@asteby/storefront 0.8.0 → 0.10.0

package/dist/mock.d.cts

@@ -1,4 +1,4 @@
-import { aB as Shop, ah as Product, w as Collection, aI as Theme, $ as Page, U as Menu, b as Article, C as Cart, A as Address, y as Customer, Z as Order, a2 as PaymentAttemptResult, ao as PromotionAnnouncement, aA as ShippingRate, a8 as PaymentMethod } from './types-CSMuPSQA.cjs';
+import { aI as Shop, ao as Product, w as Collection, aP as Theme, a6 as Page, $ as Menu, b as Article, C as Cart, A as Address, y as Customer, a4 as Order, a9 as PaymentAttemptResult, z as CustomerCapabilities, av as PromotionAnnouncement, aH as ShippingRate, af as PaymentMethod } from './types-DdLzlxw4.cjs';
 import './geo.cjs';
 
 /**
@@ -31,6 +31,14 @@ type MockStorefrontOptions = {
     imageUrl?: MockImageUrl;
     /** OTP code accepted by `/customer/session` (default `000000`). */
     otpCode?: string;
+    /**
+     * What `GET /customer/capabilities` reports (default `{ password: true, email_verification: true, otp_channels: ['email'] }`).
+     * `password: false` makes register / login / password routes answer `403`; `email_verification: false` makes `register`
+     * create the account straight away (`201`).
+     */
+    customerCapabilities?: Partial<CustomerCapabilities>;
+    /** Failed password logins per email before `429 rate_limited` (default 5; a success or a reset clears the count). */
+    maxLoginAttempts?: number;
     /** Discount codes → percentage off the subtotal (default `{ BIENVENIDA10: 10 }`). */
     discountCodes?: Record<string, number>;
     /** Flat shipping rate (default 149). Free from `shop.policies.free_shipping_min`. */
@@ -96,6 +104,16 @@ type MockState = {
         customer_id: string | null;
     })[];
     otps: Map<string, string>;
+    /** Email → password (plain text: it is a mock). The seed customer starts without one. */
+    passwords: Map<string, string>;
+    /** Registrations waiting for their code, by email. */
+    pendingRegistrations: Map<string, {
+        password: string;
+        first_name: string | null;
+        last_name: string | null;
+    }>;
+    /** Consecutive failed password logins by email. */
+    loginFailures: Map<string, number>;
     sessions: Map<string, string>;
     idempotency: Map<string, {
         status: number;

package/dist/mock.d.ts

@@ -1,4 +1,4 @@
-import { aB as Shop, ah as Product, w as Collection, aI as Theme, $ as Page, U as Menu, b as Article, C as Cart, A as Address, y as Customer, Z as Order, a2 as PaymentAttemptResult, ao as PromotionAnnouncement, aA as ShippingRate, a8 as PaymentMethod } from './types-iGGZ9EiC.js';
+import { aI as Shop, ao as Product, w as Collection, aP as Theme, a6 as Page, $ as Menu, b as Article, C as Cart, A as Address, y as Customer, a4 as Order, a9 as PaymentAttemptResult, z as CustomerCapabilities, av as PromotionAnnouncement, aH as ShippingRate, af as PaymentMethod } from './types-COSwo4ND.js';
 import './geo.js';
 
 /**
@@ -31,6 +31,14 @@ type MockStorefrontOptions = {
     imageUrl?: MockImageUrl;
     /** OTP code accepted by `/customer/session` (default `000000`). */
     otpCode?: string;
+    /**
+     * What `GET /customer/capabilities` reports (default `{ password: true, email_verification: true, otp_channels: ['email'] }`).
+     * `password: false` makes register / login / password routes answer `403`; `email_verification: false` makes `register`
+     * create the account straight away (`201`).
+     */
+    customerCapabilities?: Partial<CustomerCapabilities>;
+    /** Failed password logins per email before `429 rate_limited` (default 5; a success or a reset clears the count). */
+    maxLoginAttempts?: number;
     /** Discount codes → percentage off the subtotal (default `{ BIENVENIDA10: 10 }`). */
     discountCodes?: Record<string, number>;
     /** Flat shipping rate (default 149). Free from `shop.policies.free_shipping_min`. */
@@ -96,6 +104,16 @@ type MockState = {
         customer_id: string | null;
     })[];
     otps: Map<string, string>;
+    /** Email → password (plain text: it is a mock). The seed customer starts without one. */
+    passwords: Map<string, string>;
+    /** Registrations waiting for their code, by email. */
+    pendingRegistrations: Map<string, {
+        password: string;
+        first_name: string | null;
+        last_name: string | null;
+    }>;
+    /** Consecutive failed password logins by email. */
+    loginFailures: Map<string, number>;
     sessions: Map<string, string>;
     idempotency: Map<string, {
         status: number;

package/dist/mock.js

@@ -395,6 +395,15 @@ function createMockStorefront(options = {}) {
   const currency = options.currency ?? MOCK_CURRENCY;
   const imageUrl = options.imageUrl ?? MOCK_IMAGE_URL;
   const otpCode = options.otpCode ?? "000000";
+  const capabilities = {
+    password: true,
+    email_verification: true,
+    otp_channels: ["email"],
+    ...options.customerCapabilities
+  };
+  const maxLoginAttempts = options.maxLoginAttempts ?? 5;
+  const MIN_PASSWORD = 10;
+  const MAX_PASSWORD = 128;
   const discountCodes = Object.fromEntries(
     Object.entries(options.discountCodes ?? { BIENVENIDA10: 10 }).map(([k, v]) => [k.toUpperCase(), v])
   );
@@ -427,6 +436,9 @@ function createMockStorefront(options = {}) {
         }
       ],
       otps: /* @__PURE__ */ new Map(),
+      passwords: /* @__PURE__ */ new Map(),
+      pendingRegistrations: /* @__PURE__ */ new Map(),
+      loginFailures: /* @__PURE__ */ new Map(),
       sessions: /* @__PURE__ */ new Map(),
       idempotency: /* @__PURE__ */ new Map(),
       checkouts: /* @__PURE__ */ new Map(),
@@ -711,6 +723,39 @@ function createMockStorefront(options = {}) {
     if (email && !/^[^@\s]+@[^@\s]+$/.test(email)) throw new HttpError(400, "validation", "Invalid email", "email");
     return email ? `email:${email}` : `phone:${phone}`;
   }
+  function emailOf(body) {
+    const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+    if (!email || !/^[^@\s]+@[^@\s]+$/.test(email)) throw new HttpError(400, "validation", "Invalid email", "email");
+    return email;
+  }
+  function passwordOf(body, field = "password") {
+    const value = body[field];
+    if (typeof value !== "string" || value.length < MIN_PASSWORD || value.length > MAX_PASSWORD) {
+      throw new HttpError(400, "validation", `${field} must be ${MIN_PASSWORD}-${MAX_PASSWORD} characters`, field);
+    }
+    return value;
+  }
+  function requirePasswordEnabled() {
+    if (!capabilities.password) throw new HttpError(403, "forbidden", "Password accounts are disabled for this store");
+  }
+  function sessionFor(email, extra = {}) {
+    let customer = state.customers.find((c) => c.email === email);
+    if (!customer) {
+      customer = {
+        id: nextId("cus"),
+        email,
+        phone: null,
+        first_name: extra.first_name ?? null,
+        last_name: extra.last_name ?? null,
+        default_address_id: null,
+        created_at: now()
+      };
+      state.customers.push(customer);
+    }
+    const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
+    state.sessions.set(token, customer.id);
+    return { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer };
+  }
   function validateAddress(body, partial = false) {
     const required = ["address1", "city", "zip", "country_code"];
     if (!partial) {
@@ -1126,6 +1171,74 @@ function createMockStorefront(options = {}) {
       cache: "private"
     };
   });
+  route("GET", "/customer/capabilities", "customer:read", () => ({ body: capabilities, cache: "private" }));
+  route("POST", "/customer/register", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    const password = passwordOf(body);
+    const text = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+    const first_name = text(body.first_name);
+    const last_name = text(body.last_name);
+    if (state.passwords.has(email)) throw new HttpError(409, "conflict", "An account with this email already exists", "email");
+    if (capabilities.email_verification) {
+      state.pendingRegistrations.set(email, { password, first_name, last_name });
+      state.otps.set(`email:${email}`, otpCode);
+      return { status: 202, body: { status: "verification_required" }, cache: "private" };
+    }
+    state.passwords.set(email, password);
+    return { status: 201, body: sessionFor(email, { first_name, last_name }), cache: "private" };
+  });
+  route("POST", "/customer/register/verify", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    const pending = state.pendingRegistrations.get(email);
+    if (!pending || typeof body.code !== "string" || state.otps.get(`email:${email}`) !== body.code) {
+      throw new HttpError(401, "unauthorized", "Invalid or expired code", "code");
+    }
+    state.pendingRegistrations.delete(email);
+    state.otps.delete(`email:${email}`);
+    state.passwords.set(email, pending.password);
+    return { status: 201, body: sessionFor(email, pending), cache: "private" };
+  });
+  route("POST", "/customer/login", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    if ((state.loginFailures.get(email) ?? 0) >= maxLoginAttempts) {
+      throw new HttpError(429, "rate_limited", "Too many failed attempts, try again later");
+    }
+    const stored = state.passwords.get(email);
+    if (stored === void 0 || typeof body.password !== "string" || body.password !== stored) {
+      state.loginFailures.set(email, (state.loginFailures.get(email) ?? 0) + 1);
+      throw new HttpError(401, "unauthorized", "Invalid email or password");
+    }
+    state.loginFailures.delete(email);
+    return { status: 201, body: sessionFor(email), cache: "private" };
+  });
+  route("PUT", "/customer/password", "customer:write", ({ headers, body }) => {
+    requirePasswordEnabled();
+    const customer = requireCustomer(headers);
+    const password = passwordOf(body);
+    const email = customer.email;
+    if (!email) throw new HttpError(422, "invalid_state", "The account has no email", "email");
+    const current = state.passwords.get(email);
+    if (current !== void 0 && body.current_password !== current) {
+      throw new HttpError(401, "unauthorized", "current_password is missing or wrong", "current_password");
+    }
+    state.passwords.set(email, password);
+    return { status: 204 };
+  });
+  route("POST", "/customer/password/reset", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    const password = passwordOf(body);
+    if (typeof body.code !== "string" || state.otps.get(`email:${email}`) !== body.code || !state.customers.some((c) => c.email === email)) {
+      throw new HttpError(401, "unauthorized", "Invalid or expired code", "code");
+    }
+    state.otps.delete(`email:${email}`);
+    state.passwords.set(email, password);
+    state.loginFailures.delete(email);
+    return { status: 204 };
+  });
   route("GET", "/customer", "customer:read", ({ headers }) => ({ body: requireCustomer(headers), cache: "private" }));
   const stripOrder = ({ customer_id: _c, ...o }) => o;
   route("GET", "/customer/orders", "orders:read", ({ headers, search }) => {