npm - @blamejs/blamejs-shop - Versions diffs - 0.3.22 → 0.3.24 - Mend

@blamejs/blamejs-shop 0.3.22 → 0.3.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/CHANGELOG.md +4 -0
package/lib/admin.js +905 -3
package/lib/asset-manifest.json +1 -1
package/lib/security-middleware.js +7 -0
package/lib/storefront.js +211 -10
package/package.json +1 -1

package/lib/asset-manifest.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.22",
+  "version": "0.3.24",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/security-middleware.js CHANGED Viewed

@@ -105,6 +105,13 @@ var EDGE_POST_PATHS = [
   "/consent",
   "/currency",
   "/newsletter",
+  // One-click unsubscribe (RFC 8058). The unsubscribe token in the URL IS
+  // the bearer; the POST a mail client fires from List-Unsubscribe-Post
+  // carries no cookies and no session CSRF token, so the path must be
+  // exempt from the double-submit check (it keeps its SameSite +
+  // fetch-metadata defense and is single-use + timing-safe at the token
+  // layer). Container-only — there's no edge copy to keep parity with.
+  "/unsubscribe",
   "/announcements/",
 ];

package/lib/storefront.js CHANGED Viewed

@@ -106,6 +106,23 @@ function webhookRawBodyCapture(paths) {
 // same XSS guard, same unknown / unused refusal).
 var _render = emailModule._render;
+// Splice a fully-rendered HTML fragment into `html` at the first
+// occurrence of a literal `RAW_*` token, inserting the fragment LITERALLY.
+//
+// `String.prototype.replace(token, replacementString)` gives the
+// replacement string special meaning to `$` sequences — `$$`, `$&`,
+// `` $` `` (the text before the match), `$'` (the text after the match),
+// `$1`. A page/blog body that contains a dollar followed by a backtick
+// would otherwise splice the entire document HEAD into the body, and any
+// other dollar sequence corrupts the output. The fragment is already
+// escaped/rendered at its own build site, so this is purely about the
+// replace mechanics: passing a REPLACER FUNCTION makes `String.replace`
+// insert the return value verbatim, with no dollar interpretation. Use
+// this for every dynamic (operator- or customer-supplied) fragment swap.
+function _spliceRaw(html, token, fragment) {
+  return html.replace(token, function () { return fragment == null ? "" : String(fragment); });
+}
 // ---- double-submit CSRF token injection ---------------------------------
 // The container's authenticated state-changing forms (account /
@@ -758,15 +775,23 @@ function _wrap(opts) {
   // Per-page robots directive. Indexable pages (the default) emit no
   // robots meta — the absence means "index, follow". Pages the storefront
-  // keeps out of search (cart / account / any session-scoped surface)
-  // pass `robots: "noindex"`, which stamps a noindex,nofollow meta in the
-  // <head> — a belt-and-suspenders pairing with the robots.txt Disallow +
-  // the edge `x-robots-tag` header, so a directly-fetched page is also
+  // keeps out of search pass a directive:
+  //   - `noindex` → `noindex,nofollow`. Session-scoped surfaces (cart /
+  //     account) whose links are all session-scoped too, so there's
+  //     nothing for a crawler to follow.
+  //   - `noindex,follow` → `noindex,follow`. Internal search result pages
+  //     are thin/duplicate indexable URLs (one per query + facet combo) —
+  //     keep the query URL out of the index but let crawlers follow the
+  //     product links the page lists.
+  // It's a belt-and-suspenders pairing with the robots.txt Disallow + the
+  // edge `x-robots-tag` header, so a directly-fetched page is also
   // self-describing. A noindex page needs no canonical (a crawler won't
   // index it to dedupe), so these pages don't thread a canonical_url.
-  var robotsMeta = (opts.robots === "noindex")
-    ? "  <meta name=\"robots\" content=\"noindex,nofollow\">\n"
-    : "";
+  var robotsMeta = (opts.robots === "noindex,follow")
+    ? "  <meta name=\"robots\" content=\"noindex,follow\">\n"
+    : (opts.robots === "noindex")
+      ? "  <meta name=\"robots\" content=\"noindex,nofollow\">\n"
+      : "";
   var assembled = _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
@@ -776,15 +801,18 @@ function _wrap(opts) {
     .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
     .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
     .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
-    .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "")
-    .replace("RAW_BODY_PLACEHOLDER", opts.body);
+    .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "");
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
   // outer renderer's HTML-escape doesn't double-escape the inner
-  // markup. `search_q` is HTML-escaped by the renderer like any
+  // markup, and routes through `_spliceRaw` so a body carrying a `$`
+  // sequence (a blog/CMS post, a reflected query) is inserted literally
+  // rather than triggering `String.replace`'s dollar-substitution.
+  // `search_q` is HTML-escaped by the renderer like any
   // other placeholder, so a customer-supplied query like
   // `"><script>` lands as escaped text inside the input's `value`.
   //
+  assembled = _spliceRaw(assembled, "RAW_BODY_PLACEHOLDER", opts.body);
   // Final pass: token the container's authenticated POST forms with the
   // per-request double-submit CSRF value (stashed on the locale ALS by
   // `localeMiddleware`). EDGE_POST_PATHS forms are skipped to preserve
@@ -1557,6 +1585,10 @@ function renderSearch(opts) {
     og_description: searchMetaDescription,
     canonical_url: opts.canonical_url,
     og_url:        opts.og_url,
+    // Internal search results are thin/duplicate indexable URLs (one per
+    // query + facet combination) — keep the query URL out of the index
+    // but let crawlers follow the product links the page lists.
+    robots:     "noindex,follow",
     body:       body,
   }, _currencyWrapOpts(opts)));
 }
@@ -5226,6 +5258,110 @@ function renderNewsletterError(opts) {
   });
 }
+// ---- newsletter unsubscribe (CAN-SPAM / RFC 8058) ----------------------
+//
+// A marketing email's unsubscribe link points at GET /unsubscribe?token=…
+// (a friendly confirm page) and List-Unsubscribe-Post fires a one-click
+// POST /unsubscribe with the same token. Both are unauthenticated — the
+// opaque, single-use, timing-safe token is the bearer — and CSRF-exempt
+// (the mail-client POST carries no session). The token is never echoed
+// back to the page; only its structured outcome is rendered.
+// The confirm page (GET). A no-JS form POSTs the token back to
+// /unsubscribe to perform the unsubscribe, so a visitor who followed the
+// link sees a deliberate "yes, unsubscribe me" step rather than being
+// unsubscribed by a link-prefetcher. The token rides in a hidden field
+// (HTML-escaped) and is the only handle — no email address is shown.
+function renderUnsubscribeConfirm(opts) {
+  opts = opts || {};
+  var token = typeof opts.token === "string" ? opts.token : "";
+  var body =
+    "<section class=\"newsletter-thanks\">" +
+      "<div class=\"newsletter-thanks__card\">" +
+        "<p class=\"eyebrow\">Newsletter</p>" +
+        "<h1 class=\"newsletter-thanks__title\">Unsubscribe from the list?</h1>" +
+        "<p class=\"newsletter-thanks__lede\">Confirm below and we'll stop emailing this address. You can re-subscribe any time from the footer of the site.</p>" +
+        "<form class=\"newsletter-unsub__form\" method=\"post\" action=\"/unsubscribe\">" +
+          "<input type=\"hidden\" name=\"token\" value=\"" + _escAttr(token) + "\">" +
+          "<div class=\"newsletter-thanks__cta\">" +
+            "<button type=\"submit\" class=\"btn-primary\">Unsubscribe</button>" +
+            "<a href=\"/\" class=\"btn-ghost\">Keep me subscribed</a>" +
+          "</div>" +
+        "</form>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Unsubscribe",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    // The confirm + result pages are token-bearer surfaces with no
+    // canonical/indexable identity — keep them out of search (`noindex`
+    // maps to noindex,nofollow in _wrap).
+    robots:     "noindex",
+    body:       body,
+  });
+}
+// The POST outcome page. `opts.outcome` is one of the structured results
+// the unsubscribe flow produces: "unsubscribed" (success — offers a
+// re-subscribe form), "not-found" (invalid / unknown token), "already"
+// (the token was already consumed — the address is already off the list),
+// "expired" (the token's TTL lapsed). Every branch renders a clean,
+// server-rendered page; no raw error is ever surfaced.
+function renderUnsubscribeResult(opts) {
+  opts = opts || {};
+  var outcome = opts.outcome;
+  var heading, lede, extra = "";
+  if (outcome === "unsubscribed") {
+    heading = "You're unsubscribed.";
+    lede    = "This address won't receive any more newsletter email. Changed your mind? Re-subscribe below.";
+    // Re-subscribe affordance — the storefront newsletter signup form,
+    // pre-pointed at the footer band's POST /newsletter so a single click
+    // (after typing the address) puts the visitor back on the list.
+    extra =
+      "<form class=\"newsletter-resub__form\" method=\"post\" action=\"/newsletter\">" +
+        "<label class=\"skip-link\" for=\"resub-email\">Email address</label>" +
+        "<input id=\"resub-email\" type=\"email\" name=\"email\" required placeholder=\"you@example.com\" autocomplete=\"email\">" +
+        "<button type=\"submit\" class=\"btn-primary\">Re-subscribe</button>" +
+      "</form>";
+  } else if (outcome === "already") {
+    heading = "Already unsubscribed.";
+    lede    = "This link was already used — the address is off the list, so there's nothing more to do.";
+  } else if (outcome === "expired") {
+    heading = "That link has expired.";
+    lede    = "Unsubscribe links are valid for a limited time. You're still on the list; use the unsubscribe link in a more recent email, or contact us and we'll remove you.";
+  } else {
+    // "not-found" + any unexpected code → the same generic, non-leaking
+    // copy. A bad / unknown / malformed token can't be distinguished from
+    // outside, by design.
+    heading = "This link isn't valid.";
+    lede    = "We couldn't match this unsubscribe link to a subscription. It may have already been used, or the link may be incomplete.";
+  }
+  var body =
+    "<section class=\"newsletter-thanks\">" +
+      "<div class=\"newsletter-thanks__card\">" +
+        "<p class=\"eyebrow\">Newsletter</p>" +
+        "<h1 class=\"newsletter-thanks__title\">" + heading + "</h1>" +
+        "<p class=\"newsletter-thanks__lede\">" + lede + "</p>" +
+        extra +
+        "<div class=\"newsletter-thanks__cta\">" +
+          "<a href=\"/\" class=\"btn-primary\">Back to the shop <span aria-hidden=\"true\">→</span></a>" +
+        "</div>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Unsubscribe",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    // Token-bearer outcome page — keep it out of search (`noindex` maps to
+    // noindex,nofollow in _wrap).
+    robots:     "noindex",
+    body:       body,
+  });
+}
 // ---- cookie preference center ------------------------------------------
 // The four toggleable categories + their operator-facing copy, mirroring
@@ -11263,6 +11399,71 @@ function mount(router, deps) {
         }));
       }
     });
+    // Newsletter unsubscribe (CAN-SPAM one-click / RFC 8058).
+    //
+    // GET /unsubscribe?token=… renders a friendly confirm page; the
+    // visitor clicks "Unsubscribe", which POSTs the token back. POST
+    // /unsubscribe is also the List-Unsubscribe-Post one-click target a
+    // mail client fires directly. The opaque, single-use, timing-safe
+    // token is the bearer — no session, no auth — so the route is
+    // CSRF-exempt (see EDGE_POST_PATHS) and reads each structured outcome
+    // `consumeUnsubscribeToken` returns onto a clean server-rendered page.
+    // The token is never echoed back beyond the confirm form's hidden
+    // field; the outcome page reveals nothing about whether a token
+    // existed, was already used, or expired beyond its own friendly copy.
+    // Map a `consumeUnsubscribeToken` result code onto the outcome the
+    // result page renders. The structured codes are stable; an unknown
+    // code degrades to the generic "not valid" page rather than a 500.
+    function _unsubscribeOutcome(result) {
+      if (result && result.ok === true) return "unsubscribed";
+      var code = result && result.error;
+      if (code === "already-consumed") return "already";
+      if (code === "expired")          return "expired";
+      return "not-found";   // "not-found" + anything unexpected
+    }
+    router.get("/unsubscribe", async function (req, res) {
+      var token = (req.query && typeof req.query.token === "string") ? req.query.token : "";
+      var cartCount = 0;
+      try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      return _send(res, 200, renderUnsubscribeConfirm({
+        shop_name:  shopName,
+        cart_count: cartCount,
+        token:      token,
+      }));
+    });
+    router.post("/unsubscribe", async function (req, res) {
+      var body = req.body || {};
+      var token = typeof body.token === "string" ? body.token : "";
+      var cartCount = 0;
+      try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      var outcome;
+      try {
+        // `consumeUnsubscribeToken` returns a structured result (it does
+        // not throw on a bad/missing token — it returns `{ ok:false,
+        // error:"not-found" }`). An empty token is handled the same way.
+        var result = await deps.newsletter.consumeUnsubscribeToken(token);
+        outcome = _unsubscribeOutcome(result);
+      } catch (e) {
+        // A real infrastructure fault (D1 unreachable) — record it server-
+        // side and render the generic non-leaking page rather than a 500
+        // that exposes internals on a public, unauthenticated route.
+        _log.error("storefront unsubscribe failed", {
+          route:      "/unsubscribe",
+          request_id: (req && req.requestId) || null,
+          err:        (e && e.message) || String(e),
+        });
+        outcome = "not-found";
+      }
+      return _send(res, 200, renderUnsubscribeResult({
+        shop_name:  shopName,
+        cart_count: cartCount,
+        outcome:    outcome,
+      }));
+    });
   }
   // ---- cookie consent -----------------------------------------------------

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {