@jarwizz/create-jarshop 0.1.1 → 0.1.3

package/dist/template/storefront/lib/account.ts

@@ -0,0 +1,366 @@
+"use server";
+
+import type {
+  AccountProfile,
+  AccountSummary,
+  RegisterAccountInput,
+  SessionStore,
+} from "@jarwizz/commerce-sdk/types";
+import { cookies, headers } from "next/headers";
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+
+import type { CommerceLocale } from "./commerce";
+import {
+  createAccountAddress,
+  changeAccountPassword,
+  deleteAccountAddress,
+  getAccountProfile,
+  getActiveAccount,
+  loginAccount,
+  logoutAccount,
+  registerAccount,
+  refreshAccountRegistration,
+  requestAccountPasswordReset,
+  resetAccountPassword,
+  updateAccountAddress,
+  updateAccountProfile,
+  verifyAccountRegistration,
+} from "./commerce";
+import { createCommerceSessionStore } from "./commerce-session";
+import { createAccountActionGuard } from "./account-security";
+import { formPassword, formText } from "./form-values";
+import {
+  PASSWORD_RESET_TOKEN_COOKIE,
+  passwordResetToken,
+} from "./password-reset-token";
+import { valkeyAccountRateLimitStore } from "./valkey-rate-limit";
+
+export type LoginActionState =
+  | { readonly status: "idle" }
+  | {
+      readonly status: "error";
+      readonly reason: "invalidCredentials" | "temporaryFailure";
+    };
+
+type AccountFailureReason =
+  | "invalidCredentials"
+  | "passwordInvalid"
+  | "passwordMismatch"
+  | "invalidToken"
+  | "temporaryFailure";
+
+export type AccountActionState =
+  | { readonly status: "idle" }
+  | { readonly status: "success" }
+  | {
+      readonly status: "error";
+      readonly reason: AccountFailureReason;
+    };
+
+async function sessionStore() {
+  return createCommerceSessionStore(await cookies());
+}
+
+const accountActionGuard = createAccountActionGuard(
+  valkeyAccountRateLimitStore,
+);
+
+async function accountActionAllowedForHeaders(
+  scope: string,
+  subject: string,
+  requestHeaders: Pick<Headers, "get">,
+): Promise<boolean> {
+  return (
+    await accountActionGuard.check({
+      scope,
+      subject,
+      origin: requestHeaders.get("origin"),
+      host:
+        requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host"),
+      clientAddress:
+        requestHeaders.get("x-forwarded-for")?.split(",")[0] ?? null,
+      now: Date.now(),
+    })
+  ).allowed;
+}
+
+async function accountActionAllowed(
+  scope: string,
+  subject: string,
+): Promise<boolean> {
+  return accountActionAllowedForHeaders(scope, subject, await headers());
+}
+
+function accountFailure(reason: AccountFailureReason): AccountActionState {
+  return { status: "error", reason };
+}
+
+function failureReason(code: string): AccountFailureReason {
+  if (code === "PASSWORD_INVALID") return "passwordInvalid";
+  if (code === "INVALID_CREDENTIALS") return "invalidCredentials";
+  if (code === "NOT_VERIFIED" || code === "RESET_TOKEN_INVALID") {
+    return "invalidToken";
+  }
+  return "temporaryFailure";
+}
+
+export async function getSignedInAccount(
+  locale: CommerceLocale,
+): Promise<AccountSummary | null> {
+  const result = await getActiveAccount(locale, await sessionStore());
+  return result.ok ? result.data : null;
+}
+
+export async function getSignedInAccountProfile(
+  locale: CommerceLocale,
+  orderTake = 10,
+): Promise<AccountProfile | null> {
+  const result = await getAccountProfile(locale, await sessionStore(), {
+    take: orderTake,
+  });
+  return result.ok ? result.data : null;
+}
+
+export async function login(
+  locale: CommerceLocale,
+  _previousState: LoginActionState,
+  formData: FormData,
+): Promise<LoginActionState> {
+  const emailAddress = formText(formData, "emailAddress");
+  if (!(await accountActionAllowed("login", emailAddress))) {
+    return { status: "error", reason: "temporaryFailure" };
+  }
+  const result = await loginAccount(locale, await sessionStore(), {
+    emailAddress,
+    password: formPassword(formData, "password"),
+  });
+  if (!result.ok) {
+    return {
+      status: "error",
+      reason:
+        result.error.code === "INVALID_CREDENTIALS"
+          ? "invalidCredentials"
+          : "temporaryFailure",
+    };
+  }
+  redirect(`/${locale}/account`);
+}
+
+export async function register(
+  locale: CommerceLocale,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  const input: RegisterAccountInput = {
+    emailAddress: formText(formData, "emailAddress"),
+    firstName: formText(formData, "firstName"),
+    lastName: formText(formData, "lastName"),
+    password: formPassword(formData, "password"),
+  };
+  const phoneNumber = formText(formData, "phoneNumber");
+  if (phoneNumber) input.phoneNumber = phoneNumber;
+  if (
+    !input.emailAddress ||
+    !input.firstName ||
+    !input.lastName ||
+    !input.password
+  ) {
+    return accountFailure("temporaryFailure");
+  }
+  if (!(await accountActionAllowed("register", input.emailAddress))) {
+    return accountFailure("temporaryFailure");
+  }
+  const result = await registerAccount(locale, input);
+  return result.ok
+    ? { status: "success" }
+    : accountFailure(failureReason(result.error.code));
+}
+
+export async function completeAccountVerification(
+  locale: CommerceLocale,
+  session: SessionStore,
+  token: string,
+  requestHeaders: Pick<Headers, "get">,
+): Promise<boolean> {
+  if (
+    !(await accountActionAllowedForHeaders("verify", token, requestHeaders))
+  ) {
+    return false;
+  }
+  const result = await verifyAccountRegistration(locale, session, token);
+  return result.ok;
+}
+
+export async function requestPasswordReset(
+  locale: CommerceLocale,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  const emailAddress = formText(formData, "emailAddress");
+  if (!(await accountActionAllowed("password-reset", emailAddress))) {
+    return { status: "success" };
+  }
+  const result = await requestAccountPasswordReset(locale, emailAddress);
+  // Vendure intentionally makes both existing and unknown addresses look the
+  // same. Preserve that response at the UI boundary to prevent enumeration.
+  return result.ok ? { status: "success" } : accountFailure("temporaryFailure");
+}
+
+export async function refreshVerification(
+  locale: CommerceLocale,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  const emailAddress = formText(formData, "emailAddress");
+  if (!(await accountActionAllowed("refresh-verification", emailAddress))) {
+    return { status: "success" };
+  }
+  await refreshAccountRegistration(locale, emailAddress);
+  // The browser response stays neutral for unknown, verified and unverified
+  // addresses. Only the mailbox owner learns whether a new token was sent.
+  return { status: "success" };
+}
+
+export async function resetPassword(
+  locale: CommerceLocale,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  const cookieStore = await cookies();
+  const token = passwordResetToken(cookieStore);
+  const password = formPassword(formData, "password");
+  if (password !== formPassword(formData, "confirmPassword")) {
+    return accountFailure("passwordMismatch");
+  }
+  if (!token) return accountFailure("invalidToken");
+  if (!(await accountActionAllowed("reset-password", token))) {
+    return accountFailure("temporaryFailure");
+  }
+  const result = await resetAccountPassword(locale, await sessionStore(), {
+    token,
+    password,
+  });
+  if (!result.ok) {
+    if (result.error.code === "RESET_TOKEN_INVALID") {
+      cookieStore.delete(PASSWORD_RESET_TOKEN_COOKIE);
+    }
+    return accountFailure(failureReason(result.error.code));
+  }
+  cookieStore.delete(PASSWORD_RESET_TOKEN_COOKIE);
+  redirect(`/${locale}/account`);
+}
+
+export async function updateProfile(
+  locale: CommerceLocale,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  if (!(await accountActionAllowed("update-profile", "authenticated-user"))) {
+    return accountFailure("temporaryFailure");
+  }
+  const result = await updateAccountProfile(locale, await sessionStore(), {
+    firstName: formText(formData, "firstName"),
+    lastName: formText(formData, "lastName"),
+    phoneNumber: formText(formData, "phoneNumber") || undefined,
+  });
+  if (!result.ok) return accountFailure("temporaryFailure");
+  revalidatePath(`/${locale}/account`);
+  return { status: "success" };
+}
+
+export async function changePassword(
+  locale: CommerceLocale,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  if (!(await accountActionAllowed("change-password", "authenticated-user"))) {
+    return accountFailure("temporaryFailure");
+  }
+  const result = await changeAccountPassword(locale, await sessionStore(), {
+    currentPassword: formPassword(formData, "currentPassword"),
+    newPassword: formPassword(formData, "newPassword"),
+  });
+  return result.ok
+    ? { status: "success" }
+    : accountFailure(failureReason(result.error.code));
+}
+
+export async function addAddress(
+  locale: CommerceLocale,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  if (!(await accountActionAllowed("add-address", "authenticated-user"))) {
+    return accountFailure("temporaryFailure");
+  }
+  const result = await createAccountAddress(locale, await sessionStore(), {
+    fullName: formText(formData, "fullName") || undefined,
+    streetLine1: formText(formData, "streetLine1"),
+    city: formText(formData, "city") || undefined,
+    postalCode: formText(formData, "postalCode") || undefined,
+    countryCode: formText(formData, "countryCode"),
+    phoneNumber: formText(formData, "phoneNumber") || undefined,
+    defaultShippingAddress: formData.get("defaultShippingAddress") === "on",
+    defaultBillingAddress: formData.get("defaultBillingAddress") === "on",
+  });
+  if (!result.ok) return accountFailure("temporaryFailure");
+  revalidatePath(`/${locale}/account`);
+  return { status: "success" };
+}
+
+export async function updateAddress(
+  locale: CommerceLocale,
+  addressId: string,
+  _previousState: AccountActionState,
+  formData: FormData,
+): Promise<AccountActionState> {
+  if (!(await accountActionAllowed("update-address", "authenticated-user"))) {
+    return accountFailure("temporaryFailure");
+  }
+  const result = await updateAccountAddress(locale, await sessionStore(), {
+    id: addressId,
+    fullName: formText(formData, "fullName") || undefined,
+    streetLine1: formText(formData, "streetLine1") || undefined,
+    city: formText(formData, "city") || undefined,
+    postalCode: formText(formData, "postalCode") || undefined,
+    countryCode: formText(formData, "countryCode") || undefined,
+    phoneNumber: formText(formData, "phoneNumber") || undefined,
+    defaultShippingAddress: formData.get("defaultShippingAddress") === "on",
+    defaultBillingAddress: formData.get("defaultBillingAddress") === "on",
+  });
+  if (!result.ok) return accountFailure("temporaryFailure");
+  revalidatePath(`/${locale}/account`);
+  return { status: "success" };
+}
+
+export async function removeAddress(
+  locale: CommerceLocale,
+  addressId: string,
+  _previousState: AccountActionState,
+  _formData: FormData,
+): Promise<AccountActionState> {
+  if (!(await accountActionAllowed("remove-address", "authenticated-user"))) {
+    return accountFailure("temporaryFailure");
+  }
+  const result = await deleteAccountAddress(
+    locale,
+    await sessionStore(),
+    addressId,
+  );
+  if (!result.ok) return accountFailure("temporaryFailure");
+  revalidatePath(`/${locale}/account`);
+  return { status: "success" };
+}
+
+export async function logout(locale: CommerceLocale): Promise<void> {
+  if (!(await accountActionAllowed("logout", "authenticated-user"))) {
+    redirect(`/${locale}`);
+  }
+  const store = await sessionStore();
+  const result = await logoutAccount(locale, store);
+  // If the backend is temporarily unreachable, removing the browser-bound
+  // opaque token still gives the customer a safe local sign-out.
+  if (!result.ok) store.set(undefined);
+  redirect(`/${locale}`);
+}

package/dist/template/storefront/lib/cart-contract.ts

@@ -0,0 +1,52 @@
+export interface CartLine {
+  id: string;
+  productSlug: string;
+  productName: string;
+  variantName: string;
+  quantity: number;
+  linePrice: number;
+  currencyCode: string;
+}
+
+export interface CartView {
+  lines: CartLine[];
+  subtotal: number;
+  shipping: number;
+  total: number;
+  currencyCode: string;
+}
+
+interface ShopApiCart {
+  lines: Array<{
+    id: string | number;
+    quantity: number;
+    discountedLinePriceWithTax: number;
+    productVariant: { name: string; product: { slug: string; name: string } };
+  }>;
+  subTotalWithTax: number;
+  shippingWithTax: number;
+  totalWithTax: number;
+  currencyCode: string;
+}
+
+export function mapCart(order: ShopApiCart): CartView {
+  return {
+    lines: order.lines.map((line) => ({
+      // Vendure's Shop API serializes the built-in numeric ID strategy as a
+      // JSON number. The checkout contract treats identifiers as strings, so
+      // normalize at the Commerce Facade boundary before a browser snapshot is
+      // sent back to the server.
+      id: String(line.id),
+      productSlug: line.productVariant.product.slug,
+      productName: line.productVariant.product.name,
+      variantName: line.productVariant.name,
+      quantity: line.quantity,
+      linePrice: line.discountedLinePriceWithTax,
+      currencyCode: order.currencyCode,
+    })),
+    subtotal: order.subTotalWithTax,
+    shipping: order.shippingWithTax,
+    total: order.totalWithTax,
+    currencyCode: order.currencyCode,
+  };
+}

package/dist/template/storefront/lib/cart.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+
+import { mapCart } from "./cart-contract";
+
+describe("mapCart", () => {
+  it("normalizes numeric Shop API line IDs for the checkout contract", () => {
+    const cart = mapCart({
+      currencyCode: "EUR",
+      subTotalWithTax: 1990,
+      shippingWithTax: 0,
+      totalWithTax: 1990,
+      lines: [
+        {
+          id: 1,
+          quantity: 1,
+          discountedLinePriceWithTax: 1990,
+          productVariant: {
+            name: "JarShop demo variant",
+            product: {
+              name: "JarShop demo product",
+              slug: "jarshop-demo-product",
+            },
+          },
+        },
+      ],
+    });
+
+    expect(cart.lines[0]?.id).toBe("1");
+  });
+});

package/dist/template/storefront/lib/cart.ts

@@ -0,0 +1,130 @@
+"use server";
+
+import { cookies } from "next/headers";
+import { revalidatePath } from "next/cache";
+
+import type { CommerceLocale } from "./commerce";
+import { mapCart, type CartView } from "./cart-contract";
+import {
+  commerceSessionAuthorization,
+  persistCommerceSession,
+} from "./commerce-session";
+
+export type { CartView } from "./cart-contract";
+
+export type AddToCartState =
+  | { readonly status: "idle" }
+  | { readonly status: "added" }
+  | { readonly status: "error"; readonly message: string };
+
+interface GraphqlResponse<T> {
+  data?: T;
+  errors?: Array<{ message: string }>;
+}
+
+const CART_FIELDS = `
+  lines {
+    id quantity discountedLinePriceWithTax
+    productVariant { name product { slug name } }
+  }
+  subTotalWithTax shippingWithTax totalWithTax currencyCode
+`;
+
+async function request<T>(
+  locale: CommerceLocale,
+  query: string,
+  variables?: Record<string, unknown>,
+): Promise<T> {
+  const store = await cookies();
+  const endpoint = new URL(
+    process.env.JARSHOP_COMMERCE_ENDPOINT ?? "http://localhost:3000/shop-api",
+  );
+  endpoint.searchParams.set("languageCode", locale);
+  const authorization = commerceSessionAuthorization(store);
+  const response = await fetch(endpoint, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...(process.env.JARSHOP_CHANNEL_TOKEN
+        ? { "vendure-token": process.env.JARSHOP_CHANNEL_TOKEN }
+        : {}),
+      ...(authorization ? { authorization } : {}),
+    },
+    body: JSON.stringify({ query, variables }),
+    cache: "no-store",
+  });
+  persistCommerceSession(store, response.headers);
+  if (!response.ok) throw new Error(`Commerce API returned ${response.status}`);
+  const body = (await response.json()) as GraphqlResponse<T>;
+  if (body.errors?.length)
+    throw new Error(body.errors[0]?.message ?? "Commerce request failed");
+  if (!body.data) throw new Error("Commerce API returned no data");
+  return body.data;
+}
+
+export async function getCart(
+  locale: CommerceLocale,
+): Promise<CartView | null> {
+  try {
+    const result = await request<{
+      activeOrder: Parameters<typeof mapCart>[0] | null;
+    }>(locale, `query ActiveCart { activeOrder { ${CART_FIELDS} } }`);
+    return result.activeOrder ? mapCart(result.activeOrder) : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function addToCart(
+  locale: CommerceLocale,
+  variantId: string,
+  _previousState: AddToCartState,
+  formData: FormData,
+): Promise<AddToCartState> {
+  try {
+    await request(
+      locale,
+      `mutation Add($variantId: ID!, $quantity: Int!) { addItemToOrder(productVariantId: $variantId, quantity: $quantity) { __typename } }`,
+      {
+        variantId,
+        quantity: Number(formData.get("quantity") ?? 1),
+      },
+    );
+    revalidatePath(`/${locale}`);
+    revalidatePath(`/${locale}/cart`);
+    return { status: "added" };
+  } catch (error) {
+    return {
+      status: "error",
+      message: error instanceof Error ? error.message : "Unable to add item",
+    };
+  }
+}
+
+export async function updateCartLine(
+  locale: CommerceLocale,
+  lineId: string,
+  formData: FormData,
+): Promise<void> {
+  await request(
+    locale,
+    `mutation Update($lineId: ID!, $quantity: Int!) { adjustOrderLine(orderLineId: $lineId, quantity: $quantity) { __typename } }`,
+    {
+      lineId,
+      quantity: Number(formData.get("quantity")),
+    },
+  );
+  revalidatePath(`/${locale}/cart`);
+}
+
+export async function removeCartLine(
+  locale: CommerceLocale,
+  lineId: string,
+): Promise<void> {
+  await request(
+    locale,
+    `mutation Remove($lineId: ID!) { removeOrderLine(orderLineId: $lineId) { __typename } }`,
+    { lineId },
+  );
+  revalidatePath(`/${locale}/cart`);
+}

package/dist/template/storefront/lib/checkout-contract.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+
+import { PLACE_JARSHOP_ORDER_MUTATION } from "./checkout-contract";
+
+describe("checkout GraphQL contract", () => {
+  it("selects every field required by the storefront success hand-off", () => {
+    for (const field of [
+      "success",
+      "orderCode",
+      "errorCode",
+      "message",
+      "affectedLineIds",
+      "confirmationToken",
+    ]) {
+      expect(PLACE_JARSHOP_ORDER_MUTATION).toMatch(
+        new RegExp(`\\b${field}\\b`, "u"),
+      );
+    }
+  });
+});

package/dist/template/storefront/lib/checkout-contract.ts

@@ -0,0 +1,16 @@
+/**
+ * The confirmation token is required by the success-route hand-off. Keep this
+ * operation separate so its selected response fields are regression-tested.
+ */
+export const PLACE_JARSHOP_ORDER_MUTATION = `
+  mutation Place($input: JarShopPlaceOrderInput!) {
+    placeJarShopOrder(input: $input) {
+      success
+      orderCode
+      errorCode
+      message
+      affectedLineIds
+      confirmationToken
+    }
+  }
+`;