@aglyn/plugins-commerce 1.0.0-beta.289 → 1.0.0-beta.291

package/src/lib/server/pdf-response.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * How a route answers with a quote's or an invoice's PDF (AGL-4095). Kept
+ * apart from `commerce-pdf.ts`, which makes the file, so a route sends one
+ * without loading the PDF writer or sharp.
+ */
+export interface CommercePdfFile {
+    bytes: Uint8Array;
+    /** ASCII, ending `.pdf`. */
+    filename: string;
+}
+/** The headers a PDF answer carries: a download, never cached, indexed or referred on. */
+export declare function pdfResponseHeaders(file: CommercePdfFile): Record<string, string>;
+/** Sends a PDF on the (req, res) shape. */
+export declare function sendPdf(res: Parameters<PluginApiHandler>[1], file: CommercePdfFile): void;

package/src/lib/server/pdf-response.js

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /** The headers a PDF answer carries: a download, never cached, indexed or referred on. */ export function pdfResponseHeaders(file) {
+    return {
+        'Content-Type': 'application/pdf',
+        'Content-Disposition': `attachment; filename="${file.filename}"`,
+        'Cache-Control': 'private, no-store',
+        'X-Robots-Tag': 'noindex, nofollow',
+        'Referrer-Policy': 'no-referrer'
+    };
+}
+/** Sends a PDF on the (req, res) shape. */ export function sendPdf(res, file) {
+    for (const [name, value] of Object.entries(pdfResponseHeaders(file)))res.setHeader(name, value);
+    res.status(200).send(Buffer.from(file.bytes));
+}
+
+//# sourceMappingURL=pdf-response.js.map

package/src/lib/server/pdf-response.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/pdf-response.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginApiHandler } from '@aglyn/aglyn/server'\n\n/**\n * How a route answers with a quote's or an invoice's PDF (AGL-4095). Kept\n * apart from `commerce-pdf.ts`, which makes the file, so a route sends one\n * without loading the PDF writer or sharp.\n */\n\nexport interface CommercePdfFile {\n  bytes: Uint8Array\n  /** ASCII, ending `.pdf`. */\n  filename: string\n}\n\n/** The headers a PDF answer carries: a download, never cached, indexed or referred on. */\nexport function pdfResponseHeaders(file: CommercePdfFile): Record<string, string> {\n  return {\n    'Content-Type': 'application/pdf',\n    'Content-Disposition': `attachment; filename=\"${file.filename}\"`,\n    'Cache-Control': 'private, no-store',\n    'X-Robots-Tag': 'noindex, nofollow',\n    'Referrer-Policy': 'no-referrer',\n  }\n}\n\n/** Sends a PDF on the (req, res) shape. */\nexport function sendPdf(res: Parameters<PluginApiHandler>[1], file: CommercePdfFile): void {\n  for (const [name, value] of Object.entries(pdfResponseHeaders(file))) res.setHeader(name, value)\n  res.status(200).send(Buffer.from(file.bytes))\n}\n"],"names":["pdfResponseHeaders","file","filename","sendPdf","res","name","value","Object","entries","setHeader","status","send","Buffer","from","bytes"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAgBD,wFAAwF,GACxF,OAAO,SAASA,mBAAmBC,IAAqB;IACtD,OAAO;QACL,gBAAgB;QAChB,uBAAuB,CAAC,sBAAsB,EAAEA,KAAKC,QAAQ,CAAC,CAAC,CAAC;QAChE,iBAAiB;QACjB,gBAAgB;QAChB,mBAAmB;IACrB;AACF;AAEA,yCAAyC,GACzC,OAAO,SAASC,QAAQC,GAAoC,EAAEH,IAAqB;IACjF,KAAK,MAAM,CAACI,MAAMC,MAAM,IAAIC,OAAOC,OAAO,CAACR,mBAAmBC,OAAQG,IAAIK,SAAS,CAACJ,MAAMC;IAC1FF,IAAIM,MAAM,CAAC,KAAKC,IAAI,CAACC,OAAOC,IAAI,CAACZ,KAAKa,KAAK;AAC7C"}

package/src/lib/server/person-eraser.d.ts

@@ -48,8 +48,9 @@ export declare function erasedOrderPatch(data: FirebaseFirestore.DocumentData |
 /**
  * A quote's customer, erased (AGL-4093). An unpaid quote keeps its customer
  * in its `quote` section rather than on the order's own fields, so it is
- * found by `quote.customer.emailLower` and loses the person and both
- * addresses; its lines and totals stay, as an order's do.
+ * found by `quote.customer.emailLower` and loses the person, both
+ * addresses and the address each email went to; its lines and totals stay,
+ * as an order's do.
  */
 export declare function erasedQuotePatch(data: FirebaseFirestore.DocumentData | undefined, now: number): Record<string, unknown>;
 export declare function erasedCheckInPatch(data: FirebaseFirestore.DocumentData | undefined, now: number): Record<string, unknown>;

package/src/lib/server/person-eraser.js

@@ -19,9 +19,19 @@ import { FieldValue } from "firebase-admin/firestore";
 import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
 const LABEL = 'commerce person eraser';
 /** Where a quote keeps its customer's address (`commerce-quotes.ts`). */ const QUOTE_EMAIL_FIELD = 'quote.customer.emailLower';
+/**
+ * Each time the order's invoice was emailed names where it went (AGL-4099);
+ * the record of the send stays, without the address.
+ */ function erasedInvoiceSends(data) {
+    return Array.isArray(data == null ? void 0 : data['invoiceSends']) ? {
+        invoiceSends: data['invoiceSends'].map((send)=>_extends({}, send, {
+                to: ''
+            }))
+    } : {};
+}
 /** The patch that takes the buyer off one order, as it stands. */ export function erasedOrderPatch(data, now) {
     const addressTokens = new Set(Array.isArray(data == null ? void 0 : data['customerEmailTokens']) ? data['customerEmailTokens'] : []);
-    return _extends({
+    return _extends({}, erasedInvoiceSends(data), {
         customerEmail: null,
         customerName: null,
         shippingAddress: FieldValue.delete(),
@@ -36,19 +46,28 @@ const LABEL = 'commerce person eraser';
 /** The patch that takes the customer off one check-in at the window (AGL-4043). */ /**
  * A quote's customer, erased (AGL-4093). An unpaid quote keeps its customer
  * in its `quote` section rather than on the order's own fields, so it is
- * found by `quote.customer.emailLower` and loses the person and both
- * addresses; its lines and totals stay, as an order's do.
+ * found by `quote.customer.emailLower` and loses the person, both
+ * addresses and the address each email went to; its lines and totals stay,
+ * as an order's do.
  */ export function erasedQuotePatch(data, now) {
     var _ref;
     const quote = (_ref = data == null ? void 0 : data['quote']) != null ? _ref : {};
-    return {
+    // Each time it was emailed names where it went (AGL-4097); the record of
+    // the send stays, without the address.
+    const sends = Array.isArray(quote['sends']) ? {
+        sends: quote['sends'].map((send)=>_extends({}, send, {
+                to: ''
+            }))
+    } : {};
+    return _extends({
         quote: _extends({}, quote, {
             customer: {},
             billTo: null,
             shipTo: null
-        }),
+        }, sends)
+    }, erasedInvoiceSends(data), {
         customerErasedAtMs: now
-    };
+    });
 }
 export function erasedCheckInPatch(data, now) {
     var _ref, _ref1;

package/src/lib/server/person-eraser.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/person-eraser.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  PluginPersonEraser,\n  PluginPersonErasureReport,\n} from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport { updateWhereEquals } from '@aglyn/tenant-data-admin/server/paged-sweeps'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\n\n/**\n * COMMERCE'S SHARE OF A PERSON ERASURE (AGL-2623, AGL-3080).\n *\n * An order is the merchant's record of a sale: the amounts, the line items\n * and the tax are theirs to keep and the law expects them kept. So the person\n * is taken OFF every order they placed on a site of the workspace — name,\n * email, both addresses — and a stamp says when; the order itself stays.\n *\n * The address also lives in what the orders list queries by (AGL-3321): its\n * lower-cased key, its search prefixes, and the quick search's token array,\n * which holds those prefixes beside the order number's and the item names'.\n * The first two go; the prefixes are taken back out of the third. A prefix\n * the number or an item name shares with the address goes with it — a search\n * for that prefix misses this order until the orders backfill restamps it —\n * and nothing left on the order answers to the address.\n *\n * A check-in at the window (AGL-4043) copies the buyer's name, address and\n * phone, so the same person is taken off each of theirs, by the stored\n * lower-cased address; the check-in itself — who was due, who checked them\n * in, the wristband — stays, as the order does.\n *\n * A DRY RUN counts the orders and check-ins and writes nothing.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\nexport interface CommercePersonEraserDeps {\n  firestore(): Firestore\n}\n\nconst LABEL = 'commerce person eraser'\n\n/** Where a quote keeps its customer's address (`commerce-quotes.ts`). */\nconst QUOTE_EMAIL_FIELD = 'quote.customer.emailLower'\n\n/** The patch that takes the buyer off one order, as it stands. */\nexport function erasedOrderPatch(\n  data: FirebaseFirestore.DocumentData | undefined,\n  now: number,\n): Record<string, unknown> {\n  const addressTokens = new Set(\n    Array.isArray(data?.['customerEmailTokens']) ? data['customerEmailTokens'] : [],\n  )\n  return {\n    customerEmail: null,\n    customerName: null,\n    shippingAddress: FieldValue.delete(),\n    billingAddress: FieldValue.delete(),\n    customerErasedAtMs: now,\n    customerEmailLower: null,\n    customerEmailTokens: [],\n    ...(Array.isArray(data?.['searchTokens'])\n      ? {\n          searchTokens: (data['searchTokens'] as unknown[]).filter(\n            (token) => !addressTokens.has(token),\n          ),\n        }\n      : {}),\n  }\n}\n\n/** The patch that takes the customer off one check-in at the window (AGL-4043). */\n/**\n * A quote's customer, erased (AGL-4093). An unpaid quote keeps its customer\n * in its `quote` section rather than on the order's own fields, so it is\n * found by `quote.customer.emailLower` and loses the person and both\n * addresses; its lines and totals stay, as an order's do.\n */\nexport function erasedQuotePatch(\n  data: FirebaseFirestore.DocumentData | undefined,\n  now: number,\n): Record<string, unknown> {\n  const quote = (data?.['quote'] ?? {}) as Record<string, unknown>\n  return {\n    quote: { ...quote, customer: {}, billTo: null, shipTo: null },\n    customerErasedAtMs: now,\n  }\n}\n\nexport function erasedCheckInPatch(\n  data: FirebaseFirestore.DocumentData | undefined,\n  now: number,\n): Record<string, unknown> {\n  // One key per order or stay, so the people one order brought still read\n  // as one party, and as nobody's name.\n  const source = String(data?.['orderId'] ?? data?.['reservationId'] ?? '')\n  return {\n    customerKey: `erased:${source}`,\n    customerName: null,\n    customerEmail: null,\n    customerEmailLower: null,\n    customerPhone: null,\n    contactId: null,\n    searchTokens: [],\n    customerErasedAtMs: now,\n  }\n}\n\nexport function createCommercePersonEraser(deps: CommercePersonEraserDeps): PluginPersonEraser {\n  return async ({ orgId, email, dryRun, atMs }): Promise<PluginPersonErasureReport> => {\n    const db = deps.firestore()\n    const hosts = await db.collection('hosts').where('orgId', '==', orgId).get()\n    let orders = 0\n    let checkIns = 0\n    let quotes = 0\n    const emailLower = email.trim().toLowerCase()\n    for (const host of hosts.docs) {\n      const placed = host.ref.collection('orders')\n      const checked = host.ref.collection('checkIns')\n      if (dryRun) {\n        orders += (await placed.where('customerEmail', '==', email).get()).size\n        checkIns += (await checked.where('customerEmailLower', '==', emailLower).get()).size\n        quotes += (await placed.where(QUOTE_EMAIL_FIELD, '==', emailLower).get()).size\n        continue\n      }\n      checkIns += await updateWhereEquals(\n        db,\n        checked,\n        'customerEmailLower',\n        emailLower,\n        (data) => erasedCheckInPatch(data, atMs),\n        LABEL,\n      )\n      orders += await updateWhereEquals(\n        db,\n        placed,\n        'customerEmail',\n        email,\n        (data) => erasedOrderPatch(data, atMs),\n        LABEL,\n      )\n      quotes += await updateWhereEquals(\n        db,\n        placed,\n        QUOTE_EMAIL_FIELD,\n        emailLower,\n        (data) => erasedQuotePatch(data, atMs),\n        LABEL,\n      )\n    }\n    return { orders, checkIns, quotes }\n  }\n}\n\n/** The eraser over the platform's own Firestore, as the declarations register it. */\nexport const commercePersonEraser: PluginPersonEraser = (request) =>\n  createCommercePersonEraser({ firestore: () => firebaseAdmin.app().firestore() })(request)\n"],"names":["updateWhereEquals","FieldValue","firebaseAdmin","LABEL","QUOTE_EMAIL_FIELD","erasedOrderPatch","data","now","addressTokens","Set","Array","isArray","customerEmail","customerName","shippingAddress","delete","billingAddress","customerErasedAtMs","customerEmailLower","customerEmailTokens","searchTokens","filter","token","has","erasedQuotePatch","quote","customer","billTo","shipTo","erasedCheckInPatch","source","String","customerKey","customerPhone","contactId","createCommercePersonEraser","deps","orgId","email","dryRun","atMs","db","firestore","hosts","collection","where","get","orders","checkIns","quotes","emailLower","trim","toLowerCase","host","docs","placed","ref","checked","size","commercePersonEraser","request","app"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAMD,SAASA,iBAAiB,QAAQ,+CAA8C;AAChF,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,aAAa,QAAQ,iDAAgD;AAgC9E,MAAMC,QAAQ;AAEd,uEAAuE,GACvE,MAAMC,oBAAoB;AAE1B,gEAAgE,GAChE,OAAO,SAASC,iBACdC,IAAgD,EAChDC,GAAW;IAEX,MAAMC,gBAAgB,IAAIC,IACxBC,MAAMC,OAAO,CAACL,wBAAAA,IAAM,CAAC,sBAAsB,IAAIA,IAAI,CAAC,sBAAsB,GAAG,EAAE;IAEjF,OAAO;QACLM,eAAe;QACfC,cAAc;QACdC,iBAAiBb,WAAWc,MAAM;QAClCC,gBAAgBf,WAAWc,MAAM;QACjCE,oBAAoBV;QACpBW,oBAAoB;QACpBC,qBAAqB,EAAE;OACnBT,MAAMC,OAAO,CAACL,wBAAAA,IAAM,CAAC,eAAe,IACpC;QACEc,cAAc,AAACd,IAAI,CAAC,eAAe,CAAee,MAAM,CACtD,CAACC,QAAU,CAACd,cAAce,GAAG,CAACD;IAElC,IACA,CAAC;AAET;AAEA,iFAAiF,GACjF;;;;;CAKC,GACD,OAAO,SAASE,iBACdlB,IAAgD,EAChDC,GAAW;;IAEX,MAAMkB,gBAASnB,wBAAAA,IAAM,CAAC,QAAQ,mBAAI,CAAC;IACnC,OAAO;QACLmB,OAAO,aAAKA;YAAOC,UAAU,CAAC;YAAGC,QAAQ;YAAMC,QAAQ;;QACvDX,oBAAoBV;IACtB;AACF;AAEA,OAAO,SAASsB,mBACdvB,IAAgD,EAChDC,GAAW;QAIWD;IAFtB,wEAAwE;IACxE,sCAAsC;IACtC,MAAMwB,SAASC,QAAOzB,gBAAAA,wBAAAA,IAAM,CAAC,UAAU,oBAAIA,wBAAAA,IAAM,CAAC,gBAAgB,YAA5CA,OAAgD;IACtE,OAAO;QACL0B,aAAa,CAAC,OAAO,EAAEF,QAAQ;QAC/BjB,cAAc;QACdD,eAAe;QACfM,oBAAoB;QACpBe,eAAe;QACfC,WAAW;QACXd,cAAc,EAAE;QAChBH,oBAAoBV;IACtB;AACF;AAEA,OAAO,SAAS4B,2BAA2BC,IAA8B;IACvE,OAAO,OAAO,EAAEC,KAAK,EAAEC,KAAK,EAAEC,MAAM,EAAEC,IAAI,EAAE;QAC1C,MAAMC,KAAKL,KAAKM,SAAS;QACzB,MAAMC,QAAQ,MAAMF,GAAGG,UAAU,CAAC,SAASC,KAAK,CAAC,SAAS,MAAMR,OAAOS,GAAG;QAC1E,IAAIC,SAAS;QACb,IAAIC,WAAW;QACf,IAAIC,SAAS;QACb,MAAMC,aAAaZ,MAAMa,IAAI,GAAGC,WAAW;QAC3C,KAAK,MAAMC,QAAQV,MAAMW,IAAI,CAAE;YAC7B,MAAMC,SAASF,KAAKG,GAAG,CAACZ,UAAU,CAAC;YACnC,MAAMa,UAAUJ,KAAKG,GAAG,CAACZ,UAAU,CAAC;YACpC,IAAIL,QAAQ;gBACVQ,UAAU,AAAC,CAAA,MAAMQ,OAAOV,KAAK,CAAC,iBAAiB,MAAMP,OAAOQ,GAAG,EAAC,EAAGY,IAAI;gBACvEV,YAAY,AAAC,CAAA,MAAMS,QAAQZ,KAAK,CAAC,sBAAsB,MAAMK,YAAYJ,GAAG,EAAC,EAAGY,IAAI;gBACpFT,UAAU,AAAC,CAAA,MAAMM,OAAOV,KAAK,CAACzC,mBAAmB,MAAM8C,YAAYJ,GAAG,EAAC,EAAGY,IAAI;gBAC9E;YACF;YACAV,YAAY,MAAMhD,kBAChByC,IACAgB,SACA,sBACAP,YACA,CAAC5C,OAASuB,mBAAmBvB,MAAMkC,OACnCrC;YAEF4C,UAAU,MAAM/C,kBACdyC,IACAc,QACA,iBACAjB,OACA,CAAChC,OAASD,iBAAiBC,MAAMkC,OACjCrC;YAEF8C,UAAU,MAAMjD,kBACdyC,IACAc,QACAnD,mBACA8C,YACA,CAAC5C,OAASkB,iBAAiBlB,MAAMkC,OACjCrC;QAEJ;QACA,OAAO;YAAE4C;YAAQC;YAAUC;QAAO;IACpC;AACF;AAEA,mFAAmF,GACnF,OAAO,MAAMU,uBAA2C,CAACC,UACvDzB,2BAA2B;QAAEO,WAAW,IAAMxC,cAAc2D,GAAG,GAAGnB,SAAS;IAAG,GAAGkB,SAAQ"}
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/server/person-eraser.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  PluginPersonEraser,\n  PluginPersonErasureReport,\n} from '@aglyn/aglyn/plugin-manager/plugin-person-erasure'\nimport { updateWhereEquals } from '@aglyn/tenant-data-admin/server/paged-sweeps'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\n\n/**\n * COMMERCE'S SHARE OF A PERSON ERASURE (AGL-2623, AGL-3080).\n *\n * An order is the merchant's record of a sale: the amounts, the line items\n * and the tax are theirs to keep and the law expects them kept. So the person\n * is taken OFF every order they placed on a site of the workspace — name,\n * email, both addresses — and a stamp says when; the order itself stays.\n *\n * The address also lives in what the orders list queries by (AGL-3321): its\n * lower-cased key, its search prefixes, and the quick search's token array,\n * which holds those prefixes beside the order number's and the item names'.\n * The first two go; the prefixes are taken back out of the third. A prefix\n * the number or an item name shares with the address goes with it — a search\n * for that prefix misses this order until the orders backfill restamps it —\n * and nothing left on the order answers to the address.\n *\n * A check-in at the window (AGL-4043) copies the buyer's name, address and\n * phone, so the same person is taken off each of theirs, by the stored\n * lower-cased address; the check-in itself — who was due, who checked them\n * in, the wristband — stays, as the order does.\n *\n * A DRY RUN counts the orders and check-ins and writes nothing.\n */\n\ntype Firestore = FirebaseFirestore.Firestore\n\nexport interface CommercePersonEraserDeps {\n  firestore(): Firestore\n}\n\nconst LABEL = 'commerce person eraser'\n\n/** Where a quote keeps its customer's address (`commerce-quotes.ts`). */\nconst QUOTE_EMAIL_FIELD = 'quote.customer.emailLower'\n\n/**\n * Each time the order's invoice was emailed names where it went (AGL-4099);\n * the record of the send stays, without the address.\n */\nfunction erasedInvoiceSends(data: FirebaseFirestore.DocumentData | undefined): Record<string, unknown> {\n  return Array.isArray(data?.['invoiceSends'])\n    ? { invoiceSends: (data['invoiceSends'] as Array<Record<string, unknown>>).map((send) => ({ ...send, to: '' })) }\n    : {}\n}\n\n/** The patch that takes the buyer off one order, as it stands. */\nexport function erasedOrderPatch(\n  data: FirebaseFirestore.DocumentData | undefined,\n  now: number,\n): Record<string, unknown> {\n  const addressTokens = new Set(\n    Array.isArray(data?.['customerEmailTokens']) ? data['customerEmailTokens'] : [],\n  )\n  return {\n    ...erasedInvoiceSends(data),\n    customerEmail: null,\n    customerName: null,\n    shippingAddress: FieldValue.delete(),\n    billingAddress: FieldValue.delete(),\n    customerErasedAtMs: now,\n    customerEmailLower: null,\n    customerEmailTokens: [],\n    ...(Array.isArray(data?.['searchTokens'])\n      ? {\n          searchTokens: (data['searchTokens'] as unknown[]).filter(\n            (token) => !addressTokens.has(token),\n          ),\n        }\n      : {}),\n  }\n}\n\n/** The patch that takes the customer off one check-in at the window (AGL-4043). */\n/**\n * A quote's customer, erased (AGL-4093). An unpaid quote keeps its customer\n * in its `quote` section rather than on the order's own fields, so it is\n * found by `quote.customer.emailLower` and loses the person, both\n * addresses and the address each email went to; its lines and totals stay,\n * as an order's do.\n */\nexport function erasedQuotePatch(\n  data: FirebaseFirestore.DocumentData | undefined,\n  now: number,\n): Record<string, unknown> {\n  const quote = (data?.['quote'] ?? {}) as Record<string, unknown>\n  // Each time it was emailed names where it went (AGL-4097); the record of\n  // the send stays, without the address.\n  const sends = Array.isArray(quote['sends'])\n    ? { sends: (quote['sends'] as Array<Record<string, unknown>>).map((send) => ({ ...send, to: '' })) }\n    : {}\n  return {\n    quote: { ...quote, customer: {}, billTo: null, shipTo: null, ...sends },\n    ...erasedInvoiceSends(data),\n    customerErasedAtMs: now,\n  }\n}\n\nexport function erasedCheckInPatch(\n  data: FirebaseFirestore.DocumentData | undefined,\n  now: number,\n): Record<string, unknown> {\n  // One key per order or stay, so the people one order brought still read\n  // as one party, and as nobody's name.\n  const source = String(data?.['orderId'] ?? data?.['reservationId'] ?? '')\n  return {\n    customerKey: `erased:${source}`,\n    customerName: null,\n    customerEmail: null,\n    customerEmailLower: null,\n    customerPhone: null,\n    contactId: null,\n    searchTokens: [],\n    customerErasedAtMs: now,\n  }\n}\n\nexport function createCommercePersonEraser(deps: CommercePersonEraserDeps): PluginPersonEraser {\n  return async ({ orgId, email, dryRun, atMs }): Promise<PluginPersonErasureReport> => {\n    const db = deps.firestore()\n    const hosts = await db.collection('hosts').where('orgId', '==', orgId).get()\n    let orders = 0\n    let checkIns = 0\n    let quotes = 0\n    const emailLower = email.trim().toLowerCase()\n    for (const host of hosts.docs) {\n      const placed = host.ref.collection('orders')\n      const checked = host.ref.collection('checkIns')\n      if (dryRun) {\n        orders += (await placed.where('customerEmail', '==', email).get()).size\n        checkIns += (await checked.where('customerEmailLower', '==', emailLower).get()).size\n        quotes += (await placed.where(QUOTE_EMAIL_FIELD, '==', emailLower).get()).size\n        continue\n      }\n      checkIns += await updateWhereEquals(\n        db,\n        checked,\n        'customerEmailLower',\n        emailLower,\n        (data) => erasedCheckInPatch(data, atMs),\n        LABEL,\n      )\n      orders += await updateWhereEquals(\n        db,\n        placed,\n        'customerEmail',\n        email,\n        (data) => erasedOrderPatch(data, atMs),\n        LABEL,\n      )\n      quotes += await updateWhereEquals(\n        db,\n        placed,\n        QUOTE_EMAIL_FIELD,\n        emailLower,\n        (data) => erasedQuotePatch(data, atMs),\n        LABEL,\n      )\n    }\n    return { orders, checkIns, quotes }\n  }\n}\n\n/** The eraser over the platform's own Firestore, as the declarations register it. */\nexport const commercePersonEraser: PluginPersonEraser = (request) =>\n  createCommercePersonEraser({ firestore: () => firebaseAdmin.app().firestore() })(request)\n"],"names":["updateWhereEquals","FieldValue","firebaseAdmin","LABEL","QUOTE_EMAIL_FIELD","erasedInvoiceSends","data","Array","isArray","invoiceSends","map","send","to","erasedOrderPatch","now","addressTokens","Set","customerEmail","customerName","shippingAddress","delete","billingAddress","customerErasedAtMs","customerEmailLower","customerEmailTokens","searchTokens","filter","token","has","erasedQuotePatch","quote","sends","customer","billTo","shipTo","erasedCheckInPatch","source","String","customerKey","customerPhone","contactId","createCommercePersonEraser","deps","orgId","email","dryRun","atMs","db","firestore","hosts","collection","where","get","orders","checkIns","quotes","emailLower","trim","toLowerCase","host","docs","placed","ref","checked","size","commercePersonEraser","request","app"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAMD,SAASA,iBAAiB,QAAQ,+CAA8C;AAChF,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SAASC,aAAa,QAAQ,iDAAgD;AAgC9E,MAAMC,QAAQ;AAEd,uEAAuE,GACvE,MAAMC,oBAAoB;AAE1B;;;CAGC,GACD,SAASC,mBAAmBC,IAAgD;IAC1E,OAAOC,MAAMC,OAAO,CAACF,wBAAAA,IAAM,CAAC,eAAe,IACvC;QAAEG,cAAc,AAACH,IAAI,CAAC,eAAe,CAAoCI,GAAG,CAAC,CAACC,OAAU,aAAKA;gBAAMC,IAAI;;IAAO,IAC9G,CAAC;AACP;AAEA,gEAAgE,GAChE,OAAO,SAASC,iBACdP,IAAgD,EAChDQ,GAAW;IAEX,MAAMC,gBAAgB,IAAIC,IACxBT,MAAMC,OAAO,CAACF,wBAAAA,IAAM,CAAC,sBAAsB,IAAIA,IAAI,CAAC,sBAAsB,GAAG,EAAE;IAEjF,OAAO,aACFD,mBAAmBC;QACtBW,eAAe;QACfC,cAAc;QACdC,iBAAiBlB,WAAWmB,MAAM;QAClCC,gBAAgBpB,WAAWmB,MAAM;QACjCE,oBAAoBR;QACpBS,oBAAoB;QACpBC,qBAAqB,EAAE;OACnBjB,MAAMC,OAAO,CAACF,wBAAAA,IAAM,CAAC,eAAe,IACpC;QACEmB,cAAc,AAACnB,IAAI,CAAC,eAAe,CAAeoB,MAAM,CACtD,CAACC,QAAU,CAACZ,cAAca,GAAG,CAACD;IAElC,IACA,CAAC;AAET;AAEA,iFAAiF,GACjF;;;;;;CAMC,GACD,OAAO,SAASE,iBACdvB,IAAgD,EAChDQ,GAAW;;IAEX,MAAMgB,gBAASxB,wBAAAA,IAAM,CAAC,QAAQ,mBAAI,CAAC;IACnC,yEAAyE;IACzE,uCAAuC;IACvC,MAAMyB,QAAQxB,MAAMC,OAAO,CAACsB,KAAK,CAAC,QAAQ,IACtC;QAAEC,OAAO,AAACD,KAAK,CAAC,QAAQ,CAAoCpB,GAAG,CAAC,CAACC,OAAU,aAAKA;gBAAMC,IAAI;;IAAO,IACjG,CAAC;IACL,OAAO;QACLkB,OAAO,aAAKA;YAAOE,UAAU,CAAC;YAAGC,QAAQ;YAAMC,QAAQ;WAASH;OAC7D1B,mBAAmBC;QACtBgB,oBAAoBR;;AAExB;AAEA,OAAO,SAASqB,mBACd7B,IAAgD,EAChDQ,GAAW;QAIWR;IAFtB,wEAAwE;IACxE,sCAAsC;IACtC,MAAM8B,SAASC,QAAO/B,gBAAAA,wBAAAA,IAAM,CAAC,UAAU,oBAAIA,wBAAAA,IAAM,CAAC,gBAAgB,YAA5CA,OAAgD;IACtE,OAAO;QACLgC,aAAa,CAAC,OAAO,EAAEF,QAAQ;QAC/BlB,cAAc;QACdD,eAAe;QACfM,oBAAoB;QACpBgB,eAAe;QACfC,WAAW;QACXf,cAAc,EAAE;QAChBH,oBAAoBR;IACtB;AACF;AAEA,OAAO,SAAS2B,2BAA2BC,IAA8B;IACvE,OAAO,OAAO,EAAEC,KAAK,EAAEC,KAAK,EAAEC,MAAM,EAAEC,IAAI,EAAE;QAC1C,MAAMC,KAAKL,KAAKM,SAAS;QACzB,MAAMC,QAAQ,MAAMF,GAAGG,UAAU,CAAC,SAASC,KAAK,CAAC,SAAS,MAAMR,OAAOS,GAAG;QAC1E,IAAIC,SAAS;QACb,IAAIC,WAAW;QACf,IAAIC,SAAS;QACb,MAAMC,aAAaZ,MAAMa,IAAI,GAAGC,WAAW;QAC3C,KAAK,MAAMC,QAAQV,MAAMW,IAAI,CAAE;YAC7B,MAAMC,SAASF,KAAKG,GAAG,CAACZ,UAAU,CAAC;YACnC,MAAMa,UAAUJ,KAAKG,GAAG,CAACZ,UAAU,CAAC;YACpC,IAAIL,QAAQ;gBACVQ,UAAU,AAAC,CAAA,MAAMQ,OAAOV,KAAK,CAAC,iBAAiB,MAAMP,OAAOQ,GAAG,EAAC,EAAGY,IAAI;gBACvEV,YAAY,AAAC,CAAA,MAAMS,QAAQZ,KAAK,CAAC,sBAAsB,MAAMK,YAAYJ,GAAG,EAAC,EAAGY,IAAI;gBACpFT,UAAU,AAAC,CAAA,MAAMM,OAAOV,KAAK,CAAC/C,mBAAmB,MAAMoD,YAAYJ,GAAG,EAAC,EAAGY,IAAI;gBAC9E;YACF;YACAV,YAAY,MAAMtD,kBAChB+C,IACAgB,SACA,sBACAP,YACA,CAAClD,OAAS6B,mBAAmB7B,MAAMwC,OACnC3C;YAEFkD,UAAU,MAAMrD,kBACd+C,IACAc,QACA,iBACAjB,OACA,CAACtC,OAASO,iBAAiBP,MAAMwC,OACjC3C;YAEFoD,UAAU,MAAMvD,kBACd+C,IACAc,QACAzD,mBACAoD,YACA,CAAClD,OAASuB,iBAAiBvB,MAAMwC,OACjC3C;QAEJ;QACA,OAAO;YAAEkD;YAAQC;YAAUC;QAAO;IACpC;AACF;AAEA,mFAAmF,GACnF,OAAO,MAAMU,uBAA2C,CAACC,UACvDzB,2BAA2B;QAAEO,WAAW,IAAM9C,cAAciE,GAAG,GAAGnB,SAAS;IAAG,GAAGkB,SAAQ"}

package/src/lib/server/pos-reader-splash.d.ts

@@ -14,11 +14,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { type MediaCdnScope } from '@aglyn/aglyn/app-utils/media-cdn-scope';
 import type { PluginApiHandler } from '@aglyn/aglyn/server';
 import type { PluginEventPayloads } from '@aglyn/aglyn/plugin-manager/plugin-events';
 import type { PluginJobHostGate } from '@aglyn/aglyn/server';
 import { type PosReaderSplashChoice, type PosReaderSplashFamilyId } from '../model/pos-reader-splash';
+import { type LocatedImageSource } from './site-image-source';
 /** `platformSettings/posReaderSplash`: staff's default screen. */
 export declare const POS_READER_SPLASH_SETTINGS_ID = "posReaderSplash";
 /** One family's default screen, as staff uploaded it. */
@@ -40,21 +40,6 @@ export declare function posReaderSplashBucket(): import("@google-cloud/storage")
 export declare function readPlatformSplash(): Promise<PlatformSplashDoc>;
 /** The default is usable once the S700/S710 screen is uploaded; the smaller one is drawn from it if absent. */
 export declare function platformSplashReady(doc: PlatformSplashDoc): boolean;
-interface LocatedAsset {
-    kind: 'asset';
-    scope: MediaCdnScope;
-    scopeSegment: string;
-    mediaId: string;
-    doc: Record<string, unknown>;
-    /** What changes when the asset's bytes do. */
-    version: string;
-}
-interface LocatedUrl {
-    kind: 'url';
-    url: string;
-    version: string;
-}
-type LocatedSource = LocatedAsset | LocatedUrl;
 /**
  * The workspace's own logo: a white-label workspace's brand logo first,
  * then the logo on its organization profile. Never the platform's: the
@@ -67,7 +52,7 @@ export type SplashSource = {
     doc: PlatformSplashDoc;
 } | {
     mode: 'logo' | 'artwork';
-    located: LocatedSource;
+    located: LocatedImageSource;
 };
 export interface PosReaderSplashPlan {
     choice: PosReaderSplashChoice | null;
@@ -169,4 +154,3 @@ export declare function refreshPosReaderSplashes(gate: {
  */
 export declare function onOrgLogoChanged(payload: Pick<PluginEventPayloads['org.logo.changed'], 'orgId'>, gate?: PluginJobHostGate): Promise<PosReaderSplashSweep>;
 export declare const posReaderSplashHandler: PluginApiHandler;
-export {};

package/src/lib/server/pos-reader-splash.js

@@ -15,10 +15,8 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import { createHash } from "node:crypto";
-import { parseMediaCdnScope } from "@aglyn/aglyn/app-utils/media-cdn-scope";
-import { formatMediaRef, isMediaCdnPath, MEDIA_CDN_ROUTE, mediaRefFromStorageUrl, parseMediaRef, resolveMediaSrc } from "@aglyn/aglyn/app-utils/media-ref";
+import { formatMediaRef, resolveMediaSrc } from "@aglyn/aglyn/app-utils/media-ref";
 import { checkEntitlement, resolveBrandingProfile } from "@aglyn/aglyn/app-utils/plan-entitlements";
-import { visibleToHost } from "@aglyn/aglyn/app-utils/scope-tokens";
 import { firebaseAdmin, getOrgDoc, getOrgForHost } from "@aglyn/tenant-data-admin";
 import { siteLockdownJobGate } from "@aglyn/tenant-data-admin/server/tenant-write-lockdown";
 import { isPosReaderSplashChoice, POS_READER_SPLASH_DEVICE_TYPES, POS_READER_SPLASH_FAMILIES, POS_READER_SPLASH_SOURCE_MAX_BYTES, POS_READER_SPLASH_SOURCE_TYPES, posReaderSplashArtworkProblem, posReaderSplashEffectiveChoice } from "../model/pos-reader-splash.js";
@@ -26,6 +24,7 @@ import { authorizePosStaff, posRequestBody } from "./pos-auth.js";
 import { PosReaderSplashRenderError, posReaderSplashImageFacts, renderPosReaderSplash } from "./pos-reader-splash-render.js";
 import { POS_STRIPE_VERSION, posTerminalAvailable } from "./pos-stripe.js";
 import { savePosReaderConfiguration } from "./pos-terminal.js";
+import { locateImageSource, locateMediaImage, readImageSourceBytes } from "./site-image-source.js";
 /*==========================================
  * A STORE'S CARD READERS SHOW ITS START-UP SCREEN (AGL-4048).
  *
@@ -107,96 +106,12 @@ function platformSplashVersion(doc) {
 }
 const digest = (value)=>createHash('sha256').update(value).digest('hex');
 const cleanString = (value)=>typeof value === 'string' ? value.trim() : '';
-async function locateMediaAsset(scopeSegment, mediaId, hostId, orgId) {
-    var _doc_contentType, _ref, _doc_updatedAtMs;
-    const scope = parseMediaCdnScope(scopeSegment);
-    if (!scope || !/^[A-Za-z0-9_-]{1,64}$/.test(mediaId)) return null;
-    const owned = scope.isOrg ? scope.scopeId === orgId : scope.scopeId === hostId;
-    if (!owned) return null;
-    const snapshot = await firestore().collection(scope.isOrg ? 'orgs' : 'hosts').doc(scope.scopeId).collection('media').doc(mediaId).get();
-    const doc = snapshot.exists ? snapshot.data() : null;
-    if (!doc || doc['deletedAt'] || doc['private']) return null;
-    if (scope.isOrg && !visibleToHost(doc['visibleTo'], hostId)) return null;
-    if (!/^image\//.test(String((_doc_contentType = doc['contentType']) != null ? _doc_contentType : ''))) return null;
-    if (typeof doc['sizeBytes'] === 'number' && doc['sizeBytes'] > POS_READER_SPLASH_SOURCE_MAX_BYTES) return null;
-    const version = cleanString(doc['contentSha256']) || cleanString(doc['contentHash']) || String((_ref = (_doc_updatedAtMs = doc['updatedAtMs']) != null ? _doc_updatedAtMs : doc['sizeBytes']) != null ? _ref : '');
-    return {
-        kind: 'asset',
-        scope,
-        scopeSegment,
-        mediaId,
-        doc,
-        version
-    };
-}
-/** Where a stored logo or image value lives, or null when it cannot be read. */ async function locateSource(value, hostId, orgId) {
-    const stored = parseMediaRef(value) ? value : mediaRefFromStorageUrl(value);
-    const ref = stored ? parseMediaRef(stored) : null;
-    if (ref) return locateMediaAsset(ref.scope, ref.mediaId, hostId, orgId);
-    if (isMediaCdnPath(value)) {
-        const rest = value.slice(`${MEDIA_CDN_ROUTE}/`.length).split('?')[0];
-        const slash = rest.indexOf('/');
-        if (slash <= 0) return null;
-        return locateMediaAsset(rest.slice(0, slash), rest.slice(slash + 1), hostId, orgId);
-    }
-    // `isMediaCdnPath` narrows a string it refuses to `never`; the value is still the string.
-    const address = value;
-    if (/^https:\/\//.test(address) && address.length <= 2000) return {
-        kind: 'url',
-        url: address,
-        version: address
-    };
-    return null;
-}
-async function readAssetBytes(asset) {
-    const { mediaCdnServeBlock, mediaStoragePathInScope } = await import("./pos-reader-splash-server.js");
-    const blocked = await mediaCdnServeBlock(asset.scope, {
-        contentSha256: typeof asset.doc['contentSha256'] === 'string' ? asset.doc['contentSha256'] : undefined,
-        contentHash: typeof asset.doc['contentHash'] === 'string' ? asset.doc['contentHash'] : undefined,
-        scopeSegment: asset.scopeSegment,
-        mediaId: asset.mediaId
-    });
-    if (blocked) return null;
-    const objectPath = mediaStoragePathInScope({
-        storagePath: asset.doc['storagePath'],
-        base: `${asset.scope.isOrg ? 'orgs' : 'hosts'}/${asset.scope.scopeId}`,
-        mediaId: asset.mediaId
-    });
-    const [buffer] = await posReaderSplashBucket().file(objectPath).download();
-    return buffer.length > POS_READER_SPLASH_SOURCE_MAX_BYTES ? null : buffer;
-}
-const FETCH_TIMEOUT_MS = 8000;
-async function fetchPublicImage(url) {
-    const { createPinnedDispatcher, resolvePublicIp } = await import("./pos-reader-splash-server.js");
-    const pinnedIp = await resolvePublicIp(new URL(url).hostname);
-    if (!pinnedIp) return null;
-    const dispatcher = createPinnedDispatcher(pinnedIp);
-    const controller = new AbortController();
-    const timeout = setTimeout(()=>controller.abort(), FETCH_TIMEOUT_MS);
-    try {
-        var _response_headers_get, _response_headers_get1;
-        const init = {
-            redirect: 'error',
-            signal: controller.signal,
-            dispatcher
-        };
-        const response = await fetch(url, init);
-        if (!response.ok) return null;
-        if (!/^image\//.test((_response_headers_get = response.headers.get('content-type')) != null ? _response_headers_get : '')) return null;
-        const declared = Number((_response_headers_get1 = response.headers.get('content-length')) != null ? _response_headers_get1 : 0);
-        if (declared > POS_READER_SPLASH_SOURCE_MAX_BYTES) return null;
-        const buffer = Buffer.from(await response.arrayBuffer());
-        return buffer.length > POS_READER_SPLASH_SOURCE_MAX_BYTES ? null : buffer;
-    } catch (unused) {
-        return null;
-    } finally{
-        clearTimeout(timeout);
-        dispatcher.close == null ? void 0 : dispatcher.close.call(dispatcher).catch(()=>undefined);
-    }
-}
-async function readSourceBytes(source) {
-    return source.kind === 'asset' ? readAssetBytes(source) : fetchPublicImage(source.url);
-}
+/*==========================================
+ * READING A SOURCE IMAGE: `site-image-source.ts`, with the reader screen's
+ * size cap.
+ *=========================================*/ const locateMediaAsset = (scopeSegment, mediaId, hostId, orgId)=>locateMediaImage(scopeSegment, mediaId, hostId, orgId, POS_READER_SPLASH_SOURCE_MAX_BYTES);
+const locateSource = (value, hostId, orgId)=>locateImageSource(value, hostId, orgId, POS_READER_SPLASH_SOURCE_MAX_BYTES);
+const readSourceBytes = (source)=>readImageSourceBytes(source, POS_READER_SPLASH_SOURCE_MAX_BYTES);
 /*==========================================
  * WHAT A STORE SHOWS.
  *=========================================*/ /**