@btst/stack 5.1.0 → 5.2.0

package/dist/packages/stack/src/plugins/ecommerce/api/operations.cjs

@@ -0,0 +1,520 @@
+'use strict';
+
+const api = require('@btst/stack/plugins/api');
+const z = require('zod');
+const plugins_ecommerce_permissions = require('../../../../../../plugins/ecommerce/permissions.cjs');
+const schemas = require('../schemas.cjs');
+const getters = require('./getters.cjs');
+const mutations = require('./mutations.cjs');
+const serializers = require('./serializers.cjs');
+
+const idSchema = z.z.object({ id: z.z.string().min(1).max(200) });
+const discountValidationSchema = z.z.object({
+  code: z.z.string().trim().min(1).max(100),
+  items: z.z.array(schemas.cartItemSchema).min(1).max(50)
+});
+const paymentSchema = z.z.object({
+  clientSecret: z.z.string().min(1).optional(),
+  redirectUrl: z.z.string().refine(
+    (url) => /^https?:\/\//.test(url) || url.startsWith("/") && !url.startsWith("//"),
+    "Payment URL must use HTTP(S) or a local path"
+  ).optional()
+}).refine(
+  (result) => result.clientSecret || result.redirectUrl,
+  "Payment provider returned no payment destination"
+);
+function customerId(identity) {
+  return identity && typeof identity === "object" && "id" in identity && typeof identity.id === "string" ? identity.id : void 0;
+}
+function discountAmount(discount, subtotal) {
+  if (discount.expiresAt && new Date(discount.expiresAt).getTime() <= Date.now() || discount.maxUses != null && discount.uses >= discount.maxUses)
+    mutations.ecommerceError(400, "Discount code has expired or reached its usage limit");
+  return Math.min(
+    subtotal,
+    discount.type === "percent" ? Math.floor(subtotal * discount.value / 100) : discount.value
+  );
+}
+async function sha256(value) {
+  return Array.from(
+    new Uint8Array(
+      await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))
+    ),
+    (byte) => byte.toString(16).padStart(2, "0")
+  ).join("");
+}
+function safeProduct(item, data) {
+  return {
+    ...data,
+    id: item.id,
+    slug: item.slug,
+    createdAt: item.createdAt,
+    updatedAt: item.updatedAt
+  };
+}
+function createEcommerceOperations(adapter, config, mediaAvailable = false) {
+  const currency = config.currency ?? "USD";
+  const shipping = config.shippingAmount ?? 0;
+  async function checkoutResult(order) {
+    if (order.status !== "pending")
+      mutations.ecommerceError(409, "This checkout is no longer pending");
+    let payment = JSON.parse(order.paymentData);
+    if (!payment.clientSecret && !payment.redirectUrl) {
+      const claimed = await adapter.update({
+        model: "ecommerceOrder",
+        where: [
+          { field: "id", value: order.id },
+          { field: "status", value: "pending" },
+          { field: "paymentData", value: "{}" }
+        ],
+        update: { paymentData: '{"initializing":true}', updatedAt: /* @__PURE__ */ new Date() }
+      });
+      if (!claimed)
+        mutations.ecommerceError(
+          409,
+          "Payment is initializing or needs administrator reconciliation; do not start another payment"
+        );
+      payment = paymentSchema.parse(
+        await config.paymentAdapter.createPayment({
+          amount: order.total,
+          currency: order.currency,
+          orderId: order.id,
+          metadata: { email: order.email }
+        })
+      );
+      await adapter.update({
+        model: "ecommerceOrder",
+        where: [
+          { field: "id", value: order.id },
+          { field: "paymentData", value: '{"initializing":true}' }
+        ],
+        update: { paymentData: JSON.stringify(payment), updatedAt: /* @__PURE__ */ new Date() }
+      });
+    }
+    return { orderId: order.id, accessToken: order.accessToken, payment };
+  }
+  return {
+    listProducts: api.defineOperation({
+      input: schemas.productsQuerySchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.product.read,
+      facts: () => ({}),
+      execute: ({ input }) => getters.listProducts(adapter, input, mediaAvailable)
+    }),
+    getProduct: api.defineOperation({
+      input: z.z.object({ slug: z.z.string().min(1).max(200) }),
+      permission: plugins_ecommerce_permissions.ecommercePermissions.product.read,
+      facts: ({ input }) => ({ slug: input.slug }),
+      execute: async ({ input }) => await getters.getProduct(adapter, input.slug, mediaAvailable) ?? mutations.ecommerceError(404, "Product not found")
+    }),
+    createProduct: api.defineOperation({
+      input: z.z.object({
+        slug: z.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).max(200),
+        data: schemas.productSchema
+      }),
+      permission: plugins_ecommerce_permissions.ecommercePermissions.product.manage,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        const data = schemas.productSchema.parse(input.data);
+        const item = await mutations.createProduct(adapter, input.slug, data);
+        return safeProduct(item, data);
+      }
+    }),
+    updateInventory: api.defineOperation({
+      input: schemas.updateInventorySchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.product.manage,
+      facts: ({ input }) => ({ id: input.productId }),
+      execute: async ({ input }) => {
+        mutations.requireAtomicTransactions(adapter);
+        const inventory = await mutations.initializeInventory(
+          adapter,
+          input.productId,
+          input.variantId
+        );
+        return adapter.transaction(async (tx) => {
+          await mutations.productSnapshot(tx, input.productId);
+          const updated = await tx.update({
+            model: "ecommerceInventory",
+            where: [
+              { field: "id", value: inventory.id },
+              { field: "stock", value: input.expectedStock }
+            ],
+            update: { stock: input.stock }
+          });
+          return updated ?? mutations.ecommerceError(409, "Inventory changed; reload before restocking");
+        });
+      }
+    }),
+    createDiscountCode: api.defineOperation({
+      input: schemas.createDiscountSchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.discount.manage,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        if (await getters.getDiscountCode(adapter, input.code))
+          mutations.ecommerceError(409, "Discount code already exists");
+        const record = await adapter.create({
+          model: "ecommerceDiscountCode",
+          data: {
+            ...input,
+            uses: 0,
+            expiresAt: input.expiresAt ? new Date(input.expiresAt) : null
+          }
+        });
+        return {
+          ...record,
+          expiresAt: record.expiresAt ? new Date(record.expiresAt).toISOString() : null
+        };
+      }
+    }),
+    validateDiscountCode: api.defineOperation({
+      input: discountValidationSchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.discount.validate,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        let subtotal = 0;
+        const quantities = /* @__PURE__ */ new Map();
+        for (const line of input.items) {
+          const { data } = await mutations.productSnapshot(adapter, line.productId);
+          if (data.currency !== currency)
+            mutations.ecommerceError(400, "Cart currency does not match the store");
+          const variant = line.variantId ? data.variants.find((item) => item.id === line.variantId) : void 0;
+          if (data.variants.length && !variant || line.variantId && !variant)
+            mutations.ecommerceError(400, "Choose a valid product variant");
+          const key = `${line.productId}:${line.variantId ?? ""}`;
+          const quantity = (quantities.get(key) ?? 0) + line.quantity;
+          quantities.set(key, quantity);
+          const inventory = await getters.getInventory(
+            adapter,
+            line.productId,
+            line.variantId
+          );
+          if ((inventory?.stock ?? variant?.stock ?? data.stock) < quantity)
+            mutations.ecommerceError(409, "Cart has insufficient stock");
+          subtotal += (variant?.price ?? data.price) * line.quantity;
+        }
+        const record = await getters.getDiscountCode(adapter, input.code);
+        if (!record) mutations.ecommerceError(400, "Discount code not found");
+        const discount = discountAmount(record, subtotal);
+        return {
+          code: record.code,
+          subtotal,
+          discount,
+          total: subtotal - discount + shipping,
+          currency
+        };
+      }
+    }),
+    createCheckout: api.defineOperation({
+      input: schemas.checkoutSchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.checkout.create,
+      facts: () => ({}),
+      execute: async ({
+        input,
+        identity,
+        request
+      }) => {
+        mutations.requireAtomicTransactions(adapter);
+        const parsed = schemas.checkoutSchema.parse(input);
+        const owner = customerId(identity);
+        const fingerprint = await sha256(
+          JSON.stringify({ ...parsed, customerId: owner ?? null })
+        );
+        const previous = await adapter.findOne({
+          model: "ecommerceOrder",
+          where: [{ field: "idempotencyKey", value: parsed.idempotencyKey }]
+        });
+        if (previous) {
+          if (previous.checkoutFingerprint !== fingerprint)
+            mutations.ecommerceError(409, "Checkout key was already used for different details");
+          return checkoutResult(previous);
+        }
+        await config.hooks?.onBeforeCreateOrder?.(input, { request });
+        let existingCheckoutObserved = false;
+        let orderWriteStarted = false;
+        let order;
+        try {
+          for (const line of parsed.items)
+            await mutations.initializeInventory(adapter, line.productId, line.variantId);
+          order = await adapter.transaction(async (tx) => {
+            const existing = await tx.findOne({
+              model: "ecommerceOrder",
+              where: [
+                { field: "idempotencyKey", value: parsed.idempotencyKey }
+              ]
+            });
+            if (existing) {
+              existingCheckoutObserved = true;
+              if (existing.checkoutFingerprint !== fingerprint)
+                mutations.ecommerceError(
+                  409,
+                  "Checkout key was already used for different details"
+                );
+              return existing;
+            }
+            const lineItems = await mutations.reserveInventory(
+              tx,
+              parsed.items,
+              currency,
+              mediaAvailable
+            );
+            const subtotal = lineItems.reduce(
+              (sum, line) => sum + line.quantity * line.price,
+              0
+            );
+            let discount = 0;
+            let discountCodeId;
+            if (parsed.discountCode) {
+              const record = await tx.findOne({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "code", value: parsed.discountCode.toUpperCase() }
+                ]
+              });
+              if (!record) mutations.ecommerceError(400, "Discount code not found");
+              discount = discountAmount(record, subtotal);
+              const claimed = await tx.update({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "id", value: record.id },
+                  { field: "uses", value: record.uses }
+                ],
+                update: { uses: record.uses + 1 }
+              });
+              if (!claimed) mutations.ecommerceError(409, "Discount usage changed; retry checkout");
+              discountCodeId = record.id;
+            }
+            const total = subtotal - discount + shipping;
+            const rejection = config.paymentAdapter.validatePayment?.({
+              amount: total,
+              currency
+            });
+            if (rejection) mutations.ecommerceError(400, rejection);
+            orderWriteStarted = true;
+            return tx.create({
+              model: "ecommerceOrder",
+              data: {
+                email: parsed.email,
+                customerId: owner ?? null,
+                status: "pending",
+                lineItems: JSON.stringify(lineItems),
+                subtotal,
+                discount,
+                shipping,
+                total,
+                currency,
+                shippingAddress: JSON.stringify(parsed.shippingAddress),
+                paymentProvider: config.paymentAdapter.name ?? "custom",
+                paymentStatus: "pending",
+                paidHookDelivered: false,
+                paymentData: "{}",
+                accessToken: crypto.randomUUID(),
+                idempotencyKey: parsed.idempotencyKey,
+                checkoutFingerprint: fingerprint,
+                discountCodeId: discountCodeId ?? null,
+                inventoryReleased: false,
+                createdAt: /* @__PURE__ */ new Date(),
+                updatedAt: /* @__PURE__ */ new Date()
+              }
+            });
+          });
+        } catch (error) {
+          if (!existingCheckoutObserved && !orderWriteStarted && error instanceof api.OperationHttpError && error.code === "ECOMMERCE_ERROR" && [400, 404, 409].includes(error.statusCode)) {
+            throw new api.OperationHttpError(
+              error.statusCode,
+              error.message,
+              "CHECKOUT_NOT_CREATED",
+              error.issues
+            );
+          }
+          throw error;
+        }
+        return checkoutResult(order);
+      }
+    }),
+    listOrders: api.defineOperation({
+      input: schemas.ordersQuerySchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.order.read,
+      facts: () => ({}),
+      execute: async ({ input }) => {
+        const page = await getters.listOrders(adapter, input);
+        return { ...page, items: page.items.map(serializers.serializeOrder) };
+      }
+    }),
+    getOrder: api.defineOperation({
+      input: idSchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.order.read,
+      facts: ({ input }) => ({ id: input.id }),
+      execute: async ({ input }) => serializers.serializeOrder(
+        await getters.getOrder(adapter, input.id) ?? mutations.ecommerceError(404, "Order not found")
+      )
+    }),
+    listMyOrders: api.defineOperation({
+      input: schemas.ordersQuerySchema,
+      permission: plugins_ecommerce_permissions.ecommercePermissions.order.own,
+      facts: () => ({ customerId: "self" }),
+      execute: async ({ input, identity }) => {
+        const id = customerId(identity);
+        if (!id) mutations.ecommerceError(401, "Sign in to view your orders");
+        const page = await getters.listOrders(adapter, { ...input, customerId: id });
+        return { ...page, items: page.items.map(serializers.serializeOrder) };
+      }
+    }),
+    getOrderConfirmation: api.defineOperation({
+      input: idSchema.extend({ token: z.z.string().max(200) }),
+      permission: plugins_ecommerce_permissions.ecommercePermissions.order.confirmation,
+      facts: ({ input }) => ({ id: input.id }),
+      execute: async ({ input }) => {
+        const order = await getters.getOrder(adapter, input.id);
+        if (!order || order.accessToken !== input.token)
+          mutations.ecommerceError(404, "Order not found");
+        return serializers.serializeOrder(order);
+      }
+    }),
+    updateOrderStatus: api.defineOperation({
+      input: idSchema.extend({ status: schemas.orderStatusSchema }),
+      permission: plugins_ecommerce_permissions.ecommercePermissions.order.update,
+      facts: ({ input }) => ({ id: input.id }),
+      execute: async ({ input }) => {
+        mutations.requireAtomicTransactions(adapter);
+        return adapter.transaction(async (tx) => {
+          const order = await tx.findOne({
+            model: "ecommerceOrder",
+            where: [{ field: "id", value: input.id }]
+          });
+          if (!order) mutations.ecommerceError(404, "Order not found");
+          const next = {
+            pending: ["cancelled"],
+            paid: ["fulfilling", "cancelled"],
+            fulfilling: ["fulfilled", "cancelled"],
+            fulfilled: [],
+            cancelled: []
+          };
+          if (order.status === input.status) return serializers.serializeOrder(order);
+          if (!next[order.status]?.includes(input.status))
+            mutations.ecommerceError(409, "Invalid order status transition");
+          const updated = await tx.update({
+            model: "ecommerceOrder",
+            where: [
+              { field: "id", value: order.id },
+              { field: "status", value: order.status },
+              { field: "updatedAt", value: order.updatedAt }
+            ],
+            update: {
+              status: input.status,
+              inventoryReleased: input.status === "cancelled" ? true : order.inventoryReleased,
+              updatedAt: new Date(
+                Math.max(Date.now(), new Date(order.updatedAt).getTime() + 1)
+              )
+            }
+          });
+          if (!updated) mutations.ecommerceError(409, "Order changed; reload and retry");
+          if (input.status === "cancelled" && !order.inventoryReleased) {
+            await mutations.releaseInventory(tx, JSON.parse(order.lineItems));
+            if (order.paymentStatus === "pending" && order.discountCodeId)
+              await tx.incrementOne({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "id", value: order.discountCodeId },
+                  { field: "uses", value: 0, operator: "gt" }
+                ],
+                increment: { uses: -1 }
+              });
+          }
+          return serializers.serializeOrder(updated);
+        });
+      }
+    }),
+    handleWebhook: api.defineOperation({
+      input: z.z.object({}),
+      permission: plugins_ecommerce_permissions.ecommercePermissions.checkout.webhook,
+      access: "public",
+      facts: () => ({}),
+      execute: async ({ request }) => {
+        if (!request) mutations.ecommerceError(400, "Webhook requires the original HTTP request");
+        let event;
+        try {
+          event = await config.paymentAdapter.handleWebhook(request);
+        } catch {
+          mutations.ecommerceError(400, "Invalid payment webhook");
+        }
+        if (!event) return { received: true };
+        const parsed = z.z.object({
+          orderId: z.z.string().min(1),
+          status: z.z.enum(["paid", "failed", "refunded"]),
+          paymentRef: z.z.string().min(1),
+          amount: z.z.number().int().min(0),
+          currency: z.z.string().regex(/^[A-Za-z]{3}$/)
+        }).parse(event);
+        mutations.requireAtomicTransactions(adapter);
+        const paid = await adapter.transaction(async (tx) => {
+          const order = await tx.findOne({
+            model: "ecommerceOrder",
+            where: [{ field: "id", value: parsed.orderId }]
+          });
+          if (!order) mutations.ecommerceError(404, "Order not found");
+          if (order.paymentProvider !== (config.paymentAdapter.name ?? "custom") || order.total !== parsed.amount || order.currency.toUpperCase() !== parsed.currency.toUpperCase())
+            mutations.ecommerceError(400, "Payment does not match the order");
+          if (order.paymentRef && order.paymentRef !== parsed.paymentRef)
+            mutations.ecommerceError(409, "Payment reference does not match the order");
+          if (order.paymentStatus === parsed.status)
+            return parsed.status === "paid" && !order.paidHookDelivered ? serializers.serializeOrder(order) : null;
+          if (parsed.status === "paid" && order.status !== "pending")
+            mutations.ecommerceError(409, "Order is not awaiting payment");
+          if (parsed.status === "failed" && order.paymentStatus !== "pending")
+            return null;
+          if (parsed.status === "refunded" && order.paymentStatus !== "paid")
+            mutations.ecommerceError(409, "Only a paid order can be refunded");
+          const status = parsed.status === "paid" ? "paid" : "cancelled";
+          const updated = await tx.update({
+            model: "ecommerceOrder",
+            where: [
+              { field: "id", value: order.id },
+              { field: "paymentStatus", value: order.paymentStatus },
+              { field: "updatedAt", value: order.updatedAt }
+            ],
+            update: {
+              status,
+              paymentStatus: parsed.status,
+              paymentRef: parsed.paymentRef,
+              inventoryReleased: status === "cancelled" ? true : order.inventoryReleased,
+              updatedAt: new Date(
+                Math.max(Date.now(), new Date(order.updatedAt).getTime() + 1)
+              )
+            }
+          });
+          if (!updated) mutations.ecommerceError(409, "Order changed; retry webhook");
+          if (status === "cancelled" && !order.inventoryReleased) {
+            await mutations.releaseInventory(
+              tx,
+              JSON.parse(order.lineItems)
+            );
+            if (order.paymentStatus === "pending" && order.discountCodeId)
+              await tx.incrementOne({
+                model: "ecommerceDiscountCode",
+                where: [
+                  { field: "id", value: order.discountCodeId },
+                  { field: "uses", value: 0, operator: "gt" }
+                ],
+                increment: { uses: -1 }
+              });
+          }
+          return parsed.status === "paid" ? serializers.serializeOrder(updated) : null;
+        });
+        if (paid) {
+          await config.hooks?.onAfterOrderPaid?.(paid, { request });
+          await adapter.update({
+            model: "ecommerceOrder",
+            where: [
+              { field: "id", value: paid.id },
+              { field: "paymentRef", value: parsed.paymentRef },
+              { field: "paymentStatus", value: "paid" }
+            ],
+            update: { paidHookDelivered: true }
+          });
+        }
+        return { received: true };
+      }
+    })
+  };
+}
+
+exports.createEcommerceOperations = createEcommerceOperations;
+exports.discountValidationSchema = discountValidationSchema;