@tokenoftrust/storefront-runner 4.11.0 → 4.11.2

package/apps/storefront/src/lib/engagement/contact/messagesTabClient.ts

@@ -3,8 +3,15 @@
  *
  * Every visitor-supplied value is written with `textContent`; nothing from a
  * message is ever parsed as markup.
+ *
+ * Optional exact-match filter: a `form[data-messages-filter]` with a `kind`
+ * control (`email` | `phone`) and a `value` input. A filtered load POSTs
+ * `{ [kind]: value }` as the body — never a URL parameter — and an empty value
+ * (or `[data-messages-filter-clear]`) returns to the full inbox.
  */
 
+type MessageFilter = { kind: "email" | "phone"; value: string } | null;
+
 interface InboxMessage {
   id: string;
   status: string;
@@ -52,7 +59,9 @@ export function initMessagesTab(root: HTMLElement): void {
   const template = root.querySelector<HTMLTemplateElement>("template[data-messages-row]");
   const refresh = root.querySelector<HTMLElement>("[data-messages-refresh]");
   if (!statusEl || !panel || !list || !empty || !unreadEl || !template || !refresh) return;
+  const filterForm = root.querySelector<HTMLFormElement>("form[data-messages-filter]");
   let loaded = false;
+  let filter: MessageFilter = null;
 
   const setStatus = (text: string, tone: "error" | null): void => {
     statusEl.textContent = text;
@@ -87,9 +96,16 @@ export function initMessagesTab(root: HTMLElement): void {
     loaded = true;
     setStatus("Loading messages…", null);
     try {
-      const { ok, status, data } = await call("/api/admin/messages", {
-        headers: { accept: "application/json" },
-      });
+      const { ok, status, data } = await call(
+        "/api/admin/messages",
+        filter
+          ? {
+              method: "POST",
+              headers: { accept: "application/json", "content-type": "application/json" },
+              body: JSON.stringify({ [filter.kind]: filter.value }),
+            }
+          : { headers: { accept: "application/json" } },
+      );
       if (!ok) {
         setStatus(`Could not load messages (${data.error || status}).`, "error");
         return;
@@ -134,6 +150,20 @@ export function initMessagesTab(root: HTMLElement): void {
   };
 
   refresh.addEventListener("click", () => void load());
+  if (filterForm) {
+    filterForm.addEventListener("submit", (event) => {
+      event.preventDefault();
+      const kind = (filterForm.elements.namedItem("kind") as HTMLSelectElement | null)?.value;
+      const value = ((filterForm.elements.namedItem("value") as HTMLInputElement | null)?.value ?? "").trim();
+      filter = value && (kind === "email" || kind === "phone") ? { kind, value } : null;
+      void load();
+    });
+    filterForm.querySelector<HTMLElement>("[data-messages-filter-clear]")?.addEventListener("click", () => {
+      filterForm.reset();
+      filter = null;
+      void load();
+    });
+  }
   const loadIfShown = (): void => {
     if (!loaded && document.documentElement.dataset.adminTab === "messages") void load();
   };

package/apps/storefront/src/lib/orders/admin/orderActions.ts

@@ -125,11 +125,48 @@ export interface OrderActionDeps {
   confirm: (message: string) => boolean;
 }
 
+export type ContactGroup = "identity" | "email" | "phone" | "ship" | "bill";
+
+/** The field groups the vault keeps, in display order. */
+export const CONTACT_GROUPS: readonly { group: ContactGroup; label: string }[] = [
+  { group: "identity", label: "Name" },
+  { group: "email", label: "Email" },
+  { group: "phone", label: "Phone" },
+  { group: "ship", label: "Ship to" },
+  { group: "bill", label: "Bill to" },
+];
+
+/** Short human labels for the retention rules that hold a group. */
+export const RULE_LABELS: Readonly<Record<string, string>> = {
+  "fulfillment-and-service": "Order fulfillment and service",
+  "card-disputes": "Card disputes",
+  "returns-and-warranty": "Returns and warranty",
+  "returns-and-warranty-eu-eea-uk": "Returns and warranty (EU, EEA, UK)",
+  "sales-tax-sourcing": "Sales tax sourcing",
+  "legal-claims": "Legal claims",
+  "pact-delivery-sale": "PACT delivery-sale record",
+};
+
+export function ruleLabel(id: unknown): string {
+  if (typeof id !== "string" || id.trim() === "") return "Retention rule";
+  if (Object.prototype.hasOwnProperty.call(RULE_LABELS, id)) return RULE_LABELS[id]!;
+  const spaced = id.replace(/[-_]+/g, " ").trim();
+  return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+
+interface GroupView {
+  expiresAt: string;
+  rule: string | null;
+}
+
 interface OrderContact {
   customer: unknown;
   shipTo: unknown;
   billTo: unknown;
-  expiresAt: unknown;
+  /** Only the groups readable now; an expired group is absent. */
+  groups: Partial<Record<ContactGroup, GroupView>>;
+  /** Groups the server refused to erase, with the date each is held until. */
+  held: Partial<Record<ContactGroup, string>>;
 }
 
 function show(note: HTMLElement | null, lines: readonly string[]): void {
@@ -148,31 +185,44 @@ function node<K extends keyof HTMLElementTagNameMap>(tag: K, text = "", classNam
 function parseContact(body: unknown): OrderContact | null {
   if (body === null || typeof body !== "object" || Array.isArray(body)) return null;
   const record = body as Record<string, unknown>;
-  if (record.customer === null || typeof record.customer !== "object") return null;
-  if (record.shipTo === null || typeof record.shipTo !== "object") return null;
-  if (record.billTo === null || typeof record.billTo !== "object") return null;
-  return { customer: record.customer, shipTo: record.shipTo, billTo: record.billTo, expiresAt: record.expiresAt };
+  const raw = record.groups;
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const groups: Partial<Record<ContactGroup, GroupView>> = {};
+  for (const { group } of CONTACT_GROUPS) {
+    const entry = (raw as Record<string, unknown>)[group];
+    if (entry === null || typeof entry !== "object") continue;
+    const { expiresAt, rule } = entry as { expiresAt?: unknown; rule?: unknown };
+    if (typeof expiresAt !== "string" || Number.isNaN(new Date(expiresAt).getTime())) continue;
+    groups[group] = { expiresAt, rule: typeof rule === "string" ? rule : null };
+  }
+  if (Object.keys(groups).length === 0) return null;
+  return { customer: record.customer ?? {}, shipTo: record.shipTo ?? {}, billTo: record.billTo ?? {}, groups, held: {} };
 }
 
-function customerLines(customer: unknown): string[] {
+function customerField(customer: unknown, key: "name" | "email" | "phone"): string[] {
   if (customer === null || typeof customer !== "object") return [];
-  const record = customer as Record<string, unknown>;
-  return (["name", "email", "phone"] as const).flatMap((key) => {
-    const value = record[key];
-    return typeof value === "string" && value.trim() !== "" ? [value.trim()] : [];
-  });
+  const value = (customer as Record<string, unknown>)[key];
+  return typeof value === "string" && value.trim() !== "" ? [value.trim()] : [];
 }
 
-function keptUntil(expiresAt: unknown): string | null {
-  if (typeof expiresAt !== "string") return null;
-  const date = new Date(expiresAt);
-  if (Number.isNaN(date.getTime())) return null;
-  return `Contact details kept until ${date.toLocaleDateString(undefined, { year: "numeric", month: "short", day: "numeric" })}.`;
+function formatDay(iso: string): string {
+  return new Date(iso).toLocaleDateString(undefined, { year: "numeric", month: "short", day: "numeric" });
 }
 
-function group(label: string, lines: readonly string[]): HTMLElement {
+function groupLines(contact: OrderContact, group: ContactGroup): string[] {
+  if (group === "identity") return customerField(contact.customer, "name");
+  if (group === "email") return customerField(contact.customer, "email");
+  if (group === "phone") return customerField(contact.customer, "phone");
+  return addressLines(group === "ship" ? contact.shipTo : contact.billTo);
+}
+
+function keptUntil(view: GroupView): string {
+  return `Kept until ${formatDay(view.expiresAt)}. Held by: ${ruleLabel(view.rule)}.`;
+}
+
+function group(label: string, lines: readonly string[], view: GroupView): HTMLElement {
   const wrap = node("div", "", "orders-contact-group");
-  wrap.append(node("strong", label), ...lines.map((line) => node("span", line)));
+  wrap.append(node("strong", label), ...lines.map((line) => node("span", line)), node("small", keptUntil(view)));
   return wrap;
 }
 
@@ -219,33 +269,60 @@ async function settleContact(response: Response, via: ContactVia, view: ContactV
   renderContact(contact, via, view);
 }
 
-function renderContact(contact: OrderContact, via: ContactVia, view: ContactView): void {
+export const ERASE_HELD = (label: string, until: string): string =>
+  `${label} cannot be erased yet: it must be kept until ${formatDay(until)}.`;
+export const ERASE_NONE_SELECTED = "Pick at least one group to erase.";
+
+function renderContact(contact: OrderContact, via: ContactVia, view: ContactView, notice = ""): void {
   const { panel } = view;
   const status = node("p", "", "orders-contact-status");
   status.setAttribute("role", "status");
   status.hidden = true;
-  const children: HTMLElement[] = [
-    group("Customer", customerLines(contact.customer)),
-    group("Ship to", addressLines(contact.shipTo)),
-    group("Bill to", addressLines(contact.billTo)),
-  ];
-  const until = keptUntil(contact.expiresAt);
-  if (until) children.push(node("small", until));
+  const children: HTMLElement[] = [];
+  for (const { group: key, label } of CONTACT_GROUPS) {
+    const groupView = contact.groups[key];
+    if (groupView) children.push(group(label, groupLines(contact, key), groupView));
+  }
   if (via === "owner") {
-    const erase = node("button", "Erase contact details", "btn");
+    const picker = node("fieldset", "", "orders-contact-erase-groups");
+    picker.append(node("legend", "Erase these details"));
+    const boxes = new Map<ContactGroup, HTMLInputElement>();
+    for (const { group: key, label } of CONTACT_GROUPS) {
+      if (!contact.groups[key]) continue;
+      const holdUntil = contact.held[key];
+      const box = node("input");
+      box.type = "checkbox";
+      box.checked = holdUntil === undefined;
+      box.disabled = holdUntil !== undefined;
+      box.setAttribute("data-orders-erase-group", key);
+      const row = node("label", "", "orders-contact-erase-row");
+      row.append(box, node("span", holdUntil ? ERASE_HELD(label, holdUntil) : label));
+      picker.append(row);
+      boxes.set(key, box);
+    }
+    const erase = node("button", "Erase selected", "btn");
     erase.type = "button";
     erase.setAttribute("data-orders-contact-erase", "");
-    erase.addEventListener("click", () => void eraseContact(view, erase, status));
-    children.push(erase);
+    erase.addEventListener("click", () => void eraseContact(contact, view, boxes, erase, status));
+    children.push(picker, erase);
   }
   children.push(status);
+  if (notice) show(status, [notice]);
   panel.replaceChildren(...children);
   panel.hidden = false;
 }
 
-async function eraseContact(view: ContactView, button: HTMLButtonElement, status: HTMLElement): Promise<void> {
+async function eraseContact(
+  contact: OrderContact,
+  view: ContactView,
+  boxes: ReadonlyMap<ContactGroup, HTMLInputElement>,
+  button: HTMLButtonElement,
+  status: HTMLElement,
+): Promise<void> {
   const { deps, orderId, panel } = view;
   if (!deps.api) return show(status, [ERASE_FAILED]);
+  const groups = [...boxes].filter(([, box]) => box.checked && !box.disabled).map(([key]) => key);
+  if (groups.length === 0) return show(status, [ERASE_NONE_SELECTED]);
   if (!deps.confirm(ERASE_CONFIRM)) return;
   button.disabled = true;
   try {
@@ -253,10 +330,29 @@ async function eraseContact(view: ContactView, button: HTMLButtonElement, status
       method: "DELETE",
       credentials: "same-origin",
       cache: "no-store",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ groups }),
     });
-    const body = response.ok ? await readJson(response) : null;
-    if (response.ok && (body as { erased?: unknown } | null)?.erased === true) return show(panel, [CONTACT_ERASED]);
+    const body = await readJson(response);
+    if (response.ok && (body as { erased?: unknown } | null)?.erased === true) {
+      const reported = (body as { groups?: unknown }).groups;
+      const erased = Array.isArray(reported)
+        ? CONTACT_GROUPS.map((g) => g.group).filter((key) => reported.includes(key))
+        : groups;
+      for (const key of erased) delete contact.groups[key];
+      if (Object.keys(contact.groups).length === 0) return show(panel, [CONTACT_ERASED]);
+      const names = CONTACT_GROUPS.filter((g) => erased.includes(g.group)).map((g) => g.label).join(", ");
+      return renderContact(contact, "owner", view, `Erased: ${names}.`);
+    }
     if (response.status === 404) return show(panel, [CONTACT_NONE]);
+    if (response.status === 409 && errorCode(body) === "retention-hold") {
+      const held = body as { group?: unknown; holdUntil?: unknown };
+      const entry = CONTACT_GROUPS.find((g) => g.group === held.group);
+      if (entry && typeof held.holdUntil === "string" && !Number.isNaN(new Date(held.holdUntil).getTime())) {
+        contact.held[entry.group] = held.holdUntil;
+        return renderContact(contact, "owner", view, ERASE_HELD(entry.label, held.holdUntil));
+      }
+    }
     button.disabled = false;
     show(status, [ERASE_FAILED]);
   } catch {
@@ -326,6 +422,57 @@ async function loadContact(orderId: string, panel: HTMLElement | null, deps: Ord
   }
 }
 
+export const SEARCH_MALFORMED = "Enter a complete email address or phone number.";
+export const SEARCH_NONE = "No orders match that contact.";
+export const SEARCH_FAILED = "The search could not be run. Try again.";
+export const SEARCH_OWNER_ONLY = "Searching by customer contact is for the store owner.";
+
+/**
+ * Exact-match contact search: `form[data-orders-contact-search]` with a `kind` select (email|phone) and a
+ * `value` input. The value travels only as a JSON POST body, never in a URL, and is never logged.
+ */
+function mountContactSearch(root: HTMLElement, deps: OrderActionDeps): void {
+  const form = root.querySelector<HTMLFormElement>("form[data-orders-contact-search]");
+  const results = root.querySelector<HTMLElement>("[data-orders-contact-search-results]");
+  if (!form || !results) return;
+  const say = (lines: readonly string[]): void => {
+    results.replaceChildren(...lines.map((line) => node("span", line)));
+    results.hidden = false;
+  };
+  form.addEventListener("submit", (event) => {
+    event.preventDefault();
+    const kind = (form.elements.namedItem("kind") as HTMLSelectElement | null)?.value;
+    const value = ((form.elements.namedItem("value") as HTMLInputElement | null)?.value ?? "").trim();
+    if (!value || (kind !== "email" && kind !== "phone")) return say([SEARCH_MALFORMED]);
+    if (!deps.api) return say([SEARCH_FAILED]);
+    void (async () => {
+      try {
+        const response = await deps.fetch(`${deps.api}/orders/contact-search`, {
+          method: "POST",
+          credentials: "same-origin",
+          cache: "no-store",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ [kind]: value }),
+        });
+        if (response.status === 400) return say([SEARCH_MALFORMED]);
+        if (response.status === 403) return say([SEARCH_OWNER_ONLY]);
+        if (response.status === 429) return say([CONTACT_QUOTA]);
+        if (response.status === 503) return say([CONTACT_UNAVAILABLE]);
+        const body = (await readJson(response)) as { orderIds?: unknown } | null;
+        if (!response.ok || !body || !Array.isArray(body.orderIds)) return say([SEARCH_FAILED]);
+        const ids = body.orderIds.filter((id): id is string => typeof id === "string");
+        if (ids.length === 0) return say([SEARCH_NONE]);
+        const list = node("ul", "", "orders-contact-search-list");
+        for (const id of ids) list.append(node("li", id));
+        results.replaceChildren(node("span", `${ids.length} matching order${ids.length === 1 ? "" : "s"}:`), list);
+        results.hidden = false;
+      } catch {
+        say([SEARCH_FAILED]);
+      }
+    })();
+  });
+}
+
 /**
  * Wire every `[data-orders-action]` button under `root`. The button carries its plan as
  * `data-orders-action-kind|target|message`; its note is the nearest `[data-orders-action-note]` in
@@ -333,6 +480,7 @@ async function loadContact(orderId: string, panel: HTMLElement | null, deps: Ord
  * `[data-orders-blocker-action]`.
  */
 export function mountOrderActions(root: HTMLElement, deps: OrderActionDeps): void {
+  mountContactSearch(root, deps);
   const run = (button: HTMLElement, record: HTMLElement): void => {
     const kind = button.dataset.ordersActionKind as OrderActionKind | undefined;
     const target = button.dataset.ordersActionTarget ?? "";

package/apps/storefront/src/lib/orders/vault/contactIntake.ts

@@ -7,7 +7,7 @@
 import { canonicalJson, sha256Hex } from "@tot/public-runtime";
 import type { Queryable } from "../../catalog/d1/catalog.js";
 import { verifySignedCommerceToken, type CommerceCallerConfig } from "../data/orderForwardReceiver.js";
-import type { VaultKeyring } from "@/lib/customers/contactVault/envelope.js";
+import type { KmsClient } from "@/lib/customers/contactVault/kms.js";
 import { readOrderContactCommand } from "./orderContact.js";
 import { sealOrderContact, type SealOutcome } from "./orderContactVault.js";
 import { type VaultStage } from "@/lib/customers/contactVault/contactAudit.js";
@@ -26,10 +26,11 @@ function isStage(value: unknown): value is VaultStage {
 
 export async function receiveOrderContact(
   db: Queryable,
-  keyring: VaultKeyring | null,
+  kms: KmsClient,
   body: unknown,
   token: string,
   config: CommerceCallerConfig,
+  tenantClass: { regulated: boolean },
 ): Promise<ContactIntakeResult> {
   if (!isStage(config.expectedStage)) return { ok: false, status: 503, reason: "vault-unavailable" };
   if (!isRecord(body)) return { ok: false, status: 400, reason: "malformed" };
@@ -47,10 +48,11 @@ export async function receiveOrderContact(
   }
   const command = readOrderContactCommand(contact);
   if (!command) return { ok: false, status: 400, reason: "malformed" };
-  const sealed: SealOutcome = await sealOrderContact(db, keyring, {
+  const sealed: SealOutcome = await sealOrderContact(db, kms, {
     tenantId,
     stage,
     command,
+    regulated: tenantClass.regulated,
     issuer: verified.issuer,
     jti: verified.jti,
     now: new Date(config.now),

package/apps/storefront/src/lib/orders/vault/contactRoutes.ts

@@ -11,8 +11,8 @@ import { contactReaderAuthority, resolveContactReadGrant } from "@/lib/access/au
 import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1, type Queryable } from "@/lib/catalog/d1/catalog.js";
 import { commerceStageForEnv } from "@/lib/fulfillment/fulfillmentService";
-import type { VaultKeyring } from "@/lib/customers/contactVault/envelope.js";
-import { loadVaultKeyring } from "./keyringEnv.js";
+import type { KmsClient } from "@/lib/customers/contactVault/kms.js";
+import { loadVaultKms } from "./kmsEnv.js";
 import { type ContactActor, type VaultStage } from "@/lib/customers/contactVault/contactAudit.js";
 
 export const SUPPORT_REASON_CODES = [
@@ -49,7 +49,7 @@ export function readSupportReason(body: unknown): { reasonCode: string; ticketRe
 
 export type ContactRoute =
   | { ok: false; response: Response }
-  | { ok: true; db: Queryable; keyring: VaultKeyring | null; tenantId: string; stage: VaultStage; actor: ContactActor };
+  | { ok: true; db: Queryable; kms: KmsClient; tenantId: string; stage: VaultStage; actor: ContactActor };
 
 export async function openContactRoute(
   context: APIContext,
@@ -83,7 +83,7 @@ export async function openContactRoute(
   if (!stage) return refuse("stage-unknown", 409);
   const d1 = await readD1("STOREFRONT_APPS_DB");
   if (!d1) return refuse("unavailable", 503);
-  return { ok: true, db: fromD1(d1), keyring: await loadVaultKeyring(), tenantId: host, stage, actor };
+  return { ok: true, db: fromD1(d1), kms: await loadVaultKms(), tenantId: host, stage, actor };
 }
 
 /** Read a request's JSON body, or undefined when it is absent or not JSON. */

package/apps/storefront/src/lib/orders/vault/kmsEnv.ts

@@ -0,0 +1,11 @@
+/**
+ * The Worker's contact vault KMS client, from the declared `CONTACT_VAULT_KMS` secret only. An absent
+ * or malformed secret yields a client whose every call refuses with vault-key-unavailable; there is
+ * no fallback key.
+ */
+import { readEnv } from "@/lib/publication/shared/env";
+import { createKmsClient, parseKmsCredential, type KmsClient } from "@/lib/customers/contactVault/kms.js";
+
+export async function loadVaultKms(): Promise<KmsClient> {
+  return createKmsClient(parseKmsCredential(await readEnv("CONTACT_VAULT_KMS")));
+}