@tollwyn/baukasten 1.2.2 → 1.3.0

package/dist/server/core.js

@@ -0,0 +1,168 @@
+import { createDb } from './adapter/db.js';
+import { exitAfterLog, log } from './adapter/log.js';
+import { createMailer } from './adapter/mailer.js';
+import { migrationSources, migrationStatus } from './adapter/migrate.js';
+import { ConfigError } from './config.js';
+import { CHECK_TIMEOUT_MS, databaseCheck, deepHealth, mailCheck } from './health.js';
+import { createLimits } from './limits.js';
+const HEALTH = '/health';
+const DEEP = '/health/deep';
+/** The queries of the database check end before the check does, and give their connection back. */
+const PROBE_TIMEOUT_MS = CHECK_TIMEOUT_MS - 1_000;
+export function json(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' }
+    });
+}
+/**
+ * A page without its content security policy does not go out: the policy comes from `option` in
+ * sveltekit() of the product's vite.config.ts, and without it every page is a 500 that the delivery
+ * service sees, not a product that runs without the policy unnoticed. The log says it once.
+ */
+export function policyGuard(option, noun) {
+    let said = false;
+    return (response, path) => {
+        const page = response.headers.get('content-type')?.startsWith('text/html') === true;
+        if (!page || response.status >= 500 || response.headers.has('content-security-policy')) {
+            return response;
+        }
+        if (!said) {
+            said = true;
+            log.error(`a page without its content security policy: ${option} of the baukasten is missing in sveltekit() of vite.config.ts, or an endpoint of the ${noun} answers HTML of its own; every such answer is a 500`, { path });
+        }
+        return new Response('Internal Error', {
+            status: 500,
+            headers: { 'content-type': 'text/plain; charset=utf-8' }
+        });
+    };
+}
+export function serverCore(spec) {
+    const own = spec.hooks.checks ?? {};
+    if ('database' in own || 'mail' in own || spec.check in own) {
+        throw new Error(`the checks database, mail and ${spec.check} belong to the baukasten`);
+    }
+    let state = { kind: 'waiting' };
+    function running() {
+        switch (state.kind) {
+            case 'running':
+                return state;
+            case 'building':
+                throw new Error(`the baukasten is used in the build: its pages read the configuration of the running ${spec.noun} and cannot be prerendered`);
+            case 'waiting':
+                throw new Error('the baukasten is used before init ran');
+        }
+    }
+    async function stop(context, opened) {
+        await opened.runs?.stop();
+        try {
+            await spec.hooks.stop?.(context);
+        }
+        catch (error) {
+            process.exitCode = 1;
+            log.error(`the stop hook of the ${spec.noun} failed`, { error });
+        }
+        await context.db.close();
+        log.info('stopped');
+    }
+    async function start() {
+        const root = process.cwd();
+        let config;
+        try {
+            config = spec.load(root);
+        }
+        catch (error) {
+            if (!(error instanceof ConfigError))
+                throw error;
+            log.error('configuration incomplete, not starting', { problems: error.problems });
+            return exitAfterLog(1);
+        }
+        if (config.missing.length > 0) {
+            log.warn('running without what production needs', { missing: config.missing });
+        }
+        const db = createDb(config.databaseUrl, log);
+        const mail = createMailer(config.mail, config.name, log);
+        const limits = createLimits({ now: () => Date.now() });
+        const context = { config, db, log, mail, limits };
+        const opened = spec.open(context);
+        const sources = migrationSources(root, spec.art);
+        const probe = db.withTimeout(PROBE_TIMEOUT_MS);
+        const checks = Object.fromEntries(Object.entries(own).map(([name, check]) => [name, () => check(context)]));
+        const health = deepHealth({
+            checks: {
+                database: databaseCheck(probe, () => migrationStatus(probe, sources), log),
+                mail: mailCheck(mail, log),
+                [spec.check]: opened.check,
+                ...checks
+            },
+            now: () => Date.now(),
+            log
+        });
+        state = { kind: 'running', context, services: opened.services, health };
+        log.info('starting', {
+            mode: config.mode,
+            origin: config.publicOrigin,
+            language: config.language
+        });
+        opened.runs?.start();
+        await spec.hooks.start?.(context);
+        process.once('sveltekit:shutdown', () => void stop(context, opened));
+    }
+    const init = (building) => () => {
+        if (!building)
+            return start();
+        state = { kind: 'building' };
+    };
+    async function health(event) {
+        if (event.request.method !== 'GET' && event.request.method !== 'HEAD') {
+            return new Response(null, { status: 405, headers: { allow: 'GET, HEAD' } });
+        }
+        // Plain health answers without the database: Neon may sleep, the process still lives.
+        if (event.url.pathname === HEALTH)
+            return json({ status: 'ok' }, 200);
+        const report = await running().health();
+        return json(report, report.status === 'ok' ? 200 : 503);
+    }
+    const handle = async ({ event, resolve }) => {
+        // Prerendering in the build is no request of anyone.
+        if (state.kind === 'building')
+            return resolve(event);
+        const started = performance.now();
+        let status = 500;
+        try {
+            const path = event.url.pathname;
+            const response = path === HEALTH || path === DEEP
+                ? await health(event)
+                : await spec.respond(running(), event, resolve);
+            for (const [name, value] of Object.entries(spec.headers)) {
+                response.headers.set(name, value);
+            }
+            status = response.status;
+            return response;
+        }
+        finally {
+            // The container polls /health; it is logged only at debug. The path goes without its query,
+            // which may carry a token.
+            (event.url.pathname === HEALTH ? log.debug : log.info)('request', {
+                method: event.request.method,
+                path: event.url.pathname,
+                status,
+                ms: Math.round(performance.now() - started),
+                ...spec.logged?.(event)
+            });
+        }
+    };
+    const handleError = ({ error, event, status, message }) => {
+        // An unknown path is already in the request log.
+        if (status === 404)
+            return { message };
+        (status >= 500 ? log.error : log.warn)('request failed', {
+            method: event.request.method,
+            path: event.url.pathname,
+            status,
+            error
+        });
+        return { message: status >= 500 ? 'Internal Error' : message };
+    };
+    return { init, handle, handleError, running };
+}

package/dist/server/health.js

@@ -1,5 +1,5 @@
 import { StripeFailed } from './billing.js';
-import { catalogDifferences, foreignWebhooks } from './catalog.js';
+import { catalogChanges, catalogPlan, foreignWebhooks } from './catalog.js';
 import { describeError } from './log.js';
 import { MailFailed } from './mail.js';
 export class CheckFailed extends Error {
@@ -97,7 +97,7 @@ export function stripeCheck(stripe, catalog, shop, log) {
         let foreign;
         try {
             [differences, foreign] = await Promise.all([
-                catalogDifferences(stripe, catalog, shop),
+                catalogPlan(stripe, catalog, shop).then(catalogChanges),
                 foreignWebhooks(stripe, shop.origin)
             ]);
         }

package/dist/server/hook.d.ts

@@ -4,7 +4,7 @@ import type { Product, ProductEnv } from '../product.js';
 import { type Account } from './accounts.js';
 import { type CheckoutPage, type Order, type Purchase, type SubscriptionChange } from './billing.js';
 import { type Config } from './config.js';
-import { type Limits } from './limits.js';
+import type { Limits } from './limits.js';
 import type { Log } from './log.js';
 import { type OpenApiDocument } from './openapi.js';
 import { type Pages } from './pages.js';

package/dist/server/hook.js

@@ -1,26 +1,21 @@
 import { createAccounts } from './accounts.js';
-import { createDb } from './adapter/db.js';
-import { exitAfterLog, log } from './adapter/log.js';
-import { createMailer } from './adapter/mailer.js';
-import { migrationSources, migrationStatus } from './adapter/migrate.js';
+import { log } from './adapter/log.js';
 import { secrets } from './adapter/secrets.js';
 import { createStripe } from './adapter/stripe.js';
-import { asApiError, readBody, respond } from './api.js';
+import { asApiError, readBody, respond as respondApi } from './api.js';
 import { createBilling, noBilling } from './billing.js';
-import { ConfigError, loadConfig } from './config.js';
+import { loadConfig } from './config.js';
+import { policyGuard, serverCore } from './core.js';
 import { apiAccount, serveApi } from './endpoints.js';
-import { CHECK_TIMEOUT_MS, databaseCheck, deepHealth, mailCheck, stripeCheck } from './health.js';
+import { stripeCheck } from './health.js';
 import { SECURITY_HEADERS } from './headers.js';
 import { legalPages } from './legal/index.js';
-import { createLimits } from './limits.js';
 import { serveMachine } from './machine.js';
 import { MESSAGES } from './messages.js';
 import { mergeOpenApi, openApiPart } from './openapi.js';
 import { createPages } from './pages.js';
 import { BAUKASTEN_TERMS_DATE, termsVersion } from './terms.js';
 import { clearSessionCookie, clientAddress, isCrossSite, isMachinePath, SESSION_COOKIE } from './web.js';
-const HEALTH = '/health';
-const DEEP = '/health/deep';
 /**
  * The product's src/app.html writes `<html lang="%baukasten.lang%" %baukasten.theme%>`; the handle
  * fills in its language and, with a theme in its marks, `data-theme="…"`, else nothing.
@@ -31,59 +26,11 @@ const THEME = '%baukasten.theme%';
 function themeAttribute(theme) {
     return theme === undefined ? '' : `data-theme="${theme}"`;
 }
-/** The queries of the database check end before the check does, and give their connection back. */
-const PROBE_TIMEOUT_MS = CHECK_TIMEOUT_MS - 1_000;
-function json(body, status) {
-    return new Response(JSON.stringify(body), {
-        status,
-        headers: { 'content-type': 'application/json', 'cache-control': 'no-store' }
-    });
-}
 export function baukasten(product, hooks = {}) {
-    const own = hooks.checks ?? {};
-    if ('database' in own || 'mail' in own || 'stripe' in own) {
-        throw new Error('the checks database, mail and stripe belong to the baukasten');
-    }
-    let state = { kind: 'waiting' };
-    function running() {
-        switch (state.kind) {
-            case 'running':
-                return state;
-            case 'building':
-                throw new Error('the baukasten is used in the build: its pages read the configuration of the running product and cannot be prerendered');
-            case 'waiting':
-                throw new Error('the baukasten is used before init ran');
-        }
-    }
-    async function stop(context) {
-        try {
-            await hooks.stop?.(context);
-        }
-        catch (error) {
-            process.exitCode = 1;
-            log.error('the stop hook of the product failed', { error });
-        }
-        await context.db.close();
-        log.info('stopped');
-    }
-    async function start() {
-        let config;
-        try {
-            config = loadConfig(process.env, product);
-        }
-        catch (error) {
-            if (!(error instanceof ConfigError))
-                throw error;
-            log.error('configuration incomplete, not starting', { problems: error.problems });
-            return exitAfterLog(1);
-        }
-        if (config.missing.length > 0) {
-            log.warn('running without what production needs', { missing: config.missing });
-        }
-        const db = createDb(config.databaseUrl, log);
-        const mail = createMailer(config.mail, config.name, log);
-        const limits = createLimits({ now: () => Date.now() });
-        const context = { config, db, log, mail, limits };
+    const withPolicy = policyGuard('SVELTEKIT_OPTIONS', 'product');
+    /** Billing, accounts, legal pages and the rest, on the pool, mail and limits of the core. */
+    function open(context) {
+        const { config, db, mail, limits } = context;
         const version = termsVersion(BAUKASTEN_TERMS_DATE, product.termsDate);
         const messages = MESSAGES[config.language];
         const shop = { name: config.name, origin: config.publicOrigin };
@@ -133,52 +80,17 @@ export function baukasten(product, hooks = {}) {
             address: (event) => clientAddress(event.request.headers, config.mode, () => event.getClientAddress()),
             now: () => new Date()
         };
-        const sources = migrationSources(process.cwd(), 'webapp');
-        const probe = db.withTimeout(PROBE_TIMEOUT_MS);
-        const checks = Object.fromEntries(Object.entries(own).map(([name, check]) => [name, () => check(context)]));
-        // Without Stripe, locally, there is nothing to check.
-        const stripeHealth = paid === null
-            ? () => Promise.resolve()
-            : stripeCheck(paid.stripe, product.catalog, shop, log);
-        const health = deepHealth({
-            checks: {
-                database: databaseCheck(probe, () => migrationStatus(probe, sources), log),
-                mail: mailCheck(mail, log),
-                stripe: stripeHealth,
-                ...checks
-            },
-            now: () => Date.now(),
-            log
-        });
-        state = { kind: 'running', context, services, health };
-        log.info('starting', {
-            mode: config.mode,
-            origin: config.publicOrigin,
-            language: config.language
-        });
-        await hooks.start?.(context);
-        process.once('sveltekit:shutdown', () => void stop(context));
-    }
-    const init = (building) => () => {
-        if (!building)
-            return start();
-        state = { kind: 'building' };
-    };
-    async function health(event) {
-        if (event.request.method !== 'GET' && event.request.method !== 'HEAD') {
-            return new Response(null, { status: 405, headers: { allow: 'GET, HEAD' } });
-        }
-        // Plain health answers without the database: Neon may sleep, the process still lives.
-        if (event.url.pathname === HEALTH)
-            return json({ status: 'ok' }, 200);
-        const report = await running().health();
-        return json(report, report.status === 'ok' ? 200 : 503);
+        return {
+            services,
+            // Without Stripe, locally, there is nothing to check.
+            check: paid === null
+                ? () => Promise.resolve()
+                : stripeCheck(paid.stripe, product.catalog, shop, log)
+        };
     }
-    async function respondTo(event, resolve) {
+    async function respond(r, event, resolve) {
         const path = event.url.pathname;
-        if (path === HEALTH || path === DEEP)
-            return health(event);
-        const s = running().services;
+        const s = r.services;
         event.locals.account = null;
         if (isCrossSite(event.request, s.config.publicOrigin)) {
             log.warn('request refused: from another origin', { path });
@@ -208,86 +120,39 @@ export function baukasten(product, hooks = {}) {
         });
         return path.startsWith('/api/') ? asApiError(response, s.messages) : withPolicy(response, path);
     }
-    /** Whether a page went out without its content security policy; said once in the log. */
-    let policyMissing = false;
-    /**
-     * A page without its content security policy does not go out: the policy comes from
-     * SVELTEKIT_OPTIONS in the configuration of the product, and without it every page is a 500 that
-     * the delivery service sees, not a product that runs without the policy unnoticed.
-     */
-    function withPolicy(response, path) {
-        const page = response.headers.get('content-type')?.startsWith('text/html') === true;
-        if (!page || response.status >= 500 || response.headers.has('content-security-policy')) {
-            return response;
-        }
-        if (!policyMissing) {
-            policyMissing = true;
-            log.error('a page without its content security policy: SVELTEKIT_OPTIONS of the baukasten is missing in sveltekit() of vite.config.ts, or an endpoint of the product answers HTML of its own; every such answer is a 500', { path });
-        }
-        return new Response('Internal Error', {
-            status: 500,
-            headers: { 'content-type': 'text/plain; charset=utf-8' }
-        });
-    }
-    const handle = async ({ event, resolve }) => {
-        // Prerendering in the build is no request of anyone.
-        if (state.kind === 'building')
-            return resolve(event);
-        const started = performance.now();
-        let status = 500;
-        try {
-            const response = await respondTo(event, resolve);
-            for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
-                response.headers.set(name, value);
-            }
-            status = response.status;
-            return response;
-        }
-        finally {
-            // The container polls /health; it is logged only at debug. The path goes without its query,
-            // which may carry a token.
-            (event.url.pathname === HEALTH ? log.debug : log.info)('request', {
-                method: event.request.method,
-                path: event.url.pathname,
-                status,
-                ms: Math.round(performance.now() - started)
-            });
-        }
-    };
-    const handleError = ({ error, event, status, message }) => {
-        // An unknown path is already in the request log.
-        if (status === 404)
-            return { message };
-        (status >= 500 ? log.error : log.warn)('request failed', {
-            method: event.request.method,
-            path: event.url.pathname,
-            status,
-            error
-        });
-        return { message: status >= 500 ? 'Internal Error' : message };
-    };
+    const core = serverCore({
+        noun: 'product',
+        art: 'webapp',
+        check: 'stripe',
+        hooks,
+        load: () => loadConfig(process.env, product),
+        open,
+        respond,
+        headers: SECURITY_HEADERS
+    });
+    const services = () => core.running().services;
     return {
-        init,
-        handle,
-        handleError,
-        context: () => running().context,
-        pages: createPages(() => running().services),
-        clientAddress: (event) => running().services.address(event),
+        init: core.init,
+        handle: core.handle,
+        handleError: core.handleError,
+        context: () => core.running().context,
+        pages: createPages(services),
+        clientAddress: (event) => services().address(event),
         api: {
             respond: (handler) => {
-                const s = running().services;
-                return respond(s.log, s.messages, handler);
+                const s = services();
+                return respondApi(s.log, s.messages, handler);
             },
-            body: (request, schema) => readBody(request, schema, running().services.messages),
-            account: async (event) => (await apiAccount(running().services, event)).account
+            body: (request, schema) => readBody(request, schema, services().messages),
+            account: async (event) => (await apiAccount(services(), event)).account
         },
         openApi: (document) => {
-            const s = running().services;
+            const s = services();
             return mergeOpenApi(document, openApiPart(s.config.publicOrigin, s.messages));
         },
         billing: {
-            checkout: (account, order) => running().services.billing.checkout(account, order),
-            portal: (account, back) => running().services.billing.portal(account, back)
+            checkout: (account, order) => services().billing.checkout(account, order),
+            portal: (account, back) => services().billing.portal(account, back)
         }
     };
 }

package/dist/server/mail.d.ts

@@ -13,7 +13,10 @@ export declare class MailFailed extends Error {
         command?: string;
     });
 }
-/** Sends a mail of the accounts: true when it went out; a failure is logged with its kind. */
+/**
+ * Sends a mail of the accounts: true when it went out, false when the relay did not take it, which
+ * is logged with its kind. Any other failure is a fault and goes on to the caller.
+ */
 export declare function deliver(mailer: Mailer, log: Log, mail: Mail, about: {
     kind: string;
     account: string;

package/dist/server/mail.js

@@ -15,15 +15,20 @@ export class MailFailed extends Error {
         this.code = details.code;
     }
 }
-/** Sends a mail of the accounts: true when it went out; a failure is logged with its kind. */
+/**
+ * Sends a mail of the accounts: true when it went out, false when the relay did not take it, which
+ * is logged with its kind. Any other failure is a fault and goes on to the caller.
+ */
 export async function deliver(mailer, log, mail, about) {
     try {
         await mailer.send(mail);
-        log.info('mail sent', about);
-        return true;
     }
     catch (error) {
+        if (!(error instanceof MailFailed))
+            throw error;
         log.error('mail failed', { ...about, error });
         return false;
     }
+    log.info('mail sent', about);
+    return true;
 }

package/dist/server/messages.d.ts

@@ -35,6 +35,7 @@ export interface Messages {
     mailFailed: string;
     account: {
         sameEmail: string;
+        notChanged: string;
         wrongPassword: string;
         wrongCurrent: string;
         taken: string;

package/dist/server/messages.js

@@ -23,6 +23,7 @@ const en = {
     mailFailed: 'We could not send the email. Please try again in a moment.',
     account: {
         sameEmail: 'This is your address already.',
+        notChanged: 'We could not change your address just now; it stays as it was. Please try again in a few minutes.',
         wrongPassword: 'The password is wrong.',
         wrongCurrent: 'The current password is wrong.',
         taken: 'Another account uses this address.',
@@ -137,6 +138,7 @@ const de = {
     mailFailed: 'Wir konnten die E-Mail nicht senden. Bitte versuchen Sie es gleich nochmals.',
     account: {
         sameEmail: 'Das ist schon Ihre Adresse.',
+        notChanged: 'Wir konnten Ihre Adresse gerade nicht ändern; sie bleibt, wie sie war. Bitte versuchen Sie es in einigen Minuten nochmals.',
         wrongPassword: 'Das Passwort ist falsch.',
         wrongCurrent: 'Das aktuelle Passwort ist falsch.',
         taken: 'Ein anderes Konto benutzt diese Adresse.',

package/dist/server/pages.js

@@ -1,6 +1,7 @@
 import { fail, redirect } from '@sveltejs/kit';
 import { z } from 'zod';
 import { EmailTaken, normalizeEmail, sha256 } from './accounts.js';
+import { StripeFailed } from './billing.js';
 import { emailField, field, passwordField, problem } from './fields.js';
 import { LIMITS } from './limits.js';
 import { deliver } from './mail.js';
@@ -291,7 +292,20 @@ export function createPages(services) {
             actions: {
                 default: async (event) => {
                     const s = services();
-                    const result = await s.accounts.confirmEmailChange(field(await event.request.formData(), 'token'));
+                    const token = field(await event.request.formData(), 'token');
+                    let result;
+                    try {
+                        // Receipts and invoices follow the address, or the address does not change.
+                        result = await s.accounts.confirmEmailChange(token, (tx, accountId, email) => s.billing.followEmail(tx, accountId, email));
+                    }
+                    catch (error) {
+                        if (!(error instanceof StripeFailed))
+                            throw error;
+                        s.log.error('stripe: the customer could not take the new address; it did not change', {
+                            error
+                        });
+                        return fail(503, { error: s.messages.account.notChanged });
+                    }
                     switch (result.kind) {
                         case 'invalid':
                             return fail(400, { error: s.messages.link.invalid });
@@ -305,15 +319,6 @@ export function createPages(services) {
                                 newEmail: result.newEmail
                             });
                             await deliver(s.mail, s.log, { to: result.oldEmail, ...notice }, { kind: 'email_changed', account: result.accountId });
-                            // The address has changed; receipts that still go to the old one are in the log.
-                            await s.billing
-                                .followEmail(result.accountId, result.newEmail)
-                                .catch((error) => {
-                                s.log.error('stripe: the customer kept the old address', {
-                                    account: result.accountId,
-                                    error
-                                });
-                            });
                             const own = event.locals.account !== null && event.locals.account.id === result.accountId;
                             redirect(303, own ? TO.accountEmailChanged : TO.loginEmailChanged);
                         }

package/dist/server/ports.d.ts

@@ -58,7 +58,7 @@ export type StripePrice = {
     product: string;
     /** In the smallest unit of the currency; null for a price that is not a fixed amount. */
     amount: number | null;
-    /** Small letters, as Stripe writes it. */
+    /** Its code, like CHF. */
     currency: string;
 } & ({
     type: 'one_time';
@@ -79,6 +79,18 @@ export type NewPrice = {
     type: 'recurring';
     interval: 'month' | 'year';
 });
+/** A product whose subscription a customer may change in the customer portal, and to which prices. */
+export interface PortalProduct {
+    product: string;
+    prices: string[];
+    adjustable_quantity: {
+        enabled: false;
+    } | {
+        enabled: true;
+        minimum: number;
+        maximum: number;
+    };
+}
 /** What the baukasten sets of the default configuration of the customer portal, as the API takes it. */
 export interface PortalConfiguration {
     business_profile: {
@@ -109,17 +121,7 @@ export interface PortalConfiguration {
             enabled: true;
             default_allowed_updates: ('price' | 'quantity')[];
             proration_behavior: 'create_prorations';
-            products: {
-                product: string;
-                prices: string[];
-                adjustable_quantity: {
-                    enabled: false;
-                } | {
-                    enabled: true;
-                    minimum: number;
-                    maximum: number;
-                };
-            }[];
+            products: PortalProduct[];
         };
     };
 }
@@ -209,7 +211,7 @@ export type StripeEvent = {
 });
 /**
  * Stripe, with the key of the product. A failure throws StripeFailed (billing.ts), whose message
- * names what Stripe called it and never the key.
+ * names what Stripe called it and never the key. A currency is its code, like CHF, both ways.
  */
 export interface StripeApi {
     /** The product of this id, archived or not; null when there is none. */
@@ -255,8 +257,13 @@ export interface StripeApi {
     subscription(id: string): Promise<StripeSubscription>;
     /** Ends a subscription at once; `missing` when Stripe does not know it. */
     cancelSubscription(id: string): Promise<'canceled' | 'missing'>;
-    /** Returns the address of the Checkout page. */
-    createCheckout(request: CheckoutRequest): Promise<string>;
+    /** Returns the session and the address of its Checkout page. */
+    createCheckout(request: CheckoutRequest): Promise<{
+        id: string;
+        url: string;
+    }>;
+    /** Ends a Checkout that is still open, so that it can no longer be paid; `complete` if it was. */
+    retireCheckout(id: string): Promise<'expired' | 'complete'>;
     /** Returns the address of the customer portal. */
     createPortalSession(session: {
         customerId: string;

package/dist/server/sales.js

@@ -95,11 +95,12 @@ export async function salesNumbers(db, options) {
 					OR EXISTS (SELECT 1 FROM baukasten.purchases p WHERE p.account_id = a.id AND p.amount > 0)
 				)::int AS zahlende
 			 FROM baukasten.accounts a WHERE (NOT $1 OR a.stripe_mode = 'live') GROUP BY a.via`, [live]),
+        // The columns keep the currency in small letters, as Stripe writes it (003_stripe_and_sales.sql).
         db.query(`SELECT a.via, sum(paid.amount)::text AS cent FROM (
-				SELECT account_id, amount FROM baukasten.invoices WHERE currency = $1
-				UNION ALL SELECT account_id, amount FROM baukasten.purchases WHERE currency = $1
+				SELECT account_id, amount FROM baukasten.invoices WHERE currency = lower($1)
+				UNION ALL SELECT account_id, amount FROM baukasten.purchases WHERE currency = lower($1)
 			 ) paid JOIN baukasten.accounts a ON a.id = paid.account_id
-			 WHERE (NOT $2 OR a.stripe_mode = 'live') GROUP BY a.via`, [options.currency.toLowerCase(), live]),
+			 WHERE (NOT $2 OR a.stripe_mode = 'live') GROUP BY a.via`, [options.currency, live]),
         db.query(`SELECT own.name, a.via, sum(own.value)::text AS value
 			 FROM unnest($1::text[], $2::uuid[], $3::bigint[]) AS own (name, account, value)
 			 JOIN baukasten.accounts a ON a.id = own.account