@tallyui/connector-woocommerce 3.0.0-next.1 → 3.0.0

package/README.md

@@ -35,7 +35,8 @@ The incremental pull can miss an edit: a `modified_after` that over-excludes (in
 
 ## Errors
 
-- `ConnectorUnauthorizedError`, from `@tallyui/core` and re-exported here: the store rejected the token (401 or 403), or `WooMissingTokenError` (a subclass) was thrown for a missing token. `error.status` is `401` (`code: 'unauthorized'`, sign in again) or `403` (`code: 'forbidden'`, signed in but not allowed: the pull retries on the store schedule; don't sign out).
+- `ConnectorUnauthorizedError`, from `@tallyui/core` and re-exported here: the store refused the request (401: the token is missing, expired or revoked; 403: signed in but not allowed), or `WooMissingTokenError` (a subclass) was thrown for a missing token. `error.status` is `401` (`code: 'unauthorized'`, sign in again) or `403` (`code: 'forbidden'`, signed in but not allowed: the pull retries on the store schedule; don't sign out).
+- `WooTokenRefusedError` (`code: 'store_misconfigured'`, `fixedBy: 'store'`, `fix`, and the store's own `storeCode`): the store answered a `jwt_auth_*` 403, the JWT Authentication plugin refusing the till's token. WCPOS 1.10.0–1.10.7 sent it for a valid token (wcpos#1863), and later versions can still send it when the token resolves to another user, so the error names no version. The store owner checks the JWT Authentication plugin's settings, or the till is paired again; the pull retries on the store schedule and the till stays signed in.
 - `WooDateFilterError` (`code: 'unsupported_store'`): the store returned a product outside the requested date window, so it does not honour `modified_after` (WooCommerce before 5.8, or a proxy that drops the parameter). An app should show its own words for the `code`; the message, `This store needs WooCommerce 5.8 or later to sync products.`, is a plain fallback. The diagnostics are in `productId`, `bound` (the `modified_after` sent) and `received`. Today the pull retries a failed request every 5 s (RxDB's `retryTime`), one mark request each time. Stopping on errors that cannot recover is shared replication work.
 - `WooTillUpdateRequiredError` (`code: 'till_update_required'`, `fixedBy: 'till'`): the store answered 426, normally WCPOS's protocol gate (`serverCode: 'wcpos_update_required'`), so this till must be updated; the pull pauses until `resume()`.
 - `WooMissingUuidError`: a product came back without a `uuid`, so the store is not running the WCPOS Free plugin 1.10.0 or later, or the connector is not reaching it through `wcpos/v2`.

package/dist/index.d.ts

@@ -69,6 +69,21 @@ declare class WooDateFilterError extends Error {
     readonly minVersion = "5.8";
     constructor(productId: number | undefined, bound: string, received: string | undefined);
 }
+/**
+ * A `jwt_auth_*` 403: the store's JWT Authentication plugin refused the till's token. WCPOS 1.10.0–1.10.7 sent it for a valid token
+ * (wcpos/woocommerce-pos#1863); 1.10.8 and later can still send it when the token resolves to another user. So the
+ * message names no version: a version hint belongs only where a response itself carries the WCPOS version (#360).
+ */
+declare class WooTokenRefusedError extends Error {
+    readonly storeCode: string;
+    name: string;
+    readonly code: "store_misconfigured";
+    /** The store owner fixes it on the store, so the pull waits the store delay and the till stays signed in (`errorKind`). */
+    readonly fixedBy: "store";
+    /** The store-side remedy, for `SyncStatus`'s detail. */
+    readonly fix = "check the JWT Authentication plugin's settings";
+    constructor(storeCode: string);
+}
 /**
  * Replication adapter for WooCommerce products.
  *
@@ -124,4 +139,4 @@ declare function createWooCommerceConnector(): TallyConnector;
  */
 declare const woocommerceConnector: TallyConnector;
 
-export { WooDateFilterError, WooMissingTokenError, WooMissingUuidError, WooTillUpdateRequiredError, createWooCommerceConnector, wcposClientPart, wooCatalogueReconcile, wooProductReplication, wooProductSchema, wooProductSync, wooProductTraits, wooReconcileFingerprint, woocommerceConnector };
+export { WooDateFilterError, WooMissingTokenError, WooMissingUuidError, WooTillUpdateRequiredError, WooTokenRefusedError, createWooCommerceConnector, wcposClientPart, wooCatalogueReconcile, wooProductReplication, wooProductSchema, wooProductSync, wooProductTraits, wooReconcileFingerprint, woocommerceConnector };

package/dist/index.js

@@ -259,6 +259,8 @@ var MAX_STORE_MESSAGE = 200;
 async function checkResponse(response) {
   if (response.ok) return;
   if (response.status === 401 || response.status === 403) {
+    const body = response.status === 403 ? await response.json().catch(() => void 0) : void 0;
+    if (typeof body?.code === "string" && body.code.startsWith("jwt_auth_")) throw new WooTokenRefusedError(body.code);
     throw new ConnectorUnauthorizedError(`WooCommerce API error: ${response.status}`, response.status);
   }
   if (response.status === 426) {
@@ -313,6 +315,18 @@ var WooDateFilterError = class extends Error {
   /** The first WooCommerce version that applies `modified_after` (5.8). */
   minVersion = "5.8";
 };
+var WooTokenRefusedError = class extends Error {
+  constructor(storeCode) {
+    super("The store refused the sign-in token (403). Ask the store owner to check the JWT Authentication plugin's settings, or pair the till again.");
+    this.storeCode = storeCode;
+  }
+  name = "WooTokenRefusedError";
+  code = "store_misconfigured";
+  /** The store owner fixes it on the store, so the pull waits the store delay and the till stays signed in (`errorKind`). */
+  fixedBy = "store";
+  /** The store-side remedy, for `SyncStatus`'s detail. */
+  fix = "check the JWT Authentication plugin's settings";
+};
 var wooProductReplication = {
   pull: {
     handler: async function pull(lastCheckpoint, batchSize, context, requests = 0) {
@@ -425,6 +439,7 @@ function wooCatalogueReconcile(feed) {
           return;
         }
         if (!failed) console.warn("WooCommerce catalogue reconcile: the fast path answered with something that is not a list; listing page by page.");
+        yield { entries: [], cursor: from };
       }
       for (let page = from; ; page++) {
         const params = new URLSearchParams({
@@ -448,8 +463,8 @@ function wooCatalogueReconcile(feed) {
       if (!ids.length) return [];
       const params = new URLSearchParams({ include: ids.join(","), per_page: String(PAGE_SIZE), status: "any", _fields: "id,uuid,status" });
       const rows = await get(`/products?${params}`, context);
-      const live = new Set(rows.filter((row) => row.status === "publish").map((row) => row.id));
-      return locals.filter((doc) => Number.isInteger(doc.id) && !live.has(doc.id)).map((doc) => doc.uuid);
+      const live = new Map(rows.filter((row) => row.status === "publish").map((row) => [row.id, typeof row.uuid === "string" && row.uuid.length > 0 ? row.uuid : void 0]));
+      return locals.filter((doc) => Number.isInteger(doc.id) && (!live.has(doc.id) || typeof live.get(doc.id) === "string" && live.get(doc.id) !== doc.uuid)).map((doc) => doc.uuid);
     },
     // An entry with no numeric id, locally or in the listing, is dropped: the store cannot be asked about it, so
     // the feed would find nothing and tombstone it without proof. (The schema requires only uuid.)
@@ -480,7 +495,7 @@ function createWooReconcileFeed() {
 }
 
 // package.json
-var version = "3.0.0-next.1";
+var version = "3.0.0";
 
 // src/index.ts
 import { ConnectorUnauthorizedError as ConnectorUnauthorizedError3 } from "@tallyui/core";
@@ -563,6 +578,7 @@ export {
   WooMissingTokenError,
   WooMissingUuidError,
   WooTillUpdateRequiredError,
+  WooTokenRefusedError,
   createWooCommerceConnector,
   wcposClientPart,
   wooCatalogueReconcile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tallyui/connector-woocommerce",
-  "version": "3.0.0-next.1",
+  "version": "3.0.0",
   "type": "module",
   "description": "WooCommerce connector for Tally UI",
   "main": "./dist/index.js",
@@ -26,10 +26,10 @@
     "directory": "connectors/woocommerce"
   },
   "peerDependencies": {
-    "@tallyui/core": "^3.0.0-next.1"
+    "@tallyui/core": "^3.0.0"
   },
   "devDependencies": {
-    "@tallyui/database": "3.0.0-next.1",
+    "@tallyui/database": "3.0.0",
     "rxdb": "17.5.0"
   },
   "scripts": {

package/src/index.ts

@@ -119,5 +119,5 @@ export { ConnectorUnauthorizedError } from '@tallyui/core';
 export { wooProductSchema } from './schemas/products';
 export { wooProductTraits } from './traits/product';
 export { wooProductSync } from './sync/products';
-export { wooProductReplication, WooDateFilterError, WooMissingUuidError, WooTillUpdateRequiredError } from './replication/products';
+export { wooProductReplication, WooDateFilterError, WooTokenRefusedError, WooMissingUuidError, WooTillUpdateRequiredError } from './replication/products';
 export { wooCatalogueReconcile, wooReconcileFingerprint } from './reconcile/catalogue';

package/src/reconcile/catalogue.ts

@@ -30,8 +30,9 @@ async function get(path: string, context: SyncContext): Promise<any> {
 /**
  * The switch for the bulk-id fast path: true only when wcpos/v2/status lists `products_id_fast_path` in
  * `capabilities` (a missing field is false). Never a version number, and never a failed attempt.
- * A failed read (network, non-OK, non-JSON) is "no capability known", so the paged listing runs; only a
- * till-class error (401, 403, 426 through checkResponse) stops the pass, since the listing would fail the same way.
+ * A failed status read is "no capability known"; only a 401 or 403 would make the paged listing fail the same way.
+ * Only a till-class error (401 `unauthorized`, 426 `till_update_required`) or an abort stops the pass.
+ * A 403 `forbidden` is store-class: the whole pass is logged `skipped` and runs again at the next check (hourly by default).
  */
 export async function wooHasIdFastPath(context: SyncContext): Promise<boolean> {
   let status: any;
@@ -69,7 +70,8 @@ export function wooCatalogueReconcile(feed: Pick<ReconcileFeed<any>, 'enqueue'>)
       yield { entries: [], cursor: from };
       if (fast) {
         // The whole catalogue in one request, so `from` is moot. A store that refuses it (a store scope answers 400)
-        // is listed page by page in this pass; only a till-class error or an abort stops it.
+        // falls back to the paged listing, which fails the same way. A 403 `forbidden` is skipped until the next hourly
+        // check; only a till-class error or an abort stops the pass.
         let rows: any;
         let failed = false;
         try {
@@ -84,6 +86,8 @@ export function wooCatalogueReconcile(feed: Pick<ReconcileFeed<any>, 'enqueue'>)
           return;
         }
         if (!failed) console.warn('WooCommerce catalogue reconcile: the fast path answered with something that is not a list; listing page by page.');
+        // An empty page, so the fallback's first request takes its own budget slot, as the status read does.
+        yield { entries: [], cursor: from };
       }
       // status=publish: a product that is not published is absent, so it becomes a deletion candidate and
       // confirmGone decides; drafts cost no daily refetch.
@@ -104,9 +108,11 @@ export function wooCatalogueReconcile(feed: Pick<ReconcileFeed<any>, 'enqueue'>)
       // An empty include= would list the whole store; a local without a numeric id has no proof and is kept.
       if (!ids.length) return [];
       const params = new URLSearchParams({ include: ids.join(','), per_page: String(PAGE_SIZE), status: 'any', _fields: 'id,uuid,status' });
-      const rows: Array<{ id: number; status: string }> = await get(`/products?${params}`, context);
-      const live = new Set(rows.filter((row) => row.status === 'publish').map((row) => row.id));
-      return locals.filter((doc) => Number.isInteger(doc.id) && !live.has(doc.id)).map((doc) => doc.uuid);
+      const rows: Array<{ id: number; uuid: string; status: string }> = await get(`/products?${params}`, context);
+      const live = new Map(rows.filter((row) => row.status === 'publish').map((row) => [row.id, typeof row.uuid === 'string' && row.uuid.length > 0 ? row.uuid : undefined]));
+      // A live id backs only the store's uuid; other local copies are gone (#369).
+      // A row without a uuid can't prove the local copy stale, so a live id keeps it (#375 review).
+      return locals.filter((doc) => Number.isInteger(doc.id) && (!live.has(doc.id) || (typeof live.get(doc.id) === 'string' && live.get(doc.id) !== doc.uuid))).map((doc) => doc.uuid);
     },
     // An entry with no numeric id, locally or in the listing, is dropped: the store cannot be asked about it, so
     // the feed would find nothing and tombstone it without proof. (The schema requires only uuid.)

package/src/replication/products.ts

@@ -21,6 +21,9 @@ const MAX_STORE_MESSAGE = 200;
 export async function checkResponse(response: Response) {
   if (response.ok) return;
   if (response.status === 401 || response.status === 403) {
+    // A jwt_auth_* 403 is the store's JWT layer refusing the token, on any WCPOS version (#360).
+    const body = response.status === 403 ? await response.json().catch(() => undefined) : undefined;
+    if (typeof body?.code === 'string' && body.code.startsWith('jwt_auth_')) throw new WooTokenRefusedError(body.code);
     throw new ConnectorUnauthorizedError(`WooCommerce API error: ${response.status}`, response.status as 401 | 403);
   }
   if (response.status === 426) {
@@ -87,6 +90,24 @@ export class WooDateFilterError extends Error {
   }
 }
 
+/**
+ * A `jwt_auth_*` 403: the store's JWT Authentication plugin refused the till's token. WCPOS 1.10.0–1.10.7 sent it for a valid token
+ * (wcpos/woocommerce-pos#1863); 1.10.8 and later can still send it when the token resolves to another user. So the
+ * message names no version: a version hint belongs only where a response itself carries the WCPOS version (#360).
+ */
+export class WooTokenRefusedError extends Error {
+  name = 'WooTokenRefusedError';
+  readonly code = 'store_misconfigured' as const;
+  /** The store owner fixes it on the store, so the pull waits the store delay and the till stays signed in (`errorKind`). */
+  readonly fixedBy = 'store' as const;
+  /** The store-side remedy, for `SyncStatus`'s detail. */
+  readonly fix = "check the JWT Authentication plugin's settings";
+
+  constructor(readonly storeCode: string) {
+    super("The store refused the sign-in token (403). Ask the store owner to check the JWT Authentication plugin's settings, or pair the till again.");
+  }
+}
+
 /**
  * Replication adapter for WooCommerce products.
  *