@unchainedshop/plugins 4.8.4 → 4.8.9

package/lib/files/minio/api.js

@@ -19,8 +19,7 @@ export async function minioWebhookHandler(request, context) {
                 headers: { 'Content-Type': 'application/json' },
             });
         }
-        const body = await request.json();
-        const { Records = [], EventName } = body;
+        const { Records = [], EventName } = (await request.json());
         if (EventName === 's3:ObjectCreated:Put') {
             const [{ s3 }] = Records;
             const { object } = s3;

package/lib/files/temp-upload/api.d.ts

@@ -1,6 +1,8 @@
 import { type UnchainedCore } from '@unchainedshop/core';
+import type { RolesInterface } from '@unchainedshop/roles';
 export declare function tempUploadHandler(request: Request, context: UnchainedCore & {
     params: Record<string, string>;
+    roles?: RolesInterface;
     userId?: string;
     user?: any;
 }): Promise<Response>;

package/lib/files/temp-upload/api.js

@@ -1,10 +1,9 @@
 import { createLogger } from '@unchainedshop/logger';
 import { getFileAdapter } from '@unchainedshop/core';
-import { Roles } from '@unchainedshop/roles';
 const logger = createLogger('unchained:temp-upload');
 export async function tempUploadHandler(request, context) {
     try {
-        const hasPermission = await Roles.userHasPermission(context, 'uploadTempFile', []);
+        const hasPermission = await context.roles?.userHasPermission(context, 'uploadTempFile', []);
         if (!hasPermission) {
             return Response.json({ error: 'Permission denied', message: 'User does not have uploadTempFile permission' }, { status: 403 });
         }

package/lib/payment/apple-iap/api.js

@@ -13,7 +13,7 @@ const AppleNotificationTypes = {
 export async function appleIAPWebhookHandler(request, context) {
     try {
         const { modules, services } = context;
-        const responseBody = await request.json();
+        const responseBody = (await request.json());
         if (responseBody.password !== APPLE_IAP_SHARED_SECRET) {
             logger.warn('Apple IAP Webhook: Invalid shared secret');
             return new Response(JSON.stringify({

package/lib/payment/cryptopay/api.js

@@ -3,7 +3,7 @@ import handleWebhook from "./handle-webhook.js";
 const logger = createLogger('unchained:cryptopay');
 export async function cryptopayWebhookHandler(request, context) {
     try {
-        const body = await request.json();
+        const body = (await request.json());
         await handleWebhook(body, context);
         return new Response(JSON.stringify({ success: true }), {
             status: 200,

package/lib/payment/cryptopay/handle-webhook.js

@@ -1,13 +1,14 @@
 import { createLogger } from '@unchainedshop/logger';
 import {} from '@unchainedshop/api';
 import { OrderStatus } from '@unchainedshop/core-orders';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 import {} from "./module.js";
 import {} from '@unchainedshop/core-products';
 const { CRYPTOPAY_SECRET, CRYPTOPAY_MAX_RATE_AGE = '360' } = process.env;
 const logger = createLogger('unchained:cryptopay:handler');
 export default async function handleWebhook({ secret, wallet, price, ping, }, context) {
     const { modules, services } = context;
-    if (secret !== CRYPTOPAY_SECRET) {
+    if (!CRYPTOPAY_SECRET || !(await timingSafeStringEqual(secret, CRYPTOPAY_SECRET))) {
         logger.warn(`webhook called with invalid secret`);
         throw new Error('Secret invalid');
     }

package/lib/payment/datatrans-v2/adapter.js

@@ -26,10 +26,13 @@ const getMarketplaceSplits = async ({ order, orderPayment, config, }) => {
         currencyCode: order.currencyCode,
     });
     const { amount: total } = pricing.total({ useNetPrice: false });
-    return Promise.all(config
+    const roundedTotal = Math.round(total);
+    const splits = config
         .filter((item) => item.key === 'marketplaceSplit')
         .map((item) => {
-        const [subMerchantId, staticDiscountId, sharePercentage] = item.value || ''.split(';').map((f) => f.trim());
+        const [subMerchantId, staticDiscountId, sharePercentage] = (item.value || '')
+            .split(';')
+            .map((f) => f.trim());
         const { amount: discountSum } = pricingForOrderPayment.total({
             category: PaymentPricingRowCategory.Discount,
             discountId: staticDiscountId,
@@ -42,7 +45,12 @@ const getMarketplaceSplits = async ({ order, orderPayment, config, }) => {
             amount,
             commission,
         };
-    }));
+    });
+    if (splits.length > 0) {
+        const splitsSum = splits.reduce((sum, s) => sum + s.amount, 0);
+        splits[splits.length - 1].amount += roundedTotal - splitsSum;
+    }
+    return splits;
 };
 export const Datatrans = {
     ...PaymentAdapter,

package/lib/payment/payrexx/api.js

@@ -3,7 +3,7 @@ const logger = createLogger('unchained:payrexx');
 export async function payrexxWebhookHandler(request, context) {
     try {
         const { modules, services } = context;
-        const body = await request.json();
+        const body = (await request.json());
         const { transaction } = body;
         if (!transaction) {
             logger.info('Unhandled event type', {

package/lib/payment/payrexx/payrexx.js

@@ -1,9 +1,9 @@
 const getRedirects = () => {
-    const { EMAIL_WEBSITE_URL, DATATRANS_SUCCESS_PATH = '/payrexx/success', DATATRANS_ERROR_PATH = '/payrexx/error', DATATRANS_CANCEL_PATH = '/payrexx/cancel', } = process.env;
+    const { EMAIL_WEBSITE_URL, PAYREXX_SUCCESS_PATH = '/payrexx/success', PAYREXX_ERROR_PATH = '/payrexx/error', PAYREXX_CANCEL_PATH = '/payrexx/cancel', } = process.env;
     return {
-        successRedirectUrl: `${EMAIL_WEBSITE_URL}${DATATRANS_SUCCESS_PATH}`,
-        failedRedirectUrl: `${EMAIL_WEBSITE_URL}${DATATRANS_ERROR_PATH}`,
-        cancelRedirectUrl: `${EMAIL_WEBSITE_URL}${DATATRANS_CANCEL_PATH}`,
+        successRedirectUrl: `${EMAIL_WEBSITE_URL}${PAYREXX_SUCCESS_PATH}`,
+        failedRedirectUrl: `${EMAIL_WEBSITE_URL}${PAYREXX_ERROR_PATH}`,
+        cancelRedirectUrl: `${EMAIL_WEBSITE_URL}${PAYREXX_CANCEL_PATH}`,
     };
 };
 export const mapOrderDataToGatewayObject = ({ order, orderPayment, pricing }, options = {}) => {

package/lib/payment/stripe/stripe.js

@@ -10,7 +10,7 @@ else {
     try {
         const { default: Stripe } = await import('stripe');
         stripe = new Stripe(STRIPE_SECRET, {
-            apiVersion: '2026-02-25.clover',
+            apiVersion: '2026-03-25.dahlia',
         });
     }
     catch {

package/lib/worker/bulk-import/api.d.ts

@@ -1,7 +1,9 @@
 import type { UnchainedCore } from '@unchainedshop/core';
+import type { RolesInterface } from '@unchainedshop/roles';
 export declare function bulkImportHandler(request: Request, context: UnchainedCore & {
     params: Record<string, string>;
     rawRequest?: any;
+    roles?: RolesInterface;
     userId?: string;
     user?: any;
 }): Promise<Response>;

package/lib/worker/bulk-import/api.js

@@ -1,9 +1,8 @@
 import { createLogger } from '@unchainedshop/logger';
-import { Roles } from '@unchainedshop/roles';
 const logger = createLogger('unchained:bulk-import');
 export async function bulkImportHandler(request, context) {
     try {
-        const hasPermission = await Roles.userHasPermission(context, 'bulkImport', []);
+        const hasPermission = await context.roles?.userHasPermission(context, 'bulkImport', []);
         if (!hasPermission) {
             return Response.json({ error: 'Permission denied', message: 'User does not have bulkImport permission' }, { status: 403 });
         }

package/lib/worker/bulkgate/adapter.js

@@ -31,7 +31,7 @@ export const BulkGateWorker = {
                 },
                 body: JSON.stringify(requestBody),
             });
-            const responseData = await response.json();
+            const responseData = (await response.json());
             if (responseData.error || responseData.type) {
                 return {
                     success: false,

package/lib/worker/twilio/adapter.js

@@ -26,7 +26,7 @@ export const SmsWorkerPlugin = {
                     ...params,
                 }),
             });
-            const data = await response.json();
+            const data = (await response.json());
             if (!response.ok) {
                 return {
                     success: false,

package/lib/worker/update-coinbase-rates/adapter.js

@@ -1,11 +1,9 @@
 import { WorkerAdapter, WorkerDirector, schedule } from '@unchainedshop/core';
 import { resolveBestCurrency } from '@unchainedshop/utils';
 const getExchangeRates = async (base) => {
-    return fetch(`https://api.coinbase.com/v2/exchange-rates?currency=${base}`, {
-        method: 'GET',
-    })
-        .then((res) => res.json())
-        .then((r) => r?.data);
+    const res = await fetch(`https://api.coinbase.com/v2/exchange-rates?currency=${base}`);
+    const { data } = (await res.json());
+    return data;
 };
 const everyMinute = schedule.parse.cron('* * * * *');
 export const UpdateCoinbaseRates = {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/plugins",
   "description": "Official plugin collection for the Unchained Engine with payment, delivery, and pricing adapters",
-  "version": "4.8.4",
+  "version": "4.8.9",
   "main": "lib/plugins-index.js",
   "types": "lib/plugins-index.d.ts",
   "exports": {
@@ -63,7 +63,7 @@
     "minio": "8.x",
     "nodemailer": ">= 6.9 < 9",
     "p-memoize": "8.x",
-    "stripe": ">= 19 < 21",
+    "stripe": ">= 19 < 22",
     "web-push": ">= 3.6 <4",
     "xml-js": ">= 1.6 < 2"
   },
@@ -124,7 +124,7 @@
     "minio": "^8.0.5",
     "nodemailer": "^8.0.2",
     "p-memoize": "^8.0.0",
-    "stripe": "^20.0.0",
+    "stripe": "^21.0.1",
     "typescript": "^5.8.3",
     "web-push": "^3.6.7",
     "xml-js": "^1.6.11"