@jarwizz/create-jarshop 0.1.2 → 0.1.4

package/dist/template/pnpm-workspace.yaml

@@ -1,4 +1,15 @@
-packages: []
+packages:
+  - .
+  - storefront
+
+# The eslint-config-next range otherwise resolves a newer unreviewed resolver,
+# which pnpm rejects as a trust downgrade. Keep the reviewed compatible
+# resolver exact for the whole Client Project workspace.
+overrides:
+  eslint-import-resolver-typescript: 3.8.7
+
+minimumReleaseAgeExclude:
+  - "@jarwizz/commerce-sdk@0.3.0"
 
 allowBuilds:
   bcrypt: true

package/dist/template/src/plugins/jarshop-checkout/cod-payment.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import type {
+  Order,
+  Payment,
+  PaymentMethod,
+  RequestContext,
+} from "@vendure/core";
+import { jarShopCodPaymentHandler } from "./cod-payment.js";
+
+const context = {} as RequestContext;
+const order = { code: "ORDER-123" } as Order;
+const method = {} as PaymentMethod;
+
+describe("jarShopCodPaymentHandler", () => {
+  it("authorizes COD without pretending that money was collected", async () => {
+    const result = await jarShopCodPaymentHandler.createPayment(
+      context,
+      order,
+      12_345,
+      [],
+      { attemptId: "attempt-1" },
+      method,
+    );
+
+    expect(result).toMatchObject({
+      amount: 12_345,
+      state: "Authorized",
+      transactionId: "cod:ORDER-123",
+      method: "jarshop-cod-handler",
+    });
+  });
+
+  it("allows an operator-driven settlement after collection", async () => {
+    const result = await jarShopCodPaymentHandler.settlePayment(
+      context,
+      order,
+      {} as Payment,
+      [],
+      method,
+    );
+
+    expect(result).toEqual({ success: true });
+  });
+});

package/dist/template/src/plugins/jarshop-checkout/cod-payment.ts

@@ -0,0 +1,28 @@
+import { LanguageCode, PaymentMethodHandler } from "@vendure/core";
+
+/**
+ * Cash on delivery is a two-step payment: checkout authorizes collection, and
+ * an authenticated operator settles it only after money is actually received.
+ */
+export const jarShopCodPaymentHandler = new PaymentMethodHandler({
+  code: "jarshop-cod-handler",
+  description: [
+    {
+      languageCode: LanguageCode.sk,
+      value: "Dobierka s manuálnym potvrdením prijatia platby",
+    },
+    {
+      languageCode: LanguageCode.en,
+      value: "Cash on delivery with manual payment collection",
+    },
+  ],
+  args: {},
+  createPayment: async (_ctx, order, amount, _args, metadata) => ({
+    amount,
+    state: "Authorized" as const,
+    transactionId: `cod:${order.code}`,
+    metadata,
+  }),
+  settlePayment: async () => ({ success: true }),
+  cancelPayment: async () => ({ success: true }),
+});

package/dist/template/src/plugins/jarshop-checkout/confirmation.ts

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 
 export const CONFIRMATION_TTL_MS = 2 * 60 * 60 * 1000;
+export const CONFIRMATION_COOKIE_NAME = "jarshop-confirmation";
 
 export function hashConfirmationToken(token: string): string {
   return createHash("sha256").update(token).digest("hex");
@@ -15,12 +16,57 @@ export function createConfirmationToken(now = Date.now()) {
   };
 }
 
-export function canUseConfirmationToken(input: {
+/**
+ * Independent one-time credentials for the browser hand-off and e-mail link.
+ *
+ * Checkout exchanges the browser token immediately. Reusing it in the outbox
+ * would make the e-mail link a replay before the customer receives it.
+ */
+export function createConfirmationTokenPair(now = Date.now()) {
+  return {
+    browser: createConfirmationToken(now),
+    email: createConfirmationToken(now),
+  };
+}
+
+export function canExchangeConfirmationToken(input: {
+  expiresAt: Date;
+  consumedAt: Date | null;
+  now?: number;
+}): boolean {
+  return (
+    input.consumedAt === null &&
+    input.expiresAt.getTime() > (input.now ?? Date.now())
+  );
+}
+
+export function canReadConfirmationCredential(input: {
   expiresAt: Date;
   consumedAt: Date | null;
-  cookieMatches: boolean;
   now?: number;
 }): boolean {
-  if (input.expiresAt.getTime() <= (input.now ?? Date.now())) return false;
-  return input.consumedAt === null || input.cookieMatches;
+  return (
+    input.consumedAt !== null &&
+    input.expiresAt.getTime() > (input.now ?? Date.now())
+  );
+}
+
+export function readCookieValue(
+  cookieHeader: string,
+  cookieName: string,
+): string | undefined {
+  for (const part of cookieHeader.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0 || part.slice(0, separator).trim() !== cookieName) {
+      continue;
+    }
+    const value = part.slice(separator + 1).trim();
+    if (!value) return undefined;
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
 }

package/dist/template/src/plugins/jarshop-checkout/index.ts

@@ -1,11 +1,15 @@
 export { CheckoutAttempt } from "./checkout-attempt.entity.js";
 export type { CheckoutAttemptStatus } from "./checkout-attempt.entity.js";
+export { jarShopCodPaymentHandler } from "./cod-payment.js";
 export { JarShopConfirmationToken } from "./confirmation-token.entity.js";
 export {
   CONFIRMATION_TTL_MS,
-  canUseConfirmationToken,
+  CONFIRMATION_COOKIE_NAME,
+  canExchangeConfirmationToken,
+  canReadConfirmationCredential,
   createConfirmationToken,
   hashConfirmationToken,
+  readCookieValue,
 } from "./confirmation.js";
 export { JarShopLegalConfiguration } from "./legal.entity.js";
 export { JarShopOrderEmailDelivery } from "./order-email-delivery.entity.js";

package/dist/template/src/plugins/jarshop-checkout/jarshop-checkout.plugin.ts

@@ -4,7 +4,7 @@ import { Inject, Injectable } from "@nestjs/common";
 import { Allow, Permission } from "@vendure/core";
 import { createHash } from "node:crypto";
 import { parse } from "graphql";
-import type { Repository } from "typeorm";
+import { IsNull, MoreThan, type Repository } from "typeorm";
 import {
   ActiveOrderService,
   Ctx,
@@ -23,9 +23,13 @@ import {
 import { CheckoutAttempt } from "./checkout-attempt.entity.js";
 import { JarShopConfirmationToken } from "./confirmation-token.entity.js";
 import {
-  canUseConfirmationToken,
+  CONFIRMATION_COOKIE_NAME,
+  canExchangeConfirmationToken,
+  canReadConfirmationCredential,
   createConfirmationToken,
+  createConfirmationTokenPair,
   hashConfirmationToken,
+  readCookieValue,
 } from "./confirmation.js";
 import { JarShopLegalConfiguration } from "./legal.entity.js";
 import { JarShopOrderEmailDelivery } from "./order-email-delivery.entity.js";
@@ -111,6 +115,10 @@ const schema = parse(`
     totalWithTax: Int!
     currencyCode: String!
   }
+  type JarShopOrderConfirmationExchange {
+    credential: String!
+    confirmation: JarShopOrderConfirmation!
+  }
   input JarShopLegalConfigurationInput {
     languageCode: String!
     termsVersion: String!
@@ -120,10 +128,11 @@ const schema = parse(`
   }
   extend type Query {
     jarShopLegalConfiguration(languageCode: String!): JarShopLegalConfiguration
-    jarShopOrderConfirmation(token: String!): JarShopOrderConfirmation
+    jarShopProtectedOrderConfirmation(orderCode: String!): JarShopOrderConfirmation
   }
   extend type Mutation {
     placeJarShopOrder(input: JarShopPlaceOrderInput!): JarShopPlaceOrderResult!
+    exchangeJarShopOrderConfirmation(token: String!): JarShopOrderConfirmationExchange
     updateJarShopLegalConfiguration(input: JarShopLegalConfigurationInput!): JarShopLegalConfiguration!
   }
 `);
@@ -222,8 +231,8 @@ class JarShopCheckoutResolver {
     return configuration ? toLegalConfiguration(configuration) : null;
   }
 
-  @Query()
-  async jarShopOrderConfirmation(
+  @Mutation()
+  async exchangeJarShopOrderConfirmation(
     @Ctx() ctx: RequestContext,
     @Args("token") token: string,
   ) {
@@ -234,31 +243,70 @@ class JarShopCheckoutResolver {
     const record = await repository.findOne({
       where: { tokenHash: hashConfirmationToken(token) },
     });
-    if (!record || record.expiresAt.getTime() <= Date.now()) return null;
-    const cookie = ctx.req?.headers.cookie ?? "";
-    const exchanged = cookie.includes(`jarshop-confirmation=${token}`);
+    const now = new Date();
     if (
-      !canUseConfirmationToken({
+      !record ||
+      !canExchangeConfirmationToken({
         expiresAt: record.expiresAt,
         consumedAt: record.consumedAt,
-        cookieMatches: exchanged,
+        now: now.getTime(),
       })
     ) {
       return null;
     }
-    if (!record.consumedAt) {
-      record.consumedAt = new Date();
-      await repository.save(record);
+    const order = await this.orderService.findOne(ctx, record.orderId);
+    if (!order) return null;
+
+    const credential = createConfirmationToken(now.getTime());
+    const update = await repository.update(
+      {
+        id: record.id,
+        tokenHash: record.tokenHash,
+        consumedAt: IsNull(),
+        expiresAt: MoreThan(now),
+      },
+      {
+        tokenHash: credential.tokenHash,
+        consumedAt: now,
+      },
+    );
+    if (update.affected !== 1) return null;
+
+    return {
+      credential: credential.token,
+      confirmation: toOrderConfirmation(order),
+    };
+  }
+
+  @Query()
+  async jarShopProtectedOrderConfirmation(
+    @Ctx() ctx: RequestContext,
+    @Args("orderCode") orderCode: string,
+  ) {
+    const credential = readCookieValue(
+      ctx.req?.headers.cookie ?? "",
+      CONFIRMATION_COOKIE_NAME,
+    );
+    if (!credential) return null;
+    const repository = this.connection.getRepository(
+      ctx,
+      JarShopConfirmationToken,
+    );
+    const record = await repository.findOne({
+      where: { tokenHash: hashConfirmationToken(credential) },
+    });
+    if (
+      !record ||
+      !canReadConfirmationCredential({
+        expiresAt: record.expiresAt,
+        consumedAt: record.consumedAt,
+      })
+    ) {
+      return null;
     }
     const order = await this.orderService.findOne(ctx, record.orderId);
-    return order
-      ? {
-          orderId: order.id,
-          orderCode: order.code,
-          state: order.state,
-          totalWithTax: order.totalWithTax,
-          currencyCode: order.currencyCode,
-        }
+    return order && order.code === orderCode
+      ? toOrderConfirmation(order)
       : null;
   }
 
@@ -536,8 +584,8 @@ class JarShopCheckoutResolver {
       ctx,
       activeOrder.id,
       {
-        method: "dummy-payment-method",
-        metadata: { attemptId: input.attemptId, method: "cod" },
+        method: "cod",
+        metadata: { attemptId: input.attemptId },
       },
     );
     if (isGraphQlErrorResult(paymentResult)) {
@@ -566,19 +614,25 @@ class JarShopCheckoutResolver {
         acceptedAt: new Date(),
       }),
     );
-    const confirmation = createConfirmationToken();
+    const confirmations = createConfirmationTokenPair();
     const tokenRepository = this.connection.getRepository(
       ctx,
       JarShopConfirmationToken,
     );
-    await tokenRepository.save(
+    await tokenRepository.save([
       tokenRepository.create({
-        tokenHash: confirmation.tokenHash,
+        tokenHash: confirmations.browser.tokenHash,
         orderId: Number(paymentResult.id),
-        expiresAt: confirmation.expiresAt,
+        expiresAt: confirmations.browser.expiresAt,
         consumedAt: null,
       }),
-    );
+      tokenRepository.create({
+        tokenHash: confirmations.email.tokenHash,
+        orderId: Number(paymentResult.id),
+        expiresAt: confirmations.email.expiresAt,
+        consumedAt: null,
+      }),
+    ]);
     const emailDeliveryRepository = this.connection.getRepository(
       ctx,
       JarShopOrderEmailDelivery,
@@ -589,7 +643,7 @@ class JarShopCheckoutResolver {
           orderId: Number(paymentResult.id),
           checkoutAttemptId: attempt.attemptId,
           languageCode: input.languageCode,
-          confirmationToken: confirmation.token,
+          confirmationToken: confirmations.email.token,
         }),
       ),
     );
@@ -603,13 +657,13 @@ class JarShopCheckoutResolver {
           placedOrder,
           activeOrder.totalWithTax,
           activeOrder.currencyCode,
-          confirmation.token,
+          confirmations.browser.token,
         )
       : success(
           paymentResult,
           activeOrder.totalWithTax,
           activeOrder.currencyCode,
-          confirmation.token,
+          confirmations.browser.token,
         );
   }
 
@@ -783,6 +837,16 @@ function toLegalConfiguration(configuration: JarShopLegalConfiguration) {
   };
 }
 
+function toOrderConfirmation(order: Order) {
+  return {
+    orderId: order.id,
+    orderCode: order.code,
+    state: order.state,
+    totalWithTax: order.totalWithTax,
+    currencyCode: order.currencyCode,
+  };
+}
+
 /**
  * JarShop's server-owned checkout seam.
  *

package/dist/template/src/plugins/jarshop-checkout/order-email-delivery-core.ts

@@ -275,7 +275,7 @@ export function createOrderConfirmationUrl(
   const storefrontUrl =
     process.env.JARSHOP_STOREFRONT_URL ?? defaultStorefrontUrl;
   return new URL(
-    `/${languageCode}/checkout/success?token=${encodeURIComponent(token)}`,
+    `/${languageCode}/checkout/confirmation?token=${encodeURIComponent(token)}`,
     storefrontUrl,
   ).toString();
 }

package/dist/template/src/seed.ts

@@ -156,26 +156,48 @@ async function seed(): Promise<void> {
       channel.id,
     ]);
 
-    const paymentMethods =
-      await paymentMethodService.getActivePaymentMethods(ctx);
-    const cod =
-      paymentMethods.find((method) => method.code === "dummy-payment-method") ??
-      (await paymentMethodService.create(ctx, {
-        code: "dummy-payment-method",
-        enabled: true,
-        handler: {
-          code: "dummy-payment-handler",
-          arguments: [{ name: "automaticSettle", value: "false" }],
-        },
-        translations: [
-          { languageCode: LanguageCode.sk, name: "Dobierka", description: "" },
-          {
-            languageCode: LanguageCode.en,
-            name: "Cash on delivery",
-            description: "",
+    const paymentMethods = await paymentMethodService.findAll(ctx);
+    const legacyDummy = paymentMethods.items.find(
+      (method) => method.code === "dummy-payment-method",
+    );
+    if (legacyDummy?.enabled) {
+      await paymentMethodService.update(ctx, {
+        id: legacyDummy.id,
+        enabled: false,
+      });
+    }
+    const existingCod = paymentMethods.items.find(
+      (method) => method.code === "cod",
+    );
+    const cod = existingCod
+      ? await paymentMethodService.update(ctx, {
+          id: existingCod.id,
+          enabled: true,
+          handler: {
+            code: "jarshop-cod-handler",
+            arguments: [],
           },
-        ],
-      }));
+        })
+      : await paymentMethodService.create(ctx, {
+          code: "cod",
+          enabled: true,
+          handler: {
+            code: "jarshop-cod-handler",
+            arguments: [],
+          },
+          translations: [
+            {
+              languageCode: LanguageCode.sk,
+              name: "Dobierka",
+              description: "",
+            },
+            {
+              languageCode: LanguageCode.en,
+              name: "Cash on delivery",
+              description: "",
+            },
+          ],
+        });
     await channelService.assignToChannels(ctx, PaymentMethod, cod.id, [
       channel.id,
     ]);

package/dist/template/src/vendure-config.ts

@@ -3,7 +3,6 @@ import {
   DefaultSchedulerPlugin,
   DefaultSearchPlugin,
   VendureConfig,
-  dummyPaymentHandler,
 } from "@vendure/core";
 import { AssetServerPlugin } from "@vendure/asset-server-plugin";
 import { DashboardPlugin } from "@vendure/dashboard/plugin";
@@ -13,7 +12,10 @@ import {
   defaultEmailHandlers,
 } from "@vendure/email-plugin";
 import { GraphiqlPlugin } from "@vendure/graphiql-plugin";
-import { JarShopCheckoutPlugin } from "./plugins/jarshop-checkout/index.js";
+import {
+  JarShopCheckoutPlugin,
+  jarShopCodPaymentHandler,
+} from "./plugins/jarshop-checkout/index.js";
 import "dotenv/config";
 import path from "node:path";
 
@@ -76,7 +78,7 @@ export const config: VendureConfig = {
     username: process.env.DB_USERNAME,
     password: process.env.DB_PASSWORD,
   },
-  paymentOptions: { paymentMethodHandlers: [dummyPaymentHandler] },
+  paymentOptions: { paymentMethodHandlers: [jarShopCodPaymentHandler] },
   plugins: [
     JarShopCheckoutPlugin,
     GraphiqlPlugin.init(),

package/dist/template/storefront/app/[locale]/checkout/confirmation/route.ts

@@ -0,0 +1,21 @@
+import { NextResponse, type NextRequest } from "next/server";
+
+import { exchangeOrderConfirmation } from "../../../../lib/confirmation";
+import { parseLocale } from "../../../../lib/i18n";
+
+export async function GET(
+  request: NextRequest,
+  context: { params: Promise<{ locale: string }> },
+) {
+  const { locale } = await context.params;
+  const language = parseLocale(locale);
+  const token = request.nextUrl.searchParams.get("token");
+  const confirmation = token
+    ? await exchangeOrderConfirmation(language, token)
+    : null;
+  const target = new URL(`/${language}/checkout/success`, request.url);
+  if (confirmation) {
+    target.searchParams.set("order", confirmation.orderCode);
+  }
+  return NextResponse.redirect(target);
+}

package/dist/template/storefront/app/[locale]/checkout/success/page.tsx

@@ -3,15 +3,20 @@ import { getOrderConfirmation } from "../../../../lib/confirmation";
 
 interface CheckoutSuccessProps {
   params: Promise<{ locale: string }>;
+  searchParams: Promise<{ order?: string }>;
 }
 
 export default async function CheckoutSuccess({
   params,
+  searchParams,
 }: CheckoutSuccessProps) {
   const { locale } = await params;
+  const { order } = await searchParams;
   const language = parseLocale(locale);
   const t = createTranslator(language);
-  const confirmation = await getOrderConfirmation(language);
+  const confirmation = order
+    ? await getOrderConfirmation(language, order)
+    : null;
   return (
     <main lang={language}>
       <h1>{t("success.title")}</h1>

package/dist/template/storefront/app/[locale]/page.tsx

@@ -17,11 +17,11 @@ export default async function LocalePage({ params }: LocalePageProps) {
         <p className="eyebrow">JarShop starter</p>
         <h1>{t("catalog.title")}</h1>
       </div>
-      {!result.ok || result.data.length === 0 ? (
+      {!result.ok || result.data.items.length === 0 ? (
         <p>{t("catalog.empty")}</p>
       ) : (
         <ul className="product-grid">
-          {result.data.map((product) => (
+          {result.data.items.map((product) => (
             <li key={product.id}>
               <a href={`/${language}/${product.slug}`}>{product.name}</a>
               <p>{product.description}</p>

package/dist/template/storefront/eslint.config.mjs

@@ -5,5 +5,12 @@ import nextTypeScript from "eslint-config-next/typescript";
 export default defineConfig([
   ...nextVitals,
   ...nextTypeScript,
-  globalIgnores([".next/**", "dist/**", "out/**", "build/**", "next-env.d.ts"]),
+  globalIgnores([
+    ".next/**",
+    "dist/**",
+    "out/**",
+    "build/**",
+    "src/gql/**",
+    "next-env.d.ts",
+  ]),
 ]);

package/dist/template/storefront/lib/checkout.ts

@@ -8,11 +8,8 @@ import {
   commerceSessionAuthorization,
   persistCommerceSession,
 } from "./commerce-session";
-import {
-  confirmationCookieOptions,
-  CONFIRMATION_COOKIE_NAME,
-} from "./confirmation-cookie";
 import { PLACE_JARSHOP_ORDER_MUTATION } from "./checkout-contract";
+import { exchangeOrderConfirmation } from "./confirmation";
 
 export interface CheckoutCartSnapshot {
   currencyCode: string;
@@ -133,11 +130,20 @@ export async function placeOrder(
       affectedLineIds: result?.affectedLineIds ?? [],
     };
   }
-  store.set(
-    CONFIRMATION_COOKIE_NAME,
+  const confirmation = await exchangeOrderConfirmation(
+    locale,
     result.confirmationToken,
-    confirmationCookieOptions,
   );
-  redirect(`/${locale}/checkout/success`);
+  if (!confirmation || confirmation.orderCode !== result.orderCode) {
+    return {
+      ok: false,
+      errorCode: "ORDER_NOT_FOUND",
+      message: "Order confirmation is not available",
+      affectedLineIds: [],
+    };
+  }
+  redirect(
+    `/${locale}/checkout/success?order=${encodeURIComponent(result.orderCode)}`,
+  );
   return { ok: true };
 }

package/dist/template/storefront/lib/commerce.ts

@@ -6,9 +6,12 @@ import type {
   AccountAddressInput,
   AccountProfile,
   AccountOrdersOptions,
+  CatalogPage,
   ChangePasswordInput,
   CommerceResult,
   LoginInput,
+  ProductDetail,
+  ProductListOptions,
   ProductSummary,
   RegisterAccountInput,
   ResetPasswordInput,
@@ -37,14 +40,15 @@ function client(locale: CommerceLocale, sessionStore?: SessionStore) {
 
 export function getCatalog(
   locale: CommerceLocale,
-): Promise<CommerceResult<ProductSummary[]>> {
-  return client(locale).listProducts();
+  options?: ProductListOptions,
+): Promise<CommerceResult<CatalogPage<ProductSummary>>> {
+  return client(locale).listProducts(options);
 }
 
 export function getProduct(
   slug: string,
   locale: CommerceLocale,
-): Promise<CommerceResult<ProductSummary | null>> {
+): Promise<CommerceResult<ProductDetail | null>> {
   return client(locale).getProductBySlug(slug);
 }