@aglyn/plugins-commerce 1.0.0-beta.289 → 1.0.0-beta.290

package/src/lib/server/quote.d.ts

@@ -18,6 +18,9 @@ import { type PluginApiHandler, type PluginApiRequest } from '@aglyn/aglyn/serve
 import { type PluginPersonRecord, type PluginPersonSearchRequest } from '@aglyn/aglyn/plugin-manager/plugin-person-records';
 import { type SaleTaxEngineRequest, type SaleTaxEngineResult } from './tax-engine-quote';
 import { type CheckoutSessionExpiry } from './checkout-session-expiry';
+import type { quotePdfFile } from './commerce-pdf';
+import { type CommercePdfFile } from './pdf-response';
+import type { QuoteUploadCalls } from './quote-uploads';
 export interface QuoteDeps {
     verifyIdToken(token: string): Promise<{
         uid: string;
@@ -36,12 +39,23 @@ export interface QuoteDeps {
     expireSession(sessionId: string): Promise<CheckoutSessionExpiry>;
     /** The quote's pay link at a link version, or null when the site has no address or no signing secret. */
     payLinkUrl(host: Record<string, unknown>, hostId: string, quoteId: string, version: number): string | null;
+    /** The quote's PDF; loads the PDF writer and sharp only when asked. */
+    quotePdf(input: Parameters<typeof quotePdfFile>[0]): Promise<CommercePdfFile>;
+    /** The upload pipeline, loaded only by the proof actions. */
+    uploads(): Promise<QuoteUploadCalls>;
     now(): number;
 }
 export declare function defaultQuoteDeps(): QuoteDeps;
 type Outcome = {
     status: number;
     body: Record<string, unknown>;
+    pdf?: CommercePdfFile;
+    /** A proof or a customer's file, streamed by the handler. */
+    file?: {
+        path: string;
+        name: string;
+        contentType: string;
+    };
 };
 export declare function handleQuote(deps: QuoteDeps, req: PluginApiRequest): Promise<Outcome>;
 /** `POST /api/commerce/quote`. */

package/src/lib/server/quote.js

@@ -26,6 +26,7 @@ import { commerceSitePermissionRefusal } from "../model/plugin-permissions.js";
 import { holdsCommerceSiteKey } from "./commerce-site-keys.js";
 import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
 import { expireCheckoutSession } from "./checkout-session-expiry.js";
+import { sendPdf } from "./pdf-response.js";
 import { quotePayLinkUrl } from "./quote-link-token.js";
 export function defaultQuoteDeps() {
     return {
@@ -42,6 +43,8 @@ export function defaultQuoteDeps() {
         quoteTax: (request)=>quoteSaleTaxWithEngine(request),
         expireSession: (sessionId)=>expireCheckoutSession(sessionId),
         payLinkUrl: (host, hostId, quoteId, version)=>quotePayLinkUrl(host, hostId, quoteId, version),
+        quotePdf: async (input)=>(await import("./commerce-pdf.js")).quotePdfFile(input),
+        uploads: async ()=>(await import("./quote-uploads.js")).quoteUploadCalls(),
         now: ()=>Date.now()
     };
 }
@@ -281,6 +284,54 @@ export async function handleQuote(deps, req) {
             }
         };
     }
+    if (PROOF_ACTIONS.has(action)) {
+        var _body_quoteId2;
+        const quoteId = String((_body_quoteId2 = body['quoteId']) != null ? _body_quoteId2 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        return handleProofAction(deps, {
+            action,
+            body,
+            hostId,
+            quoteId,
+            hostRef,
+            firestore,
+            uid: decoded.uid,
+            actor
+        });
+    }
+    if (action === 'pdf') {
+        var _body_quoteId3, _host_data1;
+        const quoteId = String((_body_quoteId3 = body['quoteId']) != null ? _body_quoteId3 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        const [snapshot, store] = await Promise.all([
+            hostRef.collection('orders').doc(quoteId).get(),
+            hostRef.collection('settings').doc('store').get()
+        ]);
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
+        const hostData = (_host_data1 = host.data()) != null ? _host_data1 : {};
+        // The pay link is "Send quotes and invoices to customers"; without it the PDF leaves the link off.
+        const payUrl = CommerceModel.isUnpaidQuote(order) && holdsCommerceSiteKey(host, decoded.uid, 'commerce.quotes.send') ? deps.payLinkUrl(hostData, hostId, quoteId, CommerceModel.quoteLinkVersion(order.quote)) : null;
+        try {
+            var _store_data;
+            const pdf = await deps.quotePdf({
+                hostId,
+                quoteId,
+                order,
+                host: hostData,
+                store: (_store_data = store.data()) != null ? _store_data : null,
+                payUrl
+            });
+            return {
+                status: 200,
+                body: {},
+                pdf
+            };
+        } catch (error) {
+            console.error('commerce quote pdf failed', error);
+            return refuse(500, 'The PDF could not be made. Try again.');
+        }
+    }
     if (action === 'search-customers') {
         var _body_text;
         const text = String((_body_text = body['text']) != null ? _body_text : '').trim().slice(0, 120);
@@ -332,8 +383,8 @@ export async function handleQuote(deps, req) {
         if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
         const ref = hostRef.collection('orders').doc(quoteId);
         const deleted = await firestore.runTransaction(async (transaction)=>{
-            var _ref;
-            var _order_quote;
+            var _ref, _ref1;
+            var _order_quote, _order_quote1;
             const snapshot = await transaction.get(ref);
             // Already gone is what a retried delete finds.
             if (!snapshot.exists) return {
@@ -350,6 +401,11 @@ export async function handleQuote(deps, req) {
             if (((_ref = (_order_quote = order.quote) == null ? void 0 : _order_quote.stage) != null ? _ref : 'draft') !== 'draft') {
                 return refuse(409, 'Only a draft quote can be deleted.');
             }
+            // Earlier revisions are what the customer was shown and answered; a
+            // quote that has them stays on record.
+            if (Number((_ref1 = (_order_quote1 = order.quote) == null ? void 0 : _order_quote1.revision) != null ? _ref1 : 1) > 1) {
+                return refuse(409, 'This quote has earlier revisions the customer saw, so it stays on record.');
+            }
             transaction.delete(ref);
             return {
                 status: 200,
@@ -363,6 +419,8 @@ export async function handleQuote(deps, req) {
             "closeSession"
         ]);
         await closeOpenSession(deps, closeSession, 'quote deleted');
+        // Its proofs and anything the customer sent go with it.
+        if (outcome.status === 200) await removeQuoteFiles(deps, hostId, quoteId);
         return outcome;
     }
     if (action !== 'create' && action !== 'update') return refuse(400, 'Unknown action');
@@ -505,8 +563,283 @@ export async function handleQuote(deps, req) {
         return refuse(500, 'The quote could not be saved');
     }
 }
+/*==========================================
+ * PROOFS AND REVISIONS (AGL-4096)
+ *=========================================*/ const PROOF_ACTIONS = new Set([
+    'proof-ticket',
+    'proof-finalize',
+    'proof-remove',
+    'start-revision',
+    'revisions',
+    'file'
+]);
+/** Deletes a quote's kept files, its proofs and the customer's artwork; never throws. */ async function removeQuoteFiles(deps, hostId, quoteId) {
+    try {
+        const uploads = await deps.uploads();
+        await Promise.all([
+            CommerceModel.QUOTE_PROOF_PURPOSE,
+            CommerceModel.QUOTE_ARTWORK_PURPOSE
+        ].map((purpose)=>uploads.removeAll({
+                hostId,
+                purpose,
+                purposeId: quoteId
+            })));
+    } catch (error) {
+        console.error('quote files were not removed', {
+            hostId,
+            quoteId,
+            error
+        });
+    }
+}
+/** A file as the console is told about it: everything but where it is kept. */ function fileView(file) {
+    const rest = _extends({}, file);
+    delete rest.path;
+    return rest;
+}
+/** A revision as the console's history lists it. */ function revisionView(snapshot) {
+    var _snapshot_proofs, _snapshot_responses;
+    return _extends({}, snapshot, {
+        proofs: ((_snapshot_proofs = snapshot.proofs) != null ? _snapshot_proofs : []).map(fileView),
+        responses: ((_snapshot_responses = snapshot.responses) != null ? _snapshot_responses : []).map((response)=>_extends({}, response, response.files ? {
+                files: response.files.map(fileView)
+            } : {}))
+    });
+}
+/**
+ * Writes `next` over the quote in `transaction`, without the pay page's open
+ * session, which was priced from the quote as it stood; the caller closes it.
+ */ function writeEditedQuote(transaction, ref, next) {
+    const rest = _extends({}, next);
+    const session = rest.checkoutSessionId;
+    delete rest.checkoutSessionId;
+    transaction.set(ref, rest);
+    return session;
+}
+async function handleProofAction(deps, context) {
+    const { action, body, hostId, quoteId, hostRef, firestore, uid, actor } = context;
+    const ref = hostRef.collection('orders').doc(quoteId);
+    const proofScope = {
+        hostId,
+        purpose: CommerceModel.QUOTE_PROOF_PURPOSE,
+        purposeId: quoteId
+    };
+    if (action === 'revisions' || action === 'file') {
+        var _order_quote_revision, _body_fileId, _order_quote_responses, _ref, _ref1;
+        const snapshot = await ref.get();
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
+        const current = Number((_order_quote_revision = order.quote.revision) != null ? _order_quote_revision : 1);
+        const wanted = body['revision'] === undefined || body['revision'] === null ? current : Number(body['revision']);
+        let snapshots = [];
+        if (action === 'revisions' || wanted !== current) {
+            const listed = await ref.collection('revisions').get();
+            snapshots = listed.docs.map((entry)=>entry.data()).filter((entry)=>Number.isInteger(Number(entry == null ? void 0 : entry.revision))).sort((a, b)=>Number(a.revision) - Number(b.revision));
+        }
+        if (action === 'revisions') return {
+            status: 200,
+            body: {
+                revisions: snapshots.map(revisionView)
+            }
+        };
+        const fileId = String((_body_fileId = body['fileId']) != null ? _body_fileId : '');
+        const source = wanted === current ? {
+            proofs: CommerceModel.currentQuoteProofs(order.quote),
+            responses: (_order_quote_responses = order.quote.responses) != null ? _order_quote_responses : []
+        } : snapshots.find((entry)=>Number(entry.revision) === wanted);
+        const files = [
+            ...(_ref = source == null ? void 0 : source.proofs) != null ? _ref : [],
+            ...((_ref1 = source == null ? void 0 : source.responses) != null ? _ref1 : []).flatMap((response)=>{
+                var _response_files;
+                return (_response_files = response.files) != null ? _response_files : [];
+            })
+        ];
+        const file = files.find((entry)=>entry.id === fileId);
+        if (!(file == null ? void 0 : file.path)) return refuse(404, 'That file is no longer on this quote.');
+        return {
+            status: 200,
+            body: {},
+            file: {
+                path: file.path,
+                name: file.name,
+                contentType: file.contentType
+            }
+        };
+    }
+    if (action === 'proof-ticket') {
+        const snapshot = await ref.get();
+        const order = snapshot.exists ? snapshot.data() : null;
+        const refused = CommerceModel.quoteProofChangeRefusal(order, 'add');
+        if (refused) return refuse(refused === 'not-a-quote' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(refused));
+        // Storage is spent here, so the plan must sell, as a save's must.
+        const owner = await deps.orgForHost(hostId);
+        if (!checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) return refuse(403, 'Selling is not enabled');
+        const uploads = await deps.uploads();
+        const minted = await uploads.mint({
+            scope: proofScope,
+            request: body['file'],
+            caller: {
+                uid
+            }
+        });
+        if ('error' in minted) return refuse(minted.status, minted.error);
+        return {
+            status: 200,
+            body: {
+                ticket: minted.ticket,
+                upload: minted.upload,
+                file: minted.file
+            }
+        };
+    }
+    if (action === 'proof-finalize') {
+        const uploads = await deps.uploads();
+        const kept = await uploads.finalize({
+            scope: proofScope,
+            ticket: body['ticket'],
+            caller: {
+                uid
+            }
+        });
+        if ('error' in kept) return refuse(kept.status, kept.error);
+        const now = deps.now();
+        const answer = await firestore.runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const order = snapshot.exists ? snapshot.data() : null;
+            if (!order) return {
+                outcome: refuse(404, 'Unknown quote')
+            };
+            // A retried finalize finds its proof already on the quote.
+            const already = CommerceModel.currentQuoteProofs(order.quote).find((proof)=>proof.id === kept.file.id);
+            if (already) {
+                var _ref;
+                var _order_quote;
+                return {
+                    outcome: {
+                        status: 200,
+                        body: {
+                            proof: fileView(already),
+                            updatedAtMs: (_ref = (_order_quote = order.quote) == null ? void 0 : _order_quote.updatedAtMs) != null ? _ref : null
+                        }
+                    }
+                };
+            }
+            const added = CommerceModel.withQuoteProofAdded(order, {
+                id: kept.file.id,
+                name: kept.file.name,
+                contentType: kept.file.contentType,
+                size: kept.file.size,
+                path: kept.file.path
+            }, {
+                atMs: now,
+                by: actor
+            });
+            if ('reason' in added) {
+                return {
+                    outcome: refuse(added.reason === 'not-a-quote' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(added.reason))
+                };
+            }
+            const closeSession = writeEditedQuote(transaction, ref, added.order);
+            return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        proof: fileView(added.proof),
+                        updatedAtMs: now
+                    }
+                },
+                closeSession
+            };
+        });
+        if (answer.outcome.status !== 200) await uploads.remove(kept.file.path).catch(()=>undefined);
+        await closeOpenSession(deps, answer.closeSession, 'quote proof added');
+        return answer.outcome;
+    }
+    if (action === 'proof-remove') {
+        var _body_proofId;
+        const proofId = String((_body_proofId = body['proofId']) != null ? _body_proofId : '');
+        const now = deps.now();
+        const answer = await firestore.runTransaction(async (transaction)=>{
+            const snapshot = await transaction.get(ref);
+            const order = snapshot.exists ? snapshot.data() : null;
+            if (!order) return {
+                outcome: refuse(404, 'Unknown quote')
+            };
+            const removed = CommerceModel.withQuoteProofRemoved(order, proofId, {
+                atMs: now,
+                by: actor
+            });
+            if ('reason' in removed) {
+                return {
+                    outcome: refuse(removed.reason === 'not-a-quote' || removed.reason === 'unknown-proof' ? 404 : 409, CommerceModel.quoteProofRefusalMessage(removed.reason))
+                };
+            }
+            const closeSession = writeEditedQuote(transaction, ref, removed.order);
+            return {
+                outcome: {
+                    status: 200,
+                    body: {
+                        removed: true,
+                        updatedAtMs: now
+                    }
+                },
+                closeSession,
+                path: removed.proof.path
+            };
+        });
+        if (answer.path) {
+            const uploads = await deps.uploads();
+            await uploads.remove(answer.path).catch((error)=>console.error('quote proof file was not deleted', error));
+        }
+        await closeOpenSession(deps, answer.closeSession, 'quote proof removed');
+        return answer.outcome;
+    }
+    // start-revision
+    const now = deps.now();
+    const answer = await firestore.runTransaction(async (transaction)=>{
+        const snapshot = await transaction.get(ref);
+        const order = snapshot.exists ? snapshot.data() : null;
+        if (!order) return {
+            outcome: refuse(404, 'Unknown quote')
+        };
+        const started = CommerceModel.startQuoteRevision(order, {
+            atMs: now,
+            by: actor
+        });
+        if ('reason' in started) return {
+            outcome: refuse(started.reason === 'paid' ? 409 : 404, started.error)
+        };
+        const revisionRef = ref.collection('revisions').doc(String(started.revision));
+        // A revision on record is never written over.
+        if ((await transaction.get(revisionRef)).exists) {
+            return {
+                outcome: refuse(409, `Revision ${started.revision} is already on record. Close the quote and open it again.`)
+            };
+        }
+        transaction.set(revisionRef, started.snapshot);
+        const closeSession = writeEditedQuote(transaction, ref, started.order);
+        return {
+            outcome: {
+                status: 200,
+                body: {
+                    revision: started.revision + 1,
+                    updatedAtMs: now
+                }
+            },
+            closeSession
+        };
+    });
+    await closeOpenSession(deps, answer.closeSession, 'quote revision started');
+    return answer.outcome;
+}
 /** `POST /api/commerce/quote`. */ export const quoteHandler = async (req, res)=>{
-    const outcome = await handleQuote(defaultQuoteDeps(), req);
+    const deps = defaultQuoteDeps();
+    const outcome = await handleQuote(deps, req);
+    if (outcome.pdf) return sendPdf(res, outcome.pdf);
+    if (outcome.file) {
+        const uploads = await deps.uploads();
+        return uploads.send(res, outcome.file);
+    }
     return res.status(outcome.status).json(outcome.body);
 };