@asteby/storefront 0.16.0 → 0.17.0

package/dist/mock.cjs

@@ -1757,6 +1757,9 @@ function createMockStorefront(options = {}) {
       online_verify: false
     },
     fiscal_profiles: { max: 10 },
+    notifications: { channels: ["email"] },
+    data_export: true,
+    account_delete: true,
     ...options.customerCapabilities
   };
   const missingScopes = options.missingScopes ?? [];
@@ -1808,6 +1811,10 @@ function createMockStorefront(options = {}) {
       pendingRegistrations: /* @__PURE__ */ new Map(),
       loginFailures: /* @__PURE__ */ new Map(),
       sessions: /* @__PURE__ */ new Map(),
+      sessionInfo: /* @__PURE__ */ new Map(),
+      reauthFailures: /* @__PURE__ */ new Map(),
+      exportsServed: /* @__PURE__ */ new Map(),
+      deletedTokens: /* @__PURE__ */ new Set(),
       idempotency: /* @__PURE__ */ new Map(),
       checkouts: /* @__PURE__ */ new Map(),
       payments: /* @__PURE__ */ new Map(),
@@ -2158,8 +2165,13 @@ function createMockStorefront(options = {}) {
     }
     const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
     state.sessions.set(token, customer.id);
+    trackSession(token, "password");
     return { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer };
   }
+  function trackSession(token, loginMethod) {
+    const at = now();
+    state.sessionInfo.set(token, { id: nextId("ses"), customer_id: state.sessions.get(token) ?? "", created_at: at, last_used_at: at, login_method: loginMethod, reauth_at: null });
+  }
   function validateAddress(body, partial = false) {
     const required = ["address1", "city", "zip", "country_code"];
     if (!partial) {
@@ -2587,6 +2599,7 @@ function createMockStorefront(options = {}) {
     }
     const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
     state.sessions.set(token, customer.id);
+    trackSession(token, kind);
     return {
       status: 201,
       body: { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer },
@@ -2661,7 +2674,8 @@ function createMockStorefront(options = {}) {
     state.loginFailures.delete(email);
     return { status: 204 };
   });
-  const publicCustomer = (c) => {
+  const publicCustomer = (c0) => {
+    const c = { ...c0, locale: c0.locale ?? null, preferences: c0.preferences ?? { notifications: {} } };
     if (!c.fiscal?.document) return c;
     const { sha256: _sha, ...document } = c.fiscal.document;
     return { ...c, fiscal: { ...c.fiscal, document } };
@@ -2673,6 +2687,8 @@ function createMockStorefront(options = {}) {
     if ("first_name" in body) c.first_name = text(body.first_name);
     if ("last_name" in body) c.last_name = text(body.last_name);
     if ("phone" in body) c.phone = text(body.phone);
+    if ("locale" in body) c.locale = parseLocale(body.locale);
+    if ("preferences" in body) c.preferences = parsePreferences(c.preferences, body.preferences);
     if ("fiscal" in body) {
       if (body.fiscal === null) c.fiscal = null;
       else {
@@ -2692,6 +2708,144 @@ function createMockStorefront(options = {}) {
     }
     return { body: publicCustomer(c), cache: "private" };
   });
+  const OPTIONAL_EVENTS = /* @__PURE__ */ new Set(["order_updates", "shipping", "restock"]);
+  const MANDATORY_EVENTS = /* @__PURE__ */ new Set(["order_confirmation", "payment", "invoice", "security"]);
+  const CHANNELS = /* @__PURE__ */ new Set(["email", "whatsapp"]);
+  const REAUTH_WINDOW_MS = 5 * 6e4;
+  const supportedLocales = () => [state.shop.locale, ...state.shop.locales].filter((l, i, a) => l && a.indexOf(l) === i);
+  function parseLocale(raw) {
+    if (raw === null || typeof raw === "string" && !raw.trim()) return null;
+    if (typeof raw !== "string") throw new HttpError(400, "validation", "locale must be a string", "locale");
+    const tag = raw.trim().replace("_", "-");
+    const [lang = "", ...rest] = tag.split("-");
+    const canonical = [lang.toLowerCase(), ...rest.map((p) => p.toUpperCase())].join("-");
+    const supported = supportedLocales();
+    const hit = supported.find((l) => l.toLowerCase() === canonical.toLowerCase()) ?? (rest.length === 0 ? supported.find((l) => l.split("-")[0].toLowerCase() === canonical) : void 0);
+    if (!hit) throw new HttpError(400, "validation", "this store is not available in that language", "locale");
+    return hit;
+  }
+  function parsePreferences(current, raw) {
+    if (raw === null) return { notifications: {} };
+    if (typeof raw !== "object" || Array.isArray(raw)) throw new HttpError(400, "validation", "preferences must be an object", "preferences");
+    const merged = structuredClone(current?.notifications ?? {});
+    for (const [key, value] of Object.entries(raw)) {
+      if (key !== "notifications") throw new HttpError(400, "validation", "unknown preference", `preferences.${key}`);
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new HttpError(400, "validation", "notifications must map each event to its channels", "preferences.notifications");
+      for (const [event, channels] of Object.entries(value)) {
+        const field = `preferences.notifications.${event}`;
+        if (MANDATORY_EVENTS.has(event)) throw new HttpError(400, "validation", "this notification is required and cannot be turned off", field);
+        if (!OPTIONAL_EVENTS.has(event)) throw new HttpError(400, "validation", "unknown notification", field);
+        if (!channels || typeof channels !== "object" || Array.isArray(channels)) throw new HttpError(400, "validation", "each event maps its channels to true or false", field);
+        for (const [channel, on] of Object.entries(channels)) {
+          if (!CHANNELS.has(channel)) throw new HttpError(400, "validation", "unknown channel", `${field}.${channel}`);
+          if (typeof on !== "boolean") throw new HttpError(400, "validation", "each channel must be true or false", `${field}.${channel}`);
+          (merged[event] ??= {})[channel] = on;
+        }
+      }
+    }
+    return { notifications: merged };
+  }
+  function sessionOf(headers) {
+    const c = requireCustomer(headers);
+    const token = headers.get("x-customer-token");
+    if (!state.sessionInfo.has(token)) trackSession(token, "email");
+    return { c, token, info: state.sessionInfo.get(token) };
+  }
+  function requireRecentReauth(info) {
+    if (info.reauth_at === null || Date.now() - info.reauth_at > REAUTH_WINDOW_MS) {
+      throw new HttpError(403, "reauth_required", "confirm your password or a code first (customer.reauth)");
+    }
+  }
+  route("GET", "/customer/sessions", "customer:read", ({ headers }) => {
+    const { c, token } = sessionOf(headers);
+    const nodes = [...state.sessions.entries()].filter(([, id]) => id === c.id).map(([t]) => ({ t, info: state.sessionInfo.get(t) })).sort((a, b) => b.info.last_used_at.localeCompare(a.info.last_used_at)).map(({ t, info }) => ({
+      id: info.id,
+      current: t === token,
+      device_label: "Mock browser \xB7 Test",
+      login_method: info.login_method,
+      last_used_at: info.last_used_at,
+      created_at: info.created_at
+    }));
+    return { body: { nodes }, cache: "private" };
+  });
+  route("DELETE", "/customer/sessions/:id", "customer:write", ({ headers, params }) => {
+    const { c, token } = sessionOf(headers);
+    const mine = [...state.sessions.entries()].filter(([, id]) => id === c.id).map(([t]) => t);
+    if (params[0] === "others") {
+      for (const t of mine) if (t !== token) state.sessions.delete(t);
+      return { status: 204 };
+    }
+    const entry = [...state.sessionInfo.entries()].find(([, i]) => i.id === params[0]);
+    if (!entry || entry[1].customer_id !== c.id) throw new HttpError(404, "not_found", "Session not found", "id");
+    state.sessions.delete(entry[0]);
+    return { status: 204 };
+  });
+  route("POST", "/customer/reauth", "customer:write", ({ headers, body }) => {
+    const { c, info } = sessionOf(headers);
+    const hasPassword = typeof body.password === "string" && body.password !== "";
+    const hasCode = typeof body.otp_code === "string" && body.otp_code !== "";
+    if (hasPassword === hasCode) throw new HttpError(400, "validation", "send either password or otp_code", "password");
+    if ((state.reauthFailures.get(c.id) ?? 0) >= 5) throw new HttpError(429, "rate_limited", "Too many attempts, try again later");
+    const field = hasPassword ? "password" : "otp_code";
+    const ok = hasPassword ? c.email !== null && state.passwords.get(c.email) === body.password : [c.email && `email:${c.email}`, c.phone && `phone:${c.phone}`].some((id) => !!id && state.otps.get(id) === body.otp_code);
+    if (!ok) {
+      state.reauthFailures.set(c.id, (state.reauthFailures.get(c.id) ?? 0) + 1);
+      throw new HttpError(400, "validation", "could not verify; check the credential and try again", field);
+    }
+    state.reauthFailures.delete(c.id);
+    info.reauth_at = Date.now();
+    return { body: { reauth_at: new Date(info.reauth_at).toISOString(), valid_for_seconds: REAUTH_WINDOW_MS / 1e3 }, cache: "private" };
+  });
+  route("POST", "/customer/data-export", "customer:write", ({ headers }) => {
+    const { c, info } = sessionOf(headers);
+    requireRecentReauth(info);
+    if ((state.exportsServed.get(c.id) ?? 0) >= 3) throw new HttpError(429, "rate_limited", "Three exports a day; try again tomorrow");
+    state.exportsServed.set(c.id, (state.exportsServed.get(c.id) ?? 0) + 1);
+    const doc = {
+      format: "storefront-customer-data/1",
+      exported_at: now(),
+      account: { id: c.id, email: c.email, phone: c.phone, first_name: c.first_name, last_name: c.last_name, locale: c.locale ?? null, created_at: c.created_at },
+      preferences: c.preferences ?? { notifications: {} },
+      addresses: state.addresses.get(c.id) ?? [],
+      fiscal_profiles: state.fiscalProfiles.get(c.id) ?? [],
+      orders: state.orders.filter((o) => o.customer_id === c.id).map((o) => ({ id: o.id, number: o.number, created_at: o.created_at, status: o.status, total: o.total }))
+    };
+    return {
+      body: {
+        filename: `account-data-${now().slice(0, 10)}.json`,
+        content_type: "application/json",
+        content_base64: btoa(unescape(encodeURIComponent(JSON.stringify(doc, null, 2))))
+      },
+      cache: "private"
+    };
+  });
+  route("DELETE", "/customer", "customer:write", ({ headers, body }) => {
+    const token = headers.get("x-customer-token");
+    if (token && state.deletedTokens.has(token)) return { status: 204 };
+    const { c, info } = sessionOf(headers);
+    requireRecentReauth(info);
+    if (typeof body.confirm !== "string" || !body.confirm.trim() || body.confirm.length > 100) {
+      throw new HttpError(400, "validation", "confirm is required: the text the buyer typed", "confirm");
+    }
+    const closed = /* @__PURE__ */ new Set(["fulfilled", "delivered", "cancelled"]);
+    if (state.orders.some((o) => o.customer_id === c.id && !closed.has(o.status))) {
+      throw new HttpError(409, "conflict", "you have an order in progress; you can delete the account once it is delivered", "orders");
+    }
+    if (c.id === "cus_1" && state.pendingPayments.some((p) => p.status === "pending_payment")) {
+      throw new HttpError(409, "conflict", "you have a payment waiting to be completed", "pending_payments");
+    }
+    for (const [t, id] of [...state.sessions.entries()]) {
+      if (id === c.id) {
+        state.sessions.delete(t);
+        state.deletedTokens.add(t);
+      }
+    }
+    if (c.email) state.passwords.delete(c.email);
+    state.addresses.delete(c.id);
+    state.fiscalProfiles.delete(c.id);
+    state.customers = state.customers.filter((x) => x.id !== c.id);
+    return { status: 204 };
+  });
   const orderView = ({ customer_id: _c, ...o }, detail) => {
     const order = { ...o, invoice: orderInvoice(o) };
     if (order.shipments) order.shipments = order.shipments.map((s) => isTestShipment(s) ? { ...s, tracking_number: null, tracking_url: null } : { ...s, events: sortTrackingEvents(s.events) });
@@ -2944,7 +3098,7 @@ function createMockStorefront(options = {}) {
       return errorResponse(new HttpError(403, "insufficient_scope", `Token lacks scope ${r.scope}`, void 0, void 0, [r.scope]));
     }
     let body = {};
-    if (method !== "GET" && method !== "DELETE") {
+    if (method !== "GET") {
       const text = await request.text();
       if (text) {
         try {