domma-cms 0.84.1 → 0.85.0

package/plugins/shopping-cart/tests/pure.test.js

@@ -0,0 +1,210 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {createHmac} from 'node:crypto';
+import {formatMoney, fromMinor, includedTax, percentOf, toMinor} from '../public/lib/money.js';
+import {available, cleanProduct, priceRange, publicProduct, slugify, unitPrice} from '../public/lib/products.js';
+import {canMove, cleanCheckout} from '../public/lib/orders.js';
+import {cleanLines, priceBasket} from '../lib/pricing.js';
+import {paypalPaid, stripeForm, stripeLineItems, stripeSessionPaid, stripeVerify} from '../lib/payments.js';
+import {badge, summarise} from '../lib/summary.js';
+import {cartRegistry} from '../lib/extensions.js';
+import {matchShopPath} from '../plugin.public.js';
+import {cleanPath, cleanSettings, MASK, maskSettings} from '../lib/shop.js';
+import defaults from '../config.js';
+
+test('money: minor units in, formatted out', () => {
+    assert.equal(toMinor('19.99'), 1999);
+    assert.equal(toMinor('£1,299.50'), 129950);
+    assert.equal(toMinor(12), 1200);
+    assert.equal(toMinor('1000', 'JPY'), 1000);
+    for (const bad of ['', 'abc', '-3', null, '1.2.3']) assert.equal(toMinor(bad), null, String(bad));
+    assert.equal(fromMinor(1999), '19.99');
+    assert.equal(formatMoney(1999, 'GBP'), '£19.99');
+    assert.equal(formatMoney(2000, 'GBP', {compact: true}), '£20');
+    assert.equal(percentOf(1000, 20), 200);
+    assert.equal(includedTax(12000, 20), 2000);
+});
+
+test('products: cleaned, slugged, variants and stock', () => {
+    assert.equal(slugify('Blue Mug (Large) & Saucer!'), 'blue-mug-large-and-saucer');
+    const {data, errors} = cleanProduct({name: 'Tee', price: 2000, trackStock: true,
+        variants: [{name: 'S', stock: 2}, {name: 'M', stock: 0, price: 2200}, {name: 's'}]});
+    assert.ok(errors.variant2, 'a duplicate option name is refused');
+    assert.equal(data.slug, 'tee');
+    assert.equal(data.variants.length, 2);
+    const p = {...data};
+    assert.equal(unitPrice(p, p.variants[1].id), 2200);
+    assert.equal(unitPrice(p, p.variants[0].id), 2000);
+    assert.equal(available(p, p.variants[0].id), 2);
+    assert.equal(available(p, p.variants[1].id), 0);
+    assert.deepEqual(priceRange(p), {min: 2000, max: 2200});
+    assert.equal(available({trackStock: false}), Infinity);
+    const pub = publicProduct({id: 'x', data: p});
+    assert.equal(pub.variants[0].available, 2);
+    assert.equal(cleanProduct({name: '', price: 'x'}, {minor: false}).errors.price, 'Not a price.');
+    assert.equal(cleanProduct({name: 'A', price: '12.50'}, {minor: false}).data.price, 1250);
+    assert.equal(cleanProduct({name: 'A', price: 1000, compareAt: 900}).data.compareAt, null, 'a "was" price below the price is dropped');
+    assert.deepEqual(cleanProduct({name: 'A', price: 1, images: ['javascript:alert(1)', '/media/a.jpg']}).data.images, ['/media/a.jpg']);
+});
+
+test('orders: moves, checkout cleaning', () => {
+    assert.ok(canMove('paid', 'fulfilled'));
+    assert.ok(!canMove('cancelled', 'paid'));
+    assert.ok(!canMove('pending', 'refunded'));
+    const bad = cleanCheckout({customer: {name: '', email: 'nope'}, address: {country: 'FR'}}, {countries: ['GB']});
+    assert.ok(bad.errors.name && bad.errors.email && bad.errors.line1 && bad.errors.country);
+    const ok = cleanCheckout({customer: {name: 'Ann', email: 'Ann@Example.com'}}, {needsAddress: false});
+    assert.deepEqual(ok.errors, {});
+    assert.equal(ok.customer.email, 'ann@example.com');
+    assert.equal(ok.address, null);
+});
+
+const catalogue = new Map([
+    ['p1', {id: 'p1', data: {name: 'Mug', status: 'active', price: 1000, trackStock: true, stock: 3, variants: [], shippable: true}}],
+    ['p2', {id: 'p2', data: {name: 'Ebook', status: 'active', price: 500, trackStock: false, variants: [], shippable: false}}],
+    ['p3', {id: 'p3', data: {name: 'Old', status: 'archived', price: 100, variants: []}}]
+]);
+const S = {...defaults, currency: 'GBP'};
+
+test('pricing: stock caps quantities, archived products drop out', async () => {
+    const lines = cleanLines([{productId: 'p1', qty: 2}, {productId: 'p1', qty: 3}, {productId: 'p3', qty: 1}, {productId: '../x', qty: 1}, {productId: 'p2', qty: 0}]);
+    assert.deepEqual(lines.map(l => [l.productId, l.qty]), [['p1', 5], ['p3', 1]]);
+    const q = await priceBasket({lines, products: catalogue, settings: S});
+    assert.equal(q.lines.length, 1);
+    assert.equal(q.lines[0].qty, 3, 'only three left');
+    assert.equal(q.subtotal, 3000);
+    assert.equal(q.problems.length, 2);
+});
+
+test('pricing: flat delivery, free over a threshold, collection, nothing to ship', async () => {
+    const s = {...S, shippingFlat: 395, freeShippingOver: 2500, allowCollection: true};
+    let q = await priceBasket({lines: [{productId: 'p1', variantId: '', qty: 1}], products: catalogue, settings: s});
+    assert.equal(q.shipping, 395);
+    assert.equal(q.total, 1395);
+    q = await priceBasket({lines: [{productId: 'p1', variantId: '', qty: 3}], products: catalogue, settings: s});
+    assert.equal(q.shipping, 0);
+    assert.equal(q.adjustments[0].label, 'Free delivery');
+    q = await priceBasket({lines: [{productId: 'p1', variantId: '', qty: 1}], products: catalogue, settings: s, input: {delivery: 'collect'}});
+    assert.equal(q.shipping, 0);
+    q = await priceBasket({lines: [{productId: 'p2', variantId: '', qty: 1}], products: catalogue, settings: s});
+    assert.equal(q.requiresShipping, false);
+    assert.equal(q.adjustments.length, 0);
+});
+
+test('pricing: tax inclusive shows, exclusive adds', async () => {
+    const lines = [{productId: 'p1', variantId: '', qty: 1}];
+    let q = await priceBasket({lines, products: catalogue, settings: {...S, taxRate: 20, pricesIncludeTax: true, shippingFlat: 200}});
+    assert.equal(q.total, 1200);
+    assert.equal(q.tax, 200, 'the VAT inside £12');
+    assert.ok(q.taxIncluded);
+    q = await priceBasket({lines, products: catalogue, settings: {...S, taxRate: 10, pricesIncludeTax: false, taxShipping: false, shippingFlat: 200}});
+    assert.equal(q.tax, 100);
+    assert.equal(q.total, 1300);
+});
+
+test('pricing: an extension replaces a stage; a discount never goes below nothing; a failure falls back', async () => {
+    const lines = [{productId: 'p1', variantId: '', qty: 1}];
+    let q = await priceBasket({lines, products: catalogue, settings: S, handlers: {discount: () => [{label: 'Huge', amount: -99999, code: 'X'}]}});
+    assert.equal(q.discount, -1000);
+    assert.equal(q.total, 0);
+    q = await priceBasket({lines, products: catalogue, settings: {...S, shippingFlat: 300}, handlers: {shipping: () => { throw new Error('boom'); }}});
+    assert.equal(q.shipping, 300, 'the built-in rate stands in');
+    assert.equal(q.internalNotes.length, 1);
+    assert.equal(q.notes.length, 0, 'the shopper is not told about our fault');
+});
+
+test('registry: stages, tabs, and emit that never throws', async () => {
+    const reg = cartRegistry();
+    reg.register('test-ext', {stages: {discount: () => []}, tabs: [{key: 'x', label: 'X', module: '/plugins/test-ext/admin/x.js'}, {key: 'bad', module: 'https://evil/x.js'}],
+        on: {paid: () => { throw new Error('nope'); }}, checkout: {codes: true}});
+    assert.equal(typeof reg.handlers().discount, 'function');
+    assert.deepEqual(reg.tabs().map(t => t.key), ['x']);
+    assert.deepEqual(reg.checkoutFeatures(), {codes: true});
+    reg.emit('paid', {});
+    await new Promise(r => setTimeout(r, 5));
+    reg.unregister('test-ext');
+    assert.equal(reg.list().length, 0);
+});
+
+test('stripe: form encoding, itemising, signature, paid check', () => {
+    assert.equal(stripeForm({a: {b: [{c: 1}]}, d: 'x', e: null}).toString(), 'a%5Bb%5D%5B0%5D%5Bc%5D=1&d=x');
+    const order = {id: 'o1', number: 1001, currency: 'GBP', total: 1395,
+        lines: [{name: 'Mug', variantName: '', unitPrice: 1000, qty: 1, image: ''}],
+        adjustments: [{stage: 'shipping', label: 'Delivery', amount: 395}, {stage: 'tax', label: 'Incl VAT', amount: 232, included: true}]};
+    assert.equal(stripeLineItems(order).length, 2, 'the mug and delivery; included tax is not a line');
+    assert.equal(stripeLineItems({...order, adjustments: [{stage: 'discount', label: 'X', amount: -100}]}).length, 1, 'discounted: one line');
+    const body = '{"x":1}';
+    const t = 1_700_000_000;
+    const sig = createHmac('sha256', 'whsec_test').update(`${t}.${body}`).digest('hex');
+    assert.ok(stripeVerify(Buffer.from(body), `t=${t},v1=${sig}`, 'whsec_test', 300, t + 10));
+    assert.ok(!stripeVerify(Buffer.from(body), `t=${t},v1=${sig}`, 'whsec_test', 300, t + 1000), 'too old');
+    assert.ok(!stripeVerify(Buffer.from('{"x":2}'), `t=${t},v1=${sig}`, 'whsec_test', 300, t));
+    const session = {payment_status: 'paid', client_reference_id: 'o1', currency: 'gbp', amount_total: 1395, id: 'cs_1', payment_intent: 'pi_1'};
+    assert.deepEqual(stripeSessionPaid(session, order), {ref: 'cs_1', payment: 'pi_1'});
+    assert.equal(stripeSessionPaid({...session, amount_total: 1}, order), null, 'the wrong amount is not a payment');
+});
+
+test('paypal: only a completed capture of the right amount counts', () => {
+    const order = {id: 'o1', currency: 'GBP', total: 1395};
+    const pp = {id: 'PP1', status: 'COMPLETED', purchase_units: [{reference_id: 'o1', payments: {captures: [{id: 'CAP1', status: 'COMPLETED', amount: {currency_code: 'GBP', value: '13.95'}}]}}]};
+    assert.deepEqual(paypalPaid(pp, order), {ref: 'PP1', payment: 'CAP1'});
+    assert.equal(paypalPaid({...pp, status: 'APPROVED'}, order), null);
+    assert.equal(paypalPaid(pp, {...order, total: 2000}), null);
+});
+
+test('storefront addresses', () => {
+    assert.deepEqual(matchShopPath('/shop', '/shop'), {name: 'index', params: {}});
+    assert.equal(matchShopPath('/shop/cart', '/shop').name, 'cart');
+    assert.deepEqual(matchShopPath('/shop/blue-mug', '/shop'), {name: 'product', params: {slug: 'blue-mug'}});
+    assert.deepEqual(matchShopPath('/shop/order/0f8c3a2e-1111', '/shop'), {name: 'order', params: {id: '0f8c3a2e-1111'}});
+    assert.equal(matchShopPath('/shopping', '/shop'), null);
+    assert.equal(matchShopPath('/shop/a/b/c', '/shop'), null);
+    assert.equal(cleanPath('Store/'), '/store');
+    assert.equal(cleanPath('/admin'), '/shop', 'never over the admin');
+});
+
+test('settings: secrets masked, a mask keeps the stored value, bad keys refused', () => {
+    const current = {...defaults, stripeSecretKey: 'sk_test_abcdefghijklmnop'};
+    assert.equal(maskSettings(current).stripeSecretKey, MASK);
+    assert.equal(maskSettings(current).paypalSecret, '');
+    let r = cleanSettings({stripeSecretKey: MASK, taxRate: '20'}, current);
+    assert.equal(r.settings.stripeSecretKey, current.stripeSecretKey);
+    assert.equal(r.settings.taxRate, 20);
+    r = cleanSettings({stripeSecretKey: 'pk_test_wrong', stripeEnabled: true}, current);
+    assert.ok(r.errors.stripeSecretKey);
+    r = cleanSettings({paypalEnabled: true}, current);
+    assert.ok(r.errors.paypalEnabled);
+});
+
+test('summary and badge', () => {
+    const now = Date.parse('2026-09-26T12:00:00Z');
+    const o = (status, total, daysAgo, extra = {}) => ({id: `${status}${total}`, meta: {createdAt: new Date(now - daysAgo * 864e5).toISOString()},
+        data: {status, total, number: 1000 + total, paidAt: ['paid', 'fulfilled'].includes(status) ? new Date(now - daysAgo * 864e5).toISOString() : undefined,
+            lines: [{productId: 'p1', name: 'Mug', qty: 1, lineTotal: total}], customer: {name: 'Ann'}, ...extra}});
+    const orders = [o('paid', 500, 0), o('fulfilled', 1500, 3), o('pending', 900, 1), o('refunded', 700, 2), o('paid', 100, 40)];
+    const s = summarise(orders, [{id: 'p1', data: {status: 'active', trackStock: true, stock: 1, name: 'Mug'}}], {...S, lowStockAt: 3}, now);
+    assert.equal(s.days30.revenue, 2000);
+    assert.equal(s.days30.orders, 2);
+    assert.equal(s.toFulfil, 2);
+    assert.equal(s.abandoned, 1);
+    assert.equal(s.lowStockCount, 1);
+    assert.equal(s.series.length, 30);
+    const b = badge(orders, S, now);
+    assert.equal(b.count, 2);
+    assert.equal(b.tone, 'danger', 'one has waited 40 days');
+});
+
+test('pricing: a shipping handler can offer services to choose between', async () => {
+    const lines = [{productId: 'p1', variantId: '', qty: 1}];
+    const shipping = ({input}) => {
+        const choices = [{id: 'std', label: 'Standard', amount: 300}, {id: 'exp', label: 'Express', amount: 900}];
+        const pick = choices.find(c => c.id === input.service) || choices[0];
+        return {adjustments: [{label: pick.label, amount: pick.amount, ref: pick.id}], choices};
+    };
+    let q = await priceBasket({lines, products: catalogue, settings: S, handlers: {shipping}});
+    assert.deepEqual(q.shippingChoices.map(c => c.id), ['std', 'exp']);
+    assert.equal(q.shippingChoice, 'std');
+    q = await priceBasket({lines, products: catalogue, settings: S, input: {service: 'exp'}, handlers: {shipping}});
+    assert.equal(q.shipping, 900);
+    assert.equal(q.shippingChoice, 'exp');
+});

package/scripts/setup.js

@@ -46,6 +46,7 @@ const THEMES = [
     'unicorn-dark', 'unicorn-light',
     'dreamy-dark', 'dreamy-light',
     'wedding-dark', 'wedding-light',
+    'corporate-dark', 'corporate-light',
 ];
 
 const SERVER_CONFIG = path.join(ROOT, 'config', 'server.json');