orionplace-nuxt 0.7.4 → 0.7.6

package/README.md

@@ -468,7 +468,9 @@ authorization and cookies are forwarded. Backend statuses are retained and cooki
 Domain attributes are removed to bind cookies to the storefront. Gateway responses
 use `Cache-Control: no-store`, except public blog images and videos: they keep the
 backend's `private, max-age` rule, so the browser does not download them again on
-every page. Network failures return `502`.
+every page. When the network drops the connection before the backend answers, GET,
+HEAD and Application Load requests are sent once more on a new connection; other
+requests are never repeated. Network failures return `502`.
 
 A changing request (POST, PUT, PATCH, DELETE) from another site is rejected with
 `403`. A request from the page's own host or the storefront domain passes, and the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionplace-nuxt",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Nuxt 4 storefront for your Orionplace marketplace: setup CLI, server API gateway, typed store and ready-made catalog, cart, checkout and account components in English and Russian, plus an Android app build.",
   "type": "module",
   "license": "MIT",

package/runtime/marketplace.mjs

@@ -142,6 +142,74 @@ export function marketplaceConfigDirectory(root = process.cwd()) {
     : resolve(root, 'sitemaps');
 }
 
+// The network can drop a pooled connection to the backend (a reset somewhere
+// between this server and the API host). The request then fails before any
+// answer arrives, so a request that is safe to repeat gets one more try on a
+// new connection instead of a failed page.
+const droppedConnection = new Set([
+  'ECONNRESET',
+  'ECONNABORTED',
+  'EPIPE',
+  'UND_ERR_SOCKET',
+  'UND_ERR_CLOSED',
+]);
+// Application Load only reads, and its body is a small JSON object; a larger
+// body is streamed once without a retry.
+const appLoadPath       = /^\/api\/appload\/?$/;
+const repeatBodyLimit   = 64 * 1024;
+
+/** @param {any} error */
+function connectionDropped(error) {
+  return droppedConnection.has(error?.cause?.code ?? error?.code);
+}
+
+/**
+ * The upstream body and whether the request may be sent twice: GET and HEAD
+ * have no body; Application Load keeps its small body for a second try.
+ * @param {Request} request @param {string} pathname
+ * @returns {Promise<{body: any, repeatable: boolean}>}
+ */
+async function upstreamBody(request, pathname) {
+  if (['GET', 'HEAD'].includes(request.method)) {
+    return { body: undefined, repeatable: true };
+  }
+  if (!request.body || !appLoadPath.test(pathname)) {
+    return { body: request.body, repeatable: false };
+  }
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size     = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) {
+      return { body: Buffer.concat(chunks), repeatable: true };
+    }
+    chunks.push(value);
+    size += value.byteLength;
+    if (size > repeatBodyLimit) {
+      const body = new ReadableStream({
+        start(controller) {
+          for (const chunk of chunks) {
+            controller.enqueue(chunk);
+          }
+        },
+        async pull(controller) {
+          const next = await reader.read();
+          if (next.done) {
+            controller.close();
+          } else {
+            controller.enqueue(next.value);
+          }
+        },
+        cancel(reason) {
+          return reader.cancel(reason);
+        },
+      });
+      return { body, repeatable: false };
+    }
+  }
+}
+
 /** @param {number} status @param {string} message */
 function failure(status, message) {
   return Response.json(
@@ -271,13 +339,23 @@ export async function forwardMarketplace(request, configuration = {}) {
     ]),
     duplex: 'half',
   };
-  if (!['GET', 'HEAD'].includes(request.method)) {
-    options.body = request.body;
-  }
-
   let upstream;
   try {
-    upstream = await fetch(target, options);
+    const { body, repeatable } = await upstreamBody(request, incoming.pathname);
+    if (body !== undefined) {
+      options.body = body;
+    }
+    try {
+      upstream = await fetch(target, options);
+    } catch (error) {
+      if (!repeatable || !connectionDropped(error) || options.signal.aborted) {
+        throw error;
+      }
+      console.warn(
+        `[orionplace] Backend connection dropped (${error?.cause?.code ?? error?.code}), retrying once`,
+      );
+      upstream = await fetch(target, options);
+    }
   } catch (error) {
     // The browser receives only the status; keep the cause in the server log.
     if (!request.signal.aborted) {

package/templates/app/composables/useOrionplaceApi.ts

@@ -73,8 +73,21 @@ function createClients(): OrionplaceClients {
       return nativeAppRequest(appOrigin, path, request);
     }
     let received: OrionplaceApiResponse | undefined;
+    // A server render's own API call copies the visitor's request headers.
+    // A visitor who follows a link from another site arrives with
+    // `Sec-Fetch-Site: cross-site` (and a form post with a foreign Origin);
+    // the gateway's cross-site check would refuse the render's call and the
+    // page would answer 503. The call comes from this server, so it is sent
+    // as same-origin without the visitor's Origin.
     const headers = jar
-      ? { ...request.headers, cookie: jar.header() }
+      ? {
+          ...request.headers,
+          cookie: jar.header(),
+          origin: '',
+          'sec-fetch-site': 'same-origin',
+          'sec-fetch-mode': 'cors',
+          'sec-fetch-dest': 'empty',
+        }
       : request.headers;
 
     await requestFetch<unknown>(path, {

package/templates/app/interfaces/orionplace/subscribes/ISubscriptionApi.ts

@@ -104,6 +104,8 @@ export interface ICustomerSubscription {
   cancelled_date: IApiDateTime | null;
   returned_amount: ICurrencyAmounts;
   c_tickets: number;
+  /** Partner code a trial remembered, while it waits for the first payment; fill the promo field with it on upgrade. */
+  referral_code: string | null;
   renew_period: ICustomerSubscriptionRenewal | null;
   plugin: {
     remote_subscription_last_sync: IApiDateTime | null;