@blamejs/blamejs-shop 0.3.33 → 0.3.34

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.34 (2026-05-31) — **Edit, pin, and archive the internal notes on a customer.** Internal notes on a customer could only be added — a note with a typo or one that was no longer true could not be corrected or removed, which is a liability for notes like "do not ship to this address" or "allergic to X". The customer detail screen now lets you edit a note's text, pin important notes to the top, and archive notes that no longer apply (and restore them). Each action is limited to notes that belong to the customer being viewed. **Added:** *Edit, pin, and archive customer notes* — The notes panel on a customer's detail screen now supports the full lifecycle: edit a note's text to fix or update it, pin the notes that matter so they sort to the top, and archive notes that no longer apply, with a toggle to show archived notes and restore them. Previously notes were append-only, so a wrong or stale note could not be corrected or retired. Every edit, pin, and archive action is scoped to the customer being viewed, so a note can only be changed from the record it belongs to.
+
 - v0.3.33 (2026-05-31) — **Create and manage customer segments from the admin console.** Customer segments could be shown on a customer's profile but there was no way to define or manage them, so the feature could not actually be used. A new Segments screen in the admin console creates rule-based segments from recency, frequency, lifetime-order, spend, average-order-value, and refund-rate criteria, edits their rules, archives and restores them, and recomputes membership on demand — showing how many customers each segment now contains. Segment membership stays rule-derived: it is recalculated from order history, not assigned by hand. **Added:** *Customer segments administration* — A Segments screen in the admin console manages rule-based customer segments. Each segment is defined by RFM-style criteria — how recently and how often a customer orders, their lifetime order count and spend, average order value, and refund rate — and a list shows every segment with its rules, current member count, and status, filterable by active or archived. You can create and edit segments, archive and restore them, and recompute membership on demand, which re-evaluates the rules against order history and reports how many customers match. Membership is always derived from the rules, never assigned per customer.
 
 - v0.3.32 (2026-05-31) — **Collection pages now page through every product instead of stopping at 24.** A collection page showed only its first 24 products and provided no way to reach the rest, so any product past the 24th in a collection was silently unreachable. Collection pages now have previous/next pagination, matching the search results, so a collection of any size can be browsed in full. A shared link to a specific page keeps its position, while the page's canonical URL stays the plain collection address. **Fixed:** *Collection pages paginate* — A collection with more than 24 products was truncated at the first 24 with no way to see the others. Collection pages now carry previous/next pagination — the same control used on search results — so every product in a collection is reachable. The canonical URL remains the bare collection address on every page (so search engines see one collection page, not duplicates), while a shared link to a deeper page preserves its position.

package/lib/admin.js

@@ -2674,8 +2674,13 @@ function mount(router, deps) {
       }
 
       var notes = [];
+      var showArchivedNotes = flags.show_archived_notes === true;
       if (customerNotes) {
-        try { notes = (await customerNotes.notesForCustomer({ customer_id: customer.id, limit: 20 })).rows || []; }
+        try {
+          notes = (await customerNotes.notesForCustomer({
+            customer_id: customer.id, limit: 50, include_archived: showArchivedNotes,
+          })).rows || [];
+        }
         catch (_e) { notes = []; }
       }
 
@@ -2698,6 +2703,7 @@ function mount(router, deps) {
         loyalty_link:   !!deps.loyalty,
         can_notes:      !!customerNotes,
         notes:          notes,
+        show_archived_notes: showArchivedNotes,
         can_segments:   !!customerSegments,
         segments:       segments,
       }, flags);
@@ -2716,8 +2722,13 @@ function mount(router, deps) {
       R(async function (req, res) {
         var c = await _resolveCustomer(req.params.id);
         if (!c) return _problem(res, 404, "customer-not-found");
-        // Bearer JSON: the customer record + its satellites (no HTML).
-        var model = await _customerDetailModel(c, {});
+        // Bearer JSON: the customer record + its satellites (no HTML). A
+        // tooling client can opt into the archived notes via
+        // ?notes_archived=1, matching the browser detail-screen toggle.
+        var apiUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        var model = await _customerDetailModel(c, {
+          show_archived_notes: !!(apiUrl && apiUrl.searchParams.get("notes_archived") === "1"),
+        });
         _json(res, 200, {
           customer:             c,
           recent_orders:        model.recent_orders,
@@ -2738,6 +2749,7 @@ function mount(router, deps) {
           saved:        url && url.searchParams.get("saved"),
           credit_notice: url && url.searchParams.get("credit_err") ? url.searchParams.get("credit_err") : null,
           note_notice:   url && url.searchParams.get("note_err") ? url.searchParams.get("note_err") : null,
+          show_archived_notes: !!(url && url.searchParams.get("notes_archived") === "1"),
         };
         _sendHtml(res, 200, renderAdminCustomerDetail(await _customerDetailModel(c, flags)));
       },
@@ -2870,6 +2882,104 @@ function mount(router, deps) {
           _redirect(res, "/admin/customers/" + encodeURIComponent(c.id) + "?saved=1");
         },
       ));
+
+      // ---- customer notes (edit / pin / archive lifecycle) ---------------
+      // A note belongs to a customer. customerNotes' update / pin / archive
+      // methods move a row by note id alone — they carry no notion of which
+      // customer the operator is acting on — so every per-note write route
+      // under :id MUST first assert the note belongs to THAT customer before
+      // mutating it, or an operator on customer A's screen could edit / pin /
+      // retire customer B's note by guessing its id (an IDOR). This mirrors
+      // the media setPrimary (_mediaBelongsToProduct) + support thread
+      // (_ownedTicket) scoping: load the note, refuse it unless its
+      // customer_id matches the path id. A malformed note id throws a
+      // TypeError inside getNote's UUID guard → a clean 400; a well-formed
+      // unknown id (or one owned by a different customer) returns null /
+      // false → a clean 404, with nothing written either way.
+      async function _noteBelongsToCustomer(noteId, customerId) {
+        var note;
+        try { note = await customerNotes.getNote(noteId); }
+        catch (e) { if (e instanceof TypeError) throw e; return false; }
+        return (note && note.customer_id === customerId) ? note : false;
+      }
+
+      // Map a per-note write to a content-negotiated outcome. `mutate(note)`
+      // performs the customerNotes call (already ownership-checked); on the
+      // bearer path it returns the updated note as JSON, on the browser path
+      // it PRGs back to the detail screen with a saved / note_err banner.
+      // A malformed note id is a clean 400 (bearer) / note_err redirect
+      // (browser); a missing / cross-customer note is a clean 404 (bearer) /
+      // note_err redirect (browser). Nothing is mutated on any refusal.
+      function _noteWriteRoute(routePath, audit, mutate) {
+        router.post(routePath, _pageOrApi(false,
+          W(audit, async function (req, res) {
+            var c = await _resolveCustomer(req.params.id);
+            if (!c) return _problem(res, 404, "customer-not-found");
+            var owned;
+            try { owned = await _noteBelongsToCustomer(req.params.noteId, c.id); }
+            catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+            if (!owned) return _problem(res, 404, "note-not-found");
+            var updated;
+            try { updated = await mutate(owned, req.body || {}); }
+            catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+            _json(res, 200, updated);
+            return { id: c.id };
+          }),
+          async function (req, res) {
+            var c = await _resolveCustomer(req.params.id);
+            if (!c) return _sendHtml(res, 404, renderAdminCustomers({
+              shop_name: deps.shop_name, nav_available: navAvailable, customers: [], notice: "Customer not found.",
+            }));
+            var enc = encodeURIComponent(c.id);
+            var owned;
+            try { owned = await _noteBelongsToCustomer(req.params.noteId, c.id); }
+            catch (e) {
+              var nm = _safeNotice(e, audit);
+              return _redirect(res, "/admin/customers/" + enc +
+                "?note_err=" + encodeURIComponent(nm.message.replace(/^(?:admin|customerNotes)[.:]\s*/, "")));
+            }
+            if (!owned) {
+              return _redirect(res, "/admin/customers/" + enc +
+                "?note_err=" + encodeURIComponent("That note was not found on this customer."));
+            }
+            try { await mutate(owned, req.body || {}); }
+            catch (e) {
+              var n = _safeNotice(e, audit);
+              return _redirect(res, "/admin/customers/" + enc +
+                "?note_err=" + encodeURIComponent(n.message.replace(/^(?:admin|customerNotes)[.:]\s*/, "")));
+            }
+            b.audit.safeEmit({ action: AUDIT_NAMESPACE + "." + audit, outcome: "success", metadata: { id: c.id } });
+            _redirect(res, "/admin/customers/" + enc + "?saved=1");
+          },
+        ));
+      }
+
+      // Edit the note body / kind. The new text is required + length-capped by
+      // the primitive's validator (empty / over-long body, bad kind → a clean
+      // 4xx with nothing written); the kind is left unchanged when the form
+      // omits it.
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/edit", "customer.note.edit",
+        function (owned, body) {
+          var patch = { body: body.body };
+          if (body.kind != null && body.kind !== "") patch.kind = body.kind;
+          return customerNotes.updateNote(owned.id, patch);
+        });
+
+      // Pin / unpin — a pinned note floats to the top of the customer's note
+      // list (notesForCustomer orders pinned DESC). Idempotent at the
+      // primitive.
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/pin", "customer.note.pin",
+        function (owned) { return customerNotes.pinNote(owned.id); });
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/unpin", "customer.note.unpin",
+        function (owned) { return customerNotes.unpinNote(owned.id); });
+
+      // Archive / unarchive — a soft-retire that drops the note from the
+      // default (active) listing; unarchive brings it back. Both idempotent at
+      // the primitive.
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/archive", "customer.note.archive",
+        function (owned) { return customerNotes.archiveNote(owned.id); });
+      _noteWriteRoute("/admin/customers/:id/notes/:noteId/unarchive", "customer.note.unarchive",
+        function (owned) { return customerNotes.unarchiveNote(owned.id); });
     }
   }
 
@@ -9925,25 +10035,56 @@ function renderAdminCustomerDetail(opts) {
       "<p class=\"empty\">Customer notes aren't wired in this deployment.</p></div>";
   } else {
     var noteNotice = opts.note_notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.note_notice) + "</div>" : "";
+    var showArchived = opts.show_archived_notes === true;
+    // A <select name="kind"> with the active kind preselected. Reused by the
+    // add form and each note's inline edit form.
+    function _noteKindSelect(active) {
+      return ["general", "preference", "escalation", "warning", "billing"].map(function (k) {
+        return "<option value=\"" + k + "\"" + (k === active ? " selected" : "") + ">" + k + "</option>";
+      }).join("");
+    }
     var noteRows = (opts.notes || []).map(function (n) {
-      return "<li><div class=\"note-meta\">" + _htmlEscape(n.kind) + " · " + _htmlEscape(_fmtDate(n.created_at)) + "</div>" +
-        "<div class=\"note-body\">" + _htmlEscape(n.body) + "</div></li>";
+      var nenc = _htmlEscape(encodeURIComponent(n.id));
+      var base = "/admin/customers/" + _htmlEscape(enc) + "/notes/" + nenc;
+      var isPinned   = Number(n.pinned) === 1;
+      var isArchived = n.archived_at != null;
+      var pills =
+        (isPinned ? "<span class=\"status-pill paid\">Pinned</span>" : "") +
+        (isArchived ? "<span class=\"status-pill cancelled\">Archived</span>" : "");
+      // Inline edit form — kind + body, prefilled with the note's current
+      // values; the primitive re-validates an empty / over-long body.
+      var editForm = "<details class=\"note-edit\"><summary class=\"btn btn--ghost\">Edit</summary>" +
+        "<form method=\"post\" action=\"" + base + "/edit\">" +
+          "<label class=\"form-field\"><span>Kind</span>" +
+            "<select name=\"kind\">" + _noteKindSelect(n.kind) + "</select></label>" +
+          "<label class=\"form-field\"><span>Note</span>" +
+            "<textarea name=\"body\" required maxlength=\"8000\" rows=\"3\">" + _htmlEscape(n.body) + "</textarea></label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save note</button></div>" +
+        "</form></details>";
+      var pinForm = "<form method=\"post\" action=\"" + base + (isPinned ? "/unpin" : "/pin") + "\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">" + (isPinned ? "Unpin" : "Pin") + "</button></form>";
+      var archiveForm = "<form method=\"post\" action=\"" + base + (isArchived ? "/unarchive" : "/archive") + "\">" +
+        "<button class=\"btn btn--ghost\" type=\"submit\">" + (isArchived ? "Unarchive" : "Archive") + "</button></form>";
+      return "<li class=\"note-item\">" +
+        "<div class=\"note-meta\">" + _htmlEscape(n.kind) + " · " + _htmlEscape(_fmtDate(n.created_at)) +
+          (pills ? " " + pills : "") + "</div>" +
+        "<div class=\"note-body\">" + _htmlEscape(n.body) + "</div>" +
+        "<div class=\"actions-row\">" + editForm + pinForm + archiveForm + "</div>" +
+      "</li>";
     }).join("");
-    notesPanel = "<div class=\"panel\"><h3 class=\"subhead\">Notes</h3>" +
+    var archivedToggle = showArchived
+      ? "<a class=\"btn btn--ghost\" href=\"/admin/customers/" + _htmlEscape(enc) + "\">Hide archived</a>"
+      : "<a class=\"btn btn--ghost\" href=\"/admin/customers/" + _htmlEscape(enc) + "?notes_archived=1\">Show archived</a>";
+    notesPanel = "<div class=\"panel\"><div class=\"actions-row\"><h3 class=\"subhead\">Notes</h3>" + archivedToggle + "</div>" +
       noteNotice +
-      "<p class=\"meta\">Operator-only annotations on this customer. Never shown to the customer.</p>" +
+      "<p class=\"meta\">Operator-only annotations on this customer. Never shown to the customer. " +
+        "Pin the notes every shift should see first; archive a stale or wrong note to retire it from the active list.</p>" +
       ((opts.notes || []).length
         ? "<ul class=\"note-list\">" + noteRows + "</ul>"
-        : "<p class=\"empty\">No notes yet.</p>") +
+        : "<p class=\"empty\">" + (showArchived ? "No notes (including archived)." : "No notes yet.") + "</p>") +
       "<form method=\"post\" action=\"/admin/customers/" + _htmlEscape(enc) + "/notes\">" +
         "<label class=\"form-field\"><span>Kind</span>" +
-          "<select name=\"kind\">" +
-            "<option value=\"general\">general</option>" +
-            "<option value=\"preference\">preference</option>" +
-            "<option value=\"escalation\">escalation</option>" +
-            "<option value=\"warning\">warning</option>" +
-            "<option value=\"billing\">billing</option>" +
-          "</select></label>" +
+          "<select name=\"kind\">" + _noteKindSelect("general") + "</select></label>" +
         "<label class=\"form-field\"><span>Note</span>" +
           "<textarea name=\"body\" required maxlength=\"8000\" rows=\"3\" placeholder=\"e.g. VIP — comp shipping where possible\"></textarea></label>" +
         "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Add note</button></div>" +

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.33",
+  "version": "0.3.34",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.33",
+  "version": "0.3.34",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {