@stacksjs/defaults 0.70.57 → 0.70.59

package/app/Actions/Storefront/AddToCartAction.ts

@@ -0,0 +1,153 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { randomUUIDv7 } from 'bun'
+import { readCartCookie, writeCartCookie } from '../../Storefront/CartCookie'
+
+const CART_COOKIE = 'stacks_cart'
+const COOKIE_OPTS = {
+  path: '/',
+  httpOnly: true,
+  sameSite: 'lax' as const,
+  maxAge: 60 * 60 * 24 * 30, // 30 days
+}
+
+/**
+ * Add a product to the shopper's cart.
+ *
+ * - Anonymous, cookie-keyed: a `stacks_cart` cookie holds a random
+ *   `session_token` that points at a row in `carts`. We create the cart
+ *   on first add so empty visitors don't litter the table.
+ * - Idempotent per product: if the same slug is already in the cart we
+ *   bump the existing line's quantity instead of inserting a duplicate.
+ * - Form vs XHR: a normal HTML form post redirects to /cart so the
+ *   back button works; XHR callers (the cart drawer) get JSON and
+ *   stay on the current page.
+ */
+export default new Action({
+  name: 'AddToCartAction',
+  description: 'Add a product to the anonymous cart, keyed by cookie session.',
+  method: 'POST',
+
+  async handle(request: any) {
+    const slug = String(request.get('slug') ?? '').trim()
+    const quantity = Math.max(1, Math.min(99, Number(request.get('quantity') ?? 1) || 1))
+
+    if (!slug)
+      return response.json({ error: 'A product slug is required.' }, { status: 422 })
+
+    const product = await (db as any)
+      .selectFrom('products')
+      .where('slug', '=', slug)
+      .where('is_available', '=', 1)
+      .selectAll()
+      .executeTakeFirst()
+
+    if (!product)
+      return response.json({ error: `Product "${slug}" not found` }, { status: 404 })
+
+    // readCartCookie verifies the HMAC; tampered cookies return null
+    // and the action falls through to the "create new cart" branch as
+    // if no cookie were present. Legacy unsigned tokens are accepted
+    // once and re-signed on the next write below.
+    let token = readCartCookie(request, CART_COOKIE)
+    let cart = token
+      ? await (db as any).selectFrom('carts').where('session_token', '=', token).selectAll().executeTakeFirst()
+      : null
+
+    if (!cart) {
+      token = randomUUIDv7()
+      await (db as any)
+        .insertInto('carts')
+        .values({
+          status: 'active',
+          total_items: 0,
+          subtotal: 0,
+          total: 0,
+          currency: 'USD',
+          session_token: token,
+          checkout_step: 'cart',
+        })
+        .execute()
+      // Re-read by session_token: bun-query-builder's `returningAll()`
+      // returns metadata (lastInsertRowid) on sqlite rather than the
+      // full row, so we look up by token to grab a real id we can use
+      // for the cart_items FK.
+      cart = await (db as any)
+        .selectFrom('carts')
+        .where('session_token', '=', token)
+        .selectAll()
+        .executeTakeFirst()
+      writeCartCookie(request, CART_COOKIE, token, COOKIE_OPTS)
+    }
+    else if (!(request.cookies?.get?.(CART_COOKIE) ?? '').includes('.')) {
+      // Re-sign legacy carts opportunistically so the next request
+      // round-trips with the HMAC variant. Cheap — one cookie set per
+      // legacy shopper, then never again.
+      writeCartCookie(request, CART_COOKIE, token!, COOKIE_OPTS)
+    }
+
+    // Look for an existing line for the same product to bump quantity.
+    const existingItem = await (db as any)
+      .selectFrom('cart_items')
+      .where('cart_id', '=', cart.id)
+      .where('product_sku', '=', product.slug)
+      .selectAll()
+      .executeTakeFirst()
+
+    if (existingItem) {
+      const newQty = Number(existingItem.quantity) + quantity
+      await (db as any)
+        .updateTable('cart_items')
+        .set({
+          quantity: newQty,
+          total_price: newQty * Number(existingItem.unit_price),
+        })
+        .where('id', '=', existingItem.id)
+        .execute()
+    }
+    else {
+      await (db as any)
+        .insertInto('cart_items')
+        .values({
+          cart_id: cart.id,
+          quantity,
+          unit_price: Number(product.price),
+          total_price: quantity * Number(product.price),
+          product_name: product.name,
+          product_sku: product.slug,
+          product_image: product.image_url,
+        })
+        .execute()
+    }
+
+    await recomputeCartTotals(cart.id)
+
+    // Browser form post → redirect; XHR (cart drawer) → JSON.
+    const wantsHtml = (request.headers?.get?.('accept') || '').includes('text/html')
+    const xhr = request.headers?.get?.('x-requested-with') === 'XMLHttpRequest'
+    const redirectTarget = String(request.get('redirect') ?? '/cart')
+
+    if (wantsHtml && !xhr)
+      return response.redirect(redirectTarget)
+
+    return response.json({ ok: true, cart_id: cart.id })
+  },
+})
+
+async function recomputeCartTotals(cartId: number): Promise<void> {
+  const items = await (db as any)
+    .selectFrom('cart_items')
+    .where('cart_id', '=', cartId)
+    .selectAll()
+    .execute()
+
+  const totalItems = items.reduce((s: number, i: any) => s + Number(i.quantity), 0)
+  const subtotal = items.reduce((s: number, i: any) => s + Number(i.total_price || 0), 0)
+
+  await (db as any)
+    .updateTable('carts')
+    .set({ total_items: totalItems, subtotal, total: subtotal })
+    .where('id', '=', cartId)
+    .execute()
+}

package/app/Actions/Storefront/CheckoutContactAction.ts

@@ -0,0 +1,50 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { readCartCookie } from '../../Storefront/CartCookie'
+
+const CART_COOKIE = 'stacks_cart'
+
+/**
+ * Step 1 of multi-step checkout. Persists the shopper's email on the
+ * cart row and bumps the cart's `checkout_step` so a refresh on the
+ * shipping page knows which step the shopper is actually on.
+ */
+export default new Action({
+  name: 'CheckoutContactAction',
+  description: 'Save the shopper email on the active cart.',
+  method: 'POST',
+
+  async handle(request: any) {
+    const email = String(request.get('email') ?? '').trim().toLowerCase()
+    if (!email || !email.includes('@'))
+      return response.json({ error: 'A valid email is required.' }, { status: 422 })
+
+    const token = readCartCookie(request, CART_COOKIE)
+    if (!token)
+      return response.json({ error: 'Your cart is empty.' }, { status: 400 })
+
+    const cart = await (db as any)
+      .selectFrom('carts')
+      .where('session_token', '=', token)
+      .where('status', '=', 'active')
+      .selectAll()
+      .executeTakeFirst()
+
+    if (!cart)
+      return response.json({ error: 'Your cart is empty.' }, { status: 400 })
+
+    await (db as any)
+      .updateTable('carts')
+      .set({ email, checkout_step: 'shipping' })
+      .where('id', '=', cart.id)
+      .execute()
+
+    const wantsHtml = (request.headers?.get?.('accept') || '').includes('text/html')
+    const xhr = request.headers?.get?.('x-requested-with') === 'XMLHttpRequest'
+    if (wantsHtml && !xhr)
+      return response.redirect('/checkout/shipping')
+
+    return response.json({ ok: true, next: '/checkout/shipping' })
+  },
+})

package/app/Actions/Storefront/CheckoutShippingAction.ts

@@ -0,0 +1,61 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { readCartCookie } from '../../Storefront/CartCookie'
+
+const CART_COOKIE = 'stacks_cart'
+
+/**
+ * Step 2 of multi-step checkout. Saves shipping address fields on the
+ * cart and advances to the payment step.
+ */
+export default new Action({
+  name: 'CheckoutShippingAction',
+  description: 'Save shipping address on the active cart.',
+  method: 'POST',
+
+  async handle(request: any) {
+    const name = String(request.get('shipping_name') ?? '').trim()
+    const address = String(request.get('shipping_address') ?? '').trim()
+    const city = String(request.get('shipping_city') ?? '').trim()
+    const state = String(request.get('shipping_state') ?? '').trim()
+    const zip = String(request.get('shipping_zip') ?? '').trim()
+
+    if (!name || !address || !city || !state || !zip)
+      return response.json({ error: 'All shipping fields are required.' }, { status: 422 })
+
+    const token = readCartCookie(request, CART_COOKIE)
+    if (!token)
+      return response.json({ error: 'Your cart is empty.' }, { status: 400 })
+
+    const cart = await (db as any)
+      .selectFrom('carts')
+      .where('session_token', '=', token)
+      .where('status', '=', 'active')
+      .selectAll()
+      .executeTakeFirst()
+
+    if (!cart)
+      return response.json({ error: 'Your cart is empty.' }, { status: 400 })
+
+    await (db as any)
+      .updateTable('carts')
+      .set({
+        shipping_name: name,
+        shipping_address: address,
+        shipping_city: city,
+        shipping_state: state,
+        shipping_zip: zip,
+        checkout_step: 'payment',
+      })
+      .where('id', '=', cart.id)
+      .execute()
+
+    const wantsHtml = (request.headers?.get?.('accept') || '').includes('text/html')
+    const xhr = request.headers?.get?.('x-requested-with') === 'XMLHttpRequest'
+    if (wantsHtml && !xhr)
+      return response.redirect('/checkout/payment')
+
+    return response.json({ ok: true, next: '/checkout/payment' })
+  },
+})

package/app/Actions/Storefront/GetCartAction.ts

@@ -0,0 +1,58 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { readCartCookie } from '../../Storefront/CartCookie'
+
+const CART_COOKIE = 'stacks_cart'
+
+/**
+ * Read-only cart endpoint used by the slide-in CartDrawer to refresh
+ * its contents after an add/remove. Returns the same shape the drawer
+ * renders directly so the client doesn't have to do any reshaping.
+ */
+export default new Action({
+  name: 'GetCartAction',
+  description: 'Return the current cart for the caller cookie.',
+  method: 'GET',
+
+  async handle(request: any) {
+    // Verify HMAC; tampered cookies behave the same as no cookie at
+    // all — return an empty cart shell instead of looking up the
+    // forged token. Legacy unsigned tokens parse through.
+    const token = readCartCookie(request, CART_COOKIE)
+    if (!token)
+      return response.json({ items: [], subtotal: 0, total_items: 0 })
+
+    const cart = await (db as any)
+      .selectFrom('carts')
+      .where('session_token', '=', token)
+      .where('status', '=', 'active')
+      .selectAll()
+      .executeTakeFirst()
+
+    if (!cart)
+      return response.json({ items: [], subtotal: 0, total_items: 0 })
+
+    const rawItems = await (db as any)
+      .selectFrom('cart_items')
+      .where('cart_id', '=', cart.id)
+      .selectAll()
+      .execute()
+
+    const items = rawItems.map((row: any) => ({
+      id: row.id,
+      slug: row.product_sku,
+      name: row.product_name,
+      image: row.product_image,
+      qty: Number(row.quantity),
+      price: Number(row.unit_price),
+      lineTotal: Number(row.total_price || 0),
+    }))
+
+    return response.json({
+      items,
+      total_items: Number(cart.total_items || 0),
+      subtotal: Number(cart.subtotal || 0),
+    })
+  },
+})

package/app/Actions/Storefront/PlaceOrderAction.ts

@@ -0,0 +1,195 @@
+import { Action } from '@stacksjs/actions'
+import { config } from '@stacksjs/config'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { sendOrderConfirmation } from '../../Mail/OrderConfirmation'
+import { readCartCookie } from '../../Storefront/CartCookie'
+import { totalsFor } from './_shipping'
+
+const CART_COOKIE = 'stacks_cart'
+
+/**
+ * Step 3 of multi-step checkout — the actual "place order" call.
+ *
+ * Pulls everything we collected in earlier steps off the cart row
+ * (email + shipping_*), creates a Customer if we don't have one for
+ * this email yet, materializes an Order + OrderItems, decrements
+ * inventory, marks the cart as `converted`, and clears the cookie so
+ * a refresh starts fresh.
+ *
+ * No real card is charged — a Stripe call would slot in between the
+ * cart lookup and the order creation. The mock card form on the
+ * payment view doesn't actually submit any sensitive data.
+ */
+export default new Action({
+  name: 'PlaceOrderAction',
+  description: 'Convert the active cart into an Order + OrderItems.',
+  method: 'POST',
+
+  async handle(request: any) {
+    const token = readCartCookie(request, CART_COOKIE)
+    if (!token)
+      return response.json({ error: 'Your cart is empty.' }, { status: 400 })
+
+    const cart = await (db as any)
+      .selectFrom('carts')
+      .where('session_token', '=', token)
+      .where('status', '=', 'active')
+      .selectAll()
+      .executeTakeFirst()
+
+    if (!cart)
+      return response.json({ error: 'Your cart is empty.' }, { status: 400 })
+
+    const items = await (db as any)
+      .selectFrom('cart_items')
+      .where('cart_id', '=', cart.id)
+      .selectAll()
+      .execute()
+
+    if (items.length === 0)
+      return response.json({ error: 'Your cart is empty.' }, { status: 400 })
+
+    if (!cart.email || !cart.shipping_name || !cart.shipping_address)
+      return response.json({ error: 'Checkout details are incomplete.' }, { status: 422 })
+
+    // One customer per email — repeat shoppers reuse the same row so
+    // the dashboard's customer total isn't inflated by checkouts.
+    let customer = await (db as any)
+      .selectFrom('customers')
+      .where('email', '=', cart.email)
+      .selectAll()
+      .executeTakeFirst()
+
+    if (!customer) {
+      await (db as any)
+        .insertInto('customers')
+        .values({ name: cart.shipping_name, email: cart.email })
+        .execute()
+      customer = await (db as any)
+        .selectFrom('customers')
+        .where('email', '=', cart.email)
+        .selectAll()
+        .executeTakeFirst()
+    }
+
+    const itemsSubtotal = items.reduce((s: number, i: any) => s + Number(i.total_price || 0), 0)
+    const { subtotal, shipping, total } = totalsFor(itemsSubtotal)
+
+    const fullAddress = [
+      cart.shipping_address,
+      [cart.shipping_city, cart.shipping_state, cart.shipping_zip].filter(Boolean).join(', '),
+    ].filter(Boolean).join('\n')
+
+    await (db as any)
+      .insertInto('orders')
+      .values({
+        customer_id: customer.id,
+        status: 'paid',
+        order_type: 'shipping',
+        total_amount: total,
+        delivery_fee: shipping,
+        delivery_address: fullAddress,
+      })
+      .execute()
+    // Re-read latest order for this customer — RETURNING * doesn't
+    // round-trip the row reliably on sqlite via bun-query-builder.
+    const order = await (db as any)
+      .selectFrom('orders')
+      .where('customer_id', '=', customer.id)
+      .orderBy('id', 'desc')
+      .limit(1)
+      .selectAll()
+      .executeTakeFirst()
+
+    // Map cart_items → order_items, resolving product_id by SKU.
+    for (const item of items) {
+      const product = await (db as any)
+        .selectFrom('products')
+        .where('slug', '=', item.product_sku)
+        .selectAll()
+        .executeTakeFirst()
+
+      await (db as any)
+        .insertInto('order_items')
+        .values({
+          order_id: order.id,
+          product_id: product?.id ?? null,
+          quantity: Number(item.quantity),
+          price: Number(item.unit_price),
+        })
+        .execute()
+    }
+
+    // Decrement inventory for what we just sold. Best-effort — we
+    // already accepted the order, so a stock-row miss shouldn't
+    // fail the response.
+    for (const item of items) {
+      try {
+        const product = await (db as any)
+          .selectFrom('products')
+          .where('slug', '=', item.product_sku)
+          .selectAll()
+          .executeTakeFirst()
+        if (product) {
+          const next = Math.max(0, Number(product.inventory_count || 0) - Number(item.quantity))
+          await (db as any)
+            .updateTable('products')
+            .set({ inventory_count: next })
+            .where('id', '=', product.id)
+            .execute()
+        }
+      }
+      catch { /* keep going */ }
+    }
+
+    await (db as any)
+      .updateTable('carts')
+      .set({ status: 'converted', checkout_step: 'placed' })
+      .where('id', '=', cart.id)
+      .execute()
+
+    request.cookies?.delete?.(CART_COOKIE, { path: '/' })
+
+    // Fire the receipt email asynchronously so a mailer hiccup
+    // never fails an otherwise-good checkout. The customer can still
+    // see their order on the post-checkout page even if the email
+    // never lands.
+    const baseUrl = (() => {
+      let raw = process.env.APP_URL || config.app.url || ''
+      if (raw && !/^https?:\/\//i.test(raw)) raw = `https://${raw}`
+      return raw.replace(/\/$/, '')
+    })()
+    sendOrderConfirmation({
+      to: cart.email,
+      orderId: order.id,
+      customerName: cart.shipping_name || customer.name,
+      items: items.map((row: any) => ({
+        name: row.product_name,
+        qty: Number(row.quantity),
+        lineTotal: Number(row.total_price || 0),
+      })),
+      subtotal,
+      shipping,
+      total,
+      shippingAddress: fullAddress,
+      orderUrl: `${baseUrl}/orders/${order.id}`,
+    }).catch((err: unknown) => {
+      const message = err instanceof Error ? err.message : String(err)
+      console.error(`[PlaceOrderAction] order receipt email failed for order #${order.id}:`, message)
+    })
+
+    const wantsHtml = (request.headers?.get?.('accept') || '').includes('text/html')
+    const xhr = request.headers?.get?.('x-requested-with') === 'XMLHttpRequest'
+    if (wantsHtml && !xhr)
+      return response.redirect(`/orders/${order.id}`)
+
+    return response.json({
+      ok: true,
+      order_id: order.id,
+      total,
+      subtotal,
+      shipping,
+    })
+  },
+})

package/app/Actions/Storefront/SubmitReviewAction.ts

@@ -0,0 +1,140 @@
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { rateLimit, response } from '@stacksjs/router'
+import { readCartCookie } from '../../Storefront/CartCookie'
+
+const CART_COOKIE = 'stacks_cart'
+
+/**
+ * Public review-submission endpoint. Posted from `/orders/{id}` by
+ * the buyer after their order ships.
+ *
+ * Trust model:
+ *   - Verifies the submitter actually owns the order by matching the
+ *     `email` on the order against the `email` they're posting with,
+ *     and additionally accepts a still-valid cart cookie path for
+ *     guest shoppers who haven't enrolled in account auth.
+ *   - Marks `is_verified_purchase=1` only when that email-on-order
+ *     check passes.
+ *   - Always inserts with `is_approved=0`. The dashboard's reviews
+ *     index shows pending entries to admins for moderation.
+ *
+ * Spam handling: rate-limit per IP (5/min) so a hostile actor can't
+ * dump 1000 boilerplate reviews from one address. Honeypot field
+ * (`website`) catches drive-by bots — a non-empty value short-circuits
+ * with a fake-success response.
+ */
+export default new Action({
+  name: 'SubmitReviewAction',
+  description: 'Buyer-submitted review tied to a shipped order. Marked pending until moderated.',
+  method: 'POST',
+
+  async handle(request: any) {
+    await rateLimit('review-submit', 5).per('minute')
+
+    const orderId = Number(request.get('order_id') ?? 0)
+    const productSlug = String(request.get('product_slug') ?? '').trim()
+    const rating = Math.max(1, Math.min(5, Number(request.get('rating') ?? 0)))
+    const title = String(request.get('title') ?? '').trim()
+    const content = String(request.get('content') ?? '').trim()
+    const email = String(request.get('email') ?? '').trim().toLowerCase()
+    // Honeypot. Bots fill every field; a real form keeps this hidden
+    // and untouched. Pretend to succeed so the bot moves on without
+    // retrying with a different shape.
+    const honeypot = String(request.get('website') ?? '').trim()
+    if (honeypot)
+      return response.json({ success: true })
+
+    if (!orderId || !productSlug || !rating || !title || !content || !email)
+      return response.json({ success: false, message: 'All fields are required.' }, { status: 422 })
+
+    if (title.length > 100)
+      return response.json({ success: false, message: 'Title is too long.' }, { status: 422 })
+    if (content.length > 2000)
+      return response.json({ success: false, message: 'Review is too long.' }, { status: 422 })
+
+    // Verify the order + ownership. Two acceptable proofs of ownership:
+    //   (a) email on the order row matches the submitted email
+    //   (b) shopper still has the cart cookie that placed the order
+    // Either is enough — (a) is the common case for a returning buyer
+    // clicking the link in their receipt; (b) covers a buyer who never
+    // closes the post-checkout tab.
+    const order = await (db as any)
+      .selectFrom('orders')
+      .where('id', '=', orderId)
+      .selectAll()
+      .executeTakeFirst()
+    if (!order)
+      return response.json({ success: false, message: 'Order not found.' }, { status: 404 })
+
+    let ownsOrder = false
+    if (order.customer_id) {
+      const customer = await (db as any)
+        .selectFrom('customers')
+        .where('id', '=', order.customer_id)
+        .selectAll()
+        .executeTakeFirst()
+      if (customer && String(customer.email || '').toLowerCase() === email)
+        ownsOrder = true
+    }
+    if (!ownsOrder) {
+      const cookieToken = readCartCookie(request, CART_COOKIE)
+      if (cookieToken) {
+        const cart = await (db as any)
+          .selectFrom('carts')
+          .where('session_token', '=', cookieToken)
+          .selectAll()
+          .executeTakeFirst()
+        if (cart && cart.email && String(cart.email).toLowerCase() === email)
+          ownsOrder = true
+      }
+    }
+    if (!ownsOrder)
+      return response.json({ success: false, message: 'We could not match you to that order.' }, { status: 403 })
+
+    // Resolve the product row by slug. Reviews use `product_id` as a
+    // FK; the storefront submits the slug because it's what the URL
+    // and cart row already carry.
+    const product = await (db as any)
+      .selectFrom('products')
+      .where('slug', '=', productSlug)
+      .selectAll()
+      .executeTakeFirst()
+    if (!product)
+      return response.json({ success: false, message: 'Unknown product.' }, { status: 422 })
+
+    // Block duplicates per (order, product) pair so a curious shopper
+    // can't refresh-spam the form and clobber the moderation queue.
+    const dup = await (db as any)
+      .selectFrom('reviews')
+      .where('product_id', '=', product.id)
+      .where('order_id', '=', orderId)
+      .selectAll()
+      .executeTakeFirst()
+    if (dup)
+      return response.json({ success: false, message: 'You already submitted a review for this product on this order.' }, { status: 409 })
+
+    await (db as any)
+      .insertInto('reviews')
+      .values({
+        product_id: product.id,
+        customer_id: order.customer_id ?? null,
+        order_id: orderId,
+        rating,
+        title,
+        content,
+        is_verified_purchase: 1,
+        is_approved: 0,
+        is_featured: 0,
+        helpful_votes: 0,
+        unhelpful_votes: 0,
+        purchase_date: order.created_at || new Date().toISOString(),
+      })
+      .execute()
+
+    return response.json({
+      success: true,
+      message: "Thanks — your review is in. We'll publish it once a human gives it a quick look.",
+    })
+  },
+})