@mj-biz-apps/orders-server 0.0.1 → 5.2.0

package/dist/PaymentWebhookExtension.js

@@ -0,0 +1,151 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/**
+ * The route that lets a gateway tell us money moved — finally mounted.
+ *
+ * `MountPaymentWebhook` has existed since the payment drivers landed and was called by nobody. That was
+ * survivable while every provider settled synchronously: a card capture books at the moment it is
+ * asked, so the webhook only ever confirmed something already recorded, and its absence cost a little
+ * reconciliation detail. It stops being survivable the instant a bank debit is configured. A debit is
+ * captured BY the webhook — there is no other moment at which the money is known to have arrived — so
+ * without this route every ACH payment sits `Pending` for ever and no cash is ever booked.
+ *
+ * WHY AN EXTENSION AND NOT A CHANGE TO MJ. MJServer loads `serverExtensions[]` from `mj.config.cjs`
+ * BEFORE it installs the auth middleware, which is precisely the window an unauthenticated webhook
+ * needs. So the route can be mounted from this repo, in this app's own config, with no upstream change
+ * — and an operator can turn it off by flipping `Enabled` rather than by redeploying.
+ *
+ * ═══ TWO THINGS THE MOUNT MUST GET RIGHT, both of them silent when wrong ═══
+ *
+ * BEFORE AUTH. Stripe presents no bearer token; the signature IS the credential. Behind the auth
+ * middleware every delivery would be rejected with a 401 that Stripe retries and eventually gives up
+ * on, and the only symptom is payments that never capture.
+ *
+ * RAW BODY, ON THIS PATH ONLY. The signature covers the exact bytes sent. Any JSON round-trip — key
+ * reordering, whitespace, unicode normalisation — changes them, so a `express.json()` upstream turns
+ * every legitimate webhook into a signature failure. `express.raw()` is scoped to this route so it
+ * cannot affect anything else the app serves.
+ *
+ * THE PROVIDER ID IS IN THE PATH, and one endpoint per configured provider is deliberate. It is what
+ * tells the handler WHICH secret to verify against before it has read a byte of the payload — a single
+ * shared endpoint would have to parse untrusted JSON to work out whose signature to check, which is
+ * the one thing `HandlePaymentWebhook` is ordered to avoid.
+ *
+ * THE SYSTEM USER, AND WHY IT IS RESOLVED PER REQUEST. There is no human behind a webhook, so the
+ * writes are attributed to MJ's system user — the same one MJ's own unauthenticated eSignature webhook
+ * uses, via the same `UserCache`, rather than a bespoke email setting this app would then have to keep
+ * correct. It is looked up on each delivery rather than cached at startup because the extension
+ * initialises before the data provider is necessarily ready, and a user captured too early would be
+ * absent for the lifetime of the process.
+ *
+ * CONNECTS TO:
+ *   HANDLER: @mj-biz-apps/orders-core-entities-server → PaymentWebhookHandler
+ *   CONFIG:  mj.config.cjs → serverExtensions[]
+ *   DOC:     plans/archive/bizapps-orders-master.md D19
+ */
+import BodyParser from 'body-parser';
+import { LogError, LogStatus, Metadata } from '@memberjunction/core';
+import { UserCache } from '@memberjunction/generic-database-provider';
+import { RegisterClass } from '@memberjunction/global';
+import { BaseServerExtension, } from '@memberjunction/server-extensions-core';
+import { MountPaymentWebhook } from '@mj-biz-apps/orders-core-entities-server';
+/** Stripe's largest documented event payload is well under this; the cap keeps the door narrow. */
+const MAX_BODY = '1mb';
+let PaymentWebhookExtension = class PaymentWebhookExtension extends BaseServerExtension {
+    async Initialize(app, config) {
+        const route = `${config.RootPath.replace(/\/+$/, '')}/:providerId`;
+        app.post(route, 
+        // RAW, and scoped to this path. See the header — a JSON parser anywhere upstream of this
+        // invalidates every signature.
+        BodyParser.raw({ type: 'application/json', limit: MAX_BODY }), async (req, res) => {
+            const user = this.resolveSystemUser();
+            if (!user) {
+                // 500, NOT 400. The gateway did nothing wrong and the event is real — this is our
+                // configuration being incomplete, and a 4xx would tell Stripe to stop retrying a
+                // notification we very much want back once someone fixes it.
+                LogError('A payment webhook arrived but MJ\'s system user could not be resolved, so it ' +
+                    'cannot be recorded. The user cache is not populated — this is a startup ' +
+                    'problem, not a problem with the delivery.');
+                res.status(500).json({ received: false });
+                return;
+            }
+            const handler = MountPaymentWebhook(() => ({ provider: Metadata.Provider, user }));
+            await handler({
+                body: req.body,
+                headers: flattenHeaders(req.headers),
+                // Only the one parameter the handler reads, narrowed to a string here rather
+                // than passed through as Express's `string | string[]` dictionary.
+                params: { providerId: String(req.params?.providerId ?? '') },
+            }, res);
+        });
+        LogStatus(`[Orders] Payment webhook route registered at POST ${route}`);
+        return {
+            Success: true,
+            Message: 'Orders payment webhook mounted (unauthenticated, raw body, signature-verified).',
+            RegisteredRoutes: [`POST ${route}`],
+        };
+    }
+    async Shutdown() {
+        // Nothing held open — the route owns no connections, timers or sockets.
+    }
+    async HealthCheck() {
+        // Healthy means "this route can do its job", which is exactly "the system user resolves".
+        // Reporting healthy without checking would hide the one misconfiguration that silently drops
+        // real payment notifications.
+        const user = this.resolveSystemUser();
+        return user
+            ? { Healthy: true, Name: 'OrdersPaymentWebhook' }
+            : {
+                Healthy: false,
+                Name: 'OrdersPaymentWebhook',
+                Details: {
+                    Reason: 'MJ\'s system user does not resolve, so every webhook delivery will be refused.',
+                },
+            };
+    }
+    /**
+     * The user the webhook's writes are attributed to.
+     *
+     * Returns undefined rather than throwing, so the caller decides the status code. Looked up fresh
+     * each time: the metadata provider may not have been ready when this extension initialised.
+     */
+    resolveSystemUser() {
+        try {
+            return UserCache.Instance.GetSystemUser() ?? undefined;
+        }
+        catch {
+            // The cache is not populated yet. Undefined rather than a throw, so the caller can answer
+            // 500 and the gateway retries once startup has finished.
+            return undefined;
+        }
+    }
+};
+PaymentWebhookExtension = __decorate([
+    RegisterClass(BaseServerExtension, 'OrdersPaymentWebhook')
+], PaymentWebhookExtension);
+export { PaymentWebhookExtension };
+/**
+ * Express types a header value as `string | string[]` because a header CAN legitimately repeat.
+ *
+ * The handler wants a flat map, and the flattening matters for exactly one header: `stripe-signature`.
+ * Joining a repeated value with a comma would be right by luck — Stripe's own scheme is already
+ * comma-separated (`t=…,v1=…,v1=…`) so a proxy that split it across two headers rejoins correctly —
+ * whereas taking the first would silently drop half a signature during a secret rotation and fail
+ * verification for events that are perfectly valid.
+ */
+function flattenHeaders(headers) {
+    const flat = {};
+    for (const [key, value] of Object.entries(headers)) {
+        flat[key] = Array.isArray(value) ? value.join(',') : value;
+    }
+    return flat;
+}
+/** Tree-shaking anchor — call from the server bootstrap so @RegisterClass is retained. */
+export function LoadPaymentWebhookExtension() {
+    // intentionally empty
+}
+//# sourceMappingURL=PaymentWebhookExtension.js.map

package/dist/PaymentWebhookExtension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PaymentWebhookExtension.js","sourceRoot":"","sources":["../src/PaymentWebhookExtension.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,UAAU,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACH,mBAAmB,GAItB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,mGAAmG;AACnG,MAAM,QAAQ,GAAG,KAAK,CAAC;AAGhB,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,mBAAmB;IACrD,KAAK,CAAC,UAAU,CAAC,GAAgB,EAAE,MAA6B;QACnE,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC;QAEnE,GAAG,CAAC,IAAI,CACJ,KAAK;QACL,yFAAyF;QACzF,+BAA+B;QAC/B,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAC7D,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACR,kFAAkF;gBAClF,iFAAiF;gBACjF,6DAA6D;gBAC7D,QAAQ,CACJ,+EAA+E;oBAC3E,0EAA0E;oBAC1E,2CAA2C,CAClD,CAAC;gBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1C,OAAO;YACX,CAAC;YAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnF,MAAM,OAAO,CACT;gBACI,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,6EAA6E;gBAC7E,mEAAmE;gBACnE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE;aAC/D,EACD,GAAG,CACN,CAAC;QACN,CAAC,CACJ,CAAC;QAEF,SAAS,CAAC,qDAAqD,KAAK,EAAE,CAAC,CAAC;QACxE,OAAO;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,iFAAiF;YAC1F,gBAAgB,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC;SACtC,CAAC;IACN,CAAC;IAEM,KAAK,CAAC,QAAQ;QACjB,wEAAwE;IAC5E,CAAC;IAEM,KAAK,CAAC,WAAW;QACpB,0FAA0F;QAC1F,6FAA6F;QAC7F,8BAA8B;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,OAAO,IAAI;YACP,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE;YACjD,CAAC,CAAC;gBACI,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE;oBACL,MAAM,EAAE,gFAAgF;iBAC3F;aACJ,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB;QACrB,IAAI,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,SAAS,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACL,0FAA0F;YAC1F,yDAAyD;YACzD,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;CACJ,CAAA;AAjFY,uBAAuB;IADnC,aAAa,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;GAC9C,uBAAuB,CAiFnC;;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAA2B;IAC/C,MAAM,IAAI,GAAuC,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,2BAA2B;IACvC,sBAAsB;AAC1B,CAAC"}

package/dist/__tests__/CheckoutServerExtension.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CheckoutServerExtension.test.d.ts.map

package/dist/__tests__/CheckoutServerExtension.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CheckoutServerExtension.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/CheckoutServerExtension.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/CheckoutServerExtension.test.js

@@ -0,0 +1,257 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mockRunView = vi.fn();
+const mockGetSystemUser = vi.fn();
+vi.mock('@memberjunction/core', () => ({
+    LogError: vi.fn(),
+    LogStatus: vi.fn(),
+    RunView: class {
+        constructor() {
+            this.RunView = mockRunView;
+        }
+    },
+}));
+vi.mock('@memberjunction/generic-database-provider', () => ({
+    UserCache: {
+        Instance: {
+            Users: [],
+            GetSystemUser: () => mockGetSystemUser(),
+        },
+    },
+}));
+vi.mock('@memberjunction/global', () => ({
+    RegisterClass: () => (cls) => cls,
+}));
+vi.mock('@mj-biz-apps/orders-core-entities-server', () => ({
+    CheckoutSessionService: {
+        InitializeSession: vi.fn(),
+        UpdateDraft: vi.fn(),
+        OpenPaymentIntentForSession: vi.fn(),
+        CompleteCheckout: vi.fn(),
+        ReapExpiredOpenSessions: vi.fn().mockResolvedValue(0),
+    },
+    EscapeText: (value) => value.replace(/'/g, "''"),
+}));
+import { CheckoutSessionService } from '@mj-biz-apps/orders-core-entities-server';
+import { CheckoutServerExtension, shouldServeCheckoutElementSourceMap } from '../CheckoutServerExtension.js';
+function mockApp() {
+    const routes = { get: {}, post: {}, options: {} };
+    const app = {
+        get: vi.fn((path, handler) => {
+            routes.get[path] = handler;
+        }),
+        post: vi.fn((path, ...handlers) => {
+            routes.post[path] = handlers;
+        }),
+        options: vi.fn((path, handler) => {
+            routes.options[path] = handler;
+        }),
+    };
+    return { app, routes };
+}
+function mockRes() {
+    const res = {
+        statusCode: 200,
+        body: '',
+        headers: {},
+        headersSent: false,
+        status(code) {
+            this.statusCode = code;
+            return this;
+        },
+        setHeader(name, value) {
+            this.headers[name.toLowerCase()] = value;
+            return this;
+        },
+        send(body) {
+            this.body = body;
+            this.headersSent = true;
+            return this;
+        },
+        json(body) {
+            this.body = JSON.stringify(body);
+            this.headersSent = true;
+            return this;
+        },
+        end() {
+            this.headersSent = true;
+            return this;
+        },
+    };
+    return res;
+}
+describe('shouldServeCheckoutElementSourceMap', () => {
+    it('defaults off — the public payment route must not publish TypeScript', () => {
+        expect(shouldServeCheckoutElementSourceMap({}, {})).toBe(false);
+        expect(shouldServeCheckoutElementSourceMap({}, { NODE_ENV: 'development' })).toBe(false);
+        expect(shouldServeCheckoutElementSourceMap({}, { NODE_ENV: 'production' })).toBe(false);
+    });
+    it('opts in via Settings or CHECKOUT_ELEMENT_SOURCEMAP=1', () => {
+        expect(shouldServeCheckoutElementSourceMap({ ServeElementSourceMap: true }, {})).toBe(true);
+        expect(shouldServeCheckoutElementSourceMap({}, { CHECKOUT_ELEMENT_SOURCEMAP: '1' })).toBe(true);
+        expect(shouldServeCheckoutElementSourceMap({ ServeElementSourceMap: false }, { CHECKOUT_ELEMENT_SOURCEMAP: '1' })).toBe(false);
+    });
+});
+describe('CheckoutServerExtension', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockGetSystemUser.mockReturnValue({ ID: 'sys', Email: 'system@local' });
+        mockRunView.mockResolvedValue({ Success: true, Results: [{ ID: 'dist-1', CheckoutWidgetID: 'widget-1' }] });
+    });
+    it('registers POST verbs plus GET /:slug and reports both in RegisteredRoutes', async () => {
+        const { app, routes } = mockApp();
+        const ext = new CheckoutServerExtension();
+        const result = await ext.Initialize(app, {
+            Enabled: true,
+            DriverClass: 'OrdersCheckoutEdge',
+            RootPath: '/checkout',
+            Settings: {},
+        });
+        expect(result.Success).toBe(true);
+        expect(Object.keys(routes.post).sort()).toEqual([
+            '/checkout/complete',
+            '/checkout/draft',
+            '/checkout/initialize',
+            '/checkout/payment-intent',
+        ]);
+        expect(Object.keys(routes.get).sort()).toEqual(['/checkout/:slug', '/checkout/element/main.js'].sort());
+        expect(routes.get['/checkout/element/main.js.map']).toBeUndefined();
+        expect(result.RegisteredRoutes).toEqual([
+            'POST /checkout/initialize',
+            'POST /checkout/draft',
+            'POST /checkout/payment-intent',
+            'POST /checkout/complete',
+            'GET /checkout/:slug',
+        ]);
+    });
+    it('GET 404s reserved slugs without looking up a distribution', async () => {
+        const { app, routes } = mockApp();
+        await new CheckoutServerExtension().Initialize(app, {
+            Enabled: true,
+            DriverClass: 'OrdersCheckoutEdge',
+            RootPath: '/checkout',
+            Settings: {},
+        });
+        const res = mockRes();
+        await routes.get['/checkout/:slug']({ params: { slug: 'initialize' }, headers: {}, socket: {} }, res);
+        expect(res.statusCode).toBe(404);
+        expect(res.body).toContain('not valid');
+        expect(mockRunView).not.toHaveBeenCalled();
+    });
+    it('GET 404s an unknown slug', async () => {
+        mockRunView.mockResolvedValueOnce({ Success: true, Results: [] });
+        const { app, routes } = mockApp();
+        await new CheckoutServerExtension().Initialize(app, {
+            Enabled: true,
+            DriverClass: 'OrdersCheckoutEdge',
+            RootPath: '/checkout',
+            Settings: {},
+        });
+        const res = mockRes();
+        await routes.get['/checkout/:slug']({ params: { slug: 'missing-event' }, headers: {}, socket: { remoteAddress: '127.0.0.1' } }, res);
+        expect(res.statusCode).toBe(404);
+        expect(res.body).toContain('not available');
+        expect(mockRunView).toHaveBeenCalled();
+    });
+    it('GET 503s when no acting user resolves', async () => {
+        mockGetSystemUser.mockReturnValue(undefined);
+        const { app, routes } = mockApp();
+        await new CheckoutServerExtension().Initialize(app, {
+            Enabled: true,
+            DriverClass: 'OrdersCheckoutEdge',
+            RootPath: '/checkout',
+            Settings: {},
+        });
+        const res = mockRes();
+        await routes.get['/checkout/:slug']({ params: { slug: 'summit-2027' }, headers: {}, socket: { remoteAddress: '127.0.0.1' } }, res);
+        expect(res.statusCode).toBe(503);
+        expect(mockRunView).not.toHaveBeenCalled();
+    });
+    it('GET 200s an Active distribution with escaped slug and no-store HTML', async () => {
+        const { app, routes } = mockApp();
+        await new CheckoutServerExtension().Initialize(app, {
+            Enabled: true,
+            DriverClass: 'OrdersCheckoutEdge',
+            RootPath: '/checkout/',
+            Settings: {},
+        });
+        const res = mockRes();
+        await routes.get['/checkout/:slug']({ params: { slug: 'summit-2027' }, headers: {}, socket: { remoteAddress: '127.0.0.1' } }, res);
+        expect(res.statusCode).toBe(200);
+        expect(res.headers['content-type']).toBe('text/html; charset=utf-8');
+        expect(res.headers['cache-control']).toBe('no-store');
+        expect(res.headers['x-frame-options']).toBe('DENY');
+        expect(res.headers['referrer-policy']).toBe('no-referrer');
+        expect(res.headers['content-security-policy']).toContain("frame-ancestors 'none'");
+        expect(res.headers['content-security-policy']).toContain("default-src 'none'");
+        expect(res.body).toContain('slug="summit-2027"');
+        expect(res.body).toContain('api-root="/checkout"');
+        expect(res.body).toContain('src="/checkout/element/main.js"');
+        const filter = mockRunView.mock.calls[0][0].ExtraFilter;
+        expect(filter).toContain("Slug = 'summit-2027'");
+        expect(filter).toContain("Status = 'Active'");
+        expect(CheckoutSessionService.ReapExpiredOpenSessions).toHaveBeenCalledTimes(1);
+    });
+    it('does not re-reap within the interval, then reaps again after it elapses', async () => {
+        vi.useFakeTimers();
+        try {
+            vi.setSystemTime(new Date('2026-08-26T12:00:00Z'));
+            const { app, routes } = mockApp();
+            await new CheckoutServerExtension().Initialize(app, {
+                Enabled: true,
+                DriverClass: 'OrdersCheckoutEdge',
+                RootPath: '/checkout',
+                Settings: {},
+            });
+            const req = { params: { slug: 'summit-2027' }, headers: {}, socket: { remoteAddress: '127.0.0.1' } };
+            await routes.get['/checkout/:slug'](req, mockRes());
+            await routes.get['/checkout/:slug'](req, mockRes());
+            expect(CheckoutSessionService.ReapExpiredOpenSessions).toHaveBeenCalledTimes(1);
+            vi.setSystemTime(new Date('2026-08-26T12:01:01Z'));
+            await routes.get['/checkout/:slug'](req, mockRes());
+            expect(CheckoutSessionService.ReapExpiredOpenSessions).toHaveBeenCalledTimes(2);
+        }
+        finally {
+            vi.useRealTimers();
+        }
+    });
+    it('escapes a hostile slug in the GET ExtraFilter', async () => {
+        const { app, routes } = mockApp();
+        await new CheckoutServerExtension().Initialize(app, {
+            Enabled: true,
+            DriverClass: 'OrdersCheckoutEdge',
+            RootPath: '/checkout',
+            Settings: {},
+        });
+        const res = mockRes();
+        // Passes the URL-safe pattern but still contains a quote if we ever loosen it —
+        // use a valid slug here and assert EscapeText is applied via the apostrophe case
+        // by calling with a slug that includes underscore/dot only; SQL quoting is
+        // covered by EscapeText unit tests. This asserts the filter is parameterized
+        // through EscapeText for the accepted slug.
+        await routes.get['/checkout/:slug']({ params: { slug: 'summit_2027' }, headers: {}, socket: { remoteAddress: '127.0.0.1' } }, res);
+        expect(mockRunView.mock.calls[0][0].ExtraFilter).toContain("Slug = 'summit_2027'");
+    });
+    it('does not key rate limits on a spoofed leftmost X-Forwarded-For (default TrustedProxyHops=0)', async () => {
+        const { app, routes } = mockApp();
+        const ext = new CheckoutServerExtension();
+        await ext.Initialize(app, {
+            Enabled: true,
+            DriverClass: 'OrdersCheckoutEdge',
+            RootPath: '/checkout',
+            Settings: { RateLimitMax: 2, RateLimitMaxGlobal: 2, RateLimitWindowMs: 60_000 },
+        });
+        const hit = async (xff) => {
+            const res = mockRes();
+            await routes.get['/checkout/:slug']({
+                params: { slug: 'summit-2027' },
+                headers: { 'x-forwarded-for': xff },
+                socket: { remoteAddress: '10.0.0.9' },
+            }, res);
+            return res.statusCode;
+        };
+        expect(await hit('1.1.1.1')).toBe(200);
+        expect(await hit('2.2.2.2')).toBe(200);
+        expect(await hit('3.3.3.3')).toBe(429);
+    });
+});
+//# sourceMappingURL=CheckoutServerExtension.test.js.map

package/dist/__tests__/CheckoutServerExtension.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CheckoutServerExtension.test.js","sourceRoot":"","sources":["../../src/__tests__/CheckoutServerExtension.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9D,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAElC,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;IACjB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;IAClB,OAAO,EAAE;QAAA;YACL,YAAO,GAAG,WAAW,CAAC;QAC1B,CAAC;KAAA;CACJ,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,SAAS,EAAE;QACP,QAAQ,EAAE;YACN,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;SAC3C;KACJ;CACJ,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG;CAC7C,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,sBAAsB,EAAE;QACpB,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE;QAC1B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;QACpB,2BAA2B,EAAE,EAAE,CAAC,EAAE,EAAE;QACpC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;QACzB,uBAAuB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;KACxD;IACD,UAAU,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;CAC3D,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAQ7G,SAAS,OAAO;IACZ,MAAM,MAAM,GAAa,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG;QACR,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,OAA8C,EAAE,EAAE;YACxE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QAC/B,CAAC,CAAC;QACF,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,GAAG,QAAmB,EAAE,EAAE;YACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;QACjC,CAAC,CAAC;QACF,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,OAAgB,EAAE,EAAE;YAC9C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACnC,CAAC,CAAC;KACqB,CAAC;IAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO;IACZ,MAAM,GAAG,GAAG;QACR,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAA4B;QACrC,WAAW,EAAE,KAAK;QAClB,MAAM,CAAC,IAAY;YACf,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,SAAS,CAAC,IAAY,EAAE,KAAa;YACjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;YACzC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAY;YACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAa;YACd,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,GAAG;YACC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QAChB,CAAC;KACJ,CAAC;IACF,OAAO,GAAG,CAAC;AACf,CAAC;AAED,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,mCAAmC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5F,MAAM,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,CAAC,mCAAmC,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,EAAE,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnI,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACrC,UAAU,CAAC,GAAG,EAAE;QACZ,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACxE,WAAW,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE;YACrC,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YAC5C,oBAAoB;YACpB,iBAAiB;YACjB,sBAAsB;YACtB,0BAA0B;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACxG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC;YACpC,2BAA2B;YAC3B,sBAAsB;YACtB,+BAA+B;YAC/B,yBAAyB;YACzB,qBAAqB;SACxB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;YAChD,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC/B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAwB,EACjF,GAA0B,CAC7B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACtC,WAAW,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;YAChD,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC/B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAwB,EAChH,GAA0B,CAC7B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACnD,iBAAiB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;YAChD,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC/B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAwB,EAC9G,GAA0B,CAC7B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;YAChD,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC/B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAwB,EAC9G,GAA0B,CAC7B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAqB,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACrF,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,IAAI,CAAC;YACD,EAAE,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACnD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;gBAChD,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,oBAAoB;gBACjC,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,EAAE;aACf,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAwB,CAAC;YAC3H,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,OAAO,EAAyB,CAAC,CAAC;YAC3E,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,OAAO,EAAyB,CAAC,CAAC;YAC3E,MAAM,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAChF,EAAE,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACnD,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,OAAO,EAAyB,CAAC,CAAC;YAC3E,MAAM,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACP,EAAE,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE;YAChD,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,gFAAgF;QAChF,iFAAiF;QACjF,2EAA2E;QAC3E,6EAA6E;QAC7E,4CAA4C;QAC5C,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC/B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAwB,EAC9G,GAA0B,CAC7B,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE;SAClF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC/B;gBACI,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;gBAC/B,OAAO,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE;gBACnC,MAAM,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE;aAClB,EACvB,GAA0B,CAC7B,CAAC;YACF,OAAO,GAAG,CAAC,UAAU,CAAC;QAC1B,CAAC,CAAC;QACF,MAAM,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/checkout-edge-policy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=checkout-edge-policy.test.d.ts.map

package/dist/__tests__/checkout-edge-policy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-edge-policy.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/checkout-edge-policy.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/checkout-edge-policy.test.js

@@ -0,0 +1,70 @@
+import { describe, expect, it } from 'vitest';
+import { CHECKOUT_RESERVED_SLUGS, isSameOrigin, isValidCheckoutSlug, originAllowed, resolveClientIp, } from '../checkout-edge-policy.js';
+describe('isValidCheckoutSlug', () => {
+    it('accepts typical vanity slugs', () => {
+        expect(isValidCheckoutSlug('summit-2027')).toBe(true);
+        expect(isValidCheckoutSlug('A')).toBe(true);
+        expect(isValidCheckoutSlug('event_1.2')).toBe(true);
+    });
+    it('rejects empty, too long, unsafe, and reserved POST verbs', () => {
+        expect(isValidCheckoutSlug('')).toBe(false);
+        expect(isValidCheckoutSlug('initialize')).toBe(false);
+        expect(isValidCheckoutSlug('Draft')).toBe(false);
+        expect(isValidCheckoutSlug('payment-intent')).toBe(false);
+        expect(isValidCheckoutSlug('complete')).toBe(false);
+        expect(isValidCheckoutSlug('../etc')).toBe(false);
+        expect(isValidCheckoutSlug('has space')).toBe(false);
+        expect(isValidCheckoutSlug('<script>')).toBe(false);
+        expect(isValidCheckoutSlug('a'.repeat(129))).toBe(false);
+    });
+    it('reserved set covers every POST suffix on the edge', () => {
+        expect([...CHECKOUT_RESERVED_SLUGS].sort()).toEqual(['complete', 'draft', 'initialize', 'payment-intent'].sort());
+    });
+});
+describe('isSameOrigin', () => {
+    it('matches scheme-less Host against Origin host:port', () => {
+        expect(isSameOrigin('http://localhost:4103', 'localhost:4103')).toBe(true);
+        expect(isSameOrigin('https://api.example.com', 'api.example.com')).toBe(true);
+    });
+    it('rejects missing values, bad URLs, and different hosts', () => {
+        expect(isSameOrigin('', 'localhost:4103')).toBe(false);
+        expect(isSameOrigin('http://localhost:4103', undefined)).toBe(false);
+        expect(isSameOrigin('not-a-url', 'localhost:4103')).toBe(false);
+        expect(isSameOrigin('http://localhost:4103', 'localhost:4303')).toBe(false);
+        expect(isSameOrigin('https://evil.example', 'api.example.com')).toBe(false);
+    });
+});
+describe('originAllowed', () => {
+    it('allows same-origin even when the widget allowlist names another site', () => {
+        expect(originAllowed('http://localhost:4103', { allowedOrigins: ['https://events.example.com'] }, 'localhost:4103')).toBe(true);
+    });
+    it('allows any origin when the allowlist is absent or empty', () => {
+        expect(originAllowed('https://anywhere.example', {}, 'api.example.com')).toBe(true);
+        expect(originAllowed('https://anywhere.example', { allowedOrigins: [] }, 'api.example.com')).toBe(true);
+    });
+    it('enforces the allowlist for cross-origin embeds (trailing slash insensitive)', () => {
+        const policy = { allowedOrigins: ['https://events.example.com/'] };
+        expect(originAllowed('https://events.example.com', policy, 'api.example.com')).toBe(true);
+        expect(originAllowed('https://other.example.com', policy, 'api.example.com')).toBe(false);
+    });
+});
+describe('resolveClientIp', () => {
+    const req = (xff, socket = '10.0.0.9') => ({
+        headers: { 'x-forwarded-for': xff },
+        socket: { remoteAddress: socket },
+    });
+    it('ignores X-Forwarded-For when no proxy hops are declared (default)', () => {
+        expect(resolveClientIp(req('1.2.3.4, 10.0.0.1'))).toBe('10.0.0.9');
+        expect(resolveClientIp(req('1.2.3.4'))).toBe('10.0.0.9');
+    });
+    it('takes the Nth-from-right hop when TrustedProxyHops is set', () => {
+        // client, proxy1, proxy2 — with 1 trusted proxy the last hop is what that proxy saw
+        expect(resolveClientIp(req('9.9.9.9, 203.0.113.10'), 1)).toBe('203.0.113.10');
+        expect(resolveClientIp(req('9.9.9.9, 198.51.100.2, 203.0.113.10'), 2)).toBe('198.51.100.2');
+    });
+    it('falls back to the socket when XFF is missing or too short for the declared hop count', () => {
+        expect(resolveClientIp(req(undefined), 1)).toBe('10.0.0.9');
+        expect(resolveClientIp(req('only-one'), 2)).toBe('10.0.0.9');
+    });
+});
+//# sourceMappingURL=checkout-edge-policy.test.js.map

package/dist/__tests__/checkout-edge-policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-edge-policy.test.js","sourceRoot":"","sources":["../../src/__tests__/checkout-edge-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACH,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,eAAe,GAClB,MAAM,4BAA4B,CAAC;AAEpC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAC/C,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAC/D,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,YAAY,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,YAAY,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,CAAC,YAAY,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC5E,MAAM,CACF,aAAa,CAAC,uBAAuB,EAAE,EAAE,cAAc,EAAE,CAAC,4BAA4B,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAC/G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,aAAa,CAAC,0BAA0B,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,MAAM,CAAC,aAAa,CAAC,0BAA0B,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACnF,MAAM,MAAM,GAAG,EAAE,cAAc,EAAE,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,aAAa,CAAC,4BAA4B,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,CAAC,aAAa,CAAC,2BAA2B,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,MAAM,GAAG,GAAG,CAAC,GAAuB,EAAE,MAAM,GAAG,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE;QACnC,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE;KACpC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACjE,oFAAoF;QACpF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9E,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/checkout-host-page.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=checkout-host-page.test.d.ts.map

package/dist/__tests__/checkout-host-page.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-host-page.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/checkout-host-page.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/checkout-host-page.test.js

@@ -0,0 +1,86 @@
+import { describe, expect, it } from 'vitest';
+import { checkoutHostSecurityHeaders, escapeAttr, escapeHtml, renderCheckoutHostErrorPage, renderCheckoutHostPage, } from '../checkout-host-page.js';
+describe('escapeHtml / escapeAttr', () => {
+    it('escapes markup and quotes', () => {
+        expect(escapeHtml('<script>alert(1)</script>')).toBe('&lt;script&gt;alert(1)&lt;/script&gt;');
+        expect(escapeAttr('x" onclick="alert(1)')).toBe('x&quot; onclick=&quot;alert(1)');
+        expect(escapeAttr('a&b<c>')).toBe('a&amp;b&lt;c&gt;');
+    });
+});
+describe('renderCheckoutHostPage', () => {
+    it('hosts the Angular Element when elementSrc is provided', () => {
+        const html = renderCheckoutHostPage({
+            slug: 'summit-2027',
+            apiRoot: '/checkout',
+            elementSrc: '/checkout/element/main.js',
+            cspNonce: 'nOnce+/1',
+        });
+        expect(html).toContain('slug="summit-2027"');
+        expect(html).toContain('api-root="/checkout"');
+        expect(html).toContain('csp-nonce="nOnce+/1"');
+        expect(html).toContain('src="/checkout/element/main.js"');
+        expect(html).toContain('type="module"');
+        expect(html).toContain('nonce="nOnce+/1"');
+        expect(html).not.toContain("post('/initialize'");
+    });
+    it('bakes slug and api root into data-* attributes, never into the script block', () => {
+        const evil = 'summit"</script><script>alert(1)</script>';
+        const html = renderCheckoutHostPage({ slug: evil, apiRoot: '/checkout', cspNonce: 'nOnce+/1' });
+        expect(html).toContain('data-slug="summit&quot;&lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt;"');
+        expect(html).toContain('data-api-root="/checkout"');
+        const scriptOpen = html.indexOf('<script');
+        const scriptTagEnd = html.indexOf('>', scriptOpen);
+        const script = html.slice(scriptTagEnd + 1, html.indexOf('</script>'));
+        expect(script).not.toContain(evil);
+        expect(script).not.toContain('summit"');
+        expect(script).toContain("host.getAttribute('data-slug')");
+        expect(script).toContain("host.getAttribute('data-api-root')");
+    });
+    it('drives only the existing POST verbs (no amount/price/provider in the request shape)', () => {
+        const html = renderCheckoutHostPage({ slug: 'summit-2027', apiRoot: '/checkout', cspNonce: 'nOnce+/1' });
+        expect(html).toContain("post('/initialize'");
+        expect(html).toContain("post('/draft'");
+        expect(html).toContain("post('/payment-intent'");
+        expect(html).toContain("post('/complete'");
+        expect(html).toContain('if (stripe) { resolve(stripe); return; }');
+        expect(html).toContain('crypto.getRandomValues');
+        expect(html).not.toContain('Math.random');
+        expect(html).not.toContain('amount:');
+        expect(html).not.toContain('UnitPrice');
+        expect(html).not.toContain('paymentProviderId');
+    });
+    it('is a complete HTML document with noindex and utf-8', () => {
+        const html = renderCheckoutHostPage({ slug: 'summit-2027', apiRoot: '/checkout', pageTitle: 'Buy <tickets>', cspNonce: 'nOnce+/1' });
+        expect(html.startsWith('<!doctype html>')).toBe(true);
+        expect(html).toContain('<title>Buy &lt;tickets&gt;</title>');
+        expect(html).toContain('name="robots" content="noindex"');
+        expect(html).toContain('charset="utf-8"');
+    });
+});
+describe('renderCheckoutHostErrorPage', () => {
+    it('escapes the operator-facing message and has no boot script', () => {
+        const html = renderCheckoutHostErrorPage({ message: 'Not <found> & gone', cspNonce: 'nOnce+/1' });
+        expect(html).toContain('Not &lt;found&gt; &amp; gone');
+        expect(html).not.toContain('<script>');
+        expect(html).toContain('role="alert"');
+    });
+    it('stamps a CSP nonce onto style and script when provided', () => {
+        const html = renderCheckoutHostPage({ slug: 's', apiRoot: '/checkout', cspNonce: 'nOnce+/1' });
+        expect(html).toContain('nonce="nOnce+/1"');
+        expect(html).toMatch(/<style nonce="nOnce\+\/1">/);
+        expect(html).toMatch(/<script nonce="nOnce\+\/1">/);
+    });
+});
+describe('checkoutHostSecurityHeaders', () => {
+    it('denies framing and scopes scripts to the nonce plus Stripe', () => {
+        const h = checkoutHostSecurityHeaders('abc123');
+        expect(h['X-Frame-Options']).toBe('DENY');
+        expect(h['Referrer-Policy']).toBe('no-referrer');
+        expect(h['Content-Security-Policy']).toContain("frame-ancestors 'none'");
+        expect(h['Content-Security-Policy']).toContain("'nonce-abc123'");
+        expect(h['Content-Security-Policy']).toContain("'self'");
+        expect(h['Content-Security-Policy']).toContain('https://js.stripe.com');
+        expect(h['Content-Security-Policy']).toContain("default-src 'none'");
+    });
+});
+//# sourceMappingURL=checkout-host-page.test.js.map