@tallyui/connector-woocommerce 3.0.0-next.1 → 3.0.0-next.2

package/README.md

@@ -35,7 +35,8 @@ The incremental pull can miss an edit: a `modified_after` that over-excludes (in
 
 ## Errors
 
-- `ConnectorUnauthorizedError`, from `@tallyui/core` and re-exported here: the store rejected the token (401 or 403), or `WooMissingTokenError` (a subclass) was thrown for a missing token. `error.status` is `401` (`code: 'unauthorized'`, sign in again) or `403` (`code: 'forbidden'`, signed in but not allowed: the pull retries on the store schedule; don't sign out).
+- `ConnectorUnauthorizedError`, from `@tallyui/core` and re-exported here: the store refused the request (401: the token is missing, expired or revoked; 403: signed in but not allowed), or `WooMissingTokenError` (a subclass) was thrown for a missing token. `error.status` is `401` (`code: 'unauthorized'`, sign in again) or `403` (`code: 'forbidden'`, signed in but not allowed: the pull retries on the store schedule; don't sign out).
+- `WooPluginUpdateRequiredError` (`code: 'unsupported_store'`, `fixedBy: 'store'`): the store answered a `jwt_auth_*` 403, which WCPOS before 1.10.8 sends for a valid token (wcpos#1863). The store owner must update WCPOS to `minVersion` (`1.10.8`); the pull retries on the store schedule and the till stays signed in.
 - `WooDateFilterError` (`code: 'unsupported_store'`): the store returned a product outside the requested date window, so it does not honour `modified_after` (WooCommerce before 5.8, or a proxy that drops the parameter). An app should show its own words for the `code`; the message, `This store needs WooCommerce 5.8 or later to sync products.`, is a plain fallback. The diagnostics are in `productId`, `bound` (the `modified_after` sent) and `received`. Today the pull retries a failed request every 5 s (RxDB's `retryTime`), one mark request each time. Stopping on errors that cannot recover is shared replication work.
 - `WooTillUpdateRequiredError` (`code: 'till_update_required'`, `fixedBy: 'till'`): the store answered 426, normally WCPOS's protocol gate (`serverCode: 'wcpos_update_required'`), so this till must be updated; the pull pauses until `resume()`.
 - `WooMissingUuidError`: a product came back without a `uuid`, so the store is not running the WCPOS Free plugin 1.10.0 or later, or the connector is not reaching it through `wcpos/v2`.

package/dist/index.d.ts

@@ -69,6 +69,16 @@ declare class WooDateFilterError extends Error {
     readonly minVersion = "5.8";
     constructor(productId: number | undefined, bound: string, received: string | undefined);
 }
+/** A stale JWT plugin 403 on WCPOS 1.10.0–1.10.7 (wcpos/woocommerce-pos#1863; fixed by 7243675c9). */
+declare class WooPluginUpdateRequiredError extends Error {
+    readonly storeCode: string;
+    name: string;
+    readonly code: "unsupported_store";
+    readonly fixedBy: "store";
+    readonly software = "WCPOS";
+    readonly minVersion = "1.10.8";
+    constructor(storeCode: string);
+}
 /**
  * Replication adapter for WooCommerce products.
  *
@@ -124,4 +134,4 @@ declare function createWooCommerceConnector(): TallyConnector;
  */
 declare const woocommerceConnector: TallyConnector;
 
-export { WooDateFilterError, WooMissingTokenError, WooMissingUuidError, WooTillUpdateRequiredError, createWooCommerceConnector, wcposClientPart, wooCatalogueReconcile, wooProductReplication, wooProductSchema, wooProductSync, wooProductTraits, wooReconcileFingerprint, woocommerceConnector };
+export { WooDateFilterError, WooMissingTokenError, WooMissingUuidError, WooPluginUpdateRequiredError, WooTillUpdateRequiredError, createWooCommerceConnector, wcposClientPart, wooCatalogueReconcile, wooProductReplication, wooProductSchema, wooProductSync, wooProductTraits, wooReconcileFingerprint, woocommerceConnector };

package/dist/index.js

@@ -259,6 +259,8 @@ var MAX_STORE_MESSAGE = 200;
 async function checkResponse(response) {
   if (response.ok) return;
   if (response.status === 401 || response.status === 403) {
+    const body = response.status === 403 ? await response.json().catch(() => void 0) : void 0;
+    if (typeof body?.code === "string" && body.code.startsWith("jwt_auth_")) throw new WooPluginUpdateRequiredError(body.code);
     throw new ConnectorUnauthorizedError(`WooCommerce API error: ${response.status}`, response.status);
   }
   if (response.status === 426) {
@@ -313,6 +315,17 @@ var WooDateFilterError = class extends Error {
   /** The first WooCommerce version that applies `modified_after` (5.8). */
   minVersion = "5.8";
 };
+var WooPluginUpdateRequiredError = class extends Error {
+  constructor(storeCode) {
+    super("This store needs WCPOS 1.10.8 or later: the JWT Authentication plugin blocks the till on older versions.");
+    this.storeCode = storeCode;
+  }
+  name = "WooPluginUpdateRequiredError";
+  code = "unsupported_store";
+  fixedBy = "store";
+  software = "WCPOS";
+  minVersion = "1.10.8";
+};
 var wooProductReplication = {
   pull: {
     handler: async function pull(lastCheckpoint, batchSize, context, requests = 0) {
@@ -480,7 +493,7 @@ function createWooReconcileFeed() {
 }
 
 // package.json
-var version = "3.0.0-next.1";
+var version = "3.0.0-next.2";
 
 // src/index.ts
 import { ConnectorUnauthorizedError as ConnectorUnauthorizedError3 } from "@tallyui/core";
@@ -562,6 +575,7 @@ export {
   WooDateFilterError,
   WooMissingTokenError,
   WooMissingUuidError,
+  WooPluginUpdateRequiredError,
   WooTillUpdateRequiredError,
   createWooCommerceConnector,
   wcposClientPart,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tallyui/connector-woocommerce",
-  "version": "3.0.0-next.1",
+  "version": "3.0.0-next.2",
   "type": "module",
   "description": "WooCommerce connector for Tally UI",
   "main": "./dist/index.js",
@@ -26,10 +26,10 @@
     "directory": "connectors/woocommerce"
   },
   "peerDependencies": {
-    "@tallyui/core": "^3.0.0-next.1"
+    "@tallyui/core": "^3.0.0-next.2"
   },
   "devDependencies": {
-    "@tallyui/database": "3.0.0-next.1",
+    "@tallyui/database": "3.0.0-next.2",
     "rxdb": "17.5.0"
   },
   "scripts": {

package/src/index.ts

@@ -119,5 +119,5 @@ export { ConnectorUnauthorizedError } from '@tallyui/core';
 export { wooProductSchema } from './schemas/products';
 export { wooProductTraits } from './traits/product';
 export { wooProductSync } from './sync/products';
-export { wooProductReplication, WooDateFilterError, WooMissingUuidError, WooTillUpdateRequiredError } from './replication/products';
+export { wooProductReplication, WooDateFilterError, WooPluginUpdateRequiredError, WooMissingUuidError, WooTillUpdateRequiredError } from './replication/products';
 export { wooCatalogueReconcile, wooReconcileFingerprint } from './reconcile/catalogue';

package/src/reconcile/catalogue.ts

@@ -30,8 +30,9 @@ async function get(path: string, context: SyncContext): Promise<any> {
 /**
  * The switch for the bulk-id fast path: true only when wcpos/v2/status lists `products_id_fast_path` in
  * `capabilities` (a missing field is false). Never a version number, and never a failed attempt.
- * A failed read (network, non-OK, non-JSON) is "no capability known", so the paged listing runs; only a
- * till-class error (401, 403, 426 through checkResponse) stops the pass, since the listing would fail the same way.
+ * A failed status read is "no capability known"; only a 401 or 403 would make the paged listing fail the same way.
+ * Only a till-class error (401 `unauthorized`, 426 `till_update_required`) or an abort stops the pass.
+ * A 403 `forbidden` is store-class: the catalogue reconcile skips this check and tries again at the next hourly check.
  */
 export async function wooHasIdFastPath(context: SyncContext): Promise<boolean> {
   let status: any;
@@ -69,7 +70,8 @@ export function wooCatalogueReconcile(feed: Pick<ReconcileFeed<any>, 'enqueue'>)
       yield { entries: [], cursor: from };
       if (fast) {
         // The whole catalogue in one request, so `from` is moot. A store that refuses it (a store scope answers 400)
-        // is listed page by page in this pass; only a till-class error or an abort stops it.
+        // falls back to the paged listing, which fails the same way. A 403 `forbidden` is skipped until the next hourly
+        // check; only a till-class error or an abort stops the pass.
         let rows: any;
         let failed = false;
         try {

package/src/replication/products.ts

@@ -21,6 +21,9 @@ const MAX_STORE_MESSAGE = 200;
 export async function checkResponse(response: Response) {
   if (response.ok) return;
   if (response.status === 401 || response.status === 403) {
+    // Older WCPOS versions leak the JWT plugin's stale 403 despite a valid token.
+    const body = response.status === 403 ? await response.json().catch(() => undefined) : undefined;
+    if (typeof body?.code === 'string' && body.code.startsWith('jwt_auth_')) throw new WooPluginUpdateRequiredError(body.code);
     throw new ConnectorUnauthorizedError(`WooCommerce API error: ${response.status}`, response.status as 401 | 403);
   }
   if (response.status === 426) {
@@ -87,6 +90,19 @@ export class WooDateFilterError extends Error {
   }
 }
 
+/** A stale JWT plugin 403 on WCPOS 1.10.0–1.10.7 (wcpos/woocommerce-pos#1863; fixed by 7243675c9). */
+export class WooPluginUpdateRequiredError extends Error {
+  name = 'WooPluginUpdateRequiredError';
+  readonly code = 'unsupported_store' as const;
+  readonly fixedBy = 'store' as const;
+  readonly software = 'WCPOS';
+  readonly minVersion = '1.10.8';
+
+  constructor(readonly storeCode: string) {
+    super('This store needs WCPOS 1.10.8 or later: the JWT Authentication plugin blocks the till on older versions.');
+  }
+}
+
 /**
  * Replication adapter for WooCommerce products.
  *