orionplace-svelte 0.6.1 → 0.7.0

package/README.md

@@ -480,7 +480,9 @@ The corresponding `.cfg` is read on every request. Backend URLs must use HTTPS,
 end in `/api`, and belong to `*.orionplace.app`. API methods, query strings, bodies,
 authorization and cookies are forwarded. Backend statuses are retained and cookie
 Domain attributes are removed to bind cookies to the storefront. Gateway responses
-use `Cache-Control: no-store`. Network failures return `502`.
+use `Cache-Control: no-store`, except public blog images and videos: they keep the
+backend's `private, max-age` rule, so the browser does not download them again on
+every page. Network failures return `502`.
 
 A changing request (POST, PUT, PATCH, DELETE) from another site is rejected with
 `403`. A request from the page's own host or the storefront domain passes, and the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionplace-svelte",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "SvelteKit 2 storefront for your Orionplace marketplace: setup CLI, server API gateway, typed store and ready-made catalog, cart, checkout and account components in English and Russian, plus an Android app build.",
   "type": "module",
   "license": "MIT",

package/runtime/marketplace.d.mts

@@ -37,6 +37,11 @@ export declare function marketplacePublicOrigin(
   tenantDomain?: string,
 ): string;
 
+export declare function marketplaceCacheControl(
+  media: boolean,
+  upstream: Response,
+): string;
+
 export declare function noindexPathPrefixes(value?: string): string[];
 
 export declare function marketplaceNoindexPath(

package/runtime/marketplace.mjs

@@ -41,6 +41,18 @@ const hostnamePattern =
 const blogMediaPattern =
   /^\/ps3\/blog\/posts\/(?:images\/\d+|videos\/\d+(?:\/preview)?)$/;
 
+/**
+ * API answers are never stored. A media file keeps the backend's own browser
+ * cache rule when the backend allows it (a published public blog image:
+ * "private, max-age=…"); "private" keeps it out of shared caches.
+ */
+export function marketplaceCacheControl(media, upstream) {
+  const value = upstream.headers.get('cache-control') ?? '';
+  return media && upstream.ok && /\bprivate\b/i.test(value) && /\bmax-age=\d+/i.test(value) && !/no-store|no-cache/i.test(value)
+    ? value
+    : 'no-store';
+}
+
 /** @param {string} pathname */
 export function isMarketplaceMediaPath(pathname) {
   return blogMediaPattern.test(pathname);
@@ -307,7 +319,7 @@ export async function forwardMarketplace(request, configuration = {}) {
         : destination.href,
     );
   }
-  responseHeaders.set('Cache-Control', 'no-store');
+  responseHeaders.set('Cache-Control', marketplaceCacheControl(media, upstream));
   responseHeaders.set('Vary', 'Host, X-Forwarded-Host, X-Front-Domain');
   // fetch decodes compressed bodies: do not reuse upstream Content-Length/Encoding.
   return new Response(upstream.body, {

package/src/project-readme.mjs

@@ -403,6 +403,14 @@ for example \`ORIONPLACE_NOINDEX_PATHS="/catalog /category /product"\`. Those
 pages answer with \`X-Robots-Tag: noindex, follow\` and the sitemap leaves them
 out; the journal and other pages stay indexable. Leave it empty on a live shop.
 
+Every product page carries schema.org product data for Google and Yandex: the
+price, the crossed-out old price, stock, photos, brand, seller, rating and the
+return terms the page shows. To include the return terms, set
+\`ORIONPLACE_SHIPPING_COUNTRIES\` in \`.env\` to the countries you ship to, as
+ISO codes separated by spaces, for example
+\`ORIONPLACE_SHIPPING_COUNTRIES="RU BY"\`; without it the return terms are left
+out. The delivery cost is not included: it depends on the buyer's address.
+
 This setup does not add analytics.
 
 ## Android app

package/templates/src/hooks.server.ts

@@ -12,10 +12,12 @@ function escapeAttribute(value: string) {
 
 /**
  * Personalized pages are never shared between visitors or storefront domains.
- * The API gateway, robots.txt and the sitemap set their own headers, so those
- * requests are left alone.
+ * The API gateway (/api, /ps3 media), robots.txt and the sitemap set their own
+ * headers, so those requests are left alone: public blog images keep the
+ * backend's browser cache rule.
  */
 const ownHeaders = ['/robots.txt', '/sitemap.xml'];
+const gatewayPaths = ['/api/', '/ps3/'];
 
 export const handle: Handle = async ({ event, resolve }) => {
   const response = await resolve(event, {
@@ -26,7 +28,7 @@ export const handle: Handle = async ({ event, resolve }) => {
       ),
   });
   if (
-    !event.url.pathname.startsWith('/api/') &&
+    !gatewayPaths.some((path) => event.url.pathname.startsWith(path)) &&
     !ownHeaders.includes(event.url.pathname)
   ) {
     response.headers.set('Cache-Control', 'private, no-store');

package/templates/src/lib/components/orionplace/blog/BlogArticle.README.md

@@ -8,6 +8,8 @@ Article videos may come as the backend's own paths (`/ps3/...`). In an Android a
 
 The cover and the images of the text open larger: a click, Enter or Space on one opens `ProductReviewImageViewer` at that image, with the article's other images a step away and each image's caption (its `figcaption`, else its `title`, else its `alt`) under it. The images get `role="button"`, a keyboard stop and an «Open image» name; a zoom-in cursor marks them. Images inside a link, a button or a product placement keep their own action. The helper is `src/lib/utils/orionplace/blogImageViewer.ts`.
 
+Products the author places in the text appear at those positions: an empty block with `data-product-id="12"` shows one product card, `data-product-ids="12,15,9"` a row of up to 24 cards. The block keeps the editor's float or centred style, and `data-product-hidden-badges` (`new`, `popular`, `good-deal`) turns card badges off. Products missing from `related_products` are loaded with `products_search` and `filters.id_in`, up to 35 IDs per request, and stored with `store.setProduct()`; a block whose products are not found stays hidden. Article text styles do not reach the cards, and in a narrow article a floated card stands alone in the middle. The helper is `src/lib/utils/orionplace/blogProductPlacements.ts`.
+
 Source: `src/lib/components/orionplace/blog/BlogArticle.svelte`.
 
 ## Inputs