orionplace-nuxt 0.1.3 → 0.2.0

package/bin/orionplace-nuxt.mjs

@@ -7,6 +7,19 @@ import { createInterface } from 'node:readline/promises';
 
 const help = `Orionplace Nuxt setup
 
+From zero (Node.js 22.12+ with npm; run from the parent folder):
+  npx --yes orionplace-nuxt init my-marketplace
+  cd my-marketplace
+  npm install
+  npx orionplace-nuxt set backend your-project.orionplace.app
+  npx orionplace-nuxt add frontend shop.example.com
+  npm run dev
+
+Replace the backend with the domain from your orionmarket.place profile,
+and the frontend with your storefront domain. Open Nuxt's local URL;
+the storefront opens after Application Load succeeds.
+
+Commands for an existing project (run from its root):
   npx orionplace-nuxt help
   npx orionplace-nuxt init [directory]
   npx orionplace-nuxt update
@@ -36,9 +49,9 @@ try {
     console.log(JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')).version);
   } else {
     const positional = [];
-    let cwd = process.cwd();
-    let dryRun = false;
-    let local = false;
+    let cwd          = process.cwd();
+    let dryRun       = false;
+    let local        = false;
     for (let index = 0; index < argv.length; index++) {
       if (argv[index] === '--dry-run') dryRun = true;
       else if (argv[index] === '--local') local = true;

package/package.json

@@ -1,16 +1,29 @@
 {
   "name": "orionplace-nuxt",
-  "version": "0.1.3",
-  "description": "Nuxt integration and setup CLI for your Orionplace personal marketplace backend.",
+  "version": "0.2.0",
+  "description": "Nuxt 4 storefront for your Orionplace marketplace: setup CLI, server API gateway, typed store and ready-made catalog, cart, checkout and account components in English and Russian, plus an Android app build.",
   "type": "module",
   "license": "MIT",
   "author": "Orionplace",
-  "homepage": "https://orionmarket.place/sandbox/backend-domain/nuxt",
+  "homepage": "https://orionmarket.place/en/sandbox/new-project/nuxt",
   "keywords": [
     "nuxt",
+    "nuxt4",
     "nuxt-module",
+    "vue",
     "orionplace",
-    "marketplace"
+    "orionmarketplace",
+    "marketplace",
+    "storefront",
+    "ecommerce",
+    "e-commerce",
+    "shop",
+    "cart",
+    "checkout",
+    "ssr",
+    "cli",
+    "android",
+    "capacitor"
   ],
   "engines": {
     "node": ">=22.12.0"
@@ -36,7 +49,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --experimental-strip-types --test test/*.test.mjs"
+    "test": "node --experimental-strip-types --import ../../scripts/register-test-aliases.mjs --test test/*.test.mjs"
   },
   "peerDependencies": {
     "nuxt": "^4.0.0"
@@ -44,10 +57,16 @@
   "dependencies": {
     "@nuxt/kit": "^4.5.0",
     "h3": "^1.15.4",
-    "magicast": "^0.5.0"
+    "magicast": "^0.5.0",
+    "@tailwindcss/vite": "^4.3.3",
+    "tailwindcss": "^4.3.3"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "pinia": "^4.0.2",
+    "vue": "^3.5.0"
   }
 }

package/runtime/api.mjs

@@ -1,11 +1,14 @@
 // All browser and SSR /api requests use this gateway.
+// It also serves guarded blog media under /ps3/blog.
 import { defineEventHandler, toWebRequest, sendWebResponse } from 'h3';
 import { useRuntimeConfig } from '#imports';
 import { forwardMarketplace } from './marketplace.mjs';
 
 export default defineEventHandler(async (event) => {
   const response = await forwardMarketplace(toWebRequest(event), {
-    mimicFrontDomain: process.env.MIMIC_FRONT_DOMAIN ?? useRuntimeConfig(event).mimicFrontDomain,
+    mimicFrontDomain:
+      process.env.MIMIC_FRONT_DOMAIN ??
+      useRuntimeConfig(event).mimicFrontDomain,
   });
   return sendWebResponse(event, response);
 });

package/runtime/domain.mjs

@@ -4,6 +4,8 @@ import { useRuntimeConfig } from '#imports';
 import { resolveFrontDomain } from './marketplace.mjs';
 
 export default defineEventHandler((event) => {
-  event.context.marketplaceDomain = resolveFrontDomain(toWebRequest(event),
-    process.env.MIMIC_FRONT_DOMAIN ?? useRuntimeConfig(event).mimicFrontDomain);
+  event.context.marketplaceDomain = resolveFrontDomain(
+    toWebRequest(event),
+    process.env.MIMIC_FRONT_DOMAIN ?? useRuntimeConfig(event).mimicFrontDomain,
+  );
 });

package/runtime/marketplace.mjs

@@ -1,211 +1,287 @@
-import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import { isIP } from 'node:net';
-
-const environment = process.env;
-
-const hostnamePattern =
-	/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-
-/** @param {unknown} value */
-export function normalizeFrontDomain(value) {
-	if (typeof value !== 'string') return null;
-	const domain = value.split(',')[0].trim().toLowerCase().replace(/\.$/, '');
-	return hostnamePattern.test(domain) && !isIP(domain) ? domain : null;
-}
-
-/** @param {Request} request @param {string} mimic */
-export function resolveFrontDomain(
-	request,
-	mimic = environment.MIMIC_FRONT_DOMAIN || '',
-) {
-	// The hosting proxy must overwrite these headers. Public hosts win over MIMIC.
-	for (const candidate of [
-		request.headers.get('x-front-domain'),
-		request.headers.get('x-forwarded-host'),
-		request.headers.get('host'),
-		new URL(request.url).hostname,
-	]) {
-		const domain = normalizeFrontDomain(candidate);
-		if (domain) return domain;
-	}
-	return normalizeFrontDomain(mimic);
-}
-
-/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
-export async function readMarketplace(request, configuration = {}) {
-	const domain = resolveFrontDomain(request, configuration.mimicFrontDomain);
-	if (!domain) throw new Error('Invalid storefront domain');
-
-	const directory = environment.SITEMAPS_DIR || resolve('sitemaps');
-	const source = await readFile(resolve(directory, `${domain}.cfg`), 'utf8');
-	const lines = source
-		.split(/\r?\n/)
-		.map((line) => line.trim())
-		.filter((line) => line && !line.startsWith('#'));
-	if (lines.length !== 1) throw new Error('Expected one API URL');
-	const value = lines[0];
-	const api = new URL(value.includes('://') ? value : `https://${value}`);
-	api.pathname = api.pathname.replace(/\/+$/, '');
-	if (
-		api.protocol !== 'https:' ||
-		!hostnamePattern.test(api.hostname) ||
-		!api.hostname.endsWith('.orionplace.app') ||
-		isIP(api.hostname) ||
-		api.port ||
-		api.username ||
-		api.password ||
-		api.search ||
-		api.hash ||
-		api.pathname !== '/api'
-	) {
-		throw new Error('Expected https://<project>.orionplace.app/api');
-	}
-	return { domain, api };
-}
-
-/** @param {number} status @param {string} message */
-function failure(status, message) {
-	return Response.json(
-		{ error: message },
-		{
-			status,
-			headers: {
-				'Cache-Control': 'no-store',
-				'Vary': 'Host, X-Forwarded-Host, X-Front-Domain',
-			},
-		},
-	);
-}
-
-/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
-export async function forwardMarketplace(request, configuration = {}) {
-	let tenant;
-	try {
-		tenant = await readMarketplace(request, configuration);
-	} catch {
-		return failure(
-			503,
-			'Storefront domain configuration is missing or invalid',
-		);
-	}
-
-	const incoming = new URL(request.url);
-	if (!incoming.pathname.startsWith('/api/'))
-		return failure(404, 'Unknown API path');
-	// Prevent encoded separators or traversal from escaping the /api namespace.
-	let path;
-	try {
-		path = decodeURIComponent(incoming.pathname);
-	} catch {
-		return failure(400, 'Invalid API path');
-	}
-	if (
-		path.includes('\\') ||
-		/%(?:2e|2f|5c)/i.test(path) ||
-		path.split('/').some((part) => part === '.' || part === '..')
-	) {
-		return failure(400, 'Invalid API path');
-	}
-	const target = new URL(
-		incoming.pathname + incoming.search,
-		tenant.api.origin,
-	);
-	if (!target.pathname.startsWith('/api/'))
-		return failure(400, 'Invalid API path');
-
-	const origin = request.headers.get('origin');
-	const publicHost = request.headers.get('host') || incoming.host;
-	const originHosts = [publicHost, tenant.domain];
-	if (!['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
-		try {
-			if (
-				request.headers.get('sec-fetch-site') === 'cross-site' ||
-				(origin && !originHosts.includes(new URL(origin).host))
-			) {
-				return failure(403, 'Cross-site API request rejected');
-			}
-		} catch {
-			return failure(403, 'Invalid Origin');
-		}
-	}
-
-	// An allowlist excludes hop-by-hop and client-supplied routing headers.
-	const headers = new Headers();
-	for (const name of [
-		'accept',
-		'content-type',
-		'authorization',
-		'cookie',
-		'origin',
-		'referer',
-		'x-csrftoken',
-		'accept-language',
-		'user-agent',
-		'x-tz',
-	]) {
-		const value = request.headers.get(name);
-		if (value) headers.set(name, value);
-	}
-	headers.set('X-Front-Domain', tenant.domain);
-	headers.set('Accept-Encoding', 'identity');
-	const clientIp =
-		request.headers.get('x-init-ip') ||
-		request.headers.get('x-real-ip') ||
-		request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();
-	if (clientIp) headers.set('X-Init-Ip', clientIp);
-	/** @type {RequestInit & { duplex: 'half' }} */
-	const options = {
-		method: request.method,
-		headers,
-		redirect: 'manual',
-		cache: 'no-store',
-		signal: AbortSignal.any([request.signal, AbortSignal.timeout(30_000)]),
-		duplex: 'half',
-	};
-	if (!['GET', 'HEAD'].includes(request.method)) options.body = request.body;
-
-	let upstream;
-	try {
-		upstream = await fetch(target, options);
-	} catch {
-		return failure(502, 'Marketplace backend is unavailable');
-	}
-
-	const responseHeaders = new Headers();
-	for (const name of [
-		'content-type',
-		'content-disposition',
-		'www-authenticate',
-		'retry-after',
-		'allow',
-	]) {
-		const value = upstream.headers.get(name);
-		if (value) responseHeaders.set(name, value);
-	}
-	// Keep each cookie separate; remove the backend Domain attribute only.
-	for (const cookie of upstream.headers.getSetCookie()) {
-		responseHeaders.append(
-			'Set-Cookie',
-			cookie.replace(/;\s*Domain=[^;]*/gi, ''),
-		);
-	}
-	const location = upstream.headers.get('location');
-	if (location) {
-		const destination = new URL(location, target);
-		responseHeaders.set(
-			'Location',
-			destination.origin === tenant.api.origin
-				? destination.pathname + destination.search + destination.hash
-				: destination.href,
-		);
-	}
-	responseHeaders.set('Cache-Control', 'no-store');
-	responseHeaders.set('Vary', 'Host, X-Forwarded-Host, X-Front-Domain');
-	// fetch decodes compressed bodies: do not reuse upstream Content-Length/Encoding.
-	return new Response(upstream.body, {
-		status: upstream.status,
-		statusText: upstream.statusText,
-		headers: responseHeaders,
-	});
-}
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import {
+  getDefaultAutoSelectFamilyAttemptTimeout,
+  isIP,
+  setDefaultAutoSelectFamilyAttemptTimeout,
+} from 'node:net';
+
+const environment     = process.env;
+
+// Node gives each resolved backend address 250 ms to connect before it moves
+// on. Over slower links (VPNs, distant regions) every attempt can expire, and
+// the request fails although the backend is reachable. Allow more time per
+// address; a longer value already chosen by the application is kept.
+const connectTimeout  = 2_000;
+if (getDefaultAutoSelectFamilyAttemptTimeout() < connectTimeout) {
+  setDefaultAutoSelectFamilyAttemptTimeout(connectTimeout);
+}
+
+// A backend answer may take up to 30 seconds. A file upload (multipart form:
+// review photos, cart option files, ticket attachments) also has to send the
+// file first; at 3 Mbit/s a 10 MB file alone takes about 30 seconds, so
+// uploads get 5 minutes.
+const requestTimeout  = 30_000;
+const uploadTimeout   = 300_000;
+
+/** @param {Request} request */
+export function marketplaceRequestTimeout(request) {
+  const contentType = request.headers.get('content-type') ?? '';
+
+  return contentType.toLowerCase().startsWith('multipart/form-data')
+    ? uploadTimeout
+    : requestTimeout;
+}
+
+const hostnamePattern =
+  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+// Blog media is served outside /api by the backend's guarded /ps3 routes.
+// Only these read-only paths are forwarded; other /ps3 files stay private.
+const blogMediaPattern =
+  /^\/ps3\/blog\/posts\/(?:images\/\d+|videos\/\d+(?:\/preview)?)$/;
+
+/** @param {string} pathname */
+export function isMarketplaceMediaPath(pathname) {
+  return blogMediaPattern.test(pathname);
+}
+
+/** @param {unknown} value */
+export function normalizeFrontDomain(value) {
+  if (typeof value !== 'string') {
+    return null;
+  }
+  const domain = value.split(',')[0].trim().toLowerCase().replace(/\.$/, '');
+  return hostnamePattern.test(domain) && !isIP(domain) ? domain : null;
+}
+
+/** @param {Request} request @param {string} mimic */
+export function resolveFrontDomain(
+  request,
+  mimic = environment.MIMIC_FRONT_DOMAIN || '',
+) {
+  // The hosting proxy must overwrite these headers. Public hosts win over MIMIC.
+  for (const candidate of [
+    request.headers.get('x-front-domain'),
+    request.headers.get('x-forwarded-host'),
+    request.headers.get('host'),
+    new URL(request.url).hostname,
+  ]) {
+    const domain = normalizeFrontDomain(candidate);
+    if (domain) {
+      return domain;
+    }
+  }
+  return normalizeFrontDomain(mimic);
+}
+
+/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
+export async function readMarketplace(request, configuration = {}) {
+  const domain    = resolveFrontDomain(request, configuration.mimicFrontDomain);
+  if (!domain) {
+    throw new Error('Invalid storefront domain');
+  }
+
+  const directory = environment.SITEMAPS_DIR || resolve('sitemaps');
+  const source    = await readFile(resolve(directory, `${domain}.cfg`), 'utf8');
+  const lines     = source
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith('#'));
+  if (lines.length !== 1) {
+    throw new Error('Expected one API URL');
+  }
+  const value     = lines[0];
+  const api       = new URL(value.includes('://') ? value : `https://${value}`);
+  api.pathname    = api.pathname.replace(/\/+$/, '');
+  if (
+    api.protocol !== 'https:' ||
+    !hostnamePattern.test(api.hostname) ||
+    !api.hostname.endsWith('.orionplace.app') ||
+    isIP(api.hostname) ||
+    api.port ||
+    api.username ||
+    api.password ||
+    api.search ||
+    api.hash ||
+    api.pathname !== '/api'
+  ) {
+    throw new Error('Expected https://<project>.orionplace.app/api');
+  }
+  return { domain, api };
+}
+
+/** @param {number} status @param {string} message */
+function failure(status, message) {
+  return Response.json(
+    { error: message },
+    {
+      status,
+      headers: {
+        'Cache-Control': 'no-store',
+        'Vary': 'Host, X-Forwarded-Host, X-Front-Domain',
+      },
+    },
+  );
+}
+
+/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
+export async function forwardMarketplace(request, configuration = {}) {
+  let tenant;
+  try {
+    tenant = await readMarketplace(request, configuration);
+  } catch {
+    return failure(
+      503,
+      'Storefront domain configuration is missing or invalid',
+    );
+  }
+
+  const incoming        = new URL(request.url);
+  const media           = isMarketplaceMediaPath(incoming.pathname);
+  if (!incoming.pathname.startsWith('/api/') && !media) {
+    return failure(404, 'Unknown API path');
+  }
+  if (media && !['GET', 'HEAD'].includes(request.method)) {
+    return failure(405, 'Media is read-only');
+  }
+  // Prevent encoded separators or traversal from escaping the /api namespace.
+  let path;
+  try {
+    path = decodeURIComponent(incoming.pathname);
+  } catch {
+    return failure(400, 'Invalid API path');
+  }
+  if (
+    path.includes('\\') ||
+    /%(?:2e|2f|5c)/i.test(path) ||
+    path.split('/').some((part) => part === '.' || part === '..')
+  ) {
+    return failure(400, 'Invalid API path');
+  }
+  const target          = new URL(
+    incoming.pathname + incoming.search,
+    tenant.api.origin,
+  );
+  if (
+    media
+      ? !isMarketplaceMediaPath(target.pathname)
+      : !target.pathname.startsWith('/api/')
+  ) {
+    return failure(400, 'Invalid API path');
+  }
+
+  const origin          = request.headers.get('origin');
+  const publicHost      = request.headers.get('host') || incoming.host;
+  const originHosts     = [publicHost, tenant.domain];
+  if (!['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
+    try {
+      if (
+        request.headers.get('sec-fetch-site') === 'cross-site' ||
+        (origin && !originHosts.includes(new URL(origin).host))
+      ) {
+        return failure(403, 'Cross-site API request rejected');
+      }
+    } catch {
+      return failure(403, 'Invalid Origin');
+    }
+  }
+
+  // An allowlist excludes hop-by-hop and client-supplied routing headers.
+  const headers         = new Headers();
+  for (const name of [
+    'accept',
+    'content-type',
+    'authorization',
+    'cookie',
+    'origin',
+    'referer',
+    'x-csrftoken',
+    'accept-language',
+    'user-agent',
+    'x-tz',
+    'range',
+  ]) {
+    const value = request.headers.get(name);
+    if (value) {
+      headers.set(name, value);
+    }
+  }
+  headers.set('X-Front-Domain', tenant.domain);
+  headers.set('Accept-Encoding', 'identity');
+  const clientIp        =
+    request.headers.get('x-init-ip') ||
+    request.headers.get('x-real-ip') ||
+    request.headers.get('x-forwarded-for')?.split(',')[0]?.trim();
+  if (clientIp) {
+    headers.set('X-Init-Ip', clientIp);
+  }
+  /** @type {RequestInit & { duplex: 'half' }} */
+  const options         = {
+    method: request.method,
+    headers,
+    redirect: 'manual',
+    cache: 'no-store',
+    signal: AbortSignal.any([
+      request.signal,
+      AbortSignal.timeout(marketplaceRequestTimeout(request)),
+    ]),
+    duplex: 'half',
+  };
+  if (!['GET', 'HEAD'].includes(request.method)) {
+    options.body = request.body;
+  }
+
+  let upstream;
+  try {
+    upstream = await fetch(target, options);
+  } catch (error) {
+    // The browser receives only the status; keep the cause in the server log.
+    if (!request.signal.aborted) {
+      const cause = error?.cause?.code ?? error?.message ?? String(error);
+      console.error(`[orionplace] Backend request failed: ${cause}`);
+    }
+    return failure(502, 'Marketplace backend is unavailable');
+  }
+
+  const responseHeaders = new Headers();
+  for (const name of [
+    'content-type',
+    'content-disposition',
+    'www-authenticate',
+    'retry-after',
+    'allow',
+    'accept-ranges',
+    'content-range',
+  ]) {
+    const value = upstream.headers.get(name);
+    if (value) {
+      responseHeaders.set(name, value);
+    }
+  }
+  // Keep each cookie separate; remove the backend Domain attribute only.
+  for (const cookie of upstream.headers.getSetCookie()) {
+    responseHeaders.append(
+      'Set-Cookie',
+      cookie.replace(/;\s*Domain=[^;]*/gi, ''),
+    );
+  }
+  const location        = upstream.headers.get('location');
+  if (location) {
+    const destination = new URL(location, target);
+    responseHeaders.set(
+      'Location',
+      destination.origin === tenant.api.origin
+        ? destination.pathname + destination.search + destination.hash
+        : destination.href,
+    );
+  }
+  responseHeaders.set('Cache-Control', 'no-store');
+  responseHeaders.set('Vary', 'Host, X-Forwarded-Host, X-Front-Domain');
+  // fetch decodes compressed bodies: do not reuse upstream Content-Length/Encoding.
+  return new Response(upstream.body, {
+    status: upstream.status,
+    statusText: upstream.statusText,
+    headers: responseHeaders,
+  });
+}

package/src/asset-loading-plugin.mjs

@@ -0,0 +1,10 @@
+export default function assetLoadingPlugin(nitro) {
+  nitro.hooks.hook('render:html', (html) => {
+    html.head = html.head
+      .map((entry) => entry.replace(
+        /<link\b(?=[^>]*\brel=["']prefetch["'])[^>]*>/gi,
+        '',
+      ))
+      .filter(Boolean);
+  });
+}