@blamejs/blamejs-shop 0.2.13 → 0.2.14

package/lib/admin.js

@@ -138,6 +138,25 @@ function _strictMinorInt(value, prefix, label) {
   return n;
 }
 
+// Parse a "k=v, k=v" form string into a variant options attribute map.
+// An empty / whitespace string yields `{}` (no options). A pair missing
+// its `=` is skipped rather than throwing — the catalog primitive does
+// the authoritative validation on the resulting object. Keys + values
+// are trimmed; a duplicate key keeps the last value.
+function _parseOptionsString(s) {
+  if (s == null) return {};
+  if (typeof s !== "string") return {};
+  var out = {};
+  s.split(",").forEach(function (pair) {
+    var eq = pair.indexOf("=");
+    if (eq === -1) return;
+    var k = pair.slice(0, eq).trim();
+    var v = pair.slice(eq + 1).trim();
+    if (k) out[k] = v;
+  });
+  return out;
+}
+
 // ---- bearer auth --------------------------------------------------------
 
 function _readBearer(req) {
@@ -401,11 +420,77 @@ function mount(router, deps) {
     },
   ));
 
-  router.get("/admin/products/:id", R(async function (req, res) {
-    var p = await catalog.products.get(req.params.id);
-    if (!p) return _problem(res, 404, "product-not-found");
-    _json(res, 200, p);
-  }));
+  // Default currency for the price-set form — read from shop config when
+  // wired, falling back to USD. A config read failure (unconfigured store)
+  // is non-fatal: the form just defaults to USD.
+  async function _defaultCurrency() {
+    if (!deps.config) return "USD";
+    try {
+      var c = await deps.config.get("shop.currency", "USD");
+      return (typeof c === "string" && /^[A-Z]{3}$/.test(c)) ? c : "USD";
+    } catch (_e) { return "USD"; }
+  }
+
+  // Hydrate the full detail model: the product, its variants, each
+  // variant's price-per-currency (current + history), and the product's
+  // media. Throws TypeError on a malformed id (defensive id reader) — the
+  // caller maps that to a 404, never a 500.
+  async function _productDetailModel(id) {
+    var p = await catalog.products.get(id);
+    if (!p) return null;
+    var variants = await catalog.variants.listForProduct(id);
+    var pricesByVariant = {};
+    for (var i = 0; i < variants.length; i += 1) {
+      var v = variants[i];
+      var currencies = await catalog.prices.currencies(v.id);
+      var perCurrency = [];
+      for (var j = 0; j < currencies.length; j += 1) {
+        var cur = currencies[j];
+        perCurrency.push({
+          currency: cur,
+          current:  await catalog.prices.current(v.id, cur),
+          history:  await catalog.prices.history(v.id, cur),
+        });
+      }
+      pricesByVariant[v.id] = { currencies: perCurrency };
+    }
+    var media = await catalog.media.listForProduct(id);
+    return { product: p, variants: variants, prices_by_variant: pricesByVariant, media: media };
+  }
+
+  // Detail content-negotiates: bearer → JSON (product + variants + prices
+  // + media); browser → the full management screen. A bad / unknown id is
+  // a 404 page, never a 500.
+  router.get("/admin/products/:id", _pageOrApi(true,
+    R(async function (req, res) {
+      var model;
+      try { model = await _productDetailModel(req.params.id); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 404, "product-not-found", e.message); throw e; }
+      if (!model) return _problem(res, 404, "product-not-found");
+      _json(res, 200, model);
+    }),
+    async function (req, res) {
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      var model;
+      try { model = await _productDetailModel(req.params.id); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; model = null; }
+      if (!model) {
+        var page = await catalog.products.list({ limit: 100 });
+        return _sendHtml(res, 404, renderAdminProducts({
+          shop_name: deps.shop_name, nav_available: navAvailable, products: page.rows || [], notice: "Product not found.",
+        }));
+      }
+      _sendHtml(res, 200, renderAdminProduct({
+        shop_name: deps.shop_name, nav_available: navAvailable,
+        product: model.product, variants: model.variants,
+        prices_by_variant: model.prices_by_variant, media: model.media,
+        asset_prefix: assetPrefix, upload_available: !!r2,
+        default_currency: await _defaultCurrency(),
+        saved:  url && url.searchParams.get("saved"),
+        notice: (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+      }));
+    },
+  ));
 
   router.patch("/admin/products/:id", W("product.update", async function (req, res) {
     var p = await catalog.products.update(req.params.id, req.body || {});
@@ -414,6 +499,40 @@ function mount(router, deps) {
     return p;
   }));
 
+  // Browser POST alias for the product fields edit (HTML forms can't
+  // PATCH). Bearer clients keep using PATCH /admin/products/:id. Bad input
+  // re-renders the detail with a notice (?err=1), never a 500.
+  router.post("/admin/products/:id/edit", _pageOrApi(false,
+    W("product.update", async function (req, res) {
+      var p;
+      try { p = await catalog.products.update(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!p) return _problem(res, 404, "product-not-found");
+      _json(res, 200, p);
+      return p;
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      var patch = {};
+      if (typeof body.slug === "string")        patch.slug = body.slug.trim();
+      if (typeof body.title === "string")       patch.title = body.title;
+      if (typeof body.description === "string") patch.description = body.description;
+      if (typeof body.status === "string" && body.status) patch.status = body.status;
+      try {
+        if (Object.keys(patch).length === 0) return _redirect(res, "/admin/products/" + enc + "?err=1");
+        var p = await catalog.products.update(id, patch);
+        if (!p) return _redirect(res, "/admin/products/" + enc + "?err=1");
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".product.update", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   function _productStateAction(verb, op, audit) {
     return _pageOrApi(false,
       W(audit, async function (req, res) {
@@ -443,6 +562,37 @@ function mount(router, deps) {
     return v;
   }));
 
+  // Browser POST alias for variant create from the product detail screen.
+  // The options string ("k=v, k=v") and the weight / requires_shipping
+  // selects come in as form strings — coerce them to the shapes the
+  // primitive expects before handing off. Bad input → ?err=1 notice.
+  router.post("/admin/products/:id/variants/create", _pageOrApi(false,
+    W("variant.create", async function (req, res) {
+      var v = await catalog.variants.create(req.params.id, req.body || {});
+      _json(res, 201, v);
+      return v;
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      try {
+        await catalog.variants.create(id, {
+          sku:               typeof body.sku === "string" ? body.sku.trim() : body.sku,
+          title:             typeof body.title === "string" ? body.title : undefined,
+          options:           _parseOptionsString(body.options),
+          weight_grams:      body.weight_grams === undefined || body.weight_grams === "" ? undefined : _strictMinorInt(body.weight_grams, "admin.variant", "weight_grams"),
+          requires_shipping: body.requires_shipping === undefined ? undefined : (String(body.requires_shipping) === "1"),
+        });
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".variant.create", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   router.patch("/admin/variants/:id", W("variant.update", async function (req, res) {
     var v = await catalog.variants.update(req.params.id, req.body || {});
     if (!v) return _problem(res, 404, "variant-not-found");
@@ -450,6 +600,51 @@ function mount(router, deps) {
     return v;
   }));
 
+  // Resolve the owning product id for a variant so a variant-scoped
+  // browser route can redirect back to the product detail page. Returns
+  // null for a missing / malformed id.
+  async function _variantProductId(variantId) {
+    var v = null;
+    try { v = await catalog.variants.get(variantId); }
+    catch (e) { if (!(e instanceof TypeError)) throw e; }
+    return v ? v.product_id : null;
+  }
+
+  // Browser POST alias for variant edit (HTML forms can't PATCH).
+  router.post("/admin/variants/:id/edit", _pageOrApi(false,
+    W("variant.update", async function (req, res) {
+      var v;
+      try { v = await catalog.variants.update(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!v) return _problem(res, 404, "variant-not-found");
+      _json(res, 200, v);
+      return v;
+    }),
+    async function (req, res) {
+      var vid  = req.params.id;
+      var body = req.body || {};
+      var productId = await _variantProductId(vid);
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!productId) return _redirect(res, back + "?err=1");
+      try {
+        var patch = {};
+        if (typeof body.sku === "string")   patch.sku = body.sku.trim();
+        if (typeof body.title === "string") patch.title = body.title;
+        if (typeof body.options === "string") patch.options = _parseOptionsString(body.options);
+        if (body.weight_grams !== undefined && body.weight_grams !== "") patch.weight_grams = _strictMinorInt(body.weight_grams, "admin.variant", "weight_grams");
+        if (body.requires_shipping !== undefined) patch.requires_shipping = String(body.requires_shipping) === "1";
+        if (Object.keys(patch).length === 0) return _redirect(res, back + "?err=1");
+        var v = await catalog.variants.update(vid, patch);
+        if (!v) return _redirect(res, back + "?err=1");
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, back + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".variant.update", outcome: "success", metadata: { id: vid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   router.delete("/admin/variants/:id", W("variant.delete", async function (req, res) {
     var ok = await catalog.variants.delete(req.params.id);
     if (!ok) return _problem(res, 404, "variant-not-found");
@@ -457,6 +652,56 @@ function mount(router, deps) {
     return { id: req.params.id };
   }));
 
+  // Browser confirm interstitial for variant delete — deleting a variant
+  // removes its prices + media via the FK cascade, so the console confirms
+  // first (the CSP forbids a client confirm() dialog). Reached by a GET
+  // link from the detail screen; bearer clients DELETE directly.
+  router.get("/admin/variants/:id/delete/confirm-page", _pageOrApi(true,
+    R(async function (_req, res) {
+      return _problem(res, 405, "use-canonical-endpoint", "DELETE /admin/variants/:id (or POST .../delete) directly for the JSON API");
+    }),
+    async function (req, res) {
+      var vid = req.params.id;
+      var v = null;
+      try { v = await catalog.variants.get(vid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      var productId = v ? v.product_id : null;
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!v) return _redirect(res, back + "?err=1");
+      _sendHtml(res, 200, renderAdminConfirm({
+        shop_name: deps.shop_name, nav_available: navAvailable, active: "products",
+        heading: "Delete this variant?",
+        consequence: "Deleting the variant is permanent — its prices and any media attached to it are removed too.",
+        detail: "Variant: " + (v.title || v.sku) + " (" + v.sku + ").",
+        action: "/admin/variants/" + _htmlEscape(vid) + "/delete",
+        confirm_label: "Delete variant",
+        cancel_href: back,
+      }));
+    },
+  ));
+
+  // Browser POST for variant delete (HTML forms can't DELETE). Bearer
+  // clients keep using DELETE /admin/variants/:id.
+  router.post("/admin/variants/:id/delete", _pageOrApi(false,
+    W("variant.delete", async function (req, res) {
+      var ok = await catalog.variants.delete(req.params.id);
+      if (!ok) return _problem(res, 404, "variant-not-found");
+      _json(res, 200, { ok: true });
+      return { id: req.params.id };
+    }),
+    async function (req, res) {
+      var vid = req.params.id;
+      var productId = await _variantProductId(vid);
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      var ok = false;
+      try { ok = await catalog.variants.delete(vid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      if (!ok) return _redirect(res, back + "?err=1");
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".variant.delete", outcome: "success", metadata: { id: vid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   // ---- prices ---------------------------------------------------------
 
   router.post("/admin/variants/:id/prices", W("price.set", async function (req, res) {
@@ -465,6 +710,37 @@ function mount(router, deps) {
     return p;
   }));
 
+  // Browser POST alias for setting a price from the product detail screen.
+  // The amount comes in as a form string — coerce it with the strict
+  // integer reader (refuses "29.99" / "" / "50abc") before handing to the
+  // primitive. Bad input → ?err=1 notice on the product detail.
+  router.post("/admin/variants/:id/prices/set", _pageOrApi(false,
+    W("price.set", async function (req, res) {
+      var p = await catalog.prices.set(req.params.id, req.body || {});
+      _json(res, 201, p);
+      return p;
+    }),
+    async function (req, res) {
+      var vid  = req.params.id;
+      var body = req.body || {};
+      var productId = await _variantProductId(vid);
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!productId) return _redirect(res, back + "?err=1");
+      try {
+        var amount = _strictMinorInt(body.amount_minor, "admin.price", "amount_minor");
+        await catalog.prices.set(vid, {
+          currency:     typeof body.currency === "string" ? body.currency.trim().toUpperCase() : body.currency,
+          amount_minor: amount,
+        });
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, back + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".price.set", outcome: "success", metadata: { id: vid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   router.get("/admin/variants/:id/prices", R(async function (req, res) {
     var url = req.url ? new URL(req.url, "http://localhost") : null;
     var currency = url && url.searchParams.get("currency");
@@ -607,6 +883,36 @@ function mount(router, deps) {
     return m;
   }));
 
+  // Browser POST alias: attach an existing R2 object to a product from the
+  // product detail screen. The product id comes from the path; the
+  // primitive validates the r2_key + content_type. Bad input → ?err=1.
+  router.post("/admin/products/:id/media/attach", _pageOrApi(false,
+    W("media.attach", async function (req, res) {
+      var body = Object.assign({}, req.body || {}, { product_id: req.params.id });
+      var m = await catalog.media.attach(body);
+      _json(res, 201, m);
+      return m;
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      try {
+        await catalog.media.attach({
+          product_id:   id,
+          r2_key:       typeof body.r2_key === "string" ? body.r2_key.trim() : body.r2_key,
+          content_type: typeof body.content_type === "string" ? body.content_type.trim() : body.content_type,
+          alt_text:     typeof body.alt_text === "string" ? body.alt_text : undefined,
+        });
+      } catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.attach", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   // --- media upload (r2 bridge) ---------------------------------------
   // POST /admin/media/upload — fetches `source_url` via b.httpClient
   // (SSRF gate + size cap), uploads to R2 through the bridge, then
@@ -614,8 +920,13 @@ function mount(router, deps) {
   // r2_bridge is wired (operator hasn't set D1_BRIDGE_URL +
   // D1_BRIDGE_SECRET).
   if (r2) {
-    router.post("/admin/media/upload", W("media.upload", async function (req, res) {
-      var body = req.body || {};
+    // Fetch → store → attach, shared by the JSON upload route and the
+    // browser POST alias. Throws TypeError on bad input (mapped to 400);
+    // returns `{ status, code, detail }` for an operational failure the
+    // caller renders as a problem (JSON) or ?err=1 (browser), or `{ rec }`
+    // on success.
+    async function _performMediaUpload(body) {
+      body = body || {};
       if (typeof body.source_url !== "string" || !body.source_url.length) {
         throw new TypeError("admin.media.upload: body.source_url required");
       }
@@ -641,11 +952,10 @@ function mount(router, deps) {
           headers:   { "accept": body.content_type + ",*/*;q=0.5" },
         });
       } catch (e) {
-        return _problem(res, 502, "source-fetch-failed", (e && e.message) || String(e));
+        return { status: 502, code: "source-fetch-failed", detail: (e && e.message) || String(e) };
       }
       if (fetched.statusCode < 200 || fetched.statusCode >= 300) {
-        return _problem(res, 502, "source-fetch-status",
-          "source_url returned HTTP " + fetched.statusCode);
+        return { status: 502, code: "source-fetch-status", detail: "source_url returned HTTP " + fetched.statusCode };
       }
       var fetchedCT = String(fetched.headers && (fetched.headers["content-type"] || fetched.headers["Content-Type"]) || "");
       // Loose match — the declared content_type must be a prefix of
@@ -655,13 +965,13 @@ function mount(router, deps) {
       var declared = body.content_type.split(";")[0].trim().toLowerCase();
       var served   = fetchedCT.split(";")[0].trim().toLowerCase();
       if (served && declared !== served) {
-        return _problem(res, 422, "content-type-mismatch",
-          "source_url served `" + served + "` but operator declared `" + declared + "`");
+        return { status: 422, code: "content-type-mismatch",
+          detail: "source_url served `" + served + "` but operator declared `" + declared + "`" };
       }
       var buf = fetched.body && Buffer.isBuffer(fetched.body) ? fetched.body
               : Buffer.from(fetched.body || "");
       if (buf.length === 0) {
-        return _problem(res, 422, "source-empty", "source_url returned an empty body");
+        return { status: 422, code: "source-empty", detail: "source_url returned an empty body" };
       }
       // Generate the R2 key. The extension is inferred from the
       // declared content-type so the operator can preview the asset
@@ -672,7 +982,7 @@ function mount(router, deps) {
       try {
         await r2.put(key, buf, body.content_type);
       } catch (e) {
-        return _problem(res, 502, "r2-upload-failed", (e && e.message) || String(e));
+        return { status: 502, code: "r2-upload-failed", detail: (e && e.message) || String(e) };
       }
       var m;
       try {
@@ -690,15 +1000,42 @@ function mount(router, deps) {
         // The R2 write succeeded but the DB row didn't land — surface
         // the orphan key so the operator can reconcile or re-attach.
         var problem = e instanceof TypeError ? 400 : 500;
-        return _problem(res, problem, "media-attach-failed",
-          (e && e.message || String(e)) + " (orphan r2_key=" + key + ")");
+        return { status: problem, code: "media-attach-failed",
+          detail: (e && e.message || String(e)) + " (orphan r2_key=" + key + ")" };
       }
       // Expose the public asset URL alongside the media row so the
       // admin UI can preview without an extra round-trip.
-      var rec = Object.assign({}, m, { asset_url: assetPrefix + key });
-      _json(res, 201, rec);
-      return rec;
+      return { rec: Object.assign({}, m, { asset_url: assetPrefix + key }) };
+    }
+
+    router.post("/admin/media/upload", W("media.upload", async function (req, res) {
+      var out = await _performMediaUpload(req.body || {});
+      if (out.rec) { _json(res, 201, out.rec); return out.rec; }
+      return _problem(res, out.status, out.code, out.detail);
     }));
+
+    // Browser POST alias: upload-from-URL scoped to a product (id from the
+    // path). On success PRGs back to the detail; an operational failure or
+    // bad input lands a ?err=1 notice rather than a problem-details JSON.
+    router.post("/admin/products/:id/media/upload", _pageOrApi(false,
+      W("media.upload", async function (req, res) {
+        var body = Object.assign({}, req.body || {}, { product_id: req.params.id });
+        var out = await _performMediaUpload(body);
+        if (out.rec) { _json(res, 201, out.rec); return out.rec; }
+        return _problem(res, out.status, out.code, out.detail);
+      }),
+      async function (req, res) {
+        var id  = req.params.id;
+        var enc = encodeURIComponent(id);
+        var body = Object.assign({}, req.body || {}, { product_id: id });
+        var out;
+        try { out = await _performMediaUpload(body); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/products/" + enc + "?err=1"); }
+        if (!out.rec) return _redirect(res, "/admin/products/" + enc + "?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.upload", outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/products/" + enc + "?saved=1");
+      },
+    ));
   }
 
   router.delete("/admin/media/:id", W("media.delete", async function (req, res) {
@@ -708,6 +1045,57 @@ function mount(router, deps) {
     return { id: req.params.id };
   }));
 
+  // Browser confirm interstitial for media delete — removing a media row
+  // detaches the asset from the product (the R2 object itself is left in
+  // the bucket for the operator to reclaim), so the console confirms.
+  router.get("/admin/media/:id/delete/confirm-page", _pageOrApi(true,
+    R(async function (_req, res) {
+      return _problem(res, 405, "use-canonical-endpoint", "DELETE /admin/media/:id (or POST .../delete) directly for the JSON API");
+    }),
+    async function (req, res) {
+      var mid = req.params.id;
+      var m = null;
+      try { m = await catalog.media.get(mid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      var productId = m ? m.product_id : null;
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      if (!m) return _redirect(res, back + "?err=1");
+      _sendHtml(res, 200, renderAdminConfirm({
+        shop_name: deps.shop_name, nav_available: navAvailable, active: "products",
+        heading: "Delete this media?",
+        consequence: "This detaches the asset from the product. The stored object remains in your bucket — reclaim it there if no longer needed.",
+        detail: m.r2_key ? "Key: " + m.r2_key : "This media row will be removed.",
+        action: "/admin/media/" + _htmlEscape(mid) + "/delete",
+        confirm_label: "Delete media",
+        cancel_href: back,
+      }));
+    },
+  ));
+
+  // Browser POST for media delete (HTML forms can't DELETE).
+  router.post("/admin/media/:id/delete", _pageOrApi(false,
+    W("media.delete", async function (req, res) {
+      var ok = await catalog.media.delete(req.params.id);
+      if (!ok) return _problem(res, 404, "media-not-found");
+      _json(res, 200, { ok: true });
+      return { id: req.params.id };
+    }),
+    async function (req, res) {
+      var mid = req.params.id;
+      var m = null;
+      try { m = await catalog.media.get(mid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      var productId = m ? m.product_id : null;
+      var back = productId ? "/admin/products/" + encodeURIComponent(productId) : "/admin/products";
+      var ok = false;
+      try { ok = await catalog.media.delete(mid); }
+      catch (e) { if (!(e instanceof TypeError)) throw e; }
+      if (!ok) return _redirect(res, back + "?err=1");
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.delete", outcome: "success", metadata: { id: mid } });
+      _redirect(res, back + "?saved=1");
+    },
+  ));
+
   // ---- bulk catalog import --------------------------------------------
 
   // POST /admin/catalog/import — Content-Type: text/csv body. The CSV
@@ -3238,10 +3626,13 @@ function renderAdminProducts(opts) {
     var action = p.status === "archived"
       ? "<form method=\"post\" action=\"/admin/products/" + _htmlEscape(p.id) + "/restore\"><button class=\"btn btn--ghost\" type=\"submit\">Restore</button></form>"
       : "<form method=\"post\" action=\"/admin/products/" + _htmlEscape(p.id) + "/archive\"><button class=\"btn btn--ghost\" type=\"submit\">Archive</button></form>";
-    return "<tr><td><strong>" + _htmlEscape(p.title) + "</strong></td>" +
+    return "<tr><td><a href=\"/admin/products/" + _htmlEscape(p.id) + "\"><strong>" + _htmlEscape(p.title) + "</strong></a></td>" +
       "<td><code class=\"order-id\">" + _htmlEscape(p.slug) + "</code></td>" +
       "<td><span class=\"status-pill " + cls + "\">" + _htmlEscape(p.status) + "</span></td>" +
-      "<td>" + action + "</td></tr>";
+      "<td><div class=\"actions-row mt-0\">" +
+        "<a class=\"btn btn--ghost\" href=\"/admin/products/" + _htmlEscape(p.id) + "\">Manage</a>" +
+        action +
+      "</div></td></tr>";
   }).join("");
   var table = products.length
     ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Title</th><th scope=\"col\">Slug</th><th scope=\"col\">Status</th><th scope=\"col\">Action</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
@@ -4618,6 +5009,209 @@ function renderAdminCollection(opts) {
   return _renderAdminShell(opts.shop_name, "Collection " + col.slug, body, "collections", opts.nav_available);
 }
 
+// Product detail / management screen — the console's full editor for a
+// single catalog product: its fields (slug / title / description /
+// status), its variants (create / edit / delete), each variant's price
+// (set, with the current price + an append-only price history) and the
+// product's media (list / attach-by-key / upload-by-URL when the R2
+// bridge is wired / delete). Mirrors `renderAdminCollection`: an edit
+// form posting to a /edit POST alias (HTML forms can't PATCH), inline
+// sub-entity tables with per-row forms, and destructive actions routed
+// through a server-rendered confirm interstitial (the CSP forbids a
+// client confirm() dialog).
+function renderAdminProduct(opts) {
+  opts = opts || {};
+  var p = opts.product;
+  if (!p) {
+    var nf = "<section><h2>Product</h2><p class=\"empty\">Product not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/products\">Back to products</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Product", nf, "products", opts.nav_available);
+  }
+  var variants     = opts.variants || [];
+  var mediaRows    = opts.media || [];
+  var pricesByVar  = opts.prices_by_variant || {};   // { variantId: { currencies: [{ currency, current, history }] } }
+  var assetPrefix  = typeof opts.asset_prefix === "string" ? opts.asset_prefix : "/assets/";
+  var uploadWired  = !!opts.upload_available;
+  var defaultCurrency = (typeof opts.default_currency === "string" && /^[A-Z]{3}$/.test(opts.default_currency)) ? opts.default_currency : "USD";
+  var pid = _htmlEscape(p.id);
+
+  var saved   = opts.saved   ? "<div class=\"banner banner--ok\">Saved.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  // ---- product fields edit ---------------------------------------------
+  var statusOpts = ["draft", "active", "archived"].map(function (s) {
+    return "<option value=\"" + s + "\"" + (s === p.status ? " selected" : "") + ">" + s + "</option>";
+  }).join("");
+  var editForm =
+    "<div class=\"panel mw-40\">" +
+      "<h3 class=\"subhead\">Details</h3>" +
+      "<form method=\"post\" action=\"/admin/products/" + pid + "/edit\">" +
+        _setupField("Slug", "slug", p.slug, "text", "Lowercase, hyphenated — the storefront URL.", " maxlength=\"200\" required") +
+        _setupField("Title", "title", p.title, "text", "", " maxlength=\"500\" required") +
+        "<label class=\"form-field\"><span>Description</span>" +
+          "<textarea name=\"description\" maxlength=\"100000\" rows=\"4\">" + _htmlEscape(p.description || "") + "</textarea></label>" +
+        "<label class=\"form-field\"><span>Status</span><select name=\"status\">" + statusOpts + "</select></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save</button></div>" +
+      "</form>" +
+    "</div>";
+
+  // ---- variants table + per-variant price manager ----------------------
+  var variantBlocks = variants.map(function (v) {
+    var vid = _htmlEscape(v.id);
+    var optionPairs = Object.keys(v.options || {}).map(function (k) {
+      return _htmlEscape(k) + "=" + _htmlEscape(String(v.options[k]));
+    }).join(", ");
+    var optionsText = Object.keys(v.options || {}).map(function (k) {
+      return k + "=" + String(v.options[k]);
+    }).join(", ");
+
+    // Price rows — current + history per currency the variant is priced in.
+    var priceModel = pricesByVar[v.id] || { currencies: [] };
+    var priceCurrencyBlocks = (priceModel.currencies || []).map(function (pc) {
+      var current = pc.current
+        ? "<strong>" + _htmlEscape(pricing.format(pc.current.amount_minor, pc.currency)) + "</strong>"
+        : "<span class=\"u-mute\">no active price</span>";
+      var histRows = (pc.history || []).map(function (h) {
+        return "<tr>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(h.amount_minor, pc.currency)) + "</td>" +
+          "<td>" + _htmlEscape(_fmtDate(h.effective_from)) + "</td>" +
+          "<td>" + (h.effective_until == null ? "<span class=\"status-pill paid\">current</span>" : _htmlEscape(_fmtDate(h.effective_until))) + "</td>" +
+        "</tr>";
+      }).join("");
+      var histTable = (pc.history && pc.history.length)
+        ? "<table><thead><tr><th scope=\"col\" class=\"num\">Amount</th><th scope=\"col\">From</th><th scope=\"col\">Until</th></tr></thead><tbody>" + histRows + "</tbody></table>"
+        : "";
+      return "<div class=\"m-04\">" +
+        "<span class=\"u-mute\">" + _htmlEscape(pc.currency) + "</span> · " + current +
+        histTable +
+      "</div>";
+    }).join("");
+    var priceSection =
+      "<div class=\"panel-sub\">" +
+        "<h4 class=\"subhead subhead--sp\">Price</h4>" +
+        (priceCurrencyBlocks || "<p class=\"empty\">No price set yet.</p>") +
+        "<form method=\"post\" action=\"/admin/variants/" + vid + "/prices/set\" class=\"price-set-form\">" +
+          "<div class=\"actions-row\">" +
+            "<input type=\"text\" name=\"currency\" value=\"" + _htmlEscape(defaultCurrency) + "\" class=\"input-code\" aria-label=\"Currency\" maxlength=\"3\" required>" +
+            "<input type=\"number\" name=\"amount_minor\" min=\"0\" step=\"1\" placeholder=\"amount (minor units)\" aria-label=\"Amount in minor units\" required>" +
+            "<button class=\"btn btn--ghost\" type=\"submit\">Set price</button>" +
+          "</div>" +
+          "<small class=\"u-mute\">Amount in the currency's minor units — e.g. 2999 = $29.99. Setting a price is append-only; the prior price is retained in history.</small>" +
+        "</form>" +
+      "</div>";
+
+    var editVariant =
+      "<form method=\"post\" action=\"/admin/variants/" + vid + "/edit\">" +
+        "<div class=\"actions-row\">" +
+          "<label class=\"form-field mb-0\"><span>SKU</span><input type=\"text\" name=\"sku\" value=\"" + _htmlEscape(v.sku) + "\" maxlength=\"128\" required></label>" +
+          "<label class=\"form-field mb-0\"><span>Title</span><input type=\"text\" name=\"title\" value=\"" + _htmlEscape(v.title || "") + "\" maxlength=\"500\"></label>" +
+        "</div>" +
+        "<div class=\"actions-row\">" +
+          "<label class=\"form-field mb-0\"><span>Options (k=v, comma-sep)</span><input type=\"text\" name=\"options\" value=\"" + _htmlEscape(optionsText) + "\" maxlength=\"2000\"></label>" +
+          "<label class=\"form-field mb-0\"><span>Weight (g)</span><input type=\"number\" name=\"weight_grams\" value=\"" + _htmlEscape(String(v.weight_grams || 0)) + "\" min=\"0\" step=\"1\"></label>" +
+        "</div>" +
+        "<label class=\"form-field\"><span>Requires shipping</span><select name=\"requires_shipping\">" +
+          "<option value=\"1\"" + (v.requires_shipping ? " selected" : "") + ">Yes (physical)</option>" +
+          "<option value=\"0\"" + (v.requires_shipping ? "" : " selected") + ">No (digital)</option>" +
+        "</select></label>" +
+        "<div class=\"actions-row\">" +
+          "<button class=\"btn btn--ghost\" type=\"submit\">Save variant</button>" +
+          "<a class=\"btn btn--danger\" href=\"/admin/variants/" + vid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+        "</div>" +
+      "</form>";
+
+    return "<div class=\"panel mt-1\">" +
+      "<div class=\"actions-row mt-0\">" +
+        "<strong>" + _htmlEscape(v.title || v.sku) + "</strong>" +
+        "<code class=\"order-id\">" + _htmlEscape(v.sku) + "</code>" +
+        (optionPairs ? "<span class=\"u-mute\">" + optionPairs + "</span>" : "") +
+      "</div>" +
+      editVariant +
+      priceSection +
+    "</div>";
+  }).join("");
+  var variantsBody = variants.length ? variantBlocks : "<p class=\"empty\">No variants yet — add the first one below.</p>";
+
+  var addVariant =
+    "<div class=\"panel mt-1 mw-40\">" +
+      "<h3 class=\"subhead\">Add a variant</h3>" +
+      "<form method=\"post\" action=\"/admin/products/" + pid + "/variants/create\">" +
+        _setupField("SKU", "sku", "", "text", "Unique stock-keeping unit — letters, digits, . _ -", " maxlength=\"128\" required") +
+        _setupField("Title", "title", "", "text", "Optional — e.g. “Large / Blue”.", " maxlength=\"500\"") +
+        _setupField("Options", "options", "", "text", "Attribute map as k=v pairs, comma-separated — e.g. size=L, color=blue.", " maxlength=\"2000\"") +
+        _setupField("Weight (grams)", "weight_grams", "0", "number", "Used for shipping rate calculation.", " min=\"0\" step=\"1\"") +
+        "<label class=\"form-field\"><span>Requires shipping</span><select name=\"requires_shipping\">" +
+          "<option value=\"1\">Yes (physical)</option><option value=\"0\">No (digital)</option>" +
+        "</select></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add variant</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var variantsSection = "<section class=\"mt\"><h3 class=\"fs-105\">Variants</h3>" + variantsBody + addVariant + "</section>";
+
+  // ---- media -----------------------------------------------------------
+  var mediaCards = mediaRows.map(function (m) {
+    var mid = _htmlEscape(m.id);
+    var url = assetPrefix + m.r2_key;
+    var isImage = /^image\//.test(m.content_type || "");
+    var thumb = isImage
+      ? "<img class=\"media-thumb\" src=\"" + _htmlEscape(url) + "\" alt=\"" + _htmlEscape(m.alt_text || "") + "\" loading=\"lazy\">"
+      : "<span class=\"media-thumb media-thumb--file\">" + _htmlEscape((m.content_type || "file").split("/")[0]) + "</span>";
+    return "<div class=\"media-card\">" +
+      thumb +
+      "<code class=\"order-id\">" + _htmlEscape(m.r2_key) + "</code>" +
+      "<span class=\"u-mute\">" + _htmlEscape(m.content_type || "") + (m.alt_text ? " · " + _htmlEscape(m.alt_text) : "") + "</span>" +
+      "<a class=\"btn btn--danger\" href=\"/admin/media/" + mid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+    "</div>";
+  }).join("");
+  var mediaGrid = mediaRows.length
+    ? "<div class=\"media-grid\">" + mediaCards + "</div>"
+    : "<p class=\"empty\">No media attached yet.</p>";
+
+  var attachForm =
+    "<div class=\"panel mt-1 mw-40\">" +
+      "<h3 class=\"subhead\">Attach media by R2 key</h3>" +
+      "<p class=\"meta\">Reference an object already in your media bucket. The key is its path under the bucket (no leading slash, no “..”).</p>" +
+      "<form method=\"post\" action=\"/admin/products/" + pid + "/media/attach\">" +
+        _setupField("R2 key", "r2_key", "", "text", "e.g. media/01j…png", " maxlength=\"1024\" required") +
+        _setupField("Content type", "content_type", "", "text", "MIME type — e.g. image/png.", " maxlength=\"255\" required") +
+        _setupField("Alt text", "alt_text", "", "text", "Describes the image for screen readers + SEO.", " maxlength=\"500\"") +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Attach media</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var uploadForm = uploadWired
+    ? "<div class=\"panel mt-1 mw-40\">" +
+        "<h3 class=\"subhead\">Upload media from a URL</h3>" +
+        "<p class=\"meta\">Fetches the source (SSRF-gated), stores it in your bucket, and attaches it to this product in one step.</p>" +
+        "<form method=\"post\" action=\"/admin/products/" + pid + "/media/upload\">" +
+          _setupField("Source URL", "source_url", "", "url", "A public https URL to the asset bytes.", " maxlength=\"2000\" required") +
+          _setupField("Content type", "content_type", "", "text", "MIME type the source serves — e.g. image/png.", " maxlength=\"255\" required") +
+          _setupField("Alt text", "alt_text", "", "text", "Describes the image for screen readers + SEO.", " maxlength=\"500\"") +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Upload + attach</button></div>" +
+        "</form>" +
+      "</div>"
+    : "";
+
+  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + attachForm + uploadForm + "</section>";
+
+  // ---- head + assembly -------------------------------------------------
+  var statusCls = p.status === "active" ? "paid" : (p.status === "archived" ? "refunded" : "pending");
+  var archiveAction = p.status === "archived"
+    ? "<form method=\"post\" action=\"/admin/products/" + pid + "/restore\" class=\"form-inline\"><button class=\"btn btn--ghost\" type=\"submit\">Restore</button></form>"
+    : "<form method=\"post\" action=\"/admin/products/" + pid + "/archive\" class=\"form-inline\"><button class=\"btn btn--ghost\" type=\"submit\">Archive</button></form>";
+  var head =
+    "<p class=\"meta\"><a href=\"/admin/products\">&larr; Products</a> · " +
+      "<code class=\"order-id\">" + _htmlEscape(p.slug) + "</code> · " +
+      "<span class=\"status-pill " + statusCls + "\">" + _htmlEscape(p.status) + "</span>" +
+      " · <a href=\"/products/" + _htmlEscape(encodeURIComponent(p.slug)) + "\" target=\"_blank\" rel=\"noreferrer\">View on storefront &rarr;</a></p>";
+
+  var body = "<section><h2>" + _htmlEscape(p.title) + "</h2>" + saved + notice + head +
+    "<div class=\"actions-row mt-0\">" + archiveAction + "</div>" +
+    editForm + "</section>" + variantsSection + mediaSection;
+  return _renderAdminShell(opts.shop_name, "Product " + p.slug, body, "products", opts.nav_available);
+}
+
 module.exports = {
   mount:           mount,
   AUDIT_NAMESPACE: AUDIT_NAMESPACE,
@@ -4627,6 +5221,7 @@ module.exports = {
   renderAdminSetup:        renderAdminSetup,
   renderAdminIntegrations: renderAdminIntegrations,
   renderAdminProducts:     renderAdminProducts,
+  renderAdminProduct:      renderAdminProduct,
   renderAdminInventory:    renderAdminInventory,
   renderAdminOrders:       renderAdminOrders,
   renderAdminOrder:        renderAdminOrder,