@blamejs/blamejs-shop 0.3.52 → 0.3.54

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.52",
+  "version": "0.3.54",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",
@@ -44,6 +44,10 @@
     "js/paypal-checkout.js": {
       "integrity": "sha384-LI6y/1z0Y9F8Kx8RhW4EwY2WqJPXLwJozCXqnhDT+dTckLHyvhly0SsRpH0bsdui",
       "fingerprinted": "js/paypal-checkout.b05ab5572cc3728f.js"
+    },
+    "js/saved-card.js": {
+      "integrity": "sha384-Kaj6n+Any4rwCH2lyREHoq30MrAZtEd/fTa+tDnIrMJ4zO01YWRhW5TTujcYyuVn",
+      "fingerprinted": "js/saved-card.d7fd750d746dbe4d.js"
     }
   }
 }

package/lib/click-and-collect.js

@@ -631,6 +631,21 @@ function create(opts) {
       return row;
     },
 
+    // Soft-delete a location: clears `active` and stamps `archived_at` so
+    // `availableLocations` filters it out while past pickup schedules still
+    // resolve the FK. Re-defining the same code via definePickupLocation
+    // clears `archived_at` (resurrects it). Returns the updated row, or null
+    // when the code matched no location (the route maps null → 404).
+    archiveLocation: async function (code) {
+      _code(code, "code");
+      var now = _now();
+      await query(
+        "UPDATE pickup_locations SET active = 0, archived_at = ?1, updated_at = ?1 WHERE code = ?2",
+        [now, code],
+      );
+      return await this.getLocation(code);
+    },
+
     // Read a hydrated schedule for an order. Returns null on miss.
     getScheduleByOrder: async function (orderId) {
       var id = _orderId(orderId);
@@ -678,18 +693,33 @@ function create(opts) {
         throw new TypeError("click-and-collect.customerSchedules: opts.order must be wired for " +
           "this read (the customer→order linkage lives on the order primitive)");
       }
-      var orderPage = await orderPrim.listForCustomer(id, { limit: MAX_LIST_LIMIT });
-      var orders = (orderPage && orderPage.rows) || [];
-      if (!orders.length) return [];
+      // Page through the customer's orders via the cursor. The order
+      // primitive caps a single page below MAX_LIST_LIMIT, so a single
+      // `limit: MAX_LIST_LIMIT` call would throw — request a conservative
+      // per-page size and walk pages until exhausted OR we've gathered
+      // MAX_LIST_LIMIT order ids (which bounds the IN-list below). A customer
+      // with more orders than that sees their most-recent MAX_LIST_LIMIT
+      // orders' pickups, which matches the order-list page model.
+      var orderIds = [];
+      var cursor = null;
+      do {
+        var orderPage = await orderPrim.listForCustomer(id, { limit: 100, cursor: cursor || undefined });
+        var rows0 = (orderPage && orderPage.rows) || [];
+        for (var oi = 0; oi < rows0.length && orderIds.length < MAX_LIST_LIMIT; oi += 1) {
+          orderIds.push(rows0[oi].id);
+        }
+        cursor = orderPage && orderPage.next_cursor;
+      } while (cursor && orderIds.length < MAX_LIST_LIMIT);
+      if (!orderIds.length) return [];
       // SQL IN-list construction — every value is a UUID that came
       // out of the order primitive (which itself validates UUIDs at
       // write time), so the placeholder fan-out is safe. We still
       // pass them as bound params rather than interpolating.
       var placeholders = [];
       var params = [];
-      for (var i = 0; i < orders.length; i += 1) {
+      for (var i = 0; i < orderIds.length; i += 1) {
         placeholders.push("?" + (i + 1));
-        params.push(orders[i].id);
+        params.push(orderIds[i]);
       }
       var sql = "SELECT * FROM pickup_schedules WHERE order_id IN (" +
                 placeholders.join(", ") + ") ORDER BY scheduled_window_start DESC, id DESC";

package/lib/email.js

@@ -220,6 +220,49 @@ var REVIEW_REQUEST_TEXT_LINE =
 var REVIEW_REQUEST_TEXT_AFTER_LINES =
   "\nEach link takes about a minute. Thank you.\n";
 
+// Back-in-stock — double-opt-in confirmation + the fired notification.
+// Both auto-escape every field through the strict `{{var}}` renderer
+// (product_title / sku are catalog data; escape anyway).
+
+var STOCK_ALERT_CONFIRM_HTML =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Confirm your back-in-stock alert</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">Confirm your back-in-stock alert</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\">You asked to be emailed when <strong>{{product_title}}</strong> (SKU {{sku}}) is back in stock. Confirm below and we'll email you once, the moment it returns.</p>\n" +
+  "  <p style=\"margin:24px 0;\"><a href=\"{{confirm_url}}\" style=\"background:#fa4f09;color:#ffffff;padding:12px 20px;text-decoration:none;display:inline-block;font-weight:bold;\">Confirm my alert</a></p>\n" +
+  "  <p style=\"margin:0;color:#0d0d0d;font-size:13px;\">If you didn't request this, ignore this email — no alert is set until you confirm. Link: {{confirm_url}}</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+
+var STOCK_ALERT_CONFIRM_TEXT =
+  "Confirm your back-in-stock alert\n\n" +
+  "You asked to be emailed when {{product_title}} (SKU {{sku}}) is back in stock.\n" +
+  "Confirm to set the alert — we'll email you once, the moment it returns.\n\n" +
+  "Confirm: {{confirm_url}}\n\n" +
+  "If you didn't request this, ignore this email — no alert is set until you confirm.\n";
+
+var BACK_IN_STOCK_HTML =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Back in stock: {{product_title}}</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">It's back in stock</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\"><strong>{{product_title}}</strong> (SKU {{sku}}) is available again. Stock can move fast — grab it while it's here.</p>\n" +
+  "  <p style=\"margin:24px 0;\"><a href=\"{{product_url}}\" style=\"background:#fa4f09;color:#ffffff;padding:12px 20px;text-decoration:none;display:inline-block;font-weight:bold;\">View the product</a></p>\n" +
+  "  <p style=\"margin:0;color:#0d0d0d;font-size:13px;\">Link: {{product_url}}</p>\n" +
+  "  <p style=\"margin:16px 0 0;color:#0d0d0d;font-size:13px;\">Don't want these alerts? Unsubscribe: {{unsubscribe_url}}</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+
+var BACK_IN_STOCK_TEXT =
+  "It's back in stock\n\n" +
+  "{{product_title}} (SKU {{sku}}) is available again.\n" +
+  "Stock can move fast — grab it while it's here.\n\n" +
+  "View the product: {{product_url}}\n\n" +
+  "Don't want these alerts? Unsubscribe: {{unsubscribe_url}}\n";
+
 // ---- factory ------------------------------------------------------------
 
 function _email(s) {
@@ -460,6 +503,53 @@ function create(opts) {
         html, text, input.replyTo
       );
     },
+
+    // Back-in-stock double-opt-in confirmation. `confirm_url` is built by
+    // the route from SHOP_ORIGIN + the plaintext token returned once by
+    // stockAlerts.subscribe. product_title / sku are catalog data; the
+    // strict renderer escapes every field anyway (escape-by-default).
+    sendStockAlertConfirmation: async function (input) {
+      if (!input) throw new TypeError("email.sendStockAlertConfirmation: input object required");
+      if (typeof input.to !== "string" || !input.to) {
+        throw new TypeError("email.sendStockAlertConfirmation: to required");
+      }
+      if (typeof input.confirm_url !== "string" || !input.confirm_url) {
+        throw new TypeError("email.sendStockAlertConfirmation: confirm_url required");
+      }
+      var vars = {
+        product_title: input.product_title == null ? input.sku || "this item" : String(input.product_title),
+        sku:           input.sku == null ? "—" : String(input.sku),
+        confirm_url:   input.confirm_url,
+      };
+      var html = _render(STOCK_ALERT_CONFIRM_HTML, vars);
+      var text = _render(STOCK_ALERT_CONFIRM_TEXT, vars);
+      return await _send(input.to, "Confirm your back-in-stock alert", html, text, input.replyTo);
+    },
+
+    // Back-in-stock fired notification. Subject is built from the same
+    // already-escaped var path as the body (the subject string itself is
+    // never HTML — it carries the raw title; the mailer transport escapes
+    // header-injection, and the body is rendered through the strict
+    // escaping renderer).
+    sendBackInStock: async function (input) {
+      if (!input) throw new TypeError("email.sendBackInStock: input object required");
+      if (typeof input.to !== "string" || !input.to) {
+        throw new TypeError("email.sendBackInStock: to required");
+      }
+      if (typeof input.product_url !== "string" || !input.product_url) {
+        throw new TypeError("email.sendBackInStock: product_url required");
+      }
+      var title = input.product_title == null ? (input.sku || "this item") : String(input.product_title);
+      var vars = {
+        product_title:   title,
+        sku:             input.sku == null ? "—" : String(input.sku),
+        product_url:     input.product_url,
+        unsubscribe_url: input.unsubscribe_url == null ? "" : String(input.unsubscribe_url),
+      };
+      var html = _render(BACK_IN_STOCK_HTML, vars);
+      var text = _render(BACK_IN_STOCK_TEXT, vars);
+      return await _send(input.to, "Back in stock: " + title, html, text, input.replyTo);
+    },
   };
 }
 
@@ -491,5 +581,9 @@ module.exports = {
     REVIEW_REQUEST_TEXT_BEFORE_LINES: REVIEW_REQUEST_TEXT_BEFORE_LINES,
     REVIEW_REQUEST_TEXT_LINE:         REVIEW_REQUEST_TEXT_LINE,
     REVIEW_REQUEST_TEXT_AFTER_LINES:  REVIEW_REQUEST_TEXT_AFTER_LINES,
+    STOCK_ALERT_CONFIRM_HTML:         STOCK_ALERT_CONFIRM_HTML,
+    STOCK_ALERT_CONFIRM_TEXT:         STOCK_ALERT_CONFIRM_TEXT,
+    BACK_IN_STOCK_HTML:               BACK_IN_STOCK_HTML,
+    BACK_IN_STOCK_TEXT:               BACK_IN_STOCK_TEXT,
   },
 };

package/lib/payment.js

@@ -43,6 +43,8 @@ var IDEMPOTENT_OPERATIONS    = {
   "subscription.create":   true,
   "subscription.update":   true,
   "subscription.cancel":   true,
+  "customer.create":       true,
+  "setup_intent.create":   true,
   // PayPal adapter mutating operations (Orders v2).
   "paypal_order.create":   true,
   "paypal_capture.create": true,
@@ -348,6 +350,20 @@ function stripe(opts) {
       if (input.metadata) params.metadata  = input.metadata;
       if (input.description) params.description = input.description;
       if (input.receipt_email) params.receipt_email = input.receipt_email;
+      // Saved-card reuse: a stored payment_method drives an off-session
+      // (one-click) charge. Both are optional so the default Elements flow
+      // — no payment_method, automatic_payment_methods.enabled — is
+      // byte-identical. When a payment_method is supplied we confirm
+      // immediately (confirm:true) so the stored card is charged in the
+      // single create call rather than requiring a second client round trip.
+      if (input.payment_method) {
+        if (typeof input.payment_method !== "string" || !input.payment_method.length) {
+          throw new TypeError("payment.createPaymentIntent: payment_method must be a non-empty string");
+        }
+        params.payment_method = input.payment_method;
+        params.confirm = true;
+        if (input.off_session) params.off_session = true;
+      }
       return _maybeIdempotent("payment_intent.create", idempotencyKey, params, function () {
         return _stripeCall(opts, "POST", "/payment_intents", params, idempotencyKey);
       });
@@ -370,6 +386,67 @@ function stripe(opts) {
                           {}, idempotencyKey);
     },
 
+    // ---- Customer + SetupIntent (saved-card vaulting) ---------------------
+    //
+    // The card-on-file flow needs a Stripe Customer to attach the saved
+    // payment method to, plus a SetupIntent the browser confirms (off the
+    // Elements card form) to collect-without-charging. The shop persists
+    // only the resulting opaque `pm_…` token — never the PAN/CVV, which
+    // stay inside Stripe's PCI scope. `usage: "off_session"` so the saved
+    // card is reusable for a later one-click (off-session) charge.
+
+    // Create (or look up) a Stripe Customer for a shopper. `email` is the
+    // only field Stripe needs to dedupe; `metadata` carries the shop's own
+    // customer id so a Stripe-dashboard operator can correlate the two.
+    createCustomer: function (input, idempotencyKey) {
+      if (!input || typeof input !== "object") throw new TypeError("payment.createCustomer: input object required");
+      var params = {};
+      if (input.email != null) {
+        if (typeof input.email !== "string" || !input.email.length) {
+          throw new TypeError("payment.createCustomer: email must be a non-empty string when provided");
+        }
+        params.email = input.email;
+      }
+      if (input.name) params.name = input.name;
+      if (input.metadata) params.metadata = input.metadata;
+      return _maybeIdempotent("customer.create", idempotencyKey, params, function () {
+        return _stripeCall(opts, "POST", "/customers", params, idempotencyKey);
+      });
+    },
+
+    // Open a SetupIntent for the given Stripe Customer. The browser's
+    // Elements confirms it against the entered card; on success Stripe
+    // returns a `pm_…` the shop reads back via retrieveSetupIntent →
+    // retrievePaymentMethod and stores through paymentMethods.add.
+    createSetupIntent: function (input, idempotencyKey) {
+      if (!input || typeof input !== "object") throw new TypeError("payment.createSetupIntent: input object required");
+      _assertSecret(input.customer, "createSetupIntent.customer");
+      var params = {
+        customer: input.customer,
+        automatic_payment_methods: { enabled: true },
+        usage: "off_session",
+      };
+      if (input.metadata) params.metadata = input.metadata;
+      return _maybeIdempotent("setup_intent.create", idempotencyKey, params, function () {
+        return _stripeCall(opts, "POST", "/setup_intents", params, idempotencyKey);
+      });
+    },
+
+    // Read a SetupIntent back (after the browser confirmed it) to learn the
+    // resulting payment_method id. Read-only.
+    retrieveSetupIntent: function (id) {
+      _assertSecret(id, "setup_intent id");
+      return _stripeCall(opts, "GET", "/setup_intents/" + encodeURIComponent(id), null, null);
+    },
+
+    // Read a saved payment method's display fields (brand / last4 /
+    // exp_month / exp_year) so the shop can render "ending in 4242". The
+    // PAN/CVV are never in this payload. Read-only.
+    retrievePaymentMethod: function (id) {
+      _assertSecret(id, "payment_method id");
+      return _stripeCall(opts, "GET", "/payment_methods/" + encodeURIComponent(id), null, null);
+    },
+
     // Register a web domain so Stripe enables the wallet methods (Apple
     // Pay / Google Pay / Link / PayPal) for the Express Checkout Element
     // served from it. Stripe performs Apple merchant validation + hosts

package/lib/security-middleware.js

@@ -126,6 +126,15 @@ var EDGE_POST_PATHS = [
   // layer). Container-only — there's no edge copy to keep parity with.
   "/unsubscribe",
   "/announcements/",
+  // Back-in-stock "Notify me" — the subscribe form lives on the edge-cached,
+  // cookie-less PDP buy box (dual-rendered byte-identical with the worker
+  // twin), so it cannot carry a per-session `_csrf` token. A DISTINCT
+  // top-level action keeps `/products/` (which DOES require the token on its
+  // review + question POSTs) un-exempted. Keeps SameSite + fetch-metadata
+  // defense; the confirm/unsubscribe GETs need no CSRF. Kept in lockstep with
+  // the `edge-form-csrf-exempt` detector lookahead in
+  // test/layer-0-primitives/codebase-patterns.test.js.
+  "/stock-alert/subscribe",
 ];
 
 // The TLS-terminated public origin(s) the storefront is served on. Behind