@jarwizz/create-jarshop 0.1.1 → 0.1.3

package/dist/template/pnpm-workspace.yaml

@@ -1,4 +1,15 @@
-packages: []
+packages:
+  - .
+  - storefront
+
+# The eslint-config-next range otherwise resolves a newer unreviewed resolver,
+# which pnpm rejects as a trust downgrade. Keep the reviewed compatible
+# resolver exact for the whole Client Project workspace.
+overrides:
+  eslint-import-resolver-typescript: 3.8.7
+
+minimumReleaseAgeExclude:
+  - "@jarwizz/commerce-sdk@0.3.0"
 
 allowBuilds:
   bcrypt: true

package/dist/template/src/dev-storefront.ts

@@ -0,0 +1,58 @@
+import { spawn } from "node:child_process";
+import { resolve } from "node:path";
+import dotenv from "dotenv";
+
+const root = resolve(__dirname, "..");
+const inheritedEnvironment = { ...process.env };
+
+function parsePort(value: string): number {
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+    throw new Error(
+      "JARSHOP_STOREFRONT_PORT must be an integer from 1 to 65535.",
+    );
+  }
+  return port;
+}
+
+async function main(): Promise<void> {
+  dotenv.config({ path: resolve(root, ".env"), quiet: true });
+  const storefrontPort = parsePort(
+    process.env.JARSHOP_STOREFRONT_PORT ?? "3001",
+  );
+  const commerceEndpoint =
+    process.env.JARSHOP_COMMERCE_ENDPOINT ??
+    `http://localhost:${process.env.PORT ?? "3000"}/shop-api`;
+  const child = spawn(
+    "pnpm",
+    ["--dir", "storefront", "dev", "--port", String(storefrontPort)],
+    {
+      cwd: root,
+      stdio: "inherit",
+      // Values from the root .env are intentionally not forwarded to Next.
+      // Server, worker and database credentials therefore stay inside their
+      // own process; the local storefront receives only the commerce endpoint
+      // and its server-only local Valkey URL.
+      env: {
+        ...inheritedEnvironment,
+        JARSHOP_COMMERCE_ENDPOINT: commerceEndpoint,
+        JARSHOP_ACCOUNT_RATE_LIMIT_URL:
+          process.env.JARSHOP_ACCOUNT_RATE_LIMIT_URL ??
+          "redis://localhost:6380",
+        NEXT_TELEMETRY_DISABLED: process.env.NEXT_TELEMETRY_DISABLED ?? "1",
+      },
+    },
+  );
+  await new Promise<void>((resolvePromise, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) resolvePromise();
+      else reject(new Error(`storefront exited with ${signal ?? code}`));
+    });
+  });
+}
+
+main().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exitCode = 1;
+});

package/dist/template/src/dev.ts

@@ -1,6 +1,6 @@
-import { copyFile, access } from "node:fs/promises";
+import { access, appendFile, copyFile, readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
-import { createServer } from "node:net";
+import { createConnection, createServer } from "node:net";
 import { resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 import dotenv from "dotenv";
@@ -45,12 +45,59 @@ async function assertPortAvailable(
   });
 }
 
+async function assertServiceReachable(
+  port: number,
+  service: string,
+): Promise<void> {
+  await new Promise<void>((resolvePromise, reject) => {
+    const socket = createConnection({ host: "127.0.0.1", port });
+    const cleanup = () => {
+      socket.removeAllListeners();
+      socket.destroy();
+    };
+    socket.once("connect", () => {
+      cleanup();
+      resolvePromise();
+    });
+    socket.once("error", (error) => {
+      cleanup();
+      reject(error);
+    });
+    socket.setTimeout(500, () => {
+      cleanup();
+      reject(new Error(`${service} is not reachable on localhost:${port}`));
+    });
+  });
+}
+
 async function ensureEnv() {
   try {
     await access(envFile);
   } catch {
     await copyFile(envExample, envFile);
     console.log("Created local .env from .env.example");
+    return;
+  }
+
+  const [currentEnvironment, exampleEnvironment] = await Promise.all([
+    readFile(envFile, "utf8"),
+    readFile(envExample, "utf8"),
+  ]);
+  const currentKeys = new Set(
+    currentEnvironment
+      .split(/\r?\n/)
+      .flatMap((line) => line.match(/^([A-Z][A-Z0-9_]*)=/)?.[1] ?? []),
+  );
+  const missingDefaults = exampleEnvironment.split(/\r?\n/).filter((line) => {
+    const key = line.match(/^([A-Z][A-Z0-9_]*)=/)?.[1];
+    return key !== undefined && !currentKeys.has(key);
+  });
+
+  if (missingDefaults.length > 0) {
+    await appendFile(envFile, `\n${missingDefaults.join("\n")}\n`);
+    console.log(
+      `Added ${missingDefaults.length} missing local default${missingDefaults.length === 1 ? "" : "s"} from .env.example`,
+    );
   }
 }
 
@@ -77,6 +124,10 @@ async function dockerReady() {
     process.env.JARSHOP_POSTGRES_PORT ?? process.env.DB_PORT ?? "6543",
     "JARSHOP_POSTGRES_PORT",
   );
+  const valkeyPort = parsePort(
+    process.env.JARSHOP_VALKEY_PORT ?? "6380",
+    "JARSHOP_VALKEY_PORT",
+  );
   try {
     await run("docker", ["info"], { stdio: "ignore" });
   } catch {
@@ -86,7 +137,7 @@ async function dockerReady() {
   }
 
   try {
-    await run("docker", ["compose", "up", "-d", "postgres_db"]);
+    await run("docker", ["compose", "up", "-d", "postgres_db", "valkey"]);
   } catch {
     throw new Error(
       `PostgreSQL could not start on port ${dbPort}. Stop the conflicting service or choose another JARSHOP_POSTGRES_PORT.`,
@@ -109,6 +160,13 @@ async function dockerReady() {
         ],
         { stdio: "ignore" },
       );
+      // `pg_isready` proves readiness inside Docker. Docker Desktop can expose
+      // the container before its host port proxy is available, so also prove
+      // the connection that migrations use from the local machine.
+      await Promise.all([
+        assertServiceReachable(dbPort, "PostgreSQL"),
+        assertServiceReachable(valkeyPort, "Valkey"),
+      ]);
       return;
     } catch {
       await delay(1000);
@@ -124,9 +182,13 @@ async function main() {
   dotenv.config({ path: envFile, quiet: true });
   assertRuntime();
   const serverPort = parsePort(process.env.PORT ?? "3000", "PORT");
+  const storefrontPort = parsePort(
+    process.env.JARSHOP_STOREFRONT_PORT ?? "3001",
+    "JARSHOP_STOREFRONT_PORT",
+  );
   await Promise.all([
     assertPortAvailable(serverPort, "Vendure"),
-    assertPortAvailable(3001, "storefront"),
+    assertPortAvailable(storefrontPort, "storefront"),
   ]);
   const isDev = (process.env.APP_ENV ?? "dev") === "dev";
   if (isDev) {
@@ -141,6 +203,7 @@ async function main() {
     "run",
     "dev:server",
     "dev:worker",
+    "dev:dashboard",
     "dev:storefront",
     `--ui=${turboUi}`,
   ];

package/dist/template/src/email-smoke.ts

@@ -0,0 +1,27 @@
+import "dotenv/config";
+import { parseSmtpSmokeCommand } from "./plugins/jarshop-checkout/email-smoke-core.js";
+import { createConfiguredOrderEmailTransport } from "./plugins/jarshop-checkout/order-email-transport.js";
+
+async function main(): Promise<void> {
+  const command = parseSmtpSmokeCommand(process.argv.slice(2), process.env);
+  const transport = createConfiguredOrderEmailTransport();
+  await transport.deliver({
+    deliveryId: 1,
+    email: {
+      recipient: command.recipient,
+      subject: "JarShop SMTP transport smoke",
+      text: [
+        "This is a controlled JarShop SMTP transport smoke message.",
+        "No customer order, bearer token, or checkout data is included.",
+      ].join("\n"),
+    },
+  });
+  console.log("SMTP smoke email was accepted by the configured transport.");
+}
+
+main().catch(() => {
+  console.error(
+    "SMTP smoke delivery failed. Check the provider configuration without copying credentials into logs.",
+  );
+  process.exitCode = 1;
+});

package/dist/template/src/environment.d.ts

@@ -5,6 +5,8 @@ declare global {
     interface ProcessEnv {
       APP_ENV?: string;
       PORT?: string;
+      JARSHOP_STOREFRONT_PORT?: string;
+      JARSHOP_COMMERCE_ENDPOINT?: string;
       COOKIE_SECRET?: string;
       SUPERADMIN_USERNAME?: string;
       SUPERADMIN_PASSWORD?: string;
@@ -14,6 +16,10 @@ declare global {
       DB_USERNAME?: string;
       DB_PASSWORD?: string;
       DB_SCHEMA?: string;
+      JARSHOP_ORDER_EMAIL_ENCRYPTION_KEY?: string;
+      JARSHOP_EMAIL_TRANSPORT?: string;
+      JARSHOP_EMAIL_FILE_TRANSPORT_PATH?: string;
+      JARSHOP_STOREFRONT_URL?: string;
     }
   }
 }

package/dist/template/src/migrate.ts

@@ -0,0 +1,16 @@
+import { runMigrations } from "@vendure/core";
+
+import { config } from "./vendure-config.js";
+
+runMigrations(config)
+  .then((migrations) => {
+    if (migrations.length === 0) {
+      console.log("Migrations are up to date.");
+      return;
+    }
+    console.log(`Applied migrations: ${migrations.join(", ")}`);
+  })
+  .catch((error: unknown) => {
+    console.error(error);
+    process.exitCode = 1;
+  });

package/dist/template/src/migrations/1786024108434-jarshop-checkout-attempt.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class JarShopCheckoutAttempt1786024108434 implements MigrationInterface {
+  name = "JarShopCheckoutAttempt1786024108434";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE "jarshop_checkout_attempt" (
+        "id" SERIAL NOT NULL,
+        "attemptId" character varying(36) NOT NULL,
+        "marketCode" character varying(64) NOT NULL,
+        "languageCode" character varying(32) NOT NULL,
+        "status" character varying(16) NOT NULL,
+        "inputHash" character varying(128) NOT NULL,
+        "orderId" integer,
+        "errorCode" character varying(64),
+        "createdAt" TIMESTAMP NOT NULL DEFAULT now(),
+        "updatedAt" TIMESTAMP NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_jarshop_checkout_attempt" PRIMARY KEY ("id"),
+        CONSTRAINT "UQ_jarshop_checkout_attempt_attempt_id" UNIQUE ("attemptId")
+      )
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP TABLE "jarshop_checkout_attempt"`);
+  }
+}

package/dist/template/src/migrations/1786024108435-jarshop-legal-and-confirmation.ts

@@ -0,0 +1,60 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class JarShopLegalAndConfirmation1786024108435 implements MigrationInterface {
+  name = "JarShopLegalAndConfirmation1786024108435";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE "jarshop_legal_configuration" (
+        "id" SERIAL NOT NULL,
+        "channelId" integer NOT NULL,
+        "languageCode" character varying(10) NOT NULL,
+        "termsVersion" character varying(64) NOT NULL,
+        "termsUrl" character varying(2048) NOT NULL,
+        "privacyVersion" character varying(64) NOT NULL,
+        "privacyUrl" character varying(2048) NOT NULL,
+        "createdAt" TIMESTAMP NOT NULL DEFAULT now(),
+        "updatedAt" TIMESTAMP NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_jarshop_legal_configuration" PRIMARY KEY ("id"),
+        CONSTRAINT "UQ_jarshop_legal_channel_language" UNIQUE ("channelId", "languageCode")
+      )
+    `);
+    await queryRunner.query(`
+      CREATE TABLE "jarshop_order_consent" (
+        "id" SERIAL NOT NULL,
+        "orderId" integer NOT NULL,
+        "termsVersion" character varying(64) NOT NULL,
+        "termsUrl" character varying(2048) NOT NULL,
+        "privacyUrl" character varying(2048) NOT NULL,
+        "acceptedAt" TIMESTAMP WITH TIME ZONE NOT NULL,
+        "createdAt" TIMESTAMP NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_jarshop_order_consent" PRIMARY KEY ("id"),
+        CONSTRAINT "UQ_jarshop_order_consent_order" UNIQUE ("orderId")
+      )
+    `);
+    await queryRunner.query(`
+      CREATE TABLE "jarshop_confirmation_token" (
+        "id" SERIAL NOT NULL,
+        "tokenHash" character varying(128) NOT NULL,
+        "orderId" integer NOT NULL,
+        "expiresAt" TIMESTAMP WITH TIME ZONE NOT NULL,
+        "consumedAt" TIMESTAMP WITH TIME ZONE,
+        "createdAt" TIMESTAMP NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_jarshop_confirmation_token" PRIMARY KEY ("id"),
+        CONSTRAINT "UQ_jarshop_confirmation_token_hash" UNIQUE ("tokenHash")
+      )
+    `);
+    await queryRunner.query(
+      `CREATE INDEX "IDX_jarshop_confirmation_token_order" ON "jarshop_confirmation_token" ("orderId")`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "IDX_jarshop_confirmation_token_order"`,
+    );
+    await queryRunner.query(`DROP TABLE "jarshop_confirmation_token"`);
+    await queryRunner.query(`DROP TABLE "jarshop_order_consent"`);
+    await queryRunner.query(`DROP TABLE "jarshop_legal_configuration"`);
+  }
+}

package/dist/template/src/migrations/1786024108436-jarshop-order-email-outbox.ts

@@ -0,0 +1,37 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class JarShopOrderEmailOutbox1786024108436 implements MigrationInterface {
+  name = "JarShopOrderEmailOutbox1786024108436";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE TABLE "jarshop_order_email_delivery" (
+        "id" SERIAL NOT NULL,
+        "orderId" integer NOT NULL,
+        "checkoutAttemptId" character varying(36) NOT NULL,
+        "kind" character varying(64) NOT NULL,
+        "languageCode" character varying(10) NOT NULL,
+        "status" character varying(16) NOT NULL,
+        "payloadCiphertext" text NOT NULL,
+        "attemptCount" integer NOT NULL DEFAULT 0,
+        "nextAttemptAt" TIMESTAMP WITH TIME ZONE NOT NULL,
+        "lastErrorCode" character varying(64),
+        "sentAt" TIMESTAMP WITH TIME ZONE,
+        "createdAt" TIMESTAMP NOT NULL DEFAULT now(),
+        "updatedAt" TIMESTAMP NOT NULL DEFAULT now(),
+        CONSTRAINT "PK_jarshop_order_email_delivery" PRIMARY KEY ("id"),
+        CONSTRAINT "UQ_jarshop_order_email_delivery_order_kind" UNIQUE ("orderId", "kind")
+      )
+    `);
+    await queryRunner.query(
+      `CREATE INDEX "IDX_jarshop_order_email_delivery_pending" ON "jarshop_order_email_delivery" ("status", "nextAttemptAt")`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "IDX_jarshop_order_email_delivery_pending"`,
+    );
+    await queryRunner.query(`DROP TABLE "jarshop_order_email_delivery"`);
+  }
+}

package/dist/template/src/migrations/1786030000000-jarshop-order-email-delivery-lease.ts

@@ -0,0 +1,27 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/**
+ * This is additive and nullable: existing pending/sent deliveries remain valid
+ * while application code rolls forward. It must not delete delivery intent.
+ */
+export class JarShopOrderEmailDeliveryLease1786030000000 implements MigrationInterface {
+  name = "JarShopOrderEmailDeliveryLease1786030000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "jarshop_order_email_delivery" ADD "leaseToken" character varying(36)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "jarshop_order_email_delivery" ADD "leaseExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "jarshop_order_email_delivery" DROP COLUMN "leaseExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "jarshop_order_email_delivery" DROP COLUMN "leaseToken"`,
+    );
+  }
+}

package/dist/template/src/plugins/jarshop-checkout/checkout-attempt.entity.ts

@@ -0,0 +1,42 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from "typeorm";
+
+export type CheckoutAttemptStatus = "processing" | "completed" | "failed";
+
+@Entity({ name: "jarshop_checkout_attempt" })
+export class CheckoutAttempt {
+  @PrimaryGeneratedColumn()
+  id!: number;
+
+  @Column({ type: "varchar", length: 36, unique: true })
+  attemptId!: string;
+
+  @Column({ type: "varchar", length: 64 })
+  marketCode!: string;
+
+  @Column({ type: "varchar", length: 32 })
+  languageCode!: string;
+
+  @Column({ type: "varchar", length: 16 })
+  status!: CheckoutAttemptStatus;
+
+  @Column({ type: "varchar", length: 128 })
+  inputHash!: string;
+
+  @Column({ type: "int", nullable: true })
+  orderId!: number | null;
+
+  @Column({ type: "varchar", length: 64, nullable: true })
+  errorCode!: string | null;
+
+  @CreateDateColumn()
+  createdAt!: Date;
+
+  @UpdateDateColumn()
+  updatedAt!: Date;
+}

package/dist/template/src/plugins/jarshop-checkout/cod-payment.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import type {
+  Order,
+  Payment,
+  PaymentMethod,
+  RequestContext,
+} from "@vendure/core";
+import { jarShopCodPaymentHandler } from "./cod-payment.js";
+
+const context = {} as RequestContext;
+const order = { code: "ORDER-123" } as Order;
+const method = {} as PaymentMethod;
+
+describe("jarShopCodPaymentHandler", () => {
+  it("authorizes COD without pretending that money was collected", async () => {
+    const result = await jarShopCodPaymentHandler.createPayment(
+      context,
+      order,
+      12_345,
+      [],
+      { attemptId: "attempt-1" },
+      method,
+    );
+
+    expect(result).toMatchObject({
+      amount: 12_345,
+      state: "Authorized",
+      transactionId: "cod:ORDER-123",
+      method: "jarshop-cod-handler",
+    });
+  });
+
+  it("allows an operator-driven settlement after collection", async () => {
+    const result = await jarShopCodPaymentHandler.settlePayment(
+      context,
+      order,
+      {} as Payment,
+      [],
+      method,
+    );
+
+    expect(result).toEqual({ success: true });
+  });
+});

package/dist/template/src/plugins/jarshop-checkout/cod-payment.ts

@@ -0,0 +1,28 @@
+import { LanguageCode, PaymentMethodHandler } from "@vendure/core";
+
+/**
+ * Cash on delivery is a two-step payment: checkout authorizes collection, and
+ * an authenticated operator settles it only after money is actually received.
+ */
+export const jarShopCodPaymentHandler = new PaymentMethodHandler({
+  code: "jarshop-cod-handler",
+  description: [
+    {
+      languageCode: LanguageCode.sk,
+      value: "Dobierka s manuálnym potvrdením prijatia platby",
+    },
+    {
+      languageCode: LanguageCode.en,
+      value: "Cash on delivery with manual payment collection",
+    },
+  ],
+  args: {},
+  createPayment: async (_ctx, order, amount, _args, metadata) => ({
+    amount,
+    state: "Authorized" as const,
+    transactionId: `cod:${order.code}`,
+    metadata,
+  }),
+  settlePayment: async () => ({ success: true }),
+  cancelPayment: async () => ({ success: true }),
+});

package/dist/template/src/plugins/jarshop-checkout/confirmation-token.entity.ts

@@ -0,0 +1,31 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  Index,
+  PrimaryGeneratedColumn,
+  Unique,
+} from "typeorm";
+
+@Entity({ name: "jarshop_confirmation_token" })
+export class JarShopConfirmationToken {
+  @PrimaryGeneratedColumn()
+  id!: number;
+
+  @Unique("UQ_jarshop_confirmation_token_hash", ["tokenHash"])
+  @Column({ type: "varchar", length: 128 })
+  tokenHash!: string;
+
+  @Index("IDX_jarshop_confirmation_token_order")
+  @Column({ type: "int" })
+  orderId!: number;
+
+  @Column({ type: "timestamptz" })
+  expiresAt!: Date;
+
+  @Column({ type: "timestamptz", nullable: true })
+  consumedAt!: Date | null;
+
+  @CreateDateColumn()
+  createdAt!: Date;
+}

package/dist/template/src/plugins/jarshop-checkout/confirmation.ts

@@ -0,0 +1,59 @@
+import { createHash, randomBytes } from "node:crypto";
+
+export const CONFIRMATION_TTL_MS = 2 * 60 * 60 * 1000;
+export const CONFIRMATION_COOKIE_NAME = "jarshop-confirmation";
+
+export function hashConfirmationToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function createConfirmationToken(now = Date.now()) {
+  const token = randomBytes(32).toString("base64url");
+  return {
+    token,
+    tokenHash: hashConfirmationToken(token),
+    expiresAt: new Date(now + CONFIRMATION_TTL_MS),
+  };
+}
+
+export function canExchangeConfirmationToken(input: {
+  expiresAt: Date;
+  consumedAt: Date | null;
+  now?: number;
+}): boolean {
+  return (
+    input.consumedAt === null &&
+    input.expiresAt.getTime() > (input.now ?? Date.now())
+  );
+}
+
+export function canReadConfirmationCredential(input: {
+  expiresAt: Date;
+  consumedAt: Date | null;
+  now?: number;
+}): boolean {
+  return (
+    input.consumedAt !== null &&
+    input.expiresAt.getTime() > (input.now ?? Date.now())
+  );
+}
+
+export function readCookieValue(
+  cookieHeader: string,
+  cookieName: string,
+): string | undefined {
+  for (const part of cookieHeader.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0 || part.slice(0, separator).trim() !== cookieName) {
+      continue;
+    }
+    const value = part.slice(separator + 1).trim();
+    if (!value) return undefined;
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
+}