@unchainedshop/api 4.0.0-rc.12 → 4.0.0-rc.14

package/src/mcp/utils/getNormalizedOrderDetails.ts

@@ -0,0 +1,77 @@
+import { OrderPricingSheet } from '@unchainedshop/core';
+import { Context } from '../../context.js';
+import { getNormalizedProductDetails } from './getNormalizedProductDetails.js';
+import { removeConfidentialServiceHashes } from '@unchainedshop/core-users';
+
+export async function getNormalizedOrderDetails(
+  { orderId, orderNumber }: { orderId?: string; orderNumber?: string },
+  context: Context,
+) {
+  const { modules, loaders } = context;
+  const order = await modules.orders.findOrder({ orderId, orderNumber });
+  if (!order) return null;
+  const positions = await modules.orders.positions.findOrderPositions({
+    orderId: order._id,
+  });
+  const payment = await modules.orders.payments.findOrderPayment({
+    orderPaymentId: order?.paymentId,
+  });
+  const delivery = await modules.orders.deliveries.findDelivery({
+    orderDeliveryId: order?.deliveryId,
+  });
+  const [
+    items,
+    user,
+    enrollments,
+    currency,
+    country,
+    supportedPaymentProviders,
+    supportedDeliveryProviders,
+    discounts,
+  ] = await Promise.all([
+    Promise.all(
+      positions.map(async ({ productId, ...position }) => ({
+        ...(await getNormalizedProductDetails(productId, context)),
+        ...position,
+      })),
+    ),
+    loaders.userLoader.load({ userId: order.userId }),
+    modules.enrollments.findEnrollment({
+      orderId: order._id,
+    }),
+    loaders.currencyLoader.load({ isoCode: order.currencyCode }),
+    loaders.countryLoader.load({ isoCode: order.countryCode }),
+    context.services.orders.supportedPaymentProviders({
+      order,
+    }),
+    context.services.orders.supportedDeliveryProviders({
+      order,
+    }),
+    modules.orders.discounts.findOrderDiscounts({ orderId: order._id }),
+  ]);
+  let total = null;
+  const pricing = OrderPricingSheet({
+    calculation: order.calculation,
+    currencyCode: order.currencyCode,
+  });
+
+  if (pricing.isValid()) {
+    total = pricing.total();
+  }
+
+  return {
+    ...order,
+    total,
+    discounts,
+    enrollments,
+    currency,
+    supportedDeliveryProviders,
+    supportedPaymentProviders,
+    country,
+    user: removeConfidentialServiceHashes(user),
+    status: order?.status ?? 'OPEN',
+    items,
+    payment,
+    delivery,
+  };
+}

package/src/mcp/utils/getNormalizedProductDetails.ts

@@ -15,12 +15,16 @@ export async function getNormalizedProductDetails(productId: string, context: Co
   let variations = [];
   let bundleItems = [];
   let assignments = [];
-  if (product.type === ProductTypes.ConfigurableProduct && product?.proxy?.assignments?.length) {
+  const reviews = await modules.products.reviews.findProductReviews({
+    productId,
+  });
+
+  if (product.type === ProductTypes.ConfigurableProduct) {
     variations = await context.modules.products.variations.findProductVariations({
-      productId: product._id,
+      productId: product?._id,
     });
     assignments = await Promise.all(
-      product?.proxy?.assignments?.map(async (assignment) => {
+      (product?.proxy?.assignments || [])?.map(async (assignment) => {
         const product = await loaders.productLoader.load({
           productId: assignment.productId,
         });
@@ -34,7 +38,7 @@ export async function getNormalizedProductDetails(productId: string, context: Co
         });
         return {
           assignment: {
-            ...assignment,
+            ...(assignment || {}),
             product: {
               ...product,
               media,
@@ -94,5 +98,6 @@ export async function getNormalizedProductDetails(productId: string, context: Co
     variations,
     bundleItems,
     pricing,
+    reviews,
   };
 }

package/src/mcp/utils/getNormalizedUserDetails.ts

@@ -0,0 +1,86 @@
+import { removeConfidentialServiceHashes, User } from '@unchainedshop/core-users';
+import { Context } from '../../context.js';
+import normalizeMediaUrl from './normalizeMediaUrl.js';
+
+const getPrimaryEmail = (user: User) => {
+  return (user.emails || []).toSorted(
+    (left, right) => Number(right.verified) - Number(left.verified),
+  )?.[0];
+};
+
+export async function getNormalizedUserDetails(userId: string, context: Context) {
+  const { modules, loaders } = context;
+  const user = await modules.users.findUserById(userId);
+  if (!user) return null;
+
+  const avatar = await loaders.fileLoader.load({
+    fileId: user.avatarId,
+  });
+  const normalizedAvatar = await normalizeMediaUrl([{ mediaId: avatar?._id }], context);
+
+  const primaryEmail = getPrimaryEmail(user);
+  const { profile } = user;
+  let name = primaryEmail?.address || user._id;
+  if (profile && profile.displayName && profile.displayName !== '') name = profile.displayName;
+
+  const walletAddresses =
+    user.services?.web3?.flatMap((service) => {
+      return service.verified ? [service.address] : [];
+    }) || [];
+
+  const tokens = await context.modules.warehousing.findTokensForUser({
+    userId: user._id,
+    walletAddresses,
+  });
+
+  const userLocale = await modules.users.userLocale(user);
+
+  const country = await loaders.countryLoader.load({
+    isoCode: userLocale.region,
+  });
+
+  const enrollments = await modules.enrollments.findEnrollments({
+    userId: user._id,
+  });
+
+  const language = await loaders.languageLoader.load({ isoCode: userLocale.language });
+  const orders = await modules.orders.findOrders({
+    userId: user._id,
+  });
+
+  const paymentCredentials = await modules.payment.paymentCredentials.findPaymentCredentials(
+    { userId: user._id },
+    {
+      sort: {
+        created: -1,
+      },
+    },
+  );
+
+  const quotations = await modules.quotations.findQuotations({
+    userId: user._id,
+  });
+
+  const reviews = await modules.products.reviews.findProductReviews({
+    authorId: user._id,
+  });
+  const safeUser = removeConfidentialServiceHashes(user);
+
+  return {
+    ...safeUser,
+    avatar: normalizedAvatar,
+    primaryEmail,
+    name,
+    isGuest: !!safeUser?.guest,
+    tokens,
+    country,
+    enrollments,
+    language,
+    orders,
+    paymentCredentials,
+    quotations,
+    webAuthnCredentials: user?.services?.webAuthn || [],
+    web3Addresses: user?.services?.web3 || [],
+    reviews,
+  };
+}

package/src/mcp/utils/normalizeMediaUrl.ts

@@ -3,19 +3,22 @@ import { getFileAdapter } from '@unchainedshop/core-files';
 const normalizeMediaUrl = async (medias = [], context) => {
   if (medias?.length) {
     const normalizedMedias = await Promise.all(
-      medias.map(async (media) => {
-        const file = await context.loaders.fileLoader.load({
-          fileId: media.mediaId,
-        });
-        const fileUploadAdapter = getFileAdapter();
-        const url = await fileUploadAdapter.createDownloadURL(file);
-        file.url = context.modules.files.normalizeUrl(url, {});
+      medias
+        .map(async (media) => {
+          const file = await context.loaders.fileLoader.load({
+            fileId: media.mediaId,
+          });
+          if (!file) return null;
+          const fileUploadAdapter = getFileAdapter();
+          const url = await fileUploadAdapter.createDownloadURL(file);
+          file.url = context.modules.files.normalizeUrl(url, {});
 
-        return {
-          ...media,
-          file,
-        };
-      }),
+          return {
+            ...media,
+            file,
+          };
+        })
+        .filter(Boolean),
     );
 
     return normalizedMedias.filter(Boolean);

package/src/mcp/utils/sanitizeLocalizationEntityData.ts

@@ -0,0 +1,26 @@
+import {
+  LocalizationType,
+  LocalizationEntity,
+  LocalizationUpdateEntity,
+} from '../tools/localization/types.js';
+import validateIsoCode from './validateIsoCode.js';
+
+const sanitizeEntityData = (
+  localizationType: LocalizationType,
+  entity: LocalizationEntity | LocalizationUpdateEntity,
+) => {
+  const entityData = { ...entity };
+
+  if (localizationType !== 'CURRENCY') {
+    delete entityData.contractAddress;
+    delete entityData.decimals;
+  }
+
+  if (entityData.isoCode) {
+    entityData.isoCode = validateIsoCode(localizationType, entityData.isoCode);
+  }
+
+  return entityData;
+};
+
+export default sanitizeEntityData;

package/src/mcp/utils/sharedSchemas.ts

@@ -1,12 +1,98 @@
 import { z } from 'zod';
+import { SortDirection } from '@unchainedshop/utils';
 
-export const OrderFilterSchema = {
-  paymentProviderIds: z.array(z.string()).optional(),
-  deliveryProviderIds: z.array(z.string()).optional(),
-  status: z.array(z.enum(['PENDING', 'CONFIRMED', 'SHIPPED', 'DELIVERED', 'CANCELLED'])).optional(),
+const sortDirectionKeys = Object.keys(SortDirection) as [string, ...string[]];
+
+export const PaginationSchema = {
+  limit: z.number().int().min(1).max(100).optional().describe('Maximum number of results to return'),
+  offset: z.number().int().min(0).optional().describe('Number of results to skip for pagination'),
 };
 
+export const SortingSchema = {
+  sort: z
+    .array(
+      z.object({
+        key: z.string().describe('Field to sort by'),
+        value: z.enum(sortDirectionKeys).describe('Sort direction (ASC/DESC)'),
+      }),
+    )
+    .optional()
+    .describe('Array of sort options'),
+};
+
+export const SearchSchema = {
+  queryString: z.string().optional().describe('Search query string for text-based filtering'),
+  includeInactive: z
+    .boolean()
+    .optional()
+    .default(true)
+    .describe('Whether to include inactive/disabled items'),
+};
+
+export const LocalizationTextSchema = z.object({
+  locale: z
+    .string()
+    .min(2)
+    .describe(
+      'Locale code (e.g., "en-US", "de-CH") when a user provides locale make sure it exists in the system languages first. and if not prompt them to add the language before using it. if they provide a dialect at least base language should be registered in the system. if it does not exists prompt the user to add the language. NEVER add it automatically',
+    ),
+  title: z.string().min(1).describe('Localized title'),
+  subtitle: z.string().optional().describe('Optional localized subtitle'),
+});
+
 export const DateRangeSchema = {
-  from: z.string().datetime().optional(),
-  to: z.string().datetime().optional(),
+  from: z.string().datetime().optional().describe('Start date in ISO format'),
+  to: z.string().datetime().optional().describe('End date in ISO format'),
 };
+
+export const OrderFilterSchema = {
+  paymentProviderIds: z.array(z.string()).optional().describe('Filter by payment provider IDs'),
+  deliveryProviderIds: z.array(z.string()).optional().describe('Filter by delivery provider IDs'),
+  status: z
+    .array(z.enum(['PENDING', 'CONFIRMED', 'SHIPPED', 'DELIVERED', 'CANCELLED']))
+    .optional()
+    .describe('Filter by order statuses'),
+};
+
+export const EntityIdSchema = {
+  id: z.string().min(1).optional().describe('Entity ID'),
+};
+
+export const MediaUrlSchema = {
+  url: z.string().url().optional().describe('Media URL'),
+};
+
+export function createManagementSchema<T extends readonly string[]>(
+  actions: T,
+  additionalFields: Record<string, z.ZodType> = {},
+) {
+  return {
+    action: z.enum(actions as any).describe(`Management action: ${actions.join(', ')}`),
+    ...PaginationSchema,
+    ...SortingSchema,
+    ...SearchSchema,
+    ...additionalFields,
+  };
+}
+
+export function createMcpResponse(response) {
+  return {
+    content: [
+      {
+        type: 'text' as const,
+        text: JSON.stringify({ ...response }),
+      },
+    ],
+  };
+}
+
+export function createMcpErrorResponse(action: string, error: Error) {
+  return {
+    content: [
+      {
+        type: 'text' as const,
+        text: `Error in ${action.toLowerCase()}: ${error.message}`,
+      },
+    ],
+  };
+}

package/src/mcp/utils/validateIsoCode.ts

@@ -0,0 +1,25 @@
+import { LocalizationType } from '../tools/localization/types.js';
+
+const validateIsoCode = (localizationType: LocalizationType, isoCode: string): string => {
+  switch (localizationType) {
+    case 'COUNTRY':
+      if (isoCode.length !== 2) {
+        throw new Error('Country ISO code must be exactly 2 characters (ISO 3166-1 alpha-2)');
+      }
+      return isoCode.toUpperCase();
+    case 'CURRENCY':
+      if (isoCode.length !== 3) {
+        throw new Error('Currency ISO code must be exactly 3 characters (ISO 4217)');
+      }
+      return isoCode.toUpperCase();
+    case 'LANGUAGE':
+      if (isoCode.length < 2 || isoCode.length > 10) {
+        throw new Error('Language ISO code must be 2-10 characters (ISO 639-1/ISO 3166-1)');
+      }
+      return isoCode;
+    default:
+      return isoCode;
+  }
+};
+
+export default validateIsoCode;

package/src/resolvers/mutations/accounts/verifyWeb3Address.ts

@@ -2,6 +2,93 @@ import { log } from '@unchainedshop/logger';
 import { UserWeb3AddressNotFoundError, UserWeb3AddressSignatureError } from '../../../errors.js';
 import { Context } from '../../../context.js';
 
+import type { keccak_256 as Keccak256Type } from '@noble/hashes/sha3.js';
+import type { bytesToHex as BytesToHex, hexToBytes as HexToBytes } from '@noble/hashes/utils.js';
+import type { secp256k1 as Secp256k1Type } from '@noble/curves/secp256k1.js';
+
+// Dynamic imports for optional peer dependencies
+let secp256k1: typeof Secp256k1Type;
+let keccak_256: typeof Keccak256Type;
+let bytesToHex: typeof BytesToHex;
+let hexToBytes: typeof HexToBytes;
+
+async function loadNoblePackages() {
+  try {
+    // eslint-disable-next-line
+  // @ts-ignore
+    const curves = await import('@noble/curves/secp256k1.js');
+
+    // eslint-disable-next-line
+  // @ts-ignore
+    const hashes = await import('@noble/hashes/sha3.js');
+
+    // eslint-disable-next-line
+  // @ts-ignore
+    const utils = await import('@noble/hashes/utils.js');
+
+    if (!curves || !hashes || !utils) {
+      throw new Error('Missing required @noble packages for Web3 signature verification');
+    }
+
+    secp256k1 = curves.secp256k1;
+    keccak_256 = hashes.keccak_256;
+    bytesToHex = utils.bytesToHex;
+    hexToBytes = utils.hexToBytes;
+
+    return true;
+  } catch (error) {
+    log('Failed to load @noble packages for Web3 verification', { error: error.message });
+    return false;
+  }
+}
+
+// Inline utility functions to replace @ethereumjs/util
+function fromRPCSig(sig: string): { v: bigint; r: Uint8Array; s: Uint8Array } {
+  const bytes = hexToBytes(sig.startsWith('0x') ? sig.slice(2) : sig);
+  if (bytes.length !== 65) throw new Error('Invalid signature length');
+
+  const r = bytes.slice(0, 32);
+  const s = bytes.slice(32, 64);
+  let v = BigInt(bytes[64]);
+
+  // Handle EIP-155 encoding
+  if (v >= 35n) {
+    v = v - 35n - 2n * 1n; // chainId = 1 for mainnet, adjust if needed
+  } else if (v >= 27n) {
+    v = v - 27n;
+  }
+
+  return { v, r, s };
+}
+
+function hashPersonalMessage(message: Uint8Array): Uint8Array {
+  const prefix = new TextEncoder().encode('\x19Ethereum Signed Message:\n');
+  const lengthBytes = new TextEncoder().encode(message.length.toString());
+  const combined = new Uint8Array(prefix.length + lengthBytes.length + message.length);
+  combined.set(prefix, 0);
+  combined.set(lengthBytes, prefix.length);
+  combined.set(message, prefix.length + lengthBytes.length);
+  return keccak_256(combined);
+}
+
+function ecrecover(msgHash: Uint8Array, v: bigint, r: Uint8Array, s: Uint8Array): Uint8Array {
+  const recovery = Number(v);
+  const signature = new Uint8Array(64);
+  signature.set(r, 0);
+  signature.set(s, 32);
+
+  const publicKey = secp256k1.Signature.fromBytes(signature)
+    .addRecoveryBit(recovery)
+    .recoverPublicKey(msgHash);
+
+  return publicKey.toBytes(false).slice(1); // Remove the 0x04 prefix for uncompressed key
+}
+
+function publicToAddress(publicKey: Uint8Array): Uint8Array {
+  const hash = keccak_256(publicKey);
+  return hash.slice(-20); // Take last 20 bytes
+}
+
 export default async function verifyWeb3Address(
   root: never,
   { address, hash }: { address: string; hash: `0x${string}` },
@@ -11,6 +98,14 @@ export default async function verifyWeb3Address(
     userId,
   });
 
+  // Load noble packages dynamically
+  const packagesLoaded = await loadNoblePackages();
+  if (!packagesLoaded) {
+    throw new Error(
+      'Web3 signature verification is not available. Please install the required @noble packages: @noble/curves, @noble/hashes',
+    );
+  }
+
   const foundCredentials = user.services?.web3?.find(
     (service) => service.address.toLowerCase() === address.toLowerCase(),
   );
@@ -20,17 +115,15 @@ export default async function verifyWeb3Address(
 
   // eslint-disable-next-line
   // @ts-ignore
-  const { bufferToHex, fromRpcSig, ecrecover, toBuffer, hashPersonalMessage, publicToAddress } =
-    await import('@ethereumjs/util');
-
-  const message = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
-  const messageHash = hashPersonalMessage(toBuffer(message));
+  const messageHash = hashPersonalMessage(
+    hexToBytes(`0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`),
+  );
 
-  const sigParams = fromRpcSig(hash);
+  const sigParams = fromRPCSig(hash);
   const publicKey = ecrecover(messageHash, sigParams.v, sigParams.r, sigParams.s);
 
   const sender = publicToAddress(publicKey);
-  const recoveredAddr = bufferToHex(sender);
+  const recoveredAddr = `0x${bytesToHex(sender)}`;
 
   const isSignatureCorrectForAddress =
     recoveredAddr.toLowerCase() === foundCredentials.address.toLowerCase();

package/src/resolvers/queries/orders/orderStatistics.ts

@@ -5,12 +5,12 @@ import { DateFilterInput } from '@unchainedshop/utils';
 export default async function orderStatistics(
   root: never,
   params: { dateRange?: DateFilterInput },
-  { modules, userId }: Context,
+  { userId }: Context,
 ) {
+  const { dateRange } = params || {};
   log(`query orderStatistics `, {
     userId,
     ...(params?.dateRange || {}),
   });
-
-  return modules.orders.getReport(params);
+  return { dateRange };
 }

package/src/resolvers/type/index.ts

@@ -67,6 +67,7 @@ import { Token } from './token-types.js';
 import { Web3Address } from './web3-address.js';
 import { LoginMethodResponse } from './login-method-response-types.js';
 import { ProductSearchResult } from './product-search-result-types.js';
+import { OrderStatistics } from './order/order-statistics-types.js';
 
 const types = {
   Assortment,
@@ -138,6 +139,7 @@ const types = {
   Media,
   Web3Address,
   LoginMethodResponse,
+  OrderStatistics,
 };
 
 export default types;

package/src/resolvers/type/order/order-statistics-types.ts

@@ -0,0 +1,99 @@
+import { Context } from '../../../context.js';
+
+function buildDateMatch(dateField: string, dateRange?: { start?: string; end?: string }) {
+  if (!dateRange?.start && !dateRange?.end) return { [dateField]: { $exists: true } };
+
+  const rangeMatch: Record<string, any> = {};
+  if (dateRange?.start) rangeMatch.$gte = new Date(dateRange.start);
+  if (dateRange?.end) rangeMatch.$lte = new Date(dateRange.end);
+
+  return { [dateField]: rangeMatch };
+}
+
+async function aggregateOrders(
+  modules: Context['modules'],
+  dateField: string,
+  dateRange?: { start?: string; end?: string },
+  options?: { includeAmount?: boolean; includeCarts?: boolean },
+) {
+  const match = buildDateMatch(dateField, dateRange);
+
+  const pipeline: any[] = [{ $match: match }];
+
+  if (options?.includeCarts) {
+    match.status = null;
+    match.orderNumber = null;
+  }
+
+  if (options?.includeAmount) {
+    pipeline.push({
+      $addFields: {
+        orderTotal: {
+          $reduce: {
+            input: { $ifNull: ['$calculation', []] },
+            initialValue: 0,
+            in: { $add: ['$$value', { $ifNull: ['$$this.amount', 0] }] },
+          },
+        },
+      },
+    });
+
+    pipeline.push({
+      $group: {
+        _id: {
+          date: { $dateToString: { format: '%Y-%m-%d', date: `$${dateField}` } },
+          currency: '$currencyCode',
+        },
+        totalAmount: { $sum: '$orderTotal' },
+        count: { $sum: 1 },
+      },
+    });
+
+    pipeline.push({
+      $project: {
+        _id: 0,
+        date: '$_id.date',
+        total: { amount: '$totalAmount', currencyCode: '$_id.currency' },
+        count: 1,
+      },
+    });
+
+    pipeline.push({ $sort: { date: 1 } });
+    return modules.orders.aggregateOrders({ pipeline });
+  }
+  // Just count total orders
+  pipeline.push({ $count: 'count' });
+  const result = await modules.orders.aggregateOrders({ pipeline });
+  return result[0]?.count ?? 0;
+}
+export const OrderStatistics = {
+  newCount: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'created', dateRange, { includeCarts: true }),
+
+  checkoutCount: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'ordered', dateRange),
+
+  rejectCount: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'rejected', dateRange),
+
+  confirmCount: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'confirmed', dateRange),
+
+  fulfillCount: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'fullfilled', dateRange),
+
+  newRecords: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'created', dateRange, { includeAmount: true, includeCarts: true }),
+
+  checkoutRecords: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'ordered', dateRange, { includeAmount: true }),
+
+  rejectRecords: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'rejected', dateRange, { includeAmount: true }),
+
+  confirmRecords: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'confirmed', dateRange, { includeAmount: true }),
+
+  fulfilledRecords: async ({ dateRange }, _p, { modules }: Context) =>
+    aggregateOrders(modules, 'fullfilled', dateRange, { includeAmount: true }),
+};

package/src/schema/query.ts

@@ -480,14 +480,14 @@ export default [
         limit: Int = 10
         offset: Int = 0
         queryString: String
-        created: DateTime
+        created: DateFilterInput
         sort: [SortOptionInput!]
       ): [Event!]!
 
       """
       Get total count of all emitted events
       """
-      eventsCount(types: [String!], queryString: String, created: DateTime): Int!
+      eventsCount(types: [String!], queryString: String, created: DateFilterInput): Int!
 
       """
       Determines if a token is valid/active for reset password