@mj-biz-apps/orders-server 5.1.0 → 5.2.1

package/README.md

@@ -33,6 +33,13 @@ class will be used instead, and the first symptom is a financial one.
 
 - `config.ts` — server configuration
 - `src/generated/` — CodeGen's GraphQL resolvers. Do not edit; see the Entities package README.
+- `MJ_SERVER_EXTENSIONS` — webhook + checkout edge declarations. MJ bootstrap collects this
+  (or `package.json` `memberjunction.serverExtensions`) from hosts that list this package in
+  `dynamicPackages.server[]`. Host `mj.config.cjs` `serverExtensions[]` overlays by DriverClass.
+- `GET /checkout/:slug` — public HTML host for a distribution; POSTs stay on the same edge.
+  Pre-auth. Host `serverExtensions[]` can set `Enabled: false` to suppress. Settings:
+  `TrustedProxyHops` (default 0 — ignore `X-Forwarded-For`; set to the number of reverse
+  proxies that append to it), `RateLimitMax` / `RateLimitMaxGlobal`.
 
 ## Verifying registration
 

package/dist/CheckoutServerExtension.d.ts

@@ -0,0 +1,96 @@
+import type { Application } from 'express';
+import { BaseServerExtension, type ExtensionHealthResult, type ExtensionInitResult, type ServerExtensionConfig } from '@memberjunction/server-extensions-core';
+interface CheckoutEdgeSettings {
+    /** Email of the named checkout service principal; falls back to the system user. */
+    ServiceUserEmail?: string;
+    /** Name of the env var holding the Cloudflare Turnstile secret. */
+    TurnstileSecretEnvVar?: string;
+    /** Rate-limit window in ms (default 60000). */
+    RateLimitWindowMs?: number;
+    /** Max requests per window per client key (default 30). */
+    RateLimitMax?: number;
+    /**
+     * Aggregate max per IP per window across all slugs (default 90).
+     * Independent of the per-slug cap.
+     */
+    RateLimitMaxGlobal?: number;
+    /**
+     * Number of reverse proxies that append to X-Forwarded-For. 0 (default)
+     * ignores XFF and uses the socket address — the leftmost XFF hop is
+     * client-supplied and must not key rate limits or Turnstile.
+     */
+    TrustedProxyHops?: number;
+    /**
+     * When true, GET `{root}/element/main.js.map` is registered. Default off —
+     * the map is original TypeScript on an unauthenticated payment route.
+     * Also honoured via env `CHECKOUT_ELEMENT_SOURCEMAP=1` when the setting is unset.
+     */
+    ServeElementSourceMap?: boolean;
+}
+/** Source maps on the public checkout element are opt-in (dev). Default: do not serve. */
+export declare function shouldServeCheckoutElementSourceMap(settings: Pick<CheckoutEdgeSettings, 'ServeElementSourceMap'>, env?: NodeJS.ProcessEnv): boolean;
+export declare class CheckoutServerExtension extends BaseServerExtension {
+    private settings;
+    private rateWindows;
+    private warnedSystemUserFallback;
+    private rootPath;
+    private lastReapAt;
+    Initialize(app: Application, config: ServerExtensionConfig): Promise<ExtensionInitResult>;
+    Shutdown(): Promise<void>;
+    HealthCheck(): Promise<ExtensionHealthResult>;
+    /** Runs the shared gates (rate limit → origin → turnstile where required) then the handler. */
+    private guardAndRun;
+    /** OPTIONS preflight: grant CORS only to origins the widget policy allows. */
+    private handlePreflight;
+    /**
+     * Resolves the widget edge policy (allowed origins + turnstile requirement) for this
+     * request — by slug on initialize, by session id on the other routes. Returns null when
+     * nothing resolves (unknown slug/session): the underlying service will answer with its
+     * own refusal.
+     */
+    private resolveEdgePolicy;
+    /** Enforces the per-widget origin allowlist; grants CORS to allowed origins. */
+    private applyOriginGate;
+    private originAllowed;
+    private setCorsHeaders;
+    /** Turnstile applies to the abuse-sensitive endpoints: initialize and complete. */
+    private isTurnstileGatedPath;
+    /**
+     * Verifies the Cloudflare Turnstile token. Returns null on success, or [status, message]
+     * on refusal. A widget that REQUIRES Turnstile with no secret configured fails closed
+     * with a 503 — a silent pass would advertise protection that is not running.
+     */
+    private verifyTurnstile;
+    /**
+     * `GET /checkout/:slug` — first-party HTML that talks to the POST edge.
+     * Unknown/reserved slugs 404; missing service principal is a 503. The page
+     * itself is cache-free; initialize still enforces Active widget + distribution.
+     */
+    private handleGetHost;
+    private sendHostError;
+    private applyHostSecurityHeaders;
+    private maybeReapExpiredSessions;
+    private requestSlug;
+    private activeDistributionExists;
+    private handleInitialize;
+    private handleDraft;
+    private handlePaymentIntent;
+    private handleComplete;
+    /** Fixed-window limiter over a bounded, insertion-ordered map. */
+    private rateLimitExceeded;
+    /**
+     * The client IP for rate limiting and Turnstile. Ignores X-Forwarded-For unless
+     * `Settings.TrustedProxyHops` is a positive integer (Nth-from-right hop).
+     */
+    private clientIp;
+    /**
+     * The acting principal for checkout writes: the configured service user when present,
+     * else MJ's system user (warned once). Resolved per request — the user cache may not be
+     * populated when the extension initializes.
+     */
+    private resolveActingUser;
+}
+/** Tree-shaking anchor — call from the server bootstrap so @RegisterClass is retained. */
+export declare function LoadCheckoutServerExtension(): void;
+export {};
+//# sourceMappingURL=CheckoutServerExtension.d.ts.map

package/dist/CheckoutServerExtension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CheckoutServerExtension.d.ts","sourceRoot":"","sources":["../src/CheckoutServerExtension.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,WAAW,EAAmC,MAAM,SAAS,CAAC;AAI5E,OAAO,EACH,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC7B,MAAM,wCAAwC,CAAC;AAuDhD,UAAU,oBAAoB;IAC1B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,0FAA0F;AAC1F,wBAAgB,mCAAmC,CAC/C,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,EAC7D,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,OAAO,CAQT;AAOD,qBACa,uBAAwB,SAAQ,mBAAmB;IAC5D,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,WAAW,CAA6D;IAChF,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,UAAU,CAAK;IAEV,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA+CzF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB,WAAW,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAa1D,+FAA+F;YACjF,WAAW;IAyCzB,8EAA8E;YAChE,eAAe;IAe7B;;;;;OAKG;YACW,iBAAiB;IAsD/B,gFAAgF;IAChF,OAAO,CAAC,eAAe;IAevB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,cAAc;IAQtB,mFAAmF;IACnF,OAAO,CAAC,oBAAoB;IAI5B;;;;OAIG;YACW,eAAe;IA6B7B;;;;OAIG;YACW,aAAa;IA4C3B,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,wBAAwB;IAWhC,OAAO,CAAC,WAAW;YAOL,wBAAwB;YAaxB,gBAAgB;YAahB,WAAW;YAcX,mBAAmB;YAYnB,cAAc;IAc5B,kEAAkE;IAClE,OAAO,CAAC,iBAAiB;IAkBzB;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;CAkB5B;AAED,0FAA0F;AAC1F,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/dist/CheckoutServerExtension.js

@@ -0,0 +1,554 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/**
+ * The anonymous checkout edge — the public transport in front of `CheckoutSessionService`.
+ *
+ * Until this extension existed the checkout service had no edge at all: nothing exposed
+ * InitializeSession / UpdateDraft / CompleteCheckout to a browser, so the widget could not be
+ * driven end-to-end. Like the payment webhook, the edge mounts through `serverExtensions[]`
+ * BEFORE MJServer installs its auth middleware — an anonymous buyer presents no bearer token;
+ * the distribution slug plus the session id + client session key (re-verified inside the
+ * service on every mutating call) are the credentials.
+ *
+ * `GET {RootPath}/:slug` is the first-party public page. It hosts the reusable
+ * Angular `<mj-checkout-widget>` (as `<mj-orders-checkout>`) when the element
+ * bundle is built; otherwise a vanilla fallback. Extension fields come from
+ * ProductType.OrderLineExtensionEntity metadata — not a hard-coded event form.
+ * MJ auto-loads this extension from `@mj-biz-apps/orders-server`'s `MJ_SERVER_EXTENSIONS`
+ * when the package is listed in the host `dynamicPackages.server[]`.
+ *
+ * ═══ THE GATE SEQUENCE, in order, all fail-closed ═══
+ *
+ * 1. BODY CAP — `express.json()` scoped to these routes with a small limit. Checkout inputs
+ *    are tiny; anything large is abuse.
+ * 2. RATE LIMIT — fixed-window, per client IP (and per IP+slug on initialize), in-memory.
+ *    Session initialization is a row-insert primitive and Person resolution touches the
+ *    database; both must be bounded per caller.
+ * 3. ORIGIN ALLOWLIST — when the widget's admin-authored Configuration sets
+ *    `allowedOrigins`, a browser request from any other origin is refused AND receives no
+ *    CORS grant (so the browser blocks the response either way). With no allowlist
+ *    configured, any origin is allowed — the distribution slug remains the access control.
+ * 4. TURNSTILE — when the widget sets `requireTurnstile`, session initialization and
+ *    completion demand a Cloudflare Turnstile token, verified server-side against the secret
+ *    named by `Settings.TurnstileSecretEnvVar`. Required-but-unconfigured verifies as a 503,
+ *    never as a silent pass.
+ *
+ * ═══ THE PRICING-INPUT RULE HOLDS AT THIS BOUNDARY ═══
+ * The request bodies accepted here carry NO amount, price, product resolution or provider.
+ * `CheckoutLineInput` has no price field; the payment-intent route takes only the session
+ * id + key (amount comes from the session's server-priced snapshot; the provider from the
+ * widget's Configuration). Anything else in a request body is ignored.
+ *
+ * ═══ THE ACTING USER ═══
+ * Writes run as the service principal named by `Settings.ServiceUserEmail` when configured —
+ * a named checkout principal is auditable and permission-scopeable — falling back to MJ's
+ * system user (with a logged warning) so a bare install still works. Resolved per request,
+ * same reasoning as the payment webhook: the user cache may not be ready at Initialize time.
+ *
+ * CONNECTS TO:
+ *   SERVICE: @mj-biz-apps/orders-core-entities-server → CheckoutSessionService
+ *   CONFIG:  mj.config.cjs → serverExtensions[] (DriverClass 'OrdersCheckoutEdge')
+ *   PLAN:    aidp-next plans/aidp-unified-transactions-plan.md §3.2
+ */
+import BodyParser from 'body-parser';
+import { LogError, LogStatus, RunView } from '@memberjunction/core';
+import { UserCache } from '@memberjunction/generic-database-provider';
+import { RegisterClass } from '@memberjunction/global';
+import { BaseServerExtension, } from '@memberjunction/server-extensions-core';
+import { CheckoutSessionService, EscapeText } from '@mj-biz-apps/orders-core-entities-server';
+import { randomBytes } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isValidCheckoutSlug, originAllowed as originIsAllowed, resolveClientIp } from './checkout-edge-policy.js';
+import { checkoutHostSecurityHeaders, renderCheckoutHostErrorPage, renderCheckoutHostPage } from './checkout-host-page.js';
+/** Checkout request bodies are small; anything larger is abuse, not commerce. */
+const MAX_BODY = '256kb';
+/** Fixed-window rate limit defaults (overridable via extension Settings). */
+const DEFAULT_RATE_WINDOW_MS = 60_000;
+const DEFAULT_RATE_MAX_PER_WINDOW = 30;
+/** Aggregate cap per IP across all slugs — sits on top of the per-slug window. */
+const DEFAULT_RATE_MAX_GLOBAL = 90;
+const REAP_INTERVAL_MS = 60_000;
+const requireFromHere = createRequire(import.meta.url);
+/** Directory of the `<mj-orders-checkout>` Angular Element bundle, if it was built. */
+function resolveCheckoutElementDir() {
+    const candidates = [];
+    try {
+        const entry = requireFromHere.resolve('@mj-biz-apps/orders-ng');
+        candidates.push(path.join(path.dirname(entry), 'checkout-element'));
+    }
+    catch {
+        /* package not resolvable */
+    }
+    try {
+        const here = path.dirname(fileURLToPath(import.meta.url));
+        candidates.push(path.resolve(here, '../../Angular/dist/checkout-element'));
+        candidates.push(path.resolve(here, '../../../Angular/dist/checkout-element'));
+    }
+    catch {
+        /* non-file URL */
+    }
+    for (const dir of candidates) {
+        if (existsSync(path.join(dir, 'main.js'))) {
+            return dir;
+        }
+    }
+    return null;
+}
+/** Bounded size of the rate-limit map — oldest windows evict first. */
+const RATE_CACHE_MAX = 50_000;
+const CHECKOUT_SESSION_ENTITY = 'MJ_BizApps_Orders: Checkout Sessions';
+const CHECKOUT_DISTRIBUTION_ENTITY = 'MJ_BizApps_Orders: Checkout Widget Distributions';
+const CHECKOUT_WIDGET_ENTITY = 'MJ_BizApps_Orders: Checkout Widgets';
+const TURNSTILE_VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+/** Source maps on the public checkout element are opt-in (dev). Default: do not serve. */
+export function shouldServeCheckoutElementSourceMap(settings, env = process.env) {
+    if (settings.ServeElementSourceMap === true) {
+        return true;
+    }
+    if (settings.ServeElementSourceMap === false) {
+        return false;
+    }
+    return env.CHECKOUT_ELEMENT_SOURCEMAP === '1';
+}
+let CheckoutServerExtension = class CheckoutServerExtension extends BaseServerExtension {
+    constructor() {
+        super(...arguments);
+        this.settings = {};
+        this.rateWindows = new Map();
+        this.warnedSystemUserFallback = false;
+        this.rootPath = '/checkout';
+        this.lastReapAt = 0;
+    }
+    async Initialize(app, config) {
+        this.settings = (config.Settings ?? {});
+        const root = config.RootPath.replace(/\/+$/, '') || '/checkout';
+        this.rootPath = root;
+        const json = BodyParser.json({ limit: MAX_BODY });
+        const elementDir = resolveCheckoutElementDir();
+        if (elementDir) {
+            app.get(`${root}/element/main.js`, (_req, res) => {
+                res.type('application/javascript').sendFile(path.join(elementDir, 'main.js'));
+            });
+            if (shouldServeCheckoutElementSourceMap(this.settings)) {
+                app.get(`${root}/element/main.js.map`, (_req, res) => {
+                    res.type('application/json').sendFile(path.join(elementDir, 'main.js.map'));
+                });
+            }
+            LogStatus(`[Orders] Checkout Angular Element served from ${elementDir} at GET ${root}/element/main.js`);
+        }
+        const routes = [
+            [`${root}/initialize`, (req, res) => this.handleInitialize(req, res)],
+            [`${root}/draft`, (req, res) => this.handleDraft(req, res)],
+            [`${root}/payment-intent`, (req, res) => this.handlePaymentIntent(req, res)],
+            [`${root}/complete`, (req, res) => this.handleComplete(req, res)],
+        ];
+        for (const [path, handler] of routes) {
+            // CORS preflight: answered per-widget after the origin gate resolves the policy.
+            app.options(path, (req, res) => {
+                void this.handlePreflight(req, res);
+            });
+            app.post(path, json, (req, res, _next) => {
+                void this.guardAndRun(req, res, handler);
+            });
+        }
+        const hostPath = `${root}/:slug`;
+        app.get(hostPath, (req, res) => this.handleGetHost(req, res));
+        LogStatus(`[Orders] Checkout edge registered at GET ${hostPath} and POST ${root}/{initialize,draft,payment-intent,complete}`);
+        return {
+            Success: true,
+            Message: 'Orders anonymous checkout edge mounted (public GET host, rate-limited POSTs, origin-gated, optional Turnstile).',
+            RegisteredRoutes: [...routes.map(([path]) => `POST ${path}`), `GET ${hostPath}`],
+        };
+    }
+    async Shutdown() {
+        this.rateWindows.clear();
+    }
+    async HealthCheck() {
+        const user = this.resolveActingUser();
+        return user
+            ? { Healthy: true, Name: 'OrdersCheckoutEdge' }
+            : {
+                Healthy: false,
+                Name: 'OrdersCheckoutEdge',
+                Details: { Reason: 'Neither the configured service user nor the system user resolves; every checkout call will be refused.' },
+            };
+    }
+    // ─── Gate pipeline ────────────────────────────────────────────────────────
+    /** Runs the shared gates (rate limit → origin → turnstile where required) then the handler. */
+    async guardAndRun(req, res, handler) {
+        try {
+            const ip = this.clientIp(req);
+            const slug = typeof req.body?.slug === 'string' ? req.body.slug : '';
+            const globalMax = this.settings.RateLimitMaxGlobal ?? DEFAULT_RATE_MAX_GLOBAL;
+            if (this.rateLimitExceeded(`${ip}|*`, globalMax) || this.rateLimitExceeded(`${ip}|${slug}`)) {
+                res.status(429).json({ Success: false, ErrorMessage: 'Too many requests — slow down and try again shortly.' });
+                return;
+            }
+            const policy = await this.resolveEdgePolicy(req);
+            if (policy === null) {
+                // Session/slug did not resolve; let the service produce its own not-found
+                // message with no origin grant beyond a same-origin default.
+                await handler(req, res);
+                return;
+            }
+            if (!this.applyOriginGate(req, res, policy)) {
+                return; // refused; response already written
+            }
+            if (policy.requireTurnstile && this.isTurnstileGatedPath(req)) {
+                const turnstileFailure = await this.verifyTurnstile(req);
+                if (turnstileFailure) {
+                    const [status, message] = turnstileFailure;
+                    res.status(status).json({ Success: false, ErrorMessage: message });
+                    return;
+                }
+            }
+            await handler(req, res);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            LogError(`[OrdersCheckoutEdge] Unhandled error on ${req.path}: ${msg}`);
+            if (!res.headersSent) {
+                res.status(500).json({ Success: false, ErrorMessage: 'Checkout is temporarily unavailable.' });
+            }
+        }
+    }
+    /** OPTIONS preflight: grant CORS only to origins the widget policy allows. */
+    async handlePreflight(req, res) {
+        try {
+            const policy = (await this.resolveEdgePolicy(req)) ?? {};
+            const origin = req.headers.origin;
+            if (origin && this.originAllowed(origin, policy, req)) {
+                this.setCorsHeaders(res, origin);
+                res.status(204).end();
+            }
+            else {
+                res.status(403).end();
+            }
+        }
+        catch {
+            res.status(403).end();
+        }
+    }
+    /**
+     * Resolves the widget edge policy (allowed origins + turnstile requirement) for this
+     * request — by slug on initialize, by session id on the other routes. Returns null when
+     * nothing resolves (unknown slug/session): the underlying service will answer with its
+     * own refusal.
+     */
+    async resolveEdgePolicy(req) {
+        const user = this.resolveActingUser();
+        if (!user) {
+            return null;
+        }
+        const rv = new RunView();
+        let widgetId = null;
+        const slug = this.requestSlug(req);
+        const sessionId = typeof req.body?.sessionId === 'string' ? req.body.sessionId.trim() : '';
+        if (slug) {
+            const distRes = await rv.RunView({
+                EntityName: CHECKOUT_DISTRIBUTION_ENTITY,
+                Fields: ['ID', 'CheckoutWidgetID'],
+                ExtraFilter: `Slug = '${EscapeText(slug)}' AND Status = 'Active'`,
+                ResultType: 'simple',
+            }, user);
+            widgetId = distRes?.Success && distRes.Results?.length ? distRes.Results[0].CheckoutWidgetID : null;
+        }
+        else if (sessionId && /^[0-9a-f-]{36}$/i.test(sessionId)) {
+            const sessRes = await rv.RunView({
+                EntityName: CHECKOUT_SESSION_ENTITY,
+                Fields: ['ID', 'CheckoutWidgetID'],
+                ExtraFilter: `ID = '${EscapeText(sessionId)}'`,
+                ResultType: 'simple',
+            }, user);
+            widgetId = sessRes?.Success && sessRes.Results?.length ? sessRes.Results[0].CheckoutWidgetID : null;
+        }
+        if (!widgetId) {
+            return null;
+        }
+        const widgetRes = await rv.RunView({
+            EntityName: CHECKOUT_WIDGET_ENTITY,
+            Fields: ['ID', 'Configuration'],
+            ExtraFilter: `ID = '${EscapeText(widgetId)}'`,
+            ResultType: 'simple',
+        }, user);
+        const configRaw = widgetRes?.Success && widgetRes.Results?.length ? widgetRes.Results[0].Configuration : null;
+        if (!configRaw) {
+            return {};
+        }
+        try {
+            const config = JSON.parse(configRaw);
+            return {
+                allowedOrigins: Array.isArray(config.allowedOrigins) ? config.allowedOrigins.filter((o) => typeof o === 'string') : undefined,
+                requireTurnstile: config.requireTurnstile === true,
+            };
+        }
+        catch {
+            return {};
+        }
+    }
+    /** Enforces the per-widget origin allowlist; grants CORS to allowed origins. */
+    applyOriginGate(req, res, policy) {
+        const origin = req.headers.origin;
+        if (!origin) {
+            // Non-browser client (no Origin header): nothing to grant, nothing to block here —
+            // the session credentials remain the gate.
+            return true;
+        }
+        if (!this.originAllowed(origin, policy, req)) {
+            res.status(403).json({ Success: false, ErrorMessage: 'This origin is not allowed to use this checkout.' });
+            return false;
+        }
+        this.setCorsHeaders(res, origin);
+        return true;
+    }
+    originAllowed(origin, policy, req) {
+        return originIsAllowed(origin, policy, typeof req.headers.host === 'string' ? req.headers.host : undefined);
+    }
+    setCorsHeaders(res, origin) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+        res.setHeader('Access-Control-Max-Age', '600');
+    }
+    /** Turnstile applies to the abuse-sensitive endpoints: initialize and complete. */
+    isTurnstileGatedPath(req) {
+        return req.path.endsWith('/initialize') || req.path.endsWith('/complete');
+    }
+    /**
+     * Verifies the Cloudflare Turnstile token. Returns null on success, or [status, message]
+     * on refusal. A widget that REQUIRES Turnstile with no secret configured fails closed
+     * with a 503 — a silent pass would advertise protection that is not running.
+     */
+    async verifyTurnstile(req) {
+        const envVar = this.settings.TurnstileSecretEnvVar;
+        const secret = envVar ? process.env[envVar] : undefined;
+        if (!secret) {
+            LogError(`[OrdersCheckoutEdge] Widget requires Turnstile but no secret is configured (Settings.TurnstileSecretEnvVar${envVar ? `='${envVar}' resolved empty` : ' unset'})`);
+            return [503, 'Checkout verification is not configured — contact the site operator.'];
+        }
+        const token = typeof req.body?.turnstileToken === 'string' ? req.body.turnstileToken : '';
+        if (!token) {
+            return [403, 'Human verification is required for this checkout.'];
+        }
+        try {
+            const params = new URLSearchParams({ secret, response: token, remoteip: this.clientIp(req) });
+            const verifyRes = await fetch(TURNSTILE_VERIFY_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: params.toString(),
+            });
+            const outcome = (await verifyRes.json());
+            return outcome?.success === true ? null : [403, 'Human verification failed — please try again.'];
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            LogError(`[OrdersCheckoutEdge] Turnstile verification call failed: ${msg}`);
+            return [503, 'Human verification is temporarily unavailable — please try again.'];
+        }
+    }
+    // ─── Public host page ─────────────────────────────────────────────────────
+    /**
+     * `GET /checkout/:slug` — first-party HTML that talks to the POST edge.
+     * Unknown/reserved slugs 404; missing service principal is a 503. The page
+     * itself is cache-free; initialize still enforces Active widget + distribution.
+     */
+    async handleGetHost(req, res) {
+        try {
+            const slug = typeof req.params?.slug === 'string' ? req.params.slug.trim() : '';
+            if (!isValidCheckoutSlug(slug)) {
+                this.sendHostError(res, 404, 'This checkout link is not valid.');
+                return;
+            }
+            const ip = this.clientIp(req);
+            const globalMax = this.settings.RateLimitMaxGlobal ?? DEFAULT_RATE_MAX_GLOBAL;
+            if (this.rateLimitExceeded(`${ip}|*`, globalMax) || this.rateLimitExceeded(`${ip}|get|${slug}`)) {
+                this.sendHostError(res, 429, 'Too many requests — slow down and try again shortly.');
+                return;
+            }
+            const user = this.resolveActingUser();
+            if (!user) {
+                this.sendHostError(res, 503, 'Checkout is not ready — please try again shortly.');
+                return;
+            }
+            const exists = await this.activeDistributionExists(slug, user);
+            if (!exists) {
+                this.sendHostError(res, 404, 'This checkout is not available.');
+                return;
+            }
+            this.maybeReapExpiredSessions(user);
+            const nonce = randomBytes(16).toString('base64url');
+            this.applyHostSecurityHeaders(res, nonce);
+            res
+                .status(200)
+                .setHeader('Content-Type', 'text/html; charset=utf-8')
+                .send(renderCheckoutHostPage({
+                slug,
+                apiRoot: this.rootPath,
+                cspNonce: nonce,
+                elementSrc: resolveCheckoutElementDir() ? `${this.rootPath}/element/main.js` : undefined,
+            }));
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            LogError(`[OrdersCheckoutEdge] Unhandled error on GET host: ${msg}`);
+            if (!res.headersSent) {
+                this.sendHostError(res, 500, 'Checkout is temporarily unavailable.');
+            }
+        }
+    }
+    sendHostError(res, status, message) {
+        const nonce = randomBytes(16).toString('base64url');
+        this.applyHostSecurityHeaders(res, nonce);
+        res
+            .status(status)
+            .setHeader('Content-Type', 'text/html; charset=utf-8')
+            .send(renderCheckoutHostErrorPage({ message, cspNonce: nonce }));
+    }
+    applyHostSecurityHeaders(res, nonce) {
+        for (const [name, value] of Object.entries(checkoutHostSecurityHeaders(nonce))) {
+            res.setHeader(name, value);
+        }
+    }
+    maybeReapExpiredSessions(user) {
+        const now = Date.now();
+        if (now - this.lastReapAt < REAP_INTERVAL_MS) {
+            return;
+        }
+        this.lastReapAt = now;
+        void CheckoutSessionService.ReapExpiredOpenSessions(user).catch((err) => {
+            LogError(`[OrdersCheckoutEdge] Session reap failed: ${err instanceof Error ? err.message : String(err)}`);
+        });
+    }
+    requestSlug(req) {
+        if (typeof req.params?.slug === 'string' && req.params.slug.trim()) {
+            return req.params.slug.trim();
+        }
+        return typeof req.body?.slug === 'string' ? req.body.slug.trim() : '';
+    }
+    async activeDistributionExists(slug, user) {
+        const rv = new RunView();
+        const distRes = await rv.RunView({
+            EntityName: CHECKOUT_DISTRIBUTION_ENTITY,
+            Fields: ['ID'],
+            ExtraFilter: `Slug = '${EscapeText(slug)}' AND Status = 'Active'`,
+            ResultType: 'simple',
+        }, user);
+        return !!(distRes?.Success && distRes.Results?.length);
+    }
+    // ─── Route handlers (thin shells over the service) ───────────────────────
+    async handleInitialize(req, res) {
+        const user = this.resolveActingUser();
+        if (!user) {
+            res.status(500).json({ Success: false, ErrorMessage: 'Checkout is not ready — the service principal is unavailable.' });
+            return;
+        }
+        const slug = typeof req.body?.slug === 'string' ? req.body.slug : '';
+        const clientSessionKey = typeof req.body?.clientSessionKey === 'string' ? req.body.clientSessionKey : '';
+        this.maybeReapExpiredSessions(user);
+        const result = await CheckoutSessionService.InitializeSession(slug, clientSessionKey, user);
+        res.status(result.Success ? 200 : 400).json(result);
+    }
+    async handleDraft(req, res) {
+        const user = this.resolveActingUser();
+        if (!user) {
+            res.status(500).json({ Success: false, ErrorMessage: 'Checkout is not ready — the service principal is unavailable.' });
+            return;
+        }
+        const sessionId = typeof req.body?.sessionId === 'string' ? req.body.sessionId : '';
+        const clientSessionKey = typeof req.body?.clientSessionKey === 'string' ? req.body.clientSessionKey : '';
+        const email = typeof req.body?.email === 'string' ? req.body.email : '';
+        const lines = Array.isArray(req.body?.lines) ? req.body.lines : [];
+        const result = await CheckoutSessionService.UpdateDraft(sessionId, clientSessionKey, email, lines, user);
+        res.status(result.Success ? 200 : 400).json(result);
+    }
+    async handlePaymentIntent(req, res) {
+        const user = this.resolveActingUser();
+        if (!user) {
+            res.status(500).json({ Success: false, ErrorMessage: 'Checkout is not ready — the service principal is unavailable.' });
+            return;
+        }
+        const sessionId = typeof req.body?.sessionId === 'string' ? req.body.sessionId : '';
+        const clientSessionKey = typeof req.body?.clientSessionKey === 'string' ? req.body.clientSessionKey : '';
+        const result = await CheckoutSessionService.OpenPaymentIntentForSession(sessionId, clientSessionKey, user);
+        res.status(result.Success ? 200 : 400).json(result);
+    }
+    async handleComplete(req, res) {
+        const user = this.resolveActingUser();
+        if (!user) {
+            res.status(500).json({ Success: false, ErrorMessage: 'Checkout is not ready — the service principal is unavailable.' });
+            return;
+        }
+        const sessionId = typeof req.body?.sessionId === 'string' ? req.body.sessionId : '';
+        const clientSessionKey = typeof req.body?.clientSessionKey === 'string' ? req.body.clientSessionKey : '';
+        const result = await CheckoutSessionService.CompleteCheckout(sessionId, clientSessionKey, user);
+        res.status(result.Success ? 200 : 409).json(result);
+    }
+    // ─── Infrastructure ──────────────────────────────────────────────────────
+    /** Fixed-window limiter over a bounded, insertion-ordered map. */
+    rateLimitExceeded(clientKey, maxPerWindow = this.settings.RateLimitMax ?? DEFAULT_RATE_MAX_PER_WINDOW) {
+        const windowMs = this.settings.RateLimitWindowMs ?? DEFAULT_RATE_WINDOW_MS;
+        const now = Date.now();
+        const entry = this.rateWindows.get(clientKey);
+        if (!entry || now - entry.windowStart >= windowMs) {
+            if (this.rateWindows.size >= RATE_CACHE_MAX) {
+                const oldest = this.rateWindows.keys().next().value;
+                if (oldest !== undefined) {
+                    this.rateWindows.delete(oldest);
+                }
+            }
+            this.rateWindows.set(clientKey, { windowStart: now, count: 1 });
+            return false;
+        }
+        entry.count++;
+        return entry.count > maxPerWindow;
+    }
+    /**
+     * The client IP for rate limiting and Turnstile. Ignores X-Forwarded-For unless
+     * `Settings.TrustedProxyHops` is a positive integer (Nth-from-right hop).
+     */
+    clientIp(req) {
+        return resolveClientIp(req, this.settings.TrustedProxyHops ?? 0);
+    }
+    /**
+     * The acting principal for checkout writes: the configured service user when present,
+     * else MJ's system user (warned once). Resolved per request — the user cache may not be
+     * populated when the extension initializes.
+     */
+    resolveActingUser() {
+        try {
+            const email = this.settings.ServiceUserEmail?.trim().toLowerCase();
+            if (email) {
+                const named = UserCache.Instance.Users?.find((u) => u.Email?.trim().toLowerCase() === email);
+                if (named) {
+                    return named;
+                }
+                LogError(`[OrdersCheckoutEdge] Configured ServiceUserEmail '${email}' does not resolve to a user — falling back to the system user.`);
+            }
+            else if (!this.warnedSystemUserFallback) {
+                this.warnedSystemUserFallback = true;
+                LogStatus('[OrdersCheckoutEdge] No ServiceUserEmail configured — checkout writes run as the system user. Configure a named checkout principal for auditability.');
+            }
+            return UserCache.Instance.GetSystemUser() ?? undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+};
+CheckoutServerExtension = __decorate([
+    RegisterClass(BaseServerExtension, 'OrdersCheckoutEdge')
+], CheckoutServerExtension);
+export { CheckoutServerExtension };
+/** Tree-shaking anchor — call from the server bootstrap so @RegisterClass is retained. */
+export function LoadCheckoutServerExtension() {
+    // intentionally empty
+}
+//# sourceMappingURL=CheckoutServerExtension.js.map