@base44/app-plugin-commerce 0.1.0

package/base44/functions/commerce/storefront-account/entry.ts

@@ -0,0 +1,207 @@
+/**
+ * commerce/storefront-account — customer self-service API.
+ *
+ * Two access modes:
+ *   - authenticated (base44 auth): my-orders, my-downloads, update-my-addresses, my-reviews
+ *   - order_key bearer (guest order tracking): get-order, order-notes, get-download
+ *
+ * All entity access is service-role; the caller is verified per-action
+ * (Order/Customer/DownloadPermission entities are admin-only RLS).
+ */
+import { createClientFromRequest } from "npm:@base44/sdk";
+import { HttpError, getCallerUser, requireUser } from "../../../shared/commerce/auth.ts";
+import { serializeOrderForCustomer } from "../../../shared/commerce/orders.ts";
+
+function ok(data: unknown, status = 200): Response {
+  return Response.json({ success: true, data }, { status });
+}
+
+function fail(e: unknown): Response {
+  if (e instanceof HttpError) {
+    return Response.json({ success: false, error: e.message, code: e.code ?? "error" }, { status: e.status });
+  }
+  console.error("commerce/storefront-account error:", e);
+  return Response.json(
+    { success: false, error: (e as Error)?.message ?? "Internal error", code: "internal_error" },
+    { status: 500 },
+  );
+}
+
+async function customerByEmail(sr: any, email: string): Promise<any | null> {
+  return (await sr.entities["commerce.Customer"].filter({ email: String(email).toLowerCase() }, undefined, 1))?.[0] ?? null;
+}
+
+async function orderByKey(sr: any, orderId: string, orderKey: string): Promise<any> {
+  if (!orderId || !orderKey) throw new HttpError(400, "order_id and order_key are required.", "order_key_required");
+  let order: any = null;
+  try { order = await sr.entities["commerce.Order"].get(orderId); } catch { order = null; }
+  if (!order || order.order_key !== orderKey) throw new HttpError(404, "Order not found.", "order_not_found");
+  return order;
+}
+
+Deno.serve(async (req: Request) => {
+  try {
+    const base44 = createClientFromRequest(req);
+    const sr = base44.asServiceRole;
+    const { action, ...payload } = await req.json().catch(() => ({}));
+    if (!action) throw new HttpError(400, "action is required.", "action_required");
+    const user = await getCallerUser(base44);
+
+    switch (action) {
+      case "my-orders": {
+        requireUser(user);
+        const page = Math.max(1, Math.floor(Number(payload.page) || 1));
+        const perPage = Math.min(50, Math.max(1, Math.floor(Number(payload.per_page) || 10)));
+        const customer = await customerByEmail(sr, user.email);
+        if (!customer) return ok({ orders: [], page, per_page: perPage, has_next: false });
+        const rows = (await sr.entities["commerce.Order"].filter(
+          { customer_id: customer.id },
+          "-created_date",
+          perPage + 1,
+          (page - 1) * perPage,
+        )) ?? [];
+        return ok({
+          orders: rows.slice(0, perPage).map(serializeOrderForCustomer),
+          page,
+          per_page: perPage,
+          has_next: rows.length > perPage,
+        });
+      }
+
+      case "get-order": {
+        const order = await orderByKey(sr, payload.order_id, payload.order_key);
+        return ok({ order: serializeOrderForCustomer(order) });
+      }
+
+      case "order-notes": {
+        const order = await orderByKey(sr, payload.order_id, payload.order_key);
+        const notes = (await sr.entities["commerce.OrderNote"].filter(
+          { order_id: order.id, is_customer_note: true },
+          "-created_date",
+          100,
+        )) ?? [];
+        return ok({ notes: notes.map((n: any) => ({ id: n.id, note: n.note, created_date: n.created_date })) });
+      }
+
+      case "my-downloads": {
+        requireUser(user);
+        const permissions = (await sr.entities["commerce.DownloadPermission"].filter(
+          { customer_email: String(user.email).toLowerCase() },
+          "-created_date",
+          200,
+        )) ?? [];
+        return ok({ downloads: permissions.map(publicPermission) });
+      }
+
+      case "get-download": {
+        const permissionId = String(payload.permission_id || "");
+        if (!permissionId) throw new HttpError(400, "permission_id is required.", "permission_required");
+        let perm: any = null;
+        try { perm = await sr.entities["commerce.DownloadPermission"].get(permissionId); } catch { perm = null; }
+        if (!perm) throw new HttpError(404, "Download not found.", "download_not_found");
+
+        // access check: authenticated owner OR order_key bearer
+        const authed = user && String(user.email).toLowerCase() === String(perm.customer_email).toLowerCase();
+        const keyed = payload.order_key && payload.order_key === perm.order_key;
+        if (!authed && !keyed) throw new HttpError(403, "You do not have access to this download.", "forbidden");
+
+        if (perm.downloads_remaining === 0) {
+          throw new HttpError(403, "Download limit reached.", "download_limit_reached");
+        }
+        if (perm.access_expires && new Date(perm.access_expires).getTime() < Date.now()) {
+          throw new HttpError(403, "Download access has expired.", "download_expired");
+        }
+
+        const patch: Record<string, any> = { download_count: (perm.download_count ?? 0) + 1 };
+        if (perm.downloads_remaining > 0) patch.downloads_remaining = perm.downloads_remaining - 1;
+        await sr.entities["commerce.DownloadPermission"].update(perm.id, patch);
+
+        // private files (non-http uri) get a short-lived signed URL
+        let url = perm.file_url ?? "";
+        if (url && !/^https?:\/\//i.test(url)) {
+          const signed = await sr.integrations.Core.CreateFileSignedUrl({ file_uri: url, expires_in: 3600 });
+          url = signed?.signed_url ?? url;
+        }
+        return ok({
+          url,
+          download_name: perm.download_name,
+          downloads_remaining: patch.downloads_remaining ?? perm.downloads_remaining,
+        });
+      }
+
+      case "update-my-addresses": {
+        requireUser(user);
+        const email = String(user.email).toLowerCase();
+        const existing = await customerByEmail(sr, email);
+        const patch: Record<string, any> = {};
+        if (payload.billing) patch.billing = payload.billing;
+        if (payload.shipping) patch.shipping = payload.shipping;
+        if (!Object.keys(patch).length) {
+          throw new HttpError(400, "Provide billing and/or shipping.", "nothing_to_update");
+        }
+        let customer: any;
+        if (existing) {
+          await sr.entities["commerce.Customer"].update(existing.id, patch);
+          customer = { ...existing, ...patch };
+        } else {
+          customer = await sr.entities["commerce.Customer"].create({
+            email,
+            first_name: user.full_name?.split(" ")[0] ?? "",
+            last_name: user.full_name?.split(" ").slice(1).join(" ") ?? "",
+            user_id: user.id,
+            is_guest: false,
+            ...patch,
+          });
+        }
+        return ok({ customer: publicCustomer(customer) });
+      }
+
+      case "my-reviews": {
+        requireUser(user);
+        const reviews = (await sr.entities["commerce.ProductReview"].filter(
+          { reviewer_email: String(user.email).toLowerCase() },
+          "-created_date",
+          100,
+        )) ?? [];
+        return ok({
+          reviews: reviews.map((r: any) => ({
+            id: r.id,
+            product_id: r.product_id,
+            review: r.review,
+            rating: r.rating,
+            status: r.status,
+            verified: !!r.verified,
+            created_date: r.created_date,
+          })),
+        });
+      }
+
+      default:
+        throw new HttpError(400, `Unknown action: ${action}`, "unknown_action");
+    }
+  } catch (e) {
+    return fail(e);
+  }
+});
+
+function publicPermission(p: any): any {
+  return {
+    permission_id: p.id,
+    order_id: p.order_id,
+    product_id: p.product_id,
+    download_name: p.download_name,
+    downloads_remaining: p.downloads_remaining,
+    access_expires: p.access_expires,
+    download_count: p.download_count ?? 0,
+  };
+}
+
+function publicCustomer(c: any): any {
+  return {
+    email: c.email,
+    first_name: c.first_name,
+    last_name: c.last_name,
+    billing: c.billing ?? {},
+    shipping: c.shipping ?? {},
+  };
+}

package/base44/functions/commerce/storefront-cart/cart-pricing.ts

@@ -0,0 +1,258 @@
+/**
+ * Cart resolution + pricing helpers for storefront functions.
+ * NOTE: duplicated in commerce/storefront-cart/ and commerce/storefront-checkout/ — keep in sync.
+ * (Base44 functions can only share code via base44/shared/commerce/, which this
+ * template treats as engine-only; per-function helpers live beside entry.ts.)
+ */
+import { HttpError } from "../../../shared/commerce/auth.ts";
+import { getSettings } from "../../../shared/commerce/settings.ts";
+import { calculateTotals } from "../../../shared/commerce/totals.ts";
+import { validateCoupon } from "../../../shared/commerce/coupons.ts";
+import { checkPurchasable } from "../../../shared/commerce/stock.ts";
+import { resolveShippingSelection } from "../../../shared/commerce/shipping.ts";
+import { getSetting } from "../../../shared/commerce/settings.ts";
+import { round2 } from "../../../shared/commerce/money.ts";
+import { scanAll } from "../../../shared/commerce/scan.ts";
+
+export const CART_TTL_MS = 48 * 60 * 60 * 1000; // 48h, refreshed on touch
+
+export function cartExpiry(): string {
+  return new Date(Date.now() + CART_TTL_MS).toISOString();
+}
+
+/** Load an active cart by its bearer token. Throws 404 (not found / expired). */
+export async function loadCart(sr: any, cartToken: string | undefined): Promise<any> {
+  if (!cartToken) throw new HttpError(400, "cart_token is required.", "cart_token_required");
+  const cart = (await sr.entities["commerce.Cart"].filter({ cart_token: cartToken }, undefined, 1))?.[0];
+  if (!cart || cart.status !== "active") {
+    throw new HttpError(404, "Cart not found.", "cart_not_found");
+  }
+  if (cart.expires_at && new Date(cart.expires_at).getTime() < Date.now()) {
+    try { await sr.entities["commerce.Cart"].update(cart.id, { status: "abandoned" }); } catch { /* best-effort */ }
+    throw new HttpError(404, "Cart has expired.", "cart_expired");
+  }
+  return cart;
+}
+
+export interface PricingData {
+  settings: Record<string, any>;
+  taxRates: any[];
+  zones: any[];
+  zoneMethods: any[];
+}
+
+/** One round of catalog-config reads shared by every priced response. */
+export async function loadPricingData(sr: any): Promise<PricingData> {
+  const [settings, taxRates, zones, zoneMethods] = await Promise.all([
+    getSettings(sr),
+    scanAll(sr.entities["commerce.TaxRate"], {}, "menu_order", 2000),
+    scanAll(sr.entities["commerce.ShippingZone"], {}, "order", 500),
+    scanAll(sr.entities["commerce.ShippingZoneMethod"], {}, "order", 1000),
+  ]);
+  return { settings, taxRates, zones, zoneMethods };
+}
+
+export interface ResolvedItem {
+  item: any;        // the stored cart item {item_key, product_id, variation_id, quantity, attributes}
+  product: any;
+  variation?: any;
+}
+
+/**
+ * Resolve stored cart items to live products/variations. Items whose product
+ * vanished or was unpublished are reported in `removed` (they are dropped from
+ * the cart and the shopper is told).
+ */
+export async function resolveItems(sr: any, cart: any): Promise<{ resolved: ResolvedItem[]; removed: any[] }> {
+  const resolved: ResolvedItem[] = [];
+  const removed: any[] = [];
+  for (const item of cart.items || []) {
+    let product: any = null;
+    let variation: any = undefined;
+    try { product = item.product_id ? await sr.entities["commerce.Product"].get(item.product_id) : null; } catch { product = null; }
+    if (!product || product.status !== "publish") {
+      removed.push({ item_key: item.item_key, product_id: item.product_id, reason: "This product is no longer available.", code: "unavailable" });
+      continue;
+    }
+    if (item.variation_id) {
+      try { variation = await sr.entities["commerce.ProductVariation"].get(item.variation_id); } catch { variation = undefined; }
+      if (!variation || (variation.status && variation.status !== "publish")) {
+        removed.push({ item_key: item.item_key, product_id: item.product_id, reason: "This product option is no longer available.", code: "unavailable" });
+        continue;
+      }
+    }
+    resolved.push({ item, product, variation });
+  }
+  return { resolved, removed };
+}
+
+/** Lines in the shape coupons.ts validateCoupon()/eligibleLines() expect. */
+export function couponCtxLines(resolved: ResolvedItem[]): any[] {
+  return resolved.map(({ item, product, variation }) => {
+    const src = variation ?? product;
+    const price = Number(src?.price ?? 0);
+    return {
+      line_id: item.item_key,
+      product_id: item.product_id,
+      variation_id: item.variation_id ?? "",
+      quantity: item.quantity,
+      unit_price: price,
+      subtotal: round2(price * item.quantity),
+      discount: 0,
+      product,
+      variation,
+    };
+  });
+}
+
+export async function findCoupon(sr: any, code: string): Promise<any | null> {
+  if (!code) return null;
+  return (await sr.entities["commerce.Coupon"].filter({ code: String(code).toLowerCase().trim() }, undefined, 1))?.[0] ?? null;
+}
+
+export interface PricedCart {
+  view: any;              // customer-facing cart payload
+  totals: any;            // full TotalsResult
+  resolved: ResolvedItem[];
+  removed: any[];
+  validCoupons: any[];
+  couponNotices: any[];
+  pricingData: PricingData;
+}
+
+/**
+ * Produce the priced view of a cart: resolve items, revalidate stored coupons
+ * (silently dropping ones that stopped validating, with notices), run the
+ * totals engine in preview mode, and enrich items for display.
+ * Persists item removals / coupon drops back onto the Cart record.
+ */
+export async function priceCart(sr: any, cart: any, opts: { pricingData?: PricingData; customerEmail?: string } = {}): Promise<PricedCart> {
+  const pricingData = opts.pricingData ?? (await loadPricingData(sr));
+  const { settings } = pricingData;
+  const { resolved, removed } = await resolveItems(sr, cart);
+
+  const cartPatch: Record<string, any> = {};
+  if (removed.length) {
+    const removedKeys = new Set(removed.map((r) => r.item_key));
+    cart.items = (cart.items || []).filter((i: any) => !removedKeys.has(i.item_key));
+    cartPatch.items = cart.items;
+  }
+
+  // revalidate stored coupons in application order
+  const ctxLines = couponCtxLines(resolved);
+  const itemsSubtotal = round2(ctxLines.reduce((a, l) => a + l.subtotal, 0));
+  const customerEmail = cart.customer_email || opts.customerEmail || "";
+  const validCoupons: any[] = [];
+  const keptCodes: string[] = [];
+  const couponNotices: any[] = [];
+  for (const code of cart.coupon_codes || []) {
+    const coupon = await findCoupon(sr, code);
+    const res = validateCoupon(coupon, {
+      lines: ctxLines,
+      itemsSubtotal,
+      customerEmail,
+      appliedCoupons: validCoupons,
+    });
+    if (res.valid) {
+      validCoupons.push(coupon);
+      keptCodes.push(code);
+    } else {
+      couponNotices.push({ code, error: res.error, error_code: res.code });
+    }
+  }
+  if (keptCodes.length !== (cart.coupon_codes || []).length) {
+    cart.coupon_codes = keptCodes;
+    cartPatch.coupon_codes = keptCodes;
+  }
+  if (Object.keys(cartPatch).length) {
+    try { await sr.entities["commerce.Cart"].update(cart.id, cartPatch); } catch { /* view still correct */ }
+  }
+
+  const priceWith = (chosenShippingMethodId?: string) => calculateTotals({
+    items: resolved.map((r) => ({
+      product: r.product,
+      variation: r.variation,
+      quantity: r.item.quantity,
+      attributes: r.item.attributes ?? [],
+    })),
+    coupons: validCoupons,
+    shipping_address: cart.shipping_address,
+    chosenShippingMethodId: chosenShippingMethodId || undefined,
+    settings,
+    taxRates: pricingData.taxRates,
+    zones: pricingData.zones,
+    zoneMethods: pricingData.zoneMethods,
+  });
+
+  let totals = priceWith(cart.chosen_shipping_method);
+
+  // Keep the cart's shipping choice honest: drop one that is no longer offered
+  // (the address or the cart changed) and auto-select when there is exactly one
+  // option, so a storefront that only sets an address still gets a shipping
+  // line instead of silently shipping for free. `shipping_status` on the view
+  // tells the UI whether it still has to ask the customer.
+  const shippingSelection = resolveShippingSelection({
+    needsShipping: resolved.some((r) => !(r.variation?.virtual ?? r.product.virtual)),
+    shippingEnabled: getSetting(settings, "shipping", "enable_shipping", true) !== false,
+    chosenMethodId: cart.chosen_shipping_method,
+    available: totals.available_shipping_methods,
+  });
+  if (shippingSelection.method_id !== (cart.chosen_shipping_method || "")) {
+    cart.chosen_shipping_method = shippingSelection.method_id;
+    try {
+      await sr.entities["commerce.Cart"].update(cart.id, { chosen_shipping_method: shippingSelection.method_id });
+    } catch { /* view still correct */ }
+    totals = priceWith(shippingSelection.method_id);
+  }
+
+  // display items: engine lines align by index with `resolved`
+  const items = resolved.map((r, i) => {
+    const priced = totals.line_items[i] ?? {};
+    const src = r.variation ?? r.product;
+    return {
+      item_key: r.item.item_key,
+      product_id: r.item.product_id,
+      variation_id: r.item.variation_id ?? "",
+      quantity: r.item.quantity,
+      attributes: r.item.attributes ?? [],
+      name: r.product.name ?? "",
+      sku: priced.sku ?? "",
+      image: r.variation?.image?.src || r.product.images?.[0]?.src || "",
+      price: priced.price ?? Number(src?.price ?? 0),
+      subtotal: priced.subtotal ?? 0,
+      total: priced.total ?? 0,
+      total_tax: priced.total_tax ?? 0,
+      virtual: !!(r.variation?.virtual ?? r.product.virtual),
+      sold_individually: !!r.product.sold_individually,
+      purchasable: checkPurchasable(r.product, r.variation, r.item.quantity, settings),
+    };
+  });
+
+  const view = {
+    cart_token: cart.cart_token,
+    items,
+    coupon_codes: cart.coupon_codes ?? [],
+    coupons: totals.coupon_lines,
+    coupon_notices: couponNotices,
+    removed_items: removed,
+    shipping_address: cart.shipping_address ?? null,
+    chosen_shipping_method: cart.chosen_shipping_method ?? "",
+    available_shipping_methods: totals.available_shipping_methods,
+    shipping_status: shippingSelection.state,
+    totals: {
+      subtotal: totals.subtotal,
+      discount_total: totals.discount_total,
+      discount_tax: totals.discount_tax,
+      shipping_total: totals.shipping_total,
+      shipping_tax: totals.shipping_tax,
+      cart_tax: totals.cart_tax,
+      total_tax: totals.total_tax,
+      total: totals.total,
+      prices_include_tax: totals.prices_include_tax,
+      tax_lines: totals.tax_lines,
+    },
+    expires_at: cart.expires_at ?? null,
+  };
+
+  return { view, totals, resolved, removed, validCoupons, couponNotices, pricingData };
+}