@nextblock-cms/ecom 0.21.3 → 0.22.1

package/lib/coupon-server.es.js

@@ -1,58 +1,59 @@
 import { getDefaultCurrency as e, normalizeCurrencyRecord as t, normalizePriceMap as n, normalizeSalePriceMap as r, resolveEffectivePriceForCurrency as i } from "./currency.es.js";
-import { emptyProviderDiscounts as a, getCartLineCouponKey as o, normalizeCouponCode as s } from "./coupons.es.js";
+import { COUPON_INVALID_ERROR_KEY as a, COUPON_INVALID_ERROR_MESSAGE as o, emptyProviderDiscounts as s, getCartLineCouponKey as c, normalizeCouponCode as l } from "./coupons.es.js";
+import "server-only";
 //#region src/lib/coupon-server.ts
-function c(e) {
+function u(e) {
 	if (!e) return null;
 	let t = new Date(e);
 	return Number.isNaN(t.getTime()) ? null : t;
 }
-function l(e, t) {
+function d(e, t) {
 	return e === "all" || e === t;
 }
-function u(e) {
+function f(e) {
 	return e === "stripe" || e === "freemius" ? e : null;
 }
-async function d(e) {
+async function p(e) {
 	let { data: n, error: r } = await e.from("currencies").select("code, symbol, exchange_rate, is_default, is_active, auto_sync_product_prices, auto_update_exchange_rate, exchange_rate_source, exchange_rate_updated_at, rounding_mode, rounding_increment, rounding_charm_amount").eq("is_active", !0).order("code", { ascending: !0 });
 	if (r) throw Error(r.message);
 	return (n || []).map((e) => t(e));
 }
-async function f(t) {
-	let { client: a, items: s } = t, c = await d(a);
-	if (c.length === 0) throw Error("No active currencies are configured.");
-	let l = c.find((e) => e.code === (t.currencyCode || "").toUpperCase()) ?? e(c), f = [...new Set(s.map((e) => e.product_id).filter(Boolean))], p = [...new Set(s.map((e) => e.variant_id).filter((e) => !!e))];
-	if (f.length === 0) return {
+async function m(t) {
+	let { client: a, items: o } = t, s = await p(a);
+	if (s.length === 0) throw Error("No active currencies are configured.");
+	let l = s.find((e) => e.code === (t.currencyCode || "").toUpperCase()) ?? e(s), u = [...new Set(o.map((e) => e.product_id).filter(Boolean))], d = [...new Set(o.map((e) => e.variant_id).filter((e) => !!e))];
+	if (u.length === 0) return {
 		lines: [],
-		currencies: c,
+		currencies: s,
 		selectedCurrency: l
 	};
-	let [{ data: m, error: h }, g] = await Promise.all([a.from("products").select("id, title, price, prices, sale_price, sale_prices, sale_start_at, sale_end_at, scheduled_price, scheduled_prices, scheduled_price_at, product_type, payment_provider, freemius_product_id, freemius_plan_id").in("id", f), p.length ? a.from("product_variants").select("id, product_id, price, prices, sale_price, sale_prices, sale_start_at, sale_end_at, scheduled_price, scheduled_prices, scheduled_price_at").in("id", p) : Promise.resolve({
+	let [{ data: m, error: h }, g] = await Promise.all([a.from("products").select("id, title, price, prices, sale_price, sale_prices, sale_start_at, sale_end_at, scheduled_price, scheduled_prices, scheduled_price_at, product_type, payment_provider, freemius_product_id, freemius_plan_id").in("id", u), d.length ? a.from("product_variants").select("id, product_id, price, prices, sale_price, sale_prices, sale_start_at, sale_end_at, scheduled_price, scheduled_prices, scheduled_price_at").in("id", d) : Promise.resolve({
 		data: [],
 		error: null
 	})]);
 	if (h) throw Error(h.message);
 	if (g.error) throw Error(g.error.message);
 	let _ = m || [], v = g.data || [], y = new Map(_.map((e) => [e.id, e])), b = new Map(v.map((e) => [e.id, e])), x = [];
-	for (let e of s) {
+	for (let e of o) {
 		let t = y.get(e.product_id);
 		if (!t) continue;
-		let a = u(t.payment_provider) ?? (t.product_type === "digital" ? "freemius" : "stripe"), s = e.variant_id ? b.get(e.variant_id) : null, d = s && s.product_id === t.id ? s : t, f = i({
-			prices: n(d.prices),
-			salePrices: r(d.sale_prices),
-			fallbackPrice: d.price,
-			fallbackSalePrice: d.sale_price,
-			saleStartAt: d.sale_start_at,
-			saleEndAt: d.sale_end_at,
-			scheduledPrice: d.scheduled_price,
-			scheduledPrices: n(d.scheduled_prices),
-			scheduledPriceAt: d.scheduled_price_at,
+		let a = f(t.payment_provider) ?? (t.product_type === "digital" ? "freemius" : "stripe"), o = e.variant_id ? b.get(e.variant_id) : null, u = o && o.product_id === t.id ? o : t, d = i({
+			prices: n(u.prices),
+			salePrices: r(u.sale_prices),
+			fallbackPrice: u.price,
+			fallbackSalePrice: u.sale_price,
+			saleStartAt: u.sale_start_at,
+			saleEndAt: u.sale_end_at,
+			scheduledPrice: u.scheduled_price,
+			scheduledPrices: n(u.scheduled_prices),
+			scheduledPriceAt: u.scheduled_price_at,
 			currencyCode: l.code,
-			currencies: c
-		}), p = a === "freemius" ? 1 : Math.max(1, Number(e.quantity) || 1), m = Math.max(0, f.sale_price ?? f.price);
+			currencies: s
+		}), p = a === "freemius" ? 1 : Math.max(1, Number(e.quantity) || 1), m = Math.max(0, d.sale_price ?? d.price);
 		x.push({
-			key: o(e),
+			key: c(e),
 			product_id: t.id,
-			variant_id: s?.id ?? null,
+			variant_id: o?.id ?? null,
 			title: t.title,
 			quantity: p,
 			provider: a,
@@ -63,16 +64,16 @@ async function f(t) {
 	}
 	return {
 		lines: x,
-		currencies: c,
+		currencies: s,
 		selectedCurrency: l
 	};
 }
-async function p(e, t) {
+async function h(e, t) {
 	let { data: n, error: r } = await e.from("coupon_products").select("product_id").eq("coupon_id", t);
 	if (r) throw Error(r.message);
 	return new Set((n || []).map((e) => e.product_id));
 }
-function m(e, t) {
+function g(e, t) {
 	let n = e.reduce((e, t) => e + t.subtotal, 0), r = Math.min(t, n);
 	if (n <= 0 || r <= 0) return /* @__PURE__ */ new Map();
 	let i = /* @__PURE__ */ new Map(), a = 0;
@@ -81,59 +82,70 @@ function m(e, t) {
 		a += s, i.set(t.key, s);
 	}), i;
 }
-async function h(e) {
-	let t = s(e.code);
-	if (!t) return {
-		success: !1,
-		error: "Enter a coupon code.",
-		errorKey: "ecommerce.coupon_code_required"
-	};
-	if (!e.items.length) return {
-		success: !1,
-		error: "Add an item to your cart before applying a coupon.",
-		errorKey: "ecommerce.coupon_cart_empty"
-	};
-	let { data: n, error: r } = await e.client.from("coupons").select("id, code, name, provider_scope, discount_type, discount_amount, is_active, starts_at, ends_at, redemption_limit, redemptions_count").ilike("code", t).maybeSingle();
-	if (r) throw Error(r.message);
-	if (!n) return {
-		success: !1,
+var _ = {
+	not_found: {
 		error: "Coupon code not found.",
 		errorKey: "ecommerce.coupon_not_found"
-	};
-	let i = n, o = /* @__PURE__ */ new Date(), u = c(i.starts_at), d = c(i.ends_at);
-	if (!i.is_active) return {
-		success: !1,
+	},
+	inactive: {
 		error: "This coupon is not active.",
 		errorKey: "ecommerce.coupon_inactive"
-	};
-	if (u && u > o) return {
-		success: !1,
+	},
+	not_started: {
 		error: "This coupon is not active yet.",
 		errorKey: "ecommerce.coupon_not_started"
-	};
-	if (d && d <= o) return {
-		success: !1,
+	},
+	expired: {
 		error: "This coupon has expired.",
 		errorKey: "ecommerce.coupon_expired"
-	};
-	if (i.redemption_limit !== null && (i.redemptions_count ?? 0) >= i.redemption_limit) return {
-		success: !1,
+	},
+	limit_reached: {
 		error: "This coupon has reached its redemption limit.",
 		errorKey: "ecommerce.coupon_limit_reached"
+	},
+	not_applicable: {
+		error: "This coupon does not apply to the items in your cart.",
+		errorKey: "ecommerce.coupon_not_applicable"
+	}
+};
+function v(e, t) {
+	return {
+		success: !1,
+		...t ? _[e] : {
+			error: o,
+			errorKey: a
+		}
 	};
-	let [{ lines: h }, g] = await Promise.all([f({
+}
+async function y(e) {
+	let t = l(e.code), n = e.detailedErrors === !0;
+	if (!t) return {
+		success: !1,
+		error: "Enter a coupon code.",
+		errorKey: "ecommerce.coupon_code_required"
+	};
+	if (!e.items.length) return {
+		success: !1,
+		error: "Add an item to your cart before applying a coupon.",
+		errorKey: "ecommerce.coupon_cart_empty"
+	};
+	let { data: r, error: i } = await e.client.from("coupons").select("id, code, name, provider_scope, discount_type, discount_amount, is_active, starts_at, ends_at, redemption_limit, redemptions_count").ilike("code", t).maybeSingle();
+	if (i) throw Error(i.message);
+	if (!r) return v("not_found", n);
+	let a = r, o = /* @__PURE__ */ new Date(), c = u(a.starts_at), f = u(a.ends_at);
+	if (!a.is_active) return v("inactive", n);
+	if (c && c > o) return v("not_started", n);
+	if (f && f <= o) return v("expired", n);
+	if (a.redemption_limit !== null && (a.redemptions_count ?? 0) >= a.redemption_limit) return v("limit_reached", n);
+	let [{ lines: p }, _] = await Promise.all([m({
 		client: e.client,
 		items: e.items,
 		currencyCode: e.currencyCode
-	}), p(e.client, i.id)]), _ = g.size > 0, v = h.filter((e) => e.subtotal > 0 && l(i.provider_scope, e.provider) && (!_ || g.has(e.product_id)));
-	if (v.length === 0) return {
-		success: !1,
-		error: "This coupon does not apply to the items in your cart.",
-		errorKey: "ecommerce.coupon_not_applicable"
-	};
-	let y = i.discount_type === "fixed" ? m(v, i.discount_amount) : null, b = a(), x = v.map((e) => {
-		let t = i.discount_type === "percent" ? Math.min(e.subtotal, Math.round(e.subtotal * i.discount_amount / 100)) : y?.get(e.key) ?? 0;
-		return b[e.provider] += t, {
+	}), h(e.client, a.id)]), y = _.size > 0, b = p.filter((e) => e.subtotal > 0 && d(a.provider_scope, e.provider) && (!y || _.has(e.product_id)));
+	if (b.length === 0) return v("not_applicable", n);
+	let x = a.discount_type === "fixed" ? g(b, a.discount_amount) : null, S = s(), C = b.map((e) => {
+		let t = a.discount_type === "percent" ? Math.min(e.subtotal, Math.round(e.subtotal * a.discount_amount / 100)) : x?.get(e.key) ?? 0;
+		return S[e.provider] += t, {
 			key: e.key,
 			product_id: e.product_id,
 			variant_id: e.variant_id,
@@ -147,26 +159,40 @@ async function h(e) {
 	return {
 		success: !0,
 		quote: {
-			couponId: i.id,
-			code: i.code,
-			name: i.name,
-			discountType: i.discount_type,
-			discountAmount: i.discount_amount,
-			providerScope: i.provider_scope,
-			eligibleSubtotal: v.reduce((e, t) => e + t.subtotal, 0),
-			discountTotal: b.stripe + b.freemius,
-			providerDiscounts: b,
-			lineDiscounts: x
+			couponId: a.id,
+			code: a.code,
+			name: a.name,
+			discountType: a.discount_type,
+			discountAmount: a.discount_amount,
+			providerScope: a.provider_scope,
+			eligibleSubtotal: b.reduce((e, t) => e + t.subtotal, 0),
+			discountTotal: S.stripe + S.freemius,
+			providerDiscounts: S,
+			lineDiscounts: C
 		}
 	};
 }
-function g(e) {
+function b(e) {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e?.lineDiscounts ?? []) t.set(n.key, n.discount);
 	return t;
 }
-async function _(e) {
-	let { error: t } = await e.client.from("coupon_redemptions").insert({
+async function x(e) {
+	let t = (e) => ({
+		success: !1,
+		reason: e,
+		error: o,
+		errorKey: a
+	}), { data: n, error: r } = await e.client.from("coupon_redemptions").select("id").eq("order_id", e.orderId).maybeSingle();
+	if (r) return console.error("Failed to look up existing coupon redemption:", r), t("error");
+	if (n) return {
+		success: !0,
+		alreadyRecorded: !0
+	};
+	let { data: i, error: s } = await e.client.rpc("redeem_coupon_atomically", { p_coupon_id: e.quote.couponId });
+	if (s) return console.error("Failed to reserve coupon redemption:", s), t("error");
+	if (i !== !0) return t("limit_reached");
+	let { error: c } = await e.client.from("coupon_redemptions").insert({
 		coupon_id: e.quote.couponId,
 		order_id: e.orderId,
 		coupon_code: e.quote.code,
@@ -176,15 +202,49 @@ async function _(e) {
 		customer_email: e.customerEmail || null,
 		metadata: e.metadata || {}
 	});
-	if (t) {
-		console.error("Failed to record coupon redemption:", t);
-		return;
+	return c && console.error("Failed to record coupon redemption:", c), {
+		success: !0,
+		alreadyRecorded: !1
+	};
+}
+var S = 30, C = 12 / 60, w = 5e3, T = "unknown";
+function E(e) {
+	let t = e?.capacity ?? S, n = e?.refillPerSecond ?? C, r = e?.maxBuckets ?? w, i = t / n * 1e3, a = /* @__PURE__ */ new Map();
+	function o(e) {
+		for (let [t, n] of a) e - n.updatedAt >= i && a.delete(t);
+		for (let e of a.keys()) {
+			if (a.size < r) break;
+			a.delete(e);
+		}
 	}
-	let { data: n } = await e.client.from("coupons").select("redemptions_count").eq("id", e.quote.couponId).single();
-	await e.client.from("coupons").update({
-		redemptions_count: (n?.redemptions_count ?? 0) + 1,
-		updated_at: (/* @__PURE__ */ new Date()).toISOString()
-	}).eq("id", e.quote.couponId);
+	return {
+		consume(e, i = Date.now()) {
+			let s = a.get(e);
+			if (!s) a.size >= r && o(i), s = {
+				tokens: t,
+				updatedAt: i
+			}, a.set(e, s);
+			else {
+				let e = Math.max(0, i - s.updatedAt) / 1e3;
+				s.tokens = Math.min(t, s.tokens + e * n), s.updatedAt = i;
+			}
+			return s.tokens < 1 ? !1 : (--s.tokens, !0);
+		},
+		get size() {
+			return a.size;
+		}
+	};
+}
+var D = E();
+function O(e, t) {
+	return D.consume(e, t);
+}
+function k(e) {
+	let [t] = (e ?? "").split(",");
+	return (t?.trim() ?? "") || null;
+}
+function A(e) {
+	return k(e.get("x-vercel-forwarded-for")) ?? k(e.get("x-real-ip")) ?? k(e.get("x-forwarded-for")) ?? "unknown";
 }
 //#endregion
-export { h as getCouponQuote, g as getQuoteLineDiscountMap, _ as recordCouponRedemption };
+export { T as COUPON_VALIDATION_UNKNOWN_CLIENT_KEY, O as consumeCouponValidationToken, E as createCouponValidationThrottle, y as getCouponQuote, b as getQuoteLineDiscountMap, x as recordCouponRedemption, A as resolveCouponValidationThrottleKey };

package/lib/coupons.cjs

@@ -1 +1 @@
-function e(e){return(e||``).trim().replace(/\s+/g,``).toUpperCase()}function t(e){return`${e.product_id}:${e.variant_id||`base`}`}function n(){return{stripe:0,freemius:0}}exports.emptyProviderDiscounts=n,exports.getCartLineCouponKey=t,exports.normalizeCouponCode=e;
+var e=`ecommerce.coupon_invalid`,t=`This coupon code is invalid or can't be applied to your cart.`,n=`ecommerce.coupon_validation_failed`,r=`Too many coupon attempts. Wait a moment and try again.`;function i(e){return(e||``).trim().replace(/\s+/g,``).toUpperCase()}function a(e){return`${e.product_id}:${e.variant_id||`base`}`}function o(){return{stripe:0,freemius:0}}exports.COUPON_INVALID_ERROR_KEY=e,exports.COUPON_INVALID_ERROR_MESSAGE=t,exports.COUPON_THROTTLED_ERROR_KEY=n,exports.COUPON_THROTTLED_ERROR_MESSAGE=r,exports.emptyProviderDiscounts=o,exports.getCartLineCouponKey=a,exports.normalizeCouponCode=i;

package/lib/coupons.d.ts

@@ -36,6 +36,19 @@ export type CouponQuoteResult = {
     error: string;
     errorKey?: string;
 };
+/**
+ * The one message a shopper sees for every coupon the store will not honour: unknown code,
+ * inactive, not started, expired, exhausted, or not matching the cart. One key for all of them
+ * so the public validation action cannot be used to confirm which codes exist.
+ *
+ * Seed EN + FR for this key in a forward migration (`02015` is the model); until then the
+ * client falls back to the English `error` text.
+ */
+export declare const COUPON_INVALID_ERROR_KEY = "ecommerce.coupon_invalid";
+export declare const COUPON_INVALID_ERROR_MESSAGE = "This coupon code is invalid or can't be applied to your cart.";
+/** Returned by the public validation action once a client has used up its attempts. */
+export declare const COUPON_THROTTLED_ERROR_KEY = "ecommerce.coupon_validation_failed";
+export declare const COUPON_THROTTLED_ERROR_MESSAGE = "Too many coupon attempts. Wait a moment and try again.";
 export declare function normalizeCouponCode(code?: string | null): string;
 export declare function getCartLineCouponKey(item: Pick<CartItem, 'product_id' | 'variant_id'>): string;
 export declare function emptyProviderDiscounts(): Record<EcommercePaymentProvider, number>;

package/lib/coupons.es.js

@@ -1,15 +1,16 @@
 //#region src/lib/coupons.ts
-function e(e) {
+var e = "ecommerce.coupon_invalid", t = "This coupon code is invalid or can't be applied to your cart.", n = "ecommerce.coupon_validation_failed", r = "Too many coupon attempts. Wait a moment and try again.";
+function i(e) {
 	return (e || "").trim().replace(/\s+/g, "").toUpperCase();
 }
-function t(e) {
+function a(e) {
 	return `${e.product_id}:${e.variant_id || "base"}`;
 }
-function n() {
+function o() {
 	return {
 		stripe: 0,
 		freemius: 0
 	};
 }
 //#endregion
-export { n as emptyProviderDiscounts, t as getCartLineCouponKey, e as normalizeCouponCode };
+export { e as COUPON_INVALID_ERROR_KEY, t as COUPON_INVALID_ERROR_MESSAGE, n as COUPON_THROTTLED_ERROR_KEY, r as COUPON_THROTTLED_ERROR_MESSAGE, o as emptyProviderDiscounts, a as getCartLineCouponKey, i as normalizeCouponCode };

package/lib/invoice-server.cjs

@@ -7,7 +7,7 @@ const e=require("./customer.cjs"),t=require("./invoice.cjs"),n=require("./order-
           width,
           height
         )
-      `;async function l(e){let{data:t}=await e.from(`site_settings`).select(`value`).eq(`key`,s).maybeSingle(),n=t?.value,r=typeof n==`string`&&n.length>0?n:null;if(r){let{data:t}=await e.from(`logos`).select(c).eq(`id`,r).maybeSingle();if(t)return t}let{data:i}=await e.from(`logos`).select(c).order(`created_at`,{ascending:!1}).limit(1).maybeSingle();return i??null}async function u(e){let n=a(e),[r,i]=await Promise.all([n.from(`site_settings`).select(`value`).eq(`key`,t.INVOICE_SETTINGS_KEY).maybeSingle(),l(n)]);return{settings:t.normalizeInvoiceSettings(r.data?.value??t.DEFAULT_INVOICE_SETTINGS),logo:o(i)}}async function d(e){let{data:t,error:n}=await a(e.client).rpc(`assign_order_invoice_metadata`,{p_order_id:e.orderId,p_paid_at:e.paidAt??null}).single();if(n)throw Error(n.message);return{invoiceNumber:t?.invoice_number??null,paidAt:t?.paid_at??null}}async function f(t,r){let i=a(r),{data:o,error:s}=await i.from(`orders`).select(`
+      `;async function l(e){let{data:t}=await e.from(`site_settings`).select(`value`).eq(`key`,s).maybeSingle(),n=t?.value,r=typeof n==`string`&&n.length>0?n:null;if(r){let{data:t}=await e.from(`logos`).select(c).eq(`id`,r).maybeSingle();if(t)return t}let{data:i}=await e.from(`logos`).select(c).order(`created_at`,{ascending:!1}).limit(1).maybeSingle();return i??null}async function u(e){let n=a(e),[r,i]=await Promise.all([n.from(`site_settings`).select(`value`).eq(`key`,t.INVOICE_SETTINGS_KEY).maybeSingle(),l(n)]);return{settings:t.normalizeInvoiceSettings(r.data?.value??t.DEFAULT_INVOICE_SETTINGS),logo:o(i)}}async function d(e){let{data:t,error:n}=await a(e.client).rpc(`assign_order_invoice_metadata`,{p_order_id:e.orderId,p_paid_at:e.paidAt??null}).single();if(n)throw Error(n.message);return{invoiceNumber:t?.invoice_number??null,paidAt:t?.paid_at??null}}async function f(t,i){let{data:o,error:s}=await a(i).from(`orders`).select(`
       id,
       invoice_number,
       paid_at,
@@ -30,4 +30,4 @@ const e=require("./customer.cjs"),t=require("./invoice.cjs"),n=require("./order-
         quantity,
         price_at_purchase
       )
-    `).eq(`id`,t).single();if(s||!o)throw Error(s?.message||`Order not found`);let c=(o.order_items||[]).map(e=>e.product_id).filter(Boolean),l=(o.order_items||[]).map(e=>e.variant_id).filter(Boolean),[u,d]=await Promise.all([c.length?i.from(`products`).select(`id, title, sku`).in(`id`,c):Promise.resolve({data:[],error:null}),l.length?i.from(`product_variants`).select(`id, sku`).in(`id`,l):Promise.resolve({data:[],error:null})]),f=new Map((u.data||[]).map(e=>[e.id,e])),p=new Map((d.data||[]).map(e=>[e.id,e])),m=(o.order_items||[]).map(e=>{let t=e.product_id?f.get(e.product_id):null,n=e.variant_id?p.get(e.variant_id):null,r=t?.title||`Product`,i=n?.sku?`SKU: ${n.sku}`:t?.sku?`SKU: ${t.sku}`:null;return{id:e.id,product_id:e.product_id??null,variant_id:e.variant_id??null,title:r,description:i,quantity:e.quantity,unit_amount:e.price_at_purchase,total_amount:e.price_at_purchase*e.quantity,sku:n?.sku??t?.sku??null}});return{id:o.id,invoice_number:o.invoice_number??null,paid_at:o.paid_at??null,created_at:o.created_at??null,currency:o.currency||`usd`,status:o.status,provider:o.provider??null,subtotal:typeof o.subtotal==`number`?o.subtotal:m.reduce((e,t)=>e+t.total_amount,0),shipping_total:typeof o.shipping_total==`number`?o.shipping_total:0,discount_total:typeof o.discount_total==`number`?o.discount_total:0,coupon_code:o.coupon_code??null,tax_total:typeof o.tax_total==`number`?o.tax_total:0,total:o.total,customer_details:e.normalizeOrderCustomerDetails(o.customer_details??{}),tax_details:n.normalizeOrderTaxDetails(o.tax_details),items:m}}async function p(e,t){let n=a(t),[r,i]=await Promise.all([f(e,n),u(n)]);return{order:r,settings:i.settings,logo:i.logo}}exports.assignInvoiceMetadata=d,exports.getInvoiceBrandingData=u,exports.getInvoiceOrder=f,exports.getInvoicePresentationData=p;
+    `).eq(`id`,t).single();if(s||!o)throw Error(s?.message||`Order not found`);let c=(o.order_items||[]).map(e=>e.product_id).filter(Boolean),l=(o.order_items||[]).map(e=>e.variant_id).filter(Boolean),u=(0,r.getServiceRoleSupabaseClient)(),[d,f]=await Promise.all([c.length?u.from(`products`).select(`id, title, sku`).in(`id`,c):Promise.resolve({data:[],error:null}),l.length?u.from(`product_variants`).select(`id, sku`).in(`id`,l):Promise.resolve({data:[],error:null})]),p=new Map((d.data||[]).map(e=>[e.id,e])),m=new Map((f.data||[]).map(e=>[e.id,e])),h=(o.order_items||[]).map(e=>{let t=e.product_id?p.get(e.product_id):null,n=e.variant_id?m.get(e.variant_id):null,r=t?.title||`Product`,i=n?.sku?`SKU: ${n.sku}`:t?.sku?`SKU: ${t.sku}`:null;return{id:e.id,product_id:e.product_id??null,variant_id:e.variant_id??null,title:r,description:i,quantity:e.quantity,unit_amount:e.price_at_purchase,total_amount:e.price_at_purchase*e.quantity,sku:n?.sku??t?.sku??null}});return{id:o.id,invoice_number:o.invoice_number??null,paid_at:o.paid_at??null,created_at:o.created_at??null,currency:o.currency||`usd`,status:o.status,provider:o.provider??null,subtotal:typeof o.subtotal==`number`?o.subtotal:h.reduce((e,t)=>e+t.total_amount,0),shipping_total:typeof o.shipping_total==`number`?o.shipping_total:0,discount_total:typeof o.discount_total==`number`?o.discount_total:0,coupon_code:o.coupon_code??null,tax_total:typeof o.tax_total==`number`?o.tax_total:0,total:o.total,customer_details:e.normalizeOrderCustomerDetails(o.customer_details??{}),tax_details:n.normalizeOrderTaxDetails(o.tax_details),items:h}}async function p(e,t){let n=a(t),[r,i]=await Promise.all([f(e,n),u(n)]);return{order:r,settings:i.settings,logo:i.logo}}exports.assignInvoiceMetadata=d,exports.getInvoiceBrandingData=u,exports.getInvoiceOrder=f,exports.getInvoicePresentationData=p;

package/lib/invoice-server.es.js

@@ -49,16 +49,16 @@ async function p(e) {
 	};
 }
 async function m(t, n) {
-	let r = s(n), { data: a, error: o } = await r.from("orders").select("\n      id,\n      invoice_number,\n      paid_at,\n      created_at,\n      currency,\n      status,\n      provider,\n      subtotal,\n      shipping_total,\n      discount_total,\n      coupon_code,\n      tax_total,\n      total,\n      customer_details,\n      tax_details,\n      order_items (\n        id,\n        product_id,\n        variant_id,\n        quantity,\n        price_at_purchase\n      )\n    ").eq("id", t).single();
-	if (o || !a) throw Error(o?.message || "Order not found");
-	let c = (a.order_items || []).map((e) => e.product_id).filter(Boolean), l = (a.order_items || []).map((e) => e.variant_id).filter(Boolean), [u, d] = await Promise.all([c.length ? r.from("products").select("id, title, sku").in("id", c) : Promise.resolve({
+	let { data: r, error: o } = await s(n).from("orders").select("\n      id,\n      invoice_number,\n      paid_at,\n      created_at,\n      currency,\n      status,\n      provider,\n      subtotal,\n      shipping_total,\n      discount_total,\n      coupon_code,\n      tax_total,\n      total,\n      customer_details,\n      tax_details,\n      order_items (\n        id,\n        product_id,\n        variant_id,\n        quantity,\n        price_at_purchase\n      )\n    ").eq("id", t).single();
+	if (o || !r) throw Error(o?.message || "Order not found");
+	let c = (r.order_items || []).map((e) => e.product_id).filter(Boolean), l = (r.order_items || []).map((e) => e.variant_id).filter(Boolean), u = a(), [d, f] = await Promise.all([c.length ? u.from("products").select("id, title, sku").in("id", c) : Promise.resolve({
 		data: [],
 		error: null
-	}), l.length ? r.from("product_variants").select("id, sku").in("id", l) : Promise.resolve({
+	}), l.length ? u.from("product_variants").select("id, sku").in("id", l) : Promise.resolve({
 		data: [],
 		error: null
-	})]), f = new Map((u.data || []).map((e) => [e.id, e])), p = new Map((d.data || []).map((e) => [e.id, e])), m = (a.order_items || []).map((e) => {
-		let t = e.product_id ? f.get(e.product_id) : null, n = e.variant_id ? p.get(e.variant_id) : null, r = t?.title || "Product", i = n?.sku ? `SKU: ${n.sku}` : t?.sku ? `SKU: ${t.sku}` : null;
+	})]), p = new Map((d.data || []).map((e) => [e.id, e])), m = new Map((f.data || []).map((e) => [e.id, e])), h = (r.order_items || []).map((e) => {
+		let t = e.product_id ? p.get(e.product_id) : null, n = e.variant_id ? m.get(e.variant_id) : null, r = t?.title || "Product", i = n?.sku ? `SKU: ${n.sku}` : t?.sku ? `SKU: ${t.sku}` : null;
 		return {
 			id: e.id,
 			product_id: e.product_id ?? null,
@@ -72,22 +72,22 @@ async function m(t, n) {
 		};
 	});
 	return {
-		id: a.id,
-		invoice_number: a.invoice_number ?? null,
-		paid_at: a.paid_at ?? null,
-		created_at: a.created_at ?? null,
-		currency: a.currency || "usd",
-		status: a.status,
-		provider: a.provider ?? null,
-		subtotal: typeof a.subtotal == "number" ? a.subtotal : m.reduce((e, t) => e + t.total_amount, 0),
-		shipping_total: typeof a.shipping_total == "number" ? a.shipping_total : 0,
-		discount_total: typeof a.discount_total == "number" ? a.discount_total : 0,
-		coupon_code: a.coupon_code ?? null,
-		tax_total: typeof a.tax_total == "number" ? a.tax_total : 0,
-		total: a.total,
-		customer_details: e(a.customer_details ?? {}),
-		tax_details: i(a.tax_details),
-		items: m
+		id: r.id,
+		invoice_number: r.invoice_number ?? null,
+		paid_at: r.paid_at ?? null,
+		created_at: r.created_at ?? null,
+		currency: r.currency || "usd",
+		status: r.status,
+		provider: r.provider ?? null,
+		subtotal: typeof r.subtotal == "number" ? r.subtotal : h.reduce((e, t) => e + t.total_amount, 0),
+		shipping_total: typeof r.shipping_total == "number" ? r.shipping_total : 0,
+		discount_total: typeof r.discount_total == "number" ? r.discount_total : 0,
+		coupon_code: r.coupon_code ?? null,
+		tax_total: typeof r.tax_total == "number" ? r.tax_total : 0,
+		total: r.total,
+		customer_details: e(r.customer_details ?? {}),
+		tax_details: i(r.tax_details),
+		items: h
 	};
 }
 async function h(e, t) {

package/lib/order-access-token.cjs

@@ -0,0 +1 @@
+const e=require("../_virtual/_rolldown/runtime.cjs");require("server-only");let t=require("node:crypto");t=e.__toESM(t,1);function n(){let e=process.env.SUPABASE_SERVICE_ROLE_KEY||process.env.SUPABASE_SECRET_KEY||process.env.NB_2FA_SECRET;if(!e)throw Error(`Missing SUPABASE_SERVICE_ROLE_KEY / SUPABASE_SECRET_KEY for order access tokens.`);return e}function r(e){return t.default.createHmac(`sha256`,n()).update(`order:${e}`).digest(`base64url`)}function i(e,n){if(!n||typeof n!=`string`)return!1;let i=r(e),a=Buffer.from(i),o=Buffer.from(n);return a.length===o.length&&t.default.timingSafeEqual(a,o)}exports.mintOrderAccessToken=r,exports.verifyOrderAccessToken=i;

package/lib/order-access-token.d.ts

@@ -0,0 +1,2 @@
+export declare function mintOrderAccessToken(orderId: string): string;
+export declare function verifyOrderAccessToken(orderId: string, token: string | null | undefined): boolean;

package/lib/order-access-token.es.js

@@ -0,0 +1,18 @@
+import "server-only";
+import e from "node:crypto";
+//#region src/lib/order-access-token.ts
+function t() {
+	let e = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_SECRET_KEY || process.env.NB_2FA_SECRET;
+	if (!e) throw Error("Missing SUPABASE_SERVICE_ROLE_KEY / SUPABASE_SECRET_KEY for order access tokens.");
+	return e;
+}
+function n(n) {
+	return e.createHmac("sha256", t()).update(`order:${n}`).digest("base64url");
+}
+function r(t, r) {
+	if (!r || typeof r != "string") return !1;
+	let i = n(t), a = Buffer.from(i), o = Buffer.from(r);
+	return a.length === o.length && e.timingSafeEqual(a, o);
+}
+//#endregion
+export { n as mintOrderAccessToken, r as verifyOrderAccessToken };

package/lib/pages/cms/orders/actions.cjs

@@ -1,7 +1,7 @@
-"use server";let e=require("@nextblock-cms/db/server");var t=20;async function n(n=1,r,i){let a=await(0,e.createClient)(),o=(n-1)*t,s=o+t-1,c=a.from(`orders`).select(`
+"use server";const e=require("../../../server-actions/require-ecom-role.cjs");let t=require("@nextblock-cms/db/server");var n=20,r=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function i(e){let t=typeof e==`string`?e.trim():``;return!t||!r.test(t)?null:t.toLowerCase()}async function a(){return await e.getEcomActorRole()===`ADMIN`?(0,t.getServiceRoleSupabaseClient)():null}async function o(e=1,t,r){let o=i(r);if(r&&!o)return{data:[],total:0,totalPages:0};let s=await a();if(!s)return{data:[],total:0,totalPages:0};let c=((Number.isInteger(e)&&e>0?e:1)-1)*n,l=c+n-1,u=s.from(`orders`).select(`
       *,
       order_items (*)
-    `,{count:`exact`}).order(`created_at`,{ascending:!1}).range(o,s);r&&r!==`all`&&(c=c.eq(`status`,r)),i&&(c=c.or(`id.eq.${i},user_id.eq.${i}`));let{data:l,error:u,count:d}=await c;if(u)throw console.error(`Error fetching orders:`,u),Error(`Failed to fetch orders`);let f=l||[],p=Array.from(new Set(f.map(e=>e.user_id).filter(Boolean))),m=new Map;if(p.length>0){let{data:e,error:t}=await a.from(`profiles`).select(`*`).in(`id`,p);!t&&e&&e.forEach(e=>m.set(e.id,e))}return{data:f.map(e=>({...e,customer:e.user_id?m.get(e.user_id):null})),total:d||0,totalPages:d?Math.ceil(d/t):0}}async function r(t){let n=await(0,e.createClient)(),{data:r,error:i}=await n.from(`orders`).select(`
+    `,{count:`exact`}).order(`created_at`,{ascending:!1}).range(c,l);t&&t!==`all`&&(u=u.eq(`status`,t)),o&&(u=u.or(`id.eq.${o},user_id.eq.${o}`));let{data:d,error:f,count:p}=await u;if(f)throw console.error(`Error fetching orders:`,f),Error(`Failed to fetch orders`);let m=d||[],h=Array.from(new Set(m.map(e=>e.user_id).filter(Boolean))),g=new Map;if(h.length>0){let{data:e,error:t}=await s.from(`profiles`).select(`*`).in(`id`,h);!t&&e&&e.forEach(e=>g.set(e.id,e))}return{data:m.map(e=>({...e,customer:e.user_id?g.get(e.user_id):null})),total:p||0,totalPages:p?Math.ceil(p/n):0}}async function s(e){let t=await a();if(!t)return null;let{data:n,error:r}=await t.from(`orders`).select(`
       *,
       order_items (*)
-    `).eq(`id`,t).single();if(i||!r)return console.error(`Error fetching order ${t}:`,i),null;let a=r,o=null;if(a.user_id){let{data:e}=await n.from(`profiles`).select(`*`).eq(`id`,a.user_id).single();o=e}let s=a.order_items.map(e=>e.product_id).filter(Boolean),c=new Map;if(s.length>0){let{data:e}=await n.from(`products`).select(`id, title, slug, product_media(media(file_path))`).in(`id`,s);e&&e.forEach(e=>{let t=null;e.product_media&&e.product_media.length>0&&e.product_media[0].media&&(t=e.product_media[0].media.file_path),c.set(e.id,{title:e.title,slug:e.slug,image_url:t})})}let l=a.order_items.map(e=>({...e,product:e.product_id?c.get(e.product_id):null}));return{...a,order_items:l,customer:o}}exports.getOrderDetails=r,exports.getOrders=n;
+    `).eq(`id`,e).single();if(r||!n)return console.error(`Error fetching order ${e}:`,r),null;let i=n,o=null;if(i.user_id){let{data:e}=await t.from(`profiles`).select(`*`).eq(`id`,i.user_id).single();o=e}let s=i.order_items.map(e=>e.product_id).filter(Boolean),c=new Map;if(s.length>0){let{data:e}=await t.from(`products`).select(`id, title, slug, product_media(media(file_path))`).in(`id`,s);e&&e.forEach(e=>{let t=null;e.product_media&&e.product_media.length>0&&e.product_media[0].media&&(t=e.product_media[0].media.file_path),c.set(e.id,{title:e.title,slug:e.slug,image_url:t})})}let l=i.order_items.map(e=>({...e,product:e.product_id?c.get(e.product_id):null}));return{...i,order_items:l,customer:o}}exports.getOrderDetails=s,exports.getOrders=o;

package/lib/pages/cms/orders/actions.es.js

@@ -1,37 +1,59 @@
 "use server";
-import { createClient as e } from "@nextblock-cms/db/server";
+import { getEcomActorRole as e } from "../../../server-actions/require-ecom-role.es.js";
+import { getServiceRoleSupabaseClient as t } from "@nextblock-cms/db/server";
 //#region src/lib/pages/cms/orders/actions.ts
-var t = 20;
-async function n(n = 1, r, i) {
-	let a = await e(), o = (n - 1) * t, s = o + t - 1, c = a.from("orders").select("\n      *,\n      order_items (*)\n    ", { count: "exact" }).order("created_at", { ascending: !1 }).range(o, s);
-	r && r !== "all" && (c = c.eq("status", r)), i && (c = c.or(`id.eq.${i},user_id.eq.${i}`));
-	let { data: l, error: u, count: d } = await c;
-	if (u) throw console.error("Error fetching orders:", u), Error("Failed to fetch orders");
-	let f = l || [], p = Array.from(new Set(f.map((e) => e.user_id).filter(Boolean))), m = /* @__PURE__ */ new Map();
-	if (p.length > 0) {
-		let { data: e, error: t } = await a.from("profiles").select("*").in("id", p);
-		!t && e && e.forEach((e) => m.set(e.id, e));
+var n = 20, r = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function i(e) {
+	let t = typeof e == "string" ? e.trim() : "";
+	return !t || !r.test(t) ? null : t.toLowerCase();
+}
+async function a() {
+	return await e() === "ADMIN" ? t() : null;
+}
+async function o(e = 1, t, r) {
+	let o = i(r);
+	if (r && !o) return {
+		data: [],
+		total: 0,
+		totalPages: 0
+	};
+	let s = await a();
+	if (!s) return {
+		data: [],
+		total: 0,
+		totalPages: 0
+	};
+	let c = ((Number.isInteger(e) && e > 0 ? e : 1) - 1) * n, l = c + n - 1, u = s.from("orders").select("\n      *,\n      order_items (*)\n    ", { count: "exact" }).order("created_at", { ascending: !1 }).range(c, l);
+	t && t !== "all" && (u = u.eq("status", t)), o && (u = u.or(`id.eq.${o},user_id.eq.${o}`));
+	let { data: d, error: f, count: p } = await u;
+	if (f) throw console.error("Error fetching orders:", f), Error("Failed to fetch orders");
+	let m = d || [], h = Array.from(new Set(m.map((e) => e.user_id).filter(Boolean))), g = /* @__PURE__ */ new Map();
+	if (h.length > 0) {
+		let { data: e, error: t } = await s.from("profiles").select("*").in("id", h);
+		!t && e && e.forEach((e) => g.set(e.id, e));
 	}
 	return {
-		data: f.map((e) => ({
+		data: m.map((e) => ({
 			...e,
-			customer: e.user_id ? m.get(e.user_id) : null
+			customer: e.user_id ? g.get(e.user_id) : null
 		})),
-		total: d || 0,
-		totalPages: d ? Math.ceil(d / t) : 0
+		total: p || 0,
+		totalPages: p ? Math.ceil(p / n) : 0
 	};
 }
-async function r(t) {
-	let n = await e(), { data: r, error: i } = await n.from("orders").select("\n      *,\n      order_items (*)\n    ").eq("id", t).single();
-	if (i || !r) return console.error(`Error fetching order ${t}:`, i), null;
-	let a = r, o = null;
-	if (a.user_id) {
-		let { data: e } = await n.from("profiles").select("*").eq("id", a.user_id).single();
+async function s(e) {
+	let t = await a();
+	if (!t) return null;
+	let { data: n, error: r } = await t.from("orders").select("\n      *,\n      order_items (*)\n    ").eq("id", e).single();
+	if (r || !n) return console.error(`Error fetching order ${e}:`, r), null;
+	let i = n, o = null;
+	if (i.user_id) {
+		let { data: e } = await t.from("profiles").select("*").eq("id", i.user_id).single();
 		o = e;
 	}
-	let s = a.order_items.map((e) => e.product_id).filter(Boolean), c = /* @__PURE__ */ new Map();
+	let s = i.order_items.map((e) => e.product_id).filter(Boolean), c = /* @__PURE__ */ new Map();
 	if (s.length > 0) {
-		let { data: e } = await n.from("products").select("id, title, slug, product_media(media(file_path))").in("id", s);
+		let { data: e } = await t.from("products").select("id, title, slug, product_media(media(file_path))").in("id", s);
 		e && e.forEach((e) => {
 			let t = null;
 			e.product_media && e.product_media.length > 0 && e.product_media[0].media && (t = e.product_media[0].media.file_path), c.set(e.id, {
@@ -41,15 +63,15 @@ async function r(t) {
 			});
 		});
 	}
-	let l = a.order_items.map((e) => ({
+	let l = i.order_items.map((e) => ({
 		...e,
 		product: e.product_id ? c.get(e.product_id) : null
 	}));
 	return {
-		...a,
+		...i,
 		order_items: l,
 		customer: o
 	};
 }
 //#endregion
-export { r as getOrderDetails, n as getOrders };
+export { s as getOrderDetails, o as getOrders };

package/lib/pages/cms/orders/export-actions.cjs

@@ -1 +1 @@
-"use server";let e=require("@nextblock-cms/db/server");async function t(t,n){let r=(0,e.createClient)(),i=r.from(`orders`).select(`*, order_items(*)`);if(t&&(i=i.gte(`created_at`,t)),n){let e=new Date(n);e.setHours(23,59,59,999),i=i.lte(`created_at`,e.toISOString())}let{data:a,error:o}=await i.order(`created_at`,{ascending:!0});if(o)throw console.error(`Error fetching report data:`,o),Error(`Failed to fetch report data: ${o.message}`);if(!a||a.length===0)return[];let s=Array.from(new Set(a.map(e=>e.user_id).filter(Boolean))),c=new Map;if(s.length>0){let{data:e}=await r.from(`profiles`).select(`id, full_name, email`).in(`id`,s);e&&e.forEach(e=>c.set(e.id,e))}return a.map(e=>({...e,customer:e.user_id?c.get(e.user_id):null}))}exports.fetchOrderReportData=t;
+"use server";const e=require("../../../server-actions/require-ecom-role.cjs");let t=require("@nextblock-cms/db/server");async function n(n,r){if(await e.getEcomActorRole()!==`ADMIN`)return[];let i=(0,t.getServiceRoleSupabaseClient)(),a=i.from(`orders`).select(`*, order_items(*)`);if(n&&(a=a.gte(`created_at`,n)),r){let e=new Date(r);e.setHours(23,59,59,999),a=a.lte(`created_at`,e.toISOString())}let{data:o,error:s}=await a.order(`created_at`,{ascending:!0});if(s)throw console.error(`Error fetching report data:`,s),Error(`Failed to fetch report data: ${s.message}`);if(!o||o.length===0)return[];let c=Array.from(new Set(o.map(e=>e.user_id).filter(e=>!!e))),l=new Map;if(c.length>0){let{data:e}=await i.from(`profiles`).select(`id, full_name`).in(`id`,c);e&&e.forEach(e=>l.set(e.id,e))}return o.map(e=>({...e,customer:e.user_id?l.get(e.user_id):null}))}exports.fetchOrderReportData=n;