@blamejs/blamejs-shop 0.4.125 → 0.4.126

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.126 (2026-06-27) — **Storefront error responses no longer echo internal error detail, and order/account pages render images from the configured asset prefix.** Two storefront correctness fixes. First, around fifteen storefront routes (cart line edit/remove, product compare, saved-for-later, account actions and more) returned the raw error message to the client on an unexpected server error — a string that can carry an internal database column, a vault/crypto detail, or other implementation internals. Those routes now distinguish a client-shape validation error (a 400 that still shows its operator-authored message) from an unexpected server error (a 500 that logs the real error server-side, correlated by the request id, and returns only a generic message plus that id) — the same redaction the WebAuthn ceremony routes already used. Second, the order-detail and account-dashboard pages were rendering product thumbnails from the default "/assets/" path instead of the operator's configured asset prefix, so on a deployment that serves assets from a CDN or object-store prefix those two pages showed broken images; both pages now pass the configured prefix like every other page. **Fixed:** *Storefront routes no longer echo the internal error message on a 500* — About fifteen storefront routes — cart line update/remove, product-compare add/clear, saved-for-later move/remove, and several account actions — handled a caught error with `status(TypeError ? 400 : 500)` and then returned the raw error message for both cases, so an unexpected (non-validation) server error sent its internal message string to the client. These routes now return that message only for a client-shape validation error (a 400); any other error is a 500 that records the real error server-side against the request id and returns a generic "Something went wrong" message plus that id for support correlation. This matches the redaction the WebAuthn register/login routes already applied. · *Order-detail and account pages render images from the configured asset prefix* — The order-detail (`/orders/:id`) and account-dashboard (`/account`) renderers were not passed the configured asset prefix, so they fell back to the default `/assets/` path for product thumbnails while every other page used the operator's prefix. On a deployment that serves static assets from a CDN or object-store prefix, those two pages showed broken images. Both now pass the configured prefix, so their images load from the same place as the rest of the storefront.
+
 - v0.4.125 (2026-06-27) — **Vendored framework refreshed to 0.15.34 — RSA OpenPGP signatures with a high zero byte now verify reliably.** Updates the vendored blamejs framework to 0.15.34. The upstream release fixes the framework's OpenPGP verification: an RSA signature whose value began with one or more zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct, because the OpenPGP wire format strips those leading zero bytes and the verifier handed the shortened signature straight to RSA verification (which requires the signature to be exactly the key's modulus length). The signature is now left-padded back to the modulus width before verification, so every valid RSA signature verifies reliably, including signatures produced by other OpenPGP implementations. The release also carries internal test-suite tooling with no runtime effect. **Changed:** *Vendored framework refreshed to 0.15.34 (reliable RSA OpenPGP signature verification)* — Refreshes the vendored blamejs framework to 0.15.34. The upstream fix left-pads an RSA OpenPGP signature back to the key's modulus byte length before verifying it, so a valid signature whose value carried one or more leading zero bytes (~1 in 256, for any key) is no longer intermittently rejected — matching the padding the Ed25519 verification path already applied. Any code path that verifies OpenPGP RSA signatures through the framework now accepts every correct signature. The rest of the release is internal test-suite tooling with no runtime, public-API, or wire-format change.
 
 - v0.4.124 (2026-06-27) — **Adding the same item to a cart from two requests at once always sums the quantity, and the manager role can configure delivery cutoffs and postal zones.** Two correctness fixes. First, adding the same product to a cart from two requests at once — a double-click, or two open tabs — could drop one of the quantity increases: the cart line's quantity was read and then written back as an absolute value, so the second write overwrote the first instead of adding to it. Adding to the cart now sums the quantity in a single atomic database statement, so simultaneous adds of the same item always total correctly; the same atomic write covers applying a bundle's units onto an existing line and merging a guest cart into a signed-in cart at login. Second, an operator with the manager role was wrongly denied the delivery-estimate cutoff-time and postal-zone screens — those two actions were not mapped to the catalog-write permission and fell through to the owner-only fallback, so only the owner could reach them; managers can now manage them alongside the other delivery-estimate settings. **Fixed:** *Simultaneous add-to-cart requests for the same item sum the quantity instead of losing one* — Adding a line to a cart read the existing quantity and then wrote back the absolute sum, so two requests adding the same item to the same cart at the same time (a rapid double-click, or two tabs) could each read the same starting quantity and overwrite each other — one increase was lost. The add is now a single atomic upsert that increments the stored quantity in the database (`qty = qty + added`), so concurrent adds of the same item always total correctly and a concurrent first-add no longer fails on the cart's unique-line constraint. A plain re-add still keeps the line's existing price. The same atomic write applies to placing a bundle's units onto an existing line (the per-unit price re-blends to the combined value, rounded up so it never charges below it) and to merging a guest cart into a signed-in cart at login. · *The manager role can configure delivery cutoff times and postal zones* — The delivery-estimate cutoff-time and postal-zone actions were not mapped to the catalog-write permission, so they fell through to the owner-only fallback and an operator with the manager role was denied access to those two screens while being allowed the adjacent transit-time and holiday screens. Both actions now require catalog-write, matching the rest of the delivery-estimate settings, so managers can configure them.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.125",
+  "version": "0.4.126",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/storefront.js

@@ -80,6 +80,22 @@ function _authServerError(req, res, e, where) {
   return res.end ? res.end(msg) : res.send(msg);
 }
 
+// Uniform terminal error for a text/HTML route: a malformed-input TypeError is
+// a 400 whose message is operator-authored validation copy (safe to show), but
+// any OTHER error is a 500 whose message could carry an internal string (a DB
+// column, a vault/crypto internal) — so it routes through _authServerError,
+// which logs the real error server-side and returns only a generic message +
+// the correlating request id. Replaces the `res.status(e instanceof TypeError ?
+// 400 : 500); res.end(e.message)` shape, which leaked the raw error on the 500.
+function _routeError(req, res, e) {
+  if (e instanceof TypeError) {
+    res.status(400);
+    var m = (e && e.message) || "Invalid request";
+    return res.end ? res.end(m) : res.send(m);
+  }
+  return _authServerError(req, res, e, (req && req.method && req.url) ? (req.method + " " + req.url) : "route");
+}
+
 // Payment-webhook signatures (Stripe's HMAC, PayPal's, …) are computed over
 // the EXACT raw request bytes, but the global JSON body-parser reparses and
 // discards them. This middleware buffers the raw body for the given POST
@@ -14248,8 +14264,7 @@ function mount(router, deps) {
           return _compareRedirect(res, dest, "full");
         }
         // A malformed product id (or session id) is a client error.
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        return _routeError(req, res, e);
       }
 
       if (!dest) {
@@ -14269,8 +14284,7 @@ function mount(router, deps) {
         try { await deps.productCompare.clearCompareList({ session_id: sid }); }
         catch (e) {
           if (!(e instanceof TypeError)) {
-            res.status(500);
-            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+            return _authServerError(req, res, e, "POST /compare/clear");
           }
           // A malformed session cookie can't address a basket — treat
           // the clear as a no-op rather than a 400 (the cookie grants
@@ -15592,6 +15606,7 @@ function mount(router, deps) {
         }
       }
       _send(res, 200, renderOrder({
+        asset_prefix:    deps.asset_prefix || "/assets/",
         order:           o,
         product_lookup:  productLookup,
         recommendations: recommendations,
@@ -16596,6 +16611,7 @@ function mount(router, deps) {
 
       var cartCount = await _cartCountForReq(req);
       _send(res, 200, renderAccount({
+        asset_prefix:          deps.asset_prefix || "/assets/",
         customer:              customer,
         orders:                orders,
         order_product_lookup:  orderProductLookup,
@@ -17556,8 +17572,7 @@ function mount(router, deps) {
           if (already) { await deps.wishlist.remove({ customer_id: auth.customer_id, product_id: productId }); removed = true; }
           else         await deps.wishlist.add({ customer_id: auth.customer_id, product_id: productId });
         } catch (e) {
-          res.status(e instanceof TypeError ? 400 : 500);
-          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          return _routeError(req, res, e);
         }
         var okKind = removed ? "removed" : "added";
         var rt = (req.body || {}).return_to;
@@ -17715,8 +17730,7 @@ function mount(router, deps) {
               await deps.wishlistAlerts.unsubscribeFromAlertKind({ customer_id: auth.customer_id, trigger: trigger });
             }
           } catch (e) {
-            res.status(e instanceof TypeError ? 400 : 500);
-            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+            return _routeError(req, res, e);
           }
           res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?prefs=alerts");
           return res.end ? res.end() : res.send("");
@@ -17759,8 +17773,7 @@ function mount(router, deps) {
               }
             }
           } catch (e) {
-            res.status(e instanceof TypeError ? 400 : 500);
-            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+            return _routeError(req, res, e);
           }
           res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?prefs=digest");
           return res.end ? res.end() : res.send("");
@@ -17856,8 +17869,7 @@ function mount(router, deps) {
             privacy:           "unlisted",
           });
         } catch (e) {
-          res.status(e instanceof TypeError ? 400 : 500);
-          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          return _routeError(req, res, e);
         }
         // The full public URL the giver opens. Built from this request's
         // ORIGIN (scheme + host) so the one-time link is a correct absolute
@@ -17905,8 +17917,7 @@ function mount(router, deps) {
         try {
           await deps.wishlistSharing.revokeShareLink({ link_id: shareId, reason: "owner revoked from account" });
         } catch (e) {
-          res.status(e instanceof TypeError ? 400 : 500);
-          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          return _routeError(req, res, e);
         }
         res.status(303); res.setHeader && res.setHeader("location", "/account/wishlist?share=revoked");
         return res.end ? res.end() : res.send("");
@@ -18521,8 +18532,7 @@ function mount(router, deps) {
             line_id:     req.params && req.params.line_id,
           });
         } catch (e) {
-          res.status(e instanceof TypeError ? 400 : 500);
-          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          return _routeError(req, res, e);
         }
         res.status(303); res.setHeader && res.setHeader("location", "/cart");
         return res.end ? res.end() : res.send("");
@@ -18606,8 +18616,7 @@ function mount(router, deps) {
         try {
           await deps.saveForLater.remove({ customer_id: auth.customer_id, save_id: req.params && req.params.save_id });
         } catch (e) {
-          res.status(e instanceof TypeError ? 400 : 500);
-          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          return _routeError(req, res, e);
         }
         res.status(303); res.setHeader && res.setHeader("location", "/account/saved?ok=removed");
         return res.end ? res.end() : res.send("");
@@ -18758,8 +18767,7 @@ function mount(router, deps) {
           var addr = await _ownedAddress(req, res, auth); if (!addr) return;
           try { await fn(addr.id); }
           catch (e) {
-            res.status(e instanceof TypeError ? 400 : 500);
-            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+            return _routeError(req, res, e);
           }
           res.status(303); res.setHeader && res.setHeader("location", "/account/addresses?ok=" + okKind);
           return res.end ? res.end() : res.send("");
@@ -18788,8 +18796,7 @@ function mount(router, deps) {
         var addr = await _ownedAddress(req, res, auth); if (!addr) return;
         try { await deps.addresses.archive(addr.id); }
         catch (e) {
-          res.status(e instanceof TypeError ? 400 : 500);
-          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          return _routeError(req, res, e);
         }
         res.status(303);
         res.setHeader && res.setHeader("location", "/account/addresses?ok=removed&undo=" + encodeURIComponent(addr.id));
@@ -18813,8 +18820,7 @@ function mount(router, deps) {
         }
         try { await deps.addresses.unarchive(addr.id); }
         catch (e) {
-          res.status(e instanceof TypeError ? 400 : 500);
-          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          return _routeError(req, res, e);
         }
         res.status(303); res.setHeader && res.setHeader("location", "/account/addresses?ok=restored");
         return res.end ? res.end() : res.send("");
@@ -21282,8 +21288,7 @@ function mount(router, deps) {
           });
         }
       } catch (e) {
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        return _routeError(req, res, e);
       }
       res.status(303);
       res.setHeader && res.setHeader("location", "/cart");
@@ -21319,8 +21324,7 @@ function mount(router, deps) {
         return res.end ? res.end("Line not found") : res.send("Line not found");
       }
     } catch (e) {
-      res.status(e instanceof TypeError ? 400 : 500);
-      return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+      return _routeError(req, res, e);
     }
     res.status(303);
     res.setHeader && res.setHeader("location", "/cart");
@@ -21348,8 +21352,7 @@ function mount(router, deps) {
     try {
       await deps.cart.removeLine(lineId, cart.id);
     } catch (e) {
-      res.status(e instanceof TypeError ? 400 : 500);
-      return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+      return _routeError(req, res, e);
     }
     res.status(303);
     res.setHeader && res.setHeader("location", "/cart");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.125",
+  "version": "0.4.126",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {