Store and member management

Store administration belongs to the signed-in owner or a store member with the right permissions. The SDK makes the operations easy to call; the backend decides who may perform them.

Read and manage a store#

const store = await sdk.stores.getStore(storeId, memberId);
const stores = await sdk.account.ownedStores(adminId);
const myMemberships = await sdk.account.memberStores(userId);

const updated = await sdk.stores.updateStore(storeId, { name: 'Market Garden' }, memberId);

Other store capabilities—products, inventory, hours, orders, analytics, coupons, and integrity reports—are available through the named operation catalog and sdk.execute(operationName, variables).

Invite a teammate#

const invitation = await sdk.members.createInvitation(
  {
    email: 'teammate@example.com',
    storeId,
    role: 'STAFF',
    permissions: ['VIEW_STORE', 'VIEW_ORDERS'],
  },
  memberId,
);

You can then list invitations, accept or reject an invitation, list members, update permissions, or remove a member through sdk.members.

STORE_PERMISSION_PRESETS provides the same starting permission sets as the website:

import { STORE_PERMISSION_PRESETS } from 'malonlin-sdk';

const defaultPermissions = STORE_PERMISSION_PRESETS.STAFF;

Use a preset as a starting point only. The backend permission guard remains authoritative.

The website's role presets are helpful defaults, not authorization. The server re-checks the current actor and membership on each request. Avoid using a client-supplied memberId as proof that someone owns the store.

Safer ownership changes#

Ownership transfer is exposed through the website operation catalog. Resolve both members for the target store and require the current owner to approve the transfer. Since an ownership transfer changes access for both accounts, treat it as a sensitive operation and handle confirmation in your product UI.