npm - @blamejs/blamejs-shop - Versions diffs - 0.3.54 → 0.3.56 - Mend

@blamejs/blamejs-shop 0.3.54 → 0.3.56

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/lib/asset-manifest.json CHANGED Viewed

@@ -1,13 +1,13 @@
 {
-  "version": "0.3.54",
+  "version": "0.3.56",
   "assets": {
     "css/admin.css": {
-      "integrity": "sha384-/NizdENQkTc96romD0kmnl8220NAvW32QI0aSFuGiPbWE5lYbRxLXU5shsjlx5Ek",
-      "fingerprinted": "css/admin.f028b2e410387546.css"
+      "integrity": "sha384-6k53cvkRrxMgmeStLIoLjVXZQHqIJgTmv1Izd8TYhh1HOC4POgE6GCvx1bsalyEP",
+      "fingerprinted": "css/admin.44eb97700c660798.css"
     },
     "css/main.css": {
-      "integrity": "sha384-9rtEz2wKJbpfALccIipRdo/BWVQZi5O4IufqaLO/7jFyLK1xxCaDc/65Apjy8dbs",
-      "fingerprinted": "css/main.1a1a379d6f58e2c0.css"
+      "integrity": "sha384-2nlE5YDlOjcnP/l1EY5kcYwvbV/TboHx+Hi6fAaDNyaau3nzQppJnNyXoLiFE8w1",
+      "fingerprinted": "css/main.59afbe779336867a.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/email.js CHANGED Viewed

@@ -187,6 +187,75 @@ var ABANDONED_CART_TEXT_AFTER_LINES =
   "{{notes}}\n\n" +
   "Return to cart: {{cart_url}}\n";
+// Wishlist digest — the periodic rollup of the customer's saved items
+// (price + in/out-of-stock marker per line). The line set is rendered
+// through the strict renderer once per line so each line's `title` /
+// `price` / `stock` is HTML-escaped independently, then concatenated
+// between the BEFORE/AFTER halves. The structured `lines[]` from
+// composeDigest is the source — the pre-built `digest.html` is NEVER
+// spliced in (that would double-handle escaping); rendering from the
+// structured array keeps the escape-by-default path owning escaping
+// end-to-end (the <script>-in-title XSS guard).
+var WISHLIST_DIGEST_HTML_BEFORE_LINES =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Your wishlist update</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">Your wishlist this period</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\">Here's where your saved items stand right now:</p>\n" +
+  "  <ul style=\"padding-left:20px;margin:0 0 16px;color:#0d0d0d;\">\n";
+var WISHLIST_DIGEST_HTML_LINE =
+  "    <li><a href=\"{{product_url}}\" style=\"color:#fa4f09;\">{{title}}</a> — {{price}}{{stock}}</li>\n";
+var WISHLIST_DIGEST_HTML_EMPTY =
+  "    <li>No items in your wishlist right now.</li>\n";
+var WISHLIST_DIGEST_HTML_AFTER_LINES =
+  "  </ul>\n" +
+  "  <p style=\"margin:16px 0;color:#0d0d0d;font-size:13px;\">You're receiving this because you opted into the wishlist digest.</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+var WISHLIST_DIGEST_TEXT_BEFORE_LINES =
+  "Your wishlist this period\n=========================\n\n" +
+  "Here's where your saved items stand right now:\n\n";
+var WISHLIST_DIGEST_TEXT_LINE =
+  "  {{title}} — {{price}}{{stock}}\n  {{product_url}}\n";
+var WISHLIST_DIGEST_TEXT_EMPTY =
+  "  No items in your wishlist right now.\n";
+var WISHLIST_DIGEST_TEXT_AFTER_LINES =
+  "\nYou're receiving this because you opted into the wishlist digest.\n";
+// Magic-link sign-in — a single-use, time-limited link a customer
+// follows to sign in without a passkey or password. The `link_url`
+// carries the plaintext portal token; it's HTML-escaped through the
+// strict renderer like every other value (the URL is built server-side
+// but escape-by-default still applies).
+var MAGIC_LINK_HTML =
+  "<!DOCTYPE html>\n" +
+  "<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Your sign-in link</title></head>" +
+  "<body style=\"margin:0;background:#ffffff;color:#0d0d0d;font-family:system-ui,sans-serif;\">\n" +
+  "<div style=\"max-width:560px;margin:0 auto;padding:24px;\">\n" +
+  "  <h1 style=\"color:#0d0d0d;margin:0 0 12px;\">Sign in to your account</h1>\n" +
+  "  <p style=\"margin:0 0 16px;\">Use the button below to sign in. This link works once and expires shortly.</p>\n" +
+  "  <p style=\"margin:24px 0;\"><a href=\"{{link_url}}\" style=\"background:#fa4f09;color:#ffffff;padding:12px 20px;text-decoration:none;display:inline-block;font-weight:bold;\">Sign in</a></p>\n" +
+  "  <p style=\"margin:0;color:#0d0d0d;font-size:13px;\">If the button doesn't work, paste this link into your browser: {{link_url}}</p>\n" +
+  "  <p style=\"margin:16px 0 0;color:#0d0d0d;font-size:13px;\">If you didn't request this, you can ignore this email — no one can sign in without the link.</p>\n" +
+  "</div>\n" +
+  "</body></html>\n";
+var MAGIC_LINK_TEXT =
+  "Sign in to your account\n\n" +
+  "Use this single-use link to sign in (it expires shortly):\n" +
+  "{{link_url}}\n\n" +
+  "If you didn't request this, you can ignore this email.\n";
 // Review request — sent ~7 days after ship. Per-product review
 // links use the same before/lines/after split as the abandoned
 // cart so the strict renderer keeps its escape-everything property.
@@ -443,6 +512,96 @@ function create(opts) {
       );
     },
+    // Wishlist digest — the periodic rollup of the customer's saved
+    // items. The caller (the wishlistDigest dispatcher) passes the
+    // structured `lines[]` composeDigest built; this renders each line
+    // through the strict renderer once so every `title` / `price` is
+    // HTML-escaped independently, then concatenates between the
+    // BEFORE/AFTER halves. The pre-built `digest.html` / `digest.text`
+    // are accepted by the caller's shape but NEVER spliced in raw —
+    // rendering from the structured array keeps the escape-by-default
+    // path owning escaping end-to-end (the <script>-in-title XSS guard).
+    // `lines` MAY be empty (the "no items" digest); validation is
+    // entry-point tier (throw TypeError so the cron caller's try/catch
+    // drops the row silently).
+    sendWishlistDigest: async function (input) {
+      if (!input) throw new TypeError("email.sendWishlistDigest: input object required");
+      if (typeof input.customer_email !== "string" || !input.customer_email) {
+        throw new TypeError("email.sendWishlistDigest: customer_email required");
+      }
+      if (!Array.isArray(input.lines)) {
+        throw new TypeError("email.sendWishlistDigest: lines array required (may be empty)");
+      }
+      var i;
+      for (i = 0; i < input.lines.length; i += 1) {
+        var ln = input.lines[i];
+        if (!ln || typeof ln !== "object") {
+          throw new TypeError("email.sendWishlistDigest: lines[" + i + "] must be an object");
+        }
+        if (typeof ln.title !== "string" || !ln.title) {
+          throw new TypeError("email.sendWishlistDigest: lines[" + i + "].title required");
+        }
+      }
+      var htmlLines = "";
+      var textLines = "";
+      if (input.lines.length === 0) {
+        htmlLines = WISHLIST_DIGEST_HTML_EMPTY;
+        textLines = WISHLIST_DIGEST_TEXT_EMPTY;
+      } else {
+        for (i = 0; i < input.lines.length; i += 1) {
+          var line = input.lines[i];
+          // The in/out-of-stock marker is derived here (not trusted from
+          // the caller as raw HTML) so it rides the strict renderer like
+          // every other field.
+          var stockMarker = line.in_stock === true  ? " (in stock)"
+                          : line.in_stock === false ? " (out of stock)"
+                          :                            "";
+          var lineVars = {
+            title:       line.title,
+            price:       line.price == null ? "—" : String(line.price),
+            stock:       stockMarker,
+            product_url: typeof line.product_url === "string" && line.product_url
+              ? line.product_url
+              : "#",
+          };
+          htmlLines += _render(WISHLIST_DIGEST_HTML_LINE, lineVars);
+          textLines += _render(WISHLIST_DIGEST_TEXT_LINE, lineVars);
+        }
+      }
+      var html =
+        WISHLIST_DIGEST_HTML_BEFORE_LINES +
+        htmlLines +
+        WISHLIST_DIGEST_HTML_AFTER_LINES;
+      var text =
+        WISHLIST_DIGEST_TEXT_BEFORE_LINES +
+        textLines +
+        WISHLIST_DIGEST_TEXT_AFTER_LINES;
+      return await _send(
+        input.customer_email,
+        "Your wishlist update",
+        html, text, input.replyTo
+      );
+    },
+    // Magic-link sign-in — emails a single-use portal link. The
+    // `link_url` carries the plaintext token; it's escaped through the
+    // strict renderer like every other value. Entry-point tier: throw
+    // TypeError on a bad shape so the caller's try/catch keeps the
+    // surface enumeration-safe (the generic confirmation shows either way).
+    sendMagicLink: async function (input) {
+      if (!input) throw new TypeError("email.sendMagicLink: input object required");
+      if (typeof input.customer_email !== "string" || !input.customer_email) {
+        throw new TypeError("email.sendMagicLink: customer_email required");
+      }
+      if (typeof input.link_url !== "string" || !input.link_url) {
+        throw new TypeError("email.sendMagicLink: link_url required");
+      }
+      var vars = { link_url: input.link_url };
+      var html = _render(MAGIC_LINK_HTML, vars);
+      var text = _render(MAGIC_LINK_TEXT, vars);
+      return await _send(input.customer_email, "Your sign-in link", html, text, input.replyTo);
+    },
     // Review request — sent ~7 days after ship. Per-product review
     // links are derived from review_base_url + "/" + slug + "/review",
     // then HTML-escaped through the strict renderer with the rest of
@@ -575,6 +734,16 @@ module.exports = {
     ABANDONED_CART_TEXT_BEFORE_LINES: ABANDONED_CART_TEXT_BEFORE_LINES,
     ABANDONED_CART_TEXT_LINE:         ABANDONED_CART_TEXT_LINE,
     ABANDONED_CART_TEXT_AFTER_LINES:  ABANDONED_CART_TEXT_AFTER_LINES,
+    WISHLIST_DIGEST_HTML_BEFORE_LINES: WISHLIST_DIGEST_HTML_BEFORE_LINES,
+    WISHLIST_DIGEST_HTML_LINE:         WISHLIST_DIGEST_HTML_LINE,
+    WISHLIST_DIGEST_HTML_EMPTY:        WISHLIST_DIGEST_HTML_EMPTY,
+    WISHLIST_DIGEST_HTML_AFTER_LINES:  WISHLIST_DIGEST_HTML_AFTER_LINES,
+    WISHLIST_DIGEST_TEXT_BEFORE_LINES: WISHLIST_DIGEST_TEXT_BEFORE_LINES,
+    WISHLIST_DIGEST_TEXT_LINE:         WISHLIST_DIGEST_TEXT_LINE,
+    WISHLIST_DIGEST_TEXT_EMPTY:        WISHLIST_DIGEST_TEXT_EMPTY,
+    WISHLIST_DIGEST_TEXT_AFTER_LINES:  WISHLIST_DIGEST_TEXT_AFTER_LINES,
+    MAGIC_LINK_HTML:                  MAGIC_LINK_HTML,
+    MAGIC_LINK_TEXT:                  MAGIC_LINK_TEXT,
     REVIEW_REQUEST_HTML_BEFORE_LINES: REVIEW_REQUEST_HTML_BEFORE_LINES,
     REVIEW_REQUEST_HTML_LINE:         REVIEW_REQUEST_HTML_LINE,
     REVIEW_REQUEST_HTML_AFTER_LINES:  REVIEW_REQUEST_HTML_AFTER_LINES,