domma-cms 0.84.1 → 0.86.0

package/plugins/shopping-cart/plugin.js

@@ -0,0 +1,559 @@
+/**
+ * Shopping Cart - the API (mounted at /api/plugins/shopping-cart).
+ *
+ * Admin (the `shop` permission; read to look, manage to change):
+ *   GET  /summary                 Overview figures
+ *   GET  /count                   sidebar badge: paid orders to fulfil
+ *   GET  /extensions              admin tabs extensions (Pro) add
+ *   GET  /products · POST /products · PUT /products/:id · DELETE /products/:id
+ *   POST /products/:id/duplicate · PUT /products/:id/stock
+ *   GET  /orders · GET /orders/:id · PUT /orders/:id/status · PUT /orders/:id/note
+ *   POST /orders/:id/refund · DELETE /orders/:id
+ *   GET  /settings · PUT /settings · POST /settings/test/:provider
+ *
+ * Shoppers (no sign-in):
+ *   GET  /catalogue               products on sale
+ *   POST /quote                   the basket priced (the ONE pricing: lib/pricing.js)
+ *   POST /checkout                an order, and where to pay for it
+ *   GET  /order/:id?t=            an order's receipt (token-gated), checking Stripe on the way
+ *   GET  /paypal/return           PayPal sends the shopper back here; we capture
+ *   POST /stripe/webhook          Stripe's word that a session was paid
+ *
+ * Storefront pages are plugin.public.js.
+ */
+
+import {getConfig} from '../../server/config.js';
+import {cleanCheckout, orderLabel} from './public/lib/orders.js';
+import {formatMoney} from './public/lib/money.js';
+import {publicProduct, byShelf} from './public/lib/products.js';
+import {cartRegistry} from './lib/extensions.js';
+import {SAMPLES} from './lib/samples.js';
+import {cleanLines, priceBasket} from './lib/pricing.js';
+import {badge, summarise} from './lib/summary.js';
+import * as pay from './lib/payments.js';
+import {
+    NAME, allOrders, allProducts, annotateOrder, cleanSettings, cleanTracking, createOrder, ensureCollections, extendOrder,
+    getOrder, getProduct, liveSettings, markPaid, maskSettings, methodsOf, moveOrder, publicOrder, removeOrder,
+    refreshShelf, removeProduct, saveProduct, saveSettings, setProviderRef, settingsNow, shelfNow, tokenOk
+} from './lib/shop.js';
+import {cardHtml, esc, gridHtml} from './lib/render.js';
+
+/** The origin shoppers last reached us on - for emails, which have no request. */
+let lastOrigin = '';
+
+/** Where this site lives, for the addresses a payment provider sends shoppers back to. */
+function siteBase(request) {
+    let base = '';
+    try { base = String(getConfig('site')?.baseUrl || ''); } catch { /* no site config */ }
+    if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
+    if (!request) return lastOrigin;
+    const origin = `${request.protocol}://${request.host || request.headers.host || request.hostname}`;
+    lastOrigin = origin;
+    return origin;
+}
+
+const receiptPath = (s, order) => `${s.shopPath}/order/${order.id}?t=${order.data.token}`;
+
+/** A problem for the shopper, sent as JSON with a status. */
+const fail = (reply, status, error, extra = {}) => reply.code(status).send({error, ...extra});
+
+/** The quote, from a request body, at today's prices. */
+async function quoteFor(body, settings) {
+    const lines = cleanLines(body?.lines);
+    const ids = new Set(lines.map(l => l.productId));
+    const products = new Map();
+    for (const e of await allProducts()) if (ids.has(e.id)) products.set(e.id, e);
+    const input = {
+        code: String(body?.code || '').trim().slice(0, 60),
+        country: String(body?.address?.country || body?.country || settings.countries?.[0] || '').toUpperCase().slice(0, 2),
+        region: String(body?.address?.region || '').slice(0, 100),
+        postcode: String(body?.address?.postcode || '').slice(0, 20),
+        delivery: body?.delivery === 'collect' ? 'collect' : 'ship',
+        service: String(body?.service || '').slice(0, 40),
+        email: String(body?.customer?.email || '').slice(0, 200)
+    };
+    const quote = await priceBasket({lines, products, settings, input, handlers: cartRegistry().handlers()});
+    return {quote, input};
+}
+
+/** What the storefront shows of a quote. */
+function shopperQuote(q, settings) {
+    return {
+        currency: q.currency, lines: q.lines, problems: q.problems, notes: q.notes, subtotal: q.subtotal,
+        adjustments: q.adjustments, total: q.total, taxIncluded: q.taxIncluded, requiresShipping: q.requiresShipping,
+        itemCount: q.itemCount, shippingChoices: q.shippingChoices, shippingChoice: q.shippingChoice, methods: methodsOf(settings).map(m => ({id: m.id, label: m.label})),
+        features: {collection: Boolean(settings.allowCollection), collectionLabel: settings.collectionLabel, ...cartRegistry().checkoutFeatures()}
+    };
+}
+
+/**
+ * Sell from any page:
+ *   [shop-products category="Mugs" limit="8" columns="4" featured="true" /]
+ *   [shop-product slug="blue-mug" /]
+ *   [buy-button slug="blue-mug" label="Buy now" /]
+ * Rendered from the products as last read (shortcodes run synchronously).
+ */
+function registerShortcodes(hooks) {
+    if (typeof hooks.registerShortcode !== 'function') return;
+    const onSale = () => shelfNow().filter(e => e.data?.status === 'active').sort(byShelf);
+
+    hooks.registerShortcode('shop-products', (attrStr, _body, ctx) => {
+        const a = ctx.parseShortcodeAttrs(attrStr || '');
+        const s = settingsNow();
+        let list = onSale();
+        if (a.category) list = list.filter(e => String(e.data.category).toLowerCase() === String(a.category).toLowerCase());
+        if (a.tag) list = list.filter(e => (e.data.tags || []).includes(String(a.tag).toLowerCase()));
+        if (a.featured === 'true' || a.featured === true) list = list.filter(e => e.data.featured);
+        const limit = Math.max(1, Math.min(48, Number(a.limit) || 8));
+        list = list.slice(0, limit);
+        if (!list.length) return '<p class="shop-muted">Nothing on sale here yet.</p>';
+        return `<div class="shop-embed">${gridHtml(list, s, s.shopPath, {columns: a.columns})}</div>`;
+    });
+
+    hooks.registerShortcode('shop-product', (attrStr, _body, ctx) => {
+        const a = ctx.parseShortcodeAttrs(attrStr || '');
+        const s = settingsNow();
+        const e = onSale().find(x => x.data.slug === String(a.slug || ''));
+        if (!e) return '';
+        return `<div class="shop-embed is-single">${cardHtml(e, s, s.shopPath)}</div>`;
+    });
+
+    hooks.registerShortcode('buy-button', (attrStr, _body, ctx) => {
+        const a = ctx.parseShortcodeAttrs(attrStr || '');
+        const s = settingsNow();
+        const e = onSale().find(x => x.data.slug === String(a.slug || ''));
+        if (!e) return '';
+        const label = String(a.label || 'Add to basket').slice(0, 60);
+        if (e.data.variants?.length) {
+            return `<a class="shop-buy-button" href="${esc(`${s.shopPath}/${e.data.slug}`)}">${esc(label)}</a>`;
+        }
+        return `<button type="button" class="shop-buy-button" data-shop-add data-id="${esc(e.id)}" data-name="${esc(e.data.name)}" data-image="${esc(e.data.images?.[0] || '')}">${esc(label)} · ${esc(formatMoney(e.data.price, s.currency, {compact: true}))}</button>`;
+    });
+}
+
+export default async function shoppingCart(fastify, options) {
+    const {authenticate, requirePermission} = options.auth;
+    const hooks = options.hooks || {};
+    const can = (action) => ({preHandler: [authenticate, requirePermission('shop', action)]});
+    const registry = cartRegistry();
+
+    await ensureCollections();
+    await refreshShelf();
+    registerShortcodes(hooks);
+
+    // ---- Telling people ------------------------------------------------------------
+
+    function announcePaid(order) {
+        const d = order.data;
+        try {
+            hooks.notify?.({
+                title: `New order ${orderLabel(d)} - ${formatMoney(d.total, d.currency)}`,
+                body: `${d.customer?.name || d.email}: ${(d.lines || []).map(l => `${l.qty} × ${l.name}`).join(', ')}`.slice(0, 300),
+                severity: 'success',
+                link: `#/plugins/shopping-cart/orders/${order.id}`,
+                source: 'orders',
+                dedupeKey: `order-paid:${order.id}`
+            });
+        } catch { /* a notice never breaks a sale */ }
+        registry.emit('paid', order);
+    }
+
+    function announceMove(order, from, to) {
+        if (to === 'paid' && from !== 'fulfilled') announcePaid(order);
+        registry.emit('status', order, from, to);
+    }
+
+    if (typeof hooks.registerNotificationSource === 'function') {
+        try {
+            hooks.registerNotificationSource({id: 'orders', label: 'Shop orders', severity: 'success', defaultOn: true,
+                description: 'A new paid order in the Shop.'});
+        } catch { /* older engine */ }
+    }
+
+    // What extensions may use: the Cart's own data, read the Cart's way.
+    registry.services = {
+        name: NAME,
+        liveSettings, allOrders, getOrder, allProducts, getProduct, extendOrder, publicOrder,
+        formatMoney, orderLabel,
+        siteBase: () => siteBase(null),
+        receiptUrl: (order) => liveSettings().then(s => `${siteBase(null)}${receiptPath(s, order)}`)
+    };
+
+    // ---- Admin: overview, badge, extensions ----------------------------------------
+
+    fastify.get('/summary', can('read'), async () => {
+        const [orders, products, settings] = await Promise.all([allOrders(), allProducts(), liveSettings()]);
+        return {
+            ...summarise(orders, products, settings),
+            methods: methodsOf(settings).map(m => m.id),
+            shopPath: settings.shopPath,
+            shopTitle: settings.shopTitle
+        };
+    });
+
+    fastify.get('/count', can('read'), async () => {
+        const [orders, settings] = await Promise.all([allOrders(), liveSettings()]);
+        return badge(orders, settings);
+    });
+
+    fastify.get('/extensions', can('read'), async () => ({
+        tabs: registry.tabs(),
+        extensions: registry.list().map(e => ({owner: e.owner, label: e.label}))
+    }));
+
+    // ---- Admin: products -------------------------------------------------------------
+
+    fastify.get('/products', can('read'), async () => {
+        const products = await allProducts();
+        return products.sort(byShelf);
+    });
+
+    fastify.post('/products', can('manage'), async (request, reply) => {
+        const s = await liveSettings();
+        const r = await saveProduct(request.body || {}, {currency: s.currency, by: request.user?.id});
+        if (r.errors) return fail(reply, 400, Object.values(r.errors)[0], {errors: r.errors});
+        return reply.code(201).send(r.entry);
+    });
+
+    fastify.put('/products/:id', can('manage'), async (request, reply) => {
+        const s = await liveSettings();
+        const r = await saveProduct(request.body || {}, {id: request.params.id, currency: s.currency});
+        if (r.notFound) return fail(reply, 404, 'That product is gone.');
+        if (r.errors) return fail(reply, 400, Object.values(r.errors)[0], {errors: r.errors});
+        return r.entry;
+    });
+
+    /** Quick edits from the list: stock, status, featured - merged over the product. */
+    fastify.patch('/products/:id', can('manage'), async (request, reply) => {
+        const had = await getProduct(request.params.id);
+        if (!had) return fail(reply, 404, 'That product is gone.');
+        const b = request.body || {};
+        const patch = {};
+        for (const k of ['status', 'featured', 'stock', 'trackStock', 'position', 'variants']) if (b[k] !== undefined) patch[k] = b[k];
+        const s = await liveSettings();
+        const r = await saveProduct({...had.data, ...patch}, {id: had.id, currency: s.currency});
+        if (r.errors) return fail(reply, 400, Object.values(r.errors)[0], {errors: r.errors});
+        return r.entry;
+    });
+
+    fastify.post('/products/:id/duplicate', can('manage'), async (request, reply) => {
+        const had = await getProduct(request.params.id);
+        if (!had) return fail(reply, 404, 'That product is gone.');
+        const s = await liveSettings();
+        const r = await saveProduct({...had.data, name: `${had.data.name} (copy)`, slug: '', status: 'draft',
+            variants: (had.data.variants || []).map(v => ({...v, id: ''}))}, {currency: s.currency, by: request.user?.id});
+        if (r.errors) return fail(reply, 400, Object.values(r.errors)[0]);
+        return reply.code(201).send(r.entry);
+    });
+
+    /** The sample products, added as drafts or on sale (`live`). */
+    fastify.post('/samples', can('manage'), async (request, reply) => {
+        const s = await liveSettings();
+        const live = request.body?.live !== false;
+        const made = [];
+        for (const p of SAMPLES) {
+            const r = await saveProduct({...p, status: live ? 'active' : 'draft'}, {currency: s.currency, by: request.user?.id});
+            if (r.entry) made.push(r.entry);
+        }
+        return reply.code(201).send({count: made.length});
+    });
+
+    fastify.delete('/products/:id', can('manage'), async (request, reply) => {
+        const had = await getProduct(request.params.id);
+        if (!had) return fail(reply, 404, 'That product is gone.');
+        await removeProduct(had.id);
+        return {ok: true};
+    });
+
+    // ---- Admin: orders ---------------------------------------------------------------
+
+    fastify.get('/orders', can('read'), async () => allOrders());
+
+    fastify.get('/orders/:id', can('read'), async (request, reply) => {
+        const o = await getOrder(request.params.id);
+        return o || fail(reply, 404, 'No such order.');
+    });
+
+    fastify.put('/orders/:id/status', can('manage'), async (request, reply) => {
+        const {status, note = '', restock = false, tracking} = request.body || {};
+        try {
+            const {order, from} = await moveOrder(request.params.id, String(status), {
+                by: request.user?.name || request.user?.email || 'admin', note, restock: Boolean(restock),
+                tracking: cleanTracking(tracking)
+            });
+            announceMove(order, from, order.data.status);
+            return order;
+        } catch (err) {
+            return fail(reply, err.status || 500, err.message);
+        }
+    });
+
+    fastify.put('/orders/:id/note', can('manage'), async (request, reply) => {
+        const b = request.body || {};
+        try {
+            return await annotateOrder(request.params.id, {
+                ...(b.staffNote !== undefined ? {staffNote: b.staffNote} : {}),
+                ...(b.tracking !== undefined ? {tracking: cleanTracking(b.tracking)} : {})
+            });
+        } catch (err) {
+            return fail(reply, err.status || 500, err.message);
+        }
+    });
+
+    /**
+     * Refund an order in full. With Stripe or PayPal the money goes back
+     * through them first; only when they say yes is the order marked refunded.
+     * An offline order is marked only - the money goes back the way it came.
+     */
+    fastify.post('/orders/:id/refund', can('manage'), async (request, reply) => {
+        const o = await getOrder(request.params.id);
+        if (!o) return fail(reply, 404, 'No such order.');
+        const d = o.data;
+        if (!['paid', 'fulfilled'].includes(d.status)) return fail(reply, 409, 'Only a paid order can be refunded.');
+        const s = await liveSettings();
+        const {restock = false, note = '', viaProvider = true} = request.body || {};
+        let how = 'marked refunded';
+        try {
+            if (viaProvider && d.provider === 'stripe' && d.paymentRef) {
+                if (!s.stripeSecretKey) return fail(reply, 409, 'Stripe is not set up any more - refund it in Stripe, then mark it refunded here.');
+                await pay.stripeRefund({secretKey: s.stripeSecretKey, paymentIntent: d.paymentRef});
+                how = 'refunded through Stripe';
+            } else if (viaProvider && d.provider === 'paypal' && d.paymentRef) {
+                if (!s.paypalClientId || !s.paypalSecret) return fail(reply, 409, 'PayPal is not set up any more - refund it in PayPal, then mark it refunded here.');
+                await pay.paypalRefund({creds: {clientId: s.paypalClientId, secret: s.paypalSecret, mode: s.paypalMode}, captureId: d.paymentRef});
+                how = 'refunded through PayPal';
+            }
+        } catch (err) {
+            return fail(reply, err.status || 502, `Not refunded: ${err.message}`);
+        }
+        try {
+            const {order, from} = await moveOrder(o.id, 'refunded', {by: request.user?.name || request.user?.email || 'admin',
+                note: [how, String(note || '')].filter(Boolean).join(' - '), restock: Boolean(restock)});
+            announceMove(order, from, 'refunded');
+            return {order, how};
+        } catch (err) {
+            return fail(reply, err.status || 500, err.message);
+        }
+    });
+
+    fastify.delete('/orders/:id', can('manage'), async (request, reply) => {
+        try {
+            await removeOrder(request.params.id);
+            return {ok: true};
+        } catch (err) {
+            return fail(reply, err.status || 500, err.message);
+        }
+    });
+
+    // ---- Admin: settings ---------------------------------------------------------------
+
+    fastify.get('/settings', can('read'), async (request) => {
+        const s = await liveSettings();
+        return {
+            settings: maskSettings(s),
+            webhookUrl: `${siteBase(request)}/api/plugins/shopping-cart/stripe/webhook`,
+            stripeMode: pay.stripeMode(s.stripeSecretKey)
+        };
+    });
+
+    fastify.put('/settings', can('manage'), async (request, reply) => {
+        const current = await liveSettings();
+        const {settings, errors} = cleanSettings(request.body || {}, current);
+        if (Object.keys(errors).length) return fail(reply, 400, Object.values(errors)[0], {errors});
+        await saveSettings(settings);
+        return {settings: maskSettings(await liveSettings())};
+    });
+
+    /** Try the stored keys (or the ones typed, before saving). */
+    fastify.post('/settings/test/:provider', can('manage'), async (request, reply) => {
+        const s = await liveSettings();
+        const b = request.body || {};
+        const typed = (k) => (b[k] && b[k] !== '••••••••' ? String(b[k]).trim() : s[k]);
+        try {
+            if (request.params.provider === 'stripe') {
+                const key = typed('stripeSecretKey');
+                if (!key) return fail(reply, 400, 'Enter the secret key first.');
+                return await pay.stripeTest({secretKey: key});
+            }
+            if (request.params.provider === 'paypal') {
+                const creds = {clientId: typed('paypalClientId'), secret: typed('paypalSecret'), mode: b.paypalMode || s.paypalMode};
+                if (!creds.clientId || !creds.secret) return fail(reply, 400, 'Enter the client id and secret first.');
+                return await pay.paypalTest({creds});
+            }
+            return fail(reply, 404, 'No such provider.');
+        } catch (err) {
+            return fail(reply, 400, err.message);
+        }
+    });
+
+    // ---- Shoppers --------------------------------------------------------------------
+
+    fastify.get('/catalogue', async (request) => {
+        const s = await liveSettings();
+        const products = (await allProducts()).filter(e => e.data?.status === 'active').sort(byShelf).map(publicProduct);
+        return {currency: s.currency, shopPath: s.shopPath, products};
+    });
+
+    fastify.post('/quote', async (request) => {
+        siteBase(request);
+        const s = await liveSettings();
+        const {quote} = await quoteFor(request.body, s);
+        return shopperQuote(quote, s);
+    });
+
+    fastify.post('/checkout', async (request, reply) => {
+        const s = await liveSettings();
+        const body = request.body || {};
+        const {quote, input} = await quoteFor(body, s);
+        if (!quote.lines.length) return fail(reply, 400, 'Your basket is empty.', {quote: shopperQuote(quote, s)});
+        // Anything that changed the basket (sold out, fewer left, a code refused)
+        // goes back to the shopper to see BEFORE they pay.
+        if (quote.problems.length && !body.accept) {
+            return fail(reply, 409, quote.problems.map(p => p.message).join(' '), {quote: shopperQuote(quote, s)});
+        }
+        if (Number.isInteger(body.expectTotal) && body.expectTotal !== quote.total) {
+            return fail(reply, 409, `The total is now ${formatMoney(quote.total, quote.currency)}. Please check it and pay again.`, {quote: shopperQuote(quote, s)});
+        }
+        const collecting = input.delivery === 'collect' && s.allowCollection;
+        const checkout = cleanCheckout(body, {needsAddress: quote.requiresShipping && !collecting, countries: s.countries});
+        if (Object.keys(checkout.errors).length) return fail(reply, 400, Object.values(checkout.errors)[0], {errors: checkout.errors});
+
+        const methods = methodsOf(s).map(m => m.id);
+        const provider = quote.total === 0 ? 'free' : String(body.provider || '');
+        if (provider !== 'free' && !methods.includes(provider)) return fail(reply, 400, 'Choose how to pay.');
+
+        const order = await createOrder({quote, checkout, provider, delivery: collecting ? 'collect' : (quote.requiresShipping ? 'ship' : 'none'), code: input.code});
+        registry.emit('checkout', order);
+        const base = siteBase(request);
+        const receipt = `${base}${receiptPath(s, order)}`;
+
+        try {
+            if (provider === 'free') {
+                await markPaid(order.id, {by: 'free', note: 'Nothing to pay'}).then(r => r.changed && announcePaid(r.order));
+                return {redirect: receipt, orderId: order.id};
+            }
+            if (provider === 'offline') {
+                const {order: moved} = await moveOrder(order.id, 'awaiting', {by: 'shopper', note: s.offlineLabel});
+                registry.emit('status', moved, 'pending', 'awaiting');
+                try {
+                    hooks.notify?.({title: `Order ${orderLabel(moved.data)} awaiting payment - ${formatMoney(moved.data.total, moved.data.currency)}`,
+                        body: `${moved.data.customer?.name}: ${s.offlineLabel}`, severity: 'info', source: 'orders',
+                        link: `#/plugins/shopping-cart/orders/${order.id}`, dedupeKey: `order-awaiting:${order.id}`});
+                } catch { /* never mind */ }
+                return {redirect: receipt, orderId: order.id};
+            }
+            if (provider === 'stripe') {
+                const session = await pay.stripeCreateSession({
+                    secretKey: s.stripeSecretKey,
+                    order: {id: order.id, ...order.data},
+                    successUrl: `${receipt}&session_id={CHECKOUT_SESSION_ID}`,
+                    cancelUrl: `${base}${s.shopPath}/cart?cancelled=${order.id}`,
+                    shopName: s.shopTitle
+                });
+                await setProviderRef(order.id, session.id);
+                return {redirect: session.url, orderId: order.id};
+            }
+            if (provider === 'paypal') {
+                const pp = await pay.paypalCreateOrder({
+                    creds: {clientId: s.paypalClientId, secret: s.paypalSecret, mode: s.paypalMode},
+                    order: {id: order.id, ...order.data},
+                    returnUrl: `${base}/api/plugins/shopping-cart/paypal/return?order=${order.id}&t=${order.data.token}`,
+                    cancelUrl: `${base}${s.shopPath}/cart?cancelled=${order.id}`,
+                    shopName: s.shopTitle
+                });
+                await setProviderRef(order.id, pp.id);
+                return {redirect: pp.url, orderId: order.id};
+            }
+        } catch (err) {
+            request.log.warn(`[shopping-cart] checkout ${order.data.number}: ${err.message}`);
+            return fail(reply, 502, `The payment page could not be opened: ${err.message.replace(/^(Stripe|PayPal): /, '')}. Nothing has been charged.`);
+        }
+        return fail(reply, 400, 'Choose how to pay.');
+    });
+
+    /**
+     * An order's receipt, for the page and for its polling. A pending Stripe
+     * order is checked with Stripe on the way: the shopper's return is the
+     * usual way we learn it was paid.
+     */
+    fastify.get('/order/:id', async (request, reply) => {
+        let o = await getOrder(request.params.id);
+        if (!o || !tokenOk(o, request.query?.t)) return fail(reply, 404, 'No such order.');
+        o = await confirmStripe(o, request.query?.session_id, request.log);
+        return publicOrder(o);
+    });
+
+    /** Ask Stripe about a pending order's session; mark it paid when Stripe says so. */
+    async function confirmStripe(o, sessionId, log) {
+        if (o.data.status !== 'pending' || o.data.provider !== 'stripe') return o;
+        const s = await liveSettings();
+        const id = sessionId && sessionId === o.data.providerRef ? sessionId : o.data.providerRef;
+        if (!id || !s.stripeSecretKey) return o;
+        try {
+            const session = await pay.stripeGetSession({secretKey: s.stripeSecretKey, sessionId: id});
+            const paid = pay.stripeSessionPaid(session, {id: o.id, ...o.data});
+            if (!paid) return o;
+            const r = await markPaid(o.id, {provider: 'stripe', ...paid, by: 'stripe'});
+            if (r.changed) announcePaid(r.order);
+            return r.order;
+        } catch (err) {
+            log?.warn?.(`[shopping-cart] Stripe check for ${o.data.number}: ${err.message}`);
+            return o;
+        }
+    }
+    registry.services.confirmStripe = confirmStripe;
+
+    fastify.get('/paypal/return', async (request, reply) => {
+        const {order: id, t, token} = request.query || {};
+        const o = await getOrder(String(id || ''));
+        const s = await liveSettings();
+        if (!o || !tokenOk(o, t)) return reply.redirect(`${s.shopPath}/cart`);
+        const receipt = receiptPath(s, o);
+        if (o.data.status !== 'pending' || o.data.provider !== 'paypal') return reply.redirect(receipt);
+        if (token !== o.data.providerRef) return reply.redirect(`${receipt}&problem=paypal`);
+        try {
+            const pp = await pay.paypalCapture({creds: {clientId: s.paypalClientId, secret: s.paypalSecret, mode: s.paypalMode}, paypalOrderId: token});
+            const paid = pay.paypalPaid(pp, {id: o.id, ...o.data});
+            if (!paid) return reply.redirect(`${receipt}&problem=paypal`);
+            const r = await markPaid(o.id, {provider: 'paypal', ...paid, by: 'paypal'});
+            if (r.changed) announcePaid(r.order);
+            return reply.redirect(receipt);
+        } catch (err) {
+            request.log.warn(`[shopping-cart] PayPal capture for ${o.data.number}: ${err.message}`);
+            return reply.redirect(`${receipt}&problem=paypal`);
+        }
+    });
+
+    // Stripe signs the RAW body, so this one route keeps it raw.
+    fastify.register(async function stripeWebhook(scope) {
+        scope.addContentTypeParser('application/json', {parseAs: 'buffer', bodyLimit: 1048576}, (_req, body, done) => done(null, body));
+        scope.post('/stripe/webhook', async (request, reply) => {
+            const s = await liveSettings();
+            if (!s.stripeWebhookSecret) return fail(reply, 503, 'Webhook signing secret not set.');
+            if (!pay.stripeVerify(request.body, request.headers['stripe-signature'], s.stripeWebhookSecret)) {
+                return fail(reply, 400, 'Bad signature.');
+            }
+            let event;
+            try { event = JSON.parse(request.body.toString('utf8')); } catch { return fail(reply, 400, 'Not JSON.'); }
+            if (!['checkout.session.completed', 'checkout.session.async_payment_succeeded'].includes(event?.type)) return {received: true};
+            const session = event.data?.object || {};
+            const id = session.client_reference_id || session.metadata?.orderId;
+            const o = id ? await getOrder(String(id)) : null;
+            if (!o) return {received: true};
+            const paid = pay.stripeSessionPaid(session, {id: o.id, ...o.data});
+            if (paid) {
+                const r = await markPaid(o.id, {provider: 'stripe', ...paid, by: 'stripe'});
+                if (r.changed) announcePaid(r.order);
+            }
+            return {received: true};
+        });
+    });
+}
+
+export async function onEnable() {
+    await ensureCollections();
+}
+
+export async function onDisable() {
+    console.log('[shopping-cart] Disabled. Products and orders are kept.');
+}

package/plugins/shopping-cart/plugin.json

@@ -0,0 +1,52 @@
+{
+  "name": "shopping-cart",
+  "displayName": "Shopping Cart",
+  "version": "1.0.0",
+  "tier": "free",
+  "description": "Sell from your site: products with options, stock and pictures, a storefront and a cart that follows shoppers from page to page, and checkout with Stripe, PayPal or payment offline. Orders to fulfil in the sidebar, refunds from the order.",
+  "author": "Domma CMS",
+  "date": "2026-09-26",
+  "icon": "shopping-bag",
+  "permissions": [
+    {
+      "key": "shop",
+      "label": "Shop",
+      "group": "Plugins",
+      "icon": "shopping-bag",
+      "description": "See the Shop's orders and products (read) or run it: products, orders, refunds and settings (manage).",
+      "actions": [
+        {"key": "read", "label": "See", "description": "Open the Shop and read its orders and products"},
+        {"key": "manage", "label": "Manage", "description": "Edit products, move and refund orders, change the Shop's settings"}
+      ],
+      "grant": ["admin"]
+    }
+  ],
+  "inject": {
+    "bodyEnd": "inject/body.html"
+  },
+  "admin": {
+    "css": ["admin/css/index.css"],
+    "sidebar": [
+      {
+        "id": "shopping-cart",
+        "text": "Shop",
+        "icon": "shopping-bag",
+        "url": "#/plugins/shopping-cart",
+        "section": "#/plugins/shopping-cart",
+        "permission": "shop",
+        "countUrl": "/api/plugins/shopping-cart/count"
+      }
+    ],
+    "routes": [
+      {"path": "/plugins/shopping-cart", "view": "plugin-shopping-cart", "title": "Shop - Domma CMS"},
+      {"path": "/plugins/shopping-cart/:tab", "view": "plugin-shopping-cart", "title": "Shop - Domma CMS"},
+      {"path": "/plugins/shopping-cart/:tab/:id", "view": "plugin-shopping-cart", "title": "Shop - Domma CMS"}
+    ],
+    "views": {
+      "plugin-shopping-cart": {
+        "entry": "shopping-cart/admin/views/shop.js?v=1.0.0",
+        "exportName": "shopView"
+      }
+    }
+  }
+}