@blamejs/blamejs-shop 0.3.55 → 0.3.57

package/lib/storefront.js

@@ -2805,6 +2805,11 @@ function renderWishlist(opts) {
   // sharing primitive isn't wired, or a unit test calling the renderer
   // directly) the panel is empty so the page renders unchanged.
   var sharePanel = opts.share_panel || "";
+  // Alert + digest opt-in panel (server-rendered, no client JS). The
+  // route builds it (it owns the per-trigger / per-schedule prefs reads);
+  // absent it (the alerts/digest primitives aren't wired, or a unit test
+  // calling the renderer directly) the panel is empty.
+  var prefsPanel = opts.prefs_panel || "";
   var body =
     "<section class=\"account-wishlist\">" +
       "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
@@ -2813,6 +2818,7 @@ function renderWishlist(opts) {
       "</ol></nav>" +
       "<h1 class=\"account-wishlist__title\">Saved items</h1>" +
       notice +
+      prefsPanel +
       sharePanel +
       inner +
     "</section>";
@@ -2898,6 +2904,81 @@ function _wishlistSharePanel(opts) {
          "</section>";
 }
 
+// The wishlist alert + digest opt-in panel (mounts on /account/wishlist
+// when the alerts / digest primitives are wired). Server-rendered, no
+// client JS: each toggle is a `<form method="post">` whose hidden `on`
+// field flips on submit (the submit button carries the new state). The
+// `_csrf` token is injected automatically by the `_wrap` form chokepoint
+// (_injectCsrfFields) like every other container POST form — the panel
+// emits no token itself.
+//
+//   opts.alerts   — [{ trigger, label, subscribed }] (subscribed drives
+//                   the button's on/off action)
+//   opts.digests  — [{ slug, label, enrolled, enrollment_id }]
+//   opts.notice   — "alerts" | "digest" → a saved confirmation
+//
+// Every operator-controlled string (a schedule slug used as a label) is
+// escaped via the storefront `esc()` path.
+var WISHLIST_PREFS_NOTICES = {
+  alerts: "Alert preferences saved.",
+  digest: "Digest subscription updated.",
+};
+function _wishlistPrefsPanel(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var alerts  = opts.alerts  || [];
+  var digests = opts.digests || [];
+  if (alerts.length === 0 && digests.length === 0) return "";
+  var noticeMsg = WISHLIST_PREFS_NOTICES[opts.notice];
+  var notice = noticeMsg
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">" + esc(noticeMsg) + "</p>"
+    : "";
+
+  var alertRows = "";
+  for (var i = 0; i < alerts.length; i += 1) {
+    var a = alerts[i];
+    var on = a.subscribed === true;
+    // Submitting flips the state: a subscribed trigger posts on="" (off);
+    // an unsubscribed one posts on="1".
+    alertRows +=
+      "<form class=\"wishlist-prefs__row\" method=\"post\" action=\"/account/wishlist/alerts\">" +
+        "<input type=\"hidden\" name=\"trigger\" value=\"" + esc(a.trigger) + "\">" +
+        "<input type=\"hidden\" name=\"on\" value=\"" + (on ? "" : "1") + "\">" +
+        "<span class=\"wishlist-prefs__label\">" + esc(a.label || a.trigger) + "</span>" +
+        "<span class=\"wishlist-prefs__state\">" + (on ? "On" : "Off") + "</span>" +
+        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">" + (on ? "Turn off" : "Turn on") + "</button>" +
+      "</form>";
+  }
+  var alertsBlock = alertRows
+    ? "<h3 class=\"wishlist-prefs__subhead\">Price-drop &amp; back-in-stock alerts</h3>" + alertRows
+    : "";
+
+  var digestRows = "";
+  for (var j = 0; j < digests.length; j += 1) {
+    var d = digests[j];
+    var enrolled = d.enrolled === true;
+    digestRows +=
+      "<form class=\"wishlist-prefs__row\" method=\"post\" action=\"/account/wishlist/digest\">" +
+        "<input type=\"hidden\" name=\"schedule_slug\" value=\"" + esc(d.slug) + "\">" +
+        "<input type=\"hidden\" name=\"on\" value=\"" + (enrolled ? "" : "1") + "\">" +
+        "<span class=\"wishlist-prefs__label\">" + esc(d.label || d.slug) + "</span>" +
+        "<span class=\"wishlist-prefs__state\">" + (enrolled ? "Subscribed" : "Not subscribed") + "</span>" +
+        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">" + (enrolled ? "Unsubscribe" : "Subscribe") + "</button>" +
+      "</form>";
+  }
+  var digestBlock = digestRows
+    ? "<h3 class=\"wishlist-prefs__subhead\">Periodic wishlist digest</h3>" + digestRows
+    : "";
+
+  return "<section class=\"wishlist-prefs-panel\" aria-labelledby=\"wishlist-prefs-heading\">" +
+           "<h2 id=\"wishlist-prefs-heading\" class=\"wishlist-prefs-panel__title\">Wishlist notifications</h2>" +
+           "<p class=\"wishlist-prefs-panel__lede\">Choose how you'd like to hear about your saved items. We'll only email you if your store has email delivery configured.</p>" +
+           notice +
+           alertsBlock +
+           digestBlock +
+         "</section>";
+}
+
 // Public, no-auth shared-wishlist page (`GET /wishlist/shared/:token`). It
 // renders ONLY the shared product cards (title, image, link to each PDP) —
 // the owner's identity, the per-entry private notes, and the owner customer
@@ -8602,6 +8683,7 @@ var ACCOUNT_LOGIN_PAGE =
   "      <p id=\"login-message\" class=\"auth-form__message\"></p>\n" +
   "    </form>\n" +
   "    RAW_LOGIN_OAUTH\n" +
+  "    RAW_LOGIN_MAGIC\n" +
   "    <p class=\"auth-card__alt\">New here? <a href=\"/account/register\">Create an account →</a></p>\n" +
   "  </div>\n" +
   "  RAW_LOGIN_SCRIPT\n" +
@@ -8610,6 +8692,7 @@ var ACCOUNT_LOGIN_PAGE =
 var LOGIN_ERROR_MESSAGES = {
   oauth:           "We couldn't complete that sign-in. Please try again.",
   "email-conflict": "That email already has an account — sign in with your passkey instead.",
+  link:            "That sign-in link is invalid or has expired. Request a fresh one.",
 };
 
 function renderAccountLogin(opts) {
@@ -8630,8 +8713,12 @@ function renderAccountLogin(opts) {
   var errHtml = (opts.error && LOGIN_ERROR_MESSAGES[opts.error])
     ? "<p class=\"auth-form__message auth-form__message--err\">" + b.template.escapeHtml(LOGIN_ERROR_MESSAGES[opts.error]) + "</p>"
     : "";
+  var magicHtml = opts.magic_link_enabled
+    ? "<p class=\"auth-card__alt\"><a href=\"/account/login/link\">Email me a sign-in link instead →</a></p>"
+    : "";
   var body = ACCOUNT_LOGIN_PAGE
     .replace("RAW_LOGIN_OAUTH", oauthHtml)
+    .replace("RAW_LOGIN_MAGIC", magicHtml)
     .replace("RAW_LOGIN_ERROR", errHtml)
     // Login captcha is gated separately (CAPTCHA_GATE_LOGIN): the widget
     // renders only when the operator has a provider active AND opted login
@@ -8648,6 +8735,50 @@ function renderAccountLogin(opts) {
   });
 }
 
+// Magic-link sign-in — a passwordless entry for shoppers without a
+// passkey or a social login. The page is a single email field that POSTs
+// to /account/login/link. The response is always the same enumeration-
+// safe confirmation ("if an account exists, we've emailed a link")
+// regardless of whether the address resolves — no account-existence
+// oracle. Server-rendered, no client JS.
+var ACCOUNT_MAGIC_LINK_PAGE =
+  "<section class=\"auth-page\">\n" +
+  "  <div class=\"auth-card\">\n" +
+  "    <p class=\"eyebrow\">Sign in by email</p>\n" +
+  "    <h1 class=\"auth-card__title\">Email me a sign-in link</h1>\n" +
+  "    <p class=\"auth-card__lede\">No passkey or social login? Enter your email and we'll send a single-use link that signs you in.</p>\n" +
+  "    RAW_MAGIC_LINK_NOTICE\n" +
+  "    <form method=\"post\" action=\"/account/login/link\" class=\"form-stack auth-form\">\n" +
+  "      <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span><input type=\"email\" name=\"email\" required autocomplete=\"email\" autofocus></label></div>\n" +
+  "      <div class=\"form-actions\"><button type=\"submit\" class=\"btn-primary auth-form__submit\">Email me a link</button></div>\n" +
+  "    </form>\n" +
+  "    <p class=\"auth-card__alt\"><a href=\"/account/login\">← Back to sign in</a></p>\n" +
+  "  </div>\n" +
+  "</section>\n";
+
+function renderMagicLinkPage(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  // The post-submit confirmation (sent=1) is the enumeration-safe message
+  // — identical whether or not the address matched an account. The
+  // unconfigured-mailer case carries its own honest notice.
+  var noticeHtml = "";
+  if (opts.sent) {
+    noticeHtml = "<p class=\"form-notice form-notice--ok\" role=\"status\">If an account exists for that email, we've sent a sign-in link. Check your inbox.</p>";
+  } else if (opts.unavailable) {
+    noticeHtml = "<p class=\"auth-form__message auth-form__message--err\">Email sign-in isn't available on this store. Use a passkey or social login instead.</p>";
+  }
+  var body = ACCOUNT_MAGIC_LINK_PAGE.replace("RAW_MAGIC_LINK_NOTICE", noticeHtml);
+  void esc;
+  return _wrap({
+    title:      "Email sign-in",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 var ACCOUNT_REGISTER_PAGE =
   "<section class=\"auth-page\">\n" +
   "  <div class=\"auth-card\">\n" +
@@ -12626,6 +12757,7 @@ function mount(router, deps) {
         cart_count:     cartCount,
         google_enabled: !!deps.oauthGoogle,
         apple_enabled:  !!deps.oauthApple,
+        magic_link_enabled: !!(deps.customerPortal && deps.customerPortalEmail),
         error:          url && url.searchParams.get("error"),
         captcha_kind:        captchaLoginOn ? captchaKind   : null,
         captcha_public_key:  captchaLoginOn ? captchaPubKey : null,
@@ -12645,6 +12777,105 @@ function mount(router, deps) {
       }));
     });
 
+    // ---- magic-link sign-in (passwordless email entry) ------------------
+    //
+    // A minimal passwordless login for shoppers without a passkey or a
+    // social login. Composes the customer-portal primitive: createSession
+    // mints a single-use, hashed-at-rest token; the link is emailed; the
+    // GET redemption verifies (single-use) and sets the sealed shop_auth
+    // cookie. The whole surface mounts only when BOTH the portal primitive
+    // AND a transactional mailer are wired — absent either, /account/login/
+    // link renders an "unavailable" state and passkey / OAuth are unchanged.
+    if (deps.customerPortal && deps.customerPortalEmail) {
+      // GET — the email-entry form.
+      router.get("/account/login/link", async function (req, res) {
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderMagicLinkPage({
+          shop_name:  shopName,
+          cart_count: cartCount,
+          sent:       url ? url.searchParams.get("sent") === "1" : false,
+        }));
+      });
+
+      // POST — resolve the email to a customer, mint a portal session,
+      // email the link. The response is ALWAYS the same enumeration-safe
+      // confirmation (sent=1) regardless of whether the address matched —
+      // no account-existence oracle. A bad-shaped email re-renders the
+      // form. Every send is best-effort: a mailer failure still shows the
+      // generic confirmation (the link simply doesn't arrive).
+      router.post("/account/login/link", async function (req, res) {
+        var body = req.body || {};
+        var emailRaw = typeof body.email === "string" ? body.email : "";
+        var customerId = null;
+        // Resolve the customer by email hash. A malformed address (hashEmail
+        // throws on bad shape) or a no-match both fall through to the
+        // generic confirmation — no oracle.
+        try {
+          var hash = deps.customers.hashEmail(emailRaw);
+          var cust = await deps.customers.byEmailHash(hash);
+          if (cust && cust.id) customerId = cust.id;
+        } catch (_e) { customerId = null; }
+
+        if (customerId) {
+          try {
+            var minted = await deps.customerPortal.createSession({
+              customer_id: customerId,
+              scope:       "full",
+            });
+            // Build the absolute redemption link from this request's origin.
+            var origin = "";
+            try { origin = new URL(_requestUrls(req).canonical_url).origin; }
+            catch (_e2) { origin = ""; }
+            var linkUrl = origin + "/account/portal/" + encodeURIComponent(minted.plaintext_token);
+            // The customer's plaintext address: the portal flow needs a
+            // deliverable address. The customers store keeps only the hash,
+            // so reuse the submitted address (the customer just typed it);
+            // the email handle validates the address shape.
+            await deps.customerPortalEmail.sendMagicLink({
+              customer_email: emailRaw,
+              link_url:       linkUrl,
+            });
+          } catch (_e3) { /* drop-silent — generic confirmation regardless */ }
+        }
+        // 303 to the GET with the generic confirmation flag.
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/login/link?sent=1");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // GET — redeem the magic-link token. verifyToken is single-use (flips
+      // the row to consumed) and re-checks expiry; on success set the sealed
+      // shop_auth cookie + 303 to /account. An unknown / expired / already-
+      // used token bounces to login with a soft error (no oracle on why).
+      router.get("/account/portal/:token", async function (req, res) {
+        var token = (req.params && req.params.token) || "";
+        var rv = null;
+        try { rv = await deps.customerPortal.verifyToken(token); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          rv = null;
+        }
+        if (!rv || !rv.customer_id) {
+          res.status(303);
+          res.setHeader && res.setHeader("location", "/account/login?error=link");
+          return res.end ? res.end() : res.send("");
+        }
+        // Adopt the guest cart into the now-authenticated account, mirroring
+        // the OAuth / passkey login paths.
+        var sid = _readSidCookie(req);
+        if (sid) {
+          try {
+            var anonCart = await deps.cart.bySession(sid);
+            if (anonCart) await deps.cart.setCustomer(anonCart.id, rv.customer_id);
+          } catch (_e) { /* best-effort merge; sign-in itself succeeds */ }
+        }
+        _setAuthCookie(req, res, { customer_id: rv.customer_id, exp: Date.now() + b.constants.TIME.days(14) });
+        res.status(303); res.setHeader && res.setHeader("location", "/account");
+        return res.end ? res.end() : res.send("");
+      });
+    }
+
     router.post("/account/passkey/register-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
@@ -13754,15 +13985,152 @@ function mount(router, deps) {
             notice: wlUrl ? wlUrl.searchParams.get("share") : null,
           });
         }
+        // Alert + digest opt-in panel — only when those primitives are
+        // wired (a mailer-configured deploy). The current per-trigger
+        // opt-out + per-schedule enrollment state drives each toggle's
+        // checked/unchecked render. A reads failure degrades to no panel
+        // rather than 500-ing the page.
+        var prefsPanel = await _buildWishlistPrefsPanel(
+          auth.customer_id,
+          wlUrl ? wlUrl.searchParams.get("prefs") : null,
+        );
         _send(res, 200, renderWishlist({
           items:        items,
           notice:       wlUrl ? wlUrl.searchParams.get("ok") : null,
+          prefs_panel:  prefsPanel,
           share_panel:  sharePanel,
           shop_name:    shopName,
           cart_count:   cartCount,
           asset_prefix: deps.asset_prefix || "/assets/",
         }));
       });
+
+      // Build the alert + digest opt-in panel for a signed-in customer.
+      // Reads the current per-trigger opt-out state (isUnsubscribedFrom
+      // Trigger, now exported) for each scannable alert trigger, and the
+      // active-enrollment state per live digest schedule. Each read is
+      // best-effort: a missing table / read error drops that section
+      // rather than throwing. Returns "" when neither primitive is wired.
+      async function _buildWishlistPrefsPanel(customerId, notice) {
+        var alerts  = [];
+        var digests = [];
+        if (deps.wishlistAlerts) {
+          var ALERT_TRIGGERS = [
+            { trigger: "price_drop",    label: "Email me when a saved item drops in price" },
+            { trigger: "back_in_stock", label: "Email me when a saved item is back in stock" },
+          ];
+          for (var i = 0; i < ALERT_TRIGGERS.length; i += 1) {
+            var t = ALERT_TRIGGERS[i];
+            var unsub = true;
+            try { unsub = await deps.wishlistAlerts.isUnsubscribedFromTrigger(customerId, t.trigger); }
+            catch (_e) { unsub = false; }
+            alerts.push({ trigger: t.trigger, label: t.label, subscribed: !unsub });
+          }
+        }
+        if (deps.wishlistDigest) {
+          var schedules = [];
+          try { schedules = await deps.wishlistDigest.listSchedules({ active_only: true }); }
+          catch (_e) { schedules = []; }
+          var enrollments = [];
+          try { enrollments = await deps.wishlistDigest.enrollmentsForCustomer(customerId); }
+          catch (_e) { enrollments = []; }
+          var activeBySlug = {};
+          for (var k = 0; k < enrollments.length; k += 1) {
+            var en = enrollments[k];
+            if (en.status === "active") activeBySlug[en.schedule_slug] = en.id;
+          }
+          for (var s = 0; s < schedules.length; s += 1) {
+            var sch = schedules[s];
+            var label = (sch.frequency === "weekly" ? "Weekly" : "Monthly") +
+                        " digest (" + sch.slug + ")";
+            digests.push({
+              slug:          sch.slug,
+              label:         label,
+              enrolled:      Object.prototype.hasOwnProperty.call(activeBySlug, sch.slug),
+              enrollment_id: activeBySlug[sch.slug] || null,
+            });
+          }
+        }
+        return _wishlistPrefsPanel({ alerts: alerts, digests: digests, notice: notice });
+      }
+
+      // POST /account/wishlist/alerts — flip a per-trigger alert opt-out.
+      // Body { trigger, on }: a falsey `on` unsubscribes (insert opt-out
+      // row); a truthy `on` re-subscribes (delete the opt-out row). Gated
+      // on the session customer; CSRF rides the container form chokepoint.
+      if (deps.wishlistAlerts) {
+        router.post("/account/wishlist/alerts", async function (req, res) {
+          var auth;
+          try { auth = _currentCustomer(req); }
+          catch (e) {
+            if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+            throw e;
+          }
+          if (!auth) {
+            res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+            return res.end ? res.end() : res.send("");
+          }
+          var body = req.body || {};
+          var trigger = body.trigger;
+          var on = body.on === "1" || body.on === "on" || body.on === true;
+          try {
+            if (on) {
+              await deps.wishlistAlerts.resubscribeToAlertKind({ customer_id: auth.customer_id, trigger: trigger });
+            } else {
+              await deps.wishlistAlerts.unsubscribeFromAlertKind({ customer_id: auth.customer_id, trigger: trigger });
+            }
+          } catch (e) {
+            res.status(e instanceof TypeError ? 400 : 500);
+            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          }
+          res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?prefs=alerts");
+          return res.end ? res.end() : res.send("");
+        });
+      }
+
+      // POST /account/wishlist/digest — enroll / pause a digest schedule.
+      // Body { schedule_slug, on }: a truthy `on` enrolls; a falsey `on`
+      // pauses the active enrollment for that slug (looked up via
+      // enrollmentsForCustomer). Gated on the session customer.
+      if (deps.wishlistDigest) {
+        router.post("/account/wishlist/digest", async function (req, res) {
+          var auth;
+          try { auth = _currentCustomer(req); }
+          catch (e) {
+            if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+            throw e;
+          }
+          if (!auth) {
+            res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+            return res.end ? res.end() : res.send("");
+          }
+          var body = req.body || {};
+          var scheduleSlug = body.schedule_slug;
+          var on = body.on === "1" || body.on === "on" || body.on === true;
+          try {
+            if (on) {
+              await deps.wishlistDigest.enrollCustomer({ customer_id: auth.customer_id, schedule_slug: scheduleSlug });
+            } else {
+              // Find the active enrollment for this slug and pause it.
+              var enrollments = await deps.wishlistDigest.enrollmentsForCustomer(auth.customer_id);
+              var target = null;
+              for (var i = 0; i < enrollments.length; i += 1) {
+                if (enrollments[i].schedule_slug === scheduleSlug && enrollments[i].status === "active") {
+                  target = enrollments[i]; break;
+                }
+              }
+              if (target) {
+                await deps.wishlistDigest.pauseEnrollment({ enrollment_id: target.id, reason: "customer opted out" });
+              }
+            }
+          } catch (e) {
+            res.status(e instanceof TypeError ? 400 : 500);
+            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          }
+          res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?prefs=digest");
+          return res.end ? res.end() : res.send("");
+        });
+      }
     }
 
     // ---- wishlist sharing -----------------------------------------------