payment-kit 1.29.12 → 1.29.13

package/api/src/routes/hono/checkout-sessions.ts

@@ -1243,7 +1243,18 @@ export async function startCheckoutSessionFromPaymentLink(id: string, c: any) {
   const body = c.get('sanitizedBody') ?? {};
   const { metadata, needShortUrl = false } = body;
   try {
-    const link = await PaymentLink.findByPk(id);
+    let link = await PaymentLink.findByPk(id);
+    // Preview-draft ids are `plink_<did>` (create page). The frontend builds them from the
+    // BARE login_token did (e.g. z1cxgj7…), but /stash persisted the link with the
+    // auth-normalized `did:abt:` prefix (or vice versa) — a bare/prefixed DID shape
+    // mismatch. Fall back to the other shape so the preview iframe resolves its own draft.
+    if (!link && id.startsWith('plink_')) {
+      const didPart = id.slice('plink_'.length);
+      const altId = didPart.startsWith('did:abt:')
+        ? `plink_${didPart.slice('did:abt:'.length)}`
+        : `plink_did:abt:${didPart}`;
+      link = await PaymentLink.findByPk(altId);
+    }
     if (!link) {
       return c.json({ error: 'Payment link not found, please contact the source of the payment link.' }, 400);
     }

package/api/src/routes/hono/tax-rates.ts

@@ -77,10 +77,13 @@ app.get('/', auth, async (c) => {
       attributes: {
         include: [
           [
+            // Sequelize aliases the primary table to its modelName (`TaxRate`)
+            // in findAndCountAll, so the bare table name `tax_rates.id` is not a
+            // valid column in the emitted SQL (#1395). Reference the alias.
             literal(`(
               SELECT COUNT(DISTINCT ii.invoice_id)
               FROM invoice_items AS ii
-              WHERE ii.tax_rate_id = tax_rates.id
+              WHERE ii.tax_rate_id = \`TaxRate\`.id
             )`),
             'invoice_count',
           ],

package/api/tests/routes/hono/tax-rates.spec.ts

@@ -0,0 +1,48 @@
+// Regression test for #1395 — GET /api/tax-rates returned 400
+// `SQLITE_ERROR: no such column: tax_rates.id`.
+//
+// The list handler's `invoice_count` subquery used `literal()` with the bare
+// table name `tax_rates.id`, but Sequelize aliases the primary table to its
+// modelName (`TaxRate`) in findAndCountAll, so that qualifier doesn't exist in
+// the emitted SQL. The error is in the compiled subquery itself, so it throws
+// even on an empty table — which is exactly what makes a tiny DB-backed test
+// (real sqlite, like store/tenant-model.spec.ts) enough to pin it.
+//
+// auth is stubbed to pass-through (gating is covered by
+// middlewares/hono/security.spec.ts).
+jest.mock('../../../src/middlewares/hono/security', () => ({
+  authenticate: () => (_c: any, next: any) => next(),
+}));
+
+import { Hono } from 'hono';
+import { Sequelize } from 'sequelize';
+
+import { withTenant } from '../../../src/libs/context';
+import { initialize } from '../../../src/store/models';
+import { TENANT_A } from '../../fixtures/tenants';
+import taxRates from '../../../src/routes/hono/tax-rates';
+
+const sequelize = new Sequelize('sqlite::memory:', { logging: false });
+initialize(sequelize);
+
+const app = new Hono();
+app.route('/api/tax-rates', taxRates);
+
+beforeAll(async () => {
+  await sequelize.sync({ force: true });
+});
+afterAll(() => sequelize.close());
+
+describe('GET /api/tax-rates — list (regression #1395)', () => {
+  it('the invoice_count subquery alias resolves — 200, not 400 no-such-column', async () => {
+    const r = await withTenant(TENANT_A, () =>
+      app.fetch(new Request('http://app.local/api/tax-rates', { headers: { host: 'app.local' } })),
+    );
+
+    // pre-fix: 400 { error: "SQLITE_ERROR: no such column: tax_rates.id" }
+    expect(r.status).toBe(200);
+    const body = (await r.json()) as { count: number; list: unknown[] };
+    expect(body.count).toBe(0);
+    expect(Array.isArray(body.list)).toBe(true);
+  });
+});

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.12
+version: 1.29.13
 logo: logo.png
 files:
   - dist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.12",
+  "version": "1.29.13",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -60,9 +60,9 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.12",
-    "@blocklet/payment-react": "1.29.12",
-    "@blocklet/payment-vendor": "1.29.12",
+    "@blocklet/payment-broker-client": "1.29.13",
+    "@blocklet/payment-react": "1.29.13",
+    "@blocklet/payment-vendor": "1.29.13",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
     "@blocklet/uploader": "^0.15.4",
@@ -133,7 +133,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.12",
+    "@blocklet/payment-types": "1.29.13",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -180,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "8473f4c5a7716d03d53f253563229f31e63ec0c4"
+  "gitHead": "e023f83ecfb07c0782e138a2802b5dec746fd7c6"
 }

package/src/components/payment-link/preview.tsx

@@ -1,5 +1,6 @@
 import { useEffect, useImperativeHandle, useRef, useState } from 'react';
 import { useFullscreen, useSize } from 'ahooks';
+import { joinURL } from 'ufo';
 import IframeResizer from 'iframe-resizer-react';
 import { useTheme } from '@mui/material';
 import Chrome from './chrome';
@@ -30,7 +31,11 @@ export default function PaymentLinkPreview({
     }
   }, [theme.palette.mode, mode]);
 
-  const iframeSrc = `${window.blocklet.prefix}checkout/pay/${id}?preview=1&version=${version}&theme=${mode}`;
+  // joinURL (not string concat) so the payment prefix joins the path with exactly one
+  // slash. window.blocklet.prefix has NO trailing slash on embedded hosts
+  // (/.well-known/payment), so `${prefix}checkout/...` produced `/.well-known/paymentcheckout/...`
+  // → 404. Every other payment-link URL already uses joinURL; this was the lone hard-concat.
+  const iframeSrc = `${joinURL(window.blocklet.prefix, 'checkout/pay', id)}?preview=1&version=${version}&theme=${mode}`;
   return (
     <div ref={innerRef}>
       {fullscreen ? (