domma-cms 1.6.34 → 1.6.36

package/plugins/shopping-cart/lib/render.js

@@ -110,6 +110,7 @@ export function storefrontHtml({entries, settings, base, category = '', query =
     const intro = settings.shopIntro ? `<p class="shop-intro">${esc(settings.shopIntro)}</p>` : '';
     return `<header class="shop-hero">
   <h1>${esc(settings.shopTitle || 'Shop')}</h1>${intro}
+  ${settings.accounts ? `<a class="shop-linkbtn shop-acc-link" href="${esc(base)}/account">Your account</a>` : ''}
 </header>
 ${chips || search || sort ? `<div class="shop-toolbar">${chips}<div class="shop-tools">${search}${sort}</div></div>` : ''}
 ${entries.length
@@ -181,7 +182,7 @@ ${related.length ? `<section class="shop-related"><h2>You may also like</h2>${gr
 /** The basket and checkout, one page. The script fills it from the basket in the browser. */
 export function cartHtml({settings, base}) {
     const countries = (settings.countries || ['GB']).map(c => `<option value="${esc(c)}">${esc(COUNTRIES[c] || c)}</option>`).join('');
-    return `<nav class="shop-crumbs" aria-label="Breadcrumb"><a href="${esc(base)}">${ICON.back}Keep shopping</a></nav>
+    return `<nav class="shop-crumbs" aria-label="Breadcrumb"><a href="${esc(base)}">${ICON.back}Keep shopping</a>${settings.accounts ? ` <a class="shop-acc-link" href="${esc(base)}/account" data-acc-link>Sign in for faster checkout</a>` : ''}</nav>
 <h1 class="shop-co-title">Your basket</h1>
 <div class="shop-checkout" data-shop-checkout>
   <div class="shop-co-main">
@@ -233,6 +234,16 @@ export function cartHtml({settings, base}) {
 </div>`;
 }
 
+/** The account page's frame; public/account.js fills it (signed in or not is the browser's to know). */
+export function accountHtml({settings, view = 'account'}) {
+    const title = view === 'reset' ? 'Set a new password' : view === 'confirm' ? 'Confirming your account…' : 'Your account';
+    return `<div class="shop-account" data-shop-account="${esc(view)}">
+  <h1>${esc(title)}</h1>
+  <div data-acc-body><noscript>Your account needs JavaScript switched on.</noscript></div>
+  <p class="shop-muted"><a class="shop-linkbtn" href="${esc(settings.shopPath)}">Back to the shop</a></p>
+</div>`;
+}
+
 /**
  * A shopper's receipt. `parts` are extensions' sections ([{owner, html}],
  * their own HTML, escaped by them) - Shopping Cart Pro's downloads.
@@ -282,6 +293,7 @@ export function receiptHtml({order, settings, base, problem = '', parts = []}) {
       ${addr.length ? `<h2>${order.delivery === 'collect' ? 'Collection' : 'Delivering to'}</h2><address>${addr.map(esc).join('<br>')}</address>` : order.delivery === 'collect' ? `<h2>Collection</h2><p>${esc(settings.collectionLabel || 'Collect in person')}</p>` : ''}
       <h2>Placed</h2><p>${esc(fmtDateTime(order.placedAt))}</p>
       <p><a class="shop-linkbtn" href="${esc(base)}">Continue shopping</a> · <button type="button" class="shop-linkbtn" data-shop-print>Print</button></p>
+      ${settings.accounts && !waiting && !closed ? `<div class="shop-r-join" data-shop-join data-email="${esc(order.email || '')}" data-name="${esc(order.customer?.name || '')}" hidden></div>` : ''}
     </section>
   </div>
 </div>`;

package/plugins/shopping-cart/lib/sales.js

@@ -0,0 +1,193 @@
+/**
+ * The Sales report. PURE: orders in, figures out - for the Sales tab and its CSV.
+ *
+ * A sale is an order that took money (paid, fulfilled - or refunded later), dated by when it was PAID, in the
+ * shop's time zone. A refund is dated by when it was refunded, so a period's net is what really stayed.
+ *
+ * Every line is put to a SOURCE, from what the order already says about itself:
+ *   takeaway  - an order Takeaway placed (`ref: 'takeaway:…'`)
+ *   downloads - a line for a product Shopping Cart Pro gave a download link or licence key for
+ *   addons    - an order another extension placed (any other `ref` - Cards Pro's credits, …)
+ *   shop      - everything else: the Shop's own products
+ *
+ * Platform commission (lib/commission.js) is the figure each order was given when it was paid; it counts on the day it
+ * was paid and comes back on the day of a refund.
+ *
+ * Amounts are minor units. Line amounts are before discounts; the order-level figures (discount, delivery, tax)
+ * are reported beside them, not shared out across sources.
+ *
+ * @module shopping-cart/lib/sales
+ */
+
+export const SOURCES = {shop: 'Shop', downloads: 'Downloads & keys', takeaway: 'Takeaway', addons: 'Other add-ons'};
+const PROVIDERS = {stripe: 'Card (Stripe)', paypal: 'PayPal', offline: 'Paid offline', free: 'Free'};
+const TOOK = new Set(['paid', 'fulfilled', 'refunded']);
+const DAY = 86400000;
+
+const parts = new Map();
+/** The shop's calendar date of an instant: 'YYYY-MM-DD'. */
+export function dateIn(t, tz = 'Europe/London') {
+    if (!parts.has(tz)) {
+        try { parts.set(tz, new Intl.DateTimeFormat('en-CA', {timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit'})); }
+        catch { parts.set(tz, new Intl.DateTimeFormat('en-CA', {timeZone: 'Europe/London', year: 'numeric', month: '2-digit', day: '2-digit'})); }
+    }
+    return parts.get(tz).format(new Date(t));
+}
+
+const addDays = (date, n) => { const [y, m, d] = date.split('-').map(Number); return new Date(Date.UTC(y, m - 1, d + n)).toISOString().slice(0, 10); };
+const weekday = (date) => { const [y, m, d] = date.split('-').map(Number); return new Date(Date.UTC(y, m - 1, d)).getUTCDay(); };
+
+/** The period a date falls in: the day, the Monday of its week, or the 1st of its month. */
+export function periodOf(date, by) {
+    if (by === 'month') return `${date.slice(0, 7)}-01`;
+    if (by === 'week') return addDays(date, -((weekday(date) + 6) % 7));
+    return date;
+}
+
+/** Every period from `from` to `to`, in order, so empty ones show as empty. */
+export function periodsBetween(from, to, by) {
+    const out = [];
+    let p = periodOf(from, by);
+    const last = periodOf(to, by);
+    for (let i = 0; p <= last && i < 800; i++) {
+        out.push(p);
+        if (by === 'month') { const [y, m] = p.split('-').map(Number); p = new Date(Date.UTC(y, m, 1)).toISOString().slice(0, 10); }
+        else p = addDays(p, by === 'week' ? 7 : 1);
+    }
+    return out;
+}
+
+/** Which source an order line belongs to. */
+export function sourceOf(order, line) {
+    const ref = String(order.data?.ref || '');
+    if (ref.startsWith('takeaway:')) return 'takeaway';
+    if (ref) return 'addons';
+    const pro = order.data?.ext?.['shopping-cart-pro'];
+    const digital = new Set([...(pro?.downloads || []), ...(pro?.keys || [])].map(x => x.productId));
+    if (line.productId && digital.has(line.productId)) return 'downloads';
+    return 'shop';
+}
+
+/** One order's money, split the way the report shows it. */
+export function orderFigures(o) {
+    const d = o.data;
+    const adj = d.adjustments || [];
+    const sum = (f) => adj.filter(f).reduce((n, a) => n + a.amount, 0);
+    return {
+        subtotal: d.subtotal || 0,
+        discount: -sum(a => a.stage === 'discount'),
+        delivery: sum(a => a.stage === 'shipping'),
+        taxAdded: sum(a => a.stage === 'tax' && !a.included),
+        taxIncluded: sum(a => a.stage === 'tax' && a.included),
+        total: d.total || 0
+    };
+}
+
+/**
+ * The report for `from`..`to` (dates, both included), in periods of `by`.
+ *
+ * @param {{id, data, meta}[]} orders
+ * @param {{from: string, to: string, by?: 'day'|'week'|'month', timeZone?: string}} opts
+ */
+export function salesReport(orders, {from, to, by = 'day', timeZone = 'Europe/London'}) {
+    const inRange = (date) => date >= from && date <= to;
+    const periods = new Map(periodsBetween(from, to, by).map(p => [p, {period: p, orders: 0, takings: 0, refunds: 0, commission: 0}]));
+    const totals = {orders: 0, items: 0, subtotal: 0, discount: 0, delivery: 0, taxAdded: 0, taxIncluded: 0, takings: 0, refunds: 0, refundCount: 0,
+        commission: 0, commissionBack: 0};
+    const sources = Object.fromEntries(Object.keys(SOURCES).map(k => [k, {key: k, label: SOURCES[k], orders: 0, amount: 0}]));
+    const methods = new Map();
+    const takeaway = {collect: 0, deliver: 0};
+
+    for (const o of orders) {
+        const d = o.data || {};
+        if (!TOOK.has(d.status)) continue;
+        const paidDate = dateIn(d.paidAt || o.meta?.createdAt, timeZone);
+        if (inRange(paidDate)) {
+            const f = orderFigures(o);
+            totals.orders++;
+            for (const k of ['subtotal', 'discount', 'delivery', 'taxAdded', 'taxIncluded']) totals[k] += f[k];
+            totals.takings += f.total;
+            const seen = new Set();
+            for (const l of d.lines || []) {
+                const s = sourceOf(o, l);
+                sources[s].amount += l.lineTotal || 0;
+                totals.items += l.qty || 0;
+                if (!seen.has(s)) { sources[s].orders++; seen.add(s); }
+            }
+            if (String(d.ref || '').startsWith('takeaway:')) takeaway[d.delivery === 'ship' ? 'deliver' : 'collect']++;
+            const m = methods.get(d.provider) || {key: d.provider, label: PROVIDERS[d.provider] || d.provider || 'Other', orders: 0, takings: 0};
+            m.orders++; m.takings += f.total;
+            methods.set(d.provider, m);
+            const c = d.commission?.amount || 0;
+            totals.commission += c;
+            const p = periods.get(periodOf(paidDate, by));
+            if (p) { p.orders++; p.takings += f.total; p.commission += c; }
+        }
+        if (d.status === 'refunded') {
+            const refDate = dateIn(d.refundedAt || d.paidAt || o.meta?.createdAt, timeZone);
+            if (inRange(refDate)) {
+                totals.refunds += d.total || 0;
+                totals.refundCount++;
+                const p = periods.get(periodOf(refDate, by));
+                if (p) p.refunds += d.total || 0;
+            }
+        }
+        if (d.commission?.reversed) {
+            const backDate = dateIn(d.commission.reversedAt || d.refundedAt || o.meta?.createdAt, timeZone);
+            if (inRange(backDate)) {
+                totals.commissionBack += d.commission.amount || 0;
+                const p = periods.get(periodOf(backDate, by));
+                if (p) p.commission -= d.commission.amount || 0;
+            }
+        }
+    }
+    return {
+        from, to, by,
+        totals: {...totals, net: totals.takings - totals.refunds, average: totals.orders ? Math.round(totals.takings / totals.orders) : 0,
+            commissionNet: totals.commission - totals.commissionBack, afterCommission: totals.takings - totals.refunds - (totals.commission - totals.commissionBack)},
+        periods: [...periods.values()].map(p => ({...p, net: p.takings - p.refunds})),
+        sources: Object.values(sources).filter(s => s.orders || s.key === 'shop'),
+        methods: [...methods.values()].sort((a, b) => b.takings - a.takings),
+        takeaway
+    };
+}
+
+/** The named ranges the Sales tab offers, as {from, to} dates for `today`. */
+export function rangeFor(name, today) {
+    const [y, m] = today.split('-').map(Number);
+    const monthStart = (yy, mm) => new Date(Date.UTC(yy, mm - 1, 1)).toISOString().slice(0, 10);
+    switch (name) {
+        case 'today': return {from: today, to: today};
+        case 'week': return {from: periodOf(today, 'week'), to: today};
+        case 'last7': return {from: addDays(today, -6), to: today};
+        case 'month': return {from: monthStart(y, m), to: today};
+        case 'lastmonth': return {from: monthStart(y, m - 1), to: addDays(monthStart(y, m), -1)};
+        case 'last30': return {from: addDays(today, -29), to: today};
+        case 'year': return {from: `${y}-01-01`, to: today};
+        default: return {from: addDays(today, -29), to: today};
+    }
+}
+
+const csvCell = (v) => { const s = String(v ?? ''); return /[",\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s; };
+const pounds = (n) => ((n || 0) / 100).toFixed(2);
+
+/** One row per order sold or refunded in the range - for the accountant. */
+export function salesCsv(orders, {from, to, timeZone = 'Europe/London'}) {
+    const rows = [['Order', 'Paid', 'Status', 'Refunded', 'Sources', 'Payment', 'Customer', 'Subtotal', 'Discount', 'Delivery', 'Tax added', 'Tax included', 'Total', 'Commission', 'Commission rate']];
+    const list = orders.filter(o => TOOK.has(o.data?.status)).filter(o => {
+        const paid = dateIn(o.data.paidAt || o.meta?.createdAt, timeZone);
+        const refunded = o.data.refundedAt ? dateIn(o.data.refundedAt, timeZone) : '';
+        return (paid >= from && paid <= to) || (refunded && refunded >= from && refunded <= to);
+    }).sort((a, b) => String(a.data.paidAt || a.meta?.createdAt).localeCompare(String(b.data.paidAt || b.meta?.createdAt)));
+    for (const o of list) {
+        const d = o.data;
+        const f = orderFigures(o);
+        rows.push([`#${d.number}`, dateIn(d.paidAt || o.meta?.createdAt, timeZone), d.status, d.refundedAt ? dateIn(d.refundedAt, timeZone) : '',
+            [...new Set((d.lines || []).map(l => SOURCES[sourceOf(o, l)]))].join('; '), PROVIDERS[d.provider] || d.provider, d.customer?.name || d.email || '',
+            pounds(f.subtotal), pounds(f.discount), pounds(f.delivery), pounds(f.taxAdded), pounds(f.taxIncluded), pounds(f.total),
+            d.commission ? pounds(d.commission.reversed ? 0 : d.commission.amount) : '', d.commission ? `${d.commission.percent}% + ${pounds(d.commission.fixed)}` : '']);
+    }
+    return rows.map(r => r.map(csvCell).join(',')).join('\r\n') + '\r\n';
+}
+
+export {DAY};

package/plugins/shopping-cart/lib/shop.js

@@ -18,6 +18,14 @@ import {cleanProduct} from '../public/lib/products.js';
 import {NEXT, SOLD, canMove} from '../public/lib/orders.js';
 import {currencyOf} from '../public/lib/money.js';
 import {cartRegistry} from './extensions.js';
+import {commissionFor, currentCommission} from './commission.js';
+
+/** The platform's commission on a sale being paid now - kept if it already has one. */
+function commissionOn(d, at) {
+    if (d.commission) return {};
+    const c = commissionFor({data: d}, currentCommission().rates, at);
+    return c ? {commission: c} : {};
+}
 import defaults from '../config.js';
 
 export const NAME = 'shopping-cart';
@@ -98,6 +106,7 @@ export function cleanSettings(input, current) {
     out.lowStockAt = Math.max(0, Math.min(1000, Math.round(Number(input.lowStockAt ?? current.lowStockAt) || 0)));
     out.showStockLeft = bool('showStockLeft');
     out.termsUrl = str('termsUrl', 300);
+    out.accounts = bool('accounts');
     if (out.termsUrl && !/^(\/(?!\/)|https?:\/\/)/.test(out.termsUrl)) errors.termsUrl = 'A page on this site (/terms) or a full https:// address.';
 
     const countries = Array.isArray(input.countries) ? input.countries : (current.countries || ['GB']);
@@ -360,6 +369,7 @@ export function markPaid(id, info = {}) {
             stockTaken: true,
             ...(info.ref ? {providerRef: info.ref} : {}),
             ...(info.payment ? {paymentRef: info.payment} : {}),
+            ...commissionOn(d, now),
             history: [...(d.history || []), {at: now, status: 'paid', by: info.by || d.provider, note: info.note || ''}]
         });
         return {order, changed: true, from: d.status};
@@ -372,8 +382,13 @@ export function markPaid(id, info = {}) {
  *
  * @returns {Promise<{order: object, from: string}>}
  */
-export function moveOrder(id, to, {by = 'admin', note = '', restock = false, tracking = null} = {}) {
-    return withLock(async () => {
+export function moveOrder(id, to, opts = {}) {
+    return withLock(() => moveOrderNow(id, to, opts));
+}
+
+/** moveOrder's body - for a caller that already holds the lock (a refund wraps the provider call and the move in one). */
+export async function moveOrderNow(id, to, {by = 'admin', note = '', restock = false, tracking = null} = {}) {
+    {
         const had = await getOrder(id);
         if (!had) throw Object.assign(new Error('No such order.'), {status: 404});
         const d = had.data;
@@ -384,6 +399,9 @@ export function moveOrder(id, to, {by = 'admin', note = '', restock = false, tra
         const patch = {status: to, history: [...(d.history || []), {at: now, status: to, by, note: String(note || '').slice(0, 500)}]};
         if (to === 'paid' && !d.stockTaken) { await moveStock(d, -1); patch.stockTaken = true; }
         if (to === 'paid' && !d.paidAt) patch.paidAt = now;
+        if (to === 'paid') Object.assign(patch, commissionOn(d, now));
+        // A refund gives the platform's commission back too (statements net it off in the month of the refund).
+        if (to === 'refunded' && d.commission && !d.commission.reversed) patch.commission = {...d.commission, reversed: true, reversedAt: now};
         if (to === 'fulfilled') {
             patch.fulfilledAt = now;
             if (tracking) patch.tracking = tracking;
@@ -395,7 +413,7 @@ export function moveOrder(id, to, {by = 'admin', note = '', restock = false, tra
         }
         const order = await updateEntry(ORDERS, id, {...d, ...patch});
         return {order, from: d.status};
-    });
+    }
 }
 
 /** The admin's own note and the tracking details - no status change. */

package/plugins/shopping-cart/plugin.js

@@ -23,35 +23,61 @@
  */
 
 import {getConfig} from '../../server/config.js';
+import {originOf, trustedOrigin} from '../../server/services/passwordReset.js';
 import {cleanCheckout, orderLabel} from './public/lib/orders.js';
 import {formatMoney} from './public/lib/money.js';
 import {publicProduct, byShelf} from './public/lib/products.js';
 import {cartRegistry} from './lib/extensions.js';
 import {SAMPLES} from './lib/samples.js';
+import * as accounts from './lib/accounts.js';
+import {dateIn, rangeFor, salesCsv, salesReport} from './lib/sales.js';
+import {TYPES as COMMISSION_TYPES, currentCommission, rateFor, rateText} from './lib/commission.js';
+import {getUserById} from '../../server/services/users.js';
 import {cleanCharges, cleanCustomLines, cleanLines, priceBasket} from './lib/pricing.js';
 import {badge, summarise} from './lib/summary.js';
 import * as pay from './lib/payments.js';
 import {
     NAME, allOrders, allProducts, annotateOrder, cleanSettings, cleanTracking, createOrder, ensureCollections, extendOrder,
-    getOrder, getProduct, liveSettings, markPaid, maskSettings, methodsOf, moveOrder, publicOrder, removeOrder,
-    refreshShelf, removeProduct, saveProduct, saveSettings, setProviderRef, settingsNow, shelfNow, tokenOk, updateProductExt
+    getOrder, getProduct, liveSettings, markPaid, maskSettings, methodsOf, moveOrder, moveOrderNow, publicOrder, removeOrder,
+    refreshShelf, removeProduct, saveProduct, saveSettings, setProviderRef, settingsNow, shelfNow, tokenOk, updateProductExt, withLock
 } from './lib/shop.js';
 import {cardHtml, esc, gridHtml} from './lib/render.js';
 
-/** The origin shoppers last reached us on - for emails, which have no request. */
-let lastOrigin = '';
-
-/** Where this site lives, for the addresses a payment provider sends shoppers back to. */
-function siteBase(request) {
+/** The Site URL setting as an origin, or ''. */
+function configuredBase() {
     let base = '';
     try { base = String(getConfig('site')?.baseUrl || ''); } catch { /* no site config */ }
-    if (/^https?:\/\/[^/\s]+/i.test(base)) return base.replace(/\/+$/, '');
-    if (!request) return lastOrigin;
-    const origin = `${request.protocol}://${request.host || request.headers.host || request.hostname}`;
-    lastOrigin = origin;
-    return origin;
+    return /^https?:\/\/[^/\s]+/i.test(base) ? base.replace(/\/+$/, '') : '';
+}
+
+/**
+ * Where this site lives, for the addresses a payment provider sends shoppers back to: the Site URL setting,
+ * else the origin of the shopper's own request (they land back where they came from). Never remembered for
+ * later: any request can claim any Host, and a kept one would put a stranger's address - and the receipt
+ * tokens - in every customer email until the next request.
+ */
+function siteBase(request) {
+    return configuredBase() || (request ? `${request.protocol}://${request.host || request.headers.host || request.hostname}` : '');
 }
 
+let warnedNoBase = false;
+let warn = (msg) => console.warn(msg);
+/**
+ * The address for links with no shopper's request behind them (emails, links handed to other Tools): core's
+ * rule as for password resets - the Site URL, else an address someone has really signed in on. '' when the
+ * site knows none; the email then goes without its link, and the log says why once.
+ */
+async function quietBase() {
+    const base = configuredBase() || await trustedOrigin('').catch(() => '');
+    if (!base && !warnedNoBase) {
+        warnedNoBase = true;
+        warn('[shopping-cart] Site URL is not set (Site Settings): emails go out without links to the order until it is.');
+    }
+    return base;
+}
+/** The same rule for an email answering a request (account confirm, forgotten password). */
+const linkBase = (request) => configuredBase() || trustedOrigin(originOf(request)).catch(() => '');
+
 const receiptPath = (s, order) => `${s.shopPath}/order/${order.id}?t=${order.data.token}`;
 
 /** A problem for the shopper, sent as JSON with a status. */
@@ -134,6 +160,7 @@ function registerShortcodes(hooks) {
 }
 
 export default async function shoppingCart(fastify, options) {
+    warn = (msg) => fastify.log.warn(msg);
     const {authenticate, requirePermission} = options.auth;
     const hooks = options.hooks || {};
     const can = (action) => ({preHandler: [authenticate, requirePermission('shop', action)]});
@@ -177,7 +204,10 @@ export default async function shoppingCart(fastify, options) {
         name: NAME,
         liveSettings, allOrders, getOrder, allProducts, getProduct, extendOrder, publicOrder,
         formatMoney, orderLabel,
+        /** The Site URL as an origin, or '' - sync, for the shopper-facing paths. Email links: `linkBase`. */
         siteBase: () => siteBase(null),
+        /** The address for links in emails (async): the Site URL, else an address someone has really signed in on, else ''. */
+        linkBase: quietBase,
         /** Change only an extension's part of a product, under the order lock (lib/shop.js updateProductExt). */
         updateProductExt,
         /** Move an order on (Shopping Cart Pro fulfils an order with nothing to post), telling every extension. */
@@ -186,7 +216,7 @@ export default async function shoppingCart(fastify, options) {
             announceMove(order, from, order.data.status);
             return order;
         },
-        receiptUrl: (order) => liveSettings().then(s => `${siteBase(null)}${receiptPath(s, order)}`)
+        receiptUrl: async (order) => { const [s, base] = await Promise.all([liveSettings(), quietBase()]); return base ? `${base}${receiptPath(s, order)}` : ''; }
     };
 
     // ---- Admin: overview, badge, extensions ----------------------------------------
@@ -201,6 +231,38 @@ export default async function shoppingCart(fastify, options) {
         };
     });
 
+    /**
+     * The Sales report: ?range=today|week|last7|month|lastmonth|last30|year, or ?from=&to= (dates), and ?by=day|week|month.
+     * Dates are the shop's (settings.timeZone, Europe/London unless set).
+     */
+    const salesRange = (q, s) => {
+        const today = dateIn(Date.now(), s.timeZone || 'Europe/London');
+        const isDate = (d) => /^\d{4}-\d{2}-\d{2}$/.test(String(d || ''));
+        let {from, to} = isDate(q.from) && isDate(q.to) ? {from: q.from, to: q.to} : rangeFor(String(q.range || 'last30'), today);
+        if (from > to) [from, to] = [to, from];
+        return {from, to, today};
+    };
+    /** The platform's commission for this site, for people: each kind of sale and its rate. Read-only here. */
+    const commissionInfo = (s) => {
+        const {rates, updatedAt} = currentCommission();
+        const money = (n) => formatMoney(n, s.currency);
+        return {set: Object.keys(rates).length > 0, updatedAt,
+            rates: Object.entries(COMMISSION_TYPES).map(([k, label]) => ({key: k, label, text: rateText(rateFor(k, rates), money)}))};
+    };
+
+    fastify.get('/sales', can('read'), async (request) => {
+        const [orders, s] = await Promise.all([allOrders(), liveSettings()]);
+        const {from, to, today} = salesRange(request.query || {}, s);
+        const by = ['day', 'week', 'month'].includes(request.query?.by) ? request.query.by : 'day';
+        return {...salesReport(orders, {from, to, by, timeZone: s.timeZone || 'Europe/London'}), today, currency: s.currency, commission: commissionInfo(s)};
+    });
+    fastify.get('/sales.csv', can('read'), async (request, reply) => {
+        const [orders, s] = await Promise.all([allOrders(), liveSettings()]);
+        const {from, to} = salesRange(request.query || {}, s);
+        return reply.type('text/csv; charset=utf-8').header('Content-Disposition', `attachment; filename="sales-${from}-to-${to}.csv"`)
+            .header('Cache-Control', 'no-store').send(salesCsv(orders, {from, to, timeZone: s.timeZone || 'Europe/London'}));
+    });
+
     fastify.get('/count', can('read'), async () => {
         const [orders, settings, products] = await Promise.all([allOrders(), liveSettings(), allProducts()]);
         return badge(orders, settings, Date.now(), products);
@@ -330,26 +392,32 @@ export default async function shoppingCart(fastify, options) {
     /** Refund an order in full (see above). Throws {status, message}. */
     async function refundOrder(id, {restock = false, note = '', viaProvider = true, by = 'admin'} = {}) {
         const bad = (status, message) => Object.assign(new Error(message), {status});
-        const o = await getOrder(id);
-        if (!o) throw bad(404, 'No such order.');
-        const d = o.data;
-        if (!['paid', 'fulfilled'].includes(d.status)) throw bad(409, 'Only a paid order can be refunded.');
-        const s = await liveSettings();
-        let how = 'marked refunded';
-        try {
-            if (viaProvider && d.provider === 'stripe' && d.paymentRef) {
-                if (!s.stripeSecretKey) throw bad(409, 'Stripe is not set up any more - refund it in Stripe, then mark it refunded here.');
-                await pay.stripeRefund({secretKey: s.stripeSecretKey, paymentIntent: d.paymentRef});
-                how = 'refunded through Stripe';
-            } else if (viaProvider && d.provider === 'paypal' && d.paymentRef) {
-                if (!s.paypalClientId || !s.paypalSecret) throw bad(409, 'PayPal is not set up any more - refund it in PayPal, then mark it refunded here.');
-                await pay.paypalRefund({creds: {clientId: s.paypalClientId, secret: s.paypalSecret, mode: s.paypalMode}, captureId: d.paymentRef});
-                how = 'refunded through PayPal';
+        // The whole refund runs under the order lock: two refunds at once would both reach the provider, and a
+        // write landing between the provider's yes and ours would be lost. The provider call carries an
+        // Idempotency-Key from the order id, so a retry after a timeout returns the first refund, not a second.
+        const {order, from, how} = await withLock(async () => {
+            const o = await getOrder(id);
+            if (!o) throw bad(404, 'No such order.');
+            const d = o.data;
+            if (!['paid', 'fulfilled'].includes(d.status)) throw bad(409, 'Only a paid order can be refunded.');
+            const s = await liveSettings();
+            let via = 'marked refunded';
+            try {
+                if (viaProvider && d.provider === 'stripe' && d.paymentRef) {
+                    if (!s.stripeSecretKey) throw bad(409, 'Stripe is not set up any more - refund it in Stripe, then mark it refunded here.');
+                    await pay.stripeRefund({secretKey: s.stripeSecretKey, paymentIntent: d.paymentRef, idempotencyKey: `${NAME}-refund-${o.id}`});
+                    via = 'refunded through Stripe';
+                } else if (viaProvider && d.provider === 'paypal' && d.paymentRef) {
+                    if (!s.paypalClientId || !s.paypalSecret) throw bad(409, 'PayPal is not set up any more - refund it in PayPal, then mark it refunded here.');
+                    await pay.paypalRefund({creds: {clientId: s.paypalClientId, secret: s.paypalSecret, mode: s.paypalMode}, captureId: d.paymentRef});
+                    via = 'refunded through PayPal';
+                }
+            } catch (err) {
+                throw bad(err.status || 502, err.status === 409 ? err.message : `Not refunded: ${err.message}`);
             }
-        } catch (err) {
-            throw bad(err.status || 502, err.status === 409 ? err.message : `Not refunded: ${err.message}`);
-        }
-        const {order, from} = await moveOrder(o.id, 'refunded', {by, note: [how, String(note || '')].filter(Boolean).join(' - '), restock: Boolean(restock)});
+            const moved = await moveOrderNow(o.id, 'refunded', {by, note: [via, String(note || '')].filter(Boolean).join(' - '), restock: Boolean(restock)});
+            return {...moved, how: via};
+        });
         announceMove(order, from, 'refunded');
         return {order, how};
     }
@@ -379,7 +447,8 @@ export default async function shoppingCart(fastify, options) {
         return {
             settings: maskSettings(s),
             webhookUrl: `${siteBase(request)}/api/plugins/shopping-cart/stripe/webhook`,
-            stripeMode: pay.stripeMode(s.stripeSecretKey)
+            stripeMode: pay.stripeMode(s.stripeSecretKey),
+            commission: commissionInfo(s)
         };
     });
 
@@ -413,6 +482,83 @@ export default async function shoppingCart(fastify, options) {
         }
     });
 
+    // ---- Customer accounts (lib/accounts.js) --------------------------------------------
+    //
+    // Optional (settings.accounts). Made, confirmed and described here; signed in, refreshed and given a new
+    // password by core's own /api/auth routes. A signed-in customer sends core's Bearer token.
+
+    // A boolean, the reply sent on the side: awaiting a Fastify reply resolves (empty) once it is sent, so
+    // `if (await fail(...))` would carry on and run the route anyway.
+    const accountsOff = async (reply) => {
+        if ((await liveSettings()).accounts) return false;
+        fail(reply, 404, 'Customer accounts are not switched on.');
+        return true;
+    };
+    /** `rest` -> an absolute address under the shop, for emails. */
+    const shopLink = async (request) => {
+        const s = await liveSettings();
+        const base = await linkBase(request);
+        return {s, base, link: (rest) => `${base}${s.shopPath}/${rest}`};
+    };
+    const accountFail = (reply, err) => fail(reply, err.status || 500, err.message, err.errors ? {errors: err.errors} : {});
+
+    fastify.post('/account/register', {config: {rateLimit: {max: 5, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        if (await accountsOff(reply)) return undefined;
+        const {s, base, link} = await shopLink(request);
+        // A confirm link needs an address the site trusts; the Host header is not one.
+        if (!base) return fail(reply, 409, 'Accounts cannot be made just now - please check out as a guest.');
+        try {
+            return await accounts.register(request.body || {}, {link, shopTitle: s.shopTitle || 'the shop', log: request.log});
+        } catch (err) { return accountFail(reply, err); }
+    });
+
+    fastify.post('/account/confirm', {config: {rateLimit: {max: 20, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        if (await accountsOff(reply)) return undefined;
+        try {
+            // Nothing about the account comes back - not even its email: `u` is a user id, and those are public.
+            await accounts.confirm(request.body?.u, request.body?.t);
+            return {confirmed: true};
+        } catch (err) { return accountFail(reply, err); }
+    });
+
+    fastify.post('/account/forgot', {config: {rateLimit: {max: 5, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        if (await accountsOff(reply)) return undefined;
+        const {s, base, link} = await shopLink(request);
+        if (base) await accounts.forgot(request.body?.email, {link, shopTitle: s.shopTitle || 'the shop', log: request.log}).catch(() => null);
+        else request.log.warn('[shopping-cart] password reset not sent: the site has no trusted address (set the Site URL)');
+        // The same answer whoever asked: the form must not tell anyone who has an account.
+        return {ok: true};
+    });
+
+    /** The signed-in customer: details, saved addresses and the orders placed with their email. */
+    fastify.get('/account', {preHandler: [authenticate]}, async (request, reply) => {
+        const user = await getUserById(request.user.id);
+        if (!user || !user.isActive) return fail(reply, 401, 'Please sign in again.');
+        const s = await liveSettings();
+        const mine = accounts.ordersFor(await allOrders(), user.email).slice(0, 50);
+        const orders = [];
+        for (const o of mine) {
+            orders.push({id: o.id, number: o.data.number, status: o.data.status, total: o.data.total, currency: o.data.currency,
+                placedAt: o.meta?.createdAt, receipt: receiptPath(s, o), lines: (o.data.lines || []).map(l => `${l.qty} × ${l.name}${l.variantName ? ` (${l.variantName})` : ''}`),
+                parts: await registry.accountParts(o, {settings: s})});
+        }
+        return {...accounts.describe(user), orders, accounts: Boolean(s.accounts)};
+    });
+
+    fastify.put('/account', {preHandler: [authenticate]}, async (request, reply) => {
+        try {
+            const b = request.body || {};
+            return await accounts.updateDetails(request.user.id, {name: b.name, phone: b.phone, addresses: b.addresses});
+        } catch (err) { return accountFail(reply, err); }
+    });
+
+    fastify.delete('/account', {preHandler: [authenticate], config: {rateLimit: {max: 5, timeWindow: '10 minutes'}}}, async (request, reply) => {
+        try {
+            await accounts.remove(request.user.id, request.body?.password);
+            return {deleted: true};
+        } catch (err) { return accountFail(reply, err); }
+    });
+
     // ---- Shoppers --------------------------------------------------------------------
 
     fastify.get('/catalogue', async (request) => {
@@ -422,7 +568,6 @@ export default async function shoppingCart(fastify, options) {
     });
 
     fastify.post('/quote', async (request) => {
-        siteBase(request);
         const s = await liveSettings();
         const {quote} = await quoteFor(request.body, s);
         return shopperQuote(quote, s);
@@ -581,7 +726,7 @@ export default async function shoppingCart(fastify, options) {
         const methods = methodsOf(s).map(m => m.id);
         const via = quote.total === 0 ? 'free' : (provider || methods[0] || '');
         if (via !== 'free' && !methods.includes(via)) throw bad(409, 'The Shop has no way to take payment set up yet.');
-        const origin = /^https?:\/\/[^/\s]+$/i.test(base) ? base.replace(/\/+$/, '') : siteBase(null);
+        const origin = configuredBase() || (/^https?:\/\/[^/\s]+$/i.test(base) ? base.replace(/\/+$/, '') : await quietBase());
         const back = /^\/(?!\/)/.test(String(returnTo)) ? `${origin}${returnTo}` : '';
         const order = await createOrder({quote, checkout, provider: via, delivery: deliver ? 'ship' : delivery === 'collect' ? 'collect' : 'none',
             code: String(code || '').slice(0, 60), ref, returnTo: back, ownEmails: ownEmails === true, payNote});

package/plugins/shopping-cart/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "shopping-cart",
   "displayName": "Shopping Cart",
-  "version": "1.3.0",
+  "version": "1.6.1",
   "tier": "free",
   "description": "Sell from your site: products with options, stock and pictures, a storefront and a cart that follows shoppers from page to page, and checkout with Stripe, PayPal or payment offline. Orders to fulfil in the sidebar, refunds from the order.",
   "author": "Domma CMS",
-  "date": "2026-10-12",
+  "date": "2026-10-13",
   "icon": "shopping-bag",
   "permissions": [
     {
@@ -45,7 +45,7 @@
     ],
     "views": {
       "plugin-shopping-cart": {
-        "entry": "shopping-cart/admin/views/shop.js?v=1.3.0",
+        "entry": "shopping-cart/admin/views/shop.js?v=1.6.0",
         "exportName": "shopView"
       }
     }