@meith/plugin-dues 0.17.1 → 0.17.2

package/README.md

@@ -70,7 +70,9 @@ history behind it, and a checkout a visitor can actually go through. See
      defaults to, what the ledger shows, and the fallback when a Stripe
      event carries no currency of its own) and the days a lapsed renewal
      keeps access. `DUES_CURRENCY` and `DUES_GRACE_DAYS` override them from
-     the environment, on the same rule as the keys below.
+     the environment, on the same rule as the keys below. `DUES_CURRENCY` is
+     matched case-insensitively and trimmed — `EUR` and `eur` both select
+     the same option — but write it lower-case.
    - **`DUES_STRIPE_SECRET_KEY`** and **`DUES_STRIPE_WEBHOOK_SECRET`** — set
      in the environment, or filled in here. Environment wins, and the
      screen says which source is in force.
@@ -101,9 +103,12 @@ A plan is made and edited in the panel. It has a permanent key, a name, a
 description, the group it grants, a price in minor units, its own three-letter
 currency, and one of three billing shapes:
 
-- **A pass** — one payment for a fixed stretch, one day to two years
-  (including the grace window; the board caps a plugin grant at two years,
-  and a pass respects the cap rather than pretending otherwise).
+- **A pass** — one payment for a fixed stretch, one day to two years minus
+  the longest possible grace window: the board caps a plugin grant at two
+  years, checked against the grace setting's maximum (30 days) rather than
+  whatever it is set to today, since grace can be raised after the plan
+  already exists — and a pass respects the cap rather than pretending
+  otherwise.
 - **A subscription** — renews monthly or yearly until cancelled. It bills
   against a real Stripe price: leave the box empty and the plugin mints a
   product and price to match the form, or paste a `price_…` id made in the
@@ -124,6 +129,13 @@ sees the new number. Plans are never deleted — **archiving** takes one off
 sale while everyone who holds it keeps it. The plan key is permanent because
 it is how orders, memberships and the ledger refer to the plan forever.
 
+A pass's length is part of that snapshot, and settlement reads it from the
+order, not from the plan row — an edit made while a buyer is mid-checkout
+grants what they paid for, never the edited length. Money already worked
+this way (the exact-match rule above); the length just needed to match it.
+The plan's own length is a fallback only, for an order that genuinely
+predates carrying one of its own.
+
 ## How it decides things
 
 - **A pass stacks.** Buying a fixed pass while holding one adds to the end —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/plugin-dues",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Membership dues for a Meith board: Stripe-backed subscriptions as a contained plugin.",
   "license": "LGPL-3.0-or-later",
   "repository": {
@@ -20,8 +20,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@meith/plugin-kit": "^0.17.1",
-    "@meith/theme-kit": "^0.17.1"
+    "@meith/plugin-kit": "^0.17.2",
+    "@meith/theme-kit": "^0.17.2"
   },
   "peerDependencies": {
     "react": "^19.2.0"

package/src/definition.tsx

@@ -50,9 +50,11 @@ import { GoPage, ManagePage, PlansPage, ReturnPage } from './ui/pages'
 export function createDues(input: DuesConfigInput = {}): PluginDefinition {
   const staticConfig = parseDuesConfig(input)
 
-  // Resolved fresh per call: `currency` and `graceDays` are settings, so a
-  // request made after an operator edits them must see the new value, not
-  // one baked in when the plugin was registered.
+  /**
+   * Resolved fresh per call: `currency` and `graceDays` are settings, so a
+   * request made after an operator edits them must see the new value, not
+   * one baked in when the plugin was registered.
+   */
   const configFor = (context: PluginRuntimeContext): DuesConfig =>
     resolveDuesConfig(staticConfig, context.settings)
 
@@ -66,7 +68,7 @@ export function createDues(input: DuesConfigInput = {}): PluginDefinition {
   return definePlugin({
     key: 'dues',
     name: 'Dues',
-    version: '0.17.1',
+    version: '0.17.2',
     description: en['dues.definition.description'].replace(
       '{label}',
       staticConfig.label.toLowerCase(),
@@ -94,10 +96,6 @@ export function createDues(input: DuesConfigInput = {}): PluginDefinition {
         type: 'number',
         env: 'DUES_GRACE_DAYS',
         default: DEFAULT_GRACE_DAYS,
-        // PluginSetting has no descriptionArgs — unlike the definition's own
-        // description, a setting's is translated with no interpolation — so
-        // the range is spelled out in the catalog text itself, and MIN/MAX
-        // below only need to stay in sync with the words there by hand.
         description: en['dues.definition.setting.graceDays.description'],
         descriptionKey: 'dues.definition.setting.graceDays.description',
       },

package/src/entitlement.ts

@@ -187,26 +187,22 @@ function settledPeriodEnd(
       existing !== null && existing.currentPeriodEnd > now ? existing.currentPeriodEnd : now
     if (isLifetime(base)) return LIFETIME_END
     const parsed =
+      parseStoredPeriod(order) ??
       (plan?.periodSpec !== null && plan?.periodSpec !== undefined
         ? parsePeriod(plan.periodSpec)
-        : null) ?? parseStoredPeriod(order)
+        : null) ??
+      FALLBACK_PERIOD
     return addPeriod(base, parsed)
   }
 
   return addBillingInterval(now, plan?.billingInterval ?? 'month')
 }
 
+/** @see plugins/dues/README.md#changing-and-retiring-one */
+const FALLBACK_PERIOD = { years: 0, months: 0, weeks: 0, days: 30 }
+
 function parseStoredPeriod(order: OrderRow) {
-  const fallback = { years: 0, months: 0, weeks: 0, days: 30 }
-  if (order.periodSpec === null) return fallback
-  const match = /^P(?:(\d+)Y)?(?:(\d+)M)?(?:(\d+)W)?(?:(\d+)D)?$/.exec(order.periodSpec)
-  if (match === null) return fallback
-  return {
-    years: Number(match[1] ?? 0),
-    months: Number(match[2] ?? 0),
-    weeks: Number(match[3] ?? 0),
-    days: Number(match[4] ?? 0),
-  }
+  return order.periodSpec === null ? null : parsePeriod(order.periodSpec)
 }
 
 export async function applyInternalEvent(

package/src/handlers-admin.ts

@@ -275,7 +275,7 @@ export async function handleAdminPlanCreate(
   services: DuesServices,
   request: PluginRequest,
 ): Promise<PluginResponse> {
-  const parsed = parsePlanForm(request.form ?? {}, services.config.graceDays)
+  const parsed = parsePlanForm(request.form ?? {})
   if (!parsed.ok) return toAdmin('plans', { error: parsed.error })
   const plan = parsed.plan
 
@@ -321,10 +321,7 @@ export async function handleAdminPlanUpdate(
   const existing = id === null ? null : await planRowById(services.context.data, id)
   if (existing === null) return toAdmin('plans', { error: 'no-such-plan' })
 
-  const parsed = parsePlanForm(
-    { ...request.form, key: existing.key, mode: existing.mode },
-    services.config.graceDays,
-  )
+  const parsed = parsePlanForm({ ...request.form, key: existing.key, mode: existing.mode })
   if (!parsed.ok) return toAdmin('plans', { error: parsed.error })
   const plan = parsed.plan
 

package/src/handlers.ts

@@ -70,12 +70,24 @@ export function entitlementDeps(services: DuesServices): EntitlementDeps {
   }
 }
 
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '[::1]'])
+
+/** docs/membership-guide.md#origin-for-stripe-redirects */
+function isLoopbackHost(host: string): boolean {
+  let parsed: URL
+  try {
+    parsed = new URL(`http://${host}`)
+  } catch {
+    return false
+  }
+  return LOOPBACK_HOSTNAMES.has(parsed.hostname.toLowerCase())
+}
+
+/** docs/membership-guide.md#origin-for-stripe-redirects */
 export function requestOrigin(request: PluginRequest): string {
   if (request.boardUrl !== '') return request.boardUrl
-  const host = request.headers['x-forwarded-host'] ?? request.headers.host ?? 'localhost'
-  const loopback = host.startsWith('127.0.0.1') || host.startsWith('localhost')
-  const proto = request.headers['x-forwarded-proto'] ?? (loopback ? 'http' : 'https')
-  return `${proto}://${host}`
+  const host = request.headers.host ?? ''
+  return isLoopbackHost(host) ? `http://${host}` : ''
 }
 
 function back(query: Record<string, string>): PluginResponse {
@@ -200,6 +212,9 @@ export async function handleCheckout(
   if (services.stripe === null) return back({ error: 'unconfigured' })
   const stripe = services.stripe
 
+  const origin = requestOrigin(request)
+  if (origin === '') return back({ error: 'unconfigured' })
+
   try {
     let customerId = await findStripeCustomer(services.context.data, buyerId)
     if (customerId === null) {
@@ -210,7 +225,6 @@ export async function handleCheckout(
       customerId = customer.id
     }
 
-    const origin = requestOrigin(request)
     const productName =
       recipientName === null ? plan.name : `${plan.name} — a gift for ${recipientName}`
 
@@ -339,13 +353,16 @@ export async function handlePortal(
   if (userId === null) return backToManage({ error: 'sign-in' })
   if (services.stripe === null) return backToManage({ error: 'unconfigured' })
 
+  const origin = requestOrigin(request)
+  if (origin === '') return backToManage({ error: 'unconfigured' })
+
   const customerId = await findStripeCustomer(services.context.data, userId)
   if (customerId === null) return backToManage({ error: 'no-customer' })
 
   try {
     const portal = await services.stripe.createBillingPortalSession({
       customer: customerId,
-      returnUrl: `${requestOrigin(request)}/plugins/dues/manage`,
+      returnUrl: `${origin}/plugins/dues/manage`,
     })
     return offsite(portal.url)
   } catch (error) {

package/src/index.ts

@@ -1,8 +1,10 @@
+/**
+ * `plugin` and `messages` (below) are the manifest-installable convention
+ * board.plugins.json generation relies on (scripts/board-plugins-gen.mjs) —
+ * re-exports, not a second definition, so `dues` stays the name everyone
+ * reads in code that names it directly.
+ */
 export type { DuesConfigInput, DuesPlanInput } from './config'
-// `plugin` and `messages` (below) are the manifest-installable convention
-// board.plugins.json generation relies on (scripts/board-plugins-gen.mjs) —
-// re-exports, not a second definition, so `dues` stays the name everyone
-// reads in code that names it directly.
 export { createDues, dues, dues as plugin } from './definition'
 export {
   DUES_DEMO_CODES,

package/src/messages/en.json

@@ -123,7 +123,7 @@
   "dues.admin.plans.subscription": "a subscription — renews itself",
   "dues.admin.plans.takeOffSale": "Take it off sale",
   "dues.admin.plans.thePlans": "The plans",
-  "dues.admin.plans.tooLong": "A pass plus its grace window cannot reach past two years ({days} days) — that is the board’s cap on a plugin grant. Sell lifetime instead.",
+  "dues.admin.plans.tooLong": "A pass plus the longest possible grace window ({days} days) cannot reach past two years — that is the board’s cap on a plugin grant, checked against the grace setting’s maximum, not whatever it is set to today. Sell lifetime instead.",
   "dues.admin.plans.unit": "…counted in",
   "dues.admin.plans.updated": "{key} is updated. Existing memberships and running subscriptions keep what they bought; the change is for the next buyer.",
   "dues.admin.plans.weeks": "weeks",

package/src/plans.ts

@@ -1,6 +1,6 @@
 import type { PluginData } from '@meith/plugin-kit'
 
-import type { DuesConfig } from './config'
+import { type DuesConfig, MAX_GRACE_DAYS } from './config'
 import { isCurrencyCode, isValidMinorAmount } from './money'
 import { addDays, type Period, parsePeriod, periodCeilingDays } from './period'
 import {
@@ -117,7 +117,13 @@ function bad(error: string): PlanParse {
   return { ok: false, error }
 }
 
-export function parsePlanForm(form: PlanFormInput, graceDays: number): PlanParse {
+/**
+ * Checks a fixed plan's length against `MAX_GRACE_DAYS`, not the live
+ * `grace_days` setting — mirroring the seed-path cap in `parseDuesConfig`
+ * (`config.ts`), for the same reason: `grace_days` is a runtime setting an
+ * operator can raise after the plan already exists.
+ */
+export function parsePlanForm(form: PlanFormInput): PlanParse {
   const key = (form.key ?? '').trim().toLowerCase()
   if (!PLAN_KEY.test(key)) return bad('bad-key')
 
@@ -157,7 +163,7 @@ export function parsePlanForm(form: PlanFormInput, graceDays: number): PlanParse
     periodSpec = `P${length}${letter}`
     const parsed = parsePeriod(periodSpec)
     if (parsed === null) return bad('bad-length')
-    if (periodCeilingDays(parsed) + graceDays > MAX_PLAN_DAYS) return bad('too-long')
+    if (periodCeilingDays(parsed) + MAX_GRACE_DAYS > MAX_PLAN_DAYS) return bad('too-long')
   }
 
   if (mode === 'auto') {

package/src/ui/admin.tsx

@@ -2,9 +2,9 @@ import type { ReactNode } from 'react'
 
 import type { PluginAdminPageContext } from '@meith/plugin-kit'
 
-import type { DuesConfig } from '../config'
+import { type DuesConfig, MAX_GRACE_DAYS } from '../config'
 import { formatMinor } from '../money'
-import { describeBilling, isLifetime, loadPlans, MAX_PLAN_DAYS } from '../plans'
+import { describeBilling, isLifetime, loadPlans } from '../plans'
 import {
   allMemberships,
   attentionCount,
@@ -571,7 +571,7 @@ export async function CodesPage({
         <BadNotice>
           {context.t.t(
             error,
-            context.query.error === 'too-long' ? { days: MAX_PLAN_DAYS } : undefined,
+            context.query.error === 'too-long' ? { days: MAX_GRACE_DAYS } : undefined,
           )}
         </BadNotice>
       )}