@hartl-services/medusa-base 2.9.0 → 2.11.0

package/README.md

@@ -1436,6 +1436,11 @@ Options of the `email` namespace:
   `orderNotificationEmail` mailbox. `verifyAccountUrl` (optional builder,
   like `passwordResetUrl`; the mail appends `#token=`) is the storefront page
   that confirms an account, needed while `customer_verification` is on.
+  `adminPasswordResetUrl` (optional builder, receives `{ token }`) is the
+  Medusa Admin's "choose a new password" page; without it an Admin user's
+  password reset fails with `render_failed`. `buildFoodShopConfig` sets
+  `<MEDUSA_BACKEND_URL>/app/reset-password?token=<token>` (the dashboard reads
+  the token from the query).
   `adminAffiliateApplicationsUrl` (optional builder, receives
   `{ applicationId }`) is the Admin page of the partner applications; the
   notification about a new application shows its "Im Admin prüfen" button
@@ -1539,7 +1544,7 @@ feature is switched on again.
 | --------------------- | ---------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------- |
 | (plugin switch)       | E-Mail                 | on      | every route under `/admin/email/*` (mail log, resends, attachments; 404); jobs `email-reconcile-attempts`, `email-reconcile-pending-messages`, `email-retry-messages`; every feature below                            | checkout and orders; already queued messages stay stored |
 | `order_mails`         | Bestell-Mails          | on      | subscribers `order-placed`, `email-shipment-created`, `email-order-canceled`, `return-requested`, `return-received`, `documents-shipment-invoice-assignment-decided`, `documents-order-cancellation-ready`, `documents-refund-ready`; route `/admin/draft-orders/:id/order-confirmation` (404) and its draft-order widget | jobs, Admin routes, already created messages             |
-| `account_mails`       | Konto-Mails            | on      | subscribers `password-reset`, `user-invite`, `customer-verification` (the last one only with `customer_verification` on as well); not the login code mail, which depends on neither this feature nor the plugin switch (see "Kunden-Login") | jobs, Admin routes, already created messages             |
+| `account_mails`       | Konto-Mails            | on      | subscribers `password-reset` (customers and Admin users), `user-invite`, `customer-verification` (the last one only with `customer_verification` on as well); not the login code mail, which depends on neither this feature nor the plugin switch (see "Kunden-Login") | jobs, Admin routes, already created messages             |
 | `customer_verification` | Kontobestätigung per E-Mail | off | Medusa's e-mail verification of customer logins (see "Kontobestätigung per E-Mail"), route `POST /store/customer-verification/resend` (404 while off), subscriber `customer-verification`; child of `account_mails` | checkout and orders; confirmed accounts stay confirmed, already created messages |
 | `affiliate_reminders` | Affiliate-Mails        | on      | subscribers `affiliate-consignment-reminder-due` (reminders to affiliates) and `affiliate-application-submitted` (notification to the shop about a new partner application)                                              | jobs, Admin routes, already created messages             |
 
@@ -1826,9 +1831,10 @@ has at most 35 characters. Email runtime-validates every contract before use.
 
 - The accepted kinds are exactly `order.received`, `order.received.admin`, `order.shipped`,
   `order.canceled`, `order.return_requested`, `order.return_received`,
-  `order.refunded`, `auth.password_reset`, `auth.verification`,
-  `auth.login_code`, `affiliate.consignment_report_due`,
-  `affiliate.application_submitted.admin` and `user.invite`.
+  `order.refunded`, `auth.password_reset`, `auth.admin_password_reset`,
+  `auth.verification`, `auth.login_code`, `affiliate.consignment_report_due`,
+  `affiliate.application_submitted.admin`, `user.invite` and
+  `system.credential_expiry.admin`.
 - Every automatic message has a deterministic business key.
 - Every placed Order creates independent customer and Shop intents. The customer
   intent honors `no_notification`; the Shop intent always targets the static
@@ -1914,7 +1920,7 @@ an info box lists number, customer, e-mail and order time, followed by an
 button is left out without it) and `timeZone` (IANA; the order time is left
 out without it). `buildFoodShopConfig` sets both (`<MEDUSA_BACKEND_URL>/app/
 orders/<id>` and its `timeZone` option). The layout receives `audience`
-(`"shop"` for this kind, `affiliate.application_submitted.admin` and `user.invite`, `"customer"` for all others) and
+(`"shop"` for this kind, `affiliate.application_submitted.admin`, `system.credential_expiry.admin`, `user.invite` and `auth.admin_password_reset`, `"customer"` for all others) and
 shows the contact line only to customers.
 
 The shipping confirmation (`order.shipped`, one per fulfillment) receives a
@@ -1978,6 +1984,20 @@ without `iat`) and a note that the mail can be ignored. The lifetime is
 passed as the ephemeral `valid_minutes` next to `reset_url` and is never
 persisted.
 
+The same Medusa event with `actor_type: "user"` (the Admin's "Passwort
+zurücksetzen" at `/app/reset-password`) becomes its own kind,
+`auth.admin_password_reset`, with its own Admin template: subject "Neues
+Passwort für den Admin-Bereich von <displayName>", the same button, link text,
+lifetime and ignore note, and the link from `adminPasswordResetUrl` (the token
+in the query). It is sent only when exactly one Admin user has the address:
+the `emailpass` identity is shared by all actor types, so a customer could ask
+for an Admin reset of their own identity, and that request is ignored
+(`no_admin_user`). A token whose `actor_type` differs from the event's is
+ignored as `invalid_token`; every other actor type stays `invalid_event`. Like
+the customer reset it is gated by `account_mails`, ephemeral (never resent or
+retried by the generic job) and stored with `resource_type` `"user"`; its
+layout audience is `"shop"`.
+
 The account confirmation (`auth.verification`) has the subject "Bestätige
 deine E-Mail-Adresse", a "E-Mail-Adresse bestätigen" button, the link as
 copyable text, a note that the link is only valid for a limited time (a new
@@ -2374,10 +2394,24 @@ separate documents package since 1.0.0.
   persists the customer company, customer UID and exemption wording in that
   same snapshot. B2C and non-eligible evidence add no tax-proof statement.
 - Freezes a tax breakdown (`totals.tax_breakdown`) grouped by the order's
-  item and shipping tax-line name and rate, as configured on the Medusa tax
-  region. Amounts are rounded to the currency and add up exactly to the
-  tax total; cancellations scale it proportionally. Snapshots issued before
-  this field existed read as an empty breakdown.
+  item tax-line name and rate, as configured on the Medusa tax region, with
+  the tax and the net amount (`taxable_amount`, after discounts) per rate.
+  Shipping follows the items: a shipping tax line with the code
+  `APPORTIONED_SHIPPING_TAX_CODE` (`/lib`; Tax Compliance's "Anteilige
+  Versandsteuer") is split back onto the item rates by the items' net
+  amount after discounts, the key Tax Compliance weights it by, so the
+  invoice never prints a weighted rate. Other shipping tax joins the items'
+  row when the cart has one item rate equal to it, otherwise it keeps its
+  own row.
+  Amounts are rounded to the currency and add up exactly to the tax total;
+  cancellations scale them proportionally. Snapshots issued before these
+  fields existed read as an empty breakdown or without net amounts.
+- Prints net amounts before discounts: line unit price and "Summe",
+  "Zwischensumme" (items), "Versand" (before a free-shipping promotion),
+  then all promotions as one net "Rabatt" (only when there is a discount),
+  the tax rows and the gross "Gesamt"; the rows add up to the total. With
+  several tax rates each tax row also names its net amount ("AT Reduziert
+  10 % auf € 55,00").
 - Persists one immutable decision per shipped Fulfillment. A leased, Order-
   unique coordinator chooses exactly one invoice carrier without assuming
   event delivery order; all other shipments become `non_carrier`.

package/dist/documents/templates/financial-document.js

@@ -63,7 +63,7 @@ const renderLines = (input, timeZone) => input.lines
         </td>
         <td class="number quantity">${(0, lib_1.escapeHtml)(line.quantity)}</td>
         <td class="number">${(0, html_utils_1.renderMoney)(line.unit_price)}</td>
-        <td class="number">${(0, html_utils_1.renderMoney)(line.total)}</td>
+        <td class="number">${(0, html_utils_1.renderMoney)(line.subtotal)}</td>
       </tr>`)
     .join("");
 const isExemptIntraCommunitySupply = (input) => input.order.tax_compliance?.exemption_wording ===
@@ -93,11 +93,30 @@ const formatTaxRate = (rate) => new Intl.NumberFormat(format_1.DEFAULT_FORMAT_LO
 }).format(rate / 100);
 /** One totals row below the Menge/Einzelpreis columns; the amount sits under "Summe". */
 const renderTotalRow = (label, value, className) => `<tr${className ? ` class="${className}"` : ""}><td class="spacer"></td><td class="label" colspan="2">${(0, lib_1.escapeHtml)(label)}</td><td class="number">${value}</td></tr>`;
+/** No discount, no row. */
+const renderDiscountRow = (input) => Number(input.totals.discount_total.amount) === 0
+    ? ""
+    : renderTotalRow("Rabatt", renderDiscountTotal(input));
+/**
+ * One row per tax rate. With several rates each row also names its net
+ * amount, since an invoice states the amount taxed at every rate.
+ */
 const renderTaxRows = (input) => {
     const { tax_breakdown: breakdown, tax_total: taxTotal } = input.totals;
+    const withNetAmount = breakdown.length > 1;
     const rows = breakdown.length > 0
         ? breakdown.map((entry) => ({
-            label: `${entry.name} ${formatTaxRate(entry.rate)}`,
+            label: [
+                `${entry.name} ${formatTaxRate(entry.rate)}`,
+                withNetAmount && entry.taxable_amount
+                    ? `auf ${(0, format_1.formatMoney)({
+                        amount: entry.taxable_amount.amount,
+                        currencyCode: entry.taxable_amount.currency_code,
+                    })}`
+                    : null,
+            ]
+                .filter((part) => Boolean(part))
+                .join(" "),
             money: entry.tax_total,
         }))
         : [{ label: "Umsatzsteuer", money: taxTotal }];
@@ -141,7 +160,7 @@ const renderFinancialDocument = (input, layout, timeZone) => {
       <tbody class="totals">
         ${renderTotalRow("Zwischensumme", (0, html_utils_1.renderMoney)(totals.subtotal))}
         ${renderTotalRow("Versand", (0, html_utils_1.renderMoney)(totals.shipping_total))}
-        ${renderTotalRow("Rabatt", renderDiscountTotal(input))}
+        ${renderDiscountRow(input)}
         ${renderTaxRows(input)}
         ${renderTotalRow("Gesamt", (0, html_utils_1.renderMoney)(totals.total), "grand-total")}
       </tbody>

package/dist/documents/types/documents.d.ts

@@ -40,13 +40,20 @@ export type DocumentTaxBreakdownEntry = {
     code: string | null;
     rate: number;
     tax_total: DocumentMoney;
+    /**
+     * Net amount taxed at this rate (items and their share of shipping, after
+     * discounts). Missing in snapshots issued before it was recorded.
+     */
+    taxable_amount?: DocumentMoney;
 };
 export type DocumentTemplateLine = {
     id: string;
     title: string;
     sku: string | null;
     quantity: number;
+    /** Net, before discounts (older invoice snapshots: Medusa's unit price). */
     unit_price: DocumentMoney;
+    /** Net, before discounts; printed under "Summe". */
     subtotal: DocumentMoney;
     tax_total: DocumentMoney;
     total: DocumentMoney;
@@ -74,6 +81,12 @@ export type DocumentTemplateInput = {
         tax_compliance: DocumentTaxComplianceDTO | null;
     };
     lines: DocumentTemplateLine[];
+    /**
+     * Subtotal (items) and shipping are net amounts before discounts, the
+     * discount is net, so they add up with the tax to the total. Older invoice
+     * snapshots carry Medusa's order subtotal (items plus shipping) and gross
+     * shipping and discount totals.
+     */
     totals: {
         subtotal: DocumentMoney;
         tax_total: DocumentMoney;

package/dist/email/types/email-kinds.d.ts

@@ -1,5 +1,5 @@
 import { z } from "@medusajs/framework/zod";
-export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "affiliate.application_submitted.admin", "user.invite", "auth.verification", "auth.login_code", "system.credential_expiry.admin"];
+export declare const EMAIL_KINDS: readonly ["order.received", "order.received.admin", "order.shipped", "order.canceled", "order.return_requested", "order.return_received", "order.refunded", "auth.password_reset", "affiliate.consignment_report_due", "affiliate.application_submitted.admin", "user.invite", "auth.verification", "auth.login_code", "system.credential_expiry.admin", "auth.admin_password_reset"];
 export declare const EmailKindSchema: z.ZodEnum<{
     "order.received": "order.received";
     "order.received.admin": "order.received.admin";
@@ -15,6 +15,7 @@ export declare const EmailKindSchema: z.ZodEnum<{
     "auth.verification": "auth.verification";
     "auth.login_code": "auth.login_code";
     "system.credential_expiry.admin": "system.credential_expiry.admin";
+    "auth.admin_password_reset": "auth.admin_password_reset";
 }>;
 export type EmailKind = (typeof EMAIL_KINDS)[number];
 /**
@@ -22,5 +23,5 @@ export type EmailKind = (typeof EMAIL_KINDS)[number];
  * subscriber builds the mail from the event, so neither the generic retry
  * job, the automatic dispatch nor an Admin resend may touch them.
  */
-export declare const EPHEMERAL_EMAIL_KINDS: readonly ["auth.password_reset", "auth.verification", "auth.login_code"];
+export declare const EPHEMERAL_EMAIL_KINDS: readonly ["auth.password_reset", "auth.admin_password_reset", "auth.verification", "auth.login_code"];
 export declare const isEphemeralEmailKind: (kind: EmailKind) => boolean;

package/dist/email/types/email-kinds.js

@@ -17,6 +17,7 @@ exports.EMAIL_KINDS = [
     "auth.verification",
     "auth.login_code",
     "system.credential_expiry.admin",
+    "auth.admin_password_reset",
 ];
 exports.EmailKindSchema = zod_1.z.enum(exports.EMAIL_KINDS);
 /**
@@ -26,6 +27,7 @@ exports.EmailKindSchema = zod_1.z.enum(exports.EMAIL_KINDS);
  */
 exports.EPHEMERAL_EMAIL_KINDS = [
     "auth.password_reset",
+    "auth.admin_password_reset",
     "auth.verification",
     "auth.login_code",
 ];

package/dist/email/types/shop-configuration.d.ts

@@ -48,6 +48,14 @@ export type ShopEmailConfiguration = Readonly<{
     adminAffiliateApplicationsUrl?: (input: Readonly<{
         applicationId: string;
     }>) => string;
+    /**
+     * The Medusa Admin's "choose a new password" page with the reset token
+     * (`/app/reset-password?token=<token>`). Without it an Admin user's
+     * password reset sends no mail.
+     */
+    adminPasswordResetUrl?: (input: Readonly<{
+        token: string;
+    }>) => string;
     affiliatePortalUrl: string;
     displayName: string;
     inviteUrl: (input: Readonly<{

package/dist/email/types/template-data.d.ts

@@ -381,6 +381,7 @@ export declare const EmailPersistedDataSchemas: {
         client_id: z.ZodString;
         expires_on: z.ZodString;
     }, z.core.$strict>;
+    readonly "auth.admin_password_reset": z.ZodObject<{}, z.core.$strict>;
 };
 export declare const EmailRenderDataSchemas: {
     readonly "auth.password_reset": z.ZodObject<{
@@ -388,6 +389,10 @@ export declare const EmailRenderDataSchemas: {
         reset_url: z.ZodString;
         valid_minutes: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>;
+    readonly "auth.admin_password_reset": z.ZodObject<{
+        reset_url: z.ZodString;
+        valid_minutes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>;
     readonly "user.invite": z.ZodObject<{
         invite_url: z.ZodString;
         expires_at: z.ZodOptional<z.ZodString>;
@@ -635,7 +640,7 @@ export type EmailPersistedDataMap = {
 };
 type EmptyRenderContext = Readonly<Record<never, never>>;
 export type EmailEphemeralRenderContextMap = {
-    readonly [Kind in EmailKind]: Kind extends "auth.password_reset" ? Readonly<{
+    readonly [Kind in EmailKind]: Kind extends "auth.password_reset" | "auth.admin_password_reset" ? Readonly<{
         reset_url: string;
         valid_minutes?: number;
     }> : Kind extends "user.invite" ? Readonly<{

package/dist/email/types/template-data.js

@@ -240,6 +240,8 @@ exports.EmailPersistedDataSchemas = {
         expires_on: affiliate_1.CalendarDateSchema,
     })
         .strict(),
+    // The Admin dashboard is German only, so no locale; the link is ephemeral.
+    "auth.admin_password_reset": zod_1.z.object({}).strict(),
 };
 exports.EmailRenderDataSchemas = {
     ...exports.EmailPersistedDataSchemas,
@@ -248,6 +250,11 @@ exports.EmailRenderDataSchemas = {
         /** How long the reset link is valid, from the token; `undefined` if unknown. */
         valid_minutes: zod_1.z.number().int().positive().optional(),
     }),
+    "auth.admin_password_reset": exports.EmailPersistedDataSchemas["auth.admin_password_reset"].extend({
+        reset_url: zod_1.z.string().url(),
+        /** How long the reset link is valid, from the token; `undefined` if unknown. */
+        valid_minutes: zod_1.z.number().int().positive().optional(),
+    }),
     "user.invite": exports.EmailPersistedDataSchemas["user.invite"].extend({
         invite_url: zod_1.z.string().url(),
         /** When the invite expires (ISO 8601), from the current invite. */

package/dist/shared/lib/index.d.ts

@@ -6,6 +6,7 @@ export * from "./hash";
 export * from "./logging";
 export * from "./money";
 export * from "./refreshing-snapshot";
+export * from "./shipping-tax";
 export * from "./text";
 export * from "./transaction";
 export * from "./wire-response";

package/dist/shared/lib/index.js

@@ -24,6 +24,7 @@ __exportStar(require("./hash"), exports);
 __exportStar(require("./logging"), exports);
 __exportStar(require("./money"), exports);
 __exportStar(require("./refreshing-snapshot"), exports);
+__exportStar(require("./shipping-tax"), exports);
 __exportStar(require("./text"), exports);
 __exportStar(require("./transaction"), exports);
 __exportStar(require("./wire-response"), exports);

package/dist/shared/lib/shipping-tax.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Code of a shipping tax line whose rate is the item rates weighted by the
+ * items' net amount after discounts (shipping follows the main supplies,
+ * split by their Entgelt). Tax Compliance writes it; Documents splits such a
+ * line back onto the item tax rates by the same key, because an invoice
+ * states the tax per actual rate.
+ */
+export declare const APPORTIONED_SHIPPING_TAX_CODE = "shipping_blended";

package/dist/shared/lib/shipping-tax.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPORTIONED_SHIPPING_TAX_CODE = void 0;
+/**
+ * Code of a shipping tax line whose rate is the item rates weighted by the
+ * items' net amount after discounts (shipping follows the main supplies,
+ * split by their Entgelt). Tax Compliance writes it; Documents splits such a
+ * line back onto the item tax rates by the same key, because an invoice
+ * states the tax per actual rate.
+ */
+exports.APPORTIONED_SHIPPING_TAX_CODE = "shipping_blended";

package/dist/shop-config/build-food-shop-config.js

@@ -172,6 +172,12 @@ function buildFoodShopConfig(options, environment = process.env) {
                         adminAffiliateApplicationsUrl: () => new URL("/app/affiliates/applications", backendOrigin).toString(),
                         // The Admin dashboard mounts under admin.path ("/app").
                         adminOrderUrl: ({ orderId }) => new URL(`/app/orders/${encodeURIComponent(orderId)}`, backendOrigin).toString(),
+                        // The Admin dashboard reads the token from the query, not the hash.
+                        adminPasswordResetUrl: ({ token }) => {
+                            const url = new URL("/app/reset-password", backendOrigin);
+                            url.searchParams.set("token", token);
+                            return url.toString();
+                        },
                         displayName: options.displayName,
                         affiliatePortalUrl: (0, config_1.shopUrl)(storefrontOrigin, `${storefrontPath}/partnerportal`),
                         // The Admin dashboard mounts "/invite" under admin.path ("/app").

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hartl-services/medusa-base",
-  "version": "2.9.0",
+  "version": "2.11.0",
   "description": "Base plugin for Hartl Services Medusa shops: per-plugin feature toggles with a generic Admin settings page, a Store endpoint for storefronts, enforcement helpers, the complete-cart hook composition, the root redirect, cart-promotion link repair, the built-in E-Mail, Documents and S3 file storage modules, config helpers with the turnkey food-shop preset, and the Sentry logger wrapper and instrumentation.",
   "license": "MIT",
   "files": [
@@ -101,7 +101,7 @@
     "mime-types": "3.0.1",
     "nodemailer": "6.10.1",
     "ulid": "^2.4.0",
-    "@hartl-services/medusa-food-supplements-contracts": "^0.29.0"
+    "@hartl-services/medusa-food-supplements-contracts": "^0.31.0"
   },
   "devDependencies": {
     "@medusajs/admin-sdk": "2.19.0",
@@ -153,7 +153,7 @@
     "dev": "medusa plugin:develop",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.type-tests.json --noEmit && tsc -p tsconfig.component-tests.json",
     "pretest:unit": "pnpm --filter @hartl-services/medusa-food-supplements-contracts build",
-    "test:unit": "jest",
+    "test:unit": "sh ../../scripts/dev-capped.sh jest",
     "pretest:contract": "pnpm --filter @hartl-services/medusa-food-supplements-contracts build",
     "test:contract": "jest --config jest.contract.config.js --runInBand",
     "test:integration:modules": "TEST_TYPE=integration:modules NODE_OPTIONS=--experimental-vm-modules jest --config jest.integration.config.js --silent=false --runInBand --forceExit"