@carrierllc/mcp 0.13.40 → 0.13.47

package/templates/storefront/src/lib/verify-checkout-session.ts

@@ -1,16 +1,18 @@
 type StripeCheckoutSession = {
+  status?: string;
   payment_status?: string;
   customer_email?: string | null;
   customer_details?: { email?: string | null };
+  metadata?: { storefront_id?: string; templateId?: string };
 };
 
 function sessionPurchaserEmail(session: StripeCheckoutSession): string | null {
   return session.customer_details?.email ?? session.customer_email ?? null;
 }
 
-type VerifyResult =
+export type VerifyResult =
   | { ok: true; orderId: string; purchaserEmail: string | null }
-  | { ok: false };
+  | { ok: false; status: "processing" | "unpaid" | "unavailable" | "rejected" };
 
 /**
  * Stripe Checkout session ids are opaque tokens (`cs_test_…` / `cs_live_…`).
@@ -20,6 +22,8 @@ type VerifyResult =
  * encode before interpolation.
  */
 const STRIPE_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,256}$/;
+const STOREFRONT_ID_RE = /^sf_[A-Za-z0-9_-]{20}$/;
+const STOREFRONT_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
 
 function safeStripeSessionId(sessionId: string): string | null {
   if (typeof sessionId !== "string" || !STRIPE_SESSION_ID_RE.test(sessionId)) {
@@ -29,42 +33,137 @@ function safeStripeSessionId(sessionId: string): string | null {
 }
 
 /**
- * Confirms a Stripe Checkout session is paid before allowing post-payment flows.
- * Mock sessions are only accepted when Stripe is not configured (local/dev builds).
+ * The shop this deployment sells for.
+ *
+ * `null` is a legacy storefront with no hosted slug. `"unavailable"` means a
+ * slug is configured but the canonical id could not be read — fail closed.
+ */
+async function currentStorefrontId(): Promise<string | null | "unavailable"> {
+  const slug = process.env.NEXT_PUBLIC_STOREFRONT_SLUG?.trim() ?? "";
+  if (!slug) return null;
+  if (!STOREFRONT_SLUG_RE.test(slug)) return "unavailable";
+  const base = (process.env.NEXT_PUBLIC_CARRIER_API_URL ?? "").replace(/\/+$/, "");
+  if (!base) return "unavailable";
+
+  let response: Response;
+  try {
+    response = await fetch(`${base}/api/hosted/${encodeURIComponent(slug)}`, { cache: "no-store" });
+  } catch {
+    return "unavailable";
+  }
+  if (!response.ok) return "unavailable";
+
+  let shop: { id?: unknown; slug?: unknown };
+  try {
+    shop = (await response.json()) as { id?: unknown; slug?: unknown };
+  } catch {
+    return "unavailable";
+  }
+  if (!shop || typeof shop !== "object") return "unavailable";
+  if (typeof shop.id !== "string" || !STOREFRONT_ID_RE.test(shop.id) || shop.slug !== slug) {
+    return "unavailable";
+  }
+  return shop.id;
+}
+
+type ShopMatch = "match" | "mismatch" | "unavailable";
+
+/**
+ * A failed shop lookup is unavailable. A lookup that succeeds and disagrees
+ * with the session is a mismatch. Those are different buyer states.
+ */
+async function sessionShopMatch(
+  session: StripeCheckoutSession,
+  templateId: string,
+): Promise<ShopMatch> {
+  const current = await currentStorefrontId();
+  if (current === "unavailable") return "unavailable";
+  const metaTemplate = session.metadata?.templateId ?? "";
+  const sessionStoreId = session.metadata?.storefront_id ?? "";
+  const samePlan = metaTemplate.length > 0 && metaTemplate === templateId;
+  const sameStore = current === null ? sessionStoreId === "" : sessionStoreId === current;
+  return samePlan && sameStore ? "match" : "mismatch";
+}
+
+function paymentSettled(paymentStatus: string | undefined): boolean {
+  return paymentStatus === "paid" || paymentStatus === "no_payment_required";
+}
+
+/**
+ * Confirms a Stripe Checkout session is paid for this shop and this plan.
+ *
+ * `session_id=mock` is never a payment. `no_payment_required` counts as paid.
+ * A settled session whose `metadata.storefront_id` or `metadata.templateId`
+ * belongs to another shop is rejected with no purchaser email. A shop lookup
+ * that fails, or a non-JSON shop response, is unavailable. A completed
+ * session that is still unpaid is processing. An open or expired unpaid
+ * session did not go through. A failed Stripe read is unavailable.
  */
 export async function verifyCheckoutSession(
   sessionId: string,
   templateId: string,
 ): Promise<VerifyResult> {
-  if (sessionId === "mock") {
-    if (process.env.STRIPE_SECRET_KEY || !templateId) {
-      return { ok: false };
-    }
-    return { ok: true, orderId: templateId, purchaserEmail: null };
+  if (sessionId === "mock" || templateId.length > 256) {
+    return { ok: false, status: "rejected" };
   }
 
   const safeSessionId = safeStripeSessionId(sessionId);
   if (!safeSessionId) {
-    return { ok: false };
+    return { ok: false, status: "rejected" };
   }
 
   const stripeKey = process.env.STRIPE_SECRET_KEY;
   if (!stripeKey) {
-    return { ok: false };
+    return { ok: false, status: "unavailable" };
   }
 
-  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
-    headers: { Authorization: `Bearer ${stripeKey}` },
-  });
+  let resp: Response;
+  try {
+    resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
+      headers: { Authorization: `Bearer ${stripeKey}` },
+    });
+  } catch {
+    return { ok: false, status: "unavailable" };
+  }
 
   if (!resp.ok) {
-    return { ok: false };
+    return { ok: false, status: "unavailable" };
+  }
+
+  let session: StripeCheckoutSession;
+  try {
+    session = (await resp.json()) as StripeCheckoutSession;
+  } catch {
+    return { ok: false, status: "unavailable" };
+  }
+  if (!session || typeof session !== "object") {
+    return { ok: false, status: "unavailable" };
+  }
+
+  const settled = paymentSettled(session.payment_status);
+  const awaiting = session.status === "complete" && session.payment_status === "unpaid";
+  if (settled || awaiting) {
+    const match = await sessionShopMatch(session, templateId);
+    switch (match) {
+      case "unavailable":
+        return { ok: false, status: "unavailable" };
+      case "mismatch":
+        return { ok: false, status: "rejected" };
+      case "match":
+        if (settled) {
+          return { ok: true, orderId: sessionId, purchaserEmail: sessionPurchaserEmail(session) };
+        }
+        return { ok: false, status: "processing" };
+      default: {
+        const unhandled: never = match;
+        return unhandled;
+      }
+    }
   }
 
-  const session = (await resp.json()) as StripeCheckoutSession;
-  if (session.payment_status !== "paid") {
-    return { ok: false };
+  if (session.status === "expired" || session.payment_status === "unpaid") {
+    return { ok: false, status: "unpaid" };
   }
 
-  return { ok: true, orderId: sessionId, purchaserEmail: sessionPurchaserEmail(session) };
+  return { ok: false, status: "unavailable" };
 }

package/templates/storefront/src/middleware.ts

@@ -4,6 +4,10 @@
 // the template's cf:build in the npm Release job. middleware.ts still runs on
 // the Edge runtime that the Cloudflare/OpenNext build supports.
 import { clerkMiddleware, createRouteMatcher } from "@clerk/nextjs/server";
+import { applyClerkInstanceEnv } from "@/lib/clerk-instance";
+import { buyerPendingTasksAllowed, pendingSessionTasks } from "@/lib/buyer-session";
+
+applyClerkInstanceEnv();
 
 const isPublicRoute = createRouteMatcher([
   "/",
@@ -24,6 +28,13 @@ const isPublicRoute = createRouteMatcher([
 
 export default clerkMiddleware(async (auth, req) => {
   if (!isPublicRoute(req)) {
+    const { userId, sessionId, sessionStatus } = await auth({ treatPendingAsSignedOut: false });
+    const buyerPending =
+      Boolean(userId) &&
+      sessionStatus === "pending" &&
+      Boolean(sessionId) &&
+      buyerPendingTasksAllowed((await pendingSessionTasks(sessionId ?? "")) ?? []);
+    if (userId && (sessionStatus !== "pending" || buyerPending)) return;
     await auth.protect();
   }
 });

package/templates/storefront/src/vendor/carrier/catalog-guard.ts

@@ -7,6 +7,7 @@
  */
 import type { SkuTemplate } from "./types";
 import type { TemplateCatalog } from "./client";
+import { isStripePriceId } from "./stripe-price";
 
 /** Codes the storefront maps to customer-facing copy. Never shown verbatim. */
 export type CheckoutRefusalCode = "plan_not_found" | "catalog_degraded" | "plan_not_sellable";
@@ -16,19 +17,22 @@ export type CheckoutDecision =
   | { ok: false; status: number; code: CheckoutRefusalCode; error: string };
 
 /**
- * A price is only chargeable when it is a whole, positive number of minor
- * units and the currency is a plain ISO-4217 code. The guest route builds the
- * Stripe line item inline from these two fields (price_data, no price id), so
- * Stripe validates nothing on our behalf — this is the only check there is.
+ * A plan is only chargeable when the catalog row is a real product and it
+ * names the Stripe Price checkout will charge. The guest route sends that
+ * Price id. It does not send an inline amount, so a row with no Price id
+ * has nothing Stripe can charge.
  */
 function isSellable(plan: SkuTemplate): boolean {
   return (
+    plan.fixture !== true &&
+    !plan.id.startsWith("fixture-") &&
     Number.isSafeInteger(plan.price_cents) &&
     plan.price_cents > 0 &&
     typeof plan.currency === "string" &&
     /^[A-Za-z]{3}$/.test(plan.currency) &&
     typeof plan.name === "string" &&
-    plan.name.trim().length > 0
+    plan.name.trim().length > 0 &&
+    isStripePriceId(plan.stripe_price_id)
   );
 }
 

package/templates/storefront/src/vendor/carrier/client.ts

@@ -12,7 +12,9 @@
  * to a charge must read `source`, not just the array. `fetchTemplates()` keeps
  * the plain-array shape for the pages that only render.
  */
+import { countryCatalogMode, withCountryCodes } from "../../lib/catalog-countries";
 import type { EsimOrder, EsimUsage, SkuTemplate, TopUpOption } from "./types";
+import { overlayStripePrices } from "./stripe-price";
 
 const MOCK_TEMPLATES: SkuTemplate[] = [
   {
@@ -111,7 +113,11 @@ function orderPath(orderId: string, action = ""): string | null {
 }
 
 function sampleCatalog(reason: CatalogDegradedReason): TemplateCatalog {
-  return { templates: MOCK_TEMPLATES, source: "sample", reason };
+  return {
+    templates: withCountryCodes(MOCK_TEMPLATES, countryCatalogMode(process.env.NEXT_PUBLIC_COUNTRY_CATALOG)),
+    source: "sample",
+    reason,
+  };
 }
 
 /**
@@ -127,7 +133,9 @@ export async function fetchTemplateCatalog(): Promise<TemplateCatalog> {
     const templatesPath = slug
       ? `/api/templates?storefront=${encodeURIComponent(slug)}`
       : "/api/templates";
+    const key = apiKey();
     const res = await fetch(`${base}${templatesPath}`, {
+      headers: key ? { Authorization: `Bearer ${key}` } : {},
       next: slug
         ? { revalidate: CATALOG_REVALIDATE_SECONDS, tags: [`storefront:${slug}`] }
         : { revalidate: CATALOG_REVALIDATE_SECONDS },
@@ -137,15 +145,25 @@ export async function fetchTemplateCatalog(): Promise<TemplateCatalog> {
     if (!Array.isArray(templates) || templates.length === 0) {
       return sampleCatalog("upstream-error");
     }
-    return { templates, source: "live" };
+    return {
+      templates: withCountryCodes(templates, countryCatalogMode(process.env.NEXT_PUBLIC_COUNTRY_CATALOG)),
+      source: "live",
+    };
   } catch {
     return sampleCatalog("network-error");
   }
 }
 
-/** Render-only convenience. Do not use on any path that creates a charge. */
+/**
+ * Render-only convenience. Do not use on any path that creates a charge.
+ *
+ * When a test-mode Stripe key is set, each plan's displayed amount is the
+ * live Price `unit_amount`, not the catalog copy. Checkout still sends the
+ * Price id, so an edit in Stripe changes the page and the charge together.
+ */
 export async function fetchTemplates(): Promise<SkuTemplate[]> {
-  return (await fetchTemplateCatalog()).templates;
+  const catalog = await fetchTemplateCatalog();
+  return overlayStripePrices(catalog.templates);
 }
 
 export async function createCheckoutSession(

package/templates/storefront/src/vendor/carrier/country-offers.ts

@@ -0,0 +1,106 @@
+/**
+ * One searchable row per country a plan covers.
+ *
+ * Same contract as `countryOffers` in
+ * `packages/storefront-runtime/src/countries.ts`: two-letter codes only,
+ * one row per code, cheapest catalogue price unconverted, no invented
+ * coverage. The template ships a copy because a scaffold is installed
+ * outside the monorepo. `storefront-country-search.test.js` fails if the
+ * two disagree.
+ */
+
+const regionNames = new Intl.DisplayNames(["en"], { type: "region" });
+
+export interface CountryOffer {
+  code: string;
+  name: string;
+  planIds: string[];
+  cheapestPlanId: string | null;
+  fromCents: number | null;
+  currency: string | null;
+}
+
+interface CoverablePlan {
+  id: string;
+  priceCents: number;
+  currency: string;
+  regions: string[];
+}
+
+function countryLabel(code: string): string {
+  const upper = code.trim().toUpperCase();
+  if (!/^[A-Z]{2}$/.test(upper)) return upper;
+  try {
+    const label = regionNames.of(upper);
+    if (!label || label.toUpperCase() === upper) return upper;
+    return label;
+  } catch {
+    return upper;
+  }
+}
+
+export function countryOffers(plans: CoverablePlan[]): CountryOffer[] {
+  const byCode = new Map<string, CoverablePlan[]>();
+  for (const plan of plans) {
+    for (const raw of plan.regions) {
+      const code = raw.trim().toUpperCase();
+      if (!/^[A-Z]{2}$/.test(code) || code === "ZZ") continue;
+      const list = byCode.get(code) ?? [];
+      if (!list.includes(plan)) list.push(plan);
+      byCode.set(code, list);
+    }
+  }
+  const offers: CountryOffer[] = [];
+  for (const [code, list] of byCode) {
+    const currencies = new Set(list.map((plan) => plan.currency.toUpperCase()));
+    const single = currencies.size === 1;
+    const cheapest = single ? list.reduce((a, b) => (b.priceCents < a.priceCents ? b : a)) : null;
+    offers.push({
+      code,
+      name: countryLabel(code),
+      planIds: list.map((plan) => plan.id),
+      cheapestPlanId: cheapest?.id ?? null,
+      fromCents: cheapest?.priceCents ?? null,
+      currency: single ? [...currencies][0] ?? null : null,
+    });
+  }
+  return offers.sort((a, b) => a.name.localeCompare(b.name, "en"));
+}
+
+/** Names buyers type that are not the Intl label. */
+const SEARCH_ALIASES: Record<string, string> = {
+  turkey: "TR",
+  "czech republic": "CZ",
+  uk: "GB",
+  usa: "US",
+  uae: "AE",
+  holland: "NL",
+};
+
+/** Shown before the buyer types, in this order, and only when the catalog sells them. */
+export const POPULAR_COUNTRY_CODES = ["DE", "FR", "ES", "IT", "GB", "US", "JP", "TR", "NL", "TH"] as const;
+
+export function filterCountryOffers(offers: CountryOffer[], query: string): CountryOffer[] {
+  const needle = fold(query);
+  if (needle === "") return offers;
+  const alias = SEARCH_ALIASES[needle];
+  // An exact alias is that country. "UK" must not also match Ukraine.
+  if (alias) return offers.filter((offer) => offer.code === alias || fold(offer.name) === needle);
+  return offers.filter(
+    (offer) => fold(offer.name).includes(needle) || offer.code.toLowerCase() === needle,
+  );
+}
+
+export function visibleCountryOffers(offers: CountryOffer[], query: string): CountryOffer[] {
+  if (fold(query) === "") {
+    const rank = new Map<string, number>(POPULAR_COUNTRY_CODES.map((code, index) => [code, index]));
+    return offers
+      .filter((offer) => rank.has(offer.code))
+      .sort((a, b) => (rank.get(a.code) ?? 0) - (rank.get(b.code) ?? 0));
+  }
+  return filterCountryOffers(offers, query);
+}
+
+function fold(value: string): string {
+  return value.normalize("NFD").replace(/[\u0300-\u036f]/g, "").trim().toLowerCase();
+}

package/templates/storefront/src/vendor/carrier/stripe-price.ts

@@ -0,0 +1,134 @@
+/**
+ * The amount on the page is the Stripe Price checkout will charge.
+ *
+ * Catalog `price_cents` is only a sellability record. A Price edited in
+ * Stripe test mode must show up on the next render, so display reads
+ * `unit_amount` from that Price and the Checkout Session sends the Price id.
+ * Live keys are refused: this template does not create live charges.
+ */
+import { formatPrice } from "../geo/index";
+import type { SkuTemplate } from "./types";
+
+/** Stripe Price ids we will put on a Checkout Session. */
+export const STRIPE_PRICE_ID_RE = /^price_[A-Za-z0-9_]+$/;
+
+export interface StripePriceSnapshot {
+  id: string;
+  unit_amount: number | null;
+  currency: string;
+}
+
+export function isStripePriceId(value: unknown): value is string {
+  return typeof value === "string" && STRIPE_PRICE_ID_RE.test(value);
+}
+
+/** A live secret must never reach Stripe from this template. */
+export function isLiveStripeKey(secret: string | undefined): boolean {
+  return typeof secret === "string" && (secret.startsWith("sk_live_") || secret.startsWith("rk_live_"));
+}
+
+export function isTestStripeKey(secret: string | undefined): secret is string {
+  return typeof secret === "string" && (secret.startsWith("sk_test_") || secret.startsWith("rk_test_"));
+}
+
+/**
+ * Replace the catalog amount with the Price checkout charges.
+ *
+ * A snapshot for a different Price id is ignored. A Price that cannot be
+ * read does not fall back to the catalog amount: the page shows unavailable.
+ */
+export function applyStripePrice(plan: SkuTemplate, price: StripePriceSnapshot | null): SkuTemplate {
+  if (!isStripePriceId(plan.stripe_price_id)) return plan;
+  const readable =
+    price !== null &&
+    price.id === plan.stripe_price_id &&
+    price.unit_amount !== null &&
+    Number.isSafeInteger(price.unit_amount) &&
+    price.unit_amount > 0 &&
+    /^[A-Za-z]{3}$/.test(price.currency);
+  if (!readable || !price || price.unit_amount === null) {
+    return { ...plan, price_unavailable: true };
+  }
+  return {
+    ...plan,
+    price_cents: price.unit_amount,
+    currency: price.currency.toUpperCase(),
+    price_unavailable: false,
+  };
+}
+
+/** What the plan card renders. `unitAmount` is the Stripe Price `unit_amount`. */
+export function chargedPagePrice(
+  plan: SkuTemplate,
+  price: StripePriceSnapshot | null,
+): { unitAmount: number | null; currency: string; label: string } {
+  const charged = applyStripePrice(plan, price);
+  if (charged.price_unavailable) {
+    return { unitAmount: null, currency: charged.currency, label: "Unavailable" };
+  }
+  return {
+    unitAmount: charged.price_cents,
+    currency: charged.currency,
+    label: formatPrice(charged.price_cents, charged.currency),
+  };
+}
+
+/** Checkout Session line item. The Price id, never inline `price_data`. */
+export function checkoutPriceFields(plan: SkuTemplate): Record<string, string> | null {
+  if (plan.price_unavailable === true || !isStripePriceId(plan.stripe_price_id)) return null;
+  return {
+    "line_items[0][price]": plan.stripe_price_id,
+    "line_items[0][quantity]": "1",
+  };
+}
+
+export async function overlayStripePrices(
+  plans: SkuTemplate[],
+  deps: { secret?: string; fetchImpl?: typeof fetch } = {},
+): Promise<SkuTemplate[]> {
+  const secret = deps.secret ?? process.env.STRIPE_SECRET_KEY;
+  // Only a test key may be sent to Stripe. A live key, or a non-Stripe
+  // placeholder used by unit tests, leaves the catalog amount on the page.
+  if (!isTestStripeKey(secret)) return plans;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const cache = new Map<string, StripePriceSnapshot | null>();
+  const priced: SkuTemplate[] = [];
+  for (const plan of plans) {
+    const id = plan.stripe_price_id;
+    if (!isStripePriceId(id)) {
+      priced.push(plan);
+      continue;
+    }
+    let snapshot = cache.get(id);
+    if (snapshot === undefined) {
+      snapshot = await readStripePrice(id, secret, fetchImpl);
+      cache.set(id, snapshot);
+    }
+    priced.push(applyStripePrice(plan, snapshot));
+  }
+  return priced;
+}
+
+async function readStripePrice(
+  id: string,
+  secret: string,
+  fetchImpl: typeof fetch,
+): Promise<StripePriceSnapshot | null> {
+  try {
+    const resp = await fetchImpl(`https://api.stripe.com/v1/prices/${encodeURIComponent(id)}`, {
+      headers: { Authorization: `Bearer ${secret}` },
+      cache: "no-store",
+    });
+    if (!resp.ok) return null;
+    const body = (await resp.json()) as {
+      id?: unknown;
+      unit_amount?: unknown;
+      currency?: unknown;
+    };
+    if (typeof body.id !== "string" || typeof body.currency !== "string") return null;
+    const unitAmount = typeof body.unit_amount === "number" ? body.unit_amount : null;
+    return { id: body.id, unit_amount: unitAmount, currency: body.currency };
+  } catch {
+    return null;
+  }
+}