@aglyn/plugins-commerce 1.0.0-beta.232 → 1.0.0-beta.233

package/src/lib/server/cart-checkout.d.ts

@@ -15,6 +15,8 @@
  * limitations under the License.
  */
 import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/** A rewards or credit code no provider on this site takes (AGL-3640). */
+export declare const CHECKOUT_CREDIT_INVALID_MESSAGE = "That rewards code is not valid.";
 /** An option the buyer ticked is no longer offered (AGL-3635). */
 export declare const CHECKOUT_EXTRA_UNAVAILABLE_MESSAGE = "An option you picked is no longer available. Review your cart and try again.";
 /**

package/src/lib/server/cart-checkout.js

@@ -14,7 +14,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { readSiteReturnHost, siteReturnUrl } from "@aglyn/aglyn/app-utils/site-return-url";
+ */ import { randomUUID } from "crypto";
+import { readSiteReturnHost, siteReturnUrl } from "@aglyn/aglyn/app-utils/site-return-url";
 import * as Aglyn from "@aglyn/aglyn/server";
 import * as CommerceModel from "../model/index.js";
 import { checkoutRecoveryState } from "../model/checkout-recovery.js";
@@ -29,11 +30,14 @@ import { allocateCentsByWeight, engineLineTaxPercentages, taxEngineSessionMetada
 import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
 import { holdPromotionSlot, promotionHoldKey } from "./promotion-hold.js";
 import { holdStock, stockHoldKey } from "./stock-hold.js";
+import { appendLocalFulfillmentMetadata, localFulfillmentLocationId, localStockRefusalMessage, planLocalFulfillment, readLocalFulfillmentRequest, readLocalFulfillmentStore } from "./local-fulfillment.js";
 import { applyNativeCheckoutParams, nativeCheckoutStripeHeaders, readCheckoutSessionPayload, resolveNativeCheckoutMode } from "./native-checkout.js";
 import { ensureCheckoutDomain } from "./payment-method-domains.js";
 import { raiseCheckoutStarted } from "./order-events.js";
 import { checkoutExtrasCents, encodeCheckoutExtrasMetadata, readChosenCheckoutExtras } from "@aglyn/aglyn/plugin-manager/plugin-checkout-extras";
 import { quoteCartExtras } from "./checkout-extras.js";
+import { boundedCreditCents, checkoutCreditProviderForCode, encodeCheckoutCreditMetadata, normalizeCheckoutCreditAccount, normalizeCheckoutCreditCode } from "@aglyn/aglyn/plugin-manager/plugin-checkout-credits";
+/** A rewards or credit code no provider on this site takes (AGL-3640). */ export const CHECKOUT_CREDIT_INVALID_MESSAGE = 'That rewards code is not valid.';
 /** An option the buyer ticked is no longer offered (AGL-3635). */ export const CHECKOUT_EXTRA_UNAVAILABLE_MESSAGE = 'An option you picked is no longer available. Review your cart and try again.';
 /**
  * Cart checkout (AGL-293): the whole cart in one Stripe Checkout
@@ -59,6 +63,8 @@ import { quoteCartExtras } from "./checkout-extras.js";
     const marketingOptIn = Boolean(body.marketingOptIn);
     const giftCardCode = String((_body_giftCardCode = body.giftCardCode) != null ? _body_giftCardCode : '').trim().toUpperCase().slice(0, 24);
     const couponCode = String((_body_couponCode = body.couponCode) != null ? _body_couponCode : '').trim().toUpperCase().slice(0, 40);
+    // A rewards or referral code another plugin keeps the account for (AGL-3640).
+    const creditCode = normalizeCheckoutCreditCode(body.creditCode);
     if (!hostId) return res.status(400).json({
         error: 'Missing hostId'
     });
@@ -97,7 +103,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
         if (held) await held.release();
     };
     try {
-        var _cartSnapshot_data, _ref1, _storeSettings_get, _storeSettings_get1, _req_headers_referer, _req_headers_host, _ref2, _ref3;
+        var _cartSnapshot_data, _ref1, _ref2, _storeSettings_get, _storeSettings_get1, _req_headers_referer, _req_headers_host, _ref3, _ref4;
         var _ownerOrg_org, _ownerOrg_org1, _ownerOrg_org2, _engineTax_quote;
         const firestore = firebaseAdmin.app().firestore();
         const hostRef = firestore.collection('hosts').doc(hostId);
@@ -288,7 +294,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
         // visitor per day, lower while the workspace is young. Above the claim,
         // like the line refusals, so a refusal keeps the key.
         if (giftCardCents > 0) {
-            var _ref4;
+            var _ref5;
             var _req_socket;
             const young = isYoungWorkspace(ownerOrg.org);
             const overCeiling = CommerceModel.giftCardPurchaseRefusal({
@@ -300,7 +306,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
                     visible: overCeiling
                 });
             }
-            const buys = await consumeRateLimit(`giftcard:buy:${hostId}:${String((_ref4 = (_req_socket = req.socket) == null ? void 0 : _req_socket.remoteAddress) != null ? _ref4 : '') || 'no-address'}`, {
+            const buys = await consumeRateLimit(`giftcard:buy:${hostId}:${String((_ref5 = (_req_socket = req.socket) == null ? void 0 : _req_socket.remoteAddress) != null ? _ref5 : '') || 'no-address'}`, {
                 limit: young ? CommerceModel.GIFT_CARD_PURCHASE_LIMITS.perVisitorDailyYoung : CommerceModel.GIFT_CARD_PURCHASE_LIMITS.perVisitorDaily,
                 windowMs: 24 * 60 * 60 * 1000
             });
@@ -325,10 +331,48 @@ import { quoteCartExtras } from "./checkout-extras.js";
         // session byte-identical to today's: no shipping charged, exactly as
         // before. Only a merchant who set rates up starts collecting them.
         const storeSettings = await hostRef.collection('settings').doc('store').get();
+        // PICKUP OR THE STORE'S OWN DELIVERY (AGL-3624), declared at the cart and
+        // decided here from the store's settings: the location, the zone's fee and
+        // minimum, the window. Above the claim, so a refusal keeps the key and the
+        // shopper's same button works once they choose again. See
+        // `local-fulfillment.ts`.
+        const localRequest = readLocalFulfillmentRequest(body.fulfillment);
+        const localStore = hasPhysicalLine ? await readLocalFulfillmentStore({
+            hostRef,
+            storeSettings: (_ref1 = storeSettings.data == null ? void 0 : storeSettings.data.call(storeSettings)) != null ? _ref1 : null,
+            org: ownerOrg.org
+        }) : null;
+        const localPlan = localStore ? await planLocalFulfillment({
+            hostId,
+            request: localRequest,
+            itemsCents,
+            hasPhysicalLine,
+            store: localStore
+        }) : {
+            kind: 'shipping'
+        };
+        if (localPlan.kind === 'refusal') {
+            return res.status(localPlan.status).json(_extends({
+                error: localPlan.error
+            }, localPlan.changed ? {
+                fulfillmentChanged: localPlan.changed
+            } : {}));
+        }
         // A live carrier rate (AGL-3612) is quoted here too, before the session,
         // for the destination the shopper declared; a store with none plans from
         // its table exactly as before. See `carrier-shipping.ts`.
-        const shippingPlan = hasPhysicalLine ? await planCheckoutShippingWithCarriers({
+        const shippingPlan = // Collected: nothing to price, no address to ask for.
+        localPlan.kind === 'pickup' ? {
+            countries: [],
+            options: []
+        } : localPlan.kind === 'local_delivery' ? {
+            countries: [
+                localPlan.country
+            ],
+            options: [
+                localPlan.option
+            ]
+        } : hasPhysicalLine ? await planCheckoutShippingWithCarriers({
             hostId,
             settings: storeSettings.get('shipping'),
             cart: {
@@ -343,6 +387,12 @@ import { quoteCartExtras } from "./checkout-extras.js";
             countries: CommerceModel.CHECKOUT_SHIPPING_COUNTRIES,
             options: []
         };
+        // A store whose locations offer pickup has the shopper choose WHERE at
+        // the cart (AGL-3624); the old unnamed `Local pickup` rate would be a
+        // second, unrouted pickup inside a session the shopper chose shipping for.
+        if (localPlan.kind === 'shipping' && (localStore == null ? void 0 : localStore.pickupLocations.length)) {
+            shippingPlan.options = shippingPlan.options.filter((option)=>option.rateId !== CommerceModel.LOCAL_PICKUP_RATE_ID);
+        }
         if (shippingPlan.needsPostalCode) {
             return res.status(400).json({
                 error: CARRIER_POSTAL_CODE_MESSAGE,
@@ -458,7 +508,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
         const claimed = await claimAttempt(firestore, {
             kind: 'commerce-cart',
             scopeId: `${hostId}:${cartId}`,
-            orgId: String((_ref1 = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.id) != null ? _ref1 : ''),
+            orgId: String((_ref2 = ownerOrg == null ? void 0 : (_ownerOrg_org1 = ownerOrg.org) == null ? void 0 : _ownerOrg_org1.id) != null ? _ref2 : ''),
             key: idempotencyKey,
             busyMessage: 'This checkout is already being processed'
         });
@@ -499,7 +549,9 @@ import { quoteCartExtras } from "./checkout-extras.js";
                 hostRef,
                 holdKey: stockHoldKey(claimed.claim.stripeKey),
                 lines: reserveLines,
-                label: `cart ${hostId}/${cartId}`
+                label: `cart ${hostId}/${cartId}`,
+                // At the pickup location, or the one deliveries leave from (AGL-3624).
+                locationId: localFulfillmentLocationId(localPlan)
             });
             if (!held.ok) {
                 // Nothing has been minted yet, so the key goes back and the same
@@ -510,7 +562,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
                 await releaseStock();
                 await claim.release();
                 return res.status(409).json({
-                    error: held.reason === 'sold-out' ? held.productName ? `"${held.productName}" — ${CommerceModel.STOCK_HELD_MESSAGE}` : CommerceModel.STOCK_HELD_MESSAGE : 'Your cart is no longer available'
+                    error: held.reason === 'sold-out-at-location' ? localStockRefusalMessage(localPlan, held.productName) : held.reason === 'sold-out' ? held.productName ? `"${held.productName}" — ${CommerceModel.STOCK_HELD_MESSAGE}` : CommerceModel.STOCK_HELD_MESSAGE : 'Your cart is no longer available'
                 });
             }
             if (held.holdKey) {
@@ -613,11 +665,11 @@ import { quoteCartExtras } from "./checkout-extras.js";
             })) : shippingPlan.options;
         // Coupons (AGL-96 semantics): percent off the items total.
         if (couponCode && !resolvedDiscount) {
-            var _ref5;
+            var _ref6;
             const couponRef = hostRef.collection('coupons').doc(couponCode);
             const couponSnapshot = await couponRef.get();
             const coupon = couponSnapshot.data();
-            const percentOff = Number((_ref5 = coupon == null ? void 0 : coupon.percentOff) != null ? _ref5 : 0);
+            const percentOff = Number((_ref6 = coupon == null ? void 0 : coupon.percentOff) != null ? _ref6 : 0);
             const expired = (coupon == null ? void 0 : coupon.expiresAtMs) != null && Number(coupon.expiresAtMs) < Date.now();
             if (!coupon || coupon.enabled === false || expired || !(percentOff > 0 && percentOff <= 100)) {
                 // Deterministic and retryable — the shopper fixes the code and
@@ -767,13 +819,98 @@ import { quoteCartExtras } from "./checkout-extras.js";
                 };
             }
         }
+        // STORE CREDIT ANOTHER PLUGIN KEEPS (AGL-3640) — a rewards balance, a
+        // friend's referral credit — by its code, through core's checkout-credits
+        // seam; this plugin never reads the account. Held exactly like the gift
+        // card above: against what is LEFT after every other reduction, BEFORE
+        // Stripe is contacted, keyed by this attempt so a retry re-places the same
+        // hold. The webhook takes it in the transaction that writes the order, and
+        // a session that expires lets it go.
+        let releaseCreditHold = async ()=>undefined;
+        let creditHeldCents = 0;
+        if (creditCode) {
+            const refuseCredit = async (status, error)=>{
+                await releaseGiftCardHold();
+                await releasePromotionHolds();
+                await releaseStock();
+                await (claim == null ? void 0 : claim.release());
+                return res.status(status).json({
+                    error,
+                    creditCodeInvalid: true
+                });
+            };
+            const entry = checkoutCreditProviderForCode(creditCode);
+            const offered = entry ? await entry.provider.offered({
+                hostId,
+                channel: 'online'
+            }).catch(()=>false) : false;
+            if (!entry || !offered) return refuseCredit(400, CHECKOUT_CREDIT_INVALID_MESSAGE);
+            const account = normalizeCheckoutCreditAccount(await entry.provider.resolve({
+                hostId,
+                code: creditCode,
+                channel: 'online',
+                customerEmail: email || null,
+                staff: false
+            }).catch((error)=>{
+                console.error('Checkout credit resolve failed', entry.providerId, error);
+                return null;
+            }));
+            if ('error' in account) return refuseCredit(account.status, account.error);
+            const maxCents = Math.max(0, itemsCents - totalOffCents);
+            // The attempt's key, so a retry re-places the same hold; a request
+            // that sent none (an older client) still needs a key of its own.
+            const holdKey = claim.stripeKey || `cart:${cartId}:${randomUUID()}`;
+            const held = await entry.provider.hold({
+                hostId,
+                reference: account.reference,
+                holdKey,
+                maxCents,
+                currency: 'usd',
+                customerEmail: email || null,
+                nowMs: Date.now()
+            }).catch((error)=>{
+                console.error('Checkout credit hold failed', entry.providerId, error);
+                return {
+                    ok: false,
+                    status: 409,
+                    error: 'That rewards code cannot be used right now. Try again.'
+                };
+            });
+            if ('error' in held) {
+                return refuseCredit(held.status >= 400 && held.status < 500 ? held.status : 409, held.error);
+            }
+            const release = async ()=>{
+                await entry.provider.release({
+                    hostId,
+                    reference: account.reference,
+                    holdKey
+                });
+            };
+            creditHeldCents = boundedCreditCents(held.cents, maxCents);
+            if (creditHeldCents > 0) {
+                totalOffCents += creditHeldCents;
+                for (const [key, value] of Object.entries(encodeCheckoutCreditMetadata({
+                    providerId: entry.providerId,
+                    reference: account.reference,
+                    holdKey,
+                    amountCents: creditHeldCents,
+                    label: account.label,
+                    last4: account.last4
+                }))){
+                    params.set(`metadata[${key}]`, value);
+                }
+                releaseCreditHold = release;
+            } else {
+                await release();
+            }
+        }
         if (totalOffCents > 0) {
             const stripeCoupon = await fetch('https://api.stripe.com/v1/coupons', {
                 method: 'POST',
                 headers: _extends({
                     Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
                     'Content-Type': 'application/x-www-form-urlencoded'
-                }, stripeKeyHeader('coupon')),
+                }, stripeKeyHeader(creditHeldCents > 0 ? `coupon-c${creditHeldCents}` : 'coupon')),
                 body: new URLSearchParams({
                     amount_off: String(Math.min(totalOffCents, itemsCents)),
                     currency: 'usd',
@@ -785,6 +922,20 @@ import { quoteCartExtras } from "./checkout-extras.js";
                 // Scaled ONCE, by the reduction that actually reached the session.
                 feeCents = Math.round(feeCents * Math.max(0, itemsCents - totalOffCents) / Math.max(1, itemsCents));
                 chargedItemsCents = Math.max(0, itemsCents - totalOffCents);
+            } else if (creditHeldCents > 0) {
+                // A rewards balance that did not reach the price must not be taken
+                // from the member when the session is paid (AGL-3640): refuse, and
+                // hand back everything this attempt held, rather than sell at full
+                // price with their credit spent.
+                console.error('Stripe coupon error', stripeCoupon == null ? void 0 : stripeCoupon.error);
+                await releaseGiftCardHold();
+                await releaseCreditHold();
+                await releasePromotionHolds();
+                await releaseStock();
+                await claim.release();
+                return res.status(502).json({
+                    error: 'Checkout failed'
+                });
             }
         }
         // THE FLOOR (AGL-2232). A rate above zero on goods the shopper actually
@@ -915,6 +1066,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
             // BELOW the claim on this path, so release it: the merchant fixes the
             // setting and the shopper retries under the same key (AGL-1697).
             await releaseGiftCardHold();
+            await releaseCreditHold();
             await releasePromotionHolds();
             await releaseStock();
             await claim.release();
@@ -930,6 +1082,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
             // the undecided case above.
             // Below the claim here too, so release it for the same reason.
             await releaseGiftCardHold();
+            await releaseCreditHold();
             await releasePromotionHolds();
             await releaseStock();
             await claim.release();
@@ -968,6 +1121,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
                     // The same visible refusal as the store's own rate: never an
                     // untaxed session.
                     await releaseGiftCardHold();
+                    await releaseCreditHold();
                     await releasePromotionHolds();
                     await releaseStock();
                     await claim.release();
@@ -1012,6 +1166,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
                     // (AGL-1697); the retry re-derives the same digest, so Stripe
                     // replays any rate the first run did mint.
                     await releaseGiftCardHold();
+                    await releaseCreditHold();
                     await releasePromotionHolds();
                     await releaseStock();
                     await claim.release();
@@ -1066,6 +1221,10 @@ import { quoteCartExtras } from "./checkout-extras.js";
             shippingFloorCents: cartShippingFloorCents
         })).forEach(([key, value])=>params.set(key, value));
         params.set('metadata[type]', 'commerce-cart');
+        // How the order reaches the buyer (AGL-3624): the webhook routes it.
+        if (localPlan.kind === 'pickup' || localPlan.kind === 'local_delivery') {
+            appendLocalFulfillmentMetadata(params, localPlan.metadata);
+        }
         for (const [key, value] of Object.entries(taxEngineSessionMetadata(engineTax.stamp))){
             params.set(key, value);
         }
@@ -1112,7 +1271,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
         // and is identical on both checkout paths. This swaps the redirect's URL
         // pair for `ui_mode` + `return_url` and stops. Off unless the flag is on for
         // this org AND a publishable key exists; see `resolveNativeCheckoutMode`.
-        const nativeMode = await resolveNativeCheckoutMode(String((_ref2 = ownerOrg == null ? void 0 : (_ownerOrg_org2 = ownerOrg.org) == null ? void 0 : _ownerOrg_org2.id) != null ? _ref2 : ''));
+        const nativeMode = await resolveNativeCheckoutMode(String((_ref3 = ownerOrg == null ? void 0 : (_ownerOrg_org2 = ownerOrg.org) == null ? void 0 : _ownerOrg_org2.id) != null ? _ref3 : ''));
         if (nativeMode.native) {
             applyNativeCheckoutParams(params, `${backUrl}${separator}order=success&session_id={CHECKOUT_SESSION_ID}`);
         }
@@ -1128,7 +1287,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
             headers: _extends({
                 Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,
                 'Content-Type': 'application/x-www-form-urlencoded'
-            }, stripeKeyHeader(`${engineTax.stamp ? `session-tax-${(_ref3 = (_engineTax_quote = engineTax.quote) == null ? void 0 : _engineTax_quote.taxCents) != null ? _ref3 : 'own'}-${engineTax.stamp.status}` : 'session'}${extrasCents > 0 ? `-x${extrasCents}` : ''}`), nativeCheckoutStripeHeaders(nativeMode)),
+            }, stripeKeyHeader(`${engineTax.stamp ? `session-tax-${(_ref4 = (_engineTax_quote = engineTax.quote) == null ? void 0 : _engineTax_quote.taxCents) != null ? _ref4 : 'own'}-${engineTax.stamp.status}` : 'session'}${extrasCents > 0 ? `-x${extrasCents}` : ''}${creditHeldCents > 0 ? `-c${creditHeldCents}` : ''}`), nativeCheckoutStripeHeaders(nativeMode)),
             body: params.toString()
         });
         const session = await response.json();
@@ -1144,6 +1303,7 @@ import { quoteCartExtras } from "./checkout-extras.js";
             // does not lock this cart out. The retry re-derives the same derived
             // keys, so Stripe replays whatever objects the first run did create.
             await releaseGiftCardHold();
+            await releaseCreditHold();
             await releasePromotionHolds();
             await releaseStock();
             await claim.release();