includio-cms 0.36.9 → 0.37.0

package/dist/db-postgres/schema/booking/bookingPersons.js

@@ -0,0 +1,17 @@
+import { jsonb, pgTable, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { bookingsTable } from './bookings.js';
+/**
+ * A real person on a booking. Holds identity fields (name, date of birth — the
+ * role:name / role:birthDate participant fields) ONCE, shared across every trip
+ * they take. Per-trip answers live on `booking_item_persons`.
+ */
+export const bookingPersonsTable = pgTable('booking_persons', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    bookingId: uuid('booking_id')
+        .notNull()
+        .references(() => bookingsTable.id, { onDelete: 'cascade' }),
+    /** Identity custom-field answers (name, date of birth, …). */
+    data: jsonb('data').$type().notNull().default({}),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull()
+});

package/dist/db-postgres/schema/booking/bookingReminders.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Scheduled email reminders (balance-due, pre-departure, …). A scheduler queries
+ * rows where `scheduledFor <= now AND sentAt IS NULL`, sends, then stamps
+ * `sentAt` — idempotent.
+ */
+export declare const bookingRemindersTable: import("drizzle-orm/pg-core/table", { with: { "resolution-mode": "require" } }).PgTableWithColumns<{
+    name: "booking_reminders";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "id";
+            tableName: "booking_reminders";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        bookingId: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "booking_id";
+            tableName: "booking_reminders";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        type: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "type";
+            tableName: "booking_reminders";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        templateKey: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "template_key";
+            tableName: "booking_reminders";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scheduledFor: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "scheduled_for";
+            tableName: "booking_reminders";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sentAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "sent_at";
+            tableName: "booking_reminders";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "created_at";
+            tableName: "booking_reminders";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/db-postgres/schema/booking/bookingReminders.js

@@ -0,0 +1,18 @@
+import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { bookingsTable } from './bookings.js';
+/**
+ * Scheduled email reminders (balance-due, pre-departure, …). A scheduler queries
+ * rows where `scheduledFor <= now AND sentAt IS NULL`, sends, then stamps
+ * `sentAt` — idempotent.
+ */
+export const bookingRemindersTable = pgTable('booking_reminders', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    bookingId: uuid('booking_id')
+        .notNull()
+        .references(() => bookingsTable.id, { onDelete: 'cascade' }),
+    type: text('type').notNull(),
+    templateKey: text('template_key').notNull(),
+    scheduledFor: timestamp('scheduled_for', { withTimezone: true }).notNull(),
+    sentAt: timestamp('sent_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull()
+});

package/dist/db-postgres/schema/booking/bookings.d.ts

@@ -0,0 +1,307 @@
+import type { BookingStatus } from '../../../booking/state-machine.js';
+import type { AppliedRule, Perk } from '../../../booking/pricing.js';
+/** Computed money snapshot kept on the booking for fast list/detail reads. */
+export interface BookingTotals {
+    gross: number;
+    discount: number;
+    /** Σ active manual surcharges (minor units). */
+    surcharge: number;
+    /** Σ active manual discounts, magnitude (minor units). */
+    manualDiscount: number;
+    paid: number;
+    balance: number;
+    /** Granted non-monetary perks (staff notes; manual fulfilment). */
+    perks: Perk[];
+    /** Per-rule discount breakdown for display. */
+    appliedRules: AppliedRule[];
+}
+/**
+ * A long-lived, mutable reservation with a payment ledger. Unlike a shop order
+ * ("buy → ship → done"), a booking is edited after payment and its price is
+ * recomputed. Amounts are in minor units.
+ */
+export declare const bookingsTable: import("drizzle-orm/pg-core/table", { with: { "resolution-mode": "require" } }).PgTableWithColumns<{
+    name: "bookings";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "id";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        number: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "number";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "status";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: BookingStatus;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: BookingStatus;
+        }>;
+        currency: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "currency";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        customer: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "customer";
+            tableName: "bookings";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        totals: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "totals";
+            tableName: "bookings";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: BookingTotals;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: BookingTotals;
+        }>;
+        accessToken: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "access_token";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        staffNotes: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "staff_notes";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        language: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "language";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        balanceDueAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "balance_due_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        holdExpiresAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "hold_expires_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        cancelReason: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "cancel_reason";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "deleted_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        deletedBy: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "deleted_by";
+            tableName: "bookings";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "created_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core", { with: { "resolution-mode": "require" } }).PgColumn<{
+            name: "updated_at";
+            tableName: "bookings";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/db-postgres/schema/booking/bookings.js

@@ -0,0 +1,40 @@
+import { jsonb, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+/**
+ * A long-lived, mutable reservation with a payment ledger. Unlike a shop order
+ * ("buy → ship → done"), a booking is edited after payment and its price is
+ * recomputed. Amounts are in minor units.
+ */
+export const bookingsTable = pgTable('bookings', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    number: text('number').notNull().unique(),
+    status: text('status').$type().notNull().default('draft'),
+    currency: text('currency').notNull(),
+    /** Booker details (name, email, phone, "how did you hear about us", …). */
+    customer: jsonb('customer').$type().notNull().default({}),
+    /** Computed totals (gross/discount/paid/balance), refreshed on every edit. */
+    totals: jsonb('totals').$type().notNull().default({
+        gross: 0,
+        discount: 0,
+        surcharge: 0,
+        manualDiscount: 0,
+        paid: 0,
+        balance: 0,
+        perks: [],
+        appliedRules: []
+    }),
+    /** Unguessable token for the self-service portal (`/rezerwacja/[token]`). */
+    accessToken: uuid('access_token').defaultRandom().notNull(),
+    staffNotes: text('staff_notes'),
+    language: text('language'),
+    /** Deadline to pay the balance; past it with balance>0 ⇒ auto-cancel + deposit forfeited. */
+    balanceDueAt: timestamp('balance_due_at', { withTimezone: true }),
+    /** TTL for an abandoned draft (deposit never paid) ⇒ auto-cancel. Cleared on deposit payment. */
+    holdExpiresAt: timestamp('hold_expires_at', { withTimezone: true }),
+    /** Why a booking was cancelled: 'abandoned' | 'balance_overdue' | 'manual'. */
+    cancelReason: text('cancel_reason'),
+    // Soft-delete (accounting/audit safety) — NULL = visible.
+    deletedAt: timestamp('deleted_at', { withTimezone: true }),
+    deletedBy: text('deleted_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull()
+});

package/dist/db-postgres/schema/booking/index.d.ts

@@ -0,0 +1,7 @@
+export * from './bookings.js';
+export * from './bookingItems.js';
+export * from './bookingPersons.js';
+export * from './bookingItemPersons.js';
+export * from './bookingPayments.js';
+export * from './bookingReminders.js';
+export * from './bookingAdjustments.js';

package/dist/db-postgres/schema/booking/index.js

@@ -0,0 +1,7 @@
+export * from './bookings.js';
+export * from './bookingItems.js';
+export * from './bookingPersons.js';
+export * from './bookingItemPersons.js';
+export * from './bookingPayments.js';
+export * from './bookingReminders.js';
+export * from './bookingAdjustments.js';

package/dist/db-postgres/schema/index.d.ts

@@ -9,3 +9,4 @@ export * from './imageStyle.js';
 export * from './videoStyle.js';
 export * from './mediaJob.js';
 export * from './shop/index.js';
+export * from './booking/index.js';

package/dist/db-postgres/schema/index.js

@@ -9,3 +9,4 @@ export * from './imageStyle.js';
 export * from './videoStyle.js';
 export * from './mediaJob.js';
 export * from './shop/index.js';
+export * from './booking/index.js';

package/dist/db-postgres/schema-booking.d.ts

@@ -0,0 +1 @@
+export * from './schema/booking/index.js';

package/dist/db-postgres/schema-booking.js

@@ -0,0 +1 @@
+export * from './schema/booking/index.js';

package/dist/server/security/rate-limit-handler.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Per-handler in-memory rate limiter (fixed window). Generic infra shared by the
+ * shop and booking HTTP handlers — not shop-specific. For a single instance this
+ * needs no external store; multi-instance deployments would swap the bucket map
+ * for a shared store.
+ */
+/** A fixed-window rule: at most `limit` hits per `windowSec` seconds. */
+export interface RateLimitRule {
+    limit: number;
+    windowSec: number;
+}
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetAt: number;
+}
+export declare function checkRateLimit(key: string, rule: RateLimitRule): RateLimitResult;
+export declare function resetRateLimit(key?: string): void;
+export declare function clientKey(req: Request, prefix: string): string;

package/dist/server/security/rate-limit-handler.js

@@ -0,0 +1,34 @@
+/**
+ * Per-handler in-memory rate limiter (fixed window). Generic infra shared by the
+ * shop and booking HTTP handlers — not shop-specific. For a single instance this
+ * needs no external store; multi-instance deployments would swap the bucket map
+ * for a shared store.
+ */
+const buckets = new Map();
+export function checkRateLimit(key, rule) {
+    const now = Date.now();
+    const windowMs = rule.windowSec * 1000;
+    const bucket = buckets.get(key);
+    if (!bucket || bucket.resetAt <= now) {
+        const fresh = { count: 1, resetAt: now + windowMs };
+        buckets.set(key, fresh);
+        return { allowed: true, remaining: rule.limit - 1, resetAt: fresh.resetAt };
+    }
+    if (bucket.count >= rule.limit) {
+        return { allowed: false, remaining: 0, resetAt: bucket.resetAt };
+    }
+    bucket.count += 1;
+    return { allowed: true, remaining: rule.limit - bucket.count, resetAt: bucket.resetAt };
+}
+export function resetRateLimit(key) {
+    if (key)
+        buckets.delete(key);
+    else
+        buckets.clear();
+}
+export function clientKey(req, prefix) {
+    const ip = req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ||
+        req.headers.get('x-real-ip') ||
+        'unknown';
+    return `${prefix}:${ip}`;
+}

package/dist/shop/adapters/payu/client.js

@@ -52,7 +52,9 @@ export class PayuClient {
         });
         // PayU returns 302 by default with a JSON body (manual redirect is used to read it).
         if (res.status !== 302 && !res.ok) {
-            throw new Error(`PayU createOrder failed: ${res.status}`);
+            // Surface PayU's error body (e.g. ERROR_ORDER_NOT_UNIQUE) — don't swallow it.
+            const detail = await res.text().catch(() => '');
+            throw new Error(`PayU createOrder failed: ${res.status}${detail ? ` — ${detail}` : ''}`);
         }
         const data = (await res.json());
         if (data.status && data.status.statusCode && data.status.statusCode !== 'SUCCESS') {