@aglyn/plugins-commerce 1.0.0-beta.290 → 1.0.0-beta.291

package/src/lib/server/quote.js

@@ -19,6 +19,7 @@ import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_wi
 import { createResourceUid } from "@aglyn/aglyn/app-utils/create-resource-uid";
 import { checkEntitlement } from "@aglyn/aglyn/server";
 import { searchPluginPeople } from "@aglyn/aglyn/plugin-manager/plugin-person-records";
+import { pluginRecordFactsReader } from "@aglyn/aglyn/plugin-manager/plugin-record-facts";
 import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
 import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
 import * as CommerceModel from "../model/index.js";
@@ -27,7 +28,7 @@ import { holdsCommerceSiteKey } from "./commerce-site-keys.js";
 import { quoteSaleTaxWithEngine } from "./tax-engine-quote.js";
 import { expireCheckoutSession } from "./checkout-session-expiry.js";
 import { sendPdf } from "./pdf-response.js";
-import { quotePayLinkUrl } from "./quote-link-token.js";
+import { quotePayLinkUrl, quoteProofLinkUrl } from "./quote-link-token.js";
 export function defaultQuoteDeps() {
     return {
         verifyIdToken: (token)=>firebaseAdmin.app().auth().verifyIdToken(token),
@@ -43,11 +44,47 @@ export function defaultQuoteDeps() {
         quoteTax: (request)=>quoteSaleTaxWithEngine(request),
         expireSession: (sessionId)=>expireCheckoutSession(sessionId),
         payLinkUrl: (host, hostId, quoteId, version)=>quotePayLinkUrl(host, hostId, quoteId, version),
+        proofLinkUrl: (host, hostId, quoteId, version, proofId)=>quoteProofLinkUrl(host, hostId, quoteId, version, proofId),
         quotePdf: async (input)=>(await import("./commerce-pdf.js")).quotePdfFile(input),
         uploads: async ()=>(await import("./quote-uploads.js")).quoteUploadCalls(),
+        mailer: async ()=>(await import("./quote-email.js")).quoteMailer(),
+        requestFacts: async (request)=>{
+            var _ref;
+            var _pluginRecordFactsReader;
+            return (_ref = await ((_pluginRecordFactsReader = pluginRecordFactsReader(CommerceModel.QUOTE_REQUEST_FACTS_RESOURCE)) == null ? void 0 : _pluginRecordFactsReader.reader.read(request))) != null ? _ref : null;
+        },
         now: ()=>Date.now()
     };
 }
+/** A request's facts for the member asking, or the refusal to answer with. */ async function readRequest(deps, input) {
+    var _ref, _ref1;
+    if (!DOC_ID.test(input.submissionId)) return {
+        outcome: refuse(400, 'Missing submissionId')
+    };
+    const owner = await deps.orgForHost(input.hostId);
+    const read = await deps.requestFacts({
+        orgId: (_ref = owner == null ? void 0 : owner.id) != null ? _ref : '',
+        hostId: input.hostId,
+        id: input.submissionId,
+        uid: input.uid,
+        staff: input.staff,
+        org: (_ref1 = owner == null ? void 0 : owner.org) != null ? _ref1 : null,
+        now: new Date(deps.now())
+    });
+    if (!read) return {
+        outcome: refuse(404, 'Requests aren’t available on this site.')
+    };
+    if ('error' in read) return {
+        outcome: refuse(read.status, read.error)
+    };
+    const facts = CommerceModel.readQuoteRequestFacts(read.facts);
+    if (!facts) return {
+        outcome: refuse(404, 'That request is no longer in the Inbox.')
+    };
+    return {
+        facts
+    };
+}
 /** Expires the session the pay page opened, when there is one; a failure is logged, never thrown. */ async function closeOpenSession(deps, sessionId, context) {
     if (!sessionId) return;
     const result = await deps.expireSession(sessionId).catch(()=>'open');
@@ -82,6 +119,11 @@ function headerOf(req, name) {
     return String(Array.isArray(value) ? (_value_ = value[0]) != null ? _value_ : '' : value != null ? value : '').trim();
 }
 const DOC_ID = /^(?!__.*__$)[^/]{1,200}$/;
+/** The actions under "Send quotes and invoices to customers" (`commerce.quotes.send`). */ const SEND_ACTIONS = new Set([
+    'pay-link',
+    'replace-link',
+    'send'
+]);
 /** The ship-to as a tax service reads it, or `null` to tax at the store's address. */ function serviceAddress(shipTo) {
     if (!(shipTo == null ? void 0 : shipTo.country)) return null;
     return _extends({
@@ -200,7 +242,7 @@ const DOC_ID = /^(?!__.*__$)[^/]{1,200}$/;
     };
 }
 export async function handleQuote(deps, req) {
-    var _body_hostId, _body_action, _body_quoteId, _ref;
+    var _body_hostId, _body_action, _body_quoteId, _body_from, _ref;
     if (req.method !== 'POST') return refuse(405, 'Method not allowed');
     const authorization = headerOf(req, 'authorization');
     const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : '';
@@ -220,7 +262,7 @@ export async function handleQuote(deps, req) {
     const hostRef = firestore.collection('hosts').doc(hostId);
     const host = await hostRef.get();
     if (!host.exists) return refuse(404, 'Unknown site');
-    const key = action === 'pay-link' || action === 'replace-link' ? 'commerce.quotes.send' : 'commerce.quotes';
+    const key = SEND_ACTIONS.has(action) ? 'commerce.quotes.send' : 'commerce.quotes';
     if (!holdsCommerceSiteKey(host, decoded.uid, key)) {
         return refuse(403, commerceSitePermissionRefusal(key));
     }
@@ -284,10 +326,46 @@ export async function handleQuote(deps, req) {
             }
         };
     }
-    if (PROOF_ACTIONS.has(action)) {
-        var _body_quoteId2;
+    if (action === 'send') {
+        var _body_quoteId2, _host_data1;
         const quoteId = String((_body_quoteId2 = body['quoteId']) != null ? _body_quoteId2 : '');
         if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
+        return handleSendAction(deps, {
+            req,
+            body,
+            hostId,
+            quoteId,
+            hostRef,
+            host: (_host_data1 = host.data()) != null ? _host_data1 : {},
+            firestore,
+            actor,
+            senderEmail: decoded.email ? String(decoded.email) : null
+        });
+    }
+    if (action === 'start-from-request') {
+        var _body_submissionId;
+        const read = await readRequest(deps, {
+            hostId,
+            submissionId: String((_body_submissionId = body['submissionId']) != null ? _body_submissionId : ''),
+            uid: decoded.uid,
+            staff: decoded.staff === true
+        });
+        if ('outcome' in read) return read.outcome;
+        const started = CommerceModel.quoteStartFromRequest(String(body['submissionId']), read.facts);
+        return {
+            status: 200,
+            body: {
+                prefill: started.prefill,
+                request: started.request,
+                files: CommerceModel.quoteRequestFileViews(started.files),
+                threaded: Boolean(started.emailThread)
+            }
+        };
+    }
+    if (PROOF_ACTIONS.has(action)) {
+        var _body_quoteId3;
+        const quoteId = String((_body_quoteId3 = body['quoteId']) != null ? _body_quoteId3 : '');
+        if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
         return handleProofAction(deps, {
             action,
             body,
@@ -300,8 +378,8 @@ export async function handleQuote(deps, req) {
         });
     }
     if (action === 'pdf') {
-        var _body_quoteId3, _host_data1;
-        const quoteId = String((_body_quoteId3 = body['quoteId']) != null ? _body_quoteId3 : '');
+        var _body_quoteId4, _host_data2;
+        const quoteId = String((_body_quoteId4 = body['quoteId']) != null ? _body_quoteId4 : '');
         if (!DOC_ID.test(quoteId)) return refuse(400, 'Missing quoteId');
         const [snapshot, store] = await Promise.all([
             hostRef.collection('orders').doc(quoteId).get(),
@@ -309,7 +387,7 @@ export async function handleQuote(deps, req) {
         ]);
         const order = snapshot.exists ? snapshot.data() : null;
         if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
-        const hostData = (_host_data1 = host.data()) != null ? _host_data1 : {};
+        const hostData = (_host_data2 = host.data()) != null ? _host_data2 : {};
         // The pay link is "Send quotes and invoices to customers"; without it the PDF leaves the link off.
         const payUrl = CommerceModel.isUnpaidQuote(order) && holdsCommerceSiteKey(host, decoded.uid, 'commerce.quotes.send') ? deps.payLinkUrl(hostData, hostId, quoteId, CommerceModel.quoteLinkVersion(order.quote)) : null;
         try {
@@ -432,6 +510,24 @@ export async function handleQuote(deps, req) {
     const parsed = CommerceModel.parseQuoteInput(body['quote']);
     if ('error' in parsed) return refuse(400, parsed.error);
     const input = parsed.input;
+    /*
+   * A new quote from a request (AGL-4098): the request is read again, here,
+   * for the member saving, and what the quote takes from it — which request,
+   * its files, its conversation — comes from that read and never from the
+   * body. The editable fields (customer, lines, notes) are the editor's.
+   */ const from = (_body_from = body['from']) != null ? _body_from : null;
+    let started = null;
+    if (action === 'create' && (from == null ? void 0 : from.kind) === 'submission') {
+        var _from_id;
+        const read = await readRequest(deps, {
+            hostId,
+            submissionId: String((_from_id = from.id) != null ? _from_id : ''),
+            uid: decoded.uid,
+            staff: decoded.staff === true
+        });
+        if ('outcome' in read) return read.outcome;
+        started = CommerceModel.quoteStartFromRequest(String(from.id), read.facts);
+    }
     const priced = await priceQuote(deps, hostRef, hostId, input);
     if ('status' in priced) return priced;
     const claimed = await claimAttempt(firestore, {
@@ -469,7 +565,14 @@ export async function handleQuote(deps, req) {
                     revision: 1
                 }, editedQuoteFields(input), {
                     tax: priced.tax,
-                    requireProofApproval: (_input_requireProofApproval = input.requireProofApproval) != null ? _input_requireProofApproval : priced.requireProofApprovalDefault,
+                    requireProofApproval: (_input_requireProofApproval = input.requireProofApproval) != null ? _input_requireProofApproval : priced.requireProofApprovalDefault
+                }, started ? _extends({
+                    request: started.request
+                }, started.files.length ? {
+                    requestFiles: started.files
+                } : {}, started.emailThread ? {
+                    emailThread: started.emailThread
+                } : {}) : {}, {
                     createdAtMs: now,
                     updatedAtMs: now,
                     createdBy: actor,
@@ -490,7 +593,7 @@ export async function handleQuote(deps, req) {
                         {
                             atMs: now,
                             event: 'quote',
-                            detail: `Quote created by ${actor}`
+                            detail: started ? `Quote created by ${actor} from a request sent through “${started.request.formName}”` : `Quote created by ${actor}`
                         }
                     ],
                     quote
@@ -625,7 +728,7 @@ async function handleProofAction(deps, context) {
         purposeId: quoteId
     };
     if (action === 'revisions' || action === 'file') {
-        var _order_quote_revision, _body_fileId, _order_quote_responses, _ref, _ref1;
+        var _order_quote_revision, _body_fileId, _order_quote_responses, _ref, _ref1, _order_quote_requestFiles;
         const snapshot = await ref.get();
         const order = snapshot.exists ? snapshot.data() : null;
         if (!order || !CommerceModel.isQuote(order) || !order.quote) return refuse(404, 'Unknown quote');
@@ -652,7 +755,9 @@ async function handleProofAction(deps, context) {
             ...((_ref1 = source == null ? void 0 : source.responses) != null ? _ref1 : []).flatMap((response)=>{
                 var _response_files;
                 return (_response_files = response.files) != null ? _response_files : [];
-            })
+            }),
+            // The request's files (AGL-4098), on every revision: they came first.
+            ...(_order_quote_requestFiles = order.quote.requestFiles) != null ? _order_quote_requestFiles : []
         ];
         const file = files.find((entry)=>entry.id === fileId);
         if (!(file == null ? void 0 : file.path)) return refuse(404, 'That file is no longer on this quote.');
@@ -832,6 +937,198 @@ async function handleProofAction(deps, context) {
     await closeOpenSession(deps, answer.closeSession, 'quote revision started');
     return answer.outcome;
 }
+/*==========================================
+ * SENDING THE QUOTE (AGL-4097)
+ *
+ *   { action: 'send', hostId, quoteId, to?, subject?, message } + Idempotency-Key
+ *
+ * Emails the quote to `to` (else the customer's email) under `subject` (else
+ * the conversation's, else "Quote #N from {business}"), with the business's
+ * message, the proof, the PDF and the pay link. Refused for a paid quote, one
+ * with nowhere to send it, and an address on a suppression list.
+ *
+ * When the customer was emailed an earlier revision and the link has not
+ * been replaced since, the link is replaced first (as Replace link does: the
+ * version moves on, the open payment closes) so the earlier email's link
+ * says the quote was updated. A resend of the same revision keeps it. Then
+ * the send is recorded (`quote.sends`), the conversation moves on
+ * (`quote.emailThread`), the quote moves to Sent unless the customer has
+ * answered this revision, and the timeline says so.
+ *
+ * One attempt per key: a retried press replays the answer and never sends a
+ * second email. A send that fails releases the key, and a retry finds the
+ * link already replaced, so it never replaces it twice.
+ *=========================================*/ async function handleSendAction(deps, context) {
+    var _ref, _ref1;
+    var _order_quote;
+    const { req, body, hostId, quoteId, hostRef, host, firestore, actor } = context;
+    const parsed = CommerceModel.parseQuoteSendInput(body);
+    if ('error' in parsed) return refuse(400, parsed.error);
+    const idempotencyKey = headerOf(req, 'idempotency-key').slice(0, 200);
+    if (!idempotencyKey) return refuse(400, 'Sending a quote needs an Idempotency-Key header.');
+    const ref = hostRef.collection('orders').doc(quoteId);
+    const [snapshot, store] = await Promise.all([
+        ref.get(),
+        hostRef.collection('settings').doc('store').get()
+    ]);
+    const stored = snapshot.exists ? snapshot.data() : null;
+    const to = CommerceModel.quoteSendRecipient(stored, parsed.input.to);
+    const refused = CommerceModel.quoteSendRefusal(stored, to);
+    if (refused) {
+        return refuse(refused === 'not-a-quote' ? 404 : refused === 'paid' ? 409 : 400, CommerceModel.quoteSendRefusalMessage(refused));
+    }
+    if (!deps.payLinkUrl(host, hostId, quoteId, CommerceModel.quoteLinkVersion(stored == null ? void 0 : stored.quote))) {
+        return refuse(409, 'This site has no web address yet, so its quotes have no pay link. Publish the site first.');
+    }
+    const owner = await deps.orgForHost(hostId);
+    if (!checkEntitlement(owner == null ? void 0 : owner.org, 'commerce')) return refuse(403, 'Selling is not enabled');
+    const mailer = await deps.mailer();
+    if (!mailer.configured()) {
+        return refuse(503, 'Email isn’t set up here, so quotes can’t be emailed. Copy the pay link and send it yourself.');
+    }
+    // The bounce and complaint list only (AGL-4098): the customer asked for the
+    // quote, so unsubscribing from the site's newsletter does not refuse it.
+    if (await mailer.suppression(to)) {
+        return refuse(409, `${to} bounced or reported an email as spam, so it can’t be emailed. Copy the pay link and send it another way.`);
+    }
+    const claimed = await claimAttempt(firestore, {
+        kind: 'commerce-quote-send',
+        scopeId: `${hostId}:${quoteId}`,
+        orgId: (_ref = owner == null ? void 0 : owner.id) != null ? _ref : '',
+        key: idempotencyKey,
+        busyMessage: 'This quote is already being sent'
+    });
+    if ('replay' in claimed) {
+        return {
+            status: claimed.replay.status,
+            body: claimed.replay.body
+        };
+    }
+    const claim = claimed.claim;
+    const now = deps.now();
+    let prepared;
+    try {
+        // A new revision's first email replaces the link the customer was sent.
+        prepared = await firestore.runTransaction(async (transaction)=>{
+            var _order_quote_revision;
+            const current = await transaction.get(ref);
+            const order = current.exists ? current.data() : null;
+            const again = CommerceModel.quoteSendRefusal(order, to);
+            if (again || !(order == null ? void 0 : order.quote)) {
+                const reason = again != null ? again : 'not-a-quote';
+                return {
+                    outcome: refuse(reason === 'not-a-quote' ? 404 : 409, CommerceModel.quoteSendRefusalMessage(reason))
+                };
+            }
+            const version = CommerceModel.quoteLinkVersion(order.quote);
+            if (!CommerceModel.quoteSendReplacesLink(order.quote)) return {
+                order,
+                linkVersion: version,
+                linkReplaced: false
+            };
+            const rest = _extends({}, order);
+            delete rest.checkoutSessionId;
+            const replaced = _extends({}, rest, {
+                timeline: CommerceModel.appendOrderEvent(order, 'quote-link-replaced', `Pay link replaced to send revision ${Number((_order_quote_revision = order.quote.revision) != null ? _order_quote_revision : 1)}; the earlier email's link no longer opens the quote`, now),
+                quote: _extends({}, order.quote, {
+                    linkVersion: version + 1
+                })
+            });
+            transaction.set(ref, replaced);
+            return {
+                order: replaced,
+                linkVersion: version + 1,
+                linkReplaced: true,
+                closeSession: order.checkoutSessionId
+            };
+        });
+    } catch (error) {
+        console.error('commerce quote send failed before sending', error);
+        await claim.release();
+        return refuse(500, 'The quote could not be sent. Try again.');
+    }
+    if ('outcome' in prepared) {
+        await claim.release();
+        return prepared.outcome;
+    }
+    const { order, linkVersion, linkReplaced } = prepared;
+    await closeOpenSession(deps, prepared.closeSession, 'quote link replaced to send a revision');
+    const payUrl = deps.payLinkUrl(host, hostId, quoteId, linkVersion);
+    let delivered;
+    try {
+        var _store_data;
+        delivered = await mailer.deliver({
+            hostId,
+            quoteId,
+            order,
+            host,
+            store: (_store_data = store.data()) != null ? _store_data : null,
+            owner: owner ? {
+                id: owner.id,
+                org: owner.org
+            } : null,
+            to,
+            subject: parsed.input.subject,
+            message: parsed.input.message,
+            payUrl,
+            proofUrl: (proofId)=>deps.proofLinkUrl(host, hostId, quoteId, linkVersion, proofId),
+            linkReplaced,
+            senderEmail: context.senderEmail,
+            atMs: now
+        });
+    } catch (error) {
+        console.error('commerce quote send failed', error);
+        await claim.release();
+        return refuse(502, 'The quote email could not be sent. Try again.');
+    }
+    // `strictNullChecks` is off, so the result does not narrow on `sent`.
+    if ('error' in delivered) {
+        await claim.release();
+        return refuse(delivered.status, delivered.error);
+    }
+    const done = delivered;
+    // The email is out: from here a failure is logged, never answered as one,
+    // so a retry does not send it twice.
+    const revision = Math.max(1, Number((_ref1 = (_order_quote = order.quote) == null ? void 0 : _order_quote.revision) != null ? _ref1 : 1) || 1);
+    const send = {
+        revision,
+        to,
+        subject: done.subject,
+        atMs: now,
+        by: actor,
+        messageId: done.messageId,
+        providerId: done.providerId,
+        linkVersion
+    };
+    try {
+        await firestore.runTransaction(async (transaction)=>{
+            const current = await transaction.get(ref);
+            const latest = current.exists ? current.data() : null;
+            if (!(latest == null ? void 0 : latest.quote)) return;
+            transaction.set(ref, CommerceModel.quoteAfterSend(latest, send, done.thread));
+        });
+    } catch (error) {
+        console.error('commerce quote sent but not recorded', {
+            hostId,
+            quoteId,
+            messageId: done.messageId,
+            error
+        });
+    }
+    const outcome = {
+        status: 200,
+        body: {
+            sent: true,
+            to,
+            atMs: now,
+            revision,
+            linkVersion,
+            linkReplaced
+        }
+    };
+    await claim.record(outcome.status, outcome.body);
+    return outcome;
+}
 /** `POST /api/commerce/quote`. */ export const quoteHandler = async (req, res)=>{
     const deps = defaultQuoteDeps();
     const outcome = await handleQuote(deps, req);