredentials.id })
+                .from(storefrontCustomerAuthCredentials)
+                .where(and(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId), eq(storefrontCustomerAuthCredentials.provider, provider)))
+                .limit(1);
+            if (existing) {
+                await context.db
+                    .update(storefrontCustomerAuthCredentials)
+                    .set({ encryptedCredentials: encrypted, updatedAt: new Date() })
+                    .where(eq(storefrontCustomerAuthCredentials.id, existing.id));
+                return;
+            }
+            await context.db.insert(storefrontCustomerAuthCredentials).values({
+                storefrontId,
+                organizationId: storefront.organizationId,
+                provider,
+                encryptedCredentials: encrypted,
+            });
+        },
+        async deleteProviderCredential(context, storefrontId, provider) {
+            await requireOwnedStorefront(context, storefrontId);
+            await context.db
+                .delete(storefrontCustomerAuthCredentials)
+                .where(and(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId), eq(storefrontCustomerAuthCredentials.provider, provider)));
+        },
+        async resolveProviderCredentials(context, storefrontId, providers) {
+            if (providers.length === 0)
+                return {};
+            const rows = await context.db
+                .select()
+                .from(storefrontCustomerAuthCredentials)
+                .where(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId));
+            const cipher = resolveCipher(context.bindings);
+            const resolved = {};
+            for (const row of rows) {
+                if (!providers.includes(row.provider))
+                    continue;
+                const plaintext = await cipher.decrypt(row.encryptedCredentials);
+                resolved[row.provider] = JSON.parse(plaintext);
+            }
+            return resolved;
+        },
+    };
+}
+//# sourceMappingURL=storefront-local-adapter.js.map

package/dist/storefront-local-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storefront-local-adapter.js","sourceRoot":"","sources":["../src/storefront-local-adapter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAML,iBAAiB,EACjB,iCAAiC,EACjC,WAAW,GACZ,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAE3C,OAAO,EAEL,kCAAkC,GACnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,gCAAgC,EAChC,iCAAiC,EACjC,wCAAwC,EACxC,sCAAsC,EACtC,oBAAoB,GACrB,MAAM,yBAAyB,CAAA;AAahC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAEnE,SAAS,eAAe,CAAC,GAAqB;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,cAAc,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAA2B;IAC9C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;QAC/C,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAO5C;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAA;IAEjC,yEAAyE;IACzE,KAAK,UAAU,sBAAsB,CACnC,OAAiC,EACjC,YAAoB;QAEpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aAC3B,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,EAChC,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CACvD,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAA;QACrE,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,UAAU,yCAAyC,CACtD,OAAiC,EACjC,YAAoB,EACpB,OAAiC;QAEjC,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAA;QAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAClC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;aAC1B,MAAM,CAAC,EAAE,QAAQ,EAAE,iCAAiC,CAAC,QAAQ,EAAE,CAAC;aAChE,IAAI,CAAC,iCAAiC,CAAC;aACvC,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,QAAQ,iDAAiD,CACpF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,sBAAsB,CACnC,OAAiC,EACjC,YAAoB,EACpB,KAAgC;QAEhC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aAC3B,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACxC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,EAChC,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CACvD,CACF;aACA,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAA;QACrE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,OAAiC,EACjC,UAA4B,EAC5B,IAAiC,EACjC,IAAoB;QAEpB,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;aAC3B,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,IAAI;YACJ,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI;SAC3B,CAAC;aACD,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAA;QAClF,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAA;IACxD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;iBAC7D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAA;YACvC,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAClC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY;YACvC,OAAO,eAAe,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7E,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK;YACnC,MAAM,OAAO,GAAG,sCAAsC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACrE,IAAI,gCAAgC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,oBAAoB,CAC5B,wFAAwF,CACzF,CAAA;YACH,CAAC;YACD,MAAM,aAAa,GAAG,wCAAwC,CAC5D,KAAK,CAAC,aAAa,IAAI;gBACrB,YAAY,EAAE,CAAC,UAAU,CAAC;gBAC1B,cAAc,EAAE,MAAM;gBACtB,kBAAkB,EAAE,UAAU;aAC/B,CACF,CAAA;YACD,MAAM,cAAc,GAAG,iCAAiC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;YAC9E,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACrD,MAAM,IAAI,oBAAoB,CAAC,uDAAuD,CAAC,CAAA;YACzF,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,CAAC,CAAA;YACzE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;iBAC3B,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CAAC;gBACN,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;gBACvB,IAAI;gBACJ,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,MAAM,EAAE,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC1E,OAAO;gBACP,aAAa;gBACb,cAAc;gBACd,eAAe,EAAE,IAAI;aACtB,CAAC;iBACD,SAAS,EAAE,CAAA;YACd,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,CAAC,CAAA;YACxE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK;YACjD,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,MAAM,MAAM,GAA8B,EAAE,CAAA;YAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YAC7D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,CAAC,cAAc,GAAG,iCAAiC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,CAAC,aAAa,GAAG,wCAAwC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YACtF,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,sCAAsC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;gBACrE,MAAM,yCAAyC,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAA;gBAC/E,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;YAC1B,CAAC;YACD,OAAO,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;QAC9D,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY;YAC1C,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,MAAM,OAAO,CAAC,EAAE;iBACb,MAAM,CAAC,WAAW,CAAC;iBACnB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,EAChC,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CACvD,CACF,CAAA;QACL,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO;YACpD,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,OAAO,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE;gBACnD,cAAc,EAAE,iCAAiC,CAAC,OAAO,CAAC;aAC3D,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY;YACrC,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;iBACvD,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAA;YAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI;YACjD,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACtE,OAAO,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACrD,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK;YAC7C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACtE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;iBAChC,MAAM,EAAE;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CACvF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,CAAC,CAAA;YACrF,MAAM,OAAO,CAAC,EAAE;iBACb,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACrD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;YACzC,OAAO,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAA;QACvE,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK;YAC7C,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,MAAM,OAAO,CAAC,EAAE;iBACb,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACrD,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CACvF,CAAA;QACL,CAAC;QAED,KAAK,CAAC,yBAAyB,CAC7B,OAAiC,EACjC,KAAa;YAEb,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACzD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;iBAC3B,MAAM,EAAE;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;iBACjD,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAA;YACtC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;iBAClC,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;iBAC3C,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAA;YAC5B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE;qBACb,MAAM,CAAC,iBAAiB,CAAC;qBACzB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBAC/B,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAA;QAC3E,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM;YACrD,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,OAAO,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE;gBACnD,aAAa,EAAE,wCAAwC,CAAC,MAAM,CAAC;aAChE,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO;YAChD,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,MAAM,UAAU,GAAG,sCAAsC,CAAC,OAAO,CAAC,CAAA;YAClE,MAAM,yCAAyC,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;YAClF,OAAO,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC/E,CAAC;QAED,KAAK,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY;YACjD,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,iCAAiC,CAAC;iBACvC,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;YAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,CAGxB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YACzC,OAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAW,CAAC,GAAG,CACnD,CAAC,QAAQ,EAAyC,EAAE;gBAClD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACpC,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC;oBACxB,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,IAAI;iBAChD,CAAA;YACH,CAAC,CACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW;YACtE,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACtE,MAAM,MAAM,GAAG,kCAAkC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;YACxE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YACvF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;iBAChC,MAAM,CAAC,EAAE,EAAE,EAAE,iCAAiC,CAAC,EAAE,EAAE,CAAC;iBACpD,IAAI,CAAC,iCAAiC,CAAC;iBACvC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iCAAiC,CAAC,YAAY,EAAE,YAAY,CAAC,EAChE,EAAE,CAAC,iCAAiC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACzD,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,CAAC,EAAE;qBACb,MAAM,CAAC,iCAAiC,CAAC;qBACzC,GAAG,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBAC/D,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC/D,OAAM;YACR,CAAC;YACD,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,MAAM,CAAC;gBAChE,YAAY;gBACZ,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,QAAQ;gBACR,oBAAoB,EAAE,SAAS;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ;YAC5D,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;YACnD,MAAM,OAAO,CAAC,EAAE;iBACb,MAAM,CAAC,iCAAiC,CAAC;iBACzC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iCAAiC,CAAC,YAAY,EAAE,YAAY,CAAC,EAChE,EAAE,CAAC,iCAAiC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACzD,CACF,CAAA;QACL,CAAC;QAED,KAAK,CAAC,0BAA0B,CAC9B,OAAiC,EACjC,YAAoB,EACpB,SAA0D;YAE1D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAA;YACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;iBAC1B,MAAM,EAAE;iBACR,IAAI,CAAC,iCAAiC,CAAC;iBACvC,KAAK,CAAC,EAAE,CAAC,iCAAiC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;YAC1E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC9C,MAAM,QAAQ,GAA0C,EAAE,CAAA;YAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBAC/C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBAChE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA2B,CAAA;YAC1E,CAAC;YACD,OAAO,QAAQ,CAAA;QACjB,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["/**\n * Local storefront runtime provider — backs {@link storefrontRuntimePort} with\n * the deployment's own runtime DB (self-host). Mirrors the team-management\n * local adapter: every operator write is bounded to `context.organizationId`,\n * and request-time resolution (`resolveStorefrontByApiKey`) is org-agnostic.\n */\nimport {\n  type InsertStorefront,\n  type SelectStorefront,\n  type SelectStorefrontApiKey,\n  type SelectStorefrontCustomerAuthCredential,\n  type StorefrontCustomerAuthSocialProvider,\n  storefrontApiKeys,\n  storefrontCustomerAuthCredentials,\n  storefronts,\n} from \"@voyant-travel/db/schema/iam\"\nimport { and, desc, eq } from \"drizzle-orm\"\n\nimport {\n  type StorefrontCredentialCipher,\n  validateStorefrontCredentialBundle,\n} from \"./storefront-credentials.js\"\nimport {\n  classifyStorefrontApiKey,\n  generateStorefrontApiKey,\n  hashStorefrontApiKey,\n} from \"./storefront-keys.js\"\nimport {\n  enabledStorefrontSocialProviders,\n  normalizeStorefrontAllowedOrigins,\n  normalizeStorefrontCustomerAccountPolicy,\n  normalizeStorefrontCustomerAuthMethods,\n  StorefrontInputError,\n} from \"./storefront-origins.js\"\nimport type {\n  IssuedStorefrontApiKeyDto,\n  ResolvedStorefrontApiKey,\n  ResolvedStorefrontProviderCredentials,\n  StorefrontApiKeyDto,\n  StorefrontDto,\n  StorefrontProviderCredentialStatusDto,\n  StorefrontRequestContext,\n  StorefrontResolveContext,\n  StorefrontRuntimeProvider,\n} from \"./storefront-runtime-port.js\"\n\nexport { isStorefrontOriginAllowed } from \"./storefront-origins.js\"\n\nfunction toStorefrontDto(row: SelectStorefront): StorefrontDto {\n  return {\n    id: row.id,\n    organizationId: row.organizationId,\n    name: row.name,\n    slug: row.slug,\n    hostingKind: row.hostingKind,\n    siteId: row.siteId ?? null,\n    allowedOrigins: [...row.allowedOrigins],\n    methods: row.methods,\n    accountPolicy: row.accountPolicy,\n    hostOnlyCookies: row.hostOnlyCookies,\n    createdAt: row.createdAt.toISOString(),\n    updatedAt: row.updatedAt.toISOString(),\n  }\n}\n\nfunction toApiKeyDto(row: SelectStorefrontApiKey): StorefrontApiKeyDto {\n  return {\n    id: row.id,\n    storefrontId: row.storefrontId,\n    kind: row.kind,\n    tokenPreview: row.tokenPreview,\n    name: row.name ?? null,\n    lastUsedAt: row.lastUsedAt?.toISOString() ?? null,\n    revokedAt: row.revokedAt?.toISOString() ?? null,\n    createdAt: row.createdAt.toISOString(),\n  }\n}\n\nexport function createLocalStorefrontAdapter(options: {\n  /**\n   * Resolve the KMS-backed credential cipher for a deployment. Called with the\n   * request bindings so per-deployment KMS config is honoured; the self-host\n   * host passes `createKmsStorefrontCredentialCipher(env)`.\n   */\n  resolveCipher: (bindings: Record<string, unknown>) => StorefrontCredentialCipher\n}): StorefrontRuntimeProvider {\n  const { resolveCipher } = options\n\n  /** Load a storefront and prove it belongs to the acting organization. */\n  async function requireOwnedStorefront(\n    context: StorefrontRequestContext,\n    storefrontId: string,\n  ): Promise<SelectStorefront> {\n    const [row] = await context.db\n      .select()\n      .from(storefronts)\n      .where(\n        and(\n          eq(storefronts.id, storefrontId),\n          eq(storefronts.organizationId, context.organizationId),\n        ),\n      )\n      .limit(1)\n    if (!row) throw new StorefrontInputError(\"Storefront was not found.\")\n    return row\n  }\n\n  async function requireCredentialsForEnabledSocialMethods(\n    context: StorefrontRequestContext,\n    storefrontId: string,\n    methods: StorefrontDto[\"methods\"],\n  ): Promise<void> {\n    const providers = enabledStorefrontSocialProviders(methods)\n    if (providers.length === 0) return\n    const rows = await context.db\n      .select({ provider: storefrontCustomerAuthCredentials.provider })\n      .from(storefrontCustomerAuthCredentials)\n      .where(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId))\n    const configured = new Set(rows.map((row) => row.provider))\n    for (const provider of providers) {\n      if (!configured.has(provider)) {\n        throw new StorefrontInputError(\n          `Customer auth provider ${provider} cannot be enabled without a stored credential.`,\n        )\n      }\n    }\n  }\n\n  async function persistStorefrontPatch(\n    context: StorefrontRequestContext,\n    storefrontId: string,\n    patch: Partial<InsertStorefront>,\n  ): Promise<StorefrontDto> {\n    const [row] = await context.db\n      .update(storefronts)\n      .set({ ...patch, updatedAt: new Date() })\n      .where(\n        and(\n          eq(storefronts.id, storefrontId),\n          eq(storefronts.organizationId, context.organizationId),\n        ),\n      )\n      .returning()\n    if (!row) throw new StorefrontInputError(\"Storefront was not found.\")\n    return toStorefrontDto(row)\n  }\n\n  async function issueKeyRow(\n    context: StorefrontRequestContext,\n    storefront: SelectStorefront,\n    kind: StorefrontApiKeyDto[\"kind\"],\n    name?: string | null,\n  ): Promise<IssuedStorefrontApiKeyDto> {\n    const generated = await generateStorefrontApiKey(kind)\n    const [row] = await context.db\n      .insert(storefrontApiKeys)\n      .values({\n        storefrontId: storefront.id,\n        organizationId: storefront.organizationId,\n        kind,\n        tokenHash: generated.tokenHash,\n        tokenPreview: generated.tokenPreview,\n        name: name?.trim() || null,\n      })\n      .returning()\n    if (!row) throw new StorefrontInputError(\"Failed to issue storefront access key.\")\n    return { ...toApiKeyDto(row), token: generated.token }\n  }\n\n  return {\n    async listStorefronts(context) {\n      const rows = await context.db\n        .select()\n        .from(storefronts)\n        .where(eq(storefronts.organizationId, context.organizationId))\n        .orderBy(desc(storefronts.createdAt))\n      return rows.map(toStorefrontDto)\n    },\n\n    async getStorefront(context, storefrontId) {\n      return toStorefrontDto(await requireOwnedStorefront(context, storefrontId))\n    },\n\n    async createStorefront(context, input) {\n      const methods = normalizeStorefrontCustomerAuthMethods(input.methods)\n      if (enabledStorefrontSocialProviders(methods).length > 0) {\n        throw new StorefrontInputError(\n          \"Add the provider credential before creating a storefront with a social method enabled.\",\n        )\n      }\n      const accountPolicy = normalizeStorefrontCustomerAccountPolicy(\n        input.accountPolicy ?? {\n          allowedKinds: [\"personal\"],\n          personalSignup: \"open\",\n          businessOnboarding: \"disabled\",\n        },\n      )\n      const allowedOrigins = normalizeStorefrontAllowedOrigins(input.allowedOrigins)\n      if (input.hostingKind === \"external\" && input.siteId) {\n        throw new StorefrontInputError(\"External storefronts cannot reference a hosting site.\")\n      }\n      const slug = input.slug.trim()\n      if (!slug) throw new StorefrontInputError(\"Storefront slug is required.\")\n      const [row] = await context.db\n        .insert(storefronts)\n        .values({\n          organizationId: context.organizationId,\n          name: input.name.trim(),\n          slug,\n          hostingKind: input.hostingKind,\n          siteId: input.hostingKind === \"cloud_site\" ? (input.siteId ?? null) : null,\n          methods,\n          accountPolicy,\n          allowedOrigins,\n          hostOnlyCookies: true,\n        })\n        .returning()\n      if (!row) throw new StorefrontInputError(\"Failed to create storefront.\")\n      return toStorefrontDto(row)\n    },\n\n    async updateStorefront(context, storefrontId, patch) {\n      await requireOwnedStorefront(context, storefrontId)\n      const update: Partial<InsertStorefront> = {}\n      if (patch.name !== undefined) update.name = patch.name.trim()\n      if (patch.allowedOrigins !== undefined) {\n        update.allowedOrigins = normalizeStorefrontAllowedOrigins(patch.allowedOrigins)\n      }\n      if (patch.accountPolicy !== undefined) {\n        update.accountPolicy = normalizeStorefrontCustomerAccountPolicy(patch.accountPolicy)\n      }\n      if (patch.methods !== undefined) {\n        const methods = normalizeStorefrontCustomerAuthMethods(patch.methods)\n        await requireCredentialsForEnabledSocialMethods(context, storefrontId, methods)\n        update.methods = methods\n      }\n      return persistStorefrontPatch(context, storefrontId, update)\n    },\n\n    async deleteStorefront(context, storefrontId) {\n      await requireOwnedStorefront(context, storefrontId)\n      await context.db\n        .delete(storefronts)\n        .where(\n          and(\n            eq(storefronts.id, storefrontId),\n            eq(storefronts.organizationId, context.organizationId),\n          ),\n        )\n    },\n\n    async setAllowedOrigins(context, storefrontId, origins) {\n      await requireOwnedStorefront(context, storefrontId)\n      return persistStorefrontPatch(context, storefrontId, {\n        allowedOrigins: normalizeStorefrontAllowedOrigins(origins),\n      })\n    },\n\n    async listApiKeys(context, storefrontId) {\n      await requireOwnedStorefront(context, storefrontId)\n      const rows = await context.db\n        .select()\n        .from(storefrontApiKeys)\n        .where(eq(storefrontApiKeys.storefrontId, storefrontId))\n        .orderBy(desc(storefrontApiKeys.createdAt))\n      return rows.map(toApiKeyDto)\n    },\n\n    async issueApiKey(context, storefrontId, kind, name) {\n      const storefront = await requireOwnedStorefront(context, storefrontId)\n      return issueKeyRow(context, storefront, kind, name)\n    },\n\n    async rotateApiKey(context, storefrontId, keyId) {\n      const storefront = await requireOwnedStorefront(context, storefrontId)\n      const [existing] = await context.db\n        .select()\n        .from(storefrontApiKeys)\n        .where(\n          and(eq(storefrontApiKeys.id, keyId), eq(storefrontApiKeys.storefrontId, storefrontId)),\n        )\n        .limit(1)\n      if (!existing) throw new StorefrontInputError(\"Storefront access key was not found.\")\n      await context.db\n        .update(storefrontApiKeys)\n        .set({ revokedAt: new Date(), updatedAt: new Date() })\n        .where(eq(storefrontApiKeys.id, keyId))\n      return issueKeyRow(context, storefront, existing.kind, existing.name)\n    },\n\n    async revokeApiKey(context, storefrontId, keyId) {\n      await requireOwnedStorefront(context, storefrontId)\n      await context.db\n        .update(storefrontApiKeys)\n        .set({ revokedAt: new Date(), updatedAt: new Date() })\n        .where(\n          and(eq(storefrontApiKeys.id, keyId), eq(storefrontApiKeys.storefrontId, storefrontId)),\n        )\n    },\n\n    async resolveStorefrontByApiKey(\n      context: StorefrontResolveContext,\n      token: string,\n    ): Promise<ResolvedStorefrontApiKey | null> {\n      if (classifyStorefrontApiKey(token) === null) return null\n      const tokenHash = await hashStorefrontApiKey(token)\n      const [key] = await context.db\n        .select()\n        .from(storefrontApiKeys)\n        .where(eq(storefrontApiKeys.tokenHash, tokenHash))\n        .limit(1)\n      if (!key || key.revokedAt) return null\n      const [storefront] = await context.db\n        .select()\n        .from(storefronts)\n        .where(eq(storefronts.id, key.storefrontId))\n        .limit(1)\n      if (!storefront) return null\n      try {\n        await context.db\n          .update(storefrontApiKeys)\n          .set({ lastUsedAt: new Date() })\n          .where(eq(storefrontApiKeys.id, key.id))\n      } catch {\n        // Best-effort usage stamping; never fail the request on it.\n      }\n      return { storefront: toStorefrontDto(storefront), key: toApiKeyDto(key) }\n    },\n\n    async updateAccountPolicy(context, storefrontId, policy) {\n      await requireOwnedStorefront(context, storefrontId)\n      return persistStorefrontPatch(context, storefrontId, {\n        accountPolicy: normalizeStorefrontCustomerAccountPolicy(policy),\n      })\n    },\n\n    async updateMethods(context, storefrontId, methods) {\n      await requireOwnedStorefront(context, storefrontId)\n      const normalized = normalizeStorefrontCustomerAuthMethods(methods)\n      await requireCredentialsForEnabledSocialMethods(context, storefrontId, normalized)\n      return persistStorefrontPatch(context, storefrontId, { methods: normalized })\n    },\n\n    async listProviderCredentials(context, storefrontId) {\n      await requireOwnedStorefront(context, storefrontId)\n      const rows = await context.db\n        .select()\n        .from(storefrontCustomerAuthCredentials)\n        .where(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId))\n      const byProvider = new Map<\n        StorefrontCustomerAuthSocialProvider,\n        SelectStorefrontCustomerAuthCredential\n      >(rows.map((row) => [row.provider, row]))\n      return ([\"google\", \"facebook\", \"apple\"] as const).map(\n        (provider): StorefrontProviderCredentialStatusDto => {\n          const row = byProvider.get(provider)\n          return {\n            provider,\n            configured: Boolean(row),\n            updatedAt: row?.updatedAt.toISOString() ?? null,\n          }\n        },\n      )\n    },\n\n    async putProviderCredential(context, storefrontId, provider, credentials) {\n      const storefront = await requireOwnedStorefront(context, storefrontId)\n      const bundle = validateStorefrontCredentialBundle(provider, credentials)\n      const encrypted = await resolveCipher(context.bindings).encrypt(JSON.stringify(bundle))\n      const [existing] = await context.db\n        .select({ id: storefrontCustomerAuthCredentials.id })\n        .from(storefrontCustomerAuthCredentials)\n        .where(\n          and(\n            eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId),\n            eq(storefrontCustomerAuthCredentials.provider, provider),\n          ),\n        )\n        .limit(1)\n      if (existing) {\n        await context.db\n          .update(storefrontCustomerAuthCredentials)\n          .set({ encryptedCredentials: encrypted, updatedAt: new Date() })\n          .where(eq(storefrontCustomerAuthCredentials.id, existing.id))\n        return\n      }\n      await context.db.insert(storefrontCustomerAuthCredentials).values({\n        storefrontId,\n        organizationId: storefront.organizationId,\n        provider,\n        encryptedCredentials: encrypted,\n      })\n    },\n\n    async deleteProviderCredential(context, storefrontId, provider) {\n      await requireOwnedStorefront(context, storefrontId)\n      await context.db\n        .delete(storefrontCustomerAuthCredentials)\n        .where(\n          and(\n            eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId),\n            eq(storefrontCustomerAuthCredentials.provider, provider),\n          ),\n        )\n    },\n\n    async resolveProviderCredentials(\n      context: StorefrontResolveContext,\n      storefrontId: string,\n      providers: readonly StorefrontCustomerAuthSocialProvider[],\n    ): Promise<ResolvedStorefrontProviderCredentials> {\n      if (providers.length === 0) return {}\n      const rows = await context.db\n        .select()\n        .from(storefrontCustomerAuthCredentials)\n        .where(eq(storefrontCustomerAuthCredentials.storefrontId, storefrontId))\n      const cipher = resolveCipher(context.bindings)\n      const resolved: ResolvedStorefrontProviderCredentials = {}\n      for (const row of rows) {\n        if (!providers.includes(row.provider)) continue\n        const plaintext = await cipher.decrypt(row.encryptedCredentials)\n        resolved[row.provider] = JSON.parse(plaintext) as Record<string, string>\n      }\n      return resolved\n    },\n  }\n}\n"]}

package/dist/storefront-origins.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Storefront origin + policy normalization (provider-neutral, pure).
+ *
+ * Operators declare which browser origins may use a storefront's keys. There is
+ * no ownership proof — declaration by the authenticated operator IS the
+ * authorization, so a leaked publishable key is still bound to these origins by
+ * CORS and Better Auth trusted origins.
+ */
+import type { StorefrontCustomerAccountPolicy, StorefrontCustomerAuthMethods, StorefrontCustomerAuthSocialProvider } from "@voyant-travel/db/schema/iam";
+export declare const STOREFRONT_SOCIAL_PROVIDERS: readonly ["google", "facebook", "apple"];
+export declare class StorefrontInputError extends Error {
+    constructor(message: string);
+}
+/**
+ * Normalize a set of operator-declared allowed origins. Each entry is either an
+ * exact origin or a single-label `https://*.host` wildcard. HTTP is permitted
+ * only for localhost (so a storefront can run against a sandbox from a
+ * developer's machine); every other host must use HTTPS. Duplicates are removed
+ * and the result is sorted for a stable persisted value.
+ */
+export declare function normalizeStorefrontAllowedOrigins(origins: readonly string[]): string[];
+/**
+ * Whether a request origin is authorized by a storefront's declared origins.
+ * Exact origins match verbatim; a `https://*.host` wildcard matches exactly one
+ * additional leading DNS label (`https://app.host`, not `https://a.b.host` and
+ * not the bare `https://host`).
+ */
+export declare function isStorefrontOriginAllowed(origin: string, allowedOrigins: readonly string[]): boolean;
+/** Public storefront methods projection: coerces every flag to a strict boolean. */
+export declare function normalizeStorefrontCustomerAuthMethods(methods: StorefrontCustomerAuthMethods): StorefrontCustomerAuthMethods;
+/** Social providers whose method flag is enabled on a storefront. */
+export declare function enabledStorefrontSocialProviders(methods: StorefrontCustomerAuthMethods): StorefrontCustomerAuthSocialProvider[];
+/** Normalize and validate the public B2C/B2B buyer-account capability policy. */
+export declare function normalizeStorefrontCustomerAccountPolicy(policy: StorefrontCustomerAccountPolicy): StorefrontCustomerAccountPolicy;

package/dist/storefront-origins.js

@@ -0,0 +1,132 @@
+export const STOREFRONT_SOCIAL_PROVIDERS = ["google", "facebook", "apple"];
+export class StorefrontInputError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "StorefrontInputError";
+    }
+}
+const LOCALHOST_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+const WILDCARD_PREFIX = "https://*.";
+/**
+ * Normalize a set of operator-declared allowed origins. Each entry is either an
+ * exact origin or a single-label `https://*.host` wildcard. HTTP is permitted
+ * only for localhost (so a storefront can run against a sandbox from a
+ * developer's machine); every other host must use HTTPS. Duplicates are removed
+ * and the result is sorted for a stable persisted value.
+ */
+export function normalizeStorefrontAllowedOrigins(origins) {
+    const normalized = origins.map((candidate) => {
+        const trimmed = candidate.trim();
+        if (!trimmed) {
+            throw new StorefrontInputError("Storefront allowed origins cannot be empty.");
+        }
+        // Wildcard form: https://*.example.com (exactly one leading label).
+        if (trimmed.startsWith(WILDCARD_PREFIX)) {
+            const host = trimmed.slice(WILDCARD_PREFIX.length);
+            if (!host || host.includes("*") || host.includes("/") || host.includes(":")) {
+                throw new StorefrontInputError(`Invalid storefront wildcard origin: ${candidate}`);
+            }
+            return trimmed.replace(/\/$/, "");
+        }
+        let url;
+        try {
+            url = new URL(trimmed);
+        }
+        catch {
+            throw new StorefrontInputError(`Invalid storefront allowed origin: ${candidate}`);
+        }
+        const isLocalhost = LOCALHOST_HOSTNAMES.has(url.hostname);
+        if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocalhost)) {
+            throw new StorefrontInputError("Storefront allowed origins must use HTTPS (HTTP is permitted only for localhost).");
+        }
+        if (url.username || url.password || url.search || url.hash) {
+            throw new StorefrontInputError("Storefront allowed origins cannot contain credentials, query, or hash.");
+        }
+        if (url.pathname !== "/" || trimmed.replace(/\/$/, "") !== url.origin) {
+            throw new StorefrontInputError("Storefront allowed entries must be origins, not URLs with paths.");
+        }
+        return url.origin;
+    });
+    return [...new Set(normalized)].sort();
+}
+/**
+ * Whether a request origin is authorized by a storefront's declared origins.
+ * Exact origins match verbatim; a `https://*.host` wildcard matches exactly one
+ * additional leading DNS label (`https://app.host`, not `https://a.b.host` and
+ * not the bare `https://host`).
+ */
+export function isStorefrontOriginAllowed(origin, allowedOrigins) {
+    let candidate;
+    try {
+        candidate = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    if (candidate.origin !== origin)
+        return false;
+    for (const entry of allowedOrigins) {
+        if (entry.startsWith(WILDCARD_PREFIX)) {
+            if (candidate.protocol !== "https:")
+                continue;
+            const suffix = entry.slice(WILDCARD_PREFIX.length);
+            const host = candidate.hostname;
+            if (!host.endsWith(`.${suffix}`))
+                continue;
+            const label = host.slice(0, host.length - suffix.length - 1);
+            if (label.length > 0 && !label.includes("."))
+                return true;
+            continue;
+        }
+        if (entry === candidate.origin)
+            return true;
+    }
+    return false;
+}
+/** Public storefront methods projection: coerces every flag to a strict boolean. */
+export function normalizeStorefrontCustomerAuthMethods(methods) {
+    const normalized = {
+        emailCode: methods.emailCode === true,
+        emailPassword: methods.emailPassword === true,
+        google: methods.google === true,
+        facebook: methods.facebook === true,
+        apple: methods.apple === true,
+    };
+    if (!Object.values(normalized).some(Boolean)) {
+        throw new StorefrontInputError("Enable at least one customer authentication method.");
+    }
+    return normalized;
+}
+/** Social providers whose method flag is enabled on a storefront. */
+export function enabledStorefrontSocialProviders(methods) {
+    return STOREFRONT_SOCIAL_PROVIDERS.filter((provider) => methods[provider] === true);
+}
+/** Normalize and validate the public B2C/B2B buyer-account capability policy. */
+export function normalizeStorefrontCustomerAccountPolicy(policy) {
+    const suppliedKinds = [...policy.allowedKinds];
+    if (suppliedKinds.length === 0) {
+        throw new StorefrontInputError("Allow at least one storefront buyer account kind.");
+    }
+    if (new Set(suppliedKinds).size !== suppliedKinds.length) {
+        throw new StorefrontInputError("Storefront buyer account kinds must be unique.");
+    }
+    const allowedKinds = ["personal", "business"].filter((kind) => suppliedKinds.includes(kind));
+    if (allowedKinds.length !== suppliedKinds.length) {
+        throw new StorefrontInputError("Storefront buyer account kind is unsupported.");
+    }
+    if (!allowedKinds.includes("personal") && policy.personalSignup !== "disabled") {
+        throw new StorefrontInputError("Personal signup must be disabled when personal buyer accounts are not allowed.");
+    }
+    if (!allowedKinds.includes("business") && policy.businessOnboarding !== "disabled") {
+        throw new StorefrontInputError("Business onboarding must be disabled when business buyer accounts are not allowed.");
+    }
+    if (allowedKinds.includes("business") && policy.businessOnboarding === "disabled") {
+        throw new StorefrontInputError("Business onboarding must be enabled when business buyer accounts are allowed.");
+    }
+    return {
+        allowedKinds,
+        personalSignup: policy.personalSignup,
+        businessOnboarding: policy.businessOnboarding,
+    };
+}
+//# sourceMappingURL=storefront-origins.js.map

package/dist/storefront-origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storefront-origins.js","sourceRoot":"","sources":["../src/storefront-origins.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAEnF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AACxE,MAAM,eAAe,GAAG,YAAY,CAAA;AAEpC;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAA0B;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAAC,6CAA6C,CAAC,CAAA;QAC/E,CAAC;QAED,oEAAoE;QACpE,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAA;YACpF,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACnC,CAAC;QAED,IAAI,GAAQ,CAAA;QACZ,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAA;QACnF,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACzD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,oBAAoB,CAC5B,mFAAmF,CACpF,CAAA;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,IAAI,oBAAoB,CAC5B,wEAAwE,CACzE,CAAA;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACtE,MAAM,IAAI,oBAAoB,CAC5B,kEAAkE,CACnE,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAA;IACnB,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,cAAiC;IAEjC,IAAI,SAAc,CAAA;IAClB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAE7C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YAClD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAA;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;gBAAE,SAAQ;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACzD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;IAC7C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sCAAsC,CACpD,OAAsC;IAEtC,MAAM,UAAU,GAAkC;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;QACrC,aAAa,EAAE,OAAO,CAAC,aAAa,KAAK,IAAI;QAC7C,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI;QACnC,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;KAC9B,CAAA;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,oBAAoB,CAAC,qDAAqD,CAAC,CAAA;IACvF,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gCAAgC,CAC9C,OAAsC;IAEtC,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAA;AACrF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wCAAwC,CACtD,MAAuC;IAEvC,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IAC9C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,oBAAoB,CAAC,gDAAgD,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,YAAY,GAAI,CAAC,UAAU,EAAE,UAAU,CAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACvE,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC7B,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,oBAAoB,CAAC,+CAA+C,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAC/E,MAAM,IAAI,oBAAoB,CAC5B,gFAAgF,CACjF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACnF,MAAM,IAAI,oBAAoB,CAC5B,oFAAoF,CACrF,CAAA;IACH,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,IAAI,oBAAoB,CAC5B,+EAA+E,CAChF,CAAA;IACH,CAAC;IACD,OAAO;QACL,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC","sourcesContent":["/**\n * Storefront origin + policy normalization (provider-neutral, pure).\n *\n * Operators declare which browser origins may use a storefront's keys. There is\n * no ownership proof — declaration by the authenticated operator IS the\n * authorization, so a leaked publishable key is still bound to these origins by\n * CORS and Better Auth trusted origins.\n */\nimport type {\n  StorefrontCustomerAccountPolicy,\n  StorefrontCustomerAuthMethods,\n  StorefrontCustomerAuthSocialProvider,\n} from \"@voyant-travel/db/schema/iam\"\n\nexport const STOREFRONT_SOCIAL_PROVIDERS = [\"google\", \"facebook\", \"apple\"] as const\n\nexport class StorefrontInputError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"StorefrontInputError\"\n  }\n}\n\nconst LOCALHOST_HOSTNAMES = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"])\nconst WILDCARD_PREFIX = \"https://*.\"\n\n/**\n * Normalize a set of operator-declared allowed origins. Each entry is either an\n * exact origin or a single-label `https://*.host` wildcard. HTTP is permitted\n * only for localhost (so a storefront can run against a sandbox from a\n * developer's machine); every other host must use HTTPS. Duplicates are removed\n * and the result is sorted for a stable persisted value.\n */\nexport function normalizeStorefrontAllowedOrigins(origins: readonly string[]): string[] {\n  const normalized = origins.map((candidate) => {\n    const trimmed = candidate.trim()\n    if (!trimmed) {\n      throw new StorefrontInputError(\"Storefront allowed origins cannot be empty.\")\n    }\n\n    // Wildcard form: https://*.example.com (exactly one leading label).\n    if (trimmed.startsWith(WILDCARD_PREFIX)) {\n      const host = trimmed.slice(WILDCARD_PREFIX.length)\n      if (!host || host.includes(\"*\") || host.includes(\"/\") || host.includes(\":\")) {\n        throw new StorefrontInputError(`Invalid storefront wildcard origin: ${candidate}`)\n      }\n      return trimmed.replace(/\\/$/, \"\")\n    }\n\n    let url: URL\n    try {\n      url = new URL(trimmed)\n    } catch {\n      throw new StorefrontInputError(`Invalid storefront allowed origin: ${candidate}`)\n    }\n    const isLocalhost = LOCALHOST_HOSTNAMES.has(url.hostname)\n    if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLocalhost)) {\n      throw new StorefrontInputError(\n        \"Storefront allowed origins must use HTTPS (HTTP is permitted only for localhost).\",\n      )\n    }\n    if (url.username || url.password || url.search || url.hash) {\n      throw new StorefrontInputError(\n        \"Storefront allowed origins cannot contain credentials, query, or hash.\",\n      )\n    }\n    if (url.pathname !== \"/\" || trimmed.replace(/\\/$/, \"\") !== url.origin) {\n      throw new StorefrontInputError(\n        \"Storefront allowed entries must be origins, not URLs with paths.\",\n      )\n    }\n    return url.origin\n  })\n  return [...new Set(normalized)].sort()\n}\n\n/**\n * Whether a request origin is authorized by a storefront's declared origins.\n * Exact origins match verbatim; a `https://*.host` wildcard matches exactly one\n * additional leading DNS label (`https://app.host`, not `https://a.b.host` and\n * not the bare `https://host`).\n */\nexport function isStorefrontOriginAllowed(\n  origin: string,\n  allowedOrigins: readonly string[],\n): boolean {\n  let candidate: URL\n  try {\n    candidate = new URL(origin)\n  } catch {\n    return false\n  }\n  if (candidate.origin !== origin) return false\n\n  for (const entry of allowedOrigins) {\n    if (entry.startsWith(WILDCARD_PREFIX)) {\n      if (candidate.protocol !== \"https:\") continue\n      const suffix = entry.slice(WILDCARD_PREFIX.length)\n      const host = candidate.hostname\n      if (!host.endsWith(`.${suffix}`)) continue\n      const label = host.slice(0, host.length - suffix.length - 1)\n      if (label.length > 0 && !label.includes(\".\")) return true\n      continue\n    }\n    if (entry === candidate.origin) return true\n  }\n  return false\n}\n\n/** Public storefront methods projection: coerces every flag to a strict boolean. */\nexport function normalizeStorefrontCustomerAuthMethods(\n  methods: StorefrontCustomerAuthMethods,\n): StorefrontCustomerAuthMethods {\n  const normalized: StorefrontCustomerAuthMethods = {\n    emailCode: methods.emailCode === true,\n    emailPassword: methods.emailPassword === true,\n    google: methods.google === true,\n    facebook: methods.facebook === true,\n    apple: methods.apple === true,\n  }\n  if (!Object.values(normalized).some(Boolean)) {\n    throw new StorefrontInputError(\"Enable at least one customer authentication method.\")\n  }\n  return normalized\n}\n\n/** Social providers whose method flag is enabled on a storefront. */\nexport function enabledStorefrontSocialProviders(\n  methods: StorefrontCustomerAuthMethods,\n): StorefrontCustomerAuthSocialProvider[] {\n  return STOREFRONT_SOCIAL_PROVIDERS.filter((provider) => methods[provider] === true)\n}\n\n/** Normalize and validate the public B2C/B2B buyer-account capability policy. */\nexport function normalizeStorefrontCustomerAccountPolicy(\n  policy: StorefrontCustomerAccountPolicy,\n): StorefrontCustomerAccountPolicy {\n  const suppliedKinds = [...policy.allowedKinds]\n  if (suppliedKinds.length === 0) {\n    throw new StorefrontInputError(\"Allow at least one storefront buyer account kind.\")\n  }\n  if (new Set(suppliedKinds).size !== suppliedKinds.length) {\n    throw new StorefrontInputError(\"Storefront buyer account kinds must be unique.\")\n  }\n  const allowedKinds = ([\"personal\", \"business\"] as const).filter((kind) =>\n    suppliedKinds.includes(kind),\n  )\n  if (allowedKinds.length !== suppliedKinds.length) {\n    throw new StorefrontInputError(\"Storefront buyer account kind is unsupported.\")\n  }\n  if (!allowedKinds.includes(\"personal\") && policy.personalSignup !== \"disabled\") {\n    throw new StorefrontInputError(\n      \"Personal signup must be disabled when personal buyer accounts are not allowed.\",\n    )\n  }\n  if (!allowedKinds.includes(\"business\") && policy.businessOnboarding !== \"disabled\") {\n    throw new StorefrontInputError(\n      \"Business onboarding must be disabled when business buyer accounts are not allowed.\",\n    )\n  }\n  if (allowedKinds.includes(\"business\") && policy.businessOnboarding === \"disabled\") {\n    throw new StorefrontInputError(\n      \"Business onboarding must be enabled when business buyer accounts are allowed.\",\n    )\n  }\n  return {\n    allowedKinds,\n    personalSignup: policy.personalSignup,\n    businessOnboarding: policy.businessOnboarding,\n  }\n}\n"]}