@blamejs/blamejs-shop 0.3.11 → 0.3.13

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.13 (2026-05-30) — **Updated runtime hardens the storage and audit layers; admin error pages no longer show raw database text.** The vendored blamejs runtime is updated to v0.14.7, which tightens the data and audit layers the shop is built on: database queries are checked against each table's declared columns (a reference to an undeclared column fails closed), the database encryption key is bound to its deployment so a copied key can't be unsealed elsewhere, raw SQL fragments refuse embedded string literals so values bind through placeholders, audit-chain purges can require two authorizers, and breach-notification deadlines raise a running clock. Separately, when an admin form action fails the console now shows a short generic message with the correct status instead of rendering a raw database or parser string into its error banner. No operator action is required. **Changed:** *Vendored runtime updated to v0.14.7 (storage + audit hardening)* — The underlying runtime now checks every database query against the table's declared columns and fails closed on an undeclared reference, binds the database encryption key to its data directory and key path so a relocated key won't unseal, refuses embedded string literals in raw SQL fragments, supports two-authorizer dual control on audit-chain purges, can compute sealed-column lookup hashes as a keyed MAC, and ships a running clock for breach-notification deadlines. The shop inherits these protections; no configuration change is needed. **Fixed:** *Console error banners show a safe message, not internal text* — Every admin HTML form handler now routes a thrown error through one shared classifier: a duplicate key becomes a 409 "That value is already in use.", a missing referenced record a generic not-found, malformed input a generic "Invalid input.", and an unexpected failure a generic message whose detail is recorded server-side rather than shown. Operator-facing validation messages are unchanged. This closes the path where a create form could render a raw database constraint string into its error banner, matching the API behavior the bearer path already had.
+
+- v0.3.12 (2026-05-30) — **Currency and outbound-host validation consolidated behind one shared check.** Input validation that was duplicated across the codebase is now a single shared module. Currency codes are validated against the ISO 4217 catalog consistently wherever the admin binds money — the same check the gift-card flow gained last release — and the outbound webhook host guard (refusing loopback, private, link-local, reserved, and cloud-metadata destinations, including trailing-dot forms) is one shared function used by both the delivery and registration paths. The shared module composes the framework's Unicode codepoint catalog so free-text fields can reject control, bidi-override, and zero-width characters when needed. Behavior is equal-or-stricter than before; no operator action is required. **Changed:** *Currency validation is consistently ISO 4217* — Admin paths that bind a currency now validate it against the ISO 4217 catalog in one place, so a code that isn't a real currency is rejected consistently rather than only in some flows. · *Outbound-host SSRF guard is a single shared check* — The webhook delivery and registration paths now share one host guard — loopback, private (RFC 1918), link-local, reserved, and cloud-metadata addresses (by IP literal or known name, including trailing-dot forms) are refused identically on both, so the two can't drift apart.
+
 - v0.3.11 (2026-05-30) — **Webhook endpoints reject internal addresses; admin errors stay clean and typed.** Outbound webhook endpoints can no longer be pointed at loopback, private, link-local, or cloud-metadata addresses, closing a server-side request forgery path from operator-supplied URLs. Several admin endpoints that previously returned a 500 on bad input now return the correct 4xx — a duplicate slug or SKU is a 409 Conflict, a missing referenced record and malformed JSON are a 400 — and none of them echo internal database or parser text back in the response. Gift cards now reject a currency that isn't a real ISO 4217 code, and the returns refund action reports a malformed id the same way its sibling actions do. No configuration change is required; upgrading picks these up automatically. **Fixed:** *Admin errors return the right status and don't leak internals* — Creating a product, variant, or inventory row with a duplicate key now returns 409 Conflict instead of 500; attaching media to a missing product, and pasting malformed JSON into the shipping-zone editor, now return 400. None of these responses include raw database or JSON-parser text — the detail is a generic, operator-facing message and the underlying error is recorded server-side. The same applies to the receipt and packing-slip routes. · *Gift cards validate the currency* — Issuing a gift card with a currency that isn't a real ISO 4217 code is now rejected with a 400 instead of creating a card in a non-existent currency. · *Consistent error status for refunds* — The returns refund action reports a malformed return id with the same 400 its approve, receive, and reject siblings use; a well-formed id that doesn't exist is still a 404. **Security:** *Webhook endpoints can't target internal addresses* — A webhook endpoint URL that points at a loopback, private (RFC 1918), link-local, reserved, or cloud-metadata address — by IP literal or by a known name such as localhost, metadata.google.internal, or any *.internal host — is now refused when the subscription is created, on both the delivery and outbound-registration paths. A trailing-dot form of those hosts (for example localhost. or 169.254.169.254.) is normalized before the check so it can't slip past. Public https endpoints are unaffected.
 
 - v0.3.10 (2026-05-30) — **Order discounts are split across lines for accurate partial refunds.** When an order carries a cart-level discount, the admin console now records how that discount split across the order's lines — proportional to each line's value — so a later partial refund of one line knows that line's discounted share rather than the whole-order amount. A new read-only Discount splits screen shows the per-line breakdown for an order. This is back-office bookkeeping recorded after the order is placed; it has no effect on what the shopper is charged, and an order with no discount records nothing. **Added:** *Per-line discount allocation + admin view* — An order that carried an automatic cart discount now gets a recorded breakdown of how that discount split across its lines — proportional to each line's subtotal, summing exactly to the discount. A read-only Discount splits admin screen shows the breakdown for an order. The recording runs after the order is placed and never affects the charged amount; an order with no discount records nothing.

package/lib/admin.js

@@ -33,6 +33,7 @@
 var pricing = require("./pricing");
 var collectionsModule = require("./collections");
 var quantityDiscountsModule = require("./quantity-discounts");
+var textGuard = require("./text-guard");
 var { AsyncLocalStorage } = require("node:async_hooks");   // allow:non-shop-require — Node-core per-request context (no npm dep); the framework itself composes it in db-role-context / log. No b.* request-context primitive exists to wrap it.
 
 var b = require("./vendor/blamejs");
@@ -385,6 +386,59 @@ function _redirect(res, location) {
   if (res.end) res.end(); else res.send("");
 }
 
+// Single classifier for a thrown admin error → an operator-safe outcome,
+// shared by BOTH the bearer JSON path (_wrap) and every cookie/HTML form
+// path so the two can never diverge on what a given error class is allowed
+// to reveal. Returns `{ status, code, message }`:
+//
+//   - TypeError          → 400 bad-request, `e.message` verbatim. These are
+//                          our own validation throws (`currency "ZZZ" is not
+//                          a known ISO 4217 code`, `regions_json must be valid
+//                          JSON`) — intended, operator-safe text the form must
+//                          surface so the operator can correct the input.
+//   - SyntaxError        → 400 bad-request, generic "Invalid input." A parser
+//                          SyntaxError that reached here echoes the parse
+//                          position ("...JSON at position 1"); never surface it.
+//   - UNIQUE / FOREIGN KEY constraint → 409 conflict, generic in-use /
+//                          referenced-record text — never the table/column/SQL.
+//   - CHECK / NOT NULL constraint     → 400 bad-request, generic
+//                          missing-or-invalid text.
+//   - anything else      → 500 internal-error, generic "Something went wrong
+//                          — please try again." The raw message is recorded
+//                          server-side via the framework audit (drop-silent,
+//                          outcome:"failure") so an operator can correlate;
+//                          it never reaches the client.
+//
+// `auditAction` (optional) names the audit action for the unknown-error
+// record; defaults to "request" so a bare call still files under a sensible
+// namespace.
+function _safeNotice(e, auditAction) {
+  if (e instanceof TypeError) {
+    return { status: 400, code: "bad-request", message: (e && e.message) || "Invalid input." };
+  }
+  if (e instanceof SyntaxError) {
+    return { status: 400, code: "bad-request", message: "Invalid input." };
+  }
+  var msg = (e && e.message) || "";
+  if (/UNIQUE constraint failed/i.test(msg) || /FOREIGN KEY constraint failed/i.test(msg)) {
+    return /FOREIGN KEY/i.test(msg)
+      ? { status: 409, code: "conflict", message: "A referenced record does not exist." }
+      : { status: 409, code: "conflict", message: "That value is already in use." };
+  }
+  if (/(?:CHECK|NOT NULL) constraint failed/i.test(msg)) {
+    return { status: 400, code: "bad-request", message: "A required value is missing or invalid." };
+  }
+  // Genuine unknown error — record it server-side via the framework audit
+  // (drop-silent) so operators can correlate, then hand back a generic
+  // message + a 500. The raw message never reaches the client.
+  b.audit.safeEmit({
+    action:   AUDIT_NAMESPACE + "." + (auditAction || "request") + ".error",
+    outcome:  "failure",
+    metadata: { message: msg || String(e) },
+  });
+  return { status: 500, code: "internal-error", message: "Something went wrong — please try again." };
+}
+
 function _wrap(handler, opts) {
   // Every admin handler routes through this wrapper: bearer-token
   // gate, error-to-problem-details translation, audit write on the
@@ -410,35 +464,13 @@ function _wrap(handler, opts) {
       }
       return result;
     } catch (e) {
-      if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
-      // Malformed JSON body — the body parser raises a SyntaxError whose
-      // message echoes the parser's position ("...JSON at position 1").
-      // Surface a clean 400 with a generic detail rather than leaking the
-      // parser internals (also the defense-in-depth net for any call site
-      // that JSON.parses an operator-supplied field without its own guard).
-      if (e instanceof SyntaxError) return _problem(res, 400, "bad-request", "Invalid JSON in request.");
-      // Storage-engine constraint violations reach here as plain Errors
-      // whose message names the table/column/SQL ("UNIQUE constraint
-      // failed: products.slug"). Map the class to a clean 4xx with a
-      // GENERIC operator-facing detail — never echo the table/column/SQL.
-      var msg = (e && e.message) || "";
-      if (/UNIQUE constraint failed/i.test(msg) || /FOREIGN KEY constraint failed/i.test(msg)) {
-        return _problem(res, 409, "conflict",
-          /FOREIGN KEY/i.test(msg) ? "A referenced record does not exist." : "That value is already in use.");
-      }
-      if (/(?:CHECK|NOT NULL) constraint failed/i.test(msg)) {
-        return _problem(res, 400, "bad-request", "A required value is missing or invalid.");
-      }
-      // Genuine unknown error — record it server-side via the framework
-      // audit (drop-silent) so operators can correlate, then return a
-      // generic 500 with NO detail. The raw message never reaches the
-      // client.
-      b.audit.safeEmit({
-        action:   AUDIT_NAMESPACE + "." + (opts.audit || "request") + ".error",
-        outcome:  "failure",
-        metadata: { message: msg || String(e) },
-      });
-      return _problem(res, 500, "internal-error");
+      // Single classification, shared with the cookie/HTML paths via
+      // _safeNotice. A 5xx carries NO error-derived detail (the unknown
+      // case is recorded server-side inside _safeNotice); 4xx surface the
+      // generic / validation message.
+      var n = _safeNotice(e, opts.audit);
+      if (n.status >= 500) return _problem(res, n.status, n.code);
+      return _problem(res, n.status, n.code, n.message);
     }
   };
 }
@@ -549,14 +581,12 @@ function mount(router, deps) {
       try {
         made = await catalog.products.create(req.body || {});
       } catch (e) {
-        if (e instanceof TypeError || e.code === "CATALOG_DUPLICATE" || /slug|exists|duplicate/i.test(e.message || "")) {
-          var page = await catalog.products.list({ limit: 100 });
-          return _sendHtml(res, 400, renderAdminProducts({
-            shop_name: deps.shop_name, nav_available: navAvailable, products: page.rows || [],
-            notice: (e && e.message) || "Couldn't create that product.",
-          }));
-        }
-        throw e;
+        var n = _safeNotice(e, "product.create");
+        var page = await catalog.products.list({ limit: 100 });
+        return _sendHtml(res, n.status, renderAdminProducts({
+          shop_name: deps.shop_name, nav_available: navAvailable, products: page.rows || [],
+          notice: n.message,
+        }));
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".product.create", outcome: "success", metadata: { id: made.id } });
       _redirect(res, "/admin/products/" + encodeURIComponent(made.id) + "?created=1");
@@ -968,14 +998,12 @@ function mount(router, deps) {
         if (!body.sku) throw new TypeError("sku required");
         await catalog.inventory.create(body.sku, { stock_on_hand: parseInt(body.stock_on_hand, 10) || 0 });
       } catch (e) {
-        if (e instanceof TypeError || /exists|duplicate|UNIQUE/i.test(e.message || "")) {
-          var page = await catalog.inventory.list({ limit: 500 });
-          return _sendHtml(res, 400, renderAdminInventory({
-            shop_name: deps.shop_name, nav_available: navAvailable, inventory: page.rows || [],
-            notice: (e && e.message) || "Couldn't create that SKU.",
-          }));
-        }
-        throw e;
+        var n = _safeNotice(e, "inventory.create");
+        var page = await catalog.inventory.list({ limit: 500 });
+        return _sendHtml(res, n.status, renderAdminInventory({
+          shop_name: deps.shop_name, nav_available: navAvailable, inventory: page.rows || [],
+          notice: n.message,
+        }));
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".inventory.create", outcome: "success", metadata: { sku: body.sku } });
       _redirect(res, "/admin/inventory?created=1");
@@ -1086,7 +1114,12 @@ function mount(router, deps) {
           alt_text:     typeof body.alt_text === "string" ? body.alt_text : undefined,
         });
       } catch (e) {
-        if (!(e instanceof TypeError)) throw e;
+        // Bad input (TypeError), a missing product (FOREIGN KEY constraint),
+        // or any other failure → a notice via PRG. _safeNotice records an
+        // unknown error server-side; the redirect itself carries no raw
+        // message, so the storage-engine string can't ride the query into
+        // the detail banner.
+        _safeNotice(e, "media.attach");
         return _redirect(res, "/admin/products/" + enc + "?err=1");
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.attach", outcome: "success", metadata: { id: id } });
@@ -1878,17 +1911,15 @@ function mount(router, deps) {
         var win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
         try { status = _labelStatusParam(url); win = _labelWindow(url); }
         catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          notice = e.message.replace(/^admin:\s*/, "");
+          notice = _safeNotice(e, "shipping_label.list").message.replace(/^admin:\s*/, "");
         }
         var payload;
         try { payload = await _labelListPayload(status, win); }
         catch (e2) {
-          if (!(e2 instanceof TypeError)) throw e2;
           // A bad range that slipped past the param parse (primitive
           // re-validates from < to) → fall back to the default window.
           win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
-          notice = e2.message.replace(/^shipping-labels:\s*/, "");
+          notice = _safeNotice(e2, "shipping_label.list").message.replace(/^shipping-labels:\s*/, "");
           payload = await _labelListPayload(status, win);
         }
         _sendHtml(res, 200, renderAdminShippingLabels({
@@ -1909,8 +1940,7 @@ function mount(router, deps) {
         var rows = [], notice = null;
         try { rows = await shippingLabels.pendingLabels({ limit: MAX_LABEL_LIST_LIMIT }); }
         catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          notice = e.message.replace(/^shipping-labels:\s*/, "");
+          notice = _safeNotice(e, "shipping_label.pending").message.replace(/^shipping-labels:\s*/, "");
         }
         _sendHtml(res, 200, renderAdminShippingLabelsPending({
           shop_name: deps.shop_name, nav_available: navAvailable,
@@ -1936,16 +1966,14 @@ function mount(router, deps) {
         var win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
         try { win = _labelWindow(url); carrier = _labelCarrierParam(url); }
         catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          notice = e.message.replace(/^admin:\s*/, "");
+          notice = _safeNotice(e, "shipping_label.costs").message.replace(/^admin:\s*/, "");
         }
         var report;
         try { report = await _labelCostsReport(win, carrier); }
         catch (e2) {
-          if (!(e2 instanceof TypeError)) throw e2;
           win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
           carrier = null;
-          notice = e2.message.replace(/^shipping-labels:\s*/, "");
+          notice = _safeNotice(e2, "shipping_label.costs").message.replace(/^shipping-labels:\s*/, "");
           report = await _labelCostsReport(win, carrier);
         }
         _sendHtml(res, 200, renderAdminShippingLabelCosts({
@@ -3219,11 +3247,11 @@ function mount(router, deps) {
         try {
           ep = await webhooks.endpoints.create({ url: (typeof body.url === "string" ? body.url.trim() : body.url), events: events });
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "webhook.create");
           var rows = await webhooks.endpoints.list();
-          return _sendHtml(res, 400, renderAdminWebhooks({
+          return _sendHtml(res, n.status, renderAdminWebhooks({
             shop_name: deps.shop_name, nav_available: navAvailable, endpoints: rows,
-            known_events: KNOWN_WH_EVENTS, notice: e.message.replace(/^webhooks:\s*/, ""),
+            known_events: KNOWN_WH_EVENTS, notice: n.message.replace(/^webhooks:\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".webhook.create", outcome: "success", metadata: { id: ep.id } });
@@ -3458,10 +3486,6 @@ function mount(router, deps) {
       return n;
     }
 
-    function _cleanCreateMessage(e) {
-      return (e && e.message || "Couldn't create that collection.").replace(/^collections[.:]\s*/, "");
-    }
-
     // Map the ?active= query to a collections.list filter: 1/true →
     // active-only, 0/false → archived-only, absent → all.
     function _collectionsFilter(activeS) {
@@ -3544,11 +3568,11 @@ function mount(router, deps) {
             });
           }
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "collection.create");
           var rows = await _listForBrowser({});
-          return _sendHtml(res, 400, renderAdminCollections({
+          return _sendHtml(res, n.status, renderAdminCollections({
             shop_name: deps.shop_name, nav_available: navAvailable, collections: rows,
-            notice: _cleanCreateMessage(e), form_type: type,
+            notice: n.message.replace(/^collections[.:]\s*/, ""), form_type: type,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".collection.create", outcome: "success" });
@@ -3862,11 +3886,11 @@ function mount(router, deps) {
         try {
           await announcements.defineAnnouncement(_announcementFromForm(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "announcement.define");
           var rows = await announcements.listAnnouncements({});
-          return _sendHtml(res, 400, renderAdminAnnouncements({
+          return _sendHtml(res, n.status, renderAdminAnnouncements({
             shop_name: deps.shop_name, nav_available: navAvailable, announcements: rows,
-            notice: (e && e.message || "Couldn't save that announcement.").replace(/^announcementBar[.:]\s*/, ""),
+            notice: n.message.replace(/^announcementBar[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".announcement.define", outcome: "success" });
@@ -3941,11 +3965,11 @@ function mount(router, deps) {
             questions: _standardSurveyQuestions(body.kind),
           });
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "survey.define");
           var rows = await surveys.listSurveys({});
-          return _sendHtml(res, 400, renderAdminSurveys({
+          return _sendHtml(res, n.status, renderAdminSurveys({
             shop_name: deps.shop_name, nav_available: navAvailable, surveys: rows,
-            notice: (e.message || "Couldn't create that survey.").replace(/^customerSurveys[.:]\s*/, ""),
+            notice: n.message.replace(/^customerSurveys[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".survey.define", outcome: "success" });
@@ -4054,11 +4078,11 @@ function mount(router, deps) {
         try {
           await hours.defineSchedule(_scheduleFromForm(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "hours.define");
           var rows = await hours.listSchedules();
-          return _sendHtml(res, 400, renderAdminHours({
+          return _sendHtml(res, n.status, renderAdminHours({
             shop_name: deps.shop_name, nav_available: navAvailable, schedules: rows,
-            notice: (e.message || "Couldn't save that schedule.").replace(/^businessHours[.:]\s*/, ""),
+            notice: n.message.replace(/^businessHours[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".hours.define", outcome: "success" });
@@ -4239,11 +4263,10 @@ function mount(router, deps) {
       var win, notice = null;
       try { win = _reportWindow(url); }
       catch (e) {
-        if (!(e instanceof TypeError)) throw e;
         // Bad range → re-render with the default window + a correction
         // notice (config/entry tier: the operator fixes the typo).
         win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
-        notice = e.message.replace(/^admin:\s*/, "");
+        notice = _safeNotice(e, "report.view").message.replace(/^admin:\s*/, "");
       }
       // CSV download from the browser surface too (a link, not a fetch).
       if (url && url.searchParams.get("format") === "csv") {
@@ -4264,9 +4287,8 @@ function mount(router, deps) {
       var report;
       try { report = await _buildReport(win); }
       catch (e3) {
-        if (!(e3 instanceof TypeError)) throw e3;
         win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
-        notice = e3.message.replace(/^salesReports:\s*/, "");
+        notice = _safeNotice(e3, "report.view").message.replace(/^salesReports:\s*/, "");
         report = await _buildReport(win);
       }
       _sendHtml(res, 200, renderAdminReports({
@@ -4466,11 +4488,11 @@ function mount(router, deps) {
         try {
           await subscriptions.plans.create(input);
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "subscription_plan.create");
           var rows = await subscriptions.plans.list({});
-          return _sendHtml(res, 400, renderAdminSubscriptionPlans({
+          return _sendHtml(res, n.status, renderAdminSubscriptionPlans({
             shop_name: deps.shop_name, nav_available: navAvailable, plans: rows,
-            notice: e.message.replace(/^subscriptions[.:]\s*/, ""),
+            notice: n.message.replace(/^subscriptions[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".subscription_plan.create", outcome: "success" });
@@ -4628,11 +4650,11 @@ function mount(router, deps) {
         try {
           issued = await _issueGiftCard(req.body || {});
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "gift_card.issue");
           var rows = await giftcards.list({});
-          return _sendHtml(res, 400, renderAdminGiftCards({
+          return _sendHtml(res, n.status, renderAdminGiftCards({
             shop_name: deps.shop_name, nav_available: navAvailable, cards: rows,
-            notice: e.message.replace(/^giftcards?[.:]\s*/i, ""),
+            notice: n.message.replace(/^giftcards?[.:]\s*/i, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift_card.issue", outcome: "success", metadata: { id: issued.id } });
@@ -4769,10 +4791,7 @@ function mount(router, deps) {
     // framework's ISO 4217 catalog (the same b.money.CURRENCIES surface the
     // currency-rounding + display primitives compose) and refuse unknown
     // codes with a clean 400.
-    if (typeof input.currency === "string" && /^[A-Z]{3}$/.test(input.currency) &&
-        !Object.prototype.hasOwnProperty.call(b.money.CURRENCIES, input.currency)) {
-      throw new TypeError("giftcards: currency " + JSON.stringify(input.currency) + " is not a known ISO 4217 code");
-    }
+    textGuard.currencyCode(input.currency, "giftcards: currency");
     if (body.amount_minor != null && body.amount_minor !== "") {
       input.amount_minor = _strictMinorInt(body.amount_minor, "giftcards", "amount_minor (minor units)");
     }
@@ -4823,12 +4842,18 @@ function mount(router, deps) {
         try {
           await taxRates.defineRate(_taxRateInput(body));
         } catch (e) {
-          if (!(e instanceof TypeError) && e.code !== "TAX_RATE_OVERLAP") throw e;
+          // The primitive's overlap code carries an operator-safe message;
+          // everything else routes through the shared classifier so a raw
+          // constraint / parser / unknown error can't reach the banner.
+          var overlap = e && e.code === "TAX_RATE_OVERLAP";
+          var n = overlap ? { status: 400, message: (e.message || "").replace(/^taxRates[.:]\s*/, "") }
+                          : _safeNotice(e, "tax_rate.create");
+          var noticeMsg = overlap ? n.message : n.message.replace(/^taxRates[.:]\s*/, "");
           var rows = await _taxRatesForBrowser(jurisdiction);
-          return _sendHtml(res, 400, renderAdminTaxRates({
+          return _sendHtml(res, n.status, renderAdminTaxRates({
             shop_name: deps.shop_name, nav_available: navAvailable, rates: rows,
             jurisdiction: jurisdiction, sources: taxRates.SOURCES,
-            notice: (e && e.message || "").replace(/^taxRates[.:]\s*/, ""),
+            notice: noticeMsg,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.create", outcome: "success" });
@@ -5016,14 +5041,21 @@ function mount(router, deps) {
         var filing;
         try { filing = await salesTaxFilings.defineFilingPeriod(_filingPeriodInput(req.body || {})); }
         catch (e) {
-          if (!(e instanceof TypeError) && e.code !== "SALES_TAX_FILING_DUPLICATE") throw e;
+          // The primitive's own duplicate-period code carries an operator-safe
+          // message (a named UNIQUE index, no raw SQL); everything else routes
+          // through the shared classifier so a raw constraint / parser / unknown
+          // error can't reach the banner.
+          var dup = e && e.code === "SALES_TAX_FILING_DUPLICATE";
+          var n   = dup ? { status: 400, message: (e.message || "").replace(/^salesTaxFilings[.:]\s*/, "") }
+                        : _safeNotice(e, "tax_filing.create");
+          var noticeMsg = dup ? n.message : n.message.replace(/^salesTaxFilings[.:]\s*/, "");
           var rows     = await _filingsForBrowser({});
           var upcoming = await _upcomingForBrowser();
-          return _sendHtml(res, 400, renderAdminTaxFilings({
+          return _sendHtml(res, n.status, renderAdminTaxFilings({
             shop_name: deps.shop_name, nav_available: navAvailable,
             filings: rows, upcoming: upcoming,
             kinds: salesTaxFilings.KINDS, statuses: salesTaxFilings.STATUSES,
-            notice: (e && e.message || "").replace(/^salesTaxFilings[.:]\s*/, ""),
+            notice: noticeMsg,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_filing.create", outcome: "success", metadata: { id: filing.id } });
@@ -5066,7 +5098,7 @@ function mount(router, deps) {
           notice = "Enter both a from and a to date (epoch-ms) for the report window.";
         } else {
           try { report = await salesTaxFilings.auditReportForJurisdiction({ jurisdiction: jurisdiction, from: from, to: to }); }
-          catch (e) { if (!(e instanceof TypeError)) throw e; notice = (e.message || "").replace(/^salesTaxFilings[.:]\s*/, ""); }
+          catch (e) { notice = _safeNotice(e, "tax_filing.report").message.replace(/^salesTaxFilings[.:]\s*/, ""); }
         }
         _sendHtml(res, 200, renderAdminTaxFilingReport({
           shop_name: deps.shop_name, nav_available: navAvailable,
@@ -5134,10 +5166,13 @@ function mount(router, deps) {
           try {
             await run(req.params.id, req.body || {});
           } catch (e) {
-            if (!(e instanceof TypeError) &&
-                e.code !== "SALES_TAX_FILING_NOT_FOUND" &&
-                e.code !== "SALES_TAX_FILING_BAD_TRANSITION") throw e;
-            var msg = (e && e.message || "").replace(/^salesTaxFilings[.:]\s*/, "");
+            // The primitive's not-found / bad-transition codes carry
+            // operator-safe messages; everything else routes through the
+            // shared classifier so a raw constraint / parser / unknown error
+            // can't ride the err_msg query param into the detail banner.
+            var safe = e && (e.code === "SALES_TAX_FILING_NOT_FOUND" || e.code === "SALES_TAX_FILING_BAD_TRANSITION");
+            var msg  = (safe ? (e.message || "") : _safeNotice(e, "tax_filing." + audit).message)
+              .replace(/^salesTaxFilings[.:]\s*/, "");
             return _redirect(res, "/admin/tax-filings/" + enc + "?err=1&err_msg=" + encodeURIComponent(msg));
           }
           b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_filing." + audit, outcome: "success", metadata: { id: req.params.id } });
@@ -5234,11 +5269,17 @@ function mount(router, deps) {
         try {
           await shippingZones.defineZone(_shippingZoneInput(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError) && e.code !== "SHIPPING_ZONE_EXISTS") throw e;
+          // The primitive's already-exists code carries an operator-safe
+          // message; everything else routes through the shared classifier so
+          // a raw constraint / parser / unknown error can't reach the banner.
+          var dup = e && e.code === "SHIPPING_ZONE_EXISTS";
+          var n   = dup ? { status: 400, message: (e.message || "").replace(/^shippingZones[.:]\s*/, "") }
+                        : _safeNotice(e, "shipping_zone.create");
+          var noticeMsg = dup ? n.message : n.message.replace(/^shippingZones[.:]\s*/, "");
           var rows = await shippingZones.listZones({});
-          return _sendHtml(res, 400, renderAdminShipping({
+          return _sendHtml(res, n.status, renderAdminShipping({
             shop_name: deps.shop_name, nav_available: navAvailable, zones: rows,
-            notice: (e && e.message || "").replace(/^shippingZones[.:]\s*/, ""),
+            notice: noticeMsg,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.create", outcome: "success" });
@@ -5432,9 +5473,9 @@ function mount(router, deps) {
         try {
           await autoDiscount.defineRule(_discountInput(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          return _sendHtml(res, 400, await _renderDiscounts({
-            notice: (e && e.message || "").replace(/^autoDiscount[.:]\s*/, ""),
+          var n = _safeNotice(e, "auto_discount.create");
+          return _sendHtml(res, n.status, await _renderDiscounts({
+            notice: n.message.replace(/^autoDiscount[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.create", outcome: "success" });
@@ -5525,9 +5566,9 @@ function mount(router, deps) {
           try {
             await couponStacking.definePolicy(_policyInput(req.body || {}));
           } catch (e) {
-            if (!(e instanceof TypeError)) throw e;
-            return _sendHtml(res, 400, await _renderDiscounts({
-              notice: (e && e.message || "").replace(/^couponStacking[.:]\s*/, ""),
+            var n = _safeNotice(e, "coupon_policy.create");
+            return _sendHtml(res, n.status, await _renderDiscounts({
+              notice: n.message.replace(/^couponStacking[.:]\s*/, ""),
             }));
           }
           b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".coupon_policy.create", outcome: "success" });
@@ -5641,10 +5682,6 @@ function mount(router, deps) {
       return input;
     }
 
-    function _qdCleanMessage(e) {
-      return (e && e.message || "Couldn't save that tier set.").replace(/^quantityDiscounts[.:]\s*/, "");
-    }
-
     async function _renderQdList(flags) {
       flags = flags || {};
       var rows = await quantityDiscounts.list(_qdFilter(flags.archived_filter));
@@ -5684,8 +5721,10 @@ function mount(router, deps) {
         try {
           await quantityDiscounts.defineTier(_qdDefineInput(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          return _sendHtml(res, 400, await _renderQdList({ notice: _qdCleanMessage(e) }));
+          var n = _safeNotice(e, "quantity_discount.create");
+          return _sendHtml(res, n.status, await _renderQdList({
+            notice: n.message.replace(/^quantityDiscounts[.:]\s*/, ""),
+          }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".quantity_discount.create", outcome: "success" });
         _redirect(res, "/admin/quantity-discounts?created=1");
@@ -6029,9 +6068,10 @@ function mount(router, deps) {
         if (values.support_url)   await config.put("shop.support_url", values.support_url);
         await config.put("setup.completed", true);
       } catch (e) {
-        return _sendHtml(res, 500, renderAdminSetup({
+        var n = _safeNotice(e, "setup.save");
+        return _sendHtml(res, n.status, renderAdminSetup({
           shop_name: deps.shop_name, values: values, nav_available: navAvailable,
-          notice: "Couldn't save — " + ((e && e.message) || "please try again."),
+          notice: n.message,
         }));
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".setup.save", outcome: "success", metadata: {} });

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.11",
+  "version": "0.3.13",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/currency-rounding.js

@@ -81,6 +81,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -97,20 +98,7 @@ var MAX_LIST_LIMIT = 500;
 // typo at config-time rather than at the first checkout that touches
 // the bad code.
 function _currency(code) {
-  if (typeof code !== "string" || !/^[A-Z]{3}$/.test(code)) {
-    throw new TypeError(
-      "currencyRounding: currency must be a 3-letter uppercase ISO 4217 code, got " +
-      JSON.stringify(code)
-    );
-  }
-  var catalog = b.money.CURRENCIES;
-  if (!Object.prototype.hasOwnProperty.call(catalog, code)) {
-    throw new TypeError(
-      "currencyRounding: currency " + JSON.stringify(code) +
-      " is not in the ISO 4217 catalog"
-    );
-  }
-  return code;
+  return textGuard.currencyCode(code, "currencyRounding: currency");
 }
 
 function _incrementMinor(n) {

package/lib/index.js

@@ -252,4 +252,5 @@ Object.assign(module.exports, {
   winbackCampaigns:      require("./winback-campaigns"),
   wishlistDigest:        require("./wishlist-digest"),
   operatorHelpCenter:    require("./operator-help-center"),
+  textGuard:             require("./text-guard"),
 });