domma-cms 1.6.34 → 1.6.36

package/plugins/shopping-cart/tests/api.test.js

@@ -291,3 +291,37 @@ test('an extension checks out lines it priced, with a delivery fee and address;
         reg.unregister('test-takeaway');
     }
 });
+
+test('sales: the report and its CSV over the API', async () => {
+    const r = await call('GET', '/sales?range=year&by=month');
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.ok(r.body.totals && Array.isArray(r.body.periods) && r.body.periods.length >= 1);
+    assert.ok(r.body.totals.orders >= 1, 'the earlier tests sold things');
+    const csv = await app.inject({method: 'GET', url: '/sales.csv?from=2020-01-01&to=2030-12-31'});
+    assert.equal(csv.statusCode, 200);
+    assert.match(csv.headers['content-disposition'], /attachment; filename="sales-2020-01-01-to-2030-12-31\.csv"/);
+    assert.ok(csv.body.startsWith('Order,Paid,Status'));
+});
+
+test('review: links for emails never come from a request\'s Host header; two refunds at once have one winner', async () => {
+    const reg = globalThis[Symbol.for('domma.shopping-cart')];
+    await call('PUT', '/settings', {offlineEnabled: true, countries: ['GB'], taxRate: 0, shippingFlat: 0});
+    const pen = (await call('POST', '/products', {name: 'Pen', price: 500, status: 'active', shippable: false})).body;
+    // A forged Host on a public request must not become the address in anyone's email.
+    const forged = await app.inject({method: 'POST', url: '/quote', headers: {host: 'evil.example'}, payload: {lines: [{productId: pen.id, qty: 1}]}});
+    assert.equal(forged.statusCode, 200);
+    assert.equal(String(reg.services.siteBase()).includes('evil.example'), false);
+    const placed = await call('POST', '/checkout', {lines: [{productId: pen.id, qty: 1}], provider: 'offline', customer: {name: 'Eve', email: 'eve@example.com'}});
+    assert.equal(placed.status, 200, JSON.stringify(placed.body));
+    const order = await reg.services.getOrder(placed.body.orderId);
+    const receipt = await reg.services.receiptUrl(order);
+    assert.equal(receipt.includes('evil.example'), false, `receipt link: ${receipt}`);
+    assert.equal((await reg.services.linkBase()).includes('evil.example'), false);
+    if (receipt) assert.match(receipt, /^https?:\/\/[^/]+\/shop\/order\//);
+
+    // Paid, then refunded twice in the same instant: one refund, one "only a paid order" refusal.
+    await call('PUT', `/orders/${order.id}/status`, {status: 'paid'});
+    const both = await Promise.all([call('POST', `/orders/${order.id}/refund`, {}), call('POST', `/orders/${order.id}/refund`, {})]);
+    assert.deepEqual(both.map(r => r.status).sort(), [200, 409], JSON.stringify(both.map(r => r.body)));
+    assert.equal((await reg.services.getOrder(order.id)).data.history.filter(h => h.status === 'refunded').length, 1);
+});

package/plugins/shopping-cart/tests/commission.test.js

@@ -0,0 +1,90 @@
+/**
+ * Platform commission: the pure rules, then a real sale with config/commission.json written as the manager would
+ * (in the domma-cms checkout `make test` runs in - removed again after).
+ */
+import {test, before, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import Fastify from 'fastify';
+import shoppingCart from '../plugin.js';
+import {cleanRates, commissionFor, orderType, rateFor, rateText} from '../lib/commission.js';
+
+const FILE = path.resolve('config/commission.json');
+const PLUGINS = path.resolve('config/plugins.json');
+const DIRS = ['shop-products', 'shop-orders'].map(c => path.resolve('content/collections', c));
+let savedFile;
+let savedPlugins;
+let app;
+
+before(async () => {
+    savedFile = await fs.readFile(FILE, 'utf8').catch(() => null);
+    savedPlugins = await fs.readFile(PLUGINS, 'utf8').catch(() => null);
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    delete globalThis[Symbol.for('domma.shopping-cart')];
+    app = Fastify();
+    await app.register(shoppingCart, {auth: {authenticate: async (req) => { req.user = {id: 'a', role: 'admin'}; }, requirePermission: () => async () => {}}, settings: {}, hooks: {registerShortcode() {}}});
+});
+
+after(async () => {
+    await app?.close();
+    for (const d of DIRS) await fs.rm(d, {recursive: true, force: true});
+    if (savedFile === null) await fs.rm(FILE, {force: true}); else await fs.writeFile(FILE, savedFile);
+    if (savedPlugins === null) await fs.rm(PLUGINS, {force: true}); else await fs.writeFile(PLUGINS, savedPlugins);
+});
+
+const call = async (method, url, body) => {
+    const res = await app.inject({method, url, payload: body});
+    let json = null;
+    try { json = res.json(); } catch { /* not JSON */ }
+    return {status: res.statusCode, body: json, text: res.body};
+};
+
+test('commission: rates cleaned, the kind of sale, per-sale amounts', () => {
+    const {rates} = cleanRates({rates: {default: {percent: 2, fixed: 20}, takeaway: {percent: '3.5'}, shop: {percent: -1}, junk: {percent: 9}}});
+    assert.deepEqual(rates, {default: {percent: 2, fixed: 20}, takeaway: {percent: 3.5, fixed: 0}});
+    assert.equal(orderType({data: {ref: 'takeaway:x'}}), 'takeaway');
+    assert.equal(orderType({data: {ref: 'purchase-1'}}), 'addons');
+    assert.equal(orderType({data: {}}), 'shop');
+    assert.deepEqual(rateFor('shop', rates), {percent: 2, fixed: 20}, 'no rate of its own: the default');
+    assert.deepEqual(commissionFor({data: {total: 2150}}, rates, 'T'), {type: 'shop', base: 2150, percent: 2, fixed: 20, amount: 43 + 20, at: 'T'});
+    assert.equal(commissionFor({data: {total: 2150, ref: 'takeaway:x'}}, rates).amount, 75, '3.5% of £21.50, rounded');
+    assert.equal(commissionFor({data: {total: 0}}, rates), null, 'a free order carries none');
+    assert.equal(commissionFor({data: {total: 10}}, rates).amount, 10, 'never more than the sale');
+    assert.equal(commissionFor({data: {total: 1000}}, {}), null, 'no rates: none');
+    assert.equal(rateText({percent: 2, fixed: 20}), '2% + £0.20 per sale');
+});
+
+test('commission: stored on the sale when paid, at that day\'s rate; returned with a refund; in Sales and the CSV', async () => {
+    await call('PUT', '/settings', {offlineEnabled: true, countries: ['GB']});
+    const mug = (await call('POST', '/products', {name: 'Mug', price: 1000, status: 'active', shippable: false})).body;
+    const buy = async () => (await call('POST', '/checkout', {lines: [{productId: mug.id, qty: 2}], provider: 'offline', customer: {name: 'Ann', email: 'ann@example.test'}})).body.orderId;
+
+    // No file yet: a sale carries no commission.
+    let id = await buy();
+    let o = (await call('PUT', `/orders/${id}/status`, {status: 'paid'})).body;
+    assert.equal(o.data.commission, undefined);
+
+    // The manager writes the rate; the next sale has it (no restart).
+    await fs.writeFile(FILE, JSON.stringify({rates: {default: {percent: 5, fixed: 10}}, updatedAt: '2026-10-12T00:00:00Z', by: 'super'}));
+    id = await buy();
+    o = (await call('PUT', `/orders/${id}/status`, {status: 'paid'})).body;
+    assert.deepEqual([o.data.commission.amount, o.data.commission.percent, o.data.commission.type], [110, 5, 'shop']);
+    // A later rate leaves it as it was.
+    await new Promise(r => setTimeout(r, 15));
+    await fs.writeFile(FILE, JSON.stringify({rates: {default: {percent: 50}}}));
+    o = (await call('PUT', `/orders/${id}/status`, {status: 'fulfilled'})).body;
+    assert.equal(o.data.commission.amount, 110);
+    const s = (await call('GET', '/settings')).body.commission;
+    assert.deepEqual([s.set, s.rates[0].text], [true, '50% per sale']);
+    // Refunded: returned.
+    o = (await call('POST', `/orders/${id}/refund`, {})).body.order;
+    assert.deepEqual([o.data.commission.reversed, o.data.commission.amount], [true, 110]);
+    const r = (await call('GET', '/sales?range=year')).body;
+    assert.deepEqual([r.totals.commission, r.totals.commissionBack, r.totals.commissionNet], [110, 110, 0]);
+    const csv = (await call('GET', '/sales.csv?range=year')).text;
+    assert.ok(csv.split('\r\n')[0].endsWith('Commission,Commission rate'));
+    // The customer never sees it.
+    const receipt = (await call('GET', `/order/${id}?t=${o.data.token}`)).body;
+    assert.ok(!('commission' in receipt));
+});

package/plugins/shopping-cart/tests/pure.test.js

@@ -5,7 +5,7 @@ import {formatMoney, fromMinor, includedTax, percentOf, toMinor} from '../public
 import {available, cleanProduct, priceRange, publicProduct, slugify, unitPrice} from '../public/lib/products.js';
 import {canMove, cleanCheckout} from '../public/lib/orders.js';
 import {cleanCharges, cleanCustomLines, cleanLines, priceBasket} from '../lib/pricing.js';
-import {paypalPaid, stripeForm, stripeLineItems, stripeSessionPaid, stripeVerify} from '../lib/payments.js';
+import {paypalPaid, stripeCreateSession, stripeForm, stripeLineItems, stripeRefund, stripeSessionPaid, stripeVerify} from '../lib/payments.js';
 import {badge, summarise} from '../lib/summary.js';
 import {cartRegistry} from '../lib/extensions.js';
 import {matchShopPath} from '../plugin.public.js';
@@ -298,3 +298,18 @@ test('pricing: a shipping handler can offer services to choose between', async (
     assert.equal(q.shipping, 900);
     assert.equal(q.shippingChoice, 'exp');
 });
+
+test('payments: Stripe refunds and sessions carry an Idempotency-Key, so a retry after a timeout is not a second one', async () => {
+    const seen = [];
+    const realFetch = globalThis.fetch;
+    globalThis.fetch = async (url, init) => { seen.push({url, init}); return {ok: true, json: async () => ({id: 'cs_test_1', url: 'https://pay.test/x'})}; };
+    try {
+        await stripeRefund({secretKey: 'sk_test_x', paymentIntent: 'pi_1', idempotencyKey: 'shopping-cart-refund-o1'});
+        assert.equal(seen[0].init.headers['Idempotency-Key'], 'shopping-cart-refund-o1');
+        await stripeRefund({secretKey: 'sk_test_x', paymentIntent: 'pi_1'});
+        assert.equal('Idempotency-Key' in seen[1].init.headers, false, 'none asked for, none sent');
+        await stripeCreateSession({secretKey: 'sk_test_x', order: {id: 'o1', number: 1001, currency: 'GBP', total: 100, lines: [{name: 'Mug', qty: 1, unitPrice: 100, lineTotal: 100}], adjustments: []},
+            successUrl: 'https://s.test/ok', cancelUrl: 'https://s.test/no'});
+        assert.equal(seen[2].init.headers['Idempotency-Key'], 'shop-session-o1');
+    } finally { globalThis.fetch = realFetch; }
+});

package/plugins/shopping-cart/tests/sales.test.js

@@ -0,0 +1,73 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {dateIn, periodOf, periodsBetween, rangeFor, salesCsv, salesReport, sourceOf} from '../lib/sales.js';
+
+const order = (n, {status = 'paid', paidAt, refundedAt, ref = '', provider = 'stripe', lines, adjustments = [], delivery = 'none', ext} = {}) => {
+    const subtotal = lines.reduce((s, l) => s + l.lineTotal, 0);
+    const total = subtotal + adjustments.filter(a => !a.included).reduce((s, a) => s + a.amount, 0);
+    return {id: `o${n}`, meta: {createdAt: paidAt}, data: {number: 1000 + n, status, paidAt, refundedAt, ref, provider, lines, adjustments, subtotal, total, delivery, ext,
+        customer: {name: `Customer ${n}`}}};
+};
+
+const ORDERS = [
+    // A Shop order with delivery and a discount, paid late on 1 Oct UK time (still 1 Oct in London, 23:30 BST = 22:30Z).
+    order(1, {paidAt: '2026-10-01T22:30:00Z', lines: [{productId: 'mug', qty: 2, lineTotal: 2000}],
+        adjustments: [{stage: 'discount', amount: -200}, {stage: 'shipping', amount: 395}, {stage: 'tax', amount: 366, included: true}]}),
+    // Just after midnight UK time on 2 Oct (23:10Z on 1 Oct): a London date of 2 Oct.
+    order(2, {paidAt: '2026-10-01T23:10:00Z', provider: 'offline', lines: [{productId: 'ebook', qty: 1, lineTotal: 900}],
+        ext: {'shopping-cart-pro': {downloads: [{productId: 'ebook'}]}}}),
+    // Takeaway, delivered.
+    order(3, {paidAt: '2026-10-03T18:00:00Z', ref: 'takeaway:abc', delivery: 'ship', lines: [{productId: '', custom: true, qty: 1, lineTotal: 1900}],
+        adjustments: [{stage: 'shipping', amount: 250}]}),
+    // Paid 4 Oct, refunded 9 Oct.
+    order(4, {status: 'refunded', paidAt: '2026-10-04T12:00:00Z', refundedAt: '2026-10-09T09:00:00Z', lines: [{productId: 'mug', qty: 1, lineTotal: 1000}]}),
+    // Never paid: not a sale.
+    order(5, {status: 'pending', paidAt: '2026-10-05T12:00:00Z', lines: [{productId: 'mug', qty: 1, lineTotal: 1000}]}),
+    // Another add-on's sale (Cards Pro credits).
+    order(6, {paidAt: '2026-10-06T12:00:00Z', ref: 'purchase-9', provider: 'free', lines: [{productId: 'credits', qty: 1, lineTotal: 0}]})
+];
+
+test('sales: dates in the shop\'s zone, periods, ranges', () => {
+    assert.equal(dateIn('2026-10-01T23:10:00Z', 'Europe/London'), '2026-10-02');
+    assert.equal(dateIn('2026-10-01T23:10:00Z', 'UTC'), '2026-10-01');
+    assert.equal(periodOf('2026-10-08', 'week'), '2026-10-05', 'weeks start on Monday');
+    assert.equal(periodOf('2026-10-08', 'month'), '2026-10-01');
+    assert.deepEqual(periodsBetween('2026-09-28', '2026-10-12', 'week'), ['2026-09-28', '2026-10-05', '2026-10-12']);
+    assert.deepEqual(periodsBetween('2026-11-15', '2027-01-02', 'month'), ['2026-11-01', '2026-12-01', '2027-01-01']);
+    assert.deepEqual(rangeFor('lastmonth', '2026-10-12'), {from: '2026-09-01', to: '2026-09-30'});
+    assert.deepEqual(rangeFor('week', '2026-10-12'), {from: '2026-10-12', to: '2026-10-12'});
+    assert.deepEqual(rangeFor('last7', '2026-10-12'), {from: '2026-10-06', to: '2026-10-12'});
+});
+
+test('sales: sources, figures, refunds on their own day, payment methods', () => {
+    assert.deepEqual(ORDERS.slice(0, 3).map(o => sourceOf(o, o.data.lines[0])), ['shop', 'downloads', 'takeaway']);
+    assert.equal(sourceOf(ORDERS[5], ORDERS[5].data.lines[0]), 'addons');
+    const r = salesReport(ORDERS, {from: '2026-10-01', to: '2026-10-12', by: 'day'});
+    assert.equal(r.totals.orders, 5, 'the unpaid one is not a sale');
+    assert.equal(r.totals.takings, 2195 + 900 + 2150 + 1000 + 0);
+    assert.deepEqual([r.totals.discount, r.totals.delivery, r.totals.taxIncluded, r.totals.refunds, r.totals.refundCount], [200, 645, 366, 1000, 1]);
+    assert.equal(r.totals.net, r.totals.takings - 1000);
+    const src = Object.fromEntries(r.sources.map(s => [s.key, s.amount]));
+    assert.deepEqual(src, {shop: 3000, downloads: 900, takeaway: 1900, addons: 0});
+    assert.deepEqual(r.takeaway, {collect: 0, deliver: 1});
+    assert.equal(r.methods[0].key, 'stripe');
+    const day = (d) => r.periods.find(p => p.period === d);
+    assert.equal(day('2026-10-01').takings, 2195);
+    assert.equal(day('2026-10-02').takings, 900, 'paid after midnight in London');
+    assert.equal(day('2026-10-09').refunds, 1000);
+    assert.equal(r.periods.length, 12, 'empty days are there too');
+    // A range that holds only the refund: no sale, the refund still counts.
+    const later = salesReport(ORDERS, {from: '2026-10-08', to: '2026-10-10'});
+    assert.deepEqual([later.totals.orders, later.totals.refunds, later.totals.net], [0, 1000, -1000]);
+});
+
+test('sales: the CSV, one row per order, quoted where it must be', () => {
+    const csv = salesCsv([...ORDERS, order(7, {paidAt: '2026-10-07T12:00:00Z', lines: [{productId: 'x', qty: 1, lineTotal: 500}]})].map(o => (o.id === 'o7' ? {...o, data: {...o.data, customer: {name: 'Smith, "Jo"'}}} : o)),
+        {from: '2026-10-01', to: '2026-10-12'});
+    const rows = csv.trim().split('\r\n');
+    assert.equal(rows[0].split(',')[0], 'Order');
+    assert.equal(rows.length, 1 + 6);
+    assert.ok(rows.some(r => r.startsWith('#1001,2026-10-01,paid,,Shop,Card (Stripe),Customer 1,20.00,2.00,3.95,0.00,3.66,21.95')));
+    assert.ok(rows.some(r => r.includes('"Smith, ""Jo"""')));
+    assert.ok(rows.some(r => r.startsWith('#1004,2026-10-04,refunded,2026-10-09')));
+});

package/plugins/support/CLAUDE.md

@@ -76,3 +76,9 @@ manager also "Quote in reply").
 
 Site: new replies (`info`), else open requests as an inventory. Manager: requests waiting on Domma,
 `danger` while any is urgent, `attention` otherwise; nothing waiting = every request, inventory.
+
+## 1.1.2 (2026-10-13 Tool sweep hygiene)
+
+- `docs/guide.md` added (the Documentation > Plugins page Feedback already had). The manifest entry carries
+  `?v=1.1.2` and `V = '1.1.2'` loads the sub-views - bump both with the version. lib/receiver.js header corrected
+  (fleet tokens are on disk since 2026-10-04).

package/plugins/support/admin/views/support.js

@@ -14,7 +14,7 @@
 import {api, loadKit} from '../lib/kit.js';
 
 const ROUTE = /^#\/plugins\/support(\/|$)/;
-const V = '1.1.0';
+const V = '1.1.2';
 let lifetime = null;
 
 export const supportView = {

package/plugins/support/docs/guide.md

@@ -0,0 +1,90 @@
+---
+title: Guide
+order: 1
+---
+
+Support gets you help from Domma without leaving your admin: our email, phone and hours are always to hand, and a request is a conversation with the Domma team. It is free, on every site.
+
+## What it does
+
+- Shows the **contact card**: Domma's email, phone, hours and how quickly to expect an answer.
+- Sends a request to the Domma team with your name, your site and its CMS version attached, and shows Domma's replies underneath it, newest at the bottom.
+- Tells you when Domma replies, and lets you write back in the same request.
+- Keeps a request safe if Domma cannot be reached, and sends it as soon as it can.
+
+## Getting started
+
+1. Open [Support](#/plugins/support) from the admin sidebar.
+2. Click **Ask for help**.
+3. Pick **What is it about?**: I need help with something, Something is not working, Billing or my account, or Something else.
+4. Type a **Subject** (one line) and your **Message**.
+5. Choose **Normal** (we answer in order, usually within a working day) or **Urgent** (your site is down, or you cannot take orders, bookings or payments).
+6. Optional: fill in **Where** - the screen or page it is about, for example "Pages" or `/contact`.
+7. Click **Send**.
+
+For something that is not working, say what you did, what you expected and what happened instead.
+
+## Screens
+
+### Requests
+
+Each row shows the subject, when it was last written to, and a status:
+
+| Status | Meaning |
+|---|---|
+| Waiting on Domma | Domma has it and has not replied yet |
+| Domma replied | There is a reply - it is your turn |
+| Resolved | Finished. Writing again reopens it |
+| Waiting to send | Domma could not be reached yet; it goes automatically |
+
+A dot on a row means a new reply. Click a row to read the conversation and **Reply**. Right-click a row (or use the row's menu) to **Archive**, **Resolve** or **Remove** it:
+
+- **Archive** tidies a request away under **Archived**. It comes back by itself if Domma writes to it.
+- **Resolve** closes it. You can still write to it, which reopens it.
+- **Remove** takes it off your screen. Domma keeps its copy. Removing a request that has not reached Domma yet cancels it.
+
+### Not connected
+
+If the screen offers the contact card only and says to email us, your site was not started by a Domma server, so there is nowhere to send a request to. Email or phone us instead.
+
+## Settings
+
+There is no settings screen. Whoever runs the site can change one option in the plugin's configuration file:
+
+| Option | Default | Meaning |
+|---|---|---|
+| `syncMinutes` | 5 | How often the site sends waiting requests and checks for replies |
+
+Opening the Support screen also sends anything waiting and checks for replies straight away. The contact card is set by Domma and arrives with the first sync.
+
+## Notifications
+
+When Domma replies, you get an admin notification with the request's subject. The sidebar badge counts replies you have not opened; opening the request clears it. With nothing new, the badge shows how many requests are waiting on Domma.
+
+## Permissions and roles
+
+In System > Roles, Support appears in the **Plugins** group:
+
+| Action | Label | Allows |
+|---|---|---|
+| `support.send` | Send | Ask Domma for help and see this site's requests |
+| `support.manage` | Manage | Only used on the Domma server (see below) |
+
+Only the **admin** role has them by default. Everyone with **Send** sees every request the site has sent, not just their own.
+
+## On the Domma server
+
+On the Domma server itself (the Manager), the same screen is the **Inbox** of every site's requests, for holders of **Support > Manage**:
+
+- Filter by **Open**, **Answered**, **Resolved**, **Archived** or **All**, urgent first; search subject, text, person and site.
+- Open a request to read the conversation, **Reply** (the site sees it and is notified, and the person is emailed), **Resolve**, change its priority, and keep **Internal notes** (never sent to the site).
+- Right-click a row to archive, resolve or **Delete** it. Archiving is Domma's own filing: the site does not see it, and a request comes out of the archive when the customer writes again.
+- A new request or a customer's reply is emailed to the Domma support address, with the customer as Reply-To and `[URGENT]` in the subject when it is urgent.
+
+## Limitations
+
+- Only sites started by a Domma server can send. A standalone install gets the contact card only.
+- No attachments or screenshots. Describe the problem in words, and use **Where** for the page.
+- Subjects are limited to 140 characters and messages to 8,000.
+- The Domma server accepts up to 20 requests and replies from one site in 10 minutes. Any more show as **Waiting to send** and go later.
+- You cannot edit or withdraw a message once sent. Write a follow-up instead.

package/plugins/support/lib/receiver.js

@@ -6,7 +6,7 @@
  * names, emails and words.
  *
  * A site is who its fleet token says it is (site-manager/services/fleetTokens.js,
- * memory only, minted when the manager forked it). That module only exists where
+ * minted when the manager forked it and kept in site-manager/data/fleet-tokens.json). That module only exists where
  * Site Manager does, which is also how this plugin knows it is on the manager.
  *
  * @module support/lib/receiver

package/plugins/support/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "support",
   "displayName": "Support",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "tier": "free",
   "description": "Get help from Domma straight from your admin: our email, phone and hours always to hand, and a conversation with the Domma team for anything you need - urgent requests first. Right-click a request to archive, resolve or remove it.",
   "author": "Domma CMS",
-  "date": "2026-10-04",
+  "date": "2026-10-13",
   "icon": "headphones",
   "permissions": [
     {
@@ -61,7 +61,7 @@
     ],
     "views": {
       "plugin-support": {
-        "entry": "support/admin/views/support.js",
+        "entry": "support/admin/views/support.js?v=1.1.2",
         "exportName": "supportView"
       }
     }