@hszrdm/core 1.0.3 → 1.2.0

package/.medusa/server/src/api/store/leads/route.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const utils_1 = require("@medusajs/framework/utils");
+const core_audit_1 = require("../../../modules/core-audit");
+const lead_1 = require("../../../modules/lead");
+async function POST(req, res) {
+    const config = (0, lead_1.loadLeadConfig)();
+    if (!config.enabled)
+        return res.status(404).json({ message: "Az űrlapbeküldés jelenleg nem elérhető." });
+    try {
+        const formKey = requiredText(req.body.form_key, "Űrlapazonosító", 80);
+        const form = config.forms.find((candidate) => candidate.key === formKey && candidate.enabled);
+        if (!form)
+            return res.status(404).json({ message: "Ismeretlen vagy kikapcsolt űrlap." });
+        const fingerprint = (0, lead_1.clientFingerprint)(req.headers);
+        const email = optionalText(req.body.email, 240)?.toLowerCase() || null;
+        const allowed = await (0, lead_1.checkLeadRateLimit)({
+            fingerprint,
+            email,
+            max: config.rateLimitMax,
+            windowSeconds: config.rateLimitWindowSeconds,
+        });
+        if (!allowed)
+            return res.status(429).json({ message: "Túl sok beküldési kísérlet. Próbáld újra később." });
+        const spam = (0, lead_1.assessLeadSpam)({
+            honeypotValue: req.body[config.honeypotField],
+            formStartedAt: req.body.form_started_at,
+        });
+        // Honeypot hits are intentionally acknowledged but not persisted. This
+        // avoids filling the database with bot payloads and doesn't reveal the trap.
+        if (spam.spam)
+            return res.status(201).json({ lead: { id: null, status: "received" } });
+        if (config.turnstile.enabled) {
+            const turnstileOk = await (0, lead_1.verifyTurnstile)({
+                token: optionalText(req.body.turnstile_token, 5000),
+                secretKey: config.turnstile.secretKey,
+            });
+            if (!turnstileOk)
+                return res.status(400).json({ message: "A spamvédelmi ellenőrzés nem sikerült." });
+        }
+        const standard = normalizeStandardFields(req.body, form.required_standard_fields);
+        const fields = normalizeFields(req.body.fields, form.fields);
+        const consentAccepted = req.body.privacy_consent === true;
+        if (form.privacy.required && !consentAccepted) {
+            throw new Error("Az adatkezelési hozzájárulás kötelező.");
+        }
+        const service = req.scope.resolve(lead_1.LEAD_MODULE);
+        const customerId = req.auth_context?.actor_id || null;
+        const lead = await service.createLeads({
+            form_key: form.key,
+            status: "new",
+            ...standard,
+            fields,
+            source: optionalText(req.body.source, 160),
+            page_url: optionalText(req.body.page_url, 2000),
+            referrer: optionalText(req.body.referrer, 2000),
+            utm: normalizeRecord(req.body.utm, 20, 500),
+            customer_id: customerId,
+            privacy_consent_at: consentAccepted ? new Date() : null,
+            privacy_policy_version: form.privacy.version,
+            privacy_policy_url: form.privacy.url,
+            privacy_policy_label: form.privacy.label,
+            request_fingerprint: fingerprint,
+            spam_score: spam.score,
+            spam_reasons: spam.reasons,
+        });
+        await (0, core_audit_1.writeCoreAudit)(req.scope, {
+            action: "lead.created",
+            resourceType: "lead",
+            resourceId: lead.id,
+            integration: "lead",
+            summary: `Új lead: ${form.key}.`,
+            details: { form_key: form.key, spam_score: spam.score, spam_reasons: spam.reasons },
+        });
+        if (config.emailEnabled) {
+            await notify(req, lead, config.adminEmails, config.customerEmailEnabled);
+        }
+        return res.status(201).json({ lead: { id: lead.id, status: "new" } });
+    }
+    catch (error) {
+        return res.status(400).json({ message: error instanceof Error ? error.message : "Az űrlapbeküldés mentése nem sikerült." });
+    }
+}
+async function notify(req, lead, adminEmails, customerEmailEnabled) {
+    let notifications;
+    try {
+        notifications = req.scope.resolve(utils_1.Modules.NOTIFICATION);
+    }
+    catch {
+        return;
+    }
+    const brand = process.env.STORE_NAME || process.env.VITE_ADMIN_BRAND_NAME || "HSZRDM Commerce";
+    const tasks = [];
+    const admin = (0, lead_1.leadAdminEmail)(lead, brand);
+    for (const to of adminEmails) {
+        tasks.push(notifications.createNotifications({
+            to, channel: "email", content: admin,
+            trigger_type: "lead.created.admin", resource_id: lead.id, resource_type: "lead",
+            idempotency_key: `lead-created-admin-${lead.id}-${to}`,
+        }));
+    }
+    if (customerEmailEnabled && lead.email) {
+        const customer = (0, lead_1.leadCustomerEmail)(lead, brand);
+        tasks.push(notifications.createNotifications({
+            to: lead.email, channel: "email", content: customer,
+            trigger_type: "lead.created.customer", resource_id: lead.id, resource_type: "lead",
+            idempotency_key: `lead-created-customer-${lead.id}`,
+        }));
+    }
+    await Promise.allSettled(tasks);
+}
+function normalizeStandardFields(body, required) {
+    const values = {
+        name: optionalText(body.name, 240),
+        email: optionalText(body.email, 240)?.toLowerCase() || null,
+        phone: optionalText(body.phone, 80),
+        company: optionalText(body.company, 240),
+        message: optionalText(body.message, 10000),
+    };
+    for (const key of required)
+        if (!values[key])
+            throw new Error(`${key} megadása kötelező.`);
+    if (values.email && !/^\S+@\S+\.\S+$/.test(values.email))
+        throw new Error("Érvényes e-mail-cím szükséges.");
+    return values;
+}
+function normalizeFields(value, definitions) {
+    const raw = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    const result = {};
+    for (const field of definitions) {
+        const normalized = normalizeField(raw[field.key], field);
+        if (field.required && isEmpty(normalized))
+            throw new Error(`${field.label} megadása kötelező.`);
+        if (!isEmpty(normalized))
+            result[field.key] = normalized;
+    }
+    return result;
+}
+function normalizeField(value, field) {
+    if (field.type === "boolean")
+        return value === true;
+    if (field.type === "number") {
+        if (value == null || value === "")
+            return null;
+        const number = Number(value);
+        if (!Number.isFinite(number))
+            throw new Error(`${field.label} csak szám lehet.`);
+        return number;
+    }
+    const text = optionalText(value, field.type === "textarea" ? 10000 : 2000);
+    if (field.type === "email" && text && !/^\S+@\S+\.\S+$/.test(text))
+        throw new Error(`${field.label}: érvénytelen e-mail-cím.`);
+    if (field.type === "select" && text && !field.options?.includes(text))
+        throw new Error(`${field.label}: érvénytelen választás.`);
+    return text;
+}
+function normalizeRecord(value, maxEntries, maxLength) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    return Object.fromEntries(Object.entries(value).slice(0, maxEntries).map(([key, raw]) => [key.slice(0, 80), optionalText(raw, maxLength)]));
+}
+function requiredText(value, label, max) {
+    const result = optionalText(value, max);
+    if (!result)
+        throw new Error(`${label} megadása kötelező.`);
+    return result;
+}
+function optionalText(value, max) {
+    if (typeof value !== "string")
+        return null;
+    const result = value.trim();
+    return result ? result.slice(0, max) : null;
+}
+function isEmpty(value) { return value == null || value === "" || value === false; }
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL2xlYWRzL3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBbUJBLG9CQWdGQztBQWxHRCxxREFBbUQ7QUFDbkQsNERBQTREO0FBQzVELGdEQVc4QjtBQUt2QixLQUFLLFVBQVUsSUFBSSxDQUFDLEdBQXdCLEVBQUUsR0FBbUI7SUFDdEUsTUFBTSxNQUFNLEdBQUcsSUFBQSxxQkFBYyxHQUFFLENBQUE7SUFDL0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPO1FBQUUsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSx5Q0FBeUMsRUFBRSxDQUFDLENBQUE7SUFFeEcsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQ3JFLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsR0FBRyxLQUFLLE9BQU8sSUFBSSxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUE7UUFDN0YsSUFBSSxDQUFDLElBQUk7WUFBRSxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLG1DQUFtQyxFQUFFLENBQUMsQ0FBQTtRQUV4RixNQUFNLFdBQVcsR0FBRyxJQUFBLHdCQUFpQixFQUFDLEdBQUcsQ0FBQyxPQUFrQyxDQUFDLENBQUE7UUFDN0UsTUFBTSxLQUFLLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxFQUFFLFdBQVcsRUFBRSxJQUFJLElBQUksQ0FBQTtRQUN0RSxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUEseUJBQWtCLEVBQUM7WUFDdkMsV0FBVztZQUNYLEtBQUs7WUFDTCxHQUFHLEVBQUUsTUFBTSxDQUFDLFlBQVk7WUFDeEIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxzQkFBc0I7U0FDN0MsQ0FBQyxDQUFBO1FBQ0YsSUFBSSxDQUFDLE9BQU87WUFBRSxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGtEQUFrRCxFQUFFLENBQUMsQ0FBQTtRQUUxRyxNQUFNLElBQUksR0FBRyxJQUFBLHFCQUFjLEVBQUM7WUFDMUIsYUFBYSxFQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQztZQUM3QyxhQUFhLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlO1NBQ3hDLENBQUMsQ0FBQTtRQUNGLHVFQUF1RTtRQUN2RSw2RUFBNkU7UUFDN0UsSUFBSSxJQUFJLENBQUMsSUFBSTtZQUFFLE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUE7UUFFdEYsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQzdCLE1BQU0sV0FBVyxHQUFHLE1BQU0sSUFBQSxzQkFBZSxFQUFDO2dCQUN4QyxLQUFLLEVBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLElBQUksQ0FBQztnQkFDbkQsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLENBQUMsU0FBUzthQUN0QyxDQUFDLENBQUE7WUFDRixJQUFJLENBQUMsV0FBVztnQkFBRSxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQTtRQUN0RyxDQUFDO1FBRUQsTUFBTSxRQUFRLEdBQUcsdUJBQXVCLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsd0JBQXdCLENBQUMsQ0FBQTtRQUNqRixNQUFNLE1BQU0sR0FBRyxlQUFlLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFBO1FBQzVELE1BQU0sZUFBZSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsZUFBZSxLQUFLLElBQUksQ0FBQTtRQUN6RCxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFBO1FBQzNELENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxrQkFBVyxDQUFnQixDQUFBO1FBQzdELE1BQU0sVUFBVSxHQUFJLEdBQTJELENBQUMsWUFBWSxFQUFFLFFBQVEsSUFBSSxJQUFJLENBQUE7UUFDOUcsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsV0FBVyxDQUFDO1lBQ3JDLFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRztZQUNsQixNQUFNLEVBQUUsS0FBSztZQUNiLEdBQUcsUUFBUTtZQUNYLE1BQU07WUFDTixNQUFNLEVBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEdBQUcsQ0FBQztZQUMxQyxRQUFRLEVBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQztZQUMvQyxRQUFRLEVBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQztZQUMvQyxHQUFHLEVBQUUsZUFBZSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEVBQUUsRUFBRSxHQUFHLENBQUM7WUFDM0MsV0FBVyxFQUFFLFVBQVU7WUFDdkIsa0JBQWtCLEVBQUUsZUFBZSxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ3ZELHNCQUFzQixFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTztZQUM1QyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUc7WUFDcEMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLO1lBQ3hDLG1CQUFtQixFQUFFLFdBQVc7WUFDaEMsVUFBVSxFQUFFLElBQUksQ0FBQyxLQUFLO1lBQ3RCLFlBQVksRUFBRSxJQUFJLENBQUMsT0FBTztTQUNsQixDQUFDLENBQUE7UUFFWCxNQUFNLElBQUEsMkJBQWMsRUFBQyxHQUFHLENBQUMsS0FBYyxFQUFFO1lBQ3ZDLE1BQU0sRUFBRSxjQUFjO1lBQ3RCLFlBQVksRUFBRSxNQUFNO1lBQ3BCLFVBQVUsRUFBRyxJQUFZLENBQUMsRUFBRTtZQUM1QixXQUFXLEVBQUUsTUFBTTtZQUNuQixPQUFPLEVBQUUsWUFBWSxJQUFJLENBQUMsR0FBRyxHQUFHO1lBQ2hDLE9BQU8sRUFBRSxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsT0FBTyxFQUFFO1NBQ3BGLENBQUMsQ0FBQTtRQUVGLElBQUksTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3hCLE1BQU0sTUFBTSxDQUFDLEdBQUcsRUFBRSxJQUFzQyxFQUFFLE1BQU0sQ0FBQyxXQUFXLEVBQUUsTUFBTSxDQUFDLG9CQUFvQixDQUFDLENBQUE7UUFDNUcsQ0FBQztRQUVELE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLEVBQUcsSUFBWSxDQUFDLEVBQUUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO0lBQ2hGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyx3Q0FBd0MsRUFBRSxDQUFDLENBQUE7SUFDN0gsQ0FBQztBQUNILENBQUM7QUFFRCxLQUFLLFVBQVUsTUFBTSxDQUFDLEdBQWtCLEVBQUUsSUFBeUIsRUFBRSxXQUFxQixFQUFFLG9CQUE2QjtJQUN2SCxJQUFJLGFBQWtDLENBQUE7SUFDdEMsSUFBSSxDQUFDO1FBQUMsYUFBYSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQU8sQ0FBQyxZQUFZLENBQW1DLENBQUE7SUFBQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTTtJQUFDLENBQUM7SUFDbEgsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxpQkFBaUIsQ0FBQTtJQUM5RixNQUFNLEtBQUssR0FBdUIsRUFBRSxDQUFBO0lBQ3BDLE1BQU0sS0FBSyxHQUFHLElBQUEscUJBQWMsRUFBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUE7SUFDekMsS0FBSyxNQUFNLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQztRQUM3QixLQUFLLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxtQkFBbUIsQ0FBQztZQUMzQyxFQUFFLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSztZQUNwQyxZQUFZLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLElBQUksQ0FBQyxFQUFFLEVBQUUsYUFBYSxFQUFFLE1BQU07WUFDL0UsZUFBZSxFQUFFLHNCQUFzQixJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRTtTQUN2RCxDQUFDLENBQUMsQ0FBQTtJQUNMLENBQUM7SUFDRCxJQUFJLG9CQUFvQixJQUFJLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUN2QyxNQUFNLFFBQVEsR0FBRyxJQUFBLHdCQUFpQixFQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQTtRQUMvQyxLQUFLLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxtQkFBbUIsQ0FBQztZQUMzQyxFQUFFLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxRQUFRO1lBQ25ELFlBQVksRUFBRSx1QkFBdUIsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRSxhQUFhLEVBQUUsTUFBTTtZQUNsRixlQUFlLEVBQUUseUJBQXlCLElBQUksQ0FBQyxFQUFFLEVBQUU7U0FDcEQsQ0FBQyxDQUFDLENBQUE7SUFDTCxDQUFDO0lBQ0QsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFBO0FBQ2pDLENBQUM7QUFFRCxTQUFTLHVCQUF1QixDQUFDLElBQVUsRUFBRSxRQUFrQjtJQUM3RCxNQUFNLE1BQU0sR0FBRztRQUNiLElBQUksRUFBRSxZQUFZLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUM7UUFDbEMsS0FBSyxFQUFFLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxFQUFFLFdBQVcsRUFBRSxJQUFJLElBQUk7UUFDM0QsS0FBSyxFQUFFLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNuQyxPQUFPLEVBQUUsWUFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDO1FBQ3hDLE9BQU8sRUFBRSxZQUFZLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUM7S0FDM0MsQ0FBQTtJQUNELEtBQUssTUFBTSxHQUFHLElBQUksUUFBUTtRQUFFLElBQUksQ0FBRSxNQUFrQyxDQUFDLEdBQUcsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxHQUFHLHFCQUFxQixDQUFDLENBQUE7SUFDdkgsSUFBSSxNQUFNLENBQUMsS0FBSyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUE7SUFDM0csT0FBTyxNQUFNLENBQUE7QUFDZixDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsS0FBYyxFQUFFLFdBQWtDO0lBQ3pFLE1BQU0sR0FBRyxHQUFHLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFnQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUE7SUFDL0csTUFBTSxNQUFNLEdBQTRCLEVBQUUsQ0FBQTtJQUMxQyxLQUFLLE1BQU0sS0FBSyxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sVUFBVSxHQUFHLGNBQWMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFBO1FBQ3hELElBQUksS0FBSyxDQUFDLFFBQVEsSUFBSSxPQUFPLENBQUMsVUFBVSxDQUFDO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssQ0FBQyxLQUFLLHFCQUFxQixDQUFDLENBQUE7UUFDL0YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUM7WUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQTtJQUMxRCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUE7QUFDZixDQUFDO0FBRUQsU0FBUyxjQUFjLENBQUMsS0FBYyxFQUFFLEtBQTBCO0lBQ2hFLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTO1FBQUUsT0FBTyxLQUFLLEtBQUssSUFBSSxDQUFBO0lBQ25ELElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUM1QixJQUFJLEtBQUssSUFBSSxJQUFJLElBQUksS0FBSyxLQUFLLEVBQUU7WUFBRSxPQUFPLElBQUksQ0FBQTtRQUM5QyxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUE7UUFDNUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssQ0FBQyxLQUFLLG1CQUFtQixDQUFDLENBQUE7UUFDaEYsT0FBTyxNQUFNLENBQUE7SUFDZixDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsWUFBWSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQTtJQUMxRSxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssT0FBTyxJQUFJLElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxDQUFDLEtBQUssMkJBQTJCLENBQUMsQ0FBQTtJQUM5SCxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLElBQUksQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLENBQUMsS0FBSywwQkFBMEIsQ0FBQyxDQUFBO0lBQ2hJLE9BQU8sSUFBSSxDQUFBO0FBQ2IsQ0FBQztBQUVELFNBQVMsZUFBZSxDQUFDLEtBQWMsRUFBRSxVQUFrQixFQUFFLFNBQWlCO0lBQzVFLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO1FBQUUsT0FBTyxFQUFFLENBQUE7SUFDMUUsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBZ0MsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsVUFBVSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsWUFBWSxDQUFDLEdBQUcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtBQUN4SyxDQUFDO0FBRUQsU0FBUyxZQUFZLENBQUMsS0FBYyxFQUFFLEtBQWEsRUFBRSxHQUFXO0lBQzlELE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUE7SUFDdkMsSUFBSSxDQUFDLE1BQU07UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxxQkFBcUIsQ0FBQyxDQUFBO0lBQzNELE9BQU8sTUFBTSxDQUFBO0FBQ2YsQ0FBQztBQUNELFNBQVMsWUFBWSxDQUFDLEtBQWMsRUFBRSxHQUFXO0lBQy9DLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtRQUFFLE9BQU8sSUFBSSxDQUFBO0lBQzFDLE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQTtJQUMzQixPQUFPLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQTtBQUM3QyxDQUFDO0FBQ0QsU0FBUyxPQUFPLENBQUMsS0FBYyxJQUFJLE9BQU8sS0FBSyxJQUFJLElBQUksSUFBSSxLQUFLLEtBQUssRUFBRSxJQUFJLEtBQUssS0FBSyxLQUFLLENBQUEsQ0FBQyxDQUFDIn0=

package/.medusa/server/src/api/store/newsletter/config/route.d.ts

@@ -0,0 +1,2 @@
+import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http";
+export declare function GET(_req: MedusaRequest, res: MedusaResponse): Promise<MedusaResponse>;

package/.medusa/server/src/api/store/newsletter/config/route.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+const newsletter_1 = require("../../../../modules/newsletter");
+async function GET(_req, res) {
+    const config = (0, newsletter_1.loadNewsletterConfig)();
+    return res.json({
+        enabled: config.enabled,
+        double_opt_in: config.doubleOptIn,
+        consent_version: config.consentVersion,
+        consent_url: config.consentUrl,
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL25ld3NsZXR0ZXIvY29uZmlnL3JvdXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBR0Esa0JBUUM7QUFWRCwrREFBcUU7QUFFOUQsS0FBSyxVQUFVLEdBQUcsQ0FBQyxJQUFtQixFQUFFLEdBQW1CO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLElBQUEsaUNBQW9CLEdBQUUsQ0FBQTtJQUNyQyxPQUFPLEdBQUcsQ0FBQyxJQUFJLENBQUM7UUFDZCxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDdkIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxXQUFXO1FBQ2pDLGVBQWUsRUFBRSxNQUFNLENBQUMsY0FBYztRQUN0QyxXQUFXLEVBQUUsTUFBTSxDQUFDLFVBQVU7S0FDL0IsQ0FBQyxDQUFBO0FBQ0osQ0FBQyJ9

package/.medusa/server/src/api/store/newsletter/confirm/route.d.ts

@@ -0,0 +1,4 @@
+import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http";
+type Body = Record<string, unknown>;
+export declare function POST(req: MedusaRequest<Body>, res: MedusaResponse): Promise<MedusaResponse>;
+export {};

package/.medusa/server/src/api/store/newsletter/confirm/route.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const core_audit_1 = require("../../../../modules/core-audit");
+const newsletter_1 = require("../../../../modules/newsletter");
+async function POST(req, res) {
+    const config = (0, newsletter_1.loadNewsletterConfig)();
+    if (!config.enabled)
+        return res.status(404).json({ message: "A hírlevél jelenleg nem elérhető." });
+    try {
+        const token = requiredToken(req.body?.token);
+        const hash = (0, newsletter_1.hashNewsletterToken)(token);
+        const service = req.scope.resolve(newsletter_1.NEWSLETTER_MODULE);
+        const [subscriber] = await service.listNewsletterSubscribers({ confirmation_token_hash: hash }, { take: 1 });
+        if (!subscriber || subscriber.status !== "pending") {
+            return res.status(400).json({ message: "A megerősítő link érvénytelen vagy már felhasználták." });
+        }
+        const expiresAt = subscriber.confirmation_expires_at ? new Date(subscriber.confirmation_expires_at) : null;
+        if (expiresAt && expiresAt.getTime() < Date.now()) {
+            return res.status(400).json({ message: "A megerősítő link lejárt. Iratkozz fel újra egy új linkért." });
+        }
+        const now = new Date();
+        const updated = await service.updateNewsletterSubscribers({
+            id: subscriber.id,
+            status: "subscribed",
+            confirmed_at: now,
+            subscribed_at: now,
+            unsubscribed_at: null,
+            confirmation_token_hash: null,
+            confirmation_expires_at: null,
+        });
+        await (0, core_audit_1.writeCoreAudit)(req.scope, {
+            action: "newsletter.subscription.confirm",
+            resourceType: "newsletter_subscriber",
+            resourceId: updated.id,
+            integration: "newsletter",
+            summary: "Hírlevél-feliratkozás double opt-in megerősítve.",
+            details: { status: updated.status, source: updated.source, consent_version: updated.consent_version },
+        });
+        await (0, newsletter_1.emitNewsletterEvent)(req.scope, newsletter_1.NEWSLETTER_EVENTS.subscribed, updated);
+        return res.json({ subscriber: { id: updated.id, status: updated.status }, message: "A hírlevél-feliratkozás megerősítve." });
+    }
+    catch (error) {
+        return res.status(400).json({ message: error instanceof Error ? error.message : "A feliratkozás megerősítése nem sikerült." });
+    }
+}
+function requiredToken(value) {
+    if (typeof value !== "string" || !value.trim() || value.length > 500)
+        throw new Error("Érvényes megerősítő token szükséges.");
+    return value.trim();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL25ld3NsZXR0ZXIvY29uZmlybS9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWFBLG9CQStDQztBQTNERCwrREFBK0Q7QUFDL0QsK0RBT3VDO0FBSWhDLEtBQUssVUFBVSxJQUFJLENBQUMsR0FBd0IsRUFBRSxHQUFtQjtJQUN0RSxNQUFNLE1BQU0sR0FBRyxJQUFBLGlDQUFvQixHQUFFLENBQUE7SUFDckMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPO1FBQUUsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxtQ0FBbUMsRUFBRSxDQUFDLENBQUE7SUFFbEcsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUE7UUFDNUMsTUFBTSxJQUFJLEdBQUcsSUFBQSxnQ0FBbUIsRUFBQyxLQUFLLENBQUMsQ0FBQTtRQUN2QyxNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyw4QkFBaUIsQ0FBc0IsQ0FBQTtRQUN6RSxNQUFNLENBQUMsVUFBVSxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMseUJBQXlCLENBQzFELEVBQUUsdUJBQXVCLEVBQUUsSUFBSSxFQUFXLEVBQzFDLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBVyxDQUNvQixDQUFBO1FBRTFDLElBQUksQ0FBQyxVQUFVLElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuRCxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLHVEQUF1RCxFQUFFLENBQUMsQ0FBQTtRQUNuRyxDQUFDO1FBRUQsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLHVCQUF1QixDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsdUJBQXVCLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBO1FBQzFHLElBQUksU0FBUyxJQUFJLFNBQVMsQ0FBQyxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUNsRCxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLDZEQUE2RCxFQUFFLENBQUMsQ0FBQTtRQUN6RyxDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQTtRQUN0QixNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQywyQkFBMkIsQ0FBQztZQUN4RCxFQUFFLEVBQUUsVUFBVSxDQUFDLEVBQUU7WUFDakIsTUFBTSxFQUFFLFlBQVk7WUFDcEIsWUFBWSxFQUFFLEdBQUc7WUFDakIsYUFBYSxFQUFFLEdBQUc7WUFDbEIsZUFBZSxFQUFFLElBQUk7WUFDckIsdUJBQXVCLEVBQUUsSUFBSTtZQUM3Qix1QkFBdUIsRUFBRSxJQUFJO1NBQ3JCLENBQW1DLENBQUE7UUFFN0MsTUFBTSxJQUFBLDJCQUFjLEVBQUMsR0FBRyxDQUFDLEtBQWMsRUFBRTtZQUN2QyxNQUFNLEVBQUUsaUNBQWlDO1lBQ3pDLFlBQVksRUFBRSx1QkFBdUI7WUFDckMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxFQUFFO1lBQ3RCLFdBQVcsRUFBRSxZQUFZO1lBQ3pCLE9BQU8sRUFBRSxrREFBa0Q7WUFDM0QsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsZUFBZSxFQUFFLE9BQU8sQ0FBQyxlQUFlLEVBQUU7U0FDdEcsQ0FBQyxDQUFBO1FBQ0YsTUFBTSxJQUFBLGdDQUFtQixFQUFDLEdBQUcsQ0FBQyxLQUFjLEVBQUUsOEJBQWlCLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFBO1FBRXBGLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsRUFBRSxPQUFPLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsT0FBTyxFQUFFLHNDQUFzQyxFQUFFLENBQUMsQ0FBQTtJQUM5SCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsMkNBQTJDLEVBQUUsQ0FBQyxDQUFBO0lBQ2hJLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsS0FBYztJQUNuQyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLEdBQUc7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUE7SUFDN0gsT0FBTyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUE7QUFDckIsQ0FBQyJ9

package/.medusa/server/src/api/store/newsletter/route.d.ts

@@ -0,0 +1,4 @@
+import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http";
+type Body = Record<string, unknown>;
+export declare function POST(req: MedusaRequest<Body>, res: MedusaResponse): Promise<MedusaResponse>;
+export {};

package/.medusa/server/src/api/store/newsletter/route.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const utils_1 = require("@medusajs/framework/utils");
+const core_audit_1 = require("../../../modules/core-audit");
+const newsletter_1 = require("../../../modules/newsletter");
+async function POST(req, res) {
+    const config = (0, newsletter_1.loadNewsletterConfig)();
+    if (!config.enabled)
+        return res.status(404).json({ message: "A hírlevél-feliratkozás jelenleg nem elérhető." });
+    if (req.body?.consent !== true)
+        return res.status(400).json({ message: "A hírlevél-hozzájárulás elfogadása kötelező." });
+    if (config.doubleOptIn && !config.emailEnabled) {
+        return res.status(503).json({ message: "A double opt-in aktív, de a megerősítő e-mail küldése nincs engedélyezve." });
+    }
+    try {
+        const email = (0, newsletter_1.normalizeNewsletterEmail)(req.body.email);
+        const source = optionalText(req.body.source, 160);
+        const pageUrl = optionalText(req.body.page_url, 2000);
+        const utm = (0, newsletter_1.normalizeNewsletterUtm)(req.body.utm);
+        const service = req.scope.resolve(newsletter_1.NEWSLETTER_MODULE);
+        const now = new Date();
+        const [existing] = await service.listNewsletterSubscribers({ email }, { take: 1 });
+        if (existing?.status === "subscribed") {
+            const updated = await service.updateNewsletterSubscribers({
+                id: existing.id,
+                consent_at: now,
+                consent_version: config.consentVersion,
+                consent_url: config.consentUrl,
+                source: source || existing.source || null,
+                page_url: pageUrl || existing.page_url || null,
+                utm: Object.keys(utm).length ? utm : existing.utm || null,
+            });
+            await audit(req, updated, "newsletter.subscription.duplicate", "Meglévő hírlevél-feliratkozás megerősítve.");
+            return res.status(200).json({ subscriber: publicState(updated), message: "A feliratkozás már aktív." });
+        }
+        const confirmation = config.doubleOptIn ? (0, newsletter_1.createNewsletterToken)() : null;
+        const confirmationExpiresAt = confirmation
+            ? new Date(now.getTime() + config.confirmationTtlHours * 60 * 60 * 1000)
+            : null;
+        const input = {
+            email,
+            status: config.doubleOptIn ? "pending" : "subscribed",
+            source,
+            page_url: pageUrl,
+            utm: Object.keys(utm).length ? utm : null,
+            consent_at: now,
+            consent_version: config.consentVersion,
+            consent_url: config.consentUrl,
+            double_opt_in: config.doubleOptIn,
+            confirmation_token_hash: confirmation?.hash || null,
+            confirmation_sent_at: null,
+            confirmation_expires_at: confirmationExpiresAt,
+            confirmed_at: null,
+            subscribed_at: config.doubleOptIn ? null : now,
+            unsubscribed_at: null,
+        };
+        let subscriber;
+        let ownsGeneratedConfirmationToken = true;
+        if (existing) {
+            subscriber = await service.updateNewsletterSubscribers({ id: existing.id, ...input });
+        }
+        else {
+            try {
+                subscriber = await service.createNewsletterSubscribers(input);
+            }
+            catch (error) {
+                // A unique e-mail index protects concurrent duplicate submissions. If
+                // another request won the race, its confirmation token remains authoritative.
+                const [raced] = await service.listNewsletterSubscribers({ email }, { take: 1 });
+                if (!raced)
+                    throw error;
+                subscriber = raced;
+                ownsGeneratedConfirmationToken = false;
+            }
+        }
+        if (config.doubleOptIn && confirmation && subscriber.status === "pending" && ownsGeneratedConfirmationToken) {
+            const sent = await sendConfirmation(req, subscriber, confirmation.token);
+            if (!sent) {
+                await (0, core_audit_1.writeCoreAudit)(req.scope, {
+                    action: "newsletter.confirmation.error",
+                    resourceType: "newsletter_subscriber",
+                    resourceId: subscriber.id,
+                    integration: "newsletter",
+                    status: "error",
+                    summary: "A hírlevél megerősítő e-mail létrehozása nem sikerült.",
+                    details: { source: subscriber.source, consent_version: subscriber.consent_version },
+                });
+                return res.status(503).json({
+                    subscriber: publicState(subscriber),
+                    message: "A feliratkozást rögzítettük, de a megerősítő e-mail küldése nem sikerült. Próbáld újra később.",
+                });
+            }
+            subscriber = await service.updateNewsletterSubscribers({
+                id: subscriber.id,
+                confirmation_sent_at: new Date(),
+            });
+        }
+        await audit(req, subscriber, existing || !ownsGeneratedConfirmationToken ? "newsletter.subscription.resubscribe" : "newsletter.subscription.create", config.doubleOptIn ? "Hírlevél-feliratkozás megerősítésre vár." : "Hírlevél-feliratkozás aktiválva.");
+        if (ownsGeneratedConfirmationToken) {
+            await (0, newsletter_1.emitNewsletterEvent)(req.scope, subscriber.status === "pending" ? newsletter_1.NEWSLETTER_EVENTS.pending : newsletter_1.NEWSLETTER_EVENTS.subscribed, subscriber);
+        }
+        const message = !config.doubleOptIn
+            ? "A hírlevél-feliratkozás sikeres."
+            : ownsGeneratedConfirmationToken
+                ? "Küldtünk egy megerősítő e-mailt. A feliratkozás a link megnyitása után válik aktívvá."
+                : "A feliratkozás megerősítésre vár. Ha nem érkezik meg a megerősítő e-mail, próbáld újra később.";
+        return res.status(existing || !ownsGeneratedConfirmationToken ? 200 : 201).json({
+            subscriber: publicState(subscriber),
+            message,
+        });
+    }
+    catch (error) {
+        return res.status(400).json({ message: error instanceof Error ? error.message : "A hírlevél-feliratkozás nem sikerült." });
+    }
+}
+async function sendConfirmation(req, subscriber, confirmToken) {
+    let notifications;
+    try {
+        notifications = req.scope.resolve(utils_1.Modules.NOTIFICATION);
+    }
+    catch {
+        return false;
+    }
+    const config = (0, newsletter_1.loadNewsletterConfig)();
+    const brand = process.env.STORE_NAME || process.env.VITE_ADMIN_BRAND_NAME || "HSZRDM Commerce";
+    const unsubscribeToken = (0, newsletter_1.createNewsletterUnsubscribeToken)(subscriber.id, subscriber.email);
+    const content = (0, newsletter_1.newsletterConfirmationEmail)({
+        brand,
+        confirmUrl: (0, newsletter_1.newsletterConfirmUrl)(confirmToken, config),
+        unsubscribeUrl: (0, newsletter_1.newsletterUnsubscribeUrl)(unsubscribeToken, config),
+    });
+    try {
+        await notifications.createNotifications({
+            to: subscriber.email,
+            channel: "email",
+            content,
+            trigger_type: "newsletter.confirmation",
+            resource_id: subscriber.id,
+            resource_type: "newsletter_subscriber",
+            idempotency_key: `newsletter-confirmation-${subscriber.id}-${subscriber.updated_at || Date.now()}`,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function audit(req, subscriber, action, summary) {
+    await (0, core_audit_1.writeCoreAudit)(req.scope, {
+        action,
+        resourceType: "newsletter_subscriber",
+        resourceId: subscriber.id,
+        integration: "newsletter",
+        summary,
+        details: { status: subscriber.status, source: subscriber.source, consent_version: subscriber.consent_version },
+    });
+}
+function publicState(subscriber) {
+    return {
+        id: subscriber.id,
+        status: subscriber.status,
+        double_opt_in: Boolean(subscriber.double_opt_in),
+    };
+}
+function optionalText(value, max) {
+    if (typeof value !== "string")
+        return null;
+    const result = value.trim();
+    return result ? result.slice(0, max) : null;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL25ld3NsZXR0ZXIvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFxQkEsb0JBMkhDO0FBL0lELHFEQUFtRDtBQUNuRCw0REFBNEQ7QUFDNUQsNERBYW9DO0FBSzdCLEtBQUssVUFBVSxJQUFJLENBQUMsR0FBd0IsRUFBRSxHQUFtQjtJQUN0RSxNQUFNLE1BQU0sR0FBRyxJQUFBLGlDQUFvQixHQUFFLENBQUE7SUFDckMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPO1FBQUUsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxnREFBZ0QsRUFBRSxDQUFDLENBQUE7SUFDL0csSUFBSSxHQUFHLENBQUMsSUFBSSxFQUFFLE9BQU8sS0FBSyxJQUFJO1FBQUUsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSw4Q0FBOEMsRUFBRSxDQUFDLENBQUE7SUFDeEgsSUFBSSxNQUFNLENBQUMsV0FBVyxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQy9DLE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsMkVBQTJFLEVBQUUsQ0FBQyxDQUFBO0lBQ3ZILENBQUM7SUFFRCxJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxJQUFBLHFDQUF3QixFQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUE7UUFDdEQsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEdBQUcsQ0FBQyxDQUFBO1FBQ2pELE1BQU0sT0FBTyxHQUFHLFlBQVksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQTtRQUNyRCxNQUFNLEdBQUcsR0FBRyxJQUFBLG1DQUFzQixFQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUE7UUFDaEQsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsOEJBQWlCLENBQXNCLENBQUE7UUFDekUsTUFBTSxHQUFHLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQTtRQUN0QixNQUFNLENBQUMsUUFBUSxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMseUJBQXlCLENBQUMsRUFBRSxLQUFLLEVBQVcsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDLEVBQVcsQ0FBMEMsQ0FBQTtRQUU3SSxJQUFJLFFBQVEsRUFBRSxNQUFNLEtBQUssWUFBWSxFQUFFLENBQUM7WUFDdEMsTUFBTSxPQUFPLEdBQUcsTUFBTSxPQUFPLENBQUMsMkJBQTJCLENBQUM7Z0JBQ3hELEVBQUUsRUFBRSxRQUFRLENBQUMsRUFBRTtnQkFDZixVQUFVLEVBQUUsR0FBRztnQkFDZixlQUFlLEVBQUUsTUFBTSxDQUFDLGNBQWM7Z0JBQ3RDLFdBQVcsRUFBRSxNQUFNLENBQUMsVUFBVTtnQkFDOUIsTUFBTSxFQUFFLE1BQU0sSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLElBQUk7Z0JBQ3pDLFFBQVEsRUFBRSxPQUFPLElBQUksUUFBUSxDQUFDLFFBQVEsSUFBSSxJQUFJO2dCQUM5QyxHQUFHLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsSUFBSSxJQUFJO2FBQ2pELENBQW1DLENBQUE7WUFFN0MsTUFBTSxLQUFLLENBQUMsR0FBRyxFQUFFLE9BQU8sRUFBRSxtQ0FBbUMsRUFBRSw0Q0FBNEMsQ0FBQyxDQUFBO1lBQzVHLE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxVQUFVLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBRSwyQkFBMkIsRUFBRSxDQUFDLENBQUE7UUFDekcsQ0FBQztRQUVELE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLElBQUEsa0NBQXFCLEdBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBO1FBQ3hFLE1BQU0scUJBQXFCLEdBQUcsWUFBWTtZQUN4QyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxHQUFHLE1BQU0sQ0FBQyxvQkFBb0IsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztZQUN4RSxDQUFDLENBQUMsSUFBSSxDQUFBO1FBRVIsTUFBTSxLQUFLLEdBQUc7WUFDWixLQUFLO1lBQ0wsTUFBTSxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsWUFBWTtZQUNyRCxNQUFNO1lBQ04sUUFBUSxFQUFFLE9BQU87WUFDakIsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDekMsVUFBVSxFQUFFLEdBQUc7WUFDZixlQUFlLEVBQUUsTUFBTSxDQUFDLGNBQWM7WUFDdEMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxVQUFVO1lBQzlCLGFBQWEsRUFBRSxNQUFNLENBQUMsV0FBVztZQUNqQyx1QkFBdUIsRUFBRSxZQUFZLEVBQUUsSUFBSSxJQUFJLElBQUk7WUFDbkQsb0JBQW9CLEVBQUUsSUFBSTtZQUMxQix1QkFBdUIsRUFBRSxxQkFBcUI7WUFDOUMsWUFBWSxFQUFFLElBQUk7WUFDbEIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRztZQUM5QyxlQUFlLEVBQUUsSUFBSTtTQUN0QixDQUFBO1FBRUQsSUFBSSxVQUErQixDQUFBO1FBQ25DLElBQUksOEJBQThCLEdBQUcsSUFBSSxDQUFBO1FBQ3pDLElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixVQUFVLEdBQUcsTUFBTSxPQUFPLENBQUMsMkJBQTJCLENBQUMsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxHQUFHLEtBQUssRUFBVyxDQUFtQyxDQUFBO1FBQ2xJLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxDQUFDO2dCQUNILFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQywyQkFBMkIsQ0FBQyxLQUFjLENBQW1DLENBQUE7WUFDMUcsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2Ysc0VBQXNFO2dCQUN0RSw4RUFBOEU7Z0JBQzlFLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyx5QkFBeUIsQ0FBQyxFQUFFLEtBQUssRUFBVyxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBVyxDQUEwQyxDQUFBO2dCQUMxSSxJQUFJLENBQUMsS0FBSztvQkFBRSxNQUFNLEtBQUssQ0FBQTtnQkFDdkIsVUFBVSxHQUFHLEtBQUssQ0FBQTtnQkFDbEIsOEJBQThCLEdBQUcsS0FBSyxDQUFBO1lBQ3hDLENBQUM7UUFDSCxDQUFDO1FBRUQsSUFBSSxNQUFNLENBQUMsV0FBVyxJQUFJLFlBQVksSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSw4QkFBOEIsRUFBRSxDQUFDO1lBQzVHLE1BQU0sSUFBSSxHQUFHLE1BQU0sZ0JBQWdCLENBQUMsR0FBRyxFQUFFLFVBQVUsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUE7WUFDeEUsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUNWLE1BQU0sSUFBQSwyQkFBYyxFQUFDLEdBQUcsQ0FBQyxLQUFjLEVBQUU7b0JBQ3ZDLE1BQU0sRUFBRSwrQkFBK0I7b0JBQ3ZDLFlBQVksRUFBRSx1QkFBdUI7b0JBQ3JDLFVBQVUsRUFBRSxVQUFVLENBQUMsRUFBRTtvQkFDekIsV0FBVyxFQUFFLFlBQVk7b0JBQ3pCLE1BQU0sRUFBRSxPQUFPO29CQUNmLE9BQU8sRUFBRSx3REFBd0Q7b0JBQ2pFLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZSxFQUFFO2lCQUNwRixDQUFDLENBQUE7Z0JBQ0YsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztvQkFDMUIsVUFBVSxFQUFFLFdBQVcsQ0FBQyxVQUFVLENBQUM7b0JBQ25DLE9BQU8sRUFBRSxnR0FBZ0c7aUJBQzFHLENBQUMsQ0FBQTtZQUNKLENBQUM7WUFDRCxVQUFVLEdBQUcsTUFBTSxPQUFPLENBQUMsMkJBQTJCLENBQUM7Z0JBQ3JELEVBQUUsRUFBRSxVQUFVLENBQUMsRUFBRTtnQkFDakIsb0JBQW9CLEVBQUUsSUFBSSxJQUFJLEVBQUU7YUFDeEIsQ0FBbUMsQ0FBQTtRQUMvQyxDQUFDO1FBRUQsTUFBTSxLQUFLLENBQ1QsR0FBRyxFQUNILFVBQVUsRUFDVixRQUFRLElBQUksQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDLENBQUMscUNBQXFDLENBQUMsQ0FBQyxDQUFDLGdDQUFnQyxFQUN0SCxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDLENBQUMsa0NBQWtDLENBQ3JHLENBQUE7UUFFRCxJQUFJLDhCQUE4QixFQUFFLENBQUM7WUFDbkMsTUFBTSxJQUFBLGdDQUFtQixFQUN2QixHQUFHLENBQUMsS0FBYyxFQUNsQixVQUFVLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsOEJBQWlCLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyw4QkFBaUIsQ0FBQyxVQUFVLEVBQzFGLFVBQVUsQ0FDWCxDQUFBO1FBQ0gsQ0FBQztRQUVELE1BQU0sT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLFdBQVc7WUFDakMsQ0FBQyxDQUFDLGtDQUFrQztZQUNwQyxDQUFDLENBQUMsOEJBQThCO2dCQUM5QixDQUFDLENBQUMsdUZBQXVGO2dCQUN6RixDQUFDLENBQUMsZ0dBQWdHLENBQUE7UUFFdEcsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLFFBQVEsSUFBSSxDQUFDLDhCQUE4QixDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUM5RSxVQUFVLEVBQUUsV0FBVyxDQUFDLFVBQVUsQ0FBQztZQUNuQyxPQUFPO1NBQ1IsQ0FBQyxDQUFBO0lBQ0osQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLHVDQUF1QyxFQUFFLENBQUMsQ0FBQTtJQUM1SCxDQUFDO0FBQ0gsQ0FBQztBQUVELEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxHQUFrQixFQUFFLFVBQStCLEVBQUUsWUFBb0I7SUFDdkcsSUFBSSxhQUFrQyxDQUFBO0lBQ3RDLElBQUksQ0FBQztRQUFDLGFBQWEsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxlQUFPLENBQUMsWUFBWSxDQUFtQyxDQUFBO0lBQUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sS0FBSyxDQUFBO0lBQUMsQ0FBQztJQUN4SCxNQUFNLE1BQU0sR0FBRyxJQUFBLGlDQUFvQixHQUFFLENBQUE7SUFDckMsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQkFBcUIsSUFBSSxpQkFBaUIsQ0FBQTtJQUM5RixNQUFNLGdCQUFnQixHQUFHLElBQUEsNkNBQWdDLEVBQUMsVUFBVSxDQUFDLEVBQUUsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDMUYsTUFBTSxPQUFPLEdBQUcsSUFBQSx3Q0FBMkIsRUFBQztRQUMxQyxLQUFLO1FBQ0wsVUFBVSxFQUFFLElBQUEsaUNBQW9CLEVBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQztRQUN0RCxjQUFjLEVBQUUsSUFBQSxxQ0FBd0IsRUFBQyxnQkFBZ0IsRUFBRSxNQUFNLENBQUM7S0FDbkUsQ0FBQyxDQUFBO0lBQ0YsSUFBSSxDQUFDO1FBQ0gsTUFBTSxhQUFhLENBQUMsbUJBQW1CLENBQUM7WUFDdEMsRUFBRSxFQUFFLFVBQVUsQ0FBQyxLQUFLO1lBQ3BCLE9BQU8sRUFBRSxPQUFPO1lBQ2hCLE9BQU87WUFDUCxZQUFZLEVBQUUseUJBQXlCO1lBQ3ZDLFdBQVcsRUFBRSxVQUFVLENBQUMsRUFBRTtZQUMxQixhQUFhLEVBQUUsdUJBQXVCO1lBQ3RDLGVBQWUsRUFBRSwyQkFBMkIsVUFBVSxDQUFDLEVBQUUsSUFBSSxVQUFVLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRTtTQUNuRyxDQUFDLENBQUE7UUFDRixPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQTtJQUNkLENBQUM7QUFDSCxDQUFDO0FBRUQsS0FBSyxVQUFVLEtBQUssQ0FBQyxHQUFrQixFQUFFLFVBQStCLEVBQUUsTUFBYyxFQUFFLE9BQWU7SUFDdkcsTUFBTSxJQUFBLDJCQUFjLEVBQUMsR0FBRyxDQUFDLEtBQWMsRUFBRTtRQUN2QyxNQUFNO1FBQ04sWUFBWSxFQUFFLHVCQUF1QjtRQUNyQyxVQUFVLEVBQUUsVUFBVSxDQUFDLEVBQUU7UUFDekIsV0FBVyxFQUFFLFlBQVk7UUFDekIsT0FBTztRQUNQLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZSxFQUFFO0tBQy9HLENBQUMsQ0FBQTtBQUNKLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxVQUErQjtJQUNsRCxPQUFPO1FBQ0wsRUFBRSxFQUFFLFVBQVUsQ0FBQyxFQUFFO1FBQ2pCLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTTtRQUN6QixhQUFhLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUM7S0FDakQsQ0FBQTtBQUNILENBQUM7QUFFRCxTQUFTLFlBQVksQ0FBQyxLQUFjLEVBQUUsR0FBVztJQUMvQyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7UUFBRSxPQUFPLElBQUksQ0FBQTtJQUMxQyxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUE7SUFDM0IsT0FBTyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7QUFDN0MsQ0FBQyJ9

package/.medusa/server/src/api/store/newsletter/unsubscribe/route.d.ts

@@ -0,0 +1,4 @@
+import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http";
+type Body = Record<string, unknown>;
+export declare function POST(req: MedusaRequest<Body>, res: MedusaResponse): Promise<MedusaResponse>;
+export {};

package/.medusa/server/src/api/store/newsletter/unsubscribe/route.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const core_audit_1 = require("../../../../modules/core-audit");
+const newsletter_1 = require("../../../../modules/newsletter");
+async function POST(req, res) {
+    const config = (0, newsletter_1.loadNewsletterConfig)();
+    if (!config.enabled)
+        return res.status(404).json({ message: "A hírlevél jelenleg nem elérhető." });
+    try {
+        const token = requiredToken(req.body?.token);
+        const subscriberId = (0, newsletter_1.newsletterSubscriberIdFromUnsubscribeToken)(token);
+        const service = req.scope.resolve(newsletter_1.NEWSLETTER_MODULE);
+        let subscriber;
+        try {
+            subscriber = await service.retrieveNewsletterSubscriber(subscriberId);
+        }
+        catch {
+            return res.status(400).json({ message: "A leiratkozó link érvénytelen." });
+        }
+        if (!(0, newsletter_1.verifyNewsletterUnsubscribeToken)(token, subscriber.id, subscriber.email)) {
+            return res.status(400).json({ message: "A leiratkozó link érvénytelen." });
+        }
+        if (subscriber.status === "unsubscribed") {
+            return res.json({ subscriber: { id: subscriber.id, status: subscriber.status }, message: "Erről a címről már leiratkoztál." });
+        }
+        const updated = await service.updateNewsletterSubscribers({
+            id: subscriber.id,
+            status: "unsubscribed",
+            unsubscribed_at: new Date(),
+            confirmation_token_hash: null,
+            confirmation_expires_at: null,
+        });
+        await (0, core_audit_1.writeCoreAudit)(req.scope, {
+            action: "newsletter.subscription.unsubscribe",
+            resourceType: "newsletter_subscriber",
+            resourceId: updated.id,
+            integration: "newsletter",
+            summary: "Hírlevél-leiratkozás rögzítve.",
+            details: { status: updated.status, source: updated.source, consent_version: updated.consent_version },
+        });
+        await (0, newsletter_1.emitNewsletterEvent)(req.scope, newsletter_1.NEWSLETTER_EVENTS.unsubscribed, updated);
+        return res.json({ subscriber: { id: updated.id, status: updated.status }, message: "Sikeresen leiratkoztál a hírlevélről." });
+    }
+    catch (error) {
+        return res.status(400).json({ message: error instanceof Error ? error.message : "A leiratkozás nem sikerült." });
+    }
+}
+function requiredToken(value) {
+    if (typeof value !== "string" || !value.trim() || value.length > 500)
+        throw new Error("Érvényes leiratkozó token szükséges.");
+    return value.trim();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL25ld3NsZXR0ZXIvdW5zdWJzY3JpYmUvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFjQSxvQkE2Q0M7QUExREQsK0RBQStEO0FBQy9ELCtEQVF1QztBQUloQyxLQUFLLFVBQVUsSUFBSSxDQUFDLEdBQXdCLEVBQUUsR0FBbUI7SUFDdEUsTUFBTSxNQUFNLEdBQUcsSUFBQSxpQ0FBb0IsR0FBRSxDQUFBO0lBQ3JDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTztRQUFFLE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsbUNBQW1DLEVBQUUsQ0FBQyxDQUFBO0lBRWxHLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFBO1FBQzVDLE1BQU0sWUFBWSxHQUFHLElBQUEsdURBQTBDLEVBQUMsS0FBSyxDQUFDLENBQUE7UUFDdEUsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsOEJBQWlCLENBQXNCLENBQUE7UUFDekUsSUFBSSxVQUErQixDQUFBO1FBQ25DLElBQUksQ0FBQztZQUNILFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyw0QkFBNEIsQ0FBQyxZQUFZLENBQW1DLENBQUE7UUFDekcsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8sR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsZ0NBQWdDLEVBQUUsQ0FBQyxDQUFBO1FBQzVFLENBQUM7UUFFRCxJQUFJLENBQUMsSUFBQSw2Q0FBZ0MsRUFBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLEVBQUUsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM5RSxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLGdDQUFnQyxFQUFFLENBQUMsQ0FBQTtRQUM1RSxDQUFDO1FBRUQsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLGNBQWMsRUFBRSxDQUFDO1lBQ3pDLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsRUFBRSxVQUFVLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLEVBQUUsT0FBTyxFQUFFLGtDQUFrQyxFQUFFLENBQUMsQ0FBQTtRQUNoSSxDQUFDO1FBRUQsTUFBTSxPQUFPLEdBQUcsTUFBTSxPQUFPLENBQUMsMkJBQTJCLENBQUM7WUFDeEQsRUFBRSxFQUFFLFVBQVUsQ0FBQyxFQUFFO1lBQ2pCLE1BQU0sRUFBRSxjQUFjO1lBQ3RCLGVBQWUsRUFBRSxJQUFJLElBQUksRUFBRTtZQUMzQix1QkFBdUIsRUFBRSxJQUFJO1lBQzdCLHVCQUF1QixFQUFFLElBQUk7U0FDckIsQ0FBbUMsQ0FBQTtRQUU3QyxNQUFNLElBQUEsMkJBQWMsRUFBQyxHQUFHLENBQUMsS0FBYyxFQUFFO1lBQ3ZDLE1BQU0sRUFBRSxxQ0FBcUM7WUFDN0MsWUFBWSxFQUFFLHVCQUF1QjtZQUNyQyxVQUFVLEVBQUUsT0FBTyxDQUFDLEVBQUU7WUFDdEIsV0FBVyxFQUFFLFlBQVk7WUFDekIsT0FBTyxFQUFFLGdDQUFnQztZQUN6QyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxlQUFlLEVBQUUsT0FBTyxDQUFDLGVBQWUsRUFBRTtTQUN0RyxDQUFDLENBQUE7UUFDRixNQUFNLElBQUEsZ0NBQW1CLEVBQUMsR0FBRyxDQUFDLEtBQWMsRUFBRSw4QkFBaUIsQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUE7UUFFdEYsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsRUFBRSxFQUFFLE9BQU8sQ0FBQyxFQUFFLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxPQUFPLEVBQUUsdUNBQXVDLEVBQUUsQ0FBQyxDQUFBO0lBQy9ILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsT0FBTyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE9BQU8sRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyw2QkFBNkIsRUFBRSxDQUFDLENBQUE7SUFDbEgsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLGFBQWEsQ0FBQyxLQUFjO0lBQ25DLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxJQUFJLEtBQUssQ0FBQyxNQUFNLEdBQUcsR0FBRztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQTtJQUM3SCxPQUFPLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQTtBQUNyQixDQUFDIn0=

package/.medusa/server/src/api/store/products/[id]/reviews/route.d.ts

@@ -0,0 +1,8 @@
+import type { AuthenticatedMedusaRequest, MedusaRequest, MedusaResponse } from "@medusajs/framework/http";
+type Body = {
+    rating?: unknown;
+    body?: unknown;
+};
+export declare function GET(req: MedusaRequest, res: MedusaResponse): Promise<MedusaResponse>;
+export declare function POST(req: AuthenticatedMedusaRequest<Body>, res: MedusaResponse): Promise<MedusaResponse>;
+export {};