@blamejs/blamejs-shop 0.5.22 → 0.5.24

package/lib/compliance-export.js

@@ -207,6 +207,10 @@ var SCOPE_SECTIONS = Object.freeze({
     // both directions (as referrer and as referred friend).
     "guestOrderReconciliations", "stockAlerts", "quotes", "orderRatings",
     "productQa", "customerNotes", "giftcards", "referrals",
+    // Support sessions opened on the account, and what was done under each.
+    // When someone looked at your account, who, why, and which pages is
+    // personal data about you, so a subject-access request returns it.
+    "customerImpersonation",
   ]),
   orders_only: Object.freeze(["order", "orderNotes"]),
   identity_only: Object.freeze(["customers", "addresses"]),
@@ -392,6 +396,7 @@ function create(opts) {
     orderRatings:   opts.orderRatings   || null,
     productQa:      opts.productQa      || null,
     customerNotes:  opts.customerNotes  || null,
+    customerImpersonation: opts.customerImpersonation || null,
     giftcards:      opts.giftcards      || null,
     referrals:      opts.referrals      || null,
   };
@@ -655,6 +660,14 @@ function create(opts) {
       "supportTickets", "orderNotes", "order", "guestOrderReconciliations",
       "subscriptions", "paymentMethods", "loyalty", "storeCredit",
       "giftcards", "referrals", "addresses",
+      // Retains rather than erases, and the report says so with a reason.
+      // Listed here precisely BECAUSE it retains: a domain absent from this
+      // walk is never asked, so the erasure report would neither erase it nor
+      // explain why it did not — the customer would be told their record was
+      // erased while an audit trail about them quietly remained, unmentioned.
+      // Named last so the accountability record is the final line of the
+      // report rather than buried among the erasures.
+      "customerImpersonation",
     ];
     var perDomain     = [];
     var domainsAbsent = [];
@@ -680,11 +693,28 @@ function create(opts) {
           throw new TypeError("reader " + JSON.stringify(name) +
             ".forCustomerDeletion returned non-object — must return { table, deleted }");
         }
-        perDomain.push({
+        var entry = {
           domain:  name,
           table:   effect.table  == null ? name : effect.table,
           deleted: effect.deleted == null ? 0    : Number(effect.deleted),
-        });
+        };
+        // A domain that RETAINS its rows on purpose says so, and says why.
+        // Without this the report shows a plain `deleted: 0`, which reads as
+        // "there was nothing to erase" — indistinguishable from a domain the
+        // customer had no data in. An erasure report that cannot tell those
+        // apart is the one an auditor cannot rely on, and retention here is a
+        // deliberate legal position (accounting records, accountability logs)
+        // that has to be stated rather than inferred.
+        if (effect.retained === true) {
+          entry.retained = true;
+          if (typeof effect.reason === "string" && effect.reason.length) {
+            entry.reason = effect.reason;
+          }
+        } else if (typeof effect.note === "string" && effect.note.length) {
+          // Older readers carry the same meaning as a free-text `note`.
+          entry.note = effect.note;
+        }
+        perDomain.push(entry);
       } catch (e) {
         failures.push({ domain: name, error: (e && e.message) ? e.message : String(e) });
       }

package/lib/customer-impersonation.js

@@ -113,8 +113,14 @@
  *         → `{ notified: boolean, customer_notified_at: <ms> | null }`
  *     - `listForOperator(operator_id, { active_only? })`
  *         → array of session rows, newest-first.
- *     - `listForCustomer(customer_id)`
- *         → array of session rows, newest-first.
+ *     - `listForCustomer(customer_id, { limit?, offset? })`
+ *         → the customer's most recent sessions, newest-first. BOUNDED:
+ *           20 by default, 200 at most. The storefront renders this on
+ *           every account page load and the rows are never pruned, so an
+ *           unbounded read would make a customer's own dashboard slower
+ *           for the rest of the account's life. Nothing becomes unreadable:
+ *           `offset` walks the older pages, so a customer or a regulator
+ *           asking for the whole history can still get it.
  *     - `currentlyImpersonating()`
  *         → array of active session rows.
  *     - `cleanupExpired({ now? })`
@@ -138,6 +144,13 @@
 var TOKEN_NAMESPACE         = "customer-impersonation-token";
 var TOKEN_BYTES             = 32;
 var DEFAULT_TTL_SECONDS     = 60 * 60;                  // allow:raw-time-literal — seconds value; C.TIME returns ms (60-minute default)
+
+// How much of a customer's access history their own account page shows by
+// default, and the ceiling a caller may ask for. Bounded because the rows are
+// an audit trail that is never pruned: an unbounded read would make a
+// customer's dashboard slower every time support helped them.
+var DEFAULT_CUSTOMER_HISTORY = 20;
+var MAX_CUSTOMER_HISTORY     = 200;
 var MIN_TTL_SECONDS         = 60;                       // refuse sub-minute
 var MAX_TTL_SECONDS         = 8 * 60 * 60;              // allow:raw-time-literal — seconds value; C.TIME returns ms (hard ceiling — eight hours)
 var MAX_REASON_LEN          = 280;
@@ -165,6 +178,24 @@ function _uuid(s, label) {
   }
 }
 
+// The admin console has two kinds of operator identity: a staff account, whose
+// id is a v7 UUID, and the bootstrap / break-glass credential, whose id is the
+// reserved literal below. Both are real operators and both must be recordable
+// here — a store running the single-credential console (the common deploy) has
+// no UUID to offer, and refusing it would make the feature unreachable exactly
+// where the audit trail matters most.
+//
+// Only this one literal is admitted; anything else still has to be a UUID, so
+// the column cannot fill up with free-form operator labels. It matches the id
+// the rest of the console records against the same action, which keeps an
+// impersonation row joinable to its audit entries.
+var BOOTSTRAP_OPERATOR_ID = "owner";
+
+function _operatorId(s, label) {
+  if (s === BOOTSTRAP_OPERATOR_ID) return s;
+  return _uuid(s, label);
+}
+
 function _requiredString(s, label, maxLen) {
   if (typeof s !== "string") {
     throw new TypeError("customer-impersonation: " + label + " must be a string");
@@ -308,7 +339,7 @@ function create(opts) {
       if (!input || typeof input !== "object") {
         throw new TypeError("customer-impersonation.startImpersonation: input object required");
       }
-      var operatorId = _uuid(input.operator_id, "operator_id");
+      var operatorId = _operatorId(input.operator_id, "operator_id");
       var customerId = _uuid(input.customer_id, "customer_id");
       var reason     = _requiredString(input.reason, "reason", MAX_REASON_LEN);
       var ttl        = _ttlSeconds(input.ttl_seconds);
@@ -543,7 +574,7 @@ function create(opts) {
     // started, newest-first. `active_only: true` filters to live
     // sessions only.
     listForOperator: async function (operatorId, listOpts) {
-      var oid = _uuid(operatorId, "operator_id");
+      var oid = _operatorId(operatorId, "operator_id");
       listOpts = listOpts || {};
       if (typeof listOpts !== "object") {
         throw new TypeError("customer-impersonation.listForOperator: opts must be an object");
@@ -568,12 +599,33 @@ function create(opts) {
     // Returns every impersonation session ever opened against the
     // customer, newest-first. The customer-side "show me who's looked
     // at my account" page reads this directly.
-    listForCustomer: async function (customerId) {
+    // `limit` is bounded and defaulted because the storefront renders this on
+    // every /account load. These rows are an audit trail and are never
+    // deleted, so an unbounded read would grow the query cost and the page
+    // weight of a customer's own dashboard for the rest of the account's life
+    // — worst for exactly the customers support has helped most often.
+    listForCustomer: async function (customerId, listOpts) {
       var cid = _uuid(customerId, "customer_id");
+      var opts = listOpts || {};
+      var limit = opts.limit == null ? DEFAULT_CUSTOMER_HISTORY : opts.limit;
+      if (typeof limit !== "number" || !Number.isInteger(limit) || limit <= 0 ||
+          limit > MAX_CUSTOMER_HISTORY) {
+        throw new TypeError("customer-impersonation.listForCustomer: limit must be an integer in [1, " +
+          MAX_CUSTOMER_HISTORY + "]");
+      }
+      // Offset paging, so capping the page does not put older rows out of
+      // reach. These are audit records: a bounded default protects the
+      // account page from growing heavier with every support visit, but
+      // nothing may become unreadable — a customer or a regulator asking for
+      // the whole history has to be able to walk it.
+      var offset = opts.offset == null ? 0 : opts.offset;
+      if (typeof offset !== "number" || !Number.isInteger(offset) || offset < 0) {
+        throw new TypeError("customer-impersonation.listForCustomer: offset must be a non-negative integer");
+      }
       var r = await query(
         "SELECT * FROM impersonations WHERE customer_id = ?1 " +
-        "ORDER BY started_at DESC, id DESC",
-        [cid],
+        "ORDER BY started_at DESC, id DESC LIMIT ?2 OFFSET ?3",
+        [cid, limit, offset],
       );
       return r.rows.map(_projectRow);
     },
@@ -583,11 +635,22 @@ function create(opts) {
     // The operator dashboard's "who's currently impersonating whom"
     // surface. Returns every `active` row across all operators,
     // newest-first.
-    currentlyImpersonating: async function () {
+    // Filters on the CLOCK as well as the status column.
+    //
+    // Authority expires by timestamp — `verifyImpersonationToken` and the
+    // per-request liveness read both refuse an elapsed row immediately — while
+    // the `status` column only catches up when `cleanupExpired` next runs. A
+    // query on status alone therefore reports sessions as live in the window
+    // between those two, and longer if the sweep is delayed or was never
+    // scheduled. On an oversight screen that is the wrong direction to be
+    // wrong in: it shows a supervisor people inside accounts who are not,
+    // which is the fastest way to teach them the screen is noise.
+    currentlyImpersonating: async function (listOpts) {
+      var now = (listOpts && listOpts.now != null) ? listOpts.now : _now();
       var r = await query(
-        "SELECT * FROM impersonations WHERE status = 'active' " +
+        "SELECT * FROM impersonations WHERE status = 'active' AND expires_at > ?1 " +
         "ORDER BY started_at DESC, id DESC",
-        [],
+        [now],
       );
       return r.rows.map(_projectRow);
     },
@@ -703,12 +766,64 @@ function create(opts) {
     // `endImpersonation` because the audit log distinguishes
     // operator-driven completion from operator-side termination.
     // Idempotent on already-terminal rows.
+    // ---- consumeToken -----------------------------------------------------
+    //
+    // Spend the handoff bearer WITHOUT ending the session.
+    //
+    // `startImpersonation` mints a single plaintext token and the operator
+    // follows it once, out of the console and into the storefront. Verifying
+    // it is a read, though, so until the token stops matching, that URL keeps
+    // working: it sits in browser history, in a chat message if it was pasted,
+    // in a proxy log — and anyone holding it can mint their own cookie for
+    // that customer for the rest of the hour. The handoff is meant to be
+    // one-time; this is what makes it so.
+    //
+    // Rotating the hash to a fresh random value is what spends it. The row's
+    // authority now lives entirely in the cookie the redemption sealed, which
+    // is bound to the operator's browser; the session stays `active` and
+    // `end` / `revoke` / the sweep are unaffected. Rotating (rather than
+    // nulling) also keeps the NOT NULL UNIQUE column honest.
+    //
+    // Takes the PLAINTEXT the caller was presented, and spends only that one.
+    //
+    // The match on the current hash is what makes this single-use under
+    // concurrency. Verification is a read, so two requests carrying the same
+    // link can both pass it before either writes; if the update only keyed on
+    // the row id they would both succeed and both mint a cookie, which is the
+    // guarantee this exists to provide, broken. Conditioning the write on the
+    // hash it verified means exactly one request can win — the second finds
+    // the hash already rotated and gets `consumed: false`.
+    //
+    // Deliberately NOT idempotent: a caller that cannot claim the token must
+    // not be handed a session.
+    consumeToken: async function (impersonationId, plaintext) {
+      var impId = _uuid(impersonationId, "impersonation_id");
+      if (typeof plaintext !== "string" || !plaintext.length) {
+        throw new TypeError("customer-impersonation.consumeToken: plaintext token required");
+      }
+      var presented = b.crypto.namespaceHash(TOKEN_NAMESPACE, plaintext);
+      var spent = b.crypto.namespaceHash(
+        TOKEN_NAMESPACE, "spent:" + impId + ":" + b.crypto.toBase64Url(b.crypto.generateBytes(32)));
+      var r = await query(
+        "UPDATE impersonations SET token_hash = ?1 " +
+        "WHERE id = ?2 AND status = 'active' AND token_hash = ?3",
+        [spent, impId, presented],
+      );
+      return { consumed: r.rowCount === 1 };
+    },
+
     revoke: async function (input) {
       if (!input || typeof input !== "object") {
         throw new TypeError("customer-impersonation.revoke: input object required");
       }
       var id     = _uuid(input.impersonation_id, "impersonation_id");
       var reason = _requiredString(input.reason, "reason", MAX_END_REASON_LEN);
+      // Optional so an existing caller keeps working; when present it is the
+      // operator performing the revocation, and it is what the audit row
+      // records as the actor.
+      var revokedBy = input.revoked_by == null
+        ? null
+        : _operatorId(input.revoked_by, "revoked_by");
       var existing = await _getRow(id);
       if (!existing) {
         var miss = new Error("customer-impersonation.revoke: impersonation not found");
@@ -727,12 +842,25 @@ function create(opts) {
       );
       var revoked = Number(r.rowCount || 0) > 0;
       if (revoked) {
+        // The actor is whoever DID the revoking, which is usually not the
+        // operator being removed. Attributing it to `existing.operator_id`
+        // wrote an audit row saying they ended their own session — on the one
+        // feature whose entire justification is an accurate record of who did
+        // what to whose account, that is a falsified line. `revoked_by` falls
+        // back to the session's own operator so a self-revoke still reads
+        // correctly and an older caller keeps working.
         await _audit(
           "revoke",
-          existing.operator_id,
+          revokedBy || existing.operator_id,
           id,
           { status: "active" },
-          { status: "revoked", ended_at: now, end_reason: reason },
+          {
+            status: "revoked", ended_at: now, end_reason: reason,
+            revoked_by: revokedBy || existing.operator_id,
+            // Named explicitly so an auditor reading the row can tell a
+            // supervisor's intervention from an operator closing their own.
+            self_revoked: !revokedBy || revokedBy === existing.operator_id,
+          },
         );
       }
       return { revoked: revoked };

package/lib/delivery-estimate.js

@@ -132,12 +132,11 @@ var DAY_MS                = b.constants.TIME.days(1);
 
 // ---- validators ---------------------------------------------------------
 
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _zone(s, label) {

package/lib/payment.js

@@ -176,9 +176,11 @@ function _formEncode(obj, prefix) {
 //
 // b.httpClient already routes every dial through b.ssrfGuard (private /
 // loopback / link-local / reserved / cloud-metadata IP classes refused) and
-// pins the TCP connect to the guard's resolved IP set even on the PSP path's
-// caller-supplied TLS agent, so DNS rebinding can't flip the answer between
-// check and connect. The remaining gap is a HOST allowlist: nothing today
+// pins the TCP connect to the guard's resolved IP set, so DNS rebinding can't
+// flip the answer between check and connect. (These dials no longer supply a
+// caller-built TLS agent at all — see the note at the head of this file — so
+// the pinning applies to the framework's own client.) The remaining gap is a
+// HOST allowlist: nothing today
 // stops an `opts.apiBase` pointed at an unexpected public host (config
 // injection, or a future code path that derives the base from request data)
 // from reaching a non-PSP upstream. We pin `allowedHosts` to the configured

package/lib/shipping-labels.js

@@ -136,12 +136,11 @@ function _currency(c) {
 
 // C0 + DEL refusal — same pattern orderTracking uses, kept as a
 // charCodeAt walk so the `no-control-regex` ESLint rule stays clean.
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _shortText(s, label, max) {

package/lib/shipping-zones.js

@@ -93,12 +93,11 @@ var b = require("./vendor/blamejs");
 
 // ---- validators ---------------------------------------------------------
 
+// C0 + DEL, tab included. `allowHt: false` is load-bearing: the predicate
+// permits ASCII HT by default (it is folding whitespace in a header), and
+// these are single-line operator fields where a tab has no business.
 function _hasControlByte(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var cc = s.charCodeAt(i);
-    if (cc <= 0x1f || cc === 0x7f) return true;
-  }
-  return false;
+  return b.structuredFields.containsControlBytes(s, { allowHt: false });
 }
 
 function _slug(s) {