@tillhub/schemas 6.450.0 → 6.451.0

package/lib/v1/promotions/index.js

@@ -1,2 +1,3 @@
 module.exports.create = require('./create')
 module.exports.update = require('./update')
+module.exports.templateSecurity = require('./template-security')

package/lib/v1/promotions/template-security.js

@@ -0,0 +1,176 @@
+const TYPES = {
+  EXCLUSIVE_BUNDLE: 'product_property:exclusive_bundle:output_properties',
+  AND_OR_CONCAT: 'product_property:and_or_concat:output_properties',
+  ENTIRE_BASKET: 'product_property:entire_basket:output_properties'
+}
+
+const uuidString = {
+  type: 'string',
+  format: 'uuid'
+}
+
+const uuidRef = {
+  oneOf: [
+    uuidString,
+    {
+      type: 'object',
+      required: ['id'],
+      additionalProperties: true,
+      properties: {
+        id: uuidString
+      }
+    }
+  ]
+}
+
+const uuidRefList = {
+  type: 'array',
+  items: uuidRef
+}
+
+const outputProperties = {
+  type: 'object',
+  required: ['property', 'value'],
+  additionalProperties: true,
+  properties: {
+    property: {
+      type: 'string',
+      enum: ['amount_total_gross', 'percentage_discount', 'amount_discount']
+    },
+    value: {
+      type: 'number'
+    }
+  }
+}
+
+/**
+ * Security-focused promotion template schema.
+ * Tightens identifier fields to UUID format.
+ */
+module.exports = {
+  $id: 'https://schemas.tillhub.com/v1/promotions.template-security.schema.json',
+  $schema: 'http://json-schema.org/draft-07/schema#',
+  oneOf: [
+    {
+      type: 'object',
+      required: ['type', 'inputs'],
+      additionalProperties: true,
+      properties: {
+        type: { const: TYPES.EXCLUSIVE_BUNDLE },
+        inputs: {
+          type: 'object',
+          required: ['promotable_product', 'bundle_junctions', 'output'],
+          additionalProperties: true,
+          properties: {
+            repeatable_promotable: { type: 'boolean' },
+            promotable_product: {
+              type: 'object',
+              required: ['value'],
+              additionalProperties: true,
+              properties: {
+                value: uuidString,
+                qty: { type: 'number' },
+                property: { type: 'string' }
+              }
+            },
+            bundle_junctions: {
+              type: 'array',
+              minItems: 1,
+              maxItems: 1,
+              items: {
+                type: 'object',
+                required: ['type', 'value'],
+                additionalProperties: true,
+                properties: {
+                  type: { const: 'product' },
+                  value: uuidString,
+                  qty: { type: 'number' },
+                  property: { type: 'string' }
+                }
+              }
+            },
+            output: outputProperties
+          }
+        }
+      }
+    },
+    {
+      type: 'object',
+      required: ['type', 'inputs'],
+      additionalProperties: true,
+      properties: {
+        type: { const: TYPES.AND_OR_CONCAT },
+        inputs: {
+          type: 'object',
+          required: ['promotable_product', 'bundle_junctions', 'output'],
+          additionalProperties: true,
+          properties: {
+            repeatable_promotable: { type: 'boolean' },
+            promotable_product: {
+              type: 'object',
+              required: ['value'],
+              additionalProperties: true,
+              properties: {
+                value: uuidString,
+                qty: { type: 'number' },
+                property: { type: 'string' }
+              }
+            },
+            bundle_junctions: {
+              type: 'array',
+              minItems: 2,
+              maxItems: 2,
+              items: {
+                type: 'object',
+                required: ['type', 'value'],
+                additionalProperties: true,
+                properties: {
+                  type: { enum: ['product', 'product_group'] },
+                  value: uuidRefList,
+                  qty: { type: 'number' },
+                  property: { type: 'string' }
+                }
+              }
+            },
+            output: outputProperties
+          }
+        }
+      }
+    },
+    {
+      type: 'object',
+      required: ['type', 'inputs'],
+      additionalProperties: true,
+      properties: {
+        type: { const: TYPES.ENTIRE_BASKET },
+        inputs: {
+          type: 'object',
+          required: ['promotable_product', 'promotable_product_group', 'required_amount', 'output'],
+          additionalProperties: true,
+          properties: {
+            promotable_product: {
+              type: 'object',
+              required: ['value'],
+              additionalProperties: true,
+              properties: {
+                value: uuidRefList,
+                property: { type: 'string' }
+              }
+            },
+            promotable_product_group: {
+              type: 'object',
+              required: ['value'],
+              additionalProperties: true,
+              properties: {
+                value: uuidRefList,
+                property: { type: 'string' }
+              }
+            },
+            required_amount: { type: 'number' },
+            output: outputProperties
+          }
+        }
+      }
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tillhub/schemas",
-  "version": "6.450.0",
+  "version": "6.451.0",
   "private": false,
   "description": "All Tillhub API OpenAPI 3 compatible JSON Schemas.",
   "main": "./lib/index.js",

package/test/promotions/promotions.template-security.spec.js

@@ -0,0 +1,55 @@
+const Ajv = require('ajv')
+const test = require('tape')
+const templateSecurity = require('../../lib/v1/promotions/template-security')
+
+const ajv = new Ajv({ allErrors: true })
+const validate = ajv.compile(templateSecurity)
+
+const PROMOTABLE = '0e0ae64e-1499-435d-af31-5bc5d35b1ed2'
+const BUNDLE = 'e9516453-d974-430a-8277-7373bd392157'
+
+function exclusiveTemplate (promotableId = PROMOTABLE) {
+  return {
+    type: 'product_property:exclusive_bundle:output_properties',
+    inputs: {
+      repeatable_promotable: true,
+      promotable_product: {
+        property: 'id',
+        value: promotableId,
+        qty: 1
+      },
+      bundle_junctions: [{
+        type: 'product',
+        property: 'id',
+        value: BUNDLE,
+        qty: 1
+      }],
+      output: {
+        property: 'amount_total_gross',
+        value: 5
+      }
+    }
+  }
+}
+
+test('Promotions: template security schema accepts UUID identifiers', function (t) {
+  t.plan(1)
+  t.ok(validate(exclusiveTemplate()), 'valid identifiers should pass')
+})
+
+test('Promotions: template security schema rejects injectable identifiers', function (t) {
+  t.plan(1)
+  t.notOk(
+    validate(exclusiveTemplate('12"; fetch("https://attacker.example"); //')),
+    'non-UUID identifier should fail'
+  )
+})
+
+test('Promotions: template security schema is exported', function (t) {
+  t.plan(1)
+  t.equal(
+    require('../../lib/v1/promotions').templateSecurity,
+    templateSecurity,
+    'v1 promotions exports the security schema'
+  )
+})