@semics-tech/emdash-events-suite 1.0.0-rc.2 → 1.0.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@semics-tech/emdash-events-suite",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.4",
   "type": "module",
   "description": "Links semics Events and E-sign on one EmDash site: one config call and a booking flow with inline waiver signing",
   "license": "MIT",
@@ -22,8 +22,8 @@
     "src/astro"
   ],
   "dependencies": {
-    "@semics-tech/emdash-esign": "1.0.0-rc.2",
-    "@semics-tech/emdash-events": "1.0.0-rc.2"
+    "@semics-tech/emdash-esign": "1.0.0-rc.4",
+    "@semics-tech/emdash-events": "1.0.0-rc.4"
   },
   "peerDependencies": {
     "emdash": ">=1.2.0 <2"

package/src/astro/WaiverPage.astro

@@ -10,7 +10,7 @@ import SigningCeremony from "@semics-tech/emdash-esign/astro/SigningCeremony.ast
 import { ceremonyCsp } from "@semics-tech/emdash-esign/astro/lib/csp";
 import { crossSiteResponse } from "@semics-tech/emdash-events/astro/lib/checkout-form";
 
-import { handleWaiverRequest } from "./lib/flow";
+import { handleWaiverRequest, leavesSite } from "./lib/flow";
 import { WAIVER_MESSAGES, WAIVER_PATH } from "./lib/form";
 import { waiverSlot } from "./lib/slot";
 
@@ -23,7 +23,9 @@ const outcome = await handleWaiverRequest(
 if (outcome.type === "forbidden") return crossSiteResponse();
 const cookies = outcome.type === "redirect" || outcome.type === "render" ? outcome.cookies : [];
 for (const cookie of cookies) Astro.cookies.set(cookie.name, cookie.value, cookie.options);
-if (outcome.type === "redirect") return Astro.redirect(outcome.location, 303);
+if (outcome.type === "redirect" && !leavesSite(outcome.location, Astro.url)) return Astro.redirect(outcome.location, 303);
+// The payment page is another site, which the CSP below stops a post redirecting to (T155): a page goes there instead.
+const payment = outcome.type === "redirect" ? outcome.location : undefined;
 
 Astro.response.headers.set("Referrer-Policy", "no-referrer");
 Astro.response.headers.set("Cache-Control", "private, no-store");
@@ -54,9 +56,16 @@ const signer = render?.view.kind === "ready" ? render.view.session.signer : unde
 		<meta name="viewport" content="width=device-width, initial-scale=1" />
 		<meta name="robots" content="noindex" />
 		<meta name="referrer" content="no-referrer" />
-		<title>Sign the waiver</title>
+		<title>{payment ? "Continue to payment" : "Sign the waiver"}</title>
+		{payment && <meta http-equiv="refresh" content={`0;url=${payment}`} data-testid="waiver-pay-refresh" />}
 	</head>
 	<body>
+		{payment ? (
+			<main class="semics-esign semics-sign" data-testid="waiver-page" data-step="pay">
+				<h1>Continue to payment</h1>
+				<p><a href={payment} data-testid="waiver-pay-link">Go to the payment page</a></p>
+			</main>
+		) : (
 		<main class="semics-esign semics-sign" data-testid="waiver-page" data-step={render ? "sign" : "error"}>
 			<h1>Sign the waiver</h1>
 			{error && <p role="alert" data-testid="waiver-error">{error}</p>}
@@ -89,5 +98,6 @@ const signer = render?.view.kind === "ready" ? render.view.session.signer : unde
 			)}
 			{ref && <p><a href={`/booking?ref=${ref}`}>Back to your booking</a></p>}
 		</main>
+		)}
 	</body>
 </html>

package/src/astro/lib/flow.ts

@@ -100,6 +100,14 @@ export interface BookingAnswer {
 	waiver?: { refs: string[]; voids?: Record<string, string> };
 }
 
+/**
+ * Whether a redirect leaves this site (T155). A form on the signing page cannot be redirected there:
+ * its CSP's `form-action 'self'` also covers where the post redirects, so the browser stops on the page.
+ */
+export function leavesSite(location: string, site: URL): boolean {
+	return new URL(location, site).origin !== site.origin;
+}
+
 /** Booking statuses with nothing left to sign for: the places are gone (T151). */
 const ENDED = ["expired", "cancelled", "declined", "refunded", "refunded_unavailable"];
 
@@ -354,6 +362,26 @@ async function retry(ctx: WaiverRequestContext, ids: SuiteIds): Promise<WaiverOu
 	return proceed(ctx, ids, ref, continued.data.next, [], accessToken);
 }
 
+/**
+ * T153: Pro's intents carry the hold as `signBy`, and a receipt extends the hold. Continue once more so
+ * the seats still to sign get intents with the new hold: e-sign moves each envelope's deadline and rotates
+ * its token. Refused (a lapsed licence, say), the next signer goes on with the token already held, whose
+ * envelope still runs to the hold it was issued for.
+ */
+async function nextSigner(ctx: WaiverRequestContext, ids: SuiteIds, ref: string, after: string[]) {
+	const keep = redirect(`${WAIVER_PATH}?ref=${ref}`, [flowCookie(ctx.url, ref, after)]);
+	const accessToken = ctx.cookie(retryCookieName(ref)) || ctx.cookie(bookingCookieName(ref));
+	if (!accessToken) return keep;
+	const call = { locals: ctx.locals, url: ctx.url, request: ctx.request };
+	const continued = await post<{ next?: { type?: unknown; url?: unknown; intents?: unknown } }>(
+		call,
+		ids.eventsPluginId,
+		"public/checkout/continue",
+		{ bookingRef: ref, accessToken },
+	);
+	return continued.ok ? proceed(ctx, ids, ref, continued.data.next, [], accessToken) : keep;
+}
+
 /** The receipt a finished ceremony hands back (the fragment of `ceremonyRedirect(view)`, §8.2). */
 function receiptOf(view: SignView): string | undefined {
 	const back = ceremonyRedirect(view) ?? (view.kind === "closed" ? view.returnUrl : undefined);
@@ -382,6 +410,14 @@ async function payOrLand(ctx: WaiverRequestContext, ids: SuiteIds, ref: string,
 	return next?.type === "pay" && isPayUrl(next.url) ? next.url : landed;
 }
 
+/**
+ * T153: e-sign says the envelope's deadline passed while Events says the booking is still open (its hold was
+ * extended without the seat being re-issued). The retry mints fresh intents; a booking that has really
+ * ended never gets here, it stops on `ended` first.
+ */
+const lapsed = (view: SignView, booking: BookingAnswer | undefined) =>
+	booking !== undefined && view.kind === "error" && view.code === "SIGNING_TOKEN_EXPIRED";
+
 async function sign(
 	ctx: WaiverRequestContext,
 	ids: SuiteIds,
@@ -424,6 +460,7 @@ async function sign(
 	if (form) {
 		const [token = "", ...after] = rest;
 		const view = await handleSign(signCtx, token, form);
+		if (lapsed(view, booking)) return retry(ctx, ids);
 		if (view.kind === "ready" || view.kind === "error") {
 			return { type: "render", ref, token, remaining: after.length, view, cookies: [], ...withBooking };
 		}
@@ -436,7 +473,7 @@ async function sign(
 				flowCookie(ctx.url, ref, []),
 				retryCookie(ctx.url, ref, undefined),
 			]);
-		return redirect(`${WAIVER_PATH}?ref=${ref}`, [flowCookie(ctx.url, ref, after)]);
+		return nextSigner(ctx, ids, ref, after);
 	}
 
 	// A GET only looks. An envelope closed meanwhile (signed in another tab) is forwarded and skipped.
@@ -444,6 +481,7 @@ async function sign(
 	while (rest.length > 0) {
 		const [token = "", ...after] = rest;
 		const view = await handleSign(signCtx, token, null);
+		if (lapsed(view, booking)) return retry(ctx, ids);
 		if (view.kind !== "closed") {
 			const cookies = rest.length === tokens.length ? [] : [flowCookie(ctx.url, ref, rest)];
 			return { type: "render", ref, token, remaining: after.length, view, cookies, ...withBooking };

package/src/astro/lib/templates.ts

@@ -76,6 +76,11 @@ export async function refreshCatalogue(
 }
 
 const REQUEST_ROUTE = "esign/catalog-request";
+// Events plugins found without the route (Free): not asked again in this isolate, so the host logs one
+// "Route not found" rather than one per Refresh (T154). Installing Pro restarts the site, which clears it.
+const missingRoute = new Set<string>();
+/** Tests only: forget which Events plugins lacked the route. */
+export const forgetMissingRoutes = () => missingRoute.clear();
 
 type PrivateRoute = (
 	pluginId: string,
@@ -95,6 +100,7 @@ export async function loadCatalogue(ctx: PublicRouteContext, ids: CatalogueIds):
 	const l = (ctx.locals ?? {}) as { user?: unknown; emdash?: { handlePluginApiRoute?: unknown } };
 	const call = l.emdash?.handlePluginApiRoute;
 	if (typeof call !== "function" || !l.user) return { ok: false, code: "FORBIDDEN" };
+	if (missingRoute.has(ids.eventsPluginId)) return { ok: false, code: "NOT_FOUND" };
 	const asked = new Request(new URL(`/_emdash/api/plugins/${ids.eventsPluginId}/${REQUEST_ROUTE}`, ctx.url), {
 		method: "POST",
 		headers: { "content-type": "application/json" },
@@ -109,6 +115,7 @@ export async function loadCatalogue(ctx: PublicRouteContext, ids: CatalogueIds):
 	if (data?.ok === true) return refreshCatalogue(ctx, data.request, ids);
 	// A sandboxed core without the route (Free): the host answers ROUTE_ERROR "… Route not found …".
 	const missing = typeof res?.error?.message === "string" && /\bRoute not found\b/.test(res.error.message);
+	if (missing) missingRoute.add(ids.eventsPluginId);
 	const code = missing ? "NOT_FOUND" : (data?.error?.code ?? res?.error?.code);
 	return { ok: false, code: typeof code === "string" ? code : "INTERNAL" };
 }