@blamejs/blamejs-shop 0.3.20 → 0.3.21

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.21 (2026-05-30) — **Customers can cancel an order from their account before it ships.** A signed-in customer can now cancel one of their own orders from the order page, as long as it has not started fulfillment. The Cancel control appears only while the order is still cancellable — a paid or pending order — and is absent once the order is fulfilling, shipped, delivered, already cancelled, or refunded. The action is tied to the signed-in customer, so a customer can only cancel their own order. Note: cancelling a paid order changes its status to cancelled but does not by itself refund the charge — issue the refund from the admin console as usual; a customer-initiated cancellation of a paid order is your signal to do so. **Added:** *Cancel an unfulfilled order from the account* — The order page now shows a Cancel button while an order is still in a pre-fulfillment state (paid or pending). Cancelling moves the order to cancelled and shows a confirmation; the control does not appear once an order is fulfilling, shipped, delivered, cancelled, or refunded, and a customer can only cancel their own order. A paid-order cancellation updates the status but does not automatically refund the captured payment — refund it from the console; treat a customer cancellation of a paid order as the prompt to do so.
+
 - v0.3.20 (2026-05-30) — **Served media carries hardened headers, primary-image changes are product-scoped, and image-by-URL imports are size-capped.** Three defense-in-depth fixes on product media. Media assets served from storage now carry X-Content-Type-Options: nosniff and Cross-Origin-Resource-Policy: same-origin, and SVG files additionally carry a content policy that prevents script from running when the file is opened directly while still rendering normally inside a product image. Setting a product's primary image now verifies the image actually belongs to the product named in the request rather than acting on the image alone. And importing a product image by URL now refuses a response larger than the same 10 MiB limit the file-upload path enforces, instead of buffering an unbounded download. **Changed:** *Setting the primary image is product-scoped* — The endpoint that makes an image a product's primary (hero) now verifies the image belongs to the product in the request path and returns not-found otherwise, instead of acting on the image regardless of the product named. A request whose product and image don't match is now rejected. · *Vendored runtime updated to v0.14.9* — The vendored blamejs runtime is updated to v0.14.9, a documentation-path and source-comment fix with no API, wire-format, or behavior changes. No operator action is required. **Security:** *Hardened response headers on served media* — Media served from storage now sets X-Content-Type-Options: nosniff and Cross-Origin-Resource-Policy: same-origin, so a mistyped or hostile upload can't be content-sniffed into something executable or embedded cross-origin. An SVG additionally carries a default-src 'none' sandbox content-security policy, so opening an SVG URL directly cannot run script (it still renders inside an img tag). This sits behind the existing SVG-upload sanitizer as a second layer. · *Importing an image by URL is size-capped* — Importing a product image from a URL now refuses a response larger than 10 MiB — the same limit a direct file upload uses — returning a clear error instead of buffering an unbounded download.
 
 - v0.3.19 (2026-05-30) — **Edit announcement bars, automatic-discount terms, and subscription plans from the console.** Three admin entities could be created but only partly edited from the console — the rest of their fields were reachable only through the API, so changing them meant archive-and-recreate or a manual API call. Each now has a detail screen with the full edit form. An announcement bar can have its message, links, schedule, audience, and dismissibility changed in place. An automatic discount can have its actual terms changed — the amount, percentage, threshold, or buy-x-get-y values — not just its title, priority, and on/off state. A subscription plan can have its price, billing interval, trial length, active state, and variant edited. Create and archive behavior is unchanged. **Fixed:** *Announcement bars are editable in place* — A detail screen now lets you change an announcement's message, link, theme, audience, start/end schedule, and whether it can be dismissed — instead of archiving it and creating a new one (which lost the slug and any recorded dismissal state). · *Automatic-discount terms are editable from the console* — The discount detail screen now edits the rule's trigger and value — the amount off, percent off, cart threshold, or buy-x-get-y terms — which previously could only be changed through the API. The inline priority and on/off controls are unchanged. · *Subscription plans have an edit screen* — A subscription plan's price, billing interval count, trial length, active state, and variant can now be edited from a detail screen. The Stripe-bound fields (the price id, interval unit, and currency) remain read-only, as they were always immutable.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.20",
+  "version": "0.3.21",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/storefront.js

@@ -4569,6 +4569,20 @@ function _orderEligibleForReorder(status) {
   return status !== "pending";
 }
 
+// Cancel is offered only while the order is still pre-fulfillment: the
+// order FSM (lib/order.js) accepts the `cancel` event from `pending`
+// (awaiting capture) and `paid` (captured, not yet picked) only. Once
+// the warehouse starts fulfilling — and through shipped / delivered —
+// the order is no longer the customer's to cancel; the terminal off-ramps
+// (cancelled / refunded) have no cancel edge either. Keeping this in lock-
+// step with the FSM's cancel edges means the button never offers a
+// transition the primitive would refuse. A cancel on a `paid` order does
+// NOT void the captured charge — the FSM only moves the status — so a paid
+// cancel leaves the operator to issue the refund from the console.
+function _orderEligibleForCancel(status) {
+  return status === "pending" || status === "paid";
+}
+
 // Render the lifecycle timeline. Every step up to and including the
 // current status is marked done; the current step is also marked
 // current. A terminal off-ramp (refunded / cancelled) collapses the rail
@@ -4669,6 +4683,12 @@ function _orderActionsBlock(o) {
     btns.push(
       "<a class=\"btn-secondary order-action\" href=\"/account/orders/" + esc(String(o.id)) + "/return\">Request a return</a>");
   }
+  if (_orderEligibleForCancel(o.status)) {
+    btns.push(
+      "<form class=\"order-action\" method=\"post\" action=\"/orders/" + esc(String(o.id)) + "/cancel\">" +
+        "<button type=\"submit\" class=\"btn-ghost\">Cancel order</button>" +
+      "</form>");
+  }
   if (!btns.length) return "";
   return "<div class=\"order-page__actions\">" + btns.join("") + "</div>";
 }
@@ -4733,6 +4753,7 @@ function renderOrder(opts) {
       actions_html:        actionsHtml,
       can_return:          _orderEligibleForReturn(o.status),
       can_reorder:         _orderEligibleForReorder(o.status),
+      can_cancel:          _orderEligibleForCancel(o.status),
       recommendations:     recs,
       has_recommendations: recs.length > 0,
       asset_css_main:      opts.theme.assetUrl("css/main.css"),
@@ -4759,6 +4780,14 @@ function renderOrder(opts) {
   var reorderNotice = opts.reordered
     ? "<p class=\"form-notice form-notice--ok\" role=\"status\">Items from this order were added to your cart. <a href=\"/cart\">View cart →</a></p>"
     : "";
+  // Confirmation banner after a successful cancel (the POST redirects to
+  // ?cancelled=1). A paid order's captured charge is not auto-voided by the
+  // cancel — the refund is the operator's call from the console — so the
+  // copy stays neutral ("cancelled") rather than promising a refund the
+  // status transition didn't perform.
+  var cancelNotice = opts.cancelled
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">This order has been cancelled.</p>"
+    : "";
   var body = _render(ORDER_PAGE, {
     order_id:  o.id,
     status:    o.status,
@@ -4768,7 +4797,7 @@ function renderOrder(opts) {
     shipping:  shipping,
     total:     total,
   }).replace("RAW_LINES", rows)
-    .replace("RAW_REORDER_NOTICE", reorderNotice)
+    .replace("RAW_REORDER_NOTICE", reorderNotice + cancelNotice)
     .replace("RAW_ORDER_TIMELINE", timelineHtml)
     .replace("RAW_ORDER_TRACKING", trackingHtml)
     .replace("RAW_ORDER_ACTIONS", actionsHtml)
@@ -8557,6 +8586,7 @@ function mount(router, deps) {
         recommendations: recommendations,
         shipments:       shipments,
         reordered:       ordUrl ? ordUrl.searchParams.get("reordered") === "1" : false,
+        cancelled:       ordUrl ? ordUrl.searchParams.get("cancelled") === "1" : false,
         shop_name:       shopName,
         theme:           theme,
       }));
@@ -10895,6 +10925,68 @@ function mount(router, deps) {
       res.setHeader && res.setHeader("location", "/orders/" + encodeURIComponent(o.id) + "?reordered=1");
       return res.end ? res.end() : res.send("");
     });
+
+    // POST /orders/:id/cancel — customer-initiated cancellation of an
+    // order that hasn't been fulfilled yet. The order FSM (lib/order.js)
+    // accepts the `cancel` event from `pending` and `paid` only; this
+    // route gates on the same eligibility (_orderEligibleForCancel) so a
+    // shipped / delivered / already-cancelled / refunded order can't be
+    // cancelled here. Two refusals guard against IDOR: the order must
+    // belong to the signed-in customer (a foreign or guest-owned order is
+    // a clean 404, never acted on and never leaked), and only then is the
+    // transition attempted. A cancel the FSM still refuses (a status that
+    // raced past `paid` between the page render and the POST) maps to a
+    // clean redirect back to the order rather than a 500. Cancelling a
+    // `paid` order moves the status only — the captured charge is NOT
+    // auto-voided by the transition, so the refund remains the operator's
+    // action from the console.
+    router.post("/orders/:order_id/cancel", async function (req, res) {
+      var orderId = req.params && req.params.order_id;
+      // Cancel is a logged-in-customer action — resolve the session first
+      // so an unauthenticated POST goes to login, never near the order.
+      var cancelAuth = _currentCustomerEnv(req);
+      if (!cancelAuth) {
+        res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+        return res.end ? res.end() : res.send("");
+      }
+      var o;
+      try { o = orderId ? await deps.order.get(orderId) : null; }
+      catch (e) { if (e instanceof TypeError) { o = null; } else throw e; }
+      // Ownership gate against IDOR: a missing order, a malformed id, an
+      // order owned by another customer, OR a guest order with no owner
+      // all 404 — the cancel never touches an order the caller doesn't own.
+      if (!o || !o.customer_id || o.customer_id !== cancelAuth.customer_id) {
+        return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+      }
+      // Eligibility gate mirrors the FSM's cancel edges (pending | paid).
+      // A non-cancellable status (fulfilling / shipped / delivered /
+      // cancelled / refunded) bounces back to the order page unchanged —
+      // a clean 303, no transition attempted, no 500.
+      if (!_orderEligibleForCancel(o.status)) {
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/orders/" + encodeURIComponent(o.id));
+        return res.end ? res.end() : res.send("");
+      }
+      try {
+        await deps.order.transition(o.id, "cancel", { reason: "customer-requested" });
+      } catch (e) {
+        // The FSM refuses the event (a status that advanced out of the
+        // cancellable window between render and POST). order.transition
+        // tags the refusal with .code = ORDER_TRANSITION_REFUSED; surface
+        // it as a clean redirect to the order page rather than a 500.
+        if (e && e.code === "ORDER_TRANSITION_REFUSED") {
+          res.status(303);
+          res.setHeader && res.setHeader("location", "/orders/" + encodeURIComponent(o.id));
+          return res.end ? res.end() : res.send("");
+        }
+        throw e;
+      }
+      // PRG back to the order page with a confirmation banner (a refresh
+      // doesn't re-fire the cancel).
+      res.status(303);
+      res.setHeader && res.setHeader("location", "/orders/" + encodeURIComponent(o.id) + "?cancelled=1");
+      return res.end ? res.end() : res.send("");
+    });
   }
 
   // POST /cart/lines — add a line. Reads variant_id + qty from the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {