@moonbase.sh/storefront-api 3.7.0 → 3.9.0

package/README.md

@@ -24,7 +24,7 @@ Configuration notes:
 
 - `endpoint`: your Moonbase storefront URL.
 - `includeManifests`: include downloadable file manifests when available.
-- `persistUtm`: store detected UTM values in localStorage instead of sessionStorage.
+- `persistUtm`: store detected UTM values and ad click IDs in localStorage instead of sessionStorage.
 
 ## Common usage
 
@@ -172,6 +172,38 @@ refused with `CaptchaRequiredError` (a `MoonbaseError`). A site with a
 Content-Security-Policy has to allow the store's `https://<account-id>.moonbase.sh`
 in `frame-src`.
 
+### Where a customer came from
+
+Pass the UTM tags, ad click IDs and referrer the visitor arrived with, the same
+shape orders take, so the merchant can see how the customer was acquired:
+
+```ts
+import { parseOffSiteReferrer } from '@moonbase.sh/storefront-api'
+
+const params = new URLSearchParams(window.location.search)
+
+await client.identity.signUp('Jane', 'jane@example.com', 'password', null, true, true, true, {
+  utm: {
+    source: params.get('utm_source') || undefined,
+    campaign: params.get('utm_campaign') || undefined,
+    // Click IDs ad platforms add to the link, often with no UTM tags beside them.
+    gclid: params.get('gclid') || undefined,
+    fbclid: params.get('fbclid') || undefined,
+    msclkid: params.get('msclkid') || undefined,
+    ttclid: params.get('ttclid') || undefined,
+    // The referring site's host only, and nothing when the visitor came from this site.
+    referrer: parseOffSiteReferrer(document.referrer, window.location.origin),
+  },
+})
+```
+
+Fields left out are not sent. The click IDs (`gclid`, `gbraid` and `wbraid` from
+Google Ads, `fbclid` from Meta, `msclkid` from Microsoft Advertising and `ttclid`
+from TikTok) go to the API under those names, and the rest as `utm_*`.
+`useAuth().signUp` in `@moonbase.sh/vue`, and so the storefront widget, fills this
+in from the tags and click IDs it has already picked up, unless you pass your own
+`utm`.
+
 ## Inventory flow
 
 Most inventory endpoints require an authenticated user:
@@ -191,6 +223,14 @@ while (page.hasMore && page.next) {
 }
 ```
 
+A product's release history needs no sign-in. `getReleases` lists its published releases, highest
+version first, each with its version, release notes, publish date and files, and whether the caller
+may download it (`downloadsAllowed`). It pages the same way:
+
+```ts
+const releases = await client.inventory.products.getReleases('my-product')
+```
+
 ## Endpoint groups
 
 `client.storefront`, `client.identity`, `client.orders`, `client.vouchers`, `client.inventory`, `client.activationRequests`, `client.vendor`, `client.communications`, `client.groups`.

package/dist/index.cjs

@@ -46,6 +46,7 @@ __export(index_exports, {
   NotFoundError: () => NotFoundError,
   OfferUtils: () => OfferUtils,
   OrderStatus: () => OrderStatus,
+  PasswordSetupRequiredError: () => PasswordSetupRequiredError,
   Platform: () => Platform,
   StoreClosedError: () => StoreClosedError,
   SubscriptionCancellationReason: () => SubscriptionCancellationReason,
@@ -120,7 +121,13 @@ function utmToObject(utm) {
     utm_campaign: utm == null ? void 0 : utm.campaign,
     utm_term: utm == null ? void 0 : utm.term,
     utm_content: utm == null ? void 0 : utm.content,
-    utm_referrer: utm == null ? void 0 : utm.referrer
+    utm_referrer: utm == null ? void 0 : utm.referrer,
+    gclid: utm == null ? void 0 : utm.gclid,
+    gbraid: utm == null ? void 0 : utm.gbraid,
+    wbraid: utm == null ? void 0 : utm.wbraid,
+    fbclid: utm == null ? void 0 : utm.fbclid,
+    msclkid: utm == null ? void 0 : utm.msclkid,
+    ttclid: utm == null ? void 0 : utm.ttclid
   }).filter(([_, value]) => value !== void 0).reduce((obj, [key, value]) => ({
     ...obj,
     [key]: value
@@ -212,6 +219,7 @@ var schemas_exports = {};
 __export(schemas_exports, {
   downloadSchema: () => downloadSchema,
   manifestSchema: () => manifestSchema,
+  productReleaseSchema: () => productReleaseSchema,
   productSummarySchema: () => productSummarySchema
 });
 var import_zod2 = require("zod");
@@ -274,10 +282,20 @@ var productSummarySchema = import_zod2.z.object({
   downloadsNeedsOwnership: import_zod2.z.boolean(),
   downloadsNeedsGroupMembership: import_zod2.z.boolean(),
   // Whether this caller clears every requirement above, including the group membership the client
-  // can't see for itself.
+  // can't see for itself. False with none of them set means the merchant closed the release to everyone.
   downloadsAllowed: import_zod2.z.boolean(),
   downloads: import_zod2.z.array(downloadSchema).optional()
 });
+var productReleaseSchema = import_zod2.z.object({
+  version: import_zod2.z.string(),
+  description: import_zod2.z.string().nullish(),
+  publishedAt: import_zod2.z.coerce.date(),
+  // Whether this caller may download the release, resolved against its own access control: a
+  // merchant can keep past releases to owners while the current one is open to anyone.
+  downloadsAllowed: import_zod2.z.boolean(),
+  downloads: import_zod2.z.array(downloadSchema),
+  properties: import_zod2.z.record(rawPropertyValueSchema).nullish()
+});
 
 // src/storefront/schemas.ts
 var storefrontProductSchema = import_zod3.z.object({
@@ -668,6 +686,12 @@ var CaptchaRequiredError = class extends MoonbaseError {
     this.name = "CaptchaRequiredError";
   }
 };
+var PasswordSetupRequiredError = class extends MoonbaseError {
+  constructor(detail, title, status) {
+    super(title != null ? title : "Password setup required", detail, status);
+    this.name = "PasswordSetupRequiredError";
+  }
+};
 
 // src/utils/problemDetails.ts
 var import_zod7 = require("zod");
@@ -691,6 +715,7 @@ function camelCase(str) {
   }).join("");
 }
 async function handleResponseProblem(response, logger) {
+  var _a;
   if (response.status === 404)
     throw new NotFoundError();
   if (response.status === 401) {
@@ -712,6 +737,8 @@ async function handleResponseProblem(response, logger) {
     throw new StoreClosedError(problemDetails.detail);
   if (problemDetails.errorType === "CaptchaRequired")
     throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
+  if (problemDetails.errorType === "PasswordSetupRequired")
+    throw new PasswordSetupRequiredError(problemDetails.detail, problemDetails.title, (_a = problemDetails.status) != null ? _a : response.status);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -730,6 +757,7 @@ __export(schemas_exports5, {
   identitySchema: () => identitySchema,
   ilokConnectedAccountSchema: () => ilokConnectedAccountSchema,
   pendingActivationSchema: () => pendingActivationSchema,
+  pendingPasswordProblemSchema: () => pendingPasswordProblemSchema,
   userAccountConfirmedSchema: () => userAccountConfirmedSchema,
   userAccountConfirmedStatusSchema: () => userAccountConfirmedStatusSchema,
   userSchema: () => userSchema
@@ -803,13 +831,18 @@ var pendingActivationSchema = import_zod8.z.object({
   status: import_zod8.z.literal("activation_pending"),
   email: import_zod8.z.string()
 });
+var pendingPasswordProblemSchema = import_zod8.z.object({
+  errorType: import_zod8.z.literal("PasswordSetupRequired"),
+  pendingPasswordToken: import_zod8.z.string()
+});
 
 // src/identity/endpoints.ts
 var IdentityEndpoints = class {
-  constructor(api, tokenStore, logger) {
+  constructor(api, tokenStore, logger, pendingPasswords) {
     this.api = api;
     this.tokenStore = tokenStore;
     this.logger = logger;
+    this.pendingPasswords = pendingPasswords;
   }
   async get() {
     const response = await this.api.authenticatedFetch("/api/customer/meta/user", userSchema);
@@ -841,8 +874,12 @@ var IdentityEndpoints = class {
     return userSchema.parse(identity);
   }
   async signUp(name, email, password, address, acceptedPrivacyPolicy, acceptedTermsAndConditions, communicationOptIn, options) {
-    const path = `/api/customer/identity/sign-up?scheme=JWT&communicationOptIn=${communicationOptIn ? "true" : "false"}`;
-    const response = await fetch(`${this.api.baseUrl}${path}`, {
+    const query = new URLSearchParams({
+      scheme: "JWT",
+      communicationOptIn: communicationOptIn ? "true" : "false",
+      ...utmToObject(options == null ? void 0 : options.utm)
+    });
+    const response = await fetch(`${this.api.baseUrl}/api/customer/identity/sign-up?${query.toString()}`, {
       method: "POST",
       headers: {
         "Accept": "application/json",
@@ -861,8 +898,11 @@ var IdentityEndpoints = class {
         groupIds: normalizeGroupIds(options == null ? void 0 : options.groupIds)
       })
     });
-    if (response.status >= 400)
+    if (response.status >= 400) {
+      if (response.status === 409)
+        await this.keepPendingPassword(email, response.clone());
       await handleResponseProblem(response, this.logger);
+    }
     const data = await response.json();
     if (response.status === 202) {
       const parsed = pendingActivationSchema.parse(data);
@@ -878,6 +918,19 @@ var IdentityEndpoints = class {
     this.tokenStore.setUser(identity);
     return { status: "signed-in", user: userSchema.parse(identity) };
   }
+  /**
+   * The address already has an account with no password, so the server emailed it a link and
+   * handed back the password just typed, sealed, for that link to set once it is opened here.
+   * Never thrown: the caller still gets the `PasswordSetupRequiredError` from the response.
+   */
+  async keepPendingPassword(email, response) {
+    try {
+      const problem = pendingPasswordProblemSchema.safeParse(await response.json());
+      if (problem.success)
+        this.pendingPasswords.set(email, problem.data.pendingPasswordToken);
+    } catch (e) {
+    }
+  }
   /**
    * Signs the buyer out here at once, and ends the session on the server so its refresh
    * token stops working too. Resolves once the server has answered, and never rejects:
@@ -929,7 +982,13 @@ var IdentityEndpoints = class {
       await handleResponseProblem(response, this.logger);
   }
   async confirmAccount(email, code) {
-    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, { method: "POST" });
+    const pendingPasswordToken = this.pendingPasswords.get(email);
+    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, {
+      method: "POST",
+      body: pendingPasswordToken ? { pendingPasswordToken } : void 0
+    });
+    if (pendingPasswordToken)
+      this.pendingPasswords.remove(email);
     const result = response.data;
     if (result.status === "SignedIn") {
       if (!result.accessToken || !result.refreshToken) {
@@ -1091,6 +1150,15 @@ var ProductEndpoints = class {
     const response = await this.api.fetch(`/api/customer/inventory/products/${productId}${version2 ? `?version=${version2}${this.configuration.includeManifests ? "&includeManifests=true" : ""}` : this.configuration.includeManifests ? "?includeManifests=true" : ""}`, productSummarySchema);
     return response.data;
   }
+  /**
+   * The product's published releases, highest version first, with their release notes and files,
+   * and whether the caller may download each. Open to anyone who can see the product, signed in or
+   * not. A page can hold fewer releases than its size, so keep following `next` while `hasMore` is set.
+   */
+  async getReleases(productId, nextUrl) {
+    const response = await this.api.fetch(nextUrl || `/api/customer/inventory/products/${productId}/releases${this.configuration.includeManifests ? "?includeManifests=true" : ""}`, paged(productReleaseSchema));
+    return response.data;
+  }
   async getOwned(nextUrl) {
     const response = await this.api.authenticatedFetch(nextUrl || `/api/customer/inventory/products${this.configuration.includeManifests ? "?includeManifests=true" : ""}`, paged(productSummarySchema));
     return response.data;
@@ -1117,7 +1185,7 @@ var ProductEndpoints = class {
 var import_zod14 = require("zod");
 
 // package.json
-var version = "3.7.0";
+var version = "3.9.0";
 
 // src/utils/client.ts
 function buildClientHeader(sdk) {
@@ -1125,6 +1193,11 @@ function buildClientHeader(sdk) {
 }
 
 // src/utils/api.ts
+function loggableBody(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body))
+    return body;
+  return Object.fromEntries(Object.entries(body).map(([key, value]) => [key, /password|token/i.test(key) && value != null ? "[redacted]" : value]));
+}
 function objectToQuery(obj) {
   return Object.entries(obj != null ? obj : {}).filter(([_, value]) => value !== void 0).map(([key, value]) => `${key}=${encodeURIComponent(value instanceof Date ? value.toISOString() : value)}`).join("&");
 }
@@ -1146,7 +1219,7 @@ var MoonbaseApi = class {
     const contentType = (_a = options == null ? void 0 : options.contentType) != null ? _a : "application/json";
     this.logger.debug("Making request to Moonbase API...", {
       path,
-      body: options == null ? void 0 : options.body
+      body: loggableBody(options == null ? void 0 : options.body)
     });
     const startedAt = /* @__PURE__ */ new Date();
     const request = {
@@ -1795,6 +1868,50 @@ var InMemoryStore = class {
   }
 };
 
+// src/utils/pendingPasswords.ts
+var lifetime = 24 * 60 * 60 * 1e3;
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+var _PendingPasswordStore = class _PendingPasswordStore {
+  constructor(store) {
+    this.store = store != null ? store : isLocalStorageAvailable() ? new LocalStorageStore() : new InMemoryStore();
+  }
+  get(email) {
+    var _a, _b;
+    return (_b = (_a = this.read()[normalizeEmail(email)]) == null ? void 0 : _a.token) != null ? _b : null;
+  }
+  set(email, token) {
+    this.write({ ...this.read(), [normalizeEmail(email)]: { token, storedAt: Date.now() } });
+  }
+  remove(email) {
+    const entries = this.read();
+    delete entries[normalizeEmail(email)];
+    this.write(entries);
+  }
+  /** The entries still worth keeping. Drops the rest from storage as it goes. */
+  read() {
+    const stored = this.store.get(_PendingPasswordStore.storageKey);
+    if (!stored || typeof stored !== "object")
+      return {};
+    const now = Date.now();
+    const fresh = Object.fromEntries(Object.entries(stored).filter(
+      ([, entry]) => typeof (entry == null ? void 0 : entry.token) === "string" && typeof entry.storedAt === "number" && now - entry.storedAt < lifetime
+    ));
+    if (Object.keys(fresh).length !== Object.keys(stored).length)
+      this.write(fresh);
+    return fresh;
+  }
+  write(entries) {
+    if (Object.keys(entries).length > 0)
+      this.store.set(_PendingPasswordStore.storageKey, entries);
+    else
+      this.store.remove(_PendingPasswordStore.storageKey);
+  }
+};
+_PendingPasswordStore.storageKey = "moonbase_pending_passwords";
+var PendingPasswordStore = _PendingPasswordStore;
+
 // src/utils/tokenStore.ts
 var defaultAccessTokenLifetime = 15 * 60 * 1e3;
 var renewBeforeExpiry = 5 * 60 * 1e3;
@@ -1804,9 +1921,9 @@ function accessTokenLifetime(accessToken) {
   try {
     const payload = accessToken.split(".")[1].replaceAll("-", "+").replaceAll("_", "/");
     const claims = JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
-    const lifetime = (Number(claims.exp) - Number(claims.iat)) * 1e3;
-    if (Number.isFinite(lifetime) && lifetime > 0 && lifetime <= 24 * 60 * 60 * 1e3)
-      return lifetime;
+    const lifetime2 = (Number(claims.exp) - Number(claims.iat)) * 1e3;
+    if (Number.isFinite(lifetime2) && lifetime2 > 0 && lifetime2 <= 24 * 60 * 60 * 1e3)
+      return lifetime2;
   } catch (e) {
   }
   return defaultAccessTokenLifetime;
@@ -2731,7 +2848,8 @@ function parseOffSiteReferrer(rawReferrer, currentOrigin) {
 }
 function resolveUtm(cached, fresh) {
   const freshHasUtm = !!(fresh.source || fresh.medium || fresh.campaign || fresh.term || fresh.content);
-  const freshIsExternalArrival = freshHasUtm || !!fresh.referrer;
+  const freshHasClickId = !!(fresh.gclid || fresh.gbraid || fresh.wbraid || fresh.fbclid || fresh.msclkid || fresh.ttclid);
+  const freshIsExternalArrival = freshHasUtm || freshHasClickId || !!fresh.referrer;
   if (freshIsExternalArrival)
     return fresh;
   return cached != null ? cached : fresh;
@@ -2747,7 +2865,7 @@ var MoonbaseClient = class {
     this.tokenStore = new TokenStore(configuration);
     this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger, this.configuration.sdk);
     this.storefront = new StorefrontEndpoints(this.api, this.configuration);
-    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger);
+    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger, new PendingPasswordStore(configuration.store));
     this.communications = new CommunicationsEndpoints(this.api);
     this.groups = new GroupEndpoints(this.api);
     this.vouchers = new VoucherEndpoints(this.api);
@@ -2785,6 +2903,7 @@ var MoonbaseClient = class {
   NotFoundError,
   OfferUtils,
   OrderStatus,
+  PasswordSetupRequiredError,
   Platform,
   StoreClosedError,
   SubscriptionCancellationReason,