@asteby/storefront 0.9.0 → 0.10.0

package/dist/mock.cjs

@@ -438,6 +438,15 @@ function createMockStorefront(options = {}) {
   const currency = options.currency ?? MOCK_CURRENCY;
   const imageUrl = options.imageUrl ?? MOCK_IMAGE_URL;
   const otpCode = options.otpCode ?? "000000";
+  const capabilities = {
+    password: true,
+    email_verification: true,
+    otp_channels: ["email"],
+    ...options.customerCapabilities
+  };
+  const maxLoginAttempts = options.maxLoginAttempts ?? 5;
+  const MIN_PASSWORD = 10;
+  const MAX_PASSWORD = 128;
   const discountCodes = Object.fromEntries(
     Object.entries(options.discountCodes ?? { BIENVENIDA10: 10 }).map(([k, v]) => [k.toUpperCase(), v])
   );
@@ -470,6 +479,9 @@ function createMockStorefront(options = {}) {
         }
       ],
       otps: /* @__PURE__ */ new Map(),
+      passwords: /* @__PURE__ */ new Map(),
+      pendingRegistrations: /* @__PURE__ */ new Map(),
+      loginFailures: /* @__PURE__ */ new Map(),
       sessions: /* @__PURE__ */ new Map(),
       idempotency: /* @__PURE__ */ new Map(),
       checkouts: /* @__PURE__ */ new Map(),
@@ -754,6 +766,39 @@ function createMockStorefront(options = {}) {
     if (email && !/^[^@\s]+@[^@\s]+$/.test(email)) throw new HttpError(400, "validation", "Invalid email", "email");
     return email ? `email:${email}` : `phone:${phone}`;
   }
+  function emailOf(body) {
+    const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+    if (!email || !/^[^@\s]+@[^@\s]+$/.test(email)) throw new HttpError(400, "validation", "Invalid email", "email");
+    return email;
+  }
+  function passwordOf(body, field = "password") {
+    const value = body[field];
+    if (typeof value !== "string" || value.length < MIN_PASSWORD || value.length > MAX_PASSWORD) {
+      throw new HttpError(400, "validation", `${field} must be ${MIN_PASSWORD}-${MAX_PASSWORD} characters`, field);
+    }
+    return value;
+  }
+  function requirePasswordEnabled() {
+    if (!capabilities.password) throw new HttpError(403, "forbidden", "Password accounts are disabled for this store");
+  }
+  function sessionFor(email, extra = {}) {
+    let customer = state.customers.find((c) => c.email === email);
+    if (!customer) {
+      customer = {
+        id: nextId("cus"),
+        email,
+        phone: null,
+        first_name: extra.first_name ?? null,
+        last_name: extra.last_name ?? null,
+        default_address_id: null,
+        created_at: now()
+      };
+      state.customers.push(customer);
+    }
+    const token = `ct_${customer.id}_${Math.random().toString(36).slice(2)}`;
+    state.sessions.set(token, customer.id);
+    return { token, expires_at: new Date(Date.now() + 30 * 864e5).toISOString(), customer };
+  }
   function validateAddress(body, partial = false) {
     const required = ["address1", "city", "zip", "country_code"];
     if (!partial) {
@@ -1169,6 +1214,74 @@ function createMockStorefront(options = {}) {
       cache: "private"
     };
   });
+  route("GET", "/customer/capabilities", "customer:read", () => ({ body: capabilities, cache: "private" }));
+  route("POST", "/customer/register", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    const password = passwordOf(body);
+    const text = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+    const first_name = text(body.first_name);
+    const last_name = text(body.last_name);
+    if (state.passwords.has(email)) throw new HttpError(409, "conflict", "An account with this email already exists", "email");
+    if (capabilities.email_verification) {
+      state.pendingRegistrations.set(email, { password, first_name, last_name });
+      state.otps.set(`email:${email}`, otpCode);
+      return { status: 202, body: { status: "verification_required" }, cache: "private" };
+    }
+    state.passwords.set(email, password);
+    return { status: 201, body: sessionFor(email, { first_name, last_name }), cache: "private" };
+  });
+  route("POST", "/customer/register/verify", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    const pending = state.pendingRegistrations.get(email);
+    if (!pending || typeof body.code !== "string" || state.otps.get(`email:${email}`) !== body.code) {
+      throw new HttpError(401, "unauthorized", "Invalid or expired code", "code");
+    }
+    state.pendingRegistrations.delete(email);
+    state.otps.delete(`email:${email}`);
+    state.passwords.set(email, pending.password);
+    return { status: 201, body: sessionFor(email, pending), cache: "private" };
+  });
+  route("POST", "/customer/login", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    if ((state.loginFailures.get(email) ?? 0) >= maxLoginAttempts) {
+      throw new HttpError(429, "rate_limited", "Too many failed attempts, try again later");
+    }
+    const stored = state.passwords.get(email);
+    if (stored === void 0 || typeof body.password !== "string" || body.password !== stored) {
+      state.loginFailures.set(email, (state.loginFailures.get(email) ?? 0) + 1);
+      throw new HttpError(401, "unauthorized", "Invalid email or password");
+    }
+    state.loginFailures.delete(email);
+    return { status: 201, body: sessionFor(email), cache: "private" };
+  });
+  route("PUT", "/customer/password", "customer:write", ({ headers, body }) => {
+    requirePasswordEnabled();
+    const customer = requireCustomer(headers);
+    const password = passwordOf(body);
+    const email = customer.email;
+    if (!email) throw new HttpError(422, "invalid_state", "The account has no email", "email");
+    const current = state.passwords.get(email);
+    if (current !== void 0 && body.current_password !== current) {
+      throw new HttpError(401, "unauthorized", "current_password is missing or wrong", "current_password");
+    }
+    state.passwords.set(email, password);
+    return { status: 204 };
+  });
+  route("POST", "/customer/password/reset", "customer:write", ({ body }) => {
+    requirePasswordEnabled();
+    const email = emailOf(body);
+    const password = passwordOf(body);
+    if (typeof body.code !== "string" || state.otps.get(`email:${email}`) !== body.code || !state.customers.some((c) => c.email === email)) {
+      throw new HttpError(401, "unauthorized", "Invalid or expired code", "code");
+    }
+    state.otps.delete(`email:${email}`);
+    state.passwords.set(email, password);
+    state.loginFailures.delete(email);
+    return { status: 204 };
+  });
   route("GET", "/customer", "customer:read", ({ headers }) => ({ body: requireCustomer(headers), cache: "private" }));
   const stripOrder = ({ customer_id: _c, ...o }) => o;
   route("GET", "/customer/orders", "orders:read", ({ headers, search }) => {