@moonbase.sh/storefront-api 3.7.0 → 3.9.0

package/dist/index.js

@@ -56,7 +56,13 @@ function utmToObject(utm) {
     utm_campaign: utm == null ? void 0 : utm.campaign,
     utm_term: utm == null ? void 0 : utm.term,
     utm_content: utm == null ? void 0 : utm.content,
-    utm_referrer: utm == null ? void 0 : utm.referrer
+    utm_referrer: utm == null ? void 0 : utm.referrer,
+    gclid: utm == null ? void 0 : utm.gclid,
+    gbraid: utm == null ? void 0 : utm.gbraid,
+    wbraid: utm == null ? void 0 : utm.wbraid,
+    fbclid: utm == null ? void 0 : utm.fbclid,
+    msclkid: utm == null ? void 0 : utm.msclkid,
+    ttclid: utm == null ? void 0 : utm.ttclid
   }).filter(([_, value]) => value !== void 0).reduce((obj, [key, value]) => ({
     ...obj,
     [key]: value
@@ -148,6 +154,7 @@ var schemas_exports = {};
 __export(schemas_exports, {
   downloadSchema: () => downloadSchema,
   manifestSchema: () => manifestSchema,
+  productReleaseSchema: () => productReleaseSchema,
   productSummarySchema: () => productSummarySchema
 });
 import { z as z2 } from "zod";
@@ -210,10 +217,20 @@ var productSummarySchema = z2.object({
   downloadsNeedsOwnership: z2.boolean(),
   downloadsNeedsGroupMembership: z2.boolean(),
   // Whether this caller clears every requirement above, including the group membership the client
-  // can't see for itself.
+  // can't see for itself. False with none of them set means the merchant closed the release to everyone.
   downloadsAllowed: z2.boolean(),
   downloads: z2.array(downloadSchema).optional()
 });
+var productReleaseSchema = z2.object({
+  version: z2.string(),
+  description: z2.string().nullish(),
+  publishedAt: z2.coerce.date(),
+  // Whether this caller may download the release, resolved against its own access control: a
+  // merchant can keep past releases to owners while the current one is open to anyone.
+  downloadsAllowed: z2.boolean(),
+  downloads: z2.array(downloadSchema),
+  properties: z2.record(rawPropertyValueSchema).nullish()
+});
 
 // src/storefront/schemas.ts
 var storefrontProductSchema = z3.object({
@@ -604,6 +621,12 @@ var CaptchaRequiredError = class extends MoonbaseError {
     this.name = "CaptchaRequiredError";
   }
 };
+var PasswordSetupRequiredError = class extends MoonbaseError {
+  constructor(detail, title, status) {
+    super(title != null ? title : "Password setup required", detail, status);
+    this.name = "PasswordSetupRequiredError";
+  }
+};
 
 // src/utils/problemDetails.ts
 import { z as z7 } from "zod";
@@ -627,6 +650,7 @@ function camelCase(str) {
   }).join("");
 }
 async function handleResponseProblem(response, logger) {
+  var _a;
   if (response.status === 404)
     throw new NotFoundError();
   if (response.status === 401) {
@@ -648,6 +672,8 @@ async function handleResponseProblem(response, logger) {
     throw new StoreClosedError(problemDetails.detail);
   if (problemDetails.errorType === "CaptchaRequired")
     throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
+  if (problemDetails.errorType === "PasswordSetupRequired")
+    throw new PasswordSetupRequiredError(problemDetails.detail, problemDetails.title, (_a = problemDetails.status) != null ? _a : response.status);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -666,6 +692,7 @@ __export(schemas_exports5, {
   identitySchema: () => identitySchema,
   ilokConnectedAccountSchema: () => ilokConnectedAccountSchema,
   pendingActivationSchema: () => pendingActivationSchema,
+  pendingPasswordProblemSchema: () => pendingPasswordProblemSchema,
   userAccountConfirmedSchema: () => userAccountConfirmedSchema,
   userAccountConfirmedStatusSchema: () => userAccountConfirmedStatusSchema,
   userSchema: () => userSchema
@@ -739,13 +766,18 @@ var pendingActivationSchema = z8.object({
   status: z8.literal("activation_pending"),
   email: z8.string()
 });
+var pendingPasswordProblemSchema = z8.object({
+  errorType: z8.literal("PasswordSetupRequired"),
+  pendingPasswordToken: z8.string()
+});
 
 // src/identity/endpoints.ts
 var IdentityEndpoints = class {
-  constructor(api, tokenStore, logger) {
+  constructor(api, tokenStore, logger, pendingPasswords) {
     this.api = api;
     this.tokenStore = tokenStore;
     this.logger = logger;
+    this.pendingPasswords = pendingPasswords;
   }
   async get() {
     const response = await this.api.authenticatedFetch("/api/customer/meta/user", userSchema);
@@ -777,8 +809,12 @@ var IdentityEndpoints = class {
     return userSchema.parse(identity);
   }
   async signUp(name, email, password, address, acceptedPrivacyPolicy, acceptedTermsAndConditions, communicationOptIn, options) {
-    const path = `/api/customer/identity/sign-up?scheme=JWT&communicationOptIn=${communicationOptIn ? "true" : "false"}`;
-    const response = await fetch(`${this.api.baseUrl}${path}`, {
+    const query = new URLSearchParams({
+      scheme: "JWT",
+      communicationOptIn: communicationOptIn ? "true" : "false",
+      ...utmToObject(options == null ? void 0 : options.utm)
+    });
+    const response = await fetch(`${this.api.baseUrl}/api/customer/identity/sign-up?${query.toString()}`, {
       method: "POST",
       headers: {
         "Accept": "application/json",
@@ -797,8 +833,11 @@ var IdentityEndpoints = class {
         groupIds: normalizeGroupIds(options == null ? void 0 : options.groupIds)
       })
     });
-    if (response.status >= 400)
+    if (response.status >= 400) {
+      if (response.status === 409)
+        await this.keepPendingPassword(email, response.clone());
       await handleResponseProblem(response, this.logger);
+    }
     const data = await response.json();
     if (response.status === 202) {
       const parsed = pendingActivationSchema.parse(data);
@@ -814,6 +853,19 @@ var IdentityEndpoints = class {
     this.tokenStore.setUser(identity);
     return { status: "signed-in", user: userSchema.parse(identity) };
   }
+  /**
+   * The address already has an account with no password, so the server emailed it a link and
+   * handed back the password just typed, sealed, for that link to set once it is opened here.
+   * Never thrown: the caller still gets the `PasswordSetupRequiredError` from the response.
+   */
+  async keepPendingPassword(email, response) {
+    try {
+      const problem = pendingPasswordProblemSchema.safeParse(await response.json());
+      if (problem.success)
+        this.pendingPasswords.set(email, problem.data.pendingPasswordToken);
+    } catch (e) {
+    }
+  }
   /**
    * Signs the buyer out here at once, and ends the session on the server so its refresh
    * token stops working too. Resolves once the server has answered, and never rejects:
@@ -865,7 +917,13 @@ var IdentityEndpoints = class {
       await handleResponseProblem(response, this.logger);
   }
   async confirmAccount(email, code) {
-    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, { method: "POST" });
+    const pendingPasswordToken = this.pendingPasswords.get(email);
+    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, {
+      method: "POST",
+      body: pendingPasswordToken ? { pendingPasswordToken } : void 0
+    });
+    if (pendingPasswordToken)
+      this.pendingPasswords.remove(email);
     const result = response.data;
     if (result.status === "SignedIn") {
       if (!result.accessToken || !result.refreshToken) {
@@ -1027,6 +1085,15 @@ var ProductEndpoints = class {
     const response = await this.api.fetch(`/api/customer/inventory/products/${productId}${version2 ? `?version=${version2}${this.configuration.includeManifests ? "&includeManifests=true" : ""}` : this.configuration.includeManifests ? "?includeManifests=true" : ""}`, productSummarySchema);
     return response.data;
   }
+  /**
+   * The product's published releases, highest version first, with their release notes and files,
+   * and whether the caller may download each. Open to anyone who can see the product, signed in or
+   * not. A page can hold fewer releases than its size, so keep following `next` while `hasMore` is set.
+   */
+  async getReleases(productId, nextUrl) {
+    const response = await this.api.fetch(nextUrl || `/api/customer/inventory/products/${productId}/releases${this.configuration.includeManifests ? "?includeManifests=true" : ""}`, paged(productReleaseSchema));
+    return response.data;
+  }
   async getOwned(nextUrl) {
     const response = await this.api.authenticatedFetch(nextUrl || `/api/customer/inventory/products${this.configuration.includeManifests ? "?includeManifests=true" : ""}`, paged(productSummarySchema));
     return response.data;
@@ -1053,7 +1120,7 @@ var ProductEndpoints = class {
 import { z as z14 } from "zod";
 
 // package.json
-var version = "3.7.0";
+var version = "3.9.0";
 
 // src/utils/client.ts
 function buildClientHeader(sdk) {
@@ -1061,6 +1128,11 @@ function buildClientHeader(sdk) {
 }
 
 // src/utils/api.ts
+function loggableBody(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body))
+    return body;
+  return Object.fromEntries(Object.entries(body).map(([key, value]) => [key, /password|token/i.test(key) && value != null ? "[redacted]" : value]));
+}
 function objectToQuery(obj) {
   return Object.entries(obj != null ? obj : {}).filter(([_, value]) => value !== void 0).map(([key, value]) => `${key}=${encodeURIComponent(value instanceof Date ? value.toISOString() : value)}`).join("&");
 }
@@ -1082,7 +1154,7 @@ var MoonbaseApi = class {
     const contentType = (_a = options == null ? void 0 : options.contentType) != null ? _a : "application/json";
     this.logger.debug("Making request to Moonbase API...", {
       path,
-      body: options == null ? void 0 : options.body
+      body: loggableBody(options == null ? void 0 : options.body)
     });
     const startedAt = /* @__PURE__ */ new Date();
     const request = {
@@ -1731,6 +1803,50 @@ var InMemoryStore = class {
   }
 };
 
+// src/utils/pendingPasswords.ts
+var lifetime = 24 * 60 * 60 * 1e3;
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+var _PendingPasswordStore = class _PendingPasswordStore {
+  constructor(store) {
+    this.store = store != null ? store : isLocalStorageAvailable() ? new LocalStorageStore() : new InMemoryStore();
+  }
+  get(email) {
+    var _a, _b;
+    return (_b = (_a = this.read()[normalizeEmail(email)]) == null ? void 0 : _a.token) != null ? _b : null;
+  }
+  set(email, token) {
+    this.write({ ...this.read(), [normalizeEmail(email)]: { token, storedAt: Date.now() } });
+  }
+  remove(email) {
+    const entries = this.read();
+    delete entries[normalizeEmail(email)];
+    this.write(entries);
+  }
+  /** The entries still worth keeping. Drops the rest from storage as it goes. */
+  read() {
+    const stored = this.store.get(_PendingPasswordStore.storageKey);
+    if (!stored || typeof stored !== "object")
+      return {};
+    const now = Date.now();
+    const fresh = Object.fromEntries(Object.entries(stored).filter(
+      ([, entry]) => typeof (entry == null ? void 0 : entry.token) === "string" && typeof entry.storedAt === "number" && now - entry.storedAt < lifetime
+    ));
+    if (Object.keys(fresh).length !== Object.keys(stored).length)
+      this.write(fresh);
+    return fresh;
+  }
+  write(entries) {
+    if (Object.keys(entries).length > 0)
+      this.store.set(_PendingPasswordStore.storageKey, entries);
+    else
+      this.store.remove(_PendingPasswordStore.storageKey);
+  }
+};
+_PendingPasswordStore.storageKey = "moonbase_pending_passwords";
+var PendingPasswordStore = _PendingPasswordStore;
+
 // src/utils/tokenStore.ts
 var defaultAccessTokenLifetime = 15 * 60 * 1e3;
 var renewBeforeExpiry = 5 * 60 * 1e3;
@@ -1740,9 +1856,9 @@ function accessTokenLifetime(accessToken) {
   try {
     const payload = accessToken.split(".")[1].replaceAll("-", "+").replaceAll("_", "/");
     const claims = JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
-    const lifetime = (Number(claims.exp) - Number(claims.iat)) * 1e3;
-    if (Number.isFinite(lifetime) && lifetime > 0 && lifetime <= 24 * 60 * 60 * 1e3)
-      return lifetime;
+    const lifetime2 = (Number(claims.exp) - Number(claims.iat)) * 1e3;
+    if (Number.isFinite(lifetime2) && lifetime2 > 0 && lifetime2 <= 24 * 60 * 60 * 1e3)
+      return lifetime2;
   } catch (e) {
   }
   return defaultAccessTokenLifetime;
@@ -2667,7 +2783,8 @@ function parseOffSiteReferrer(rawReferrer, currentOrigin) {
 }
 function resolveUtm(cached, fresh) {
   const freshHasUtm = !!(fresh.source || fresh.medium || fresh.campaign || fresh.term || fresh.content);
-  const freshIsExternalArrival = freshHasUtm || !!fresh.referrer;
+  const freshHasClickId = !!(fresh.gclid || fresh.gbraid || fresh.wbraid || fresh.fbclid || fresh.msclkid || fresh.ttclid);
+  const freshIsExternalArrival = freshHasUtm || freshHasClickId || !!fresh.referrer;
   if (freshIsExternalArrival)
     return fresh;
   return cached != null ? cached : fresh;
@@ -2683,7 +2800,7 @@ var MoonbaseClient = class {
     this.tokenStore = new TokenStore(configuration);
     this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger, this.configuration.sdk);
     this.storefront = new StorefrontEndpoints(this.api, this.configuration);
-    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger);
+    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger, new PendingPasswordStore(configuration.store));
     this.communications = new CommunicationsEndpoints(this.api);
     this.groups = new GroupEndpoints(this.api);
     this.vouchers = new VoucherEndpoints(this.api);
@@ -2720,6 +2837,7 @@ export {
   NotFoundError,
   OfferUtils,
   OrderStatus,
+  PasswordSetupRequiredError,
   Platform,
   StoreClosedError,
   SubscriptionCancellationReason,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@moonbase.sh/storefront-api",
   "type": "module",
-  "version": "3.7.0",
+  "version": "3.9.0",
   "description": "Package to let you build storefronts with Moonbase.sh as payment and delivery provider",
   "author": "Tobias Lønnerød Madsen <m@dsen.tv>",
   "license": "MIT",