@unchainedshop/plugins 4.4.0 → 4.6.0

package/README.md

@@ -123,6 +123,32 @@ const platform = await startPlatform({
 });
 ```
 
+## Security
+
+### Payment Plugin Security
+
+All payment plugins implement secure tokenization patterns for PCI DSS SAQ-A eligibility:
+
+| Plugin | Security Method |
+|--------|-----------------|
+| Stripe | PaymentIntent/SetupIntent tokenization |
+| Datatrans | Secure Fields with HMAC-SHA-256 signatures |
+| Saferpay | Redirect with SHA-256 transaction signatures |
+| PayPal | Order ID references |
+| Braintree | Client SDK tokenization |
+| Cryptopay | BIP-32 HD wallet address derivation |
+
+**Signature Algorithms:**
+- HMAC-SHA-256: Datatrans, Payrexx, GridFS file uploads
+- HMAC-SHA-512: PostFinance Checkout
+- SHA-256: Saferpay
+
+### FIPS 140-3 Compatibility
+
+All cryptographic operations use FIPS-approved algorithms. When deployed on FIPS-enabled Node.js (e.g., Chainguard node-fips), plugins operate in FIPS-compliant mode.
+
+See [SECURITY.md](../../SECURITY.md) for complete security documentation.
+
 ## Notes
 
 ### Postfinance Checkout Plugin

package/lib/files/gridfs/adapter.js

@@ -8,7 +8,6 @@ import { filesSettings } from '@unchainedshop/core-files';
 import {} from '@unchainedshop/core';
 import {} from "./index.js";
 const { GRIDFS_PUT_SERVER_PATH = '/gridfs' } = process.env;
-const { ROOT_URL } = process.env;
 const bufferToStream = (buffer) => {
     const stream = new Readable();
     stream.push(buffer);
@@ -32,7 +31,7 @@ export const GridFSAdapter = {
         const expiryDate = resolveExpirationDate();
         const hashedFilename = await buildHashedFilename(directoryName, fileName, expiryDate);
         const signature = await sign(directoryName, hashedFilename, expiryDate.getTime());
-        const putURL = new URL(`${GRIDFS_PUT_SERVER_PATH}/${directoryName}/${encodeURIComponent(fileName)}?e=${expiryDate.getTime()}&s=${signature}`, ROOT_URL).href;
+        const putURL = new URL(`${GRIDFS_PUT_SERVER_PATH}/${directoryName}/${encodeURIComponent(fileName)}?e=${expiryDate.getTime()}&s=${signature}`, process.env.ROOT_URL).href;
         const url = `${GRIDFS_PUT_SERVER_PATH}/${directoryName}/${hashedFilename}`;
         return {
             _id: hashedFilename,

package/lib/files/gridfs/handler-express.js

@@ -7,6 +7,7 @@ import {} from "./module.js";
 import {} from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import { getFileAdapter } from '@unchainedshop/core-files';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const { ROOT_URL, GRIDFS_PUT_SERVER_PATH = '/gridfs' } = process.env;
 const logger = createLogger('unchained:gridfs');
 const gridfsHandler = async (req, res) => {
@@ -27,7 +28,8 @@ const gridfsHandler = async (req, res) => {
             const { s: signature, e: expiryTimestamp } = req.query;
             const expiryDate = new Date(parseInt(expiryTimestamp, 10));
             const fileId = await buildHashedFilename(directoryName, fileName, expiryDate);
-            if ((await sign(directoryName, fileId, expiryDate.getTime())) === signature) {
+            const expectedSignature = await sign(directoryName, fileId, expiryDate.getTime());
+            if (await timingSafeStringEqual(expectedSignature, signature)) {
                 const file = await modules.files.findFile({ fileId });
                 if (!file) {
                     res.status(404).send('File not found');
@@ -67,7 +69,10 @@ const gridfsHandler = async (req, res) => {
                 }
                 const fileUploadAdapter = getFileAdapter();
                 const signedUrl = await fileUploadAdapter.createDownloadURL(fileDocument, expiry);
-                if (!signedUrl || new URL(signedUrl, 'file://').searchParams.get('s') !== signature) {
+                const expectedSignature = signedUrl ? new URL(signedUrl, 'file://').searchParams.get('s') : null;
+                if (!signedUrl ||
+                    !expectedSignature ||
+                    !(await timingSafeStringEqual(expectedSignature, signature))) {
                     res.status(403).send('Access restricted: Invalid signature.');
                     return;
                 }

package/lib/files/gridfs/handler-fastify.js

@@ -7,6 +7,7 @@ import {} from "./module.js";
 import {} from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import { getFileAdapter } from '@unchainedshop/core-files';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:gridfs');
 const { GRIDFS_PUT_SERVER_PATH = '/gridfs' } = process.env;
 const gridfsHandler = async (req, reply) => {
@@ -24,7 +25,8 @@ const gridfsHandler = async (req, reply) => {
             const { s: signature, e: expiryTimestamp } = req.query;
             const expiryDate = new Date(parseInt(expiryTimestamp, 10));
             const fileId = await buildHashedFilename(directoryName, fileName, expiryDate);
-            if ((await sign(directoryName, fileId, expiryDate.getTime())) === signature) {
+            const expectedSignature = await sign(directoryName, fileId, expiryDate.getTime());
+            if (await timingSafeStringEqual(expectedSignature, signature)) {
                 const file = await modules.files.findFile({ fileId });
                 if (!file) {
                     reply.status(404);
@@ -89,7 +91,10 @@ const gridfsHandler = async (req, reply) => {
                 }
                 const fileUploadAdapter = getFileAdapter();
                 const signedUrl = await fileUploadAdapter.createDownloadURL(fileDocument, expiry);
-                if (!signedUrl || new URL(signedUrl, 'file://').searchParams.get('s') !== signature) {
+                const expectedSignature = signedUrl ? new URL(signedUrl, 'file://').searchParams.get('s') : null;
+                if (!signedUrl ||
+                    !expectedSignature ||
+                    !(await timingSafeStringEqual(expectedSignature, signature))) {
                     reply.status(403);
                     logger.error('Invalid signature', { fileName, expiry });
                     return reply.send({

package/lib/files/minio/handler-express.js

@@ -1,16 +1,21 @@
 import { createLogger } from '@unchainedshop/logger';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:minio');
 const { MINIO_WEBHOOK_AUTH_TOKEN } = process.env;
-const isAuthorized = ({ authorization = '' }) => {
+const isAuthorized = async ({ authorization = '' }) => {
+    if (!MINIO_WEBHOOK_AUTH_TOKEN)
+        return false;
     const [type, token] = authorization.split(' ');
-    return type === 'Bearer' && token === MINIO_WEBHOOK_AUTH_TOKEN;
+    if (type !== 'Bearer' || !token)
+        return false;
+    return timingSafeStringEqual(token, MINIO_WEBHOOK_AUTH_TOKEN);
 };
 const minioHandler = async (req, res) => {
     try {
         if (req.method === 'POST' && req.body) {
             const { headers } = req;
             const { Records = [], EventName } = req.body;
-            if (EventName === 's3:ObjectCreated:Put' && isAuthorized(headers)) {
+            if (EventName === 's3:ObjectCreated:Put' && (await isAuthorized(headers))) {
                 const [{ s3 }] = Records;
                 const { object } = s3;
                 const { size, contentType: type } = object;

package/lib/files/minio/handler-fastify.js

@@ -1,18 +1,23 @@
 import {} from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import {} from 'fastify';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:minio');
 const { MINIO_WEBHOOK_AUTH_TOKEN } = process.env;
-const isAuthorized = ({ authorization = '' }) => {
+const isAuthorized = async ({ authorization = '' }) => {
+    if (!MINIO_WEBHOOK_AUTH_TOKEN)
+        return false;
     const [type, token] = authorization.split(' ');
-    return type === 'Bearer' && token === MINIO_WEBHOOK_AUTH_TOKEN;
+    if (type !== 'Bearer' || !token)
+        return false;
+    return timingSafeStringEqual(token, MINIO_WEBHOOK_AUTH_TOKEN);
 };
 const minioHandler = async (req, res) => {
     try {
         if (req.body) {
             const { headers } = req;
             const { Records = [], EventName } = req.body;
-            if (EventName === 's3:ObjectCreated:Put' && isAuthorized(headers)) {
+            if (EventName === 's3:ObjectCreated:Put' && (await isAuthorized(headers))) {
                 const [{ s3 }] = Records;
                 const { object } = s3;
                 const { size, contentType: type } = object;

package/lib/filters/local-search.js

@@ -1,6 +1,3 @@
-import { mongodb } from '@unchainedshop/mongodb';
-import {} from '@unchainedshop/core-products';
-import {} from '@unchainedshop/core-assortments';
 import { FilterDirector, FilterAdapter } from '@unchainedshop/core';
 import { createLogger } from '@unchainedshop/logger';
 import { isDocumentDBCompatModeEnabled } from '@unchainedshop/mongodb';
@@ -18,13 +15,10 @@ const LocalSearch = {
                 const { queryString } = params.searchQuery;
                 if (!queryString)
                     return productIds;
-                const selector = {
-                    $text: { $search: queryString },
-                };
-                if (productIds) {
-                    selector.productId = { $in: [...new Set(productIds)] };
-                }
-                const products = await params.modules.products.texts.findTexts(selector, {
+                const products = await params.modules.products.texts.findTexts({
+                    queryString,
+                    productIds: productIds ? [...new Set(productIds)] : undefined,
+                }, {
                     projection: {
                         productId: 1,
                     },
@@ -36,13 +30,10 @@ const LocalSearch = {
                 if (!queryString) {
                     return assortmentIds;
                 }
-                const selector = {
-                    $text: { $search: queryString },
-                };
-                if (assortmentIds) {
-                    selector.assortmentId = { $in: assortmentIds };
-                }
-                const assortments = await params.modules.assortments.texts.findTexts(selector, {
+                const assortments = await params.modules.assortments.texts.findTexts({
+                    queryString,
+                    assortmentIds,
+                }, {
                     projection: {
                         assortmentId: 1,
                     },

package/lib/payment/apple-iap/adapter.js

@@ -104,7 +104,7 @@ const AppleIAP = {
                     orderId: order._id,
                 });
                 return {
-                    transactionIdentifier,
+                    transactionId: transactionIdentifier,
                 };
             },
         };

package/lib/payment/apple-iap/handler-express.js

@@ -23,11 +23,7 @@ export const appleIAPHandler = async (req, res) => {
             const transactions = responseBody?.unified_receipt?.latest_receipt_info;
             const latestTransaction = transactions[0];
             if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
-                const orderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                    context: {
-                        'meta.transactionIdentifier': latestTransaction.transaction_id,
-                    },
-                });
+                const orderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.transaction_id);
                 if (!orderPayment)
                     throw new Error('Could not find any matching order payment');
                 const order = await services.orders.checkoutOrder(orderPayment.orderId, {
@@ -54,11 +50,7 @@ export const appleIAPHandler = async (req, res) => {
                 });
             }
             else {
-                const originalOrderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                    context: {
-                        'meta.transactionIdentifier': latestTransaction.original_transaction_id,
-                    },
-                });
+                const originalOrderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.original_transaction_id);
                 if (!originalOrderPayment)
                     throw new Error('Could not find any matching order payment');
                 const originalOrder = await modules.orders.findOrder({
@@ -101,7 +93,7 @@ export const appleIAPHandler = async (req, res) => {
             return;
         }
         catch (e) {
-            logger.warn(`Apple IAP Webhook: ${e.message}`, e);
+            logger.warn(`Apple IAP Webhook: ${e.name} - ${e.message}`);
             res.status(503).send({ name: e.name, code: e.code, message: e.message });
             return;
         }

package/lib/payment/apple-iap/handler-fastify.js

@@ -24,11 +24,7 @@ export const appleIAPHandler = async (req, reply) => {
         const transactions = responseBody?.unified_receipt?.latest_receipt_info;
         const latestTransaction = transactions[0];
         if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
-            const orderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                context: {
-                    'meta.transactionIdentifier': latestTransaction.transaction_id,
-                },
-            });
+            const orderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.transaction_id);
             if (!orderPayment)
                 throw new Error('Could not find any matching order payment');
             const order = await services.orders.checkoutOrder(orderPayment.orderId, {
@@ -55,11 +51,7 @@ export const appleIAPHandler = async (req, reply) => {
             });
         }
         else {
-            const originalOrderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                context: {
-                    'meta.transactionIdentifier': latestTransaction.original_transaction_id,
-                },
-            });
+            const originalOrderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.original_transaction_id);
             if (!originalOrderPayment)
                 throw new Error('Could not find any matching order payment');
             const originalOrder = await modules.orders.findOrder({

package/lib/payment/cryptopay/handle-webhook.js

@@ -28,13 +28,23 @@ export default async function handleWebhook({ secret, wallet, price, ping, }, co
             }));
         if (orderPayment) {
             const order = await modules.orders.findOrder({ orderId: orderPayment.orderId });
+            if (!order) {
+                logger.error('Order not found for payment', { orderPaymentId, orderId: orderPayment.orderId });
+                throw new Error('Order not found');
+            }
             if (order.status === null) {
+                logger.info('Initiating checkout for new order', { orderId: order._id });
                 await services.orders.checkoutOrder(order._id, {});
             }
             else if (order.status === OrderStatus.PENDING) {
+                logger.info('Processing pending order after payment update', { orderId: order._id });
                 await services.orders.processOrder(order, {});
             }
             else {
+                logger.warn('Order already processed, ignoring webhook', {
+                    orderId: order._id,
+                    status: order.status,
+                });
                 throw new Error('Already processed');
             }
         }

package/lib/payment/datatrans-v2/handler-express.js

@@ -20,7 +20,7 @@ export const datatransHandler = async (req, res) => {
             signKey: DATATRANS_SIGN2_KEY || DATATRANS_SIGN_KEY,
         })(timestamp, req.body);
         if (hash !== comparableSignature) {
-            logger.error(`hash mismatch: ${signature} / ${comparableSignature}`, req.body);
+            logger.error(`hash mismatch: ${signature} / ${comparableSignature}`);
             res.status(403).send('Hash mismatch');
             return;
         }
@@ -61,7 +61,7 @@ export const datatransHandler = async (req, res) => {
                 }
             }
             catch (e) {
-                logger.error(`rejected to checkout with message`, e);
+                logger.error(`rejected to checkout: ${e.name} - ${e.message}`);
                 res.status(500).send({ name: e.name, code: e.code, message: e.message });
                 return;
             }

package/lib/payment/saferpay/adapter.js

@@ -2,7 +2,6 @@ import { mongodb } from '@unchainedshop/mongodb';
 import { SaferpayClient } from "./api/index.js";
 import { buildSignature } from "./buildSignature.js";
 import { OrderPricingSheet, PaymentAdapter, PaymentDirector, PaymentError, } from '@unchainedshop/core';
-const { SAFERPAY_BASE_URL = 'https://test.saferpay.com/api', SAFERPAY_CUSTOMER_ID, SAFERPAY_WEBHOOK_PATH = '/payment/saferpay/webhook', SAFERPAY_RETURN_PATH = '/saferpay/return', ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_URL, SAFERPAY_USER, SAFERPAY_PW, } = process.env;
 const newSaferpayError = ({ code, message }) => {
     const error = new Error(message || code);
     error.name = `SAFERPAY_${code}`;
@@ -23,6 +22,7 @@ export const WordlineSaferpay = {
     },
     actions: (config, context) => {
         const { modules } = context;
+        const { SAFERPAY_BASE_URL = 'https://test.saferpay.com/api', SAFERPAY_CUSTOMER_ID, SAFERPAY_WEBHOOK_PATH = '/payment/saferpay/webhook', SAFERPAY_RETURN_PATH = '/saferpay/return', ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_URL, SAFERPAY_USER, SAFERPAY_PW, } = process.env;
         const createSaferPayClient = () => {
             if (!SAFERPAY_CUSTOMER_ID || !SAFERPAY_USER || !SAFERPAY_PW)
                 throw new Error('Credentials not Set');

package/lib/payment/saferpay/handler-express.js

@@ -1,5 +1,6 @@
 import { createLogger } from '@unchainedshop/logger';
 import { buildSignature } from "./buildSignature.js";
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:saferpay:handler');
 export const saferpayHandler = async (request, response) => {
     const resolvedContext = request.unchainedContext;
@@ -25,7 +26,7 @@ export const saferpayHandler = async (request, response) => {
             throw new Error(`order payment not found with orderPaymentId: ${orderPaymentId}`);
         }
         const correctSignature = await buildSignature(transactionId, orderPaymentId);
-        if (correctSignature !== signature) {
+        if (!(await timingSafeStringEqual(correctSignature, signature))) {
             throw new Error('Invalid signature');
         }
         const order = await services.orders.checkoutOrder(orderPayment.orderId, {

package/lib/payment/saferpay/handler-fastify.js

@@ -1,5 +1,6 @@
 import { createLogger } from '@unchainedshop/logger';
 import { buildSignature } from "./buildSignature.js";
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:saferpay:handler');
 export const saferpayHandler = async (request, reply) => {
     const resolvedContext = request.unchainedContext;
@@ -25,7 +26,7 @@ export const saferpayHandler = async (request, reply) => {
             throw new Error(`order payment not found with orderPaymentId: ${orderPaymentId}`);
         }
         const correctSignature = await buildSignature(transactionId, orderPaymentId);
-        if (correctSignature !== signature) {
+        if (!(await timingSafeStringEqual(correctSignature, signature))) {
             throw new Error('Invalid signature');
         }
         const order = await services.orders.checkoutOrder(orderPayment.orderId, {

package/lib/payment/stripe/stripe.js

@@ -9,7 +9,7 @@ try {
     }
     const { default: Stripe } = await import('stripe');
     stripe = new Stripe(STRIPE_SECRET, {
-        apiVersion: '2025-11-17.clover',
+        apiVersion: '2025-12-15.clover',
     });
 }
 catch {

package/lib/pricing/order-items-discount.d.ts

@@ -1 +1,2 @@
-export {};
+import { type OrderDiscountConfiguration, type IOrderPricingAdapter } from '@unchainedshop/core';
+export declare const OrderItemsDiscount: IOrderPricingAdapter<OrderDiscountConfiguration>;

package/lib/pricing/order-items-discount.js

@@ -1,6 +1,6 @@
 import { ProductPricingSheet, OrderPricingDirector, OrderPricingAdapter, OrderPricingRowCategory, resolveRatioAndTaxDivisorForPricingSheet, } from '@unchainedshop/core';
 import { calculation as calcUtils } from '@unchainedshop/utils';
-const OrderItemsDiscount = {
+export const OrderItemsDiscount = {
     ...OrderPricingAdapter,
     key: 'shop.unchained.pricing.order-items-discount',
     version: '1.0.0',

package/lib/pricing/order-items.d.ts

@@ -1 +1,2 @@
-export {};
+import { type IOrderPricingAdapter } from '@unchainedshop/core';
+export declare const OrderItems: IOrderPricingAdapter;

package/lib/pricing/order-items.js

@@ -1,5 +1,5 @@
 import { OrderPricingDirector, OrderPricingAdapter, ProductPricingSheet, } from '@unchainedshop/core';
-const OrderItems = {
+export const OrderItems = {
     ...OrderPricingAdapter,
     key: 'shop.unchained.pricing.order-items',
     version: '1.0.0',

package/lib/pricing/order-payment.d.ts

@@ -1 +1,2 @@
-export {};
+import { type IOrderPricingAdapter } from '@unchainedshop/core';
+export declare const OrderPayment: IOrderPricingAdapter;

package/lib/pricing/order-payment.js

@@ -1,5 +1,5 @@
 import { OrderPricingDirector, OrderPricingAdapter, PaymentPricingSheet, } from '@unchainedshop/core';
-const OrderPayment = {
+export const OrderPayment = {
     ...OrderPricingAdapter,
     key: 'shop.unchained.pricing.order-payment',
     version: '1.0.0',

package/lib/pricing/product-catalog-price-options.d.ts

@@ -1 +1,2 @@
-export {};
+import { type IProductPricingAdapter } from '@unchainedshop/core';
+export declare const ProductPriceOptions: IProductPricingAdapter;

package/lib/pricing/product-catalog-price-options.js

@@ -1,5 +1,5 @@
 import { ProductPricingDirector, ProductPricingAdapter, } from '@unchainedshop/core';
-const ProductPrice = {
+export const ProductPriceOptions = {
     ...ProductPricingAdapter,
     key: 'shop.unchained.pricing.product-price-options',
     version: '1.0',
@@ -25,7 +25,7 @@ const ProductPrice = {
                         amount: itemTotal,
                         isTaxable: Boolean(price.isTaxable),
                         isNetPrice: Boolean(price.isNetPrice),
-                        meta: { adapter: ProductPrice.key },
+                        meta: { adapter: ProductPriceOptions.key },
                     });
                 }
             },
@@ -48,4 +48,4 @@ const ProductPrice = {
         };
     },
 };
-ProductPricingDirector.registerAdapter(ProductPrice);
+ProductPricingDirector.registerAdapter(ProductPriceOptions);

package/lib/pricing/product-discount.d.ts

@@ -1 +1,2 @@
-export {};
+import { type ProductDiscountConfiguration, type IProductPricingAdapter } from '@unchainedshop/core';
+export declare const ProductDiscount: IProductPricingAdapter<ProductDiscountConfiguration>;

package/lib/pricing/product-discount.js

@@ -1,6 +1,6 @@
 import { calculation as calcUtils } from '@unchainedshop/utils';
 import { ProductPricingDirector, ProductPricingAdapter, ProductPricingRowCategory, } from '@unchainedshop/core';
-const ProductDiscount = {
+export const ProductDiscount = {
     ...ProductPricingAdapter,
     key: 'shop.unchained.pricing.product-discount',
     version: '1.0.0',

package/lib/warehousing/eth-minter.js

@@ -5,7 +5,6 @@ import { systemLocale } from '@unchainedshop/utils';
 import { generateDbObjectId } from '@unchainedshop/mongodb';
 import { getFileAdapter } from '@unchainedshop/core-files';
 import { createLogger } from '@unchainedshop/logger';
-const { MINTER_TOKEN_OFFSET = '0', ROOT_URL = 'http://localhost:4010' } = process.env;
 const logger = createLogger('unchained:eth-minter');
 const ETHMinter = {
     ...WarehousingAdapter,
@@ -18,6 +17,7 @@ const ETHMinter = {
         return type === WarehousingProviderType.VIRTUAL;
     },
     actions: (configuration, context) => {
+        const { MINTER_TOKEN_OFFSET = '0', ROOT_URL = 'http://localhost:4010' } = process.env;
         const { product, orderPosition, token, modules, locale } = context;
         const { contractAddress, contractStandard, tokenId, supply, ercMetadataProperties } = product?.tokenization || {};
         const getTokensCreated = async () => {

package/lib/worker/error-notifications.js

@@ -1,7 +1,6 @@
 import { WorkStatus } from '@unchainedshop/core-worker';
-import { WorkerDirector, WorkerAdapter } from '@unchainedshop/core';
-import later from '@breejs/later';
-const everyDayAtFourInTheNight = later.parse.cron('0 3 * * *');
+import { WorkerDirector, WorkerAdapter, schedule } from '@unchainedshop/core';
+const everyDayAtFourInTheNight = schedule.parse.cron('0 3 * * *');
 export const ErrorNotifications = {
     ...WorkerAdapter,
     key: 'shop.unchained.worker.error-notifications',

package/lib/worker/update-coinbase-rates.js

@@ -1,5 +1,4 @@
-import { WorkerAdapter, WorkerDirector } from '@unchainedshop/core';
-import later from '@breejs/later';
+import { WorkerAdapter, WorkerDirector, schedule } from '@unchainedshop/core';
 import { resolveBestCurrency } from '@unchainedshop/utils';
 const getExchangeRates = async (base) => {
     return fetch(`https://api.coinbase.com/v2/exchange-rates?currency=${base}`, {
@@ -8,7 +7,7 @@ const getExchangeRates = async (base) => {
         .then((res) => res.json())
         .then((r) => r?.data);
 };
-const everyMinute = later.parse.cron('* * * * *');
+const everyMinute = schedule.parse.cron('* * * * *');
 const UpdateCoinbaseRates = {
     ...WorkerAdapter,
     key: 'shop.unchained.worker.update-coinbase-rates',

package/lib/worker/update-ecb-rates.js

@@ -1,5 +1,4 @@
-import { WorkerAdapter, WorkerDirector } from '@unchainedshop/core';
-import later from '@breejs/later';
+import { WorkerAdapter, WorkerDirector, schedule } from '@unchainedshop/core';
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:worker:update-ecb-rates');
 let xml2json;
@@ -20,7 +19,7 @@ const getExchangeRates = async () => {
         .filter((e) => e.name.toLowerCase() === 'cube')[0]
         ?.elements[0]?.elements.map((element) => element.attributes));
 };
-const everyDayAtFour = later.parse.cron('0 15 * * *');
+const everyDayAtFour = schedule.parse.cron('0 15 * * *');
 const baseCurrency = 'EUR';
 const UpdateECBRates = {
     ...WorkerAdapter,

package/lib/worker/update-token-ownership.js

@@ -1,6 +1,5 @@
-import { WorkerAdapter, WorkerDirector } from '@unchainedshop/core';
-import later from '@breejs/later';
-const everyMinute = later.parse.cron('* * * * *');
+import { WorkerAdapter, WorkerDirector, schedule } from '@unchainedshop/core';
+const everyMinute = schedule.parse.cron('* * * * *');
 export const UpdateTokenOwnership = {
     ...WorkerAdapter,
     key: 'shop.unchained.worker-plugin.update-token-ownership',
@@ -21,8 +20,8 @@ export const RefreshTokens = {
     external: false,
     async doWork(input, unchainedAPI) {
         const { modules } = unchainedAPI;
-        const tokens = await modules.warehousing.findTokens({ walletAddress: { $exists: true } });
-        const users = await modules.users.findUsers({ includeGuests: true, 'services.web3.verified': true });
+        const tokens = await modules.warehousing.findTokens({ walletAddressExists: true });
+        const users = await modules.users.findUsers({ includeGuests: true, web3Verified: true });
         const accounts = users.flatMap((user) => {
             return user?.services?.web3?.flatMap((service) => {
                 if (service.verified)

package/lib/worker/zombie-killer.js

@@ -38,13 +38,13 @@ export const ZombieKillerWorker = {
             const productMedia = await modules.products.media.findProductMedias({}, { projection: { mediaId: 1 } });
             const assortmentMedia = await modules.assortments.media.findAssortmentMedias({}, { projection: { mediaId: 1 } });
             const allFileIdsLinked = [...productMedia, ...assortmentMedia].map((l) => l?.mediaId);
-            const allFileIdsRelevant = (await modules.files.findFiles({ path: { $in: ['product-media', 'assortment-media'] } }, { projection: { _id: 1 } })).map((a) => a._id);
+            const allFileIdsRelevant = (await modules.files.findFiles({ paths: ['product-media', 'assortment-media'] }, { projection: { _id: 1 } })).map((a) => a._id);
             const fileIdsToRemove = allFileIdsRelevant.filter((fileId) => {
                 return !allFileIdsLinked.includes(fileId);
             }) || [];
             const bulkImportMedia = await await modules.files.findFiles({
                 path: 'bulk-import-streams',
-                created: { $lt: new Date(Date.now() - 1000 * 60 * 60 * 24 * bulkImportMaxAgeInDays) },
+                createdBefore: new Date(Date.now() - 1000 * 60 * 60 * 24 * bulkImportMaxAgeInDays),
             });
             bulkImportMedia.forEach(async (media) => {
                 fileIdsToRemove.push(media._id);

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@unchainedshop/plugins",
-  "version": "4.4.0",
+  "description": "Official plugin collection for the Unchained Engine with payment, delivery, and pricing adapters",
+  "version": "4.6.0",
   "main": "lib/plugins-index.js",
   "types": "lib/plugins-index.d.ts",
   "exports": {
@@ -36,22 +37,21 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "dependencies": {
-    "@unchainedshop/api": "^4.4.0",
-    "@unchainedshop/core-delivery": "^4.4.0",
-    "@unchainedshop/core-enrollments": "^4.4.0",
-    "@unchainedshop/core-orders": "^4.4.0",
-    "@unchainedshop/core-payment": "^4.4.0",
-    "@unchainedshop/core-products": "^4.4.0",
-    "@unchainedshop/core-warehousing": "^4.4.0",
-    "@unchainedshop/core-worker": "^4.4.0",
-    "@unchainedshop/events": "^4.4.0",
-    "@unchainedshop/file-upload": "^4.4.0",
-    "@unchainedshop/logger": "^4.4.0",
-    "@unchainedshop/utils": "^4.4.0"
+    "@unchainedshop/api": "^4.6.0",
+    "@unchainedshop/core-delivery": "^4.6.0",
+    "@unchainedshop/core-enrollments": "^4.6.0",
+    "@unchainedshop/core-orders": "^4.6.0",
+    "@unchainedshop/core-payment": "^4.6.0",
+    "@unchainedshop/core-products": "^4.6.0",
+    "@unchainedshop/core-warehousing": "^4.6.0",
+    "@unchainedshop/core-worker": "^4.6.0",
+    "@unchainedshop/events": "^4.6.0",
+    "@unchainedshop/file-upload": "^4.6.0",
+    "@unchainedshop/logger": "^4.6.0",
+    "@unchainedshop/utils": "^4.6.0"
   },
   "peerDependencies": {
     "@aws-sdk/client-eventbridge": ">= 3.714 < 4",
-    "@breejs/later": "^4.2.0",
     "@paypal/checkout-server-sdk": "1.x",
     "@redis/client": ">= 1 < 6",
     "@scure/bip32": ">= 2",
@@ -68,9 +68,6 @@
     "xml-js": ">= 1.6 < 2"
   },
   "peerDependenciesMeta": {
-    "@breejs/later": {
-      "optional": true
-    },
     "@aws-sdk/client-eventbridge": {
       "optional": true
     },
@@ -115,12 +112,10 @@
     }
   },
   "devDependencies": {
-    "@breejs/later": "^4.2.0",
     "@paypal/checkout-server-sdk": "^1.0.3",
     "@redis/client": "^5.6.0",
     "@scure/bip32": "^2.0.0",
     "@scure/btc-signer": "^2.0.0",
-    "@types/breejs__later": "^4.1.5",
     "@types/express": "^5.0.3",
     "@types/node": "^25.0.0",
     "expiry-map": "^2.0.0",