@teleporthq/teleport-plugin-next-workflows 0.44.8 → 0.44.10

package/src/account-delete-route-generator.ts

@@ -4,9 +4,14 @@
  *
  * The client node calls this route, which:
  *   1. resolves the current user from the NextAuth session (never trusting a
- *      client-supplied id),
+ *      client-supplied id) and, when the request carries a password, goes on
+ *      only if it is the account's own,
  *   2. runs a single DB transaction that detaches + anonymises business/legal
- *      records (orders, withdrawal requests, bookings) so tracking survives,
+ *      records (orders, withdrawal requests, bookings, downloads, gift cards
+ *      the user bought or received) so tracking survives, takes the user's
+ *      email out of the activity log and the sent-email ledger, leaves the
+ *      invoices already issued as they are (an invoice must keep naming its
+ *      buyer),
  *      deletes the user's personal data (reviews, cart, favourites, chat
  *      history), deletes the rows the user owns in the project's own tables —
  *      the ones the AI made for the site, each through the one column the
@@ -100,10 +105,29 @@ const ANONYMIZE_TABLES = [
   'teleport_subscriptions',
   'teleport_abandoned_carts',
   'teleport_voucher_redemptions',
+  'teleport_downloads',
 ];
 const EMAIL_COLUMNS = ['billing_email', 'shipping_email', 'customer_email', 'email'];
 // A booking also names the customer and carries their phone; both are cleared.
-const CLEARED_COLUMNS = { teleport_bookings: ['customer_name', 'customer_phone'] };
+// A download keeps its count against the order's limit, without who fetched it
+// from where.
+const CLEARED_COLUMNS = {
+  teleport_bookings: ['customer_name', 'customer_phone'],
+  teleport_downloads: ['ip_address'],
+};
+// Tables that name the user only by their email: each column holding it takes
+// the anonymised address (a gift card stays redeemable by its code) or a blank
+// (an activity-log line keeps what happened, not who did it).
+const EMAIL_REFERENCES = [
+  { table: 'teleport_gift_cards', column: 'purchaser_email', replacement: 'anonymised' },
+  { table: 'teleport_gift_cards', column: 'recipient_email', replacement: 'anonymised' },
+  { table: 'teleport_events', column: 'actor', replacement: 'blank' },
+];
+const SENT_EMAILS_TABLE = 'teleport_sent_emails';
+
+function anonymisedEmailOf(userId) {
+  return String(DELETED_EMAIL_PATTERN).split('{{userId}}').join(String(userId));
+}
 
 async function tableColumns(client, table) {
   var r = await client.query(
@@ -146,6 +170,36 @@ async function deleteRowsByEmail(client, table, column, email) {
   await client.query('DELETE FROM ' + table + ' WHERE ' + column + ' = $1', [email]);
 }
 
+async function replaceEmailReferences(client, email, anonymisedEmail) {
+  if (!email) { return; }
+  for (var i = 0; i < EMAIL_REFERENCES.length; i++) {
+    var ref = EMAIL_REFERENCES[i];
+    var cols = await tableColumns(client, ref.table);
+    if (cols.indexOf(ref.column) === -1) { continue; }
+    await client.query(
+      'UPDATE ' + ref.table + ' SET ' + ref.column + ' = $1 WHERE lower(' + ref.column + ') = lower($2)',
+      [ref.replacement === 'anonymised' ? anonymisedEmail : '', email]
+    );
+  }
+}
+
+// The emails the site sent the user stay on record (which email, when, through
+// which provider), without the address, the body or the values it was filled
+// with.
+async function blankSentEmailsTo(client, email) {
+  if (!email) { return; }
+  var cols = await tableColumns(client, SENT_EMAILS_TABLE);
+  if (cols.indexOf('recipient_email') === -1) { return; }
+  var sets = ["recipient_email = ''"];
+  if (cols.indexOf('recipients') !== -1) { sets.push('recipients = NULL'); }
+  if (cols.indexOf('body_html') !== -1) { sets.push("body_html = ''"); }
+  if (cols.indexOf('payload') !== -1) { sets.push('payload = NULL'); }
+  await client.query(
+    'UPDATE ' + SENT_EMAILS_TABLE + ' SET ' + sets.join(', ') + ' WHERE lower(recipient_email) = lower($1)',
+    [email]
+  );
+}
+
 // Rows the user owns in the project's OWN tables — the ones the AI made for
 // this site (saved items, requests, reviews …). Their link to the user is
 // ON DELETE SET NULL, so they outlived the account with a blank owner, and the
@@ -259,44 +313,34 @@ async function deleteOwnedRows(client, userId) {
   }
 }
 
-// Invoices are a financial/tax record that must survive, but they store the
-// customer's PII denormalised and link to the user only through order_id (no
-// user_id). Scrub the PII in place, matching invoices whose order belongs to the
-// user. MUST run BEFORE the orders row is anonymised (its user_id is still set).
-var INVOICE_PII_NULL_COLUMNS = [
-  'customer_name',
-  'customer_address',
-  'customer_city',
-  'customer_state',
-  'customer_zip',
-  'customer_country',
-  'customer_vat',
-  'customer_phone',
-];
-
-async function anonymizeInvoices(client, ordersTable, invoicesTable, userId, syntheticEmail) {
-  var invCols = await tableColumns(client, invoicesTable);
-  if (invCols.indexOf('order_id') === -1) { return; }
-  var orderCols = await tableColumns(client, ordersTable);
-  if (orderCols.indexOf('user_id') === -1) { return; }
-  var sets = [];
-  var params = [];
-  if (invCols.indexOf('customer_email') !== -1) {
-    params.push(syntheticEmail);
-    sets.push('customer_email = $' + params.length);
+// The password a request confirms the deletion with, or null when it names
+// none. A request without one deletes as before; one with a password deletes
+// only when it is the account's own (the editor's delete-account form asks for
+// it).
+function readRequestPassword(req) {
+  var body = req.body;
+  if (typeof body === 'string') {
+    try { body = JSON.parse(body); } catch (e) { body = null; }
   }
-  for (var i = 0; i < INVOICE_PII_NULL_COLUMNS.length; i++) {
-    if (invCols.indexOf(INVOICE_PII_NULL_COLUMNS[i]) !== -1) {
-      sets.push(INVOICE_PII_NULL_COLUMNS[i] + ' = NULL');
-    }
+  if (!body || typeof body !== 'object' || body.password === undefined || body.password === null) {
+    return null;
+  }
+  return String(body.password);
+}
+
+// The sign-in check (utils/auth/hash-password.js verifyPassword): bcrypt over
+// the SHA-256 of the password and AUTH_PEPPER. An account without a stored
+// password (a social sign-in) matches no password.
+function passwordMatches(password, storedHash) {
+  if (!storedHash || password.length > 1000) { return false; }
+  var bcrypt = require('bcryptjs');
+  var crypto = require('crypto');
+  var prepared = crypto.createHash('sha256').update(password + (process.env.AUTH_PEPPER || '')).digest('base64');
+  try {
+    return bcrypt.compareSync(prepared, String(storedHash));
+  } catch (e) {
+    return false;
   }
-  if (sets.length === 0) { return; }
-  params.push(userId);
-  await client.query(
-    'UPDATE ' + invoicesTable + ' SET ' + sets.join(', ') +
-      ' WHERE order_id IN (SELECT id FROM ' + ordersTable + ' WHERE user_id = $' + params.length + ')',
-    params
-  );
 }
 
 ${generateFillTemplateFn()}
@@ -313,6 +357,7 @@ ${generateProviderSendFunction(provider, {
   source: 'account-delete',
   sourceRef: 'api/account/delete-current',
   relativePrefix: '../../..',
+  withoutRecipientDetails: true,
 })}
 
 // \`locale\` is the language of the page the deletion was requested from
@@ -328,7 +373,7 @@ async function sendFarewellEmail(toEmail, tokenValues, userId, locale) {
   var copy = resolveFarewellEmailCopy(locale);
   var subject = fillTemplate(copy.subject, tokenValues);
   var html = fillTemplate(copy.body, tokenValues);
-  await __sendProviderEmail({ from: from, fromName: EMAIL_FROM_NAME, to: toEmail, subject: subject, html: html, apiKey: apiKey, tokenValues: tokenValues, userId: userId });
+  await __sendProviderEmail({ from: from, fromName: EMAIL_FROM_NAME, to: toEmail, recordedTo: anonymisedEmailOf(userId), subject: subject, html: html, apiKey: apiKey, tokenValues: tokenValues, userId: userId });
 }
 
 module.exports = async function handler(req, res) {
@@ -348,10 +393,12 @@ module.exports = async function handler(req, res) {
     return res.status(401).json({ error: 'Unauthenticated' });
   }
 
+  var requestPassword = readRequestPassword(req);
   var client = getClient();
   var userEmail = '';
   var userName = '';
   var userFound = false;
+  var passwordRefused = false;
   var failed = false;
   // try/finally so the pg connection is ALWAYS closed — every early exit
   // (not-found, error) leaves via the finally, never leaking a connection.
@@ -364,14 +411,14 @@ module.exports = async function handler(req, res) {
       userFound = true;
       userEmail = userRes.rows[0].email || '';
       userName = userRes.rows[0].name || '';
-
-      var syntheticEmail = String(DELETED_EMAIL_PATTERN).split('{{userId}}').join(String(userId));
+      passwordRefused =
+        requestPassword !== null && !passwordMatches(requestPassword, userRes.rows[0].password);
+    }
+    if (userFound && !passwordRefused) {
+      var syntheticEmail = anonymisedEmailOf(userId);
 
       await client.query('BEGIN');
       try {
-        // Scrub invoice PII FIRST — invoices link to the user only through
-        // order_id, so this must run while the orders row still carries user_id.
-        await anonymizeInvoices(client, 'teleport_orders', 'teleport_invoices', userId, syntheticEmail);
         for (var a = 0; a < ANONYMIZE_TABLES.length; a++) {
           await anonymizeUserRows(client, ANONYMIZE_TABLES[a], userId, syntheticEmail);
         }
@@ -379,6 +426,8 @@ module.exports = async function handler(req, res) {
           await deleteUserRows(client, DELETE_TABLES[d], userId);
         }
         await deleteOwnedRows(client, userId);
+        await replaceEmailReferences(client, userEmail, syntheticEmail);
+        await blankSentEmailsTo(client, userEmail);
         // password_reset_tokens has no user_id — it is keyed by the email string.
         await deleteRowsByEmail(client, 'password_reset_tokens', 'email', userEmail);
         await client.query('DELETE FROM ' + AUTH_USERS_TABLE + ' WHERE id = $1', [userId]);
@@ -401,6 +450,9 @@ module.exports = async function handler(req, res) {
   if (!userFound) {
     return res.status(404).json({ error: 'Account not found' });
   }
+  if (passwordRefused) {
+    return res.status(403).json({ error: 'Incorrect password' });
+  }
 
   // Best-effort farewell email AFTER the successful commit (connection closed).
   try {

package/src/api-route-generator.ts

@@ -442,7 +442,7 @@ module.exports = async function handler(req, res) {
         for (var h = 0; h < hKeys.length; h++) {
           res.setHeader(hKeys[h], earlyRes.headers[hKeys[h]]);
         }
-        await utils.settlePendingNodePromises(context);
+        await utils.handOffPendingNodePromises(context);
         res.status(earlyRes.status || 500).json(earlyRes.body || {});
         return;
       }
@@ -453,11 +453,11 @@ module.exports = async function handler(req, res) {
       if (result && result.__terminal) break;
     }
 
-    // Land every fire-and-forget query BEFORE replying: the platform may freeze
-    // this function the moment the response is sent, which would drop the write.
-    // The visitor does not pay for this — the client dispatched this segment
-    // without awaiting it (see seg.fireAndForget in the client runtime).
-    await utils.settlePendingNodePromises(context);
+    // Every not-awaited step must still land: the platform may freeze this
+    // function the moment the response is sent, which would drop the work. On
+    // Vercel it finishes after the reply (waitUntil); elsewhere the reply waits
+    // for it (see handOffPendingNodePromises in the server runtime).
+    await utils.handOffPendingNodePromises(context);
     delete context.__request;
     delete context.__pendingNodePromises;
     // MUST be stripped before replying: the results payload below IS this
@@ -469,7 +469,7 @@ module.exports = async function handler(req, res) {
     res.status(200).json({ success: true, results: utils.segmentReply(SEGMENT_CONFIG, context, __incomingSnapshot) });
   } catch (error) {
     console.error('Workflow segment error:', error);
-    if (__wfContext) { await utils.settlePendingNodePromises(__wfContext); }
+    if (__wfContext) { await utils.handOffPendingNodePromises(__wfContext); }
     res.status(500).json({ success: false, error: error.message || 'Internal server error' });
   }
 };
@@ -876,7 +876,7 @@ module.exports = async function handler(req, res) {
         }
         const result = await nodeHandler(resolved, context);
         if (result && result.__earlyResponse) {
-          await utils.settlePendingNodePromises(context);
+          await utils.handOffPendingNodePromises(context);
           if (streamStarted) {
             res.write('data: ' + JSON.stringify({ type: 'error', error: (result.__earlyResponse.body && result.__earlyResponse.body.message) || 'Request rejected' }) + '\\n\\n');
             res.end();
@@ -901,10 +901,9 @@ module.exports = async function handler(req, res) {
       }
     }
 
-    // See the non-streaming segment route: land every fire-and-forget query
-    // before the response completes, or the platform may freeze this function
-    // with the write still in flight.
-    await utils.settlePendingNodePromises(context);
+    // See the non-streaming segment route: every not-awaited step must still
+    // land, after the reply on Vercel, before it anywhere else.
+    await utils.handOffPendingNodePromises(context);
     delete context.__request;
     delete context.__pendingNodePromises;
     // MUST be stripped before replying: the results payload below IS this
@@ -922,7 +921,7 @@ module.exports = async function handler(req, res) {
     }
   } catch (error) {
     console.error('Streaming workflow segment error:', error);
-    if (__wfContext) { await utils.settlePendingNodePromises(__wfContext); }
+    if (__wfContext) { await utils.handOffPendingNodePromises(__wfContext); }
     if (streamStarted) {
       try {
         res.write('data: ' + JSON.stringify({ type: 'error', error: error.message || 'Internal server error' }) + '\\n\\n');

package/src/auth-generator.ts

@@ -673,7 +673,9 @@ const generateProvidersSetup = (auth: UIDLAuthentication): string => {
       if (!verifyPassword(String(credentials.password), user.password)) {
         throw new Error('InvalidCredentials');
       }
-      return sanitizeUser(user);
+      const signedIn = sanitizeUser(user);
+      signedIn[TOKEN_PASSWORD_FINGERPRINT] = passwordFingerprint(user.password);
+      return signedIn;
     } catch (err) {
       if (err && err.message === 'InvalidCredentials') throw err;
       // A hashing/serialisation fault is an infrastructure problem, not a
@@ -758,6 +760,22 @@ const USER_REFRESH_INTERVAL_MS = ${USER_REFRESH_INTERVAL_MS};
 // internal timestamp on every binding that enumerates the user object.
 const TOKEN_REFRESH_STAMP = '__userRefreshedAt';
 
+// A short fingerprint of the account's stored password hash, carried in the
+// token from sign-in (or from the first refresh of a token that has none). A
+// password change, a reset included, changes it, and the refresh then ends the
+// session: every session opened before the change is signed out at its next
+// refresh. Keyed with NEXTAUTH_SECRET; never the hash itself, and like the
+// stamp above never copied onto \`session.user\`.
+const TOKEN_PASSWORD_FINGERPRINT = '__passwordFingerprint';
+
+function passwordFingerprint(storedHash) {
+  return require('crypto')
+    .createHmac('sha256', String(process.env.NEXTAUTH_SECRET || ''))
+    .update('teleport-password-fingerprint:v1|' + (storedHash ? String(storedHash) : ''))
+    .digest('base64')
+    .slice(0, 16);
+}
+
 const authOptions = {
   providers: providers,
   pages: {
@@ -803,6 +821,7 @@ const authOptions = {
       if (params.trigger !== 'update' && isFresh) {
         return token;
       }
+      let passwordChanged = false;
       try {
         if (token && token.email && typeof findUserByEmail === 'function') {
           const fresh = await findUserByEmail(String(token.email));
@@ -813,10 +832,23 @@ const authOptions = {
               token[fk[i]] = safe[fk[i]];
             }
           }
+          if (fresh) {
+            const currentFingerprint = passwordFingerprint(fresh.password);
+            if (typeof token[TOKEN_PASSWORD_FINGERPRINT] !== 'string') {
+              token[TOKEN_PASSWORD_FINGERPRINT] = currentFingerprint;
+            } else if (token[TOKEN_PASSWORD_FINGERPRINT] !== currentFingerprint) {
+              passwordChanged = true;
+            }
+          }
         }
       } catch (e) {
         // Keep the existing token on any DB hiccup — never sign the user out.
       }
+      if (passwordChanged) {
+        // NextAuth answers a jwt callback that throws by clearing the session
+        // cookie and returning no session: the visitor is signed out.
+        throw new Error('The account password changed since this session signed in');
+      }
       // Stamped even when the read threw, so an unreachable database costs one
       // attempt per interval instead of one per request.
       if (token) {
@@ -830,6 +862,7 @@ const authOptions = {
       if (token && session.user) {
         const skip = { iat: 1, exp: 1, jti: 1, sub: 1 };
         skip[TOKEN_REFRESH_STAMP] = 1;
+        skip[TOKEN_PASSWORD_FINGERPRINT] = 1;
         const keys = Object.keys(token);
         for (let i = 0; i < keys.length; i++) {
           if (!skip[keys[i]]) {

package/src/await-result.ts

@@ -15,6 +15,15 @@ export const DATA_NODE_TYPES: ReadonlyArray<string> = [
   'data-delete-item',
 ]
 
+/**
+ * The other steps the author may choose not to wait for: server work whose
+ * result nothing downstream needs (a cash order's invoice, rendered, stored
+ * and mailed while the buyer is already on the confirmation page). The
+ * editor offers the choice on the same steps (`supportsAwaitResultOption` in
+ * teleport-gui's `@teleport/workflow-schema`) — a PAIRED EDIT.
+ */
+export const NOT_AWAITABLE_SERVER_NODE_TYPES: ReadonlyArray<string> = ['ecommerce-generate-invoice']
+
 /**
  * Config key carrying the author's await choice. Only `false` opts out —
  * `undefined` (never configured) and `true` both mean "await", so every
@@ -22,14 +31,17 @@ export const DATA_NODE_TYPES: ReadonlyArray<string> = [
  */
 export const AWAIT_RESULT_CONFIG_KEY = 'awaitResult'
 
-const DATA_NODE_TYPE_SET = new Set<string>(DATA_NODE_TYPES)
+const AWAIT_OPTIONAL_NODE_TYPE_SET = new Set<string>([
+  ...DATA_NODE_TYPES,
+  ...NOT_AWAITABLE_SERVER_NODE_TYPES,
+])
 
 /**
- * True when this node runs fire-and-forget: the runtime starts the query,
+ * True when this node runs fire-and-forget: the runtime starts the step,
  * publishes `null` under the node's id and moves straight on to the next node.
  */
 export const isFireAndForgetNode = (node: UIDLWorkflowNode | undefined | null): boolean => {
-  if (!node || !DATA_NODE_TYPE_SET.has(node.type)) {
+  if (!node || !AWAIT_OPTIONAL_NODE_TYPE_SET.has(node.type)) {
     return false
   }
   const config = node.config as Record<string, unknown> | undefined
@@ -41,10 +53,10 @@ export const isFireAndForgetNode = (node: UIDLWorkflowNode | undefined | null):
  * response — i.e. every node it holds is fire-and-forget, so nothing
  * downstream can read anything the segment produces.
  *
- * The API route itself still awaits each query before replying (a serverless
- * function may be frozen the moment it responds, which would drop an in-flight
- * write); what this flag removes is the CLIENT's wait on that round trip, which
- * is where the latency the visitor feels actually comes from.
+ * The API route itself still lands each step (a serverless function may be
+ * frozen the moment it responds, which would drop an in-flight write: on
+ * Vercel the step finishes after the reply, elsewhere the reply waits); what
+ * this flag removes is the CLIENT's wait on that round trip.
  */
 export const isFireAndForgetSegment = (segment: WorkflowSegment): boolean =>
   segment.env === 'server' &&

package/src/data-api-route-generator.ts

@@ -1219,7 +1219,15 @@ module.exports = async function handler(req, res) {
   }
 
   var operation = params[params.length - 1];
-  var body = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
+  var body;
+  try {
+    body = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
+  } catch (e) {
+    body = null;
+  }
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return res.status(400).json({ error: 'Invalid request body. Expected a JSON object.' });
+  }
   var client = getClient();
 
   try {

package/src/executor-generator.ts

@@ -655,9 +655,15 @@ function normalizeComparisonOperator(op) {
     .toLowerCase();
 }
 
+// The editor's templates write a comparison's sides as leftOperand /
+// rightOperand; everything else writes leftValue / rightValue.
+function comparisonSide(config, valueKey, operandKey) {
+  return config[valueKey] !== undefined ? config[valueKey] : config[operandKey];
+}
+
 function evaluateSingleComparison(config, context) {
-  var rawLeft = resolveValue(config.leftValue, context);
-  var rawRight = resolveValue(config.rightValue, context);
+  var rawLeft = resolveValue(comparisonSide(config, 'leftValue', 'leftOperand'), context);
+  var rawRight = resolveValue(comparisonSide(config, 'rightValue', 'rightOperand'), context);
   const op = normalizeComparisonOperator(config.operator || 'equals');
   var isUnary = op === 'is-empty' || op === 'is-not-empty' || op === 'is-truthy' || op === 'is-falsy' ||
     op === 'is-null' || op === 'is-not-null' || op === 'is-true' || op === 'is-false';
@@ -667,7 +673,7 @@ function evaluateSingleComparison(config, context) {
   switch (op) {
     case '===': return left === right;
     case '!==': return left !== right;
-    case '==': case 'equals': return left == right;
+    case '=': case '==': case 'equals': return left == right;
     case '!=': case 'not-equals': return left != right;
     case '>': case 'greater-than': return left > right;
     case '<': case 'less-than': return left < right;
@@ -809,10 +815,16 @@ var __DATA_NODE_TYPES = {
   'data-delete-item': true
 };
 
-// A data node the author opted out of awaiting. Only an explicit \`false\` opts
-// out, so a config written before the option existed keeps awaiting.
+// Mirrors NOT_AWAITABLE_SERVER_NODE_TYPES in await-result.ts — PAIRED EDIT.
+var __NOT_AWAITABLE_SERVER_NODE_TYPES = {
+  'ecommerce-generate-invoice': true
+};
+
+// A data node (or a step listed above) the author opted out of awaiting. Only
+// an explicit \`false\` opts out, so a config written before the option existed
+// keeps awaiting.
 function isFireAndForgetNode(node) {
-  if (!node || !__DATA_NODE_TYPES[node.type]) return false;
+  if (!node || !(__DATA_NODE_TYPES[node.type] || __NOT_AWAITABLE_SERVER_NODE_TYPES[node.type])) return false;
   return !!node.config && node.config.awaitResult === false;
 }
 
@@ -880,9 +892,12 @@ async function settlePendingNodePromises(context) {
 // ({ error: '...' } / { success: false }) or through the AI-node contract
 // ({ error: true, message, code } — provider/auth failures). Both must halt
 // the workflow; treating error:true as success used to let the pipeline limp
-// into downstream NOT NULL violations.
+// into downstream NOT NULL violations. A result that says success: true is
+// the node's own verdict: an email node that reached some of its recipients
+// reports success with the refused addresses under error, and goes on.
 function isFatalNodeResult(result) {
   if (!result) return false;
+  if (result.success === true) return false;
   return result.success === false ||
     (typeof result.error === 'string' && result.error) ||
     result.error === true;

package/src/invoice/invoice-html-code.ts

@@ -265,6 +265,54 @@ function formatDateValue(raw) {
   }
 }
 
+// How the invoice says it was paid: the method in words, with the provider that
+// took the money when a provider did ("Card (Stripe)", "Paid online" for a
+// booking paid through the site, "Cash on delivery", "Gift card"), and the
+// provider's payment id as "Ref. pi_…". The stored values are ids.
+var PAYMENT_PROVIDER_LABELS = {
+  stripe: 'Stripe', paypal: 'PayPal', mollie: 'Mollie', razorpay: 'Razorpay',
+  square: 'Square', paddle: 'Paddle', coingate: 'CoinGate',
+};
+var PAYMENT_METHOD_LABELS = {
+  card: 'Card',
+  online: 'Paid online',
+  cash_on_delivery: 'Cash on delivery',
+  cod: 'Cash on delivery',
+  cash: 'Cash',
+  store_pickup: 'Paid at pickup',
+  pickup: 'Paid at pickup',
+  gift_card: 'Gift card',
+  bank_transfer: 'Bank transfer',
+};
+var PAYMENT_METHODS_NAMING_PROVIDER = { card: true, online: true };
+
+function humanizePaymentId(value) {
+  var words = String(value).replace(/[_-]+/g, ' ').trim();
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+
+function paymentProviderLabel(provider) {
+  var id = String(provider || '').trim().toLowerCase();
+  return PAYMENT_PROVIDER_LABELS[id] || (id ? humanizePaymentId(id) : '');
+}
+
+function paymentMethodLabel(method, provider) {
+  var id = String(method || '').trim().toLowerCase();
+  var providerLabel = paymentProviderLabel(provider);
+  if (PAYMENT_METHOD_LABELS[id]) {
+    return PAYMENT_METHOD_LABELS[id] +
+      (PAYMENT_METHODS_NAMING_PROVIDER[id] && providerLabel ? ' (' + providerLabel + ')' : '');
+  }
+  if (PAYMENT_PROVIDER_LABELS[id]) return 'Paid online (' + PAYMENT_PROVIDER_LABELS[id] + ')';
+  if (!id) return providerLabel ? 'Paid online (' + providerLabel + ')' : '';
+  return humanizePaymentId(id);
+}
+
+function paymentReference(paymentId) {
+  var ref = String(paymentId || '').trim();
+  return ref ? 'Ref. ' + ref : '';
+}
+
 function buildInvoiceDataScope(invoiceData) {
   var contextCompany = extractStaticAttrsFromContext(TEMPLATE_COMPONENT_UIDL).Company || {};
   var sym = invoiceData.currencySymbol || '$';
@@ -311,10 +359,13 @@ function buildInvoiceDataScope(invoiceData) {
   var giftCardLast4 = String(invoiceData.giftCardLast4 || '').trim();
   var totalNumber = Number(invoiceData.total);
   if (!isFinite(totalNumber)) totalNumber = 0;
+  // What is left to pay after the gift card. The invoice records what the
+  // provider or the courier was to collect; once that is paid, nothing is left.
   var amountDueNumber = Number(invoiceData.amountDue);
   if (invoiceData.amountDue == null || !isFinite(amountDueNumber)) {
     amountDueNumber = Math.max(0, totalNumber - giftCardAmountNumber);
   }
+  if (isSettledInvoice(invoiceData.status)) amountDueNumber = 0;
 
   // A paid invoice asks for nothing: where the due date would print, it says
   // when it was paid. The order keeps no payment method finer than its
@@ -376,9 +427,9 @@ function buildInvoiceDataScope(invoiceData) {
   realCustomer.hasVat = realCustomer.vat ? 'true' : 'false';
 
   var realPayment = {
-    method: invoiceData.paymentMethod || '',
-    provider: invoiceData.paymentProvider || '',
-    intentId: invoiceData.paymentIntentId || '',
+    method: paymentMethodLabel(invoiceData.paymentMethod, invoiceData.paymentProvider),
+    provider: paymentProviderLabel(invoiceData.paymentProvider),
+    intentId: paymentReference(invoiceData.paymentIntentId),
     orderId: invoiceData.orderId || '',
   };
 
@@ -746,6 +797,39 @@ function renderComponentReference(content, scope, depth) {
   return rendered;
 }
 
+// A paid invoice asks for nothing, so, as in the email, its amount-due line is
+// left out. The template shows that line whenever a gift card was used, which
+// cannot tell whether the rest was paid since. The line is the innermost
+// container holding the field (the editor lays each summary line out as a row
+// of texts), and only when the field is all it holds: a container that also
+// holds a block or another field is the merchant's own, and stays.
+var AMOUNT_DUE_FIELD = /\\bInvoice\\??\\.amountDue\\b/;
+
+function isPaidAmountDueLine(content, scope) {
+  var inv = scope.invoiceData && scope.invoiceData.Invoice;
+  if (!inv || !isSettledInvoice(inv.status)) return false;
+  var fields = { amountDue: 0, other: 0 };
+  return countLineFields(content.children, fields) && fields.amountDue > 0 && fields.other === 0;
+}
+
+// Counts the fields a line prints into \`fields\`; false when it holds anything
+// but text, which makes it a block rather than a line.
+function countLineFields(children, fields) {
+  var list = children || [];
+  for (var i = 0; i < list.length; i++) {
+    var child = list[i];
+    if (!child || child.type === 'static') continue;
+    if (child.type === 'expr') {
+      if (AMOUNT_DUE_FIELD.test(String(child.content))) fields.amountDue++;
+      else fields.other++;
+      continue;
+    }
+    var isText = child.type === 'element' && child.content && child.content.elementType === 'text';
+    if (!isText || !countLineFields(child.content.children, fields)) return false;
+  }
+  return true;
+}
+
 function renderNode(node, scope, componentName, depth) {
   if (!node) return '';
   if (typeof depth !== 'number') depth = 0;
@@ -801,6 +885,10 @@ function renderNode(node, scope, componentName, depth) {
     return fragChildren.map(function (c) { return renderNode(c, scope, componentName, depth); }).join('');
   }
 
+  if (elementType === 'container' && isPaidAmountDueLine(content, scope)) {
+    return '';
+  }
+
   var tag = content.semanticType || elementTypeToTag(elementType);
   var baseClass = classNameForNode(componentName, content.name);
   var referencedClasses = collectReferencedStyleClasses(content.referencedStyles);
@@ -1034,11 +1122,14 @@ function buildFallbackInvoiceHtml(scope) {
   }
   totalsRows += '<div style="display:flex;justify-content:space-between;font-weight:bold;border-top:2px solid #333;padding-top:4px;"><span>Total</span><span>' + escapeHtml(inv.total) + '</span></div>';
   // A gift card settles part (or all) of the total, so what is left to pay is
-  // printed beneath it — 0.00 included, which is the buyer's proof of that.
+  // printed beneath it — 0.00 included, which is the buyer's proof of that —
+  // until the invoice is paid, whose paid date says nothing is left.
   if (inv.hasGiftCard === 'true') {
     var giftCardLabel = 'Paid by gift card' + (inv.giftCardLast4 ? ' \\u2022\\u2022\\u2022\\u2022' + inv.giftCardLast4 : '');
     totalsRows += '<div style="display:flex;justify-content:space-between;margin-top:4px;margin-bottom:4px;"><span>' + escapeHtml(giftCardLabel) + '</span><span>\\u2212' + escapeHtml(inv.giftCardAmount) + '</span></div>';
-    totalsRows += '<div style="display:flex;justify-content:space-between;font-weight:bold;"><span>Amount due</span><span>' + escapeHtml(inv.amountDue) + '</span></div>';
+    if (!isSettledInvoice(inv.status)) {
+      totalsRows += '<div style="display:flex;justify-content:space-between;font-weight:bold;"><span>Amount due</span><span>' + escapeHtml(inv.amountDue) + '</span></div>';
+    }
   }
   parts.push('<div style="display:flex;justify-content:flex-end;margin-top:16px;"><div style="width:240px;">' +
     totalsRows +

package/src/nodes/account/account-delete-current.ts

@@ -18,10 +18,13 @@ async function account_delete_current(config: any, context: Record<string, unkno
   if (typeof runLocale === 'string' && runLocale) {
     deleteHeaders['x-teleport-locale'] = runLocale
   }
+  // A template that asks for the password passes what the visitor typed; the
+  // route checks it the way sign-in does and deletes nothing when it is wrong.
+  const password = config && typeof config.password === 'string' ? config.password : ''
   const response = await fetch(baseUrl + '/api/account/delete-current', {
     method: 'POST',
     headers: deleteHeaders,
-    body: '{}',
+    body: JSON.stringify(password ? { password } : {}),
   })
 
   let data: any = {}