@teleporthq/teleport-plugin-next-workflows 0.44.5 → 0.44.7

package/__tests__/credential-columns-reply.test.ts

@@ -0,0 +1,286 @@
+/* tslint:disable:function-constructor */
+import { TableAccess } from '@teleporthq/teleport-shared'
+import { generateDataAPIRoute } from '../src/data-api-route-generator'
+import {
+  generateServerSegmentAPIRoute,
+  generateStreamingServerSegmentAPIRoute,
+} from '../src/api-route-generator'
+import { generateSharedRuntimeUtilsCode } from '../src/executor-generator'
+import type { WorkflowSegment } from '../src/types'
+import { loadServerRuntime } from './_helpers/load-server-runtime'
+
+/**
+ * The auth users table's credentials — the password hash and the OAuth tokens
+ * (`TableAccess.AUTH_CREDENTIAL_COLUMNS`) — never leave the server in a row.
+ * A browser read of the data route was already served without them; a create
+ * or an update answered the whole row it wrote, and a server segment replied
+ * its data nodes' rows to the browser as they came.
+ */
+
+const SECRET = 'server-secret'
+
+const USER_ROW = {
+  id: 'u-1',
+  email: 'member@example.com',
+  name: 'Member',
+  password: '$2a$10$hash',
+  access_token: 'oauth-access',
+  refresh_token: 'oauth-refresh',
+  id_token: 'oauth-id',
+  session_state: 'state',
+  token_type: 'Bearer',
+  scope: 'openid email',
+  expires_at: 1767225600,
+}
+
+const PROFILE = { id: 'u-1', email: 'member@example.com', name: 'Member' }
+
+function bootDataRoute(rows: Array<Record<string, unknown>>) {
+  const code = generateDataAPIRoute({ authUsersTableName: 'users' })
+  class FakeClient {
+    public async connect(): Promise<void> {
+      return
+    }
+    public async end(): Promise<void> {
+      return
+    }
+    public async query(sql: string): Promise<{ rows: unknown[]; rowCount: number }> {
+      if (/information_schema/i.test(sql)) {
+        return { rows: [], rowCount: 0 }
+      }
+      return { rows, rowCount: rows.length }
+    }
+  }
+  const moduleObj: { exports: any } = { exports: {} }
+  const fakeRequire = (name: string): unknown => {
+    if (name === 'pg') {
+      return { Client: FakeClient }
+    }
+    if (name === 'next-auth/jwt') {
+      return { getToken: async () => ({ id: 'u-1' }) }
+    }
+    throw new Error('unexpected require: ' + name)
+  }
+  new Function('require', 'module', 'exports', 'process', 'console', code)(
+    fakeRequire,
+    moduleObj,
+    moduleObj.exports,
+    { env: { NEXTAUTH_SECRET: SECRET, TELEPORT_DB_CONNECTION_STRING: 'postgresql://x' } },
+    { error: (): void => undefined, warn: (): void => undefined, log: (): void => undefined }
+  )
+  return async (operation: string, body: Record<string, unknown>, headers = {}) => {
+    let status = 0
+    let payload: any = null
+    const res = {
+      status(statusCode: number) {
+        status = statusCode
+        return this
+      },
+      json(value: unknown) {
+        payload = value
+        return this
+      },
+    }
+    await moduleObj.exports(
+      { method: 'POST', query: { params: ['ds-1', operation] }, headers, body },
+      res
+    )
+    return { status, body: payload }
+  }
+}
+
+const internal = { 'x-internal-data-secret': SECRET }
+
+describe('data route — the row a create or update answers with', () => {
+  it('leaves the credentials out of a created users row, for the server caller too', async () => {
+    const route = bootDataRoute([USER_ROW])
+    const reply = await route(
+      'create',
+      { tableName: 'users', columnMappings: [{ column: 'email', value: 'member@example.com' }] },
+      internal
+    )
+    expect(reply.status).toBe(200)
+    expect(reply.body).toEqual({ item: PROFILE, id: 'u-1' })
+  })
+
+  it('leaves them out of an updated users row, however the table is spelled', async () => {
+    const route = bootDataRoute([USER_ROW])
+    for (const tableName of ['users', 'public.users', '"users"']) {
+      const reply = await route(
+        'update',
+        {
+          tableName,
+          filters: [{ field: 'id', operator: '=', value: 'u-1' }],
+          columnMappings: [{ column: 'name', value: 'Member' }],
+        },
+        internal
+      )
+      expect(reply.status).toBe(200)
+      expect(reply.body).toEqual({ updatedCount: 1, item: PROFILE, id: 'u-1' })
+    }
+  })
+
+  it("keeps another table's columns, even ones named like a credential elsewhere", async () => {
+    const card = { id: 'g-1', code: 'GIFT', expires_at: '2027-01-01', scope: 'store' }
+    const route = bootDataRoute([card])
+    const reply = await route(
+      'create',
+      { tableName: 'teleport_gift_cards', columnMappings: [{ column: 'code', value: 'GIFT' }] },
+      internal
+    )
+    expect(reply.body).toEqual({ item: card, id: 'g-1' })
+  })
+})
+
+interface SegmentReply {
+  status: number
+  body: { success: boolean; results?: Record<string, any>; error?: string }
+}
+
+function bootSegment(segment: WorkflowSegment, dataReplies: Record<string, unknown>) {
+  const source = generateServerSegmentAPIRoute(segment, 'Credentials')
+  const runtime = loadServerRuntime()
+  const routeModule: { exports: unknown } = { exports: {} }
+  new Function('module', 'exports', 'require', source)(
+    routeModule,
+    routeModule.exports,
+    (id: string) => (id.endsWith('server-runtime') ? runtime : {})
+  )
+  const handler = routeModule.exports as (req: unknown, res: unknown) => Promise<void>
+  return async (): Promise<SegmentReply> => {
+    const originalFetch = globalThis.fetch
+    globalThis.fetch = (async (url: string) => ({
+      ok: true,
+      status: 200,
+      json: async () => dataReplies[String(url).split('/').pop() as string],
+    })) as unknown as typeof fetch
+    try {
+      const reply: SegmentReply = { status: 0, body: { success: false } }
+      const res = {
+        status(code: number) {
+          reply.status = code
+          return this
+        },
+        json(payload: SegmentReply['body']) {
+          reply.body = payload
+          return this
+        },
+      }
+      await handler(
+        { method: 'POST', body: { context: {} }, headers: { host: 'shop.example' } },
+        res
+      )
+      return reply
+    } finally {
+      globalThis.fetch = originalFetch
+    }
+  }
+}
+
+const step = (id: string, type: string, stepNumber: number, config: Record<string, unknown>) => ({
+  id,
+  type,
+  label: id,
+  executionEnv: 'server' as const,
+  stepNumber,
+  config,
+})
+
+const segmentOf = (nodes: Array<ReturnType<typeof step>>): WorkflowSegment => ({
+  id: 'server-1',
+  env: 'server',
+  nodeIds: nodes.map((node) => node.id),
+  nodes,
+  edges: nodes.slice(1).map((node, index) => ({
+    id: `e${index}`,
+    source: nodes[index].id,
+    target: node.id,
+  })) as WorkflowSegment['edges'],
+  entryNodeIds: [nodes[0].id],
+})
+
+describe('server segment — the rows it replies to the browser with', () => {
+  const secret = process.env.NEXTAUTH_SECRET
+  beforeAll(() => {
+    process.env.NEXTAUTH_SECRET = SECRET
+  })
+  afterAll(() => {
+    process.env.NEXTAUTH_SECRET = secret
+  })
+
+  it('replies a data node of the users table without its credentials', async () => {
+    const segment = segmentOf([
+      step('read', 'data-select', 1, { dataSourceId: 'ds-1', tableName: 'users' }),
+      step('save', 'data-update-item', 2, {
+        dataSourceId: 'ds-1',
+        tableName: 'users',
+        filters: [{ field: 'id', operator: '=', value: 'u-1' }],
+        columnMappings: [{ column: 'name', value: 'Member' }],
+      }),
+    ])
+    const reply = await bootSegment(segment, {
+      select: { rows: [USER_ROW], count: 1 },
+      update: { item: USER_ROW, id: 'u-1', updatedCount: 1 },
+    })()
+    expect(reply.status).toBe(200)
+    const results = reply.body.results || {}
+    expect(results.read).toEqual({ rows: [PROFILE], count: 1 })
+    expect(results.save).toEqual({ ...PROFILE, updatedCount: 1, affected: 1 })
+    expect(JSON.stringify(results)).not.toMatch(/hash|oauth-/)
+  })
+
+  it("strips a raw statement's rows of the credentials no other table uses", async () => {
+    const segment = segmentOf([
+      step('raw', 'data-raw-query', 1, { dataSourceId: 'ds-1', query: 'SELECT * FROM users' }),
+    ])
+    const reply = await bootSegment(segment, { 'raw-query': { rows: [USER_ROW] } })()
+    const row = { ...PROFILE, scope: 'openid email', expires_at: 1767225600 }
+    expect(reply.body.results?.raw).toEqual({ rows: [row], result: [row] })
+  })
+
+  it("leaves another table's rows, and every node that reads no rows, as they are", async () => {
+    const card = { id: 'g-1', expires_at: '2027-01-01', scope: 'store' }
+    const segment = segmentOf([
+      step('cards', 'data-select', 1, { dataSourceId: 'ds-1', tableName: 'teleport_gift_cards' }),
+      step('form', 'general-custom-js', 2, {
+        code: 'function customHandler(params) { return { password: "typed" } }',
+        context: 'server',
+      }),
+    ])
+    const reply = await bootSegment(segment, { select: { rows: [card], count: 1 } })()
+    expect(reply.body.results?.cards).toEqual({ rows: [card], count: 1 })
+    expect(reply.body.results?.form).toEqual({ password: 'typed' })
+  })
+
+  it('signs the result it replies, so a later segment can verify what the browser holds', async () => {
+    const segment = segmentOf([
+      step('read', 'data-select', 1, { dataSourceId: 'ds-1', tableName: 'users' }),
+    ])
+    const reply = await bootSegment(segment, { select: { rows: [USER_ROW], count: 1 } })()
+    const later = loadServerRuntime()
+    const context: Record<string, unknown> = { ...reply.body.results }
+    later.claimSegmentContext({ signedNodeIds: ['read'], nodes: [], edges: [] }, context)
+    expect(context.read).toEqual({ rows: [PROFILE], count: 1 })
+  })
+})
+
+describe('one credential list', () => {
+  it('is the shared AUTH_CREDENTIAL_COLUMNS, in the runtime and in a streamed node result', () => {
+    const runtime = generateSharedRuntimeUtilsCode()
+    expect(runtime).toContain(JSON.stringify(TableAccess.AUTH_CREDENTIAL_COLUMNS))
+    expect(runtime).toContain(JSON.stringify(TableAccess.UNAMBIGUOUS_CREDENTIAL_COLUMNS))
+    const streaming = generateStreamingServerSegmentAPIRoute(
+      segmentOf([step('ai', 'ai-custom-prompt', 1, { streaming: true })])
+    )
+    expect(streaming).toContain('utils.withoutCredentialColumns(kept, result)')
+  })
+
+  it('strips a streamed data node the same way the reply does', () => {
+    const utils = loadServerRuntime()
+    const node = { id: 'read', type: 'data-select', config: { tableName: 'users' } }
+    expect(utils.withoutCredentialColumns(node, { rows: [USER_ROW], count: 1 })).toEqual({
+      rows: [PROFILE],
+      count: 1,
+    })
+  })
+})

package/__tests__/invoice-paid-status.test.ts

@@ -0,0 +1,382 @@
+/* tslint:disable:function-constructor */
+import { generateInvoiceAssemblyCode } from '../src/invoice/invoice-assembly-code'
+import { generatePdfGeneratorCode } from '../src/invoice/pdf-generator-code'
+import type { UIDLInvoiceSettings } from '@teleporthq/teleport-types'
+import { evaluateEmittedModule } from './_helpers/load-invoice-route'
+
+/**
+ * What the invoice says about being paid, and how it writes money.
+ *
+ * A store invoices an order the moment its payment webhook marks it paid, so
+ * that invoice — its email and its PDF — must not ask for a payment already
+ * made: no due date, no amount due. A cash-on-delivery order is invoiced
+ * unpaid when it is placed and keeps both. A summary line whose amount is zero
+ * (no delivery, no discount, no tax, no gift card) is left out. And an empty
+ * field on the real invoice prints nothing — never the design canvas's sample.
+ *
+ * Every piece below is the EMITTED code, run: the assembly the generate route
+ * builds the invoice with, then the renderer the email and the PDF go through
+ * (`email-sender-code.ts` fills the body with `buildDataContext` +
+ * `replacePlaceholders`).
+ */
+
+const SETTINGS = {
+  invoicePrefix: 'INV-',
+  defaultTaxRate: 0,
+  showDiscount: false,
+  taxIncludedInPrice: false,
+  companyDetails: {},
+  template: { document: null as unknown },
+  tables: { invoicesTable: 'teleport_invoices', invoiceItemsTable: 'teleport_invoice_items' },
+  emailDelivery: { enabled: false },
+} as unknown as UIDLInvoiceSettings
+
+type Row = Record<string, unknown>
+
+interface AssemblyModule {
+  assembleInvoiceData: (body: Row, order: Row | null, items: Row[]) => Row
+}
+
+interface PdfGeneratorModule {
+  buildInvoiceDataScope: (invoiceData: Row) => {
+    invoiceData: { Invoice: Record<string, string>; Company: Record<string, string> }
+  }
+  buildInvoiceHtml: (invoiceData: Row) => string
+  replacePlaceholders: (template: string, data: Row) => string
+  buildDataContext: (invoiceData: Row) => Row
+}
+
+function loadAssembly(): AssemblyModule {
+  const requireFn = ((id: string) => {
+    if (id.indexOf('pdf-generator') !== -1) {
+      return { COMPANY_DETAILS: {} }
+    }
+    if (id.indexOf('data-access') !== -1) {
+      return {}
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    return require(id)
+  }) as unknown as NodeRequire
+  return evaluateEmittedModule<AssemblyModule>(generateInvoiceAssemblyCode(SETTINGS), requireFn)
+}
+
+function loadPdfGenerator(templateUidl: unknown = null): PdfGeneratorModule {
+  return evaluateEmittedModule<PdfGeneratorModule>(
+    generatePdfGeneratorCode(SETTINGS, templateUidl, templateUidl ? {} : null),
+    require
+  )
+}
+
+// The date the renderer prints for a stored date: it reads the calendar day in
+// the server's own time zone, so the expectation does too.
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']
+const printedDate = (raw: unknown): string => {
+  const date = new Date(raw as string)
+  return MONTHS[date.getMonth()] + ' ' + date.getDate() + ', ' + date.getFullYear()
+}
+
+// The editor's invoice email design (teleport-gui purposed-email-designs.ts) as
+// it is published: each summary row is a <div> of <span>s, copied from a body a
+// store sent on 2026-10-23 with its values put back to their tokens.
+const SUMMARY_ROW_STYLE =
+  'color: #374151; margin: 0; padding: 10px 0; font-size: 14px; line-height: 1.5'
+const summaryRow = (label: string, value: string, last = false) =>
+  `<div style="${SUMMARY_ROW_STYLE}${last ? '' : '; border-bottom: 1px solid #f0f1f3'}">` +
+  `<span>${label}: </span>${value}</div>`
+const INVOICE_EMAIL_BODY =
+  '<div style="color: #1f2937; margin: 0 auto; padding: 8px; max-width: 600px; font-family: \'Segoe UI\',Roboto,Helvetica,Arial,sans-serif">' +
+  '<div style="border: 1px solid #e5e7eb; overflow: hidden; background: #ffffff; border-radius: 14px">' +
+  '<div style="padding: 24px 32px; background: #1e293b"><small style="color: #94a3b8; margin: 0; font-size: 12px; font-weight: 600; letter-spacing: 1px; text-transform: uppercase">Invoice</small>' +
+  '<p style="color: #ffffff; margin: 6px 0 0; font-size: 22px; font-weight: 700">Your invoice</p></div>' +
+  '<div style="padding: 28px 32px">' +
+  '<div style="color: #1f2937; margin: 0 0 16px; font-size: 15px; line-height: 1.6"><span>Dear </span><span>{{customerName}}</span><span>,</span></div>' +
+  '<p style="color: #4b5563; margin: 0 0 18px; font-size: 15px; line-height: 1.6">Thank you for your purchase. Your invoice is attached to this email. Here is a quick summary:</p>' +
+  '<div style="margin: 0 0 22px">' +
+  summaryRow('Invoice number', '<span>{{invoiceNumber}}</span>') +
+  summaryRow('Invoice date', '<span>{{invoiceDate}}</span>') +
+  summaryRow('Due date', '<span>{{dueDate}}</span>') +
+  summaryRow('Subtotal', '<span>{{subtotal}}</span>') +
+  summaryRow('Discount', '<span>−</span><span>{{discountAmount}}</span>') +
+  summaryRow('Tax', '<span>{{taxAmount}}</span>') +
+  summaryRow('Delivery', '<span>{{shippingAmount}}</span>') +
+  summaryRow('Total', '<span>{{totalAmount}}</span>') +
+  summaryRow('Paid by gift card', '<span>−</span><span>{{giftCardAmount}}</span>') +
+  summaryRow('Amount due', '<span>{{amountDue}}</span>', true) +
+  '</div>' +
+  '<div style="color: #4b5563; margin: 4px 0 0; font-size: 14px; line-height: 1.6"><span>If you have any questions about this invoice, contact us at </span><span>{{companyEmail}}</span><span>.</span></div>' +
+  '<p style="color: #4b5563; margin: 20px 0 2px; font-size: 14px; line-height: 1.6">Best regards,</p>' +
+  '<p style="color: #1f2937; margin: 0; font-size: 14px; font-weight: 600; line-height: 1.6">{{companyName}}</p>' +
+  '</div></div></div>'
+
+// ORD-2 of the store this was found on: one 119.00 lei line paid by card, no
+// delivery, discount, tax or gift card. The payment webhook marked it paid —
+// `payment_status` and the `updated_at` that write stamps — then asked for the
+// invoice with just the order id.
+const PAID_CARD_ORDER: Row = {
+  id: 'order-2',
+  order_number: 'ORD-2',
+  currency: 'RON',
+  total_amount: 119,
+  shipping_amount: 0,
+  discount_amount: 0,
+  gift_card_amount: 0,
+  status: 'confirmed',
+  payment_status: 'paid',
+  payment_method: 'stripe',
+  payment_provider: 'stripe',
+  updated_at: '2026-10-23T09:15:00.000Z',
+  billing_name: 'Card Buyer',
+}
+const LINES: Row[] = [
+  { product_id: 'p1', product_name: 'Bouquet', quantity: 1, unit_price: 119, total_price: 119 },
+]
+// The same basket, delivered and paid in cash at the door: invoiced when it is
+// placed, before any money moved.
+const CASH_ORDER: Row = {
+  ...PAID_CARD_ORDER,
+  id: 'order-3',
+  order_number: 'ORD-3',
+  total_amount: 134,
+  shipping_amount: 15,
+  status: 'pending',
+  payment_status: 'unpaid',
+  payment_method: 'cash_on_delivery',
+  payment_provider: '',
+}
+
+// The editor's default invoice template, reduced to the parts this covers: the
+// <context> carrying the design canvas's sample (teleport-gui
+// invoice-template-builder.ts), the dates under the number, the total, the
+// notes and the seller's VAT number.
+const SAMPLE_NOTES = 'Payment is due within 30 days. Thank you for your business.'
+const boundText = (path: string) => ({
+  type: 'element',
+  content: {
+    elementType: 'text',
+    semanticType: 'p',
+    children: [{ type: 'expr', content: `invoiceData?.${path}` }],
+  },
+})
+const INVOICE_TEMPLATE = {
+  name: 'invoice-template',
+  node: {
+    type: 'element',
+    content: {
+      elementType: 'context',
+      attrs: {
+        Company: {
+          type: 'static',
+          content: { name: 'Acme Corporation', vat: 'US123456789', logoUrl: '' },
+        },
+        Invoice: {
+          type: 'static',
+          content: {
+            invoiceNumber: '#INV-001',
+            status: 'paid',
+            issueDate: 'Jan 15, 2025',
+            dueDate: 'Feb 14, 2025',
+            paidDate: 'Jan 20, 2025',
+            total: '371.49',
+            currency: 'USD',
+            notes: SAMPLE_NOTES,
+          },
+        },
+      },
+      children: [
+        boundText('Invoice?.invoiceNumber'),
+        boundText('Invoice?.issueDate'),
+        boundText('Invoice?.dueDate'),
+        boundText('Invoice?.total'),
+        boundText('Invoice?.notes'),
+        boundText('Invoice?.paidDate'),
+        boundText('Company?.vat'),
+      ],
+    },
+  },
+}
+
+const assembly = loadAssembly()
+const pdfGenerator = loadPdfGenerator()
+
+function invoiceFor(order: Row, body: Row = {}): Row {
+  const invoice = assembly.assembleInvoiceData(
+    { orderId: order.id, issueDate: '2026-10-23', ...body },
+    order,
+    LINES
+  )
+  return { ...invoice, invoiceNumber: 'INV-0002' }
+}
+
+function emailFor(invoice: Row, body = INVOICE_EMAIL_BODY): string {
+  return pdfGenerator.replacePlaceholders(body, pdfGenerator.buildDataContext(invoice))
+}
+
+describe('the invoice of a paid order', () => {
+  it('is issued paid, at the time the payment marked the order', () => {
+    const invoice = invoiceFor(PAID_CARD_ORDER)
+    expect(invoice.status).toBe('paid')
+    expect(invoice.paidAt).toBe('2026-10-23T09:15:00.000Z')
+  })
+
+  it('keeps the status and payment time a caller states', () => {
+    const invoice = invoiceFor(PAID_CARD_ORDER, { status: 'issued' })
+    expect(invoice.status).toBe('issued')
+    expect(invoice.paidAt).toBeNull()
+    const stated = invoiceFor(PAID_CARD_ORDER, { status: 'paid', paidAt: '2026-10-20T08:00:00Z' })
+    expect(stated.paidAt).toBe('2026-10-20T08:00:00Z')
+  })
+
+  it('emails no due date, no amount due and no zero lines', () => {
+    const email = emailFor(invoiceFor(PAID_CARD_ORDER))
+    expect(email).toContain('<span>Invoice number: </span><span>INV-0002</span>')
+    expect(email).toContain(
+      '<span>Invoice date: </span><span>' + printedDate('2026-10-23') + '</span>'
+    )
+    expect(email).toContain('<span>Subtotal: </span><span>lei 119.00</span>')
+    expect(email).toContain('<span>Total: </span><span>lei 119.00</span>')
+    for (const gone of ['Due date', 'Amount due', 'Discount', 'Tax', 'Delivery', 'gift card']) {
+      expect(email).not.toContain(gone)
+    }
+    // Only the rows went: the summary box and the rest of the message stay.
+    expect(email).toContain('<div style="margin: 0 0 22px">')
+    expect(email).toContain('Best regards,')
+  })
+
+  it('prints a paid line where the PDF printed the due date', () => {
+    const invoice = invoiceFor(PAID_CARD_ORDER)
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(invoice)
+    expect(html).toContain('<p>Paid on ' + printedDate('2026-10-23T09:15:00.000Z') + '</p>')
+    expect(html).not.toContain(printedDate(invoice.dueDate))
+    expect(html).toContain('<p>lei 119.00</p>')
+    // The built-in layout of a store without a template says so too.
+    expect(pdfGenerator.buildInvoiceHtml(invoice)).toContain(
+      'Paid on ' + printedDate('2026-10-23T09:15:00.000Z')
+    )
+  })
+})
+
+describe('the invoice of a cash-on-delivery order', () => {
+  it('is issued unpaid and due in 30 days', () => {
+    const invoice = invoiceFor(CASH_ORDER)
+    expect(invoice.status).toBe('issued')
+    expect(invoice.paidAt).toBeNull()
+    expect(invoice.dueDate).toBe('2026-11-22')
+  })
+
+  it('emails its due date and the delivery, and no amount due without a gift card', () => {
+    const email = emailFor(invoiceFor(CASH_ORDER))
+    expect(email).toContain(
+      '<span>Due date: </span><span>' + printedDate('2026-11-22') + '</span></div>'
+    )
+    expect(email).toContain('<span>Delivery: </span><span>lei 15.00</span>')
+    expect(email).toContain('<span>Total: </span><span>lei 134.00</span>')
+    for (const gone of ['Amount due', 'Discount', 'Tax', 'gift card']) {
+      expect(email).not.toContain(gone)
+    }
+  })
+
+  it('keeps the due date on its PDF', () => {
+    const invoice = invoiceFor(CASH_ORDER)
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(invoice)
+    expect(html).toContain('<p>' + printedDate('2026-11-22') + '</p>')
+    expect(html).not.toContain('Paid on')
+    expect(pdfGenerator.buildInvoiceHtml(invoice)).not.toContain('Paid on')
+  })
+
+  it('emails what a gift card paid and what is left to pay at the door', () => {
+    const email = emailFor(invoiceFor({ ...CASH_ORDER, gift_card_amount: 50 }))
+    expect(email).toContain(
+      '<span>Paid by gift card: </span><span>−</span><span>lei 50.00</span></div>'
+    )
+    expect(email).toContain('<span>Amount due: </span><span>lei 84.00</span></div>')
+    expect(email).toContain('<span>Due date: </span>')
+  })
+
+  it('emails no amount due once the rest was paid by card', () => {
+    const email = emailFor(invoiceFor({ ...PAID_CARD_ORDER, gift_card_amount: 50 }))
+    expect(email).toContain('<span>Paid by gift card: </span><span>−</span><span>lei 50.00</span>')
+    expect(email).not.toContain('Amount due')
+  })
+})
+
+describe('the invoice email drops a zero line, never what holds it', () => {
+  const zeroDeliveryInvoice = invoiceFor(CASH_ORDER, { shippingAmount: 0 })
+
+  it("keeps a merchant's own block around the line it drops", () => {
+    const body =
+      '<div class="merchant-summary">' +
+      '<div class="row"><span>Delivery: </span><span>{{shippingAmount}}</span></div>' +
+      '<div class="row"><span>Total: </span><span>{{totalAmount}}</span></div>' +
+      '<p>Thank you for shopping with us.</p>' +
+      '</div>'
+    expect(emailFor(zeroDeliveryInvoice, body)).toBe(
+      '<div class="merchant-summary">' +
+        '<div class="row"><span>Total: </span><span>lei 119.00</span></div>' +
+        '<p>Thank you for shopping with us.</p>' +
+        '</div>'
+    )
+  })
+
+  it('keeps a block that holds more than the line', () => {
+    const withBlocks =
+      '<div class="note"><span>Delivery {{shippingAmount}}</span><p>See you soon.</p></div>'
+    expect(emailFor(zeroDeliveryInvoice, withBlocks)).toBe(
+      '<div class="note"><span>Delivery lei 0.00</span><p>See you soon.</p></div>'
+    )
+    const withFigures = '<div>Delivery {{shippingAmount}}, total {{totalAmount}}.</div>'
+    expect(emailFor(zeroDeliveryInvoice, withFigures)).toBe(
+      '<div>Delivery lei 0.00, total lei 119.00.</div>'
+    )
+  })
+})
+
+describe('money on the invoice', () => {
+  it.each([
+    ['RON', 'lei 119.00'],
+    ['CHF', 'CHF 119.00'],
+    ['USD', '$119.00'],
+    ['EUR', '€119.00'],
+  ])('writes %s as %s in the email and the PDF alike', (currency, printed) => {
+    const invoice = invoiceFor({ ...PAID_CARD_ORDER, currency })
+    expect(emailFor(invoice, '<span>{{totalAmount}}</span>')).toBe(`<span>${printed}</span>`)
+    expect(pdfGenerator.buildInvoiceDataScope(invoice).invoiceData.Invoice.total).toBe(printed)
+  })
+})
+
+describe("the invoice PDF never prints the template's sample", () => {
+  it('prints nothing for a field the real invoice leaves empty', () => {
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(
+      invoiceFor(CASH_ORDER, { notes: '' })
+    )
+    expect(html).not.toContain(SAMPLE_NOTES)
+    expect(html).not.toContain('Jan 20, 2025')
+    expect(html).not.toContain('US123456789')
+    expect(html).not.toContain('371.49')
+    expect(html).toContain('<p>#INV-0002</p>')
+    expect(html).toContain('<p>lei 134.00</p>')
+  })
+
+  it("prints the invoice's own notes", () => {
+    const html = loadPdfGenerator(INVOICE_TEMPLATE).buildInvoiceHtml(
+      invoiceFor(CASH_ORDER, { notes: 'Leave it with the neighbour.' })
+    )
+    expect(html).toContain('<p>Leave it with the neighbour.</p>')
+  })
+
+  it("keeps the company logo the editor wrote onto the template's context", () => {
+    const withLogo = {
+      ...INVOICE_TEMPLATE,
+      node: {
+        ...INVOICE_TEMPLATE.node,
+        content: {
+          ...INVOICE_TEMPLATE.node.content,
+          attrs: {
+            Company: { type: 'static', content: { name: '', logoUrl: 'https://cdn/logo.png' } },
+          },
+        },
+      },
+    }
+    const scope = loadPdfGenerator(withLogo).buildInvoiceDataScope(invoiceFor(CASH_ORDER))
+    expect(scope.invoiceData.Company.logoUrl).toBe('https://cdn/logo.png')
+  })
+})