@misiki/gocommerce-connector 0.4.2 → 0.4.4

package/dist/services/index.cjs

@@ -214,14 +214,16 @@ var BaseService = class _BaseService {
   }
   /**
    * The store this call is for: the request host's subdomain under
-   * `baseDomain`, else the static `store`. Read per call, never stored on the
-   * instance, because the server shares one process (and one credentials
-   * object) across every concurrent request and each may be for a different host.
+   * `baseDomain`, else the static `store`, else the host itself when it is a
+   * store's own domain (the engine answers only a verified one). Read per call,
+   * never stored on the instance, because the server shares one process (and
+   * one credentials object) across every concurrent request and each may be
+   * for a different host.
    */
   get store() {
     const { baseDomain, store } = this.creds;
     const host = typeof window !== "undefined" ? window.location?.hostname : requestHost?.();
-    return storeForHost(host, baseDomain) ?? store;
+    return storeForHost(host, baseDomain) ?? store ?? ownDomain(host, baseDomain);
   }
   /**
    * The engine's base URL from wherever this code runs. In the browser a
@@ -371,6 +373,14 @@ function storeForHost(host, baseDomain) {
   const slug = h.slice(0, -suffix.length);
   return slug && !slug.includes(".") ? slug : void 0;
 }
+function ownDomain(host, baseDomain) {
+  if (!host || !baseDomain) return void 0;
+  const h = host.toLowerCase().replace(/:\d+$/, "").replace(/\.$/, "");
+  const base = baseDomain.toLowerCase().replace(/^\.+/, "").replace(/\.$/, "");
+  if (!h.includes(".") || h === base || h.endsWith("." + base) || h.endsWith(".localhost")) return void 0;
+  if (/^[\d.]+$/.test(h) || h.includes(":") || h.startsWith("[")) return void 0;
+  return h;
+}
 var unreachable = (base, cause) => new GoCommerceError(`Could not reach the commerce engine at ${base}: ${cause?.message ?? cause}`, 0);
 function qs(query) {
   if (!query) return "";
@@ -2015,12 +2025,31 @@ var OrderService = class extends BaseService {
   async listPublic(_args = {}) {
     return emptyPage();
   }
-  async getOrderByEmailAndOTP() {
-    throw new NotSupportedError(
-      "OrderService",
-      "getOrderByEmailAndOTP",
-      "the engine sends no one-time codes; a guest reads an order with its access token"
+  /**
+   * Sends a 4-digit code to the email or phone on the order, when `contact`
+   * is that email or phone. The engine answers the same either way, so this
+   * resolves whether or not anything was sent.
+   */
+  async requestOrderCode({ orderNo, contact }) {
+    const res = await this.data(
+      `/api/orders/${encodeURIComponent(orderNo.trim())}/code`,
+      { method: "POST", body: { contact: contact.trim() } }
+    );
+    return { expiresInMinutes: res?.expires_in_minutes ?? 10 };
+  }
+  /**
+   * Opens an order with the code `requestOrderCode` sent. The token it answers
+   * is kept like an order placed in this browser, so the order page and
+   * `getOrder` read it again without another code.
+   */
+  async getOrderByEmailAndOTP({ orderNo, otp }) {
+    const number = orderNo.trim();
+    const res = await this.data(
+      `/api/orders/${encodeURIComponent(number)}/code/verify`,
+      { method: "POST", body: { code: String(otp).trim() } }
     );
+    rememberOrder({ number: res.order.number, token: res.access_token, cartId: "" });
+    return { data: [toOrder(res.order)] };
   }
 };
 var clean2 = (v) => v && v !== "undefined" && v !== "null" ? v : void 0;
@@ -3194,6 +3223,7 @@ exports.meilisearchService = meilisearchService;
 exports.menuService = menuService;
 exports.newsletterService = newsletterService;
 exports.orderService = orderService;
+exports.ownDomain = ownDomain;
 exports.pageService = pageService;
 exports.paymentMethodService = paymentMethodService;
 exports.pluginService = pluginService;