cabloy 5.1.115 → 5.1.117

package/vona/src/suite/a-commerce/modules/commerce-member/test/addressOwnership.test.ts

@@ -1,6 +1,6 @@
 import type {
-  DtoAddressCreate,
-  DtoAddressUpdate,
+  DtoAddressMineCreate,
+  DtoAddressMineUpdate,
   EntityAddress,
 } from 'vona-module-commerce-member';
 
@@ -11,12 +11,17 @@ import { describe, it } from 'node:test';
 import { app } from 'vona-mock';
 
 const actionPath = '/commerce/member/address';
+const minePath = `${actionPath}/mine`;
+const viewMinePath = `${actionPath}/viewMine/:id`;
+const createMinePath = `${actionPath}/createMine`;
+const updateMinePath = `${actionPath}/updateMine/:id`;
+const deleteMinePath = `${actionPath}/deleteMine/:id`;
 
 function createTestId() {
   return randomUUID().slice(0, 12);
 }
 
-function createAddress(suffix: string): DtoAddressCreate {
+function createAddress(suffix: string): DtoAddressMineCreate {
   return {
     recipientName: `Recipient ${suffix}`,
     phone: '15555550123',
@@ -45,15 +50,23 @@ async function registerAndSignin(name: string) {
   return { token: token.accessToken, user: app.bean.passport.currentUser! };
 }
 
-describe('address.test.ts', () => {
-  it('denies anonymous address actions', async () => {
+async function deleteOwnedAddresses(ids: Array<number | string | undefined>) {
+  for (const id of ids) {
+    if (id !== undefined) await app.scope('commerce-member').model.address.deleteById(id);
+  }
+}
+
+describe('addressOwnership.test.ts', () => {
+  it('denies anonymous Admin and Web Address actions', async () => {
     await app.bean.executor.mockCtx(async () => {
       for (const [method, path, options] of [
-        ['post', actionPath, { body: createAddress('anonymous') }],
         ['get', actionPath, {}],
         ['get', `${actionPath}/:id`, { params: { id: 999999 } }],
-        ['patch', `${actionPath}/:id`, { params: { id: 999999 }, body: {} }],
-        ['delete', `${actionPath}/:id`, { params: { id: 999999 } }],
+        ['get', minePath, {}],
+        ['get', viewMinePath, { params: { id: 999999 } }],
+        ['post', createMinePath, { body: createAddress('anonymous') }],
+        ['patch', updateMinePath, { params: { id: 999999 }, body: createAddress('anonymous') }],
+        ['delete', deleteMinePath, { params: { id: 999999 } }],
       ] as const) {
         const [_, err] = await catchError(() =>
           app.bean.executor.performAction(method, path, { ...options, innerAccess: false }),
@@ -63,146 +76,174 @@ describe('address.test.ts', () => {
     });
   });
 
-  it('derives ownership from the authenticated customer and scopes every action', async () => {
-    await app.bean.executor.mockCtx(async () => {
-      const suffix = createTestId();
-      const customerA = await registerAndSignin(`address-a-${suffix}`);
-      const customerB = await registerAndSignin(`address-b-${suffix}`);
-      const addressData = createAddress(suffix);
-      const addressId = await performAs(customerA.token, 'post', actionPath, {
-        body: { ...addressData, userId: customerB.user.id, iid: 999999 } as any,
-      });
-
-      const persisted = await app.scope('commerce-member').model.address.getById(addressId);
-      assert.equal(String(persisted?.userId), String(customerA.user.id));
-      assert.equal(persisted?.iid, app.ctx.instance.id);
-
-      const ownList = await performAs(customerA.token, 'get', actionPath);
-      assert.equal(
-        ownList.list.some(item => String(item.id) === String(addressId)),
-        true,
-      );
-      assert.equal(
-        ownList.list.every(item => !Object.hasOwn(item, 'userId')),
-        true,
-      );
-      assert.equal(
-        ownList.list.every(item => !Object.hasOwn(item, 'iid')),
-        true,
-      );
-
-      const update: DtoAddressUpdate = { ...addressData, city: 'Oakland', addressLine2: undefined };
-      assert.equal(
-        await performAs(customerA.token, 'patch', `${actionPath}/:id`, {
-          params: { id: addressId },
-          body: update,
-        }),
-        null,
-      );
-      const ownAddress: EntityAddress = await performAs(
-        customerA.token,
-        'get',
-        `${actionPath}/:id`,
-        {
-          params: { id: addressId },
-        },
-      );
-      assert.equal(ownAddress.city, update.city);
-      assert.equal(ownAddress.addressLine2, addressData.addressLine2);
-      assert.equal(Object.hasOwn(ownAddress, 'userId'), false);
-      assert.equal(Object.hasOwn(ownAddress, 'iid'), false);
-
-      const foreignList = await performAs(customerB.token, 'get', actionPath);
-      assert.equal(
-        foreignList.list.some(item => String(item.id) === String(addressId)),
-        false,
-      );
-      assert.equal(
-        await performAs(customerB.token, 'get', `${actionPath}/:id`, { params: { id: addressId } }),
-        undefined,
-      );
-      assert.equal(
-        await performAs(customerB.token, 'patch', `${actionPath}/:id`, {
-          params: { id: addressId },
-          body: { ...addressData, city: 'Los Angeles' },
-        }),
-        null,
-      );
-      assert.equal(
-        await performAs(customerB.token, 'delete', `${actionPath}/:id`, {
-          params: { id: addressId },
-        }),
-        null,
-      );
-      assert.equal(
-        (await app.scope('commerce-member').model.address.getById(addressId))?.city,
-        'Oakland',
-      );
-
-      assert.equal(
-        await performAs(customerA.token, 'delete', `${actionPath}/:id`, {
-          params: { id: addressId },
-        }),
-        null,
-      );
-      assert.equal(
-        await performAs(customerA.token, 'get', `${actionPath}/:id`, { params: { id: addressId } }),
-        undefined,
-      );
-    });
-  });
-
-  it('treats another instance address as absent', async () => {
-    let addressId!: number;
-    let customerDefault!: Awaited<ReturnType<typeof registerAndSignin>>;
-    const addressDefault = createAddress('default');
+  it('derives Web ownership from Passport and treats foreign rows as absent', async () => {
     await app.bean.executor.mockCtx(async () => {
-      customerDefault = await registerAndSignin(`address-default-${Date.now()}`);
-      addressId = await performAs(customerDefault.token, 'post', actionPath, {
-        body: addressDefault,
-      });
-    });
+      let addressId: number | undefined;
+      try {
+        const suffix = createTestId();
+        const customerA = await registerAndSignin(`address-a-${suffix}`);
+        const customerB = await registerAndSignin(`address-b-${suffix}`);
+        const addressData = createAddress(suffix);
+        addressId = await performAs(customerA.token, 'post', createMinePath, {
+          body: { ...addressData, userId: customerB.user.id, iid: 999999 } as any,
+        });
+
+        const persisted = await app.scope('commerce-member').model.address.getById(addressId);
+        assert.equal(String(persisted?.userId), String(customerA.user.id));
+        assert.equal(persisted?.iid, app.ctx.instance.id);
+
+        const ownList = await performAs(customerA.token, 'get', minePath);
+        assert.equal(
+          ownList.list.some(item => String(item.id) === String(addressId)),
+          true,
+        );
+        assert.equal(
+          ownList.list.every(item => !Object.hasOwn(item, 'userId')),
+          true,
+        );
+        assert.equal(
+          ownList.list.every(item => !Object.hasOwn(item, 'iid')),
+          true,
+        );
 
-    await app.bean.executor.mockCtx(
-      async () => {
-        const customer = await registerAndSignin(`address-share-${Date.now()}`);
+        const { addressLine2: _, ...update } = {
+          ...addressData,
+          city: 'Oakland',
+        } satisfies DtoAddressMineUpdate;
         assert.equal(
-          await performAs(customer.token, 'get', `${actionPath}/:id`, {
+          await performAs(customerA.token, 'patch', updateMinePath, {
             params: { id: addressId },
+            body: update,
           }),
-          undefined,
+          null,
         );
-        const list = await performAs(customer.token, 'get', actionPath);
+        const ownAddress: EntityAddress = await performAs(customerA.token, 'get', viewMinePath, {
+          params: { id: addressId },
+        });
+        assert.equal(ownAddress.city, update.city);
+        assert.equal(ownAddress.addressLine2, addressData.addressLine2);
+        assert.equal(Object.hasOwn(ownAddress, 'userId'), false);
+        assert.equal(Object.hasOwn(ownAddress, 'iid'), false);
+
+        const foreignList = await performAs(customerB.token, 'get', minePath);
         assert.equal(
-          list.list.some(item => String(item.id) === String(addressId)),
+          foreignList.list.some(item => String(item.id) === String(addressId)),
           false,
         );
         assert.equal(
-          await performAs(customer.token, 'patch', `${actionPath}/:id`, {
+          await performAs(customerB.token, 'get', viewMinePath, { params: { id: addressId } }),
+          undefined,
+        );
+        assert.equal(
+          await performAs(customerB.token, 'patch', updateMinePath, {
             params: { id: addressId },
-            body: { ...createAddress('foreign'), city: 'Other city' },
+            body: { ...addressData, city: 'Los Angeles' },
           }),
           null,
         );
         assert.equal(
-          await performAs(customer.token, 'delete', `${actionPath}/:id`, {
-            params: { id: addressId },
-          }),
+          await performAs(customerB.token, 'delete', deleteMinePath, { params: { id: addressId } }),
           null,
         );
         assert.equal(
-          await app.scope('commerce-member').model.address.getById(addressId),
-          undefined,
+          (await app.scope('commerce-member').model.address.getById(addressId))?.city,
+          'Oakland',
         );
-      },
-      { instanceName: 'shareTest' as any },
-    );
+      } finally {
+        await deleteOwnedAddresses([addressId]);
+      }
+    });
+  });
 
+  it('exposes active-instance Address inspection only to systemAdmin', async () => {
     await app.bean.executor.mockCtx(async () => {
-      const address = await performAs(customerDefault.token, 'get', `${actionPath}/:id`, {
-        params: { id: addressId },
-      });
-      assert.equal(address.city, addressDefault.city);
+      let addressId: number | undefined;
+      try {
+        const suffix = createTestId();
+        const customer = await registerAndSignin(`address-admin-${suffix}`);
+        addressId = await performAs(customer.token, 'post', createMinePath, {
+          body: createAddress(suffix),
+        });
+
+        const [_, nonAdminError] = await catchError(() =>
+          performAs(customer.token, 'get', actionPath),
+        );
+        assert.equal(nonAdminError?.code, 403);
+
+        const admin = await app.bean.passport.signinMock();
+        const list = await performAs(admin.accessToken, 'get', actionPath);
+        assert.equal(
+          list.list.some(item => String(item.id) === String(addressId)),
+          true,
+        );
+        const address = await performAs(admin.accessToken, 'get', `${actionPath}/:id`, {
+          params: { id: addressId },
+        });
+        assert.equal(address?.id, addressId);
+
+        const permissions = await Promise.all(
+          ['create', 'update', 'delete'].map(action =>
+            app.bean.permission.retrievePermissionAction('commerce-member:address', action),
+          ),
+        );
+        assert.deepEqual(permissions, [false, false, false]);
+      } finally {
+        await deleteOwnedAddresses([addressId]);
+      }
     });
   });
+
+  it('treats another instance Address as absent on Web actions', async () => {
+    let addressId: number | undefined;
+    let customerDefault!: Awaited<ReturnType<typeof registerAndSignin>>;
+    const addressDefault = createAddress('default');
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        customerDefault = await registerAndSignin(`address-default-${createTestId()}`);
+        addressId = await performAs(customerDefault.token, 'post', createMinePath, {
+          body: addressDefault,
+        });
+      });
+
+      await app.bean.executor.mockCtx(
+        async () => {
+          const customer = await registerAndSignin(`address-share-${createTestId()}`);
+          assert.equal(
+            await performAs(customer.token, 'get', viewMinePath, { params: { id: addressId } }),
+            undefined,
+          );
+          const list = await performAs(customer.token, 'get', minePath);
+          assert.equal(
+            list.list.some(item => String(item.id) === String(addressId)),
+            false,
+          );
+          assert.equal(
+            await performAs(customer.token, 'patch', updateMinePath, {
+              params: { id: addressId },
+              body: { ...createAddress('foreign'), city: 'Other city' },
+            }),
+            null,
+          );
+          assert.equal(
+            await performAs(customer.token, 'delete', deleteMinePath, {
+              params: { id: addressId },
+            }),
+            null,
+          );
+        },
+        { instanceName: 'shareTest' as any },
+      );
+
+      await app.bean.executor.mockCtx(async () => {
+        const address = await performAs(customerDefault.token, 'get', viewMinePath, {
+          params: { id: addressId },
+        });
+        assert.equal(address.city, addressDefault.city);
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => {
+        await deleteOwnedAddresses([addressId]);
+      });
+    }
+  });
 });

package/vona/src/suite/a-commerce/modules/commerce-payment/src/.metadata/index.ts

@@ -4,12 +4,15 @@ import type { TypeEntityOptionsFields } from 'vona-module-a-openapi';
 import type { TableIdentity } from 'table-identity';
 /** entity: begin */
 export * from '../entity/paymentAttempt.tsx';
+export * from '../entity/paymentAudit.tsx';
 import type { IEntityOptionsPaymentAttempt } from '../entity/paymentAttempt.tsx';
+import type { IEntityOptionsPaymentAudit } from '../entity/paymentAudit.tsx';
 import 'vona-module-a-orm';
 declare module 'vona-module-a-orm' {
   
     export interface IEntityRecord {
       'commerce-payment:paymentAttempt': IEntityOptionsPaymentAttempt;
+'commerce-payment:paymentAudit': IEntityOptionsPaymentAudit;
     }
 
   
@@ -20,16 +23,21 @@ declare module 'vona-module-commerce-payment' {
 /** entity: end */
 /** entity: begin */
 import type { EntityPaymentAttempt } from '../entity/paymentAttempt.tsx';
+import type { EntityPaymentAudit } from '../entity/paymentAudit.tsx';
 export interface IModuleEntity {
   'paymentAttempt': EntityPaymentAttemptMeta;
+'paymentAudit': EntityPaymentAuditMeta;
 }
 /** entity: end */
 /** entity: begin */
 export type EntityPaymentAttemptTableName = 'commercePaymentAttempt';
+export type EntityPaymentAuditTableName = 'commercePaymentAudit';
 export type EntityPaymentAttemptMeta=TypeEntityMeta<EntityPaymentAttempt,EntityPaymentAttemptTableName>;
+export type EntityPaymentAuditMeta=TypeEntityMeta<EntityPaymentAudit,EntityPaymentAuditTableName>;
 declare module 'vona-module-a-orm' {
   export interface ITableRecord {
     'commercePaymentAttempt': EntityPaymentAttemptMeta;
+'commercePaymentAudit': EntityPaymentAuditMeta;
   }
 }
 declare module 'vona-module-commerce-payment' {
@@ -37,16 +45,23 @@ declare module 'vona-module-commerce-payment' {
     export interface IEntityOptionsPaymentAttempt {
       fields?: TypeEntityOptionsFields<EntityPaymentAttempt, IEntityOptionsPaymentAttempt[TypeSymbolKeyFieldsMore]>;
     }
+
+    export interface IEntityOptionsPaymentAudit {
+      fields?: TypeEntityOptionsFields<EntityPaymentAudit, IEntityOptionsPaymentAudit[TypeSymbolKeyFieldsMore]>;
+    }
 }
 /** entity: end */
 /** model: begin */
 export * from '../model/paymentAttempt.ts';
+export * from '../model/paymentAudit.ts';
 import type { IModelOptionsPaymentAttempt } from '../model/paymentAttempt.ts';
+import type { IModelOptionsPaymentAudit } from '../model/paymentAudit.ts';
 import 'vona-module-a-orm';
 declare module 'vona-module-a-orm' {
   
     export interface IModelRecord {
       'commerce-payment:paymentAttempt': IModelOptionsPaymentAttempt;
+'commerce-payment:paymentAudit': IModelOptionsPaymentAudit;
     }
 
   
@@ -62,13 +77,26 @@ declare module 'vona-module-commerce-payment' {
             get $beanFullName(): 'commerce-payment.model.paymentAttempt';
             get $onionName(): 'commerce-payment:paymentAttempt';
             get $onionOptions(): IModelOptionsPaymentAttempt;
+          }
+
+        export interface ModelPaymentAudit {
+          /** @internal */
+          get scope(): ScopeModuleCommercePayment;
+        }
+
+          export interface ModelPaymentAudit {
+            get $beanFullName(): 'commerce-payment.model.paymentAudit';
+            get $onionName(): 'commerce-payment:paymentAudit';
+            get $onionOptions(): IModelOptionsPaymentAudit;
           } 
 }
 /** model: end */
 /** model: begin */
 import type { ModelPaymentAttempt } from '../model/paymentAttempt.ts';
+import type { ModelPaymentAudit } from '../model/paymentAudit.ts';
 export interface IModuleModel {
   'paymentAttempt': ModelPaymentAttempt;
+'paymentAudit': ModelPaymentAudit;
 }
 /** model: end */
 /** model: begin */
@@ -77,6 +105,7 @@ import 'vona';
 declare module 'vona' {
   export interface IBeanRecordGeneral {
     'commerce-payment.model.paymentAttempt': ModelPaymentAttempt;
+'commerce-payment.model.paymentAudit': ModelPaymentAudit;
   }
 }
 /** model: end */
@@ -112,27 +141,68 @@ declare module 'vona-module-commerce-payment' {
 updateById<T extends IModelUpdateOptions<EntityPaymentAttempt,ModelPaymentAttempt>>(id: TableIdentity, data: TypeModelMutateRelationData<EntityPaymentAttempt,ModelPaymentAttempt, T>, options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAttempt,ModelPaymentAttempt, T>>;
 deleteById<T extends IModelDeleteOptions<EntityPaymentAttempt,ModelPaymentAttempt>>(id: TableIdentity, options?: T): Promise<void>;
     }
+export interface ModelPaymentAudit {
+      [SymbolKeyEntity]: EntityPaymentAudit;
+      [SymbolKeyEntityMeta]: EntityPaymentAuditMeta;
+      [SymbolKeyModelOptions]: IModelOptionsPaymentAudit;
+      get<T extends IModelGetOptions<EntityPaymentAudit,ModelPaymentAudit>>(where: TypeModelWhere<EntityPaymentAudit>, options?: T): Promise<TypeModelRelationResult<EntityPaymentAudit, ModelPaymentAudit, T> | undefined>;
+      getForUpdate<T extends IModelGetOptions<EntityPaymentAudit,ModelPaymentAudit>>(where: TypeModelWhere<EntityPaymentAudit>, options?: T): Promise<TypeModelRelationResult<EntityPaymentAudit, ModelPaymentAudit, T> | undefined>;
+      getByIdForUpdate<T extends IModelGetOptions<EntityPaymentAudit,ModelPaymentAudit>>(id: TableIdentity, options?: T): Promise<TypeModelRelationResult<EntityPaymentAudit, ModelPaymentAudit, T> | undefined>;
+      mget<T extends IModelGetOptions<EntityPaymentAudit,ModelPaymentAudit>>(ids: TableIdentity[], options?: T): Promise<TypeModelRelationResult<EntityPaymentAudit, ModelPaymentAudit, T>[]>;
+      selectAndCount<T extends IModelSelectParams<EntityPaymentAudit,ModelPaymentAudit,ModelJoins>, ModelJoins extends TypeModelsClassLikeGeneral | undefined = undefined>(params?: T, options?: IModelMethodOptions, modelJoins?: ModelJoins): Promise<TypeModelSelectAndCount<EntityPaymentAudit, ModelPaymentAudit, T>>;
+      select<T extends IModelSelectParams<EntityPaymentAudit,ModelPaymentAudit,ModelJoins>, ModelJoins extends TypeModelsClassLikeGeneral | undefined = undefined>(params?: T, options?: IModelMethodOptions, modelJoins?: ModelJoins): Promise<TypeModelRelationResult<EntityPaymentAudit, ModelPaymentAudit, T>[]>;
+      insert<T extends IModelInsertOptions<EntityPaymentAudit,ModelPaymentAudit>>(data?: TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>, options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T, true>>;
+      insertBulk<T extends IModelInsertOptions<EntityPaymentAudit,ModelPaymentAudit>>(items: TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>[], options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T, true>[]>;
+      update<T extends IModelUpdateOptions<EntityPaymentAudit,ModelPaymentAudit>>(data: TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>, options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>>;
+      updateBulk<T extends IModelUpdateOptions<EntityPaymentAudit,ModelPaymentAudit>>(items: TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>[], options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>[]>;
+      delete<T extends IModelDeleteOptions<EntityPaymentAudit,ModelPaymentAudit>>(where?: TypeModelWhere<EntityPaymentAudit>, options?: T): Promise<void>;
+      deleteBulk<T extends IModelDeleteOptions<EntityPaymentAudit,ModelPaymentAudit>>(ids: TableIdentity[], options?: T): Promise<void>;
+      mutate<T extends IModelMutateOptions<EntityPaymentAudit,ModelPaymentAudit>>(data?: TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>, options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>>;
+      mutateBulk<T extends IModelMutateOptions<EntityPaymentAudit,ModelPaymentAudit>>(items: TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>[], options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>[]>;
+      count<T extends IModelSelectCountParams<EntityPaymentAudit,ModelPaymentAudit,ModelJoins>, ModelJoins extends TypeModelsClassLikeGeneral | undefined = undefined>(params?: T, options?: IModelMethodOptions, modelJoins?: ModelJoins): Promise<string | undefined>;
+      increment<T extends IModelIncrementParams<EntityPaymentAudit,ModelPaymentAudit,ModelJoins>, ModelJoins extends TypeModelsClassLikeGeneral | undefined = undefined>(params?: T, options?: IModelMethodOptions, modelJoins?: ModelJoins): Promise<number>;
+      decrement<T extends IModelIncrementParams<EntityPaymentAudit,ModelPaymentAudit,ModelJoins>, ModelJoins extends TypeModelsClassLikeGeneral | undefined = undefined>(params?: T, options?: IModelMethodOptions, modelJoins?: ModelJoins): Promise<number>;
+      aggregate<T extends IModelSelectAggrParams<EntityPaymentAudit,ModelPaymentAudit,ModelJoins>, ModelJoins extends TypeModelsClassLikeGeneral | undefined = undefined>(params?: T, options?: IModelMethodOptions, modelJoins?: ModelJoins): Promise<TypeModelAggrRelationResult<T>>;
+      group<T extends IModelSelectGroupParams<EntityPaymentAudit,ModelPaymentAudit,ModelJoins>, ModelJoins extends TypeModelsClassLikeGeneral | undefined = undefined>(params?: T, options?: IModelMethodOptions, modelJoins?: ModelJoins): Promise<TypeModelGroupRelationResult<EntityPaymentAudit, T>[]>;
+      getById<T extends IModelGetOptions<EntityPaymentAudit,ModelPaymentAudit>>(id: TableIdentity, options?: T): Promise<TypeModelRelationResult<EntityPaymentAudit, ModelPaymentAudit, T> | undefined>;
+updateById<T extends IModelUpdateOptions<EntityPaymentAudit,ModelPaymentAudit>>(id: TableIdentity, data: TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>, options?: T): Promise<TypeModelMutateRelationData<EntityPaymentAudit,ModelPaymentAudit, T>>;
+deleteById<T extends IModelDeleteOptions<EntityPaymentAudit,ModelPaymentAudit>>(id: TableIdentity, options?: T): Promise<void>;
+    }
 }
 declare module 'vona-module-a-orm' {
   export interface IModelClassRecord {
     'commerce-payment:paymentAttempt': ModelPaymentAttempt;
+'commerce-payment:paymentAudit': ModelPaymentAudit;
   }
 }
 /** model: end */
 /** service: begin */
+export * from '../service/mockPaymentAdapter.ts';
 export * from '../service/paymentAttempt.ts';
 
 import 'vona-module-a-bean';
 declare module 'vona-module-a-bean' {
   
     export interface IServiceRecord {
-      'commerce-payment:paymentAttempt': never;
+      'commerce-payment:mockPaymentAdapter': never;
+'commerce-payment:paymentAttempt': never;
     }
 
   
 }
 declare module 'vona-module-commerce-payment' {
   
+        export interface ServiceMockPaymentAdapter {
+          /** @internal */
+          get scope(): ScopeModuleCommercePayment;
+        }
+
+          export interface ServiceMockPaymentAdapter {
+            get $beanFullName(): 'commerce-payment.service.mockPaymentAdapter';
+            get $onionName(): 'commerce-payment:mockPaymentAdapter';
+            
+          }
+
         export interface ServicePaymentAttempt {
           /** @internal */
           get scope(): ScopeModuleCommercePayment;
@@ -146,9 +216,11 @@ declare module 'vona-module-commerce-payment' {
 }
 /** service: end */
 /** service: begin */
+import type { ServiceMockPaymentAdapter } from '../service/mockPaymentAdapter.ts';
 import type { ServicePaymentAttempt } from '../service/paymentAttempt.ts';
 export interface IModuleService {
-  'paymentAttempt': ServicePaymentAttempt;
+  'mockPaymentAdapter': ServiceMockPaymentAdapter;
+'paymentAttempt': ServicePaymentAttempt;
 }
 /** service: end */
 /** service: begin */
@@ -156,7 +228,8 @@ export interface IModuleService {
 import 'vona';
 declare module 'vona' {
   export interface IBeanRecordGeneral {
-    'commerce-payment.service.paymentAttempt': ServicePaymentAttempt;
+    'commerce-payment.service.mockPaymentAdapter': ServiceMockPaymentAdapter;
+'commerce-payment.service.paymentAttempt': ServicePaymentAttempt;
   }
 }
 /** service: end */

package/vona/src/suite/a-commerce/modules/commerce-payment/src/bean/meta.index.ts

@@ -10,6 +10,9 @@ import { $tableColumns } from 'vona-module-a-ormutils';
     ...$tableColumns('commercePaymentAttempt', 'userId'),
     ...$tableColumns('commercePaymentAttempt', 'state'),
     ...$tableColumns('commercePaymentAttempt', 'correlationId'),
+    ...$tableColumns('commercePaymentAudit', 'paymentAttemptId'),
+    ...$tableColumns('commercePaymentAudit', 'orderId'),
+    ...$tableColumns('commercePaymentAudit', 'idempotencyKey'),
   },
 })
 export class MetaIndex extends BeanBase {}

package/vona/src/suite/a-commerce/modules/commerce-payment/src/bean/meta.version.ts

@@ -26,10 +26,47 @@ export class MetaVersion extends BeanBase implements IMetaVersionUpdate {
       table
         .string(entityPaymentAttempt.correlationId, 100)
         .comment(entityPaymentAttempt.$comment.correlationId);
+      table
+        .dateTime(entityPaymentAttempt.finalizedAt)
+        .nullable()
+        .comment(entityPaymentAttempt.$comment.finalizedAt);
       table
         .dateTime(entityPaymentAttempt.cancelledAt)
         .nullable()
         .comment(entityPaymentAttempt.$comment.cancelledAt);
     });
+
+    const entityPaymentAudit = this.scope.entity.paymentAudit;
+    await this.bean.model.createTable(entityPaymentAudit.$table, table => {
+      table.comment(entityPaymentAudit.$comment.$table);
+      table.basicFields();
+      table
+        .tableIdentity(entityPaymentAudit.paymentAttemptId)
+        .comment(entityPaymentAudit.$comment.paymentAttemptId);
+      table.tableIdentity(entityPaymentAudit.orderId).comment(entityPaymentAudit.$comment.orderId);
+      table.userId(entityPaymentAudit.userId).comment(entityPaymentAudit.$comment.userId);
+      table.string(entityPaymentAudit.provider, 20).comment(entityPaymentAudit.$comment.provider);
+      table.string(entityPaymentAudit.outcome, 20).comment(entityPaymentAudit.$comment.outcome);
+      table
+        .string(entityPaymentAudit.fromAttemptState, 20)
+        .comment(entityPaymentAudit.$comment.fromAttemptState);
+      table
+        .string(entityPaymentAudit.toOrderState, 30)
+        .comment(entityPaymentAudit.$comment.toOrderState);
+      table
+        .string(entityPaymentAudit.idempotencyKey, 100)
+        .comment(entityPaymentAudit.$comment.idempotencyKey);
+      table
+        .string(entityPaymentAudit.correlationId, 100)
+        .comment(entityPaymentAudit.$comment.correlationId);
+      table.string(entityPaymentAudit.reason, 255).comment(entityPaymentAudit.$comment.reason);
+      table
+        .userId(entityPaymentAudit.actorId)
+        .nullable()
+        .comment(entityPaymentAudit.$comment.actorId);
+      table
+        .dateTime(entityPaymentAudit.processedAt)
+        .comment(entityPaymentAudit.$comment.processedAt);
+    });
   }
 }

package/vona/src/suite/a-commerce/modules/commerce-payment/src/dto/paymentAttemptView.tsx

@@ -15,8 +15,8 @@ export class DtoPaymentAttemptView {
   @Api.field(v.tableIdentity())
   orderId: TableIdentity;
 
-  @Api.field(z.enum(['created', 'cancelled']))
-  state: 'created' | 'cancelled';
+  @Api.field(z.enum(['created', 'succeeded', 'failed', 'cancelled']))
+  state: 'created' | 'succeeded' | 'failed' | 'cancelled';
 
   @Api.field(z.literal('USD'))
   currency: 'USD';

package/vona/src/suite/a-commerce/modules/commerce-payment/src/entity/paymentAttempt.tsx

@@ -5,7 +5,7 @@ import { Api, v } from 'vona-module-a-openapiutils';
 import { Entity, EntityBase } from 'vona-module-a-orm';
 import { z } from 'zod';
 
-export type TypePaymentAttemptState = 'created' | 'cancelled';
+export type TypePaymentAttemptState = 'created' | 'succeeded' | 'failed' | 'cancelled';
 
 export interface IEntityOptionsPaymentAttempt extends IDecoratorEntityOptions {}
 
@@ -17,7 +17,7 @@ export class EntityPaymentAttempt extends EntityBase {
   @Api.field(v.tableIdentity())
   userId: TableIdentity;
 
-  @Api.field(z.enum(['created', 'cancelled']))
+  @Api.field(z.enum(['created', 'succeeded', 'failed', 'cancelled']))
   state: TypePaymentAttemptState;
 
   @Api.field(z.literal('USD'))
@@ -29,6 +29,9 @@ export class EntityPaymentAttempt extends EntityBase {
   @Api.field(v.required(), v.min(1), v.max(100))
   correlationId: string;
 
+  @Api.field(v.optional())
+  finalizedAt?: Date;
+
   @Api.field(v.optional())
   cancelledAt?: Date;
 }