@teleporthq/teleport-plugin-next-workflows 0.43.74 → 0.44.0

package/src/auth-generator.ts

@@ -13,6 +13,7 @@ import {
   generateLocalizedEmailCopyFn,
   WELCOME_EMAIL_CONFIG_KEYS,
 } from './transactional-email-code'
+import { TableAccess } from '@teleporthq/teleport-shared'
 import { generateSessionTokenResolverCode } from './session-cookie-resolver'
 
 // GUI provider id → the actual next-auth v4 provider MODULE name, for the few
@@ -1413,6 +1414,70 @@ const selfGuardedRoutePatternOf = (protection: {
   return base === '/' ? `/[${differentiator}]` : `${base}/[${differentiator}]`
 }
 
+/** The same-site path the project redirects `/` to, or null (absent, `/` itself, or off-site). */
+const resolveHomeRedirect = (auth: UIDLAuthentication): string | null => {
+  const value = typeof auth.homeRedirect === 'string' ? auth.homeRedirect : ''
+  const path = value.split('?')[0].split('#')[0]
+  if (!path.startsWith('/') || path.startsWith('//') || path.indexOf('\\') !== -1) {
+    return null
+  }
+  const normalized = path.length > 1 ? path.replace(/\/+$/, '') : path
+  return normalized === '/' ? null : normalized
+}
+
+/**
+ * Where a signed-in visitor without the role a page asks for lands. A project
+ * whose home page is not redirected keeps the code it always had. One that
+ * redirects `/` (e.g. to an admin dashboard) only sends a visitor home when
+ * that page admits them; otherwise to sign-in, saying why.
+ */
+const generateRoleDeniedRedirectCode = (
+  signInRoute: string,
+  homeRedirect: string | null
+): string => {
+  if (!homeRedirect) {
+    return `// Where to send an authenticated user who lacks the required role. Normally the
+// home page ("you don't have access, here's the public site"). But when "/" is
+// itself a protected page (e.g. an admin dashboard published at the root), a
+// redirect to "/" re-enters this middleware and loops forever — so fall back to
+// the sign-in page (with a callbackUrl) in that case.
+function roleDeniedRedirect(request, pathname) {
+  if (pathname !== '/' && !protectedRoutes['/']) {
+    return redirectWithinLocale(request, '/');
+  }
+  return redirectWithinLocale(request, '${signInRoute}', pathname);
+}`
+  }
+  return `// The project redirects "/" here before this middleware ever runs.
+var homeRedirect = ${JSON.stringify(homeRedirect)};
+
+// Whether "/" is a way out for this visitor: the page it redirects to is not
+// the one being left, and admits their role. Otherwise sending them home would
+// land them right back on a page that refuses them — a redirect loop.
+function homeAdmitsRole(pathname, userRole) {
+  var landing = normalizeMatchPath(homeRedirect);
+  if (landing === normalizeMatchPath(pathname)) return false;
+  var protection = resolveProtection(landing).matched;
+  if (!protection) return true;
+  if (protection.requiresSubscription) return false;
+  var roles = protection.allowedRoles || [];
+  return roles.length === 0 || roles.indexOf(userRole) >= 0;
+}
+
+// Where to send an authenticated user who lacks the required role: home when
+// home admits them, else the sign-in page, which is told why (error=forbidden)
+// and keeps a callbackUrl for an account that may open the page.
+function roleDeniedRedirect(request, pathname, userRole) {
+  if (pathname !== '/' && !protectedRoutes['/'] && homeAdmitsRole(pathname, userRole)) {
+    return redirectWithinLocale(request, '/');
+  }
+  var target = new URL(localizePathname(request, '${signInRoute}'), request.url);
+  target.searchParams.set('callbackUrl', localizePathname(request, pathname));
+  target.searchParams.set('error', 'forbidden');
+  return NextResponse.redirect(target);
+}`
+}
+
 export const generateMiddlewareFile = (
   auth: UIDLAuthentication,
   options: MiddlewareOptions = {}
@@ -1506,20 +1571,19 @@ export const generateMiddlewareFile = (
     delete protectedRoutes[route]
   }
 
-  let sawAdminRoute = false
-  let adminRoles: string[] = ['admin']
-  for (const k of Object.keys(protectedRoutes)) {
-    if (k === '/admin' || k.indexOf('/admin/') === 0) {
-      sawAdminRoute = true
-      const ar = protectedRoutes[k]?.allowedRoles
-      if (ar && ar.length > 0) {
-        adminRoles = ar
-        break
-      }
-    }
-  }
+  // `/admin` itself, and every admin page the map has no entry for (one an
+  // owner added without protection), admit the admin panel's own roles — its
+  // folder's — never the first admin route's, which may also admit another
+  // role (a staff dashboard).
+  const sawAdminRoute = Object.keys(protectedRoutes).some(
+    (k) => k === '/admin' || k.indexOf('/admin/') === 0
+  )
   if (sawAdminRoute && !protectedRoutes['/admin']) {
-    protectedRoutes['/admin'] = { requiresAuth: true, allowedRoles: adminRoles }
+    const panelRoles = TableAccess.resolveAdminPanelRoles(auth)
+    protectedRoutes['/admin'] = {
+      requiresAuth: true,
+      allowedRoles: panelRoles.length > 0 ? panelRoles : ['admin'],
+    }
   }
 
   const protectedRoutesJson = JSON.stringify(protectedRoutes, null, 2)
@@ -1530,6 +1594,7 @@ export const generateMiddlewareFile = (
     options.subscriptionFallbackRoute && options.subscriptionFallbackRoute.startsWith('/')
       ? options.subscriptionFallbackRoute
       : '/'
+  const homeRedirect = resolveHomeRedirect(auth)
 
   return `import { NextResponse } from 'next/server';
 import { getToken } from 'next-auth/jwt';
@@ -1642,17 +1707,7 @@ function redirectWithinLocale(request, pathname, callbackPath) {
   return NextResponse.redirect(target);
 }
 
-// Where to send an authenticated user who lacks the required role. Normally the
-// home page ("you don't have access, here's the public site"). But when "/" is
-// itself a protected page (e.g. an admin dashboard published at the root), a
-// redirect to "/" re-enters this middleware and loops forever — so fall back to
-// the sign-in page (with a callbackUrl) in that case.
-function roleDeniedRedirect(request, pathname) {
-  if (pathname !== '/' && !protectedRoutes['/']) {
-    return redirectWithinLocale(request, '/');
-  }
-  return redirectWithinLocale(request, '${signInRoute}', pathname);
-}
+${generateRoleDeniedRedirectCode(signInRoute, homeRedirect)}
 
 // Route keys carry no trailing slash, so neither may the path we match with.
 // Next.js serves "/orders/ORD-42/" and "/orders/ORD-42" as the same route;
@@ -1839,7 +1894,7 @@ async function middleware(request) {
     }
     var userRole = getUserRoleFromToken(sessionUser);
     if (userRole == null || allowedRoles.indexOf(userRole) < 0) {
-      return roleDeniedRedirect(request, pathname);
+      return roleDeniedRedirect(request, pathname${homeRedirect ? ', userRole' : ''});
     }
   }
 

package/src/booking-calendar-feed-route-generator.ts

@@ -0,0 +1,293 @@
+/**
+ * The bookings' calendar feeds: `pages/api/bookings/ical/[file].js`, emitted
+ * when the UIDL carries `bookingCalendars.feedStatement`.
+ *
+ * Each calendar link of a site's bookings is an iCalendar (RFC 5545) feed that
+ * Airbnb, Booking.com, Vrbo or Google Calendar import to block the dates the
+ * site has booked. The editor builds the one statement behind every feed (its
+ * tables and columns are the editor's business); the generated route only runs
+ * it with the link's key and writes the rows out as a calendar.
+ */
+import { FileType, ProjectPluginStructure } from '@teleporthq/teleport-types'
+import { generatePgClientCode } from './pg-client-code'
+import { getDatabaseDriverDependencies } from './auth-generator'
+
+/**
+ * The route's source (CommonJS). GET or HEAD `/api/bookings/ical/<key>.ics`:
+ *  - another method → 405 with `Allow: GET, HEAD`;
+ *  - a key of the wrong shape, or one the statement returns no calendar row
+ *    for → 404 (the key is the link's only credential, so both look the same);
+ *  - a failed query → 500 'Calendar unavailable', the cause logged only;
+ *  - else 200 with the calendar, never cached. An event row with a missing or
+ *    invalid value is left out rather than failing the whole feed.
+ */
+export const generateBookingCalendarFeedRoute = (feedStatement: string): string => {
+  return `'use strict';
+
+// GENERATED — see generateBookingCalendarFeedRoute in
+// @teleporthq/teleport-plugin-next-workflows/src/booking-calendar-feed-route-generator.ts.
+//
+// The iCalendar feed of one calendar link of the site's bookings: Airbnb,
+// Booking.com, Vrbo or Google Calendar poll it and block the booked dates.
+${generatePgClientCode()}
+
+// Built by the editor: $1 is the link's key. It returns one 'calendar' row and
+// one 'event' row per blocked period.
+var FEED_STATEMENT = ${JSON.stringify(feedStatement)};
+var FEED_FILE_RE = /^([A-Za-z0-9_-]{20,80})[.]ics$/;
+var DATE_RE = /^([0-9]{4})([0-9]{2})([0-9]{2})$/;
+var DATE_TIME_RE = /^([0-9]{4})([0-9]{2})([0-9]{2})T([0-9]{2})([0-9]{2})([0-9]{2})Z$/;
+var TEXT_TYPE = 'text/plain; charset=utf-8';
+var CALENDAR_TYPE = 'text/calendar; charset=utf-8';
+var CRLF = String.fromCharCode(13, 10);
+var BACKSLASH = String.fromCharCode(92);
+// RFC 5545: a content line is at most 75 octets, the line break excluded.
+var MAX_LINE_OCTETS = 75;
+
+// RFC 5545 TEXT: a backslash, semicolon or comma is escaped with a backslash
+// and every line break is written as the two characters backslash and n.
+// Other control characters are not allowed in TEXT, so they are dropped.
+function icalText(value) {
+  var text = String(value == null ? '' : value);
+  var out = '';
+  for (var i = 0; i < text.length; i++) {
+    var ch = text.charAt(i);
+    var code = text.charCodeAt(i);
+    if (ch === BACKSLASH || ch === ';' || ch === ',') {
+      out += BACKSLASH + ch;
+    } else if (code === 13 || code === 10) {
+      // CRLF, a lone CR and a lone LF are each one line break.
+      if (code === 13 && text.charCodeAt(i + 1) === 10) {
+        i += 1;
+      }
+      out += BACKSLASH + 'n';
+    } else if (code === 9 || (code >= 32 && code !== 127)) {
+      out += ch;
+    }
+  }
+  return out;
+}
+
+// One content line, folded: a continuation line starts with one space (which
+// counts toward its 75 octets), and no fold splits a UTF-8 character.
+function icalFold(line) {
+  var out = '';
+  var used = 0;
+  for (var i = 0; i < line.length; i++) {
+    var ch = line.charAt(i);
+    var code = line.charCodeAt(i);
+    var octets = code < 0x80 ? 1 : code < 0x800 ? 2 : 3;
+    if (code >= 0xd800 && code <= 0xdbff) {
+      var low = line.charCodeAt(i + 1);
+      if (low >= 0xdc00 && low <= 0xdfff) {
+        // A surrogate pair is one 4-octet character.
+        ch = line.slice(i, i + 2);
+        octets = 4;
+        i += 1;
+      }
+    }
+    if (used + octets > MAX_LINE_OCTETS) {
+      out += CRLF + ' ';
+      used = 1;
+    }
+    out += ch;
+    used += octets;
+  }
+  return out + CRLF;
+}
+
+// all_day as Postgres hands it over: a boolean, or 't' / 'f' / 'true' / 'false'.
+// null for anything else.
+function icalAllDay(value) {
+  if (value === true || value === false) {
+    return value;
+  }
+  var text = String(value == null ? '' : value).trim().toLowerCase();
+  if (text === 't' || text === 'true') {
+    return true;
+  }
+  if (text === 'f' || text === 'false') {
+    return false;
+  }
+  return null;
+}
+
+// 'YYYYMMDD' (all day) or 'YYYYMMDDTHHMMSSZ' naming a real day and time, else
+// null — a value like 20260231 would otherwise reach the importing calendar.
+function icalDateValue(value, allDay) {
+  if (typeof value !== 'string') {
+    return null;
+  }
+  var text = value.trim();
+  var match = (allDay ? DATE_RE : DATE_TIME_RE).exec(text);
+  if (!match) {
+    return null;
+  }
+  var parts = [];
+  for (var i = 1; i <= 6; i++) {
+    parts.push(allDay && i > 3 ? 0 : Number(match[i]));
+  }
+  var date = new Date(Date.UTC(parts[0], parts[1] - 1, parts[2], parts[3], parts[4], parts[5]));
+  var actual = [
+    date.getUTCFullYear(),
+    date.getUTCMonth() + 1,
+    date.getUTCDate(),
+    date.getUTCHours(),
+    date.getUTCMinutes(),
+    date.getUTCSeconds(),
+  ];
+  return actual.join(',') === parts.join(',') ? text : null;
+}
+
+// The VEVENT lines of one event row, or null when a value is missing or invalid.
+function icalEventLines(row, stamp) {
+  var uid = row.uid == null ? '' : String(row.uid).trim();
+  var allDay = icalAllDay(row.all_day);
+  if (uid === '' || allDay === null) {
+    return null;
+  }
+  var start = icalDateValue(row.start_value, allDay);
+  var end = icalDateValue(row.end_value, allDay);
+  // The end is exclusive, so it must come after the start. Two values of the
+  // same format compare correctly as strings.
+  if (start === null || end === null || end <= start) {
+    return null;
+  }
+  var valueParam = allDay ? ';VALUE=DATE:' : ':';
+  return [
+    'BEGIN:VEVENT',
+    'UID:' + icalText(uid),
+    'DTSTAMP:' + stamp,
+    'DTSTART' + valueParam + start,
+    'DTEND' + valueParam + end,
+    'SUMMARY:' + icalText(row.summary),
+    'TRANSP:OPAQUE',
+    'END:VEVENT',
+  ];
+}
+
+// 'YYYYMMDDTHHMMSSZ' of an instant, in UTC.
+function icalStamp(date) {
+  var iso = date.toISOString();
+  return (
+    iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10) + 'T' +
+    iso.slice(11, 13) + iso.slice(14, 16) + iso.slice(17, 19) + 'Z'
+  );
+}
+
+function icalCalendar(calendarRow, rows, now) {
+  var stamp = icalStamp(now);
+  var lines = [
+    'BEGIN:VCALENDAR',
+    'VERSION:2.0',
+    'PRODID:-//TeleportHQ//Bookings//EN',
+    'CALSCALE:GREGORIAN',
+    'METHOD:PUBLISH',
+    'X-WR-CALNAME:' + icalText(calendarRow.calendar_name),
+    'REFRESH-INTERVAL;VALUE=DURATION:PT30M',
+    'X-PUBLISHED-TTL:PT30M',
+  ];
+  for (var i = 0; i < rows.length; i++) {
+    if (rows[i] && rows[i].kind === 'event') {
+      var eventLines = icalEventLines(rows[i], stamp);
+      if (eventLines) {
+        lines = lines.concat(eventLines);
+      }
+    }
+  }
+  lines.push('END:VCALENDAR');
+  var body = '';
+  for (var j = 0; j < lines.length; j++) {
+    body += icalFold(lines[j]);
+  }
+  return body;
+}
+
+// Never cached: a booking can block a date between two polls. A HEAD request
+// gets the headers GET would, without the body.
+function icalSend(res, status, contentType, body, headOnly) {
+  res.statusCode = status;
+  res.setHeader('Content-Type', contentType);
+  res.setHeader('Cache-Control', 'no-store');
+  res.setHeader('Content-Length', String(Buffer.byteLength(body, 'utf8')));
+  if (headOnly) {
+    res.end();
+  } else {
+    res.end(body);
+  }
+}
+
+module.exports = async function handler(req, res) {
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    res.setHeader('Allow', 'GET, HEAD');
+    return icalSend(res, 405, TEXT_TYPE, 'Method not allowed', false);
+  }
+  var headOnly = req.method === 'HEAD';
+  var file = req.query && typeof req.query.file === 'string' ? req.query.file : '';
+  var fileMatch = FEED_FILE_RE.exec(file);
+  if (!fileMatch) {
+    return icalSend(res, 404, TEXT_TYPE, 'Not found', headOnly);
+  }
+
+  var rows = null;
+  var client = null;
+  try {
+    client = getClient();
+    await client.connect();
+    var result = await client.query(FEED_STATEMENT, [fileMatch[1]]);
+    rows = result && Array.isArray(result.rows) ? result.rows : [];
+  } catch (e) {
+    console.error('[bookings-ical] calendar feed query failed:', e && e.message ? e.message : e);
+  } finally {
+    if (client) {
+      try { await client.end(); } catch (e) {}
+    }
+  }
+  if (rows === null) {
+    return icalSend(res, 500, TEXT_TYPE, 'Calendar unavailable', headOnly);
+  }
+
+  var calendarRow = null;
+  for (var i = 0; i < rows.length && calendarRow === null; i++) {
+    if (rows[i] && rows[i].kind === 'calendar') {
+      calendarRow = rows[i];
+    }
+  }
+  if (calendarRow === null) {
+    return icalSend(res, 404, TEXT_TYPE, 'Not found', headOnly);
+  }
+  res.setHeader('Content-Disposition', 'inline; filename="' + file + '"');
+  return icalSend(res, 200, CALENDAR_TYPE, icalCalendar(calendarRow, rows, new Date()), headOnly);
+};
+`
+}
+
+/**
+ * Emits the feed route when the UIDL names a feed statement, plus the `pg`
+ * driver it connects with (already present on a project with a Teleport
+ * database, which every bookings site has).
+ */
+export const generateBookingCalendarFeedFiles = (structure: ProjectPluginStructure): void => {
+  const feedStatement = structure.uidl.bookingCalendars?.feedStatement
+  if (typeof feedStatement !== 'string' || feedStatement.trim() === '') {
+    return
+  }
+
+  structure.files.set('bookings-ical-feed-route', {
+    path: ['pages', 'api', 'bookings', 'ical'],
+    files: [
+      {
+        name: '[file]',
+        fileType: FileType.JS,
+        content: generateBookingCalendarFeedRoute(feedStatement),
+      },
+    ],
+  })
+
+  const driverDependencies = getDatabaseDriverDependencies('teleport')
+  for (const [pkg, version] of Object.entries(driverDependencies)) {
+    if (!structure.dependencies[pkg]) {
+      structure.dependencies[pkg] = version
+    }
+  }
+}

package/src/data-api-route-generator.ts

@@ -13,7 +13,7 @@
 
 import { generateSqlValidatorCode } from './sql-validator'
 import { generateCommonJsSessionTokenResolverCode } from './session-cookie-resolver'
-import { TableAccess } from '@teleporthq/teleport-shared'
+import { ContentTables, TableAccess } from '@teleporthq/teleport-shared'
 
 const DATA_NODE_TYPES = new Set([
   'data-select',
@@ -79,28 +79,18 @@ export const BROWSER_READABLE_TABLES: ReadonlyArray<string> = [
   'teleport_shipping_rates',
   'teleport_tax_rates',
   'teleport_store_locations',
-  'teleport_blog_posts',
+  ...ContentTables.CONTENT_POSTS_TABLES,
 ]
 
 /**
  * What a browser is served of the readable tables whose unpublished rows sit
- * beside the public ones — the same policy the per-table read routes apply
- * (teleport-plugin-next-data-source `browser-row-policy.ts`, which this mirrors;
- * keep the two in step). A browser may not filter or sort by a hidden column:
- * a filter is an oracle for a column it never returns.
+ * beside the public ones — the same map the per-table read routes apply
+ * (teleport-plugin-next-data-source `browser-row-policy.ts`): both read it from
+ * teleport-shared. A browser may not filter or sort by a hidden column: a
+ * filter is an oracle for a column it never returns.
  */
-export const BROWSER_ROW_POLICIES: Readonly<
-  Record<string, { predicate: string; hiddenColumns: ReadonlyArray<string> }>
-> = {
-  teleport_blog_posts: {
-    predicate: "status = 'published'",
-    hiddenColumns: ['author_email', 'authorEmail'],
-  },
-  teleport_products: {
-    predicate: "LOWER(TRIM(status)) = 'active'",
-    hiddenColumns: [],
-  },
-}
+export const BROWSER_ROW_POLICIES: Readonly<Record<string, ContentTables.VisitorRowPolicy>> =
+  ContentTables.VISITOR_ROW_POLICIES
 
 export const generateDataAPIRoute = (options: DataAPIRouteOptions = {}): string => {
   const validatorCode = generateSqlValidatorCode()
@@ -111,7 +101,12 @@ export const generateDataAPIRoute = (options: DataAPIRouteOptions = {}): string
       ? options.lowStockThreshold
       : 5
 
-  return `const { Client } = require('pg');
+  return `const { Client, types: pgTypes } = require('pg');
+// A DATE stays the day it names, whatever the server's time zone: node-pg would read it as
+// local midnight, which a server east of UTC sends as the day before.
+if (pgTypes && typeof pgTypes.setTypeParser === 'function') {
+  pgTypes.setTypeParser(1082, (value) => value);
+}
 ${
   // The session cookie is resolved from the REQUEST rather than from
   // process.env.NEXTAUTH_URL — see session-cookie-resolver.ts. Reading it the

package/src/executor-generator.ts

@@ -387,8 +387,19 @@ function applyTemplateParams(text, params) {
 function finalizeResolvedConfig(nodeType, config) {
   var isDataNode = typeof nodeType === 'string' && nodeType.indexOf('data-') === 0;
   var error = null;
+  // A config value may be a live element (a trigger's target handed to a
+  // custom-js node) or an object that refers back to itself: walking into a
+  // DOM node follows its React fibers forever (a page's every element-bound
+  // behavior died with "Maximum call stack size exceeded"). Elements are
+  // left as they are; an object is walked once.
+  var seen = typeof WeakSet === 'function' ? new WeakSet() : null;
   function walk(obj, insideFilters) {
     if (!obj || typeof obj !== 'object') return;
+    if (typeof obj.nodeType === 'number' && typeof obj.nodeName === 'string') return;
+    if (seen) {
+      if (seen.has(obj)) return;
+      seen.add(obj);
+    }
     if (Array.isArray(obj)) {
       for (var ai = 0; ai < obj.length; ai++) walk(obj[ai], insideFilters);
       return;
@@ -1398,15 +1409,31 @@ var SEGMENT_REPLY_PRIVATE_KEYS = {
 // be echoed back wholesale (every earlier node's result, the trigger, the whole
 // page state), so each round trip carried the page twice over and the network
 // tab showed every node's data on every hop.
+//
+// A node marked \`keepResultOnServer\` is the exception: its result serves the
+// nodes after it in the same segment and never leaves the server (a statement's
+// rows read only to build what the browser may see, a sender's recipients).
+// Nothing in a later segment can read it.
+// The nodes whose result the client branches on: never kept on the server.
+function isBranchingNodeType(type) {
+  return type === 'general-if-statement' || type === 'general-switch';
+}
+
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = {};
   var own = {};
+  var kept = {};
   var nodes = (segmentConfig && segmentConfig.nodes) || [];
-  for (var ni = 0; ni < nodes.length; ni++) own[nodes[ni].id] = true;
+  for (var ni = 0; ni < nodes.length; ni++) {
+    own[nodes[ni].id] = true;
+    if (nodes[ni].config && nodes[ni].config.keepResultOnServer === true && !isBranchingNodeType(nodes[ni].type)) {
+      kept[nodes[ni].id] = true;
+    }
+  }
   var keys = Object.keys(context);
   for (var i = 0; i < keys.length; i++) {
     var key = keys[i];
-    if (SEGMENT_REPLY_PRIVATE_KEYS[key]) continue;
+    if (SEGMENT_REPLY_PRIVATE_KEYS[key] || kept[key]) continue;
     var value = context[key];
     if (value === undefined) continue;
     if (own[key] || !snapshot || !Object.prototype.hasOwnProperty.call(snapshot, key)) {
@@ -1497,6 +1524,7 @@ module.exports = {
   fatalNodeResultMessage,
   continuesOnError,
   isFireAndForgetNode,
+  isBranchingNodeType,
   startFireAndForgetNode,
   registerPendingNodePromise,
   settlePendingNodePromises

package/src/index.ts

@@ -57,6 +57,7 @@ export { generateWebhookFiles } from './webhook-generator'
 export {
   declarePaymentCredentialEnv,
   ensurePaymentDriversModule,
+  readUidlPaymentProviders,
   resolveStorePaymentDriverIds,
 } from './payments'
 export {

package/src/invoice/invoice-assembly-code.ts

@@ -33,6 +33,34 @@ var TEMPLATE_DOCUMENT = ${templateDocumentJson};
 ${REGIONAL_INVOICE_TAX_CODE}
 ${ProductOptions.generateProductOptionsHelperCode()}
 
+// The invoice details an order's metadata (JSON text) carries beside its
+// billing columns — the keys \`ORDER_BILLING_METADATA_KEYS\` (teleport-gui)
+// writes: the address in its parts and the buyer's tax or VAT number. Every
+// part is '' when the order has none or its metadata is no JSON object.
+function readOrderBillingMetadata(raw) {
+  var parsed = raw;
+  if (typeof raw === 'string') {
+    try {
+      parsed = JSON.parse(raw);
+    } catch (e) {
+      parsed = null;
+    }
+  }
+  var meta = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  function part(key) {
+    var value = meta[key];
+    return value === null || value === undefined ? '' : String(value).trim();
+  }
+  return {
+    taxId: part('billingTaxId'),
+    street: part('billingStreet'),
+    city: part('billingCity'),
+    postalCode: part('billingPostalCode'),
+    region: part('billingRegion'),
+    country: part('billingCountry'),
+  };
+}
+
 // The product options an order line was bought with: the short one-line label
 // (after the name) and every answer in full, one per line (the description).
 // Same rule as the order emails: a current snapshot names its options, while
@@ -416,15 +444,27 @@ function assembleInvoiceData(body, hydratedOrder, hydratedItems) {
   // field but the order has one, use it. Kept permissive on field
   // names (billing_* wins, falls back to shipping_*) because a buyer
   // who checked "bill to a different address" has both on the order.
+  //
+  // An order whose buyer gave invoice details of their own (a booking's
+  // "Add invoice details") carries them in its metadata as well: the address
+  // in its parts and the tax or VAT number. Those parts are the invoice's
+  // address — never mixed with a shipping address — and the number is the
+  // buyer's VAT.
   var orderRow = orderShippingSource;
+  var orderBilling = readOrderBillingMetadata(orderRow.metadata);
+  var billedApart = !!(orderBilling.street || orderBilling.city || orderBilling.country);
   var fallbackCustomerName =
     orderRow.billing_name || orderRow.shipping_name || orderRow.customer_name || '';
   var fallbackCustomerEmail = orderRow.billing_email || orderRow.customer_email || '';
-  var fallbackCustomerAddress = orderRow.billing_address || orderRow.shipping_address || '';
-  var fallbackCustomerCity = orderRow.shipping_city || '';
-  var fallbackCustomerState = orderRow.shipping_state || '';
-  var fallbackCustomerZip = orderRow.shipping_zip || '';
-  var fallbackCustomerCountry = orderRow.shipping_country || '';
+  var fallbackCustomerAddress = billedApart
+    ? orderBilling.street
+    : orderRow.billing_address || orderRow.shipping_address || '';
+  var fallbackCustomerCity = billedApart ? orderBilling.city : orderRow.shipping_city || '';
+  var fallbackCustomerState = billedApart ? orderBilling.region : orderRow.shipping_state || '';
+  var fallbackCustomerZip = billedApart ? orderBilling.postalCode : orderRow.shipping_zip || '';
+  var fallbackCustomerCountry = billedApart
+    ? orderBilling.country
+    : orderRow.shipping_country || '';
   var fallbackPaymentMethod = orderRow.payment_method || '';
   var fallbackPaymentProvider = orderRow.payment_provider || '';
   var fallbackPaymentIntentId = orderRow.payment_intent_id || '';
@@ -446,7 +486,7 @@ function assembleInvoiceData(body, hydratedOrder, hydratedItems) {
     customerState: body.customerState || fallbackCustomerState || '',
     customerZip: body.customerZip || fallbackCustomerZip || '',
     customerCountry: body.customerCountry || fallbackCustomerCountry || '',
-    customerVat: body.customerVat || '',
+    customerVat: body.customerVat || orderBilling.taxId || '',
     companyName: pdfGenerator.COMPANY_DETAILS.companyName || '',
     companyAddress: pdfGenerator.COMPANY_DETAILS.companyAddress || '',
     companyCity: pdfGenerator.COMPANY_DETAILS.companyCity || '',

package/src/invoice/invoice-html-code.ts

@@ -355,6 +355,9 @@ function buildInvoiceDataScope(invoiceData) {
   // sample — right for a company address, wrong for a code or a card tail: an
   // order without a voucher must not print the designer's "SAVE20".
   var realInvoiceNeverSampled = { voucherCode: voucherCode, giftCardLast4: giftCardLast4 };
+  // The buyer and their payment are never sampled either: an order with no
+  // city (a booking, a pickup, a download) must not print the designer's
+  // sample customer's, nor a card it was not paid with.
 
   var realCustomer = {
     name: invoiceData.customerName || '',
@@ -366,6 +369,11 @@ function buildInvoiceDataScope(invoiceData) {
     country: invoiceData.customerCountry || '',
     vat: invoiceData.customerVat || '',
   };
+  // The "Bill to" lines a buyer may leave out show only when they did not
+  // (string flags: the template compares strings, as with \`hasShipping\`).
+  realCustomer.hasZip = realCustomer.zip ? 'true' : 'false';
+  realCustomer.hasCountry = realCustomer.country ? 'true' : 'false';
+  realCustomer.hasVat = realCustomer.vat ? 'true' : 'false';
 
   var realPayment = {
     method: invoiceData.paymentMethod || '',
@@ -462,8 +470,8 @@ function buildInvoiceDataScope(invoiceData) {
     invoiceData: {
       Company: mergeWithDefaults(realCompany, defaults.Company),
       Invoice: Object.assign(mergeWithDefaults(realInvoice, defaults.Invoice), realInvoiceNeverSampled),
-      Customer: mergeWithDefaults(realCustomer, defaults.Customer),
-      Payment: mergeWithDefaults(realPayment, defaults.Payment),
+      Customer: realCustomer,
+      Payment: realPayment,
       Products: realProducts.length > 0 ? realProducts : (defaults.Products || []),
     },
   };