@tallyui/connector-vendure 3.0.0-next.1 → 3.0.0-next.2

package/dist/index.js

@@ -31,7 +31,7 @@ async function forbiddenError(context, forbidden) {
   const out = await signedOut(context);
   if (out === true) return new ConnectorUnauthorizedError(`Vendure GraphQL error: ${forbidden[0].message}`, 401);
   const what = forbidden.map(({ message, path }) => path?.length ? `${path.join(".")}: ${message}` : message).join("; ");
-  if (out === false) return new Error(`Vendure GraphQL error: FORBIDDEN: the store refused this request although the session is signed in (a permission is missing): ${what}`);
+  if (out === false) return new ConnectorUnauthorizedError(`Vendure GraphQL error: FORBIDDEN: the store refused this request although the session is signed in (a permission is missing): ${what}`, 403);
   return new Error(`Vendure GraphQL error: FORBIDDEN: ${what} (the session check failed, so this may be transient)`);
 }
 
@@ -48,7 +48,7 @@ async function readVendureCapabilities(baseUrl, headers, init = {}) {
   if (res.status === 401 || res.status === 403) {
     const out = await signedOut({ connectorId: "vendure", baseUrl, headers, signal: init.signal });
     if (out === true) throw new ConnectorUnauthorizedError2(`Vendure refused ${CAPABILITIES_PATH}: the session is signed out`, 401);
-    if (out === false) throw new Error(`Vendure refused ${CAPABILITIES_PATH} although the session is signed in: the CreateOrder permission is missing (HTTP ${res.status})`);
+    if (out === false) throw new ConnectorUnauthorizedError2(`Vendure refused ${CAPABILITIES_PATH} although the session is signed in: the CreateOrder permission is missing (HTTP ${res.status})`, 403);
     return void 0;
   }
   if (res.status === 404) return { orderCreate: 1 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tallyui/connector-vendure",
-  "version": "3.0.0-next.1",
+  "version": "3.0.0-next.2",
   "type": "module",
   "description": "Vendure connector for Tally UI",
   "main": "./dist/index.js",
@@ -26,11 +26,11 @@
     "directory": "connectors/vendure"
   },
   "peerDependencies": {
-    "@tallyui/core": "^3.0.0-next.1"
+    "@tallyui/core": "^3.0.0-next.2"
   },
   "devDependencies": {
-    "@tallyui/database": "3.0.0-next.1",
-    "@tallyui/pos": "3.0.0-next.1",
+    "@tallyui/database": "3.0.0-next.2",
+    "@tallyui/pos": "3.0.0-next.2",
     "rxdb": "17.5.0"
   },
   "scripts": {

package/src/capabilities.ts

@@ -11,8 +11,8 @@ export const CAPABILITIES_PATH = '/tally/v1/info';
  * non-2xx other than 404/401/403, non-JSON 2xx or malformed `taxRounding` is unknown and gives
  * `undefined`. The route answers a dead session and a missing
  * `CreateOrder` permission alike with 403, so a 401/403 asks who is signed in (#279): nobody
- * throws `ConnectorUnauthorizedError`, an administrator throws a plain Error naming the
- * permission, and a failed check is unknown.
+ * throws `ConnectorUnauthorizedError` 401, an administrator throws `ConnectorUnauthorizedError`
+ * 403 naming the permission, and a failed check is unknown.
  */
 export async function readVendureCapabilities(
   baseUrl: string,
@@ -30,7 +30,7 @@ export async function readVendureCapabilities(
     const out = await signedOut({ connectorId: 'vendure', baseUrl, headers, signal: init.signal });
     // The probe confirms sign-out; the route's 403 also covers missing permissions.
     if (out === true) throw new ConnectorUnauthorizedError(`Vendure refused ${CAPABILITIES_PATH}: the session is signed out`, 401);
-    if (out === false) throw new Error(`Vendure refused ${CAPABILITIES_PATH} although the session is signed in: the CreateOrder permission is missing (HTTP ${res.status})`);
+    if (out === false) throw new ConnectorUnauthorizedError(`Vendure refused ${CAPABILITIES_PATH} although the session is signed in: the CreateOrder permission is missing (HTTP ${res.status})`, 403);
     return undefined;
   }
   if (res.status === 404) return { orderCreate: 1 };

package/src/replication/products.ts

@@ -81,6 +81,7 @@ export async function gql(
   if (!res.ok) {
     const body = await res.json().catch(() => undefined) as GqlBody | undefined;
     const message = body?.errors?.[0]?.message;
+    // Vendure answers FORBIDDEN with HTTP 200; an HTTP 401/403 comes from a proxy or firewall and is taken at face value.
     if (res.status === 401 || res.status === 403) throw new ConnectorUnauthorizedError(`Vendure API error: ${res.status}${message ? `: ${message}` : ''}`, res.status as 401 | 403);
     throw new Error(`Vendure API error: ${res.status}${message ? `: ${message}` : ''}`);
   }

package/src/session-probe.ts

@@ -26,8 +26,8 @@ export async function signedOut(context: SyncContext): Promise<boolean | undefin
 }
 
 /**
- * The error for a `FORBIDDEN` answer: only a signed-out session signs the till out. The plain
- * errors name everything refused, in the answer's order (each GraphQL `path`, e.g. `product.variants`),
+ * The error for a `FORBIDDEN` answer: a signed-out session is 401, a confirmed missing permission
+ * is 403, and a failed probe is a plain Error. Errors name everything refused in answer order (each GraphQL `path`, e.g. `product.variants`),
  * for the store owner's log. One probe answers for the whole response.
  */
 export async function forbiddenError(context: SyncContext, forbidden: Array<{ message?: string; path?: ReadonlyArray<string | number> }>): Promise<Error> {
@@ -35,6 +35,6 @@ export async function forbiddenError(context: SyncContext, forbidden: Array<{ me
   // The probe confirmed a signed-out session even though Vendure answered FORBIDDEN.
   if (out === true) return new ConnectorUnauthorizedError(`Vendure GraphQL error: ${forbidden[0].message}`, 401);
   const what = forbidden.map(({ message, path }) => (path?.length ? `${path.join('.')}: ${message}` : message)).join('; ');
-  if (out === false) return new Error(`Vendure GraphQL error: FORBIDDEN: the store refused this request although the session is signed in (a permission is missing): ${what}`);
+  if (out === false) return new ConnectorUnauthorizedError(`Vendure GraphQL error: FORBIDDEN: the store refused this request although the session is signed in (a permission is missing): ${what}`, 403);
   return new Error(`Vendure GraphQL error: FORBIDDEN: ${what} (the session check failed, so this may be transient)`);
 }

package/src/sync/products.ts

@@ -152,6 +152,7 @@ async function gql(
     signal: context.signal,
   });
 
+  // Vendure answers FORBIDDEN with HTTP 200; an HTTP 401/403 comes from a proxy or firewall and is taken at face value.
   if (res.status === 401 || res.status === 403) throw new ConnectorUnauthorizedError(`Vendure API error: ${res.status}`, res.status as 401 | 403);
   if (!res.ok) throw new Error(`Vendure API error: ${res.status}`);
   const body: { data?: any; errors?: Array<{ message?: string; path?: Array<string | number>; extensions?: { code?: string } }> } = await res.json();