@blamejs/blamejs-shop 0.3.34 → 0.3.35

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.35 (2026-05-31) — **Share a wishlist with a private link.** A customer's wishlist could only be viewed by the customer themselves. From the wishlist page a shopper can now create a shareable link and send it to someone — a friend buying a gift, for example — who opens it without needing an account and sees the wishlist's products. The link can be revoked at any time, after which it stops working. The shared page shows only the products: it does not reveal who owns the wishlist or any private notes on it, and it is not indexed by search engines. **Added:** *Shareable wishlist links* — The wishlist page now has a Share control that creates a private link to the wishlist. The full link is shown once, to copy and send; anyone with it can open the shared wishlist without an account and see its products, each linking to the product page. The owner sees their active links and can revoke any of them, which immediately stops the link from working. The shared view shows only the products — never the owner's identity or private notes — and is marked not to be indexed by search engines, so a personal wishlist stays private to whoever holds the link.
+
 - v0.3.34 (2026-05-31) — **Edit, pin, and archive the internal notes on a customer.** Internal notes on a customer could only be added — a note with a typo or one that was no longer true could not be corrected or removed, which is a liability for notes like "do not ship to this address" or "allergic to X". The customer detail screen now lets you edit a note's text, pin important notes to the top, and archive notes that no longer apply (and restore them). Each action is limited to notes that belong to the customer being viewed. **Added:** *Edit, pin, and archive customer notes* — The notes panel on a customer's detail screen now supports the full lifecycle: edit a note's text to fix or update it, pin the notes that matter so they sort to the top, and archive notes that no longer apply, with a toggle to show archived notes and restore them. Previously notes were append-only, so a wrong or stale note could not be corrected or retired. Every edit, pin, and archive action is scoped to the customer being viewed, so a note can only be changed from the record it belongs to.
 
 - v0.3.33 (2026-05-31) — **Create and manage customer segments from the admin console.** Customer segments could be shown on a customer's profile but there was no way to define or manage them, so the feature could not actually be used. A new Segments screen in the admin console creates rule-based segments from recency, frequency, lifetime-order, spend, average-order-value, and refund-rate criteria, edits their rules, archives and restores them, and recomputes membership on demand — showing how many customers each segment now contains. Segment membership stays rule-derived: it is recalculated from order history, not assigned by hand. **Added:** *Customer segments administration* — A Segments screen in the admin console manages rule-based customer segments. Each segment is defined by RFM-style criteria — how recently and how often a customer orders, their lifetime order count and spend, average order value, and refund rate — and a list shows every segment with its rules, current member count, and status, filterable by active or archived. You can create and edit segments, archive and restore them, and recompute membership on demand, which re-evaluates the rules against order history and reports how many customers match. Membership is always derived from the rules, never assigned per customer.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.34",
+  "version": "0.3.35",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/storefront.js

@@ -2488,6 +2488,12 @@ function renderWishlist(opts) {
   var notice = okMsg
     ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(okMsg) + "</p>"
     : "";
+  // The owner's share panel — a "Share this wishlist" control plus the
+  // list of active share links each with a Revoke action. The route
+  // builds the panel HTML (it owns the share-link reads); absent it (the
+  // sharing primitive isn't wired, or a unit test calling the renderer
+  // directly) the panel is empty so the page renders unchanged.
+  var sharePanel = opts.share_panel || "";
   var body =
     "<section class=\"account-wishlist\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -2496,6 +2502,7 @@ function renderWishlist(opts) {
       "</ol></nav>" +
       "<h1 class=\"account-wishlist__title\">Saved items</h1>" +
       notice +
+      sharePanel +
       inner +
     "</section>";
   return _wrap({
@@ -2507,6 +2514,136 @@ function renderWishlist(opts) {
   });
 }
 
+// The owner-side wishlist share panel (mounts on /account/wishlist). It
+// renders a "Create a share link" control plus the owner's active share
+// links, each with a status + view count and a Revoke form. `opts.shares`
+// is the owner's links from `listSharesForOwner` (already scoped to the
+// session customer by the route). A revoked / expired link still appears
+// (greyed, no Revoke) so the owner sees the history; only an active link
+// carries a Revoke control.
+//
+// The plaintext share token is surfaced EXACTLY ONCE — at create time, via
+// `opts.fresh_url` (the full public URL of the just-minted link). The list
+// rows never carry the URL because the token isn't persisted; the owner
+// copies the link from this one-time confirmation. `opts.notice` surfaces a
+// created/revoked confirmation via role="status".
+var WISHLIST_SHARE_NOTICES = {
+  created: "Share link created. Copy it below — it's shown only once.",
+  revoked: "Share link revoked. The link no longer works.",
+};
+function _wishlistSharePanel(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var shares = opts.shares || [];
+  var nowTs = Date.now();
+  var rows = "";
+  for (var i = 0; i < shares.length; i += 1) {
+    var s = shares[i];
+    var revoked = s.revoked_at != null;
+    var expired = !revoked && s.expires_at != null && Number(s.expires_at) < nowTs;
+    var inactive = revoked || expired;
+    var statusLabel = revoked ? "Revoked" : (expired ? "Expired" : "Active");
+    var statusCls = revoked ? "wishlist-share__status--revoked"
+                  : (expired ? "wishlist-share__status--expired" : "wishlist-share__status--active");
+    var revokeForm = inactive
+      ? ""
+      : "<form class=\"wishlist-share__revoke\" method=\"post\" action=\"/wishlist/share/" + esc(s.id) + "/revoke\">" +
+          "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Revoke</button>" +
+        "</form>";
+    var viewN = Number(s.view_count) || 0;
+    rows +=
+      "<li class=\"wishlist-share" + (inactive ? " wishlist-share--inactive" : "") + "\">" +
+        "<div class=\"wishlist-share__head\">" +
+          "<span class=\"wishlist-share__status " + statusCls + "\">" + esc(statusLabel) + "</span>" +
+          "<span class=\"wishlist-share__views\">" + esc(String(viewN)) + " view" + (viewN === 1 ? "" : "s") + "</span>" +
+        "</div>" +
+        revokeForm +
+      "</li>";
+  }
+  var list = rows ? "<ul class=\"wishlist-share__list\">" + rows + "</ul>" : "";
+  var noticeMsg = WISHLIST_SHARE_NOTICES[opts.notice];
+  var notice = noticeMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(noticeMsg) + "</p>"
+    : "";
+  // The one-time URL block — present only on the create confirmation. A
+  // read-only text field the owner can copy; it never re-renders after the
+  // owner navigates away (the token isn't persisted).
+  var freshUrl = opts.fresh_url
+    ? "<div class=\"wishlist-share__fresh\">" +
+        "<label class=\"wishlist-share__fresh-label\" for=\"wishlist-share-url\">Your share link</label>" +
+        "<input id=\"wishlist-share-url\" class=\"wishlist-share__url\" type=\"text\" readonly value=\"" + esc(opts.fresh_url) + "\" " +
+          "aria-label=\"Shareable wishlist link\" onfocus=\"this.select()\">" +
+      "</div>"
+    : "";
+  return "<section class=\"wishlist-share-panel\" aria-labelledby=\"wishlist-share-heading\">" +
+           "<h2 id=\"wishlist-share-heading\" class=\"wishlist-share-panel__title\">Share this wishlist</h2>" +
+           "<p class=\"wishlist-share-panel__lede\">Create a link so friends and family can see what you're hoping for. The link shows your saved products only — it never reveals your account.</p>" +
+           notice +
+           freshUrl +
+           "<form class=\"wishlist-share-panel__create\" method=\"post\" action=\"/wishlist/share\">" +
+             "<button type=\"submit\" class=\"btn-secondary\">Create a share link</button>" +
+           "</form>" +
+           list +
+         "</section>";
+}
+
+// Public, no-auth shared-wishlist page (`GET /wishlist/shared/:token`). It
+// renders ONLY the shared product cards (title, image, link to each PDP) —
+// the owner's identity, the per-entry private notes, and the owner customer
+// id are NEVER emitted, mirroring what the primitive's `viewShared` is
+// trusted to surface to a giver. `opts.entries` is the `viewShared` entry
+// list resolved to products; `opts.title` is the share's display title.
+// Carries a noindex robots directive — a personal shared wishlist is not a
+// page search engines should index. An unknown / revoked / expired token
+// never reaches this renderer (the route 404s first via renderNotFound).
+function renderSharedWishlist(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var items = opts.items || [];
+  var prefix = opts.asset_prefix || "/assets/";
+  var heading = (opts.title && String(opts.title).length) ? opts.title : "A shared wishlist";
+  var rowsHtml = "";
+  for (var i = 0; i < items.length; i += 1) {
+    var it = items[i];
+    if (!it.product) continue;   // archived/deleted product → drop the card (no owner data to leak)
+    var slug = esc(it.product.slug);
+    var thumb = it.hero_media
+      ? "<img src=\"" + esc(prefix + it.hero_media.r2_key) + "\" alt=\"" + esc(it.hero_media.alt_text || it.product.title) + "\" loading=\"lazy\">"
+      : "<span class=\"wishlist-item__mark\" aria-hidden=\"true\">" + esc((it.product.title || "?").trim().charAt(0).toUpperCase() || "?") + "</span>";
+    rowsHtml +=
+      "<li class=\"wishlist-item\">" +
+        "<a class=\"wishlist-item__media\" href=\"/products/" + slug + "\">" + thumb + "</a>" +
+        "<div class=\"wishlist-item__body\">" +
+          "<a class=\"wishlist-item__title\" href=\"/products/" + slug + "\">" + esc(it.product.title) + "</a>" +
+          "<a class=\"wishlist-item__view card-link\" href=\"/products/" + slug + "\">View product →</a>" +
+        "</div>" +
+      "</li>";
+  }
+  var inner = rowsHtml
+    ? "<ul class=\"wishlist-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__lede\">This wishlist is empty right now — nothing's been saved yet.</p>" +
+        "<a class=\"btn-secondary\" href=\"/\">Browse the shop →</a>" +
+      "</div>";
+  var body =
+    "<section class=\"account-wishlist\">" +
+      "<p class=\"eyebrow\">Shared with you</p>" +
+      "<h1 class=\"account-wishlist__title\">" + esc(heading) + "</h1>" +
+      inner +
+    "</section>";
+  return _wrap({
+    title:      heading,
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    // A personal shared wishlist is not search-index material — keep it
+    // out of the index. `noindex` maps to noindex,nofollow in _wrap; the
+    // page needs no canonical (a crawler won't index it to dedupe).
+    robots:     "noindex",
+    body:       body,
+  });
+}
+
 // Compare page notice banner — surfaced after a toggle / a full-basket
 // refusal. The route passes a short message key; unknown keys render
 // nothing so a forged `?notice=` query can't inject arbitrary copy.
@@ -10695,13 +10832,221 @@ function mount(router, deps) {
         }
         var cartCount = await _cartCountForReq(req);
         var wlUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        // Owner share panel — only when the sharing primitive is wired.
+        // The share-link list read is SCOPED to the session customer's id,
+        // so the owner only ever sees their own links. A reads failure
+        // (missing table on a fresh deploy) degrades to no panel rather
+        // than 500-ing the page.
+        var sharePanel = "";
+        if (deps.wishlistSharing) {
+          // Scoped to the session customer — the panel read keys on the
+          // signed-in customer's id, so the owner only ever sees their own
+          // links (this list surface carries no path id, so no IDOR).
+          var sessionOwnerId = auth.customer_id;
+          var ownShares = [];
+          try { ownShares = await deps.wishlistSharing.listSharesForOwner(sessionOwnerId); }
+          catch (_e) { ownShares = []; }
+          sharePanel = _wishlistSharePanel({
+            shares: ownShares,
+            notice: wlUrl ? wlUrl.searchParams.get("share") : null,
+          });
+        }
         _send(res, 200, renderWishlist({
           items:        items,
           notice:       wlUrl ? wlUrl.searchParams.get("ok") : null,
+          share_panel:  sharePanel,
+          shop_name:    shopName,
+          cart_count:   cartCount,
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
+      });
+    }
+
+    // ---- wishlist sharing -----------------------------------------------
+    //
+    // Owner-scoped share links on the customer's own wishlist, plus the
+    // public, no-auth shared view a giver opens. Mounts only when the
+    // sharing primitive is wired (it composes the wishlist primitive, so a
+    // store with sharing also has the solo wishlist above).
+    //
+    // Owner side (gated on the session customer, CSRF-protected by the
+    // container form chokepoint): create a share link, see active links,
+    // revoke a link. Every owner action is scoped to the session customer —
+    // the create keys on the signed-in customer's id; the revoke loads the
+    // session customer's links by their id and refuses a link that isn't
+    // the session customer's (clean 404, no IDOR).
+    //
+    // Public side (NO auth): `GET /wishlist/shared/:token` resolves the
+    // wishlist ONLY through `viewShared(token)` — never by a guessable
+    // wishlist/customer id — renders the saved products (redacting the
+    // owner's identity + private notes), records the view, and 404s an
+    // unknown / revoked / expired token. noindex (a personal wishlist isn't
+    // index material).
+    if (deps.wishlistSharing) {
+      // Build the owner's share panel from links scoped to the session
+      // customer. `opts.fresh_url` (the one-time URL of a just-created link)
+      // and `opts.notice` (created / revoked) thread through to the panel.
+      // A reads failure (missing table on a fresh deploy) degrades to a
+      // panel with no list rather than throwing.
+      async function _buildSharePanel(customerId, opts) {
+        opts = opts || {};
+        var shareRows = [];
+        try { shareRows = await deps.wishlistSharing.listSharesForOwner(customerId); }
+        catch (_e) { shareRows = []; }
+        return _wishlistSharePanel({
+          shares:    shareRows,
+          notice:    opts.notice || null,
+          fresh_url: opts.fresh_url || null,
+        });
+      }
+
+      // Re-render the /account/wishlist page (used by the create POST so the
+      // one-time share URL is shown inline, and on a revoke). Resolves the
+      // same saved-items list the GET route renders.
+      async function _renderWishlistWithPanel(req, res, customerId, panelOpts) {
+        var page = await deps.wishlist.listForCustomer(customerId, { limit: 50 });
+        var items = [];
+        for (var i = 0; i < page.rows.length; i += 1) {
+          var entry = page.rows[i];
+          var product = null;
+          try { product = await deps.catalog.products.get(entry.product_id); } catch (_e) { product = null; }
+          if (!product) { items.push({ product: null, product_id: entry.product_id }); continue; }
+          var media = await deps.catalog.media.listForProduct(product.id);
+          items.push({ product: product, hero_media: media.length ? media[0] : null });
+        }
+        var cartCount = await _cartCountForReq(req);
+        var panel = await _buildSharePanel(customerId, panelOpts || {});
+        _send(res, 200, renderWishlist({
+          items:        items,
+          share_panel:  panel,
           shop_name:    shopName,
           cart_count:   cartCount,
           asset_prefix: deps.asset_prefix || "/assets/",
         }));
+      }
+
+      // POST /wishlist/share — mint a share link for the SESSION customer's
+      // wishlist. The link is owner-scoped (keyed on `auth.customer_id`);
+      // the plaintext token is returned once and surfaced inline as the
+      // public URL the owner copies (never persisted). `unlisted` is the
+      // default privacy: link-bearer access, no friends-graph requirement,
+      // not advertised. The page re-renders directly (200) rather than a
+      // redirect so the one-time URL is shown.
+      router.post("/wishlist/share", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var created;
+        try {
+          created = await deps.wishlistSharing.createShareLink({
+            owner_customer_id: auth.customer_id,
+            privacy:           "unlisted",
+          });
+        } catch (e) {
+          res.status(e instanceof TypeError ? 400 : 500);
+          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        }
+        // The full public URL the giver opens. Built from this request's
+        // ORIGIN (scheme + host) so the one-time link is a correct absolute
+        // URL — this POST lands on /wishlist/share, so trimming a path off
+        // the canonical URL would mangle the link (and the token shows once).
+        var shareOrigin = "";
+        try { shareOrigin = new URL(_requestUrls(req).canonical_url).origin; }
+        catch (_e) { shareOrigin = ""; /* unparseable — fall back to a host-relative link */ }
+        var freshUrl = shareOrigin + "/wishlist/shared/" + encodeURIComponent(created.plaintext_token);
+        await _renderWishlistWithPanel(req, res, auth.customer_id, { notice: "created", fresh_url: freshUrl });
+      });
+
+      // POST /wishlist/share/:share_id/revoke — revoke one of the SESSION
+      // customer's share links. The primitive's revokeShareLink moves a link
+      // by id alone (no owner notion), so the route owns the ownership
+      // decision: it loads the session customer's own links and refuses a
+      // share_id that isn't among them (clean 404). Without that scope, any
+      // signed-in shopper could revoke another customer's link by guessing
+      // its id (IDOR).
+      router.post("/wishlist/share/:share_id/revoke", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var shareId = (req.params && req.params.share_id) || "";
+        // Ownership scope: the link must belong to the session customer.
+        var owned = [];
+        try { owned = await deps.wishlistSharing.listSharesForOwner(auth.customer_id); }
+        catch (_e) { owned = []; }
+        var match = null;
+        for (var i = 0; i < owned.length; i += 1) {
+          if (owned[i].id === shareId) { match = owned[i]; break; }
+        }
+        if (!match) {
+          // Unknown id, malformed id, or a link owned by someone else all
+          // resolve the same way — a clean 404, no act, no leak.
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        try {
+          await deps.wishlistSharing.revokeShareLink({ link_id: shareId, reason: "owner revoked from account" });
+        } catch (e) {
+          res.status(e instanceof TypeError ? 400 : 500);
+          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        }
+        res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?share=revoked");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // GET /wishlist/shared/:token — the public, no-auth shared view. The
+      // wishlist is resolved ONLY via viewShared(token); a giver with the
+      // link sees the saved products (with the owner identity + private
+      // notes redacted — the renderer emits product cards only). An unknown
+      // / revoked / expired token 404s exactly like an unknown route. The
+      // view is recorded best-effort (analytics for the owner) and never
+      // blocks the render. noindex.
+      router.get("/wishlist/shared/:token", async function (req, res) {
+        var token = (req.params && req.params.token) || "";
+        var view = null;
+        try {
+          view = await deps.wishlistSharing.viewShared({ token: token });
+        } catch (_e) {
+          // A malformed token (TypeError) and a not-found / revoked / expired
+          // token (coded errors) all render the same 404 — no oracle on why.
+          return _send(res, 404, renderNotFound({ shop_name: shopName, cart_count: await _cartCountForReq(req) }));
+        }
+        // Record the open for the owner's view counter. Best-effort: a
+        // record failure never breaks the giver's page.
+        try { await deps.wishlistSharing.recordView({ token: token }); }
+        catch (_e) { /* drop-silent — analytics, not the render path */ }
+        // Resolve each shared entry to its product + hero image. The entry's
+        // owner customer_id + private notes are NOT carried into the view
+        // (the renderer emits product cards only) so the giver never sees
+        // the owner's identity.
+        var items = [];
+        var entries = (view && view.entries) || [];
+        for (var i = 0; i < entries.length; i += 1) {
+          var product = null;
+          try { product = await deps.catalog.products.get(entries[i].product_id); } catch (_e) { product = null; }
+          if (!product) continue;
+          var media = await deps.catalog.media.listForProduct(product.id);
+          items.push({ product: product, hero_media: media.length ? media[0] : null });
+        }
+        _send(res, 200, renderSharedWishlist({
+          items:        items,
+          title:        (view && view.share && view.share.title) || "A shared wishlist",
+          shop_name:    shopName,
+          cart_count:   await _cartCountForReq(req),
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
       });
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.34",
+  "version": "0.3.35",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {