@porulle/core 0.11.0 → 0.13.0

package/src/modules/orders/guest-access.ts

@@ -0,0 +1,55 @@
+import type { GuestOrderAccessStrategy } from "../../config/types.js";
+
+const UNIT_MS: Record<string, number> = {
+  s: 1_000,
+  m: 60_000,
+  h: 3_600_000,
+  d: 86_400_000,
+};
+
+/**
+ * Parses a window like `"7d"`, `"2h"`, `"30m"`, `"45s"`.
+ * Throws at configuration time rather than silently admitting everything —
+ * a typo in a security window must not read as "no limit".
+ */
+export function parseAccessWindow(duration: string): number {
+  const match = /^(\d+)(s|m|h|d)$/.exec(duration.trim());
+  if (!match) {
+    throw new Error(
+      `Invalid guest order access window "${duration}". Use a whole number followed by s, m, h, or d — for example "7d".`,
+    );
+  }
+  return Number(match[1]) * UNIT_MS[match[2]!]!;
+}
+
+/**
+ * Grants a guest bearer credential access to a placed order for a fixed window
+ * after it was placed.
+ *
+ * Anchored on `placedAt`, never on the cart's expiry: a shopper who checks out
+ * on the sixth day of a seven-day cart would otherwise get one day of receipt
+ * access. The two lifetimes are independent by construction.
+ */
+export function windowedGuestOrderAccess(duration: string): GuestOrderAccessStrategy {
+  const windowMs = parseAccessWindow(duration);
+  return {
+    canAccessOrder(order, now) {
+      const placedAt =
+        order.placedAt instanceof Date ? order.placedAt : new Date(order.placedAt);
+      const elapsed = now.getTime() - placedAt.getTime();
+      return Number.isFinite(elapsed) && elapsed <= windowMs;
+    },
+  };
+}
+
+/**
+ * The default window. Seven days matches `config.cart.ttlMinutes` so the
+ * product carries one number rather than two.
+ *
+ * Deliberately not Vendure's two hours: that figure is calibrated for a
+ * guessable order code, and a cart secret is a 122-bit random UUID. Guessing is
+ * not the exposure here — a secret that leaked through a referrer, a shared
+ * link or a log line is, and a bounded window is what expires it.
+ */
+export const defaultGuestOrderAccess: GuestOrderAccessStrategy =
+  windowedGuestOrderAccess("7d");

package/src/modules/orders/module.ts

@@ -52,6 +52,7 @@ export const ordersModule = defineModule<
     return new OrderService({
       repository: new OrdersRepository(deps.db.db as DrizzleDatabase),
       hooks: deps.hooks,
+      config,
       services: deps.services,
       database: deps.db,
       ...(config.orders?.customTransitions

package/src/modules/orders/quote.ts

@@ -101,6 +101,7 @@ export async function computeOrderPricing(
     context: { moduleName: "orders" },
     origin: "rest",
     database: { db: kernel.database.db as PluginDb },
+    commerceConfig: kernel.config,
   });
   if (tx !== undefined) context.tx = tx as typeof context.tx;
 

package/src/modules/orders/repository/index.ts

@@ -166,6 +166,7 @@ export class OrdersRepository {
   async findByIdempotencyKey(
     orgId: string,
     idempotencyKey: string,
+    idempotencyScope: string,
     ctx?: TxContext,
   ): Promise<Order | undefined> {
     const db = this.getDb(ctx);
@@ -175,6 +176,7 @@ export class OrdersRepository {
       .where(
         and(
           eq(orders.organizationId, orgId),
+          eq(orders.idempotencyScope, idempotencyScope),
           eq(orders.idempotencyKey, idempotencyKey),
         ),
       );

package/src/modules/orders/schema.ts

@@ -21,6 +21,8 @@ export const orders = pgTable("orders", {
   // Client-supplied key making order creation safely retryable (offline POS
   // queues, network retries) — replays return the original order.
   idempotencyKey: text("idempotency_key"),
+  // Hash of the authenticated actor or guest credential that owns the key.
+  idempotencyScope: text("idempotency_scope"),
   metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}),
   placedAt: timestamp("placed_at", { withTimezone: true }).defaultNow().notNull(),
   fulfilledAt: timestamp("fulfilled_at", { withTimezone: true }),
@@ -32,9 +34,9 @@ export const orders = pgTable("orders", {
   customerIdIdx: index("idx_orders_customer_id").on(table.customerId),
   placedAtIdx: index("idx_orders_placed_at").on(table.placedAt),
   paymentIntentIdx: index("idx_orders_payment_intent").on(table.paymentIntentId),
-  orgIdempotencyKeyUnique: uniqueIndex("orders_org_idempotency_key_unique")
-    .on(table.organizationId, table.idempotencyKey)
-    .where(sql`idempotency_key IS NOT NULL`),
+  orgIdempotencyKeyUnique: uniqueIndex("orders_org_idempotency_scope_key_unique")
+    .on(table.organizationId, table.idempotencyScope, table.idempotencyKey)
+    .where(sql`idempotency_scope IS NOT NULL AND idempotency_key IS NOT NULL`),
 }));
 
 export const orderLineItems = pgTable("order_line_items", {