wiki-plugin-shoppe 0.0.24 → 0.0.26

package/client/shoppe.js

@@ -22,8 +22,11 @@
             .sw-shoppe-left { display: flex; flex-direction: column; gap: 2px; }
             .sw-shoppe-name { font-weight: 600; font-size: 15px; }
             .sw-shoppe-code { font-size: 18px; letter-spacing: 4px; }
+            .sw-shoppe-actions { display: flex; align-items: center; gap: 12px; }
             .sw-link { font-size: 13px; color: #0066cc; text-decoration: none; white-space: nowrap; }
             .sw-link:hover { text-decoration: underline; }
+            .sw-btn-delete { background: none; border: none; color: #cc0000; font-size: 13px; cursor: pointer; padding: 0; white-space: nowrap; }
+            .sw-btn-delete:hover { text-decoration: underline; }
             .sw-empty { font-size: 13px; color: #999; font-style: italic; }
             .sw-drop { border: 2px dashed #ccc; border-radius: 12px; padding: 28px 20px; text-align: center; background: #fafafa; transition: border-color 0.2s, background 0.2s; cursor: pointer; }
             .sw-drop.dragover { border-color: #0066cc; background: #e8f0fe; }
@@ -41,6 +44,8 @@
             .sw-status.success { background: #d1fae5; color: #065f46; display: block; }
             .sw-status.error   { background: #fee2e2; color: #991b1b; display: block; }
             .sw-status code { background: rgba(0,0,0,0.08); border-radius: 4px; padding: 1px 5px; font-size: 12px; }
+            .sw-remove { display: block; width: 100%; margin-top: 24px; padding: 8px; background: none; border: 1px solid #e5e5ea; border-radius: 8px; font-size: 12px; color: #aaa; cursor: pointer; text-align: center; }
+            .sw-remove:hover { border-color: #cc0000; color: #cc0000; }
           </style>
 
           <!-- Directory -->
@@ -161,37 +166,70 @@
             <div id="sw-register-status" class="sw-status"></div>
           </div>
 
+          <button class="sw-remove" id="sw-remove-btn">Remove plugin from page</button>
+
         </div>
       `;
 
+      div.querySelector('#sw-remove-btn').addEventListener('click', () => {
+        const $page = $item.parents('.page');
+        if (window.pageHandler && $page.length) {
+          pageHandler.put($page, { type: 'remove', id: item.id });
+          $item.remove();
+        } else if (window.wiki && wiki.textEditor) {
+          wiki.textEditor($item, item);
+        }
+      });
+
       setupListeners(div);
-      loadDirectory(div);
-      checkOwner(div);
+      checkOwner(div).then(isOwner => {
+        if (!isOwner) loadDirectory(div, false);
+      });
     },
 
-    bind: function($item, item) {}
+    bind: function($item, item) {
+      $item.on('dblclick', () => {
+        const $page = $item.parents('.page');
+        if (window.pageHandler && $page.length) {
+          pageHandler.put($page, { type: 'remove', id: item.id });
+          $item.remove();
+        } else if (window.wiki && wiki.textEditor) {
+          wiki.textEditor($item, item);
+        }
+      });
+    }
   };
 
-  // ── Directory (public) ──────────────────────────────────────────────────────
+  // ── Directory ────────────────────────────────────────────────────────────────
 
-  async function loadDirectory(container) {
+  async function loadDirectory(container, isOwner = false) {
     const el = container.querySelector('#sw-directory');
     try {
-      const resp = await fetch('/plugin/shoppe/directory');
+      const resp = await fetch(isOwner ? '/plugin/shoppe/tenants' : '/plugin/shoppe/directory');
       const result = await resp.json();
-      if (!result.success || result.shoppes.length === 0) {
+      const shoppes = isOwner ? result.tenants : result.shoppes;
+      if (!result.success || !shoppes || shoppes.length === 0) {
         el.innerHTML = '<em class="sw-empty">No shoppes yet — be the first!</em>';
         return;
       }
-      el.innerHTML = result.shoppes.map(s => `
-        <div class="sw-shoppe">
+      el.innerHTML = shoppes.map(s => `
+        <div class="sw-shoppe" id="sw-shoppe-${s.uuid}">
           <div class="sw-shoppe-left">
             <span class="sw-shoppe-name">${s.name}</span>
             <span class="sw-shoppe-code">${s.emojicode}</span>
           </div>
-          <a class="sw-link" href="${s.url}" target="_blank">Visit shoppe →</a>
+          <div class="sw-shoppe-actions">
+            <a class="sw-link" href="${s.url}" target="_blank">Visit shoppe →</a>
+            ${isOwner ? `<button class="sw-btn-delete" data-uuid="${s.uuid}" data-name="${s.name}">Delete</button>` : ''}
+          </div>
         </div>
       `).join('');
+
+      if (isOwner) {
+        el.querySelectorAll('.sw-btn-delete').forEach(btn => {
+          btn.addEventListener('click', () => deleteShoppe(btn.dataset.uuid, btn.dataset.name, container));
+        });
+      }
     } catch (err) {
       el.innerHTML = '<em class="sw-empty">Could not load directory.</em>';
     }
@@ -208,8 +246,30 @@
         if (result.sanoraUrl) {
           container.querySelector('#sw-url-input').value = result.sanoraUrl;
         }
+        loadDirectory(container, true);
+        return true;
       }
     } catch (err) { /* not owner, stay hidden */ }
+    return false;
+  }
+
+  // ── Delete shoppe (owner) ────────────────────────────────────────────────────
+
+  async function deleteShoppe(uuid, name, container) {
+    if (!confirm(`Delete "${name}"? This will remove the shoppe and all its products from Sanora.`)) return;
+
+    const row = container.querySelector(`#sw-shoppe-${uuid}`);
+    if (row) row.style.opacity = '0.4';
+
+    try {
+      const resp = await fetch(`/plugin/shoppe/${uuid}`, { method: 'DELETE' });
+      const result = await resp.json();
+      if (!result.success) throw new Error(result.error || 'Delete failed');
+      loadDirectory(container, true);
+    } catch (err) {
+      if (row) row.style.opacity = '1';
+      alert(`Could not delete shoppe: ${err.message}`);
+    }
   }
 
   // ── Listeners ───────────────────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wiki-plugin-shoppe",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "description": "Multi-tenant digital goods shoppe for federated wiki, powered by Sanora",
   "keywords": [
     "wiki",

package/server/scripts/shoppe-sign.js

@@ -273,6 +273,71 @@ async function orders() {
   console.log('');
 }
 
+// ── upload — generate a signed shoppe URL for video uploading ────────────────
+
+async function upload() {
+  let sessionless;
+  try {
+    sessionless = require('sessionless-node');
+  } catch (err) {
+    console.error('❌  sessionless-node is not installed.');
+    console.error('   Run: npm install');
+    process.exit(1);
+  }
+
+  const manifest = readManifest();
+
+  if (!manifest.uuid) {
+    console.error('❌  manifest.json is missing uuid.');
+    process.exit(1);
+  }
+
+  if (fs.existsSync(LOCAL_KEY)) {
+    console.error('⚠️   shoppe-key.json is still in this folder.');
+    console.error('   Run  node shoppe-sign.js init  first.');
+    process.exit(1);
+  }
+
+  const keyData = loadStoredKey(manifest.uuid);
+
+  const timestamp = Date.now().toString();
+  const message   = timestamp + manifest.uuid;
+
+  sessionless.getKeys = () => ({ pubKey: keyData.pubKey, privateKey: keyData.privateKey });
+  const signature = await sessionless.sign(message);
+
+  const wikiUrlArg = process.argv[3];
+  const baseUrl    = wikiUrlArg
+    ? wikiUrlArg.replace(/\/+$/, '')
+    : manifest.wikiUrl
+      ? manifest.wikiUrl.replace(/\/plugin.*$/, '')
+      : null;
+
+  const shoppePath = `/plugin/shoppe/${manifest.uuid}?timestamp=${timestamp}&signature=${encodeURIComponent(signature)}`;
+  const fullUrl    = baseUrl ? `${baseUrl}${shoppePath}` : null;
+
+  console.log('\n🎬  Signed shoppe URL for video uploading (valid for 24 hours):\n');
+  if (fullUrl) {
+    console.log('   ' + fullUrl);
+  } else {
+    console.log('   Path: ' + shoppePath);
+    console.log('\n   Prepend your wiki URL, e.g.:');
+    console.log('   https://mywiki.com' + shoppePath);
+    console.log('\n   Or pass your wiki URL as an argument:');
+    console.log('   node shoppe-sign.js upload https://mywiki.com');
+  }
+
+  if (fullUrl) {
+    console.log('\n   Opening in browser...');
+    try {
+      const open = process.platform === 'win32' ? 'start' :
+                   process.platform === 'darwin' ? 'open' : 'xdg-open';
+      execSync(`${open} "${fullUrl}"`, { stdio: 'ignore' });
+    } catch (_) {}
+  }
+  console.log('');
+}
+
 // ── payouts — open Stripe Connect Express onboarding ─────────────────────────
 
 async function payouts() {
@@ -347,6 +412,11 @@ async function payouts() {
 const command = process.argv[2];
 if (command === 'init') {
   init();
+} else if (command === 'upload') {
+  upload().catch(err => {
+    console.error('❌ ', err.message);
+    process.exit(1);
+  });
 } else if (command === 'orders') {
   orders().catch(err => {
     console.error('❌ ', err.message);

package/server/server.js

@@ -261,6 +261,13 @@ function generateBundleBuffer(tenant, ownerPrivateKey, ownerPubKey, wikiOrigin)
     'Add or update content, then run `node shoppe-sign.js` again.',
     'Each upload overwrites existing items and adds new ones.',
     '',
+    '## Uploading videos',
+    '',
+    'Run: `node shoppe-sign.js upload`',
+    '',
+    'Opens your shoppe page with a signed URL (valid for 24 hours).',
+    'Any video items without a file will show an "Upload Video" button.',
+    '',
     '## Viewing orders',
     '',
     'Run: `node shoppe-sign.js orders`',
@@ -560,6 +567,20 @@ async function sanoraUploadImage(tenant, title, imageBuffer, filename) {
 
 // ============================================================
 // LUCILLE HELPERS
+async function sanoraDeleteProduct(tenant, title) {
+  const { uuid, keys } = tenant;
+  const timestamp = Date.now().toString();
+  const message = timestamp + uuid + title;
+
+  sessionless.getKeys = () => keys;
+  const signature = await sessionless.sign(message);
+
+  await fetch(
+    `${getSanoraUrl()}/user/${uuid}/product/${encodeURIComponent(title)}?timestamp=${timestamp}&signature=${encodeURIComponent(signature)}`,
+    { method: 'DELETE' }
+  );
+}
+
 // ============================================================
 
 async function lucilleCreateUser(lucilleUrl) {
@@ -1383,12 +1404,12 @@ const CATEGORY_EMOJI = { book: '📚', music: '🎵', post: '📝', album: '🖼
 // Validate an owner-signed request (used for browser-facing owner routes).
 // Expects req.query.timestamp and req.query.signature.
 // Returns an error string if invalid, null if valid.
-function checkOwnerSignature(req, tenant) {
+function checkOwnerSignature(req, tenant, maxAgeMs = 5 * 60 * 1000) {
   if (!tenant.ownerPubKey) return 'This shoppe was registered before owner signing was added';
   const { timestamp, signature } = req.query;
   if (!timestamp || !signature) return 'Missing timestamp or signature — generate a fresh URL with: node shoppe-sign.js orders';
   const age = Date.now() - parseInt(timestamp, 10);
-  if (isNaN(age) || age < 0 || age > 5 * 60 * 1000) return 'URL has expired — generate a new one with: node shoppe-sign.js orders';
+  if (isNaN(age) || age < 0 || age > maxAgeMs) return 'URL has expired — generate a new one with: node shoppe-sign.js orders';
   const message = timestamp + tenant.uuid;
   if (!sessionless.verifySignature(signature, message, tenant.ownerPubKey)) return 'Signature invalid';
   return null;
@@ -1568,7 +1589,7 @@ function renderCards(items, category) {
   }).join('');
 }
 
-function generateShoppeHTML(tenant, goods) {
+function generateShoppeHTML(tenant, goods, uploadAuth = null) {
   const total = Object.values(goods).flat().length;
   const tabs = [
     { id: 'all',          label: 'All',              count: total,                       always: true },
@@ -1667,6 +1688,7 @@ function generateShoppeHTML(tenant, goods) {
     </div>
   </div>
   <script>
+    const UPLOAD_AUTH = ${uploadAuth ? JSON.stringify(uploadAuth) : 'null'};
     function show(id, tab) {
       document.querySelectorAll('.section').forEach(s => s.classList.remove('active'));
       document.querySelectorAll('.tab').forEach(t => t.classList.remove('active'));
@@ -1697,7 +1719,9 @@ function generateShoppeHTML(tenant, goods) {
       progressDiv.innerHTML = 'Getting upload credentials…';
 
       try {
-        const infoRes = await fetch('/plugin/shoppe/' + shoppeId + '/video/' + encodeURIComponent(title) + '/upload-info');
+        if (!UPLOAD_AUTH) throw new Error('Not authorized to upload — visit the shoppe via a signed URL (node shoppe-sign.js upload)');
+        const authParams = '?timestamp=' + encodeURIComponent(UPLOAD_AUTH.timestamp) + '&signature=' + encodeURIComponent(UPLOAD_AUTH.signature);
+        const infoRes = await fetch('/plugin/shoppe/' + shoppeId + '/video/' + encodeURIComponent(title) + '/upload-info' + authParams);
         if (!infoRes.ok) throw new Error('Could not get upload credentials (' + infoRes.status + ')');
         const { uploadUrl, timestamp, signature } = await infoRes.json();
 
@@ -1864,6 +1888,36 @@ async function startServer(params) {
     res.json({ success: true, tenants: safe });
   });
 
+  // Delete a shoppe tenant (owner only)
+  app.delete('/plugin/shoppe/:identifier', owner, async (req, res) => {
+    try {
+      const tenant = getTenantByIdentifier(req.params.identifier);
+      if (!tenant) return res.status(404).json({ error: 'tenant not found' });
+
+      // Fetch all products from Sanora and fire-and-forget delete each one
+      const sanoraUrl = getSanoraUrl();
+      fetch(`${sanoraUrl}/products/${tenant.uuid}`)
+        .then(r => r.json())
+        .then(products => {
+          for (const title of Object.keys(products)) {
+            sanoraDeleteProduct(tenant, title).catch(err =>
+              console.warn(`[shoppe] delete product "${title}" failed:`, err.message)
+            );
+          }
+        })
+        .catch(err => console.warn('[shoppe] fetch products for delete failed:', err.message));
+
+      // Remove tenant from local registry
+      const tenants = loadTenants();
+      delete tenants[tenant.uuid];
+      saveTenants(tenants);
+
+      res.json({ success: true, deleted: tenant.uuid });
+    } catch (err) {
+      res.status(404).json({ error: err.message });
+    }
+  });
+
   // Public directory — name, emojicode, and shoppe URL only
   app.get('/plugin/shoppe/directory', (req, res) => {
     const tenants = loadTenants();
@@ -2537,12 +2591,18 @@ async function startServer(params) {
     }
   });
 
-  // GET /plugin/shoppe/:id/video/:title/upload-info (owner only)
+  // GET /plugin/shoppe/:id/video/:title/upload-info
   // Returns a pre-signed lucille upload URL so the browser can PUT the video file directly to lucille.
-  app.get('/plugin/shoppe/:identifier/video/:title/upload-info', owner, async (req, res) => {
+  // Auth: shoppe tenant owner signature (timestamp + uuid), valid for 24 hours.
+  // Generate the signed URL with: node shoppe-sign.js upload
+  app.get('/plugin/shoppe/:identifier/video/:title/upload-info', async (req, res) => {
     try {
       const tenant = getTenantByIdentifier(req.params.identifier);
       if (!tenant) return res.status(404).json({ error: 'tenant not found' });
+
+      const sigErr = checkOwnerSignature(req, tenant, 24 * 60 * 60 * 1000);
+      if (sigErr) return res.status(403).json({ error: sigErr });
+
       if (!tenant.lucilleKeys) return res.status(400).json({ error: 'tenant has no lucille user — re-register' });
 
       const title = req.params.title;
@@ -2579,8 +2639,14 @@ async function startServer(params) {
       const tenant = getTenantByIdentifier(req.params.identifier);
       if (!tenant) return res.status(404).send('<h1>Shoppe not found</h1>');
       const goods = await getShoppeGoods(tenant);
+
+      // Check if the request carries a valid owner signature — if so, embed auth
+      // params in the page so the upload button can authenticate with upload-info.
+      const sigErr = checkOwnerSignature(req, tenant, 24 * 60 * 60 * 1000);
+      const uploadAuth = sigErr ? null : { timestamp: req.query.timestamp, signature: req.query.signature };
+
       res.set('Content-Type', 'text/html');
-      res.send(generateShoppeHTML(tenant, goods));
+      res.send(generateShoppeHTML(tenant, goods, uploadAuth));
     } catch (err) {
       console.error('[shoppe] page error:', err);
       res.status(500).send(`<h1>Error</h1><p>${err.message}</p>`);