domma-cms 1.6.33 → 1.6.35

package/plugins/shopping-cart/public/cart.js

@@ -486,6 +486,20 @@ function checkout() {
     };
     form.addEventListener('input', keep);
 
+    // A signed-in customer: their details, and their first saved address, where nothing is typed yet.
+    import('./lib/session.js').then(async ({me}) => {
+        const mine = await me().catch(() => null);
+        if (!mine) return;
+        document.querySelector('[data-acc-link]')?.remove();
+        const a = mine.addresses[0] || {};
+        const fill = {name: mine.name, email: mine.email, phone: mine.phone, line1: a.line1, line2: a.line2, city: a.city, region: a.region, postcode: a.postcode, country: a.country};
+        for (const [k, v] of Object.entries(fill)) {
+            const el = form.elements[k];
+            if (el && v && !el.value) el.value = v;
+        }
+        keep();
+    }).catch(() => {});
+
     // A reminder email links here with the order: fill the basket from it (another device, a cleared browser).
     const params = new URLSearchParams(location.search);
     if (params.get('restore') && params.get('t')) {
@@ -713,3 +727,5 @@ if (page === 'product') productPage();
 if (page === 'index') storefront();
 if (page === 'cart') checkout();
 if (page === 'order') receipt();
+// Customer accounts: their own pages, and a receipt's "save your details" box.
+if (page === 'account' || document.querySelector('[data-shop-join]')) import('./account.js').catch(() => {});

package/plugins/shopping-cart/public/lib/session.js

@@ -0,0 +1,82 @@
+/**
+ * A customer's sign-in, in the browser - shared by the Shop's pages and any extension's (Takeaway).
+ *
+ * Signing in is core's own `/api/auth/login`; the tokens it gives are kept in this browser (localStorage, one
+ * key for the whole site) and sent as a Bearer header to the Cart's account routes. A 401 refreshes once through
+ * `/api/auth/refresh`; a refresh that fails signs the customer out here.
+ *
+ * @module shopping-cart/public/lib/session
+ */
+
+const KEY = 'dm-shop:account';
+const ACCOUNT_API = '/api/plugins/shopping-cart/account';
+
+const read = () => { try { return JSON.parse(localStorage.getItem(KEY) || 'null'); } catch { return null; } };
+const write = (v) => { try { if (v) localStorage.setItem(KEY, JSON.stringify(v)); else localStorage.removeItem(KEY); } catch { /* private mode */ } };
+
+/** {name, email} when this browser holds a sign-in, else null. */
+export function signedIn() {
+    const s = read();
+    return s?.token ? {name: s.name || '', email: s.email || ''} : null;
+}
+
+async function json(res) {
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw Object.assign(new Error(body.error || body.message || `The server answered ${res.status}`), {status: res.status, body});
+    return body;
+}
+
+/**
+ * Sign in with core's login. A staff account with a sign-in check (a code) is sent to /admin.
+ * @returns {Promise<{name: string, email: string}>}
+ */
+export async function signIn(email, password) {
+    const body = await json(await fetch('/api/auth/login', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({email, password})}));
+    if (!body.token) throw new Error('This account signs in at /admin.');
+    write({token: body.token, refreshToken: body.refreshToken, name: body.user?.name || '', email: body.user?.email || email});
+    return signedIn();
+}
+
+export async function signOut() {
+    const s = read();
+    write(null);
+    if (s?.refreshToken) await fetch('/api/auth/logout', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({refreshToken: s.refreshToken})}).catch(() => {});
+}
+
+async function refresh() {
+    const s = read();
+    if (!s?.refreshToken) return false;
+    try {
+        const r = await fetch('/api/auth/refresh', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({refreshToken: s.refreshToken})});
+        if (!r.ok) { write(null); return false; }
+        const {token} = await r.json();
+        write({...s, token});
+        return true;
+    } catch { return false; }
+}
+
+/** A request as the signed-in customer; one refresh on a 401. */
+export async function authed(url, {method = 'GET', body} = {}) {
+    const go = () => fetch(url, {method, headers: {...(body ? {'Content-Type': 'application/json'} : {}), Authorization: `Bearer ${read()?.token || ''}`},
+        body: body ? JSON.stringify(body) : undefined});
+    let res = await go();
+    if (res.status === 401 && await refresh()) res = await go();
+    if (res.status === 401) write(null);
+    return json(res);
+}
+
+/** The signed-in customer's account (details, addresses, orders), or null when nobody is signed in here. */
+export async function me() {
+    if (!read()?.token) return null;
+    try { return await authed(ACCOUNT_API); } catch (err) { if (err.status === 401) return null; throw err; }
+}
+
+export const account = {
+    register: (d) => fetch(`${ACCOUNT_API}/register`, {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify(d)}).then(json),
+    confirm: (u, t) => fetch(`${ACCOUNT_API}/confirm`, {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({u, t})}).then(json),
+    forgot: (email) => fetch(`${ACCOUNT_API}/forgot`, {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({email})}).then(json),
+    /** Core's own reset, with the token from the emailed link. */
+    reset: (token, password) => fetch('/api/auth/reset-password', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({token, password})}).then(json),
+    save: (d) => authed(ACCOUNT_API, {method: 'PUT', body: d}),
+    remove: (password) => authed(ACCOUNT_API, {method: 'DELETE', body: {password}})
+};

package/plugins/shopping-cart/public/shop.css

@@ -425,3 +425,30 @@ html.shop-locked { overflow: hidden; }
     .shop-line-controls { flex-wrap: wrap; }
 }
 .shop-co-title { font-size: clamp(1.8rem, 3vw, 2.4rem); letter-spacing: -.02em; margin: 0 0 1.25rem; }
+/* Customer accounts */
+.shop-account { max-width: 44rem; margin: 2rem auto; }
+.shop-account h1 { margin: 0 0 1rem; }
+.shop-acc { display: flex; flex-direction: column; gap: 1rem; }
+.shop-acc-form { display: flex; flex-direction: column; gap: .75rem; max-width: 26rem; }
+.shop-acc-note { padding: .75rem 1rem; border-radius: var(--shop-radius-sm); background: var(--shop-softer); border: 1px solid var(--shop-line); margin: 0; }
+.shop-acc-note.is-good, .shop-co-error.is-good { color: var(--shop-good); }
+.shop-seg { display: inline-flex; gap: .25rem; padding: .25rem; border-radius: 999px; background: var(--shop-soft); align-self: flex-start; }
+.shop-seg button { border: 0; background: none; color: var(--shop-text); font: inherit; font-weight: 600; padding: .45rem 1rem; border-radius: 999px; cursor: pointer; }
+.shop-seg button.is-on { background: var(--shop-bg); box-shadow: 0 1px 3px rgba(0, 0, 0, .15); }
+.shop-acc-card { border: 1px solid var(--shop-line); border-radius: var(--shop-radius); padding: 1rem 1.2rem; }
+.shop-acc-card h2 { font-size: 1.1rem; margin: 0 0 .75rem; }
+.shop-acc-card form { display: flex; flex-direction: column; gap: .6rem; max-width: 26rem; }
+.shop-acc-orders, .shop-acc-addrs { list-style: none; padding: 0; margin: 0 0 .5rem; display: flex; flex-direction: column; gap: .6rem; }
+.shop-acc-orders li { border-bottom: 1px solid var(--shop-line); padding-bottom: .6rem; }
+.shop-acc-order { display: grid; grid-template-columns: auto 1fr auto auto; gap: .75rem; color: var(--shop-text); text-decoration: none !important; }
+.shop-acc-orders small { color: var(--shop-muted); }
+.shop-acc-ext { margin-top: .35rem; }
+.shop-acc-addrs li { display: flex; justify-content: space-between; gap: 1rem; flex-wrap: wrap; }
+.shop-acc-addr { margin-top: .75rem; }
+.shop-acc-danger summary { cursor: pointer; color: var(--shop-muted); }
+.shop-linkbtn.is-danger { color: var(--shop-sale); }
+.shop-acc-link { font-size: .92rem; }
+.shop-crumbs .shop-acc-link { float: right; }
+.shop-r-join { margin-top: 1.25rem; padding-top: 1rem; border-top: 1px solid var(--shop-line); }
+.shop-r-join h2 { font-size: 1rem; }
+.shop-r-join form { display: flex; flex-direction: column; gap: .6rem; }

package/plugins/shopping-cart/roles/shop-customer.json

@@ -0,0 +1,8 @@
+{
+  "name": "shop-customer",
+  "label": "Shop Customer",
+  "level": 5,
+  "permissions": [],
+  "badgeClass": "badge-secondary",
+  "admin": {"home": "/my-profile", "allow": []}
+}

package/plugins/shopping-cart/tests/accounts.test.js

@@ -0,0 +1,127 @@
+/**
+ * Customer accounts against the real user and collection services in the domma-cms checkout `make test` runs in.
+ * The test's authenticate reads `x-user` (a real user id) the way core's reads a token; mail is caught with
+ * setAccountMailer. Every user it makes, and its collections, are removed; config/plugins.json is restored.
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import shoppingCart from '../plugin.js';
+import {setAccountMailer, cleanAddress, ordersFor} from '../lib/accounts.js';
+import {deleteUser, getUserByEmail, getUserById} from '../../../server/services/users.js';
+import {checkResetToken} from '../../../server/services/passwordReset.js';
+
+const PLUGINS = path.resolve('config/plugins.json');
+const DIRS = ['shop-products', 'shop-orders'].map(c => path.resolve('content/collections', c));
+const EMAILS = ['acc-ann@example.test', 'acc-bo@example.test'];
+let saved;
+let app;
+const mail = [];
+
+async function cleanUsers() {
+    for (const e of EMAILS) { const u = await getUserByEmail(e); if (u) await deleteUser(u.id); }
+}
+
+before(async () => {
+    saved = await fs.readFile(PLUGINS, 'utf8').catch(() => null);
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    await cleanUsers();
+    setAccountMailer((m) => { mail.push(m); });
+    delete globalThis[Symbol.for('domma.shopping-cart')];
+    app = Fastify();
+    // x-user: that real user; x-anon: nobody (401); neither: the shop's admin, for the admin routes.
+    const authenticate = async (req, reply) => {
+        if (req.headers['x-anon']) return reply.code(401).send({error: 'Unauthorised'});
+        if (!req.headers['x-user']) { req.user = {id: 'admin', name: 'Sam', role: 'admin'}; return undefined; }
+        const u = await getUserById(String(req.headers['x-user']));
+        if (!u) return reply.code(401).send({error: 'Unauthorised'});
+        req.user = {id: u.id, name: u.name, email: u.email, role: u.role};
+        return undefined;
+    };
+    await app.register(shoppingCart, {auth: {authenticate, requirePermission: () => async () => {}}, settings: {}, hooks: {registerShortcode() {}}});
+});
+
+after(async () => {
+    setAccountMailer(null);
+    await app?.close();
+    await cleanUsers();
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    if (saved === null) await fs.rm(PLUGINS, {force: true});
+    else await fs.writeFile(PLUGINS, saved);
+});
+
+const call = async (method, url, body, user = null) => {
+    const res = await app.inject({method, url, payload: body, headers: user === 'anon' ? {'x-anon': '1'} : user ? {'x-user': user} : {}});
+    let json = null;
+    try { json = res.json(); } catch { /* not JSON */ }
+    return {status: res.statusCode, body: json};
+};
+const linkIn = (m) => /https?:\/\/\S+/.exec(m.text)?.[0] || '';
+
+test('accounts: off by default; create, confirm by email, details, addresses, orders by email, reset, delete', async () => {
+    assert.equal((await call('POST', '/account/register', {name: 'Ann', email: EMAILS[0], password: 'a-long-password'})).status, 404, 'off until switched on');
+    const put = await call('PUT', '/settings', {accounts: true, offlineEnabled: true, countries: ['GB']});
+    assert.equal(put.status, 200, JSON.stringify(put.body));
+    assert.equal(put.body.settings?.accounts ?? put.body.accounts, true, JSON.stringify(put.body).slice(0, 300));
+
+    assert.equal((await call('POST', '/account/register', {name: 'Ann', email: EMAILS[0], password: 'short'})).status, 400);
+    assert.equal((await call('POST', '/account/register', {name: '', email: EMAILS[0], password: 'a-long-password'})).status, 400);
+    let r = await call('POST', '/account/register', {name: 'Ann Example', email: EMAILS[0], password: 'a-long-password'});
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    let user = await getUserByEmail(EMAILS[0]);
+    assert.deepEqual([user.isActive, user.role], [false, 'shop-customer'], 'inactive until confirmed');
+    const confirmLink = new URL(linkIn(mail.at(-1)));
+    assert.match(confirmLink.pathname, /\/shop\/account\/confirm$/);
+
+    // A second try with the same email says the same, and tells the holder - nothing new is made.
+    r = await call('POST', '/account/register', {name: 'Someone', email: EMAILS[0], password: 'another-password'});
+    assert.equal(r.status, 200);
+    assert.equal(mail.length, 1, 'still pending: no second email, no second account');
+
+    assert.equal((await call('POST', '/account/confirm', {u: user.id, t: '0'.repeat(48)})).status, 404);
+    r = await call('POST', '/account/confirm', {u: confirmLink.searchParams.get('u'), t: confirmLink.searchParams.get('t')});
+    assert.deepEqual(r.body, {confirmed: true, email: EMAILS[0]});
+    user = await getUserById(user.id);
+    assert.equal(user.isActive, true);
+    assert.ok(!user.meta.shop.pending);
+    r = await call('POST', '/account/register', {name: 'Ann', email: EMAILS[0], password: 'a-long-password'});
+    assert.match(mail.at(-1).subject, /already have an account/);
+
+    // Signed in: details, addresses (junk dropped), and the orders placed with this email - from before it existed too.
+    assert.equal((await call('GET', '/account', null, 'anon')).status, 401);
+    const product = (await call('POST', '/products', {name: 'Mug', price: 1000, status: 'active', shippable: false})).body;
+    const placed = await call('POST', '/checkout', {lines: [{productId: product.id, qty: 1}], provider: 'offline', customer: {name: 'Ann', email: EMAILS[0].toUpperCase()}});
+    assert.equal(placed.status, 200, JSON.stringify(placed.body));
+    await call('POST', '/checkout', {lines: [{productId: product.id, qty: 1}], provider: 'offline', customer: {name: 'Bo', email: EMAILS[1]}});
+    r = await call('GET', '/account', null, user.id);
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.deepEqual([r.body.name, r.body.email, r.body.orders.length], ['Ann Example', EMAILS[0], 1], 'only her own orders');
+    assert.match(r.body.orders[0].receipt, /^\/shop\/order\/.+\?t=/);
+    r = await call('PUT', '/account', {phone: '07700 900000', addresses: [{label: 'Home', line1: '1 High St', city: 'York', postcode: 'yo1 7hh'}, {line1: '', city: 'x'}]}, user.id);
+    assert.deepEqual([r.body.phone, r.body.addresses.length, r.body.addresses[0].postcode], ['07700 900000', 1, 'YO1 7HH']);
+
+    // Forgotten password: core's reset token, the link to the shop's page; nobody else is told anything.
+    const sent = mail.length;
+    assert.deepEqual((await call('POST', '/account/forgot', {email: 'nobody@example.test'})).body, {ok: true});
+    assert.equal(mail.length, sent, 'no account, no email - and the same answer');
+    await call('POST', '/account/forgot', {email: EMAILS[0]});
+    const reset = new URL(linkIn(mail.at(-1)));
+    assert.match(reset.pathname, /\/shop\/account\/reset$/);
+    assert.equal((await checkResetToken(reset.searchParams.get('t')))?.id, user.id, 'core accepts the token');
+
+    // Delete: only with the password; the orders stay.
+    assert.equal((await call('DELETE', '/account', {password: 'wrong'}, user.id)).status, 403);
+    assert.equal((await call('DELETE', '/account', {password: 'a-long-password'}, user.id)).status, 200);
+    assert.equal(await getUserByEmail(EMAILS[0]), null);
+    assert.equal((await call('GET', '/orders')).body.filter(o => o.data.email === EMAILS[0]).length, 1);
+});
+
+test('accounts: pure helpers', () => {
+    assert.equal(cleanAddress({line1: '1 High St'}), null, 'a town too');
+    assert.equal(cleanAddress({line1: '1 High St', city: 'York', country: 'ZZ'}).country, 'GB');
+    const o = (email, status = 'paid', at = '2026-10-01') => ({data: {email, status}, meta: {createdAt: at}});
+    assert.deepEqual(ordersFor([o('a@x.test'), o('A@X.test', 'paid', '2026-10-05'), o('a@x.test', 'pending'), o('b@x.test')], 'a@x.test').map(x => x.meta.createdAt),
+        ['2026-10-05', '2026-10-01'], 'theirs, newest first, no unfinished checkouts');
+});

package/plugins/shopping-cart/tests/api.test.js

@@ -239,3 +239,66 @@ test('an extension keeps its own part of a product, and moves its orders on', as
         reg.unregister('test-dl');
     }
 });
+
+test('an extension checks out lines it priced, with a delivery fee and address; refunds through the Cart', async () => {
+    const {cartRegistry} = await import('../lib/extensions.js');
+    const reg = cartRegistry();
+    const paid = [];
+    reg.register('test-takeaway', {on: {paid: (o) => paid.push(o)}});
+    try {
+        await call('PUT', '/settings', {offlineEnabled: true, countries: ['GB'], taxRate: 0, shippingFlat: 395});
+        const dishes = [{name: 'Vindaloo', optionName: 'Protein', variantName: 'Chicken', unitPrice: 950, qty: 2, detail: ['+ Extra chilli £0.50'], ref: 'dish:vin'},
+            {name: 'Pilau rice', unitPrice: 300, qty: 1, ref: 'dish:rice'}];
+        const charges = [{label: 'Delivery (YO10)', amount: 250}];
+        const q = await reg.services.quote({custom: dishes, charges});
+        assert.equal(q.total, 1900 + 300 + 250);
+        assert.equal(q.requiresShipping, false);
+
+        // Delivering needs an address; collecting does not.
+        await assert.rejects(reg.services.startCheckout({custom: dishes, charges, delivery: 'deliver', customer: {name: 'Ann', email: 'ann@x.test'}, provider: 'offline'}), /address/i);
+        const out = await reg.services.startCheckout({custom: dishes, charges, delivery: 'deliver', note: 'Ring the bell',
+            address: {line1: '1 High St', city: 'York', postcode: 'yo10 5dd', country: 'GB'},
+            customer: {name: 'Ann', email: 'ann@x.test', phone: '07700 900000'}, provider: 'offline', ref: 'takeaway:t1', base: 'https://site.test'});
+        assert.equal(out.total, 2450);
+        let order = await reg.services.checkOrder(out.orderId);
+        assert.equal(order.data.delivery, 'ship');
+        assert.equal(order.data.address.postcode, 'YO10 5DD');
+        assert.equal(order.data.note, 'Ring the bell');
+        assert.equal(order.data.customer.phone, '07700 900000');
+        const vin = order.data.lines.find(l => l.ref === 'dish:vin');
+        assert.deepEqual([vin.custom, vin.variantName, vin.detail], [true, 'Chicken', ['+ Extra chilli £0.50']]);
+        assert.deepEqual((await call('GET', `/order/${order.id}?t=${order.data.token}`)).body.lines[0].detail, ['+ Extra chilli £0.50']);
+
+        // Paid: no stock to take, the extension hears; then refunded through the Cart.
+        const r = await call('PUT', `/orders/${order.id}/status`, {status: 'paid'});
+        assert.equal(r.status, 200, JSON.stringify(r.body));
+        await new Promise(res => setTimeout(res, 20));
+        assert.equal(paid.at(-1)?.data?.ref, 'takeaway:t1');
+        const refunded = await reg.services.refund(order.id, {note: 'Kitchen closed early'});
+        assert.equal(refunded.order.data.status, 'refunded');
+        assert.match(refunded.order.data.history.at(-1).note, /Kitchen closed early/);
+        await assert.rejects(reg.services.refund(order.id), /Only a paid order/);
+
+        // Collecting: no address asked, no delivery.
+        const c = await reg.services.startCheckout({custom: dishes, delivery: 'collect', customer: {name: 'Bo', email: 'bo@x.test'}, provider: 'offline'});
+        order = await reg.services.checkOrder(c.orderId);
+        assert.equal(order.data.delivery, 'collect');
+        assert.equal(order.data.total, 2200);
+        // The storefront's own checkout never takes priced lines.
+        const s = await call('POST', '/checkout', {custom: dishes, provider: 'offline', customer: {name: 'Cy', email: 'cy@x.test'}});
+        assert.equal(s.status, 400);
+    } finally {
+        reg.unregister('test-takeaway');
+    }
+});
+
+test('sales: the report and its CSV over the API', async () => {
+    const r = await call('GET', '/sales?range=year&by=month');
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.ok(r.body.totals && Array.isArray(r.body.periods) && r.body.periods.length >= 1);
+    assert.ok(r.body.totals.orders >= 1, 'the earlier tests sold things');
+    const csv = await app.inject({method: 'GET', url: '/sales.csv?from=2020-01-01&to=2030-12-31'});
+    assert.equal(csv.statusCode, 200);
+    assert.match(csv.headers['content-disposition'], /attachment; filename="sales-2020-01-01-to-2030-12-31\.csv"/);
+    assert.ok(csv.body.startsWith('Order,Paid,Status'));
+});

package/plugins/shopping-cart/tests/commission.test.js

@@ -0,0 +1,90 @@
+/**
+ * Platform commission: the pure rules, then a real sale with config/commission.json written as the manager would
+ * (in the domma-cms checkout `make test` runs in - removed again after).
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import shoppingCart from '../plugin.js';
+import {cleanRates, commissionFor, orderType, rateFor, rateText} from '../lib/commission.js';
+
+const FILE = path.resolve('config/commission.json');
+const PLUGINS = path.resolve('config/plugins.json');
+const DIRS = ['shop-products', 'shop-orders'].map(c => path.resolve('content/collections', c));
+let savedFile;
+let savedPlugins;
+let app;
+
+before(async () => {
+    savedFile = await fs.readFile(FILE, 'utf8').catch(() => null);
+    savedPlugins = await fs.readFile(PLUGINS, 'utf8').catch(() => null);
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    delete globalThis[Symbol.for('domma.shopping-cart')];
+    app = Fastify();
+    await app.register(shoppingCart, {auth: {authenticate: async (req) => { req.user = {id: 'a', role: 'admin'}; }, requirePermission: () => async () => {}}, settings: {}, hooks: {registerShortcode() {}}});
+});
+
+after(async () => {
+    await app?.close();
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    if (savedFile === null) await fs.rm(FILE, {force: true}); else await fs.writeFile(FILE, savedFile);
+    if (savedPlugins === null) await fs.rm(PLUGINS, {force: true}); else await fs.writeFile(PLUGINS, savedPlugins);
+});
+
+const call = async (method, url, body) => {
+    const res = await app.inject({method, url, payload: body});
+    let json = null;
+    try { json = res.json(); } catch { /* not JSON */ }
+    return {status: res.statusCode, body: json, text: res.body};
+};
+
+test('commission: rates cleaned, the kind of sale, per-sale amounts', () => {
+    const {rates} = cleanRates({rates: {default: {percent: 2, fixed: 20}, takeaway: {percent: '3.5'}, shop: {percent: -1}, junk: {percent: 9}}});
+    assert.deepEqual(rates, {default: {percent: 2, fixed: 20}, takeaway: {percent: 3.5, fixed: 0}});
+    assert.equal(orderType({data: {ref: 'takeaway:x'}}), 'takeaway');
+    assert.equal(orderType({data: {ref: 'purchase-1'}}), 'addons');
+    assert.equal(orderType({data: {}}), 'shop');
+    assert.deepEqual(rateFor('shop', rates), {percent: 2, fixed: 20}, 'no rate of its own: the default');
+    assert.deepEqual(commissionFor({data: {total: 2150}}, rates, 'T'), {type: 'shop', base: 2150, percent: 2, fixed: 20, amount: 43 + 20, at: 'T'});
+    assert.equal(commissionFor({data: {total: 2150, ref: 'takeaway:x'}}, rates).amount, 75, '3.5% of £21.50, rounded');
+    assert.equal(commissionFor({data: {total: 0}}, rates), null, 'a free order carries none');
+    assert.equal(commissionFor({data: {total: 10}}, rates).amount, 10, 'never more than the sale');
+    assert.equal(commissionFor({data: {total: 1000}}, {}), null, 'no rates: none');
+    assert.equal(rateText({percent: 2, fixed: 20}), '2% + £0.20 per sale');
+});
+
+test('commission: stored on the sale when paid, at that day\'s rate; returned with a refund; in Sales and the CSV', async () => {
+    await call('PUT', '/settings', {offlineEnabled: true, countries: ['GB']});
+    const mug = (await call('POST', '/products', {name: 'Mug', price: 1000, status: 'active', shippable: false})).body;
+    const buy = async () => (await call('POST', '/checkout', {lines: [{productId: mug.id, qty: 2}], provider: 'offline', customer: {name: 'Ann', email: 'ann@example.test'}})).body.orderId;
+
+    // No file yet: a sale carries no commission.
+    let id = await buy();
+    let o = (await call('PUT', `/orders/${id}/status`, {status: 'paid'})).body;
+    assert.equal(o.data.commission, undefined);
+
+    // The manager writes the rate; the next sale has it (no restart).
+    await fs.writeFile(FILE, JSON.stringify({rates: {default: {percent: 5, fixed: 10}}, updatedAt: '2026-10-12T00:00:00Z', by: 'super'}));
+    id = await buy();
+    o = (await call('PUT', `/orders/${id}/status`, {status: 'paid'})).body;
+    assert.deepEqual([o.data.commission.amount, o.data.commission.percent, o.data.commission.type], [110, 5, 'shop']);
+    // A later rate leaves it as it was.
+    await new Promise(r => setTimeout(r, 15));
+    await fs.writeFile(FILE, JSON.stringify({rates: {default: {percent: 50}}}));
+    o = (await call('PUT', `/orders/${id}/status`, {status: 'fulfilled'})).body;
+    assert.equal(o.data.commission.amount, 110);
+    const s = (await call('GET', '/settings')).body.commission;
+    assert.deepEqual([s.set, s.rates[0].text], [true, '50% per sale']);
+    // Refunded: returned.
+    o = (await call('POST', `/orders/${id}/refund`, {})).body.order;
+    assert.deepEqual([o.data.commission.reversed, o.data.commission.amount], [true, 110]);
+    const r = (await call('GET', '/sales?range=year')).body;
+    assert.deepEqual([r.totals.commission, r.totals.commissionBack, r.totals.commissionNet], [110, 110, 0]);
+    const csv = (await call('GET', '/sales.csv?range=year')).text;
+    assert.ok(csv.split('\r\n')[0].endsWith('Commission,Commission rate'));
+    // The customer never sees it.
+    const receipt = (await call('GET', `/order/${id}?t=${o.data.token}`)).body;
+    assert.ok(!('commission' in receipt));
+});

package/plugins/shopping-cart/tests/pure.test.js

@@ -4,7 +4,7 @@ import {createHmac} from 'node:crypto';
 import {formatMoney, fromMinor, includedTax, percentOf, toMinor} from '../public/lib/money.js';
 import {available, cleanProduct, priceRange, publicProduct, slugify, unitPrice} from '../public/lib/products.js';
 import {canMove, cleanCheckout} from '../public/lib/orders.js';
-import {cleanLines, priceBasket} from '../lib/pricing.js';
+import {cleanCharges, cleanCustomLines, cleanLines, priceBasket} from '../lib/pricing.js';
 import {paypalPaid, stripeForm, stripeLineItems, stripeSessionPaid, stripeVerify} from '../lib/payments.js';
 import {badge, summarise} from '../lib/summary.js';
 import {cartRegistry} from '../lib/extensions.js';
@@ -77,6 +77,35 @@ test('pricing: stock caps quantities, archived products drop out', async () => {
     assert.equal(q.problems.length, 2);
 });
 
+test('pricing: lines an extension priced, and its charges standing in for delivery', async () => {
+    const custom = cleanCustomLines([
+        {name: 'Vindaloo', optionName: 'Protein', variantName: 'Chicken', unitPrice: 950, qty: 2, taxClass: 'standard',
+            detail: ['+ Extra chilli £0.50', '  No onions  ', ''], category: 'Mains', ref: 'dish:vin'},
+        {name: 'Junk', unitPrice: -5, qty: 1}, {name: '', unitPrice: 100, qty: 1}, {name: 'Naan', unitPrice: 300, qty: 0}, {name: 'Rice', unitPrice: 1.5, qty: 1}
+    ]);
+    assert.equal(custom.length, 1, 'no name, a negative or fractional price, or no quantity: dropped');
+    assert.deepEqual(custom[0].detail, ['+ Extra chilli £0.50', 'No onions']);
+    assert.equal(cleanCharges(undefined), null, 'no charges: the shipping stage runs as usual');
+    assert.deepEqual(cleanCharges([{label: 'Delivery (YO10)', amount: 250}, {amount: 'x'}]), [{label: 'Delivery (YO10)', amount: 250}]);
+
+    const settings = {...S, shippingFlat: 395, taxRate: 20, pricesIncludeTax: true, taxShipping: true};
+    let q = await priceBasket({lines: cleanLines([{productId: 'p1', qty: 1}]), products: catalogue, settings, custom, charges: cleanCharges([{label: 'Delivery', amount: 250}])});
+    assert.equal(q.lines.length, 2);
+    const dish = q.lines.find(l => l.custom);
+    assert.equal(dish.lineTotal, 1900);
+    assert.equal(dish.productId, '');
+    assert.equal(dish.shippable, false);
+    assert.equal(q.requiresShipping, true, 'the product still needs posting');
+    assert.deepEqual(q.adjustments.filter(a => a.stage === 'shipping').map(a => a.amount), [250], 'the charge, not the flat rate');
+    assert.equal(q.total, 1000 + 1900 + 250);
+    assert.equal(q.adjustments.find(a => a.stage === 'tax').amount, Math.round((1000 + 1900 + 250) / 6), 'taxed as delivery is');
+    // Only the extension's lines: nothing to post, and no charges means no delivery at all.
+    q = await priceBasket({lines: [], products: catalogue, settings, custom});
+    assert.equal(q.requiresShipping, false);
+    assert.equal(q.adjustments.filter(a => a.stage === 'shipping').length, 0);
+    assert.equal(q.subtotal, 1900);
+});
+
 test('pricing: flat delivery, free over a threshold, collection, nothing to ship', async () => {
     const s = {...S, shippingFlat: 395, freeShippingOver: 2500, allowCollection: true};
     let q = await priceBasket({lines: [{productId: 'p1', variantId: '', qty: 1}], products: catalogue, settings: s});

package/plugins/shopping-cart/tests/sales.test.js

@@ -0,0 +1,73 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {dateIn, periodOf, periodsBetween, rangeFor, salesCsv, salesReport, sourceOf} from '../lib/sales.js';
+
+const order = (n, {status = 'paid', paidAt, refundedAt, ref = '', provider = 'stripe', lines, adjustments = [], delivery = 'none', ext} = {}) => {
+    const subtotal = lines.reduce((s, l) => s + l.lineTotal, 0);
+    const total = subtotal + adjustments.filter(a => !a.included).reduce((s, a) => s + a.amount, 0);
+    return {id: `o${n}`, meta: {createdAt: paidAt}, data: {number: 1000 + n, status, paidAt, refundedAt, ref, provider, lines, adjustments, subtotal, total, delivery, ext,
+        customer: {name: `Customer ${n}`}}};
+};
+
+const ORDERS = [
+    // A Shop order with delivery and a discount, paid late on 1 Oct UK time (still 1 Oct in London, 23:30 BST = 22:30Z).
+    order(1, {paidAt: '2026-10-01T22:30:00Z', lines: [{productId: 'mug', qty: 2, lineTotal: 2000}],
+        adjustments: [{stage: 'discount', amount: -200}, {stage: 'shipping', amount: 395}, {stage: 'tax', amount: 366, included: true}]}),
+    // Just after midnight UK time on 2 Oct (23:10Z on 1 Oct): a London date of 2 Oct.
+    order(2, {paidAt: '2026-10-01T23:10:00Z', provider: 'offline', lines: [{productId: 'ebook', qty: 1, lineTotal: 900}],
+        ext: {'shopping-cart-pro': {downloads: [{productId: 'ebook'}]}}}),
+    // Takeaway, delivered.
+    order(3, {paidAt: '2026-10-03T18:00:00Z', ref: 'takeaway:abc', delivery: 'ship', lines: [{productId: '', custom: true, qty: 1, lineTotal: 1900}],
+        adjustments: [{stage: 'shipping', amount: 250}]}),
+    // Paid 4 Oct, refunded 9 Oct.
+    order(4, {status: 'refunded', paidAt: '2026-10-04T12:00:00Z', refundedAt: '2026-10-09T09:00:00Z', lines: [{productId: 'mug', qty: 1, lineTotal: 1000}]}),
+    // Never paid: not a sale.
+    order(5, {status: 'pending', paidAt: '2026-10-05T12:00:00Z', lines: [{productId: 'mug', qty: 1, lineTotal: 1000}]}),
+    // Another add-on's sale (Cards Pro credits).
+    order(6, {paidAt: '2026-10-06T12:00:00Z', ref: 'purchase-9', provider: 'free', lines: [{productId: 'credits', qty: 1, lineTotal: 0}]})
+];
+
+test('sales: dates in the shop\'s zone, periods, ranges', () => {
+    assert.equal(dateIn('2026-10-01T23:10:00Z', 'Europe/London'), '2026-10-02');
+    assert.equal(dateIn('2026-10-01T23:10:00Z', 'UTC'), '2026-10-01');
+    assert.equal(periodOf('2026-10-08', 'week'), '2026-10-05', 'weeks start on Monday');
+    assert.equal(periodOf('2026-10-08', 'month'), '2026-10-01');
+    assert.deepEqual(periodsBetween('2026-09-28', '2026-10-12', 'week'), ['2026-09-28', '2026-10-05', '2026-10-12']);
+    assert.deepEqual(periodsBetween('2026-11-15', '2027-01-02', 'month'), ['2026-11-01', '2026-12-01', '2027-01-01']);
+    assert.deepEqual(rangeFor('lastmonth', '2026-10-12'), {from: '2026-09-01', to: '2026-09-30'});
+    assert.deepEqual(rangeFor('week', '2026-10-12'), {from: '2026-10-12', to: '2026-10-12'});
+    assert.deepEqual(rangeFor('last7', '2026-10-12'), {from: '2026-10-06', to: '2026-10-12'});
+});
+
+test('sales: sources, figures, refunds on their own day, payment methods', () => {
+    assert.deepEqual(ORDERS.slice(0, 3).map(o => sourceOf(o, o.data.lines[0])), ['shop', 'downloads', 'takeaway']);
+    assert.equal(sourceOf(ORDERS[5], ORDERS[5].data.lines[0]), 'addons');
+    const r = salesReport(ORDERS, {from: '2026-10-01', to: '2026-10-12', by: 'day'});
+    assert.equal(r.totals.orders, 5, 'the unpaid one is not a sale');
+    assert.equal(r.totals.takings, 2195 + 900 + 2150 + 1000 + 0);
+    assert.deepEqual([r.totals.discount, r.totals.delivery, r.totals.taxIncluded, r.totals.refunds, r.totals.refundCount], [200, 645, 366, 1000, 1]);
+    assert.equal(r.totals.net, r.totals.takings - 1000);
+    const src = Object.fromEntries(r.sources.map(s => [s.key, s.amount]));
+    assert.deepEqual(src, {shop: 3000, downloads: 900, takeaway: 1900, addons: 0});
+    assert.deepEqual(r.takeaway, {collect: 0, deliver: 1});
+    assert.equal(r.methods[0].key, 'stripe');
+    const day = (d) => r.periods.find(p => p.period === d);
+    assert.equal(day('2026-10-01').takings, 2195);
+    assert.equal(day('2026-10-02').takings, 900, 'paid after midnight in London');
+    assert.equal(day('2026-10-09').refunds, 1000);
+    assert.equal(r.periods.length, 12, 'empty days are there too');
+    // A range that holds only the refund: no sale, the refund still counts.
+    const later = salesReport(ORDERS, {from: '2026-10-08', to: '2026-10-10'});
+    assert.deepEqual([later.totals.orders, later.totals.refunds, later.totals.net], [0, 1000, -1000]);
+});
+
+test('sales: the CSV, one row per order, quoted where it must be', () => {
+    const csv = salesCsv([...ORDERS, order(7, {paidAt: '2026-10-07T12:00:00Z', lines: [{productId: 'x', qty: 1, lineTotal: 500}]})].map(o => (o.id === 'o7' ? {...o, data: {...o.data, customer: {name: 'Smith, "Jo"'}}} : o)),
+        {from: '2026-10-01', to: '2026-10-12'});
+    const rows = csv.trim().split('\r\n');
+    assert.equal(rows[0].split(',')[0], 'Order');
+    assert.equal(rows.length, 1 + 6);
+    assert.ok(rows.some(r => r.startsWith('#1001,2026-10-01,paid,,Shop,Card (Stripe),Customer 1,20.00,2.00,3.95,0.00,3.66,21.95')));
+    assert.ok(rows.some(r => r.includes('"Smith, ""Jo"""')));
+    assert.ok(rows.some(r => r.startsWith('#1004,2026-10-04,refunded,2026-10-09')));
+});