346d80d · ae2179a · 6632d57 · 70fc345 · b40cb34 · f3e7e8a
@@ -4,10 +4,12 @@
A small shop: a catalog with categories and search, product pages with
variants and stock, a cart in a signed cookie, discount codes and gift cards,
tax by where the parcel goes, a gift card balance window, checkout with an
address, a payment step, receipts, and an `/admin` for products, inventory,
codes, cards, tax and orders with refunds. Every price is an integer number
of cents, every form carries a CSRF token, and checkout, payment, typing a
code, reading a gift card's balance and finding an order are each rate
limited on their own. A category or a search longer than 24 things is
codes, cards, tax and orders with refunds. Looking around and filling a cart
need no account; buying needs one, because an order belongs to the account
that placed it and `/orders` is that account's list of them. Every price is an
integer number of cents, every form carries a CSRF token, and checkout,
payment, typing a code, reading a gift card's balance and finding an order are
each rate limited on their own. A category or a search longer than 24 things is
paged, so a listing is never a page without an end and never hides what is
past the end of it.
@@ -106,26 +108,71 @@
the goods, plus gift cards being bought — and only then is a card's balance
taken off to leave what the gateway is asked for. `bun test` reconciles a
cart with all three against the order it becomes.
## Finding an order again
## An account buys; browsing does not need one
An order is private, so it opens with its own access token and nothing else —
which leaves the shopper who closed the tab with no way back. `/orders` is
that way back, and it has two halves:
`/`, a category, a product page, the cart, adding to it, changing it and
typing a code all work signed out, exactly as they always did. Buying is where
an account starts, because an order has to belong to somebody:
- **From this browser.** Placing an order appends its number to a signed
  `mine` cookie, at most ten deep. The cookie holds numbers and nothing else;
  the link is built from the access token read out of the row, so editing the
  cookie changes which number is being claimed and never what opens. A shared
  computer is not a shopper's, so **Forget these orders** drops the cookie.
- **The form.** An order number and the email it was placed with. Both have to
  be right, the email is compared as a keyed digest so no letter of it times
  differently — and a number that matches nothing is digested against a fixed
  string, so a miss does the same work as a match — and a pair that does not
  match is refused in the same words whether or not the number exists. This
  form is not a way to learn which order numbers are real. It is rate limited
  like the other guessable things (see below), and a lookup that succeeds
  leaves a `looked-up` row in the order's events with the address it came
  from.
- `GET /checkout` for a shopper the forge has not signed in shows the same
  order summary with the address form replaced by **Sign in to buy**, pointing
  at `/__forge/signin?to=/checkout`. Nothing about the cart is touched, so the
  same cart is there on the way back. The cart page says it too, with a full
  cart in front of the shopper rather than after they have typed an address.
- `POST /checkout` without an account writes nothing at all — no order row, no
  stock taken, no code redeemed — and answers with a 303 back to `/checkout`.
- An order records `buyer_id` and `buyer_name` from the verified identity. The
  `email` column is still the address the shopper typed: a forge account name
  is not an email address and is never written there. The email box is
  prefilled only when what the forge gave us is itself an email.
The account is also who an order opens for. `src/shop.ts`'s `openOrder` is the
only place that decides, and it knows three ways in: an admin, the account the
order belongs to, and whoever holds the order's own access token, compared in
constant time. So `/orders/<number>`, its receipt and `/pay/<number>` open for
their buyer with no `?token=` at all, and a signed-in stranger gets the same
404 a stranger has always got.
### What the access token is still for
It is not dead code. The orders placed before accounts existed — `buyer_id` is
`''` on every one of them, added with `addColumn` and a default so they keep
rendering — have nothing else, and the token is still what travels: in the
receipt, in the mock gateway's forms, and in the `success_url` and
`cancel_url` Stripe sends a shopper back to. `to=` and `rel="noreferrer"` keep
it out of the sign-in links, as before.
## Finding a guest order again
`/orders` is an account's own orders, newest first — number, date, status,
total and a link that needs no token. A shopper who is not signed in is
offered the way in and never a list of anything. Under the list are the two
halves of the way back to a guest order:
- **Found in this browser.** A guest order found here appends its number to a
  signed `mine` cookie, at most ten deep — found through the form below, or by
  opening the order with its own token, which is the same browser finding the
  same order and is what makes signing in mid-purchase land somewhere useful. The cookie holds numbers and nothing
  else; the link is built from the access token read out of the row, so editing
  the cookie changes which number is being claimed and never what opens. A
  shared computer is not a shopper's, so **Forget these orders** drops the
  cookie. An order an account owns is listed from the account, so it is never
  put in the cookie. This half is shown to whoever is holding the cookie,
  signed in or not: a guest order belongs to a browser, and a list nobody can
  see is a list nobody can drop.
- **The form, for a guest order and nothing else.** An order number and the
  email it was placed with. An order that belongs to an account is *not* found
  this way — it has a door of its own, and a number and an email are not proof
  of being its buyer — so it is refused in the words a miss gets, after the
  same work, and leaves nothing in its trail. Both fields have to be right, the
  email is compared as a keyed digest so no letter of it times differently —
  and a number that matches nothing is digested against a fixed string, so a
  miss does the same work as a match — and every refusal is the same words
  whether the number does not exist, does not match, or is not this form's to
  hand over. This form is not a way to learn which order numbers are real, nor
  which of them are owned. It is rate limited like the other guessable things
  (see below), and a lookup that succeeds leaves a `looked-up` row in the
  order's events with the address it came from.
### What a rate limit is keyed on
@@ -236,8 +283,8 @@
session cookie is still there, but it only carries the CSRF token now.
| Who | What |
| --- | --- |
| **anon** | Reads the shop: catalog, search, product pages, the cart, and an order with the order's own token. |
| **user** | Buys: everything anon can do, and the header names them. |
| **anon** | Reads the shop: catalog, search, product pages, the cart with everything it does, and an order with the order's own token. Cannot buy. |
| **user** | Buys: everything anon can do, and an order of their own — `/orders` lists it, their order, receipt and payment pages open without a token, and the terminal's orders tab shows the same list. |
| **admin** | Runs the shop: every path under `/admin`, and any order without its token. |
Anyone who is not an admin gets one page at `/admin`, status 403, whose only
@@ -248,23 +295,50 @@
from `/search?q=beans` comes back to the results — with one exception: an
order's `token` is stripped, because it opens that order to whoever holds it
and the sign-in path is handed to the forge. A page the token was what opened
(`/pay/:number`, `/orders/:number`, its receipt) is a 404 without it, so those
come back to `/orders` instead — "Find an order" opens for anybody, and lists
this browser's orders with their own links, so a shopper who signs in
part-way through paying is one click from finishing. Those links also carry
come back to `/orders` instead, which opens for anybody: the account's own
orders once they are signed in, and under them the guest orders this browser
has opened, each with its own token link — so a shopper who signs in part-way
through paying is one click from finishing either way. Those links also carry
`rel="noreferrer"`: `/__forge/*` shares this origin, so the `Referer` would
otherwise hand over the very URL `to` was careful to clean.
The terminal takes the same three roles from the environment. Stock and the
tax table read for anybody the forge names; orders,
the outbox, the codes, the cards and the changes do not, because a receipt
carries a gift card's code in full, an order carries a name and an address,
the card list is every balance in the shop, and the changes name the people
who run it. Every key that does anything — moving stock,
refunding, writing a code, issuing or voiding a card, setting a rate — is an
admin's, and so are the two keys that only read something out: `c`, which
prints a balance, and `h`, which prints the stock ledger. `src/desk.ts` holds
one table for both, and the tab bar and the foot of the screen are built from
it, so nothing can be offered without being gated.
A page only a POST reaches is the same dead end: a missed lookup at
`POST /orders/find` renders "Your orders", and a declined mock payment at
`POST /pay/:number/mock` renders the payment page, but a GET of either is a
404. So `to` is worked out once, at the front door, and handed to every page
as `ctx.backTo`: this URL when a GET renders a page for the route's own
pattern — `getAnswers` in `src/routes.ts`, asked of the pattern, because
`/orders/find` is *shaped* like `/orders/:number` — and `/orders` when it does
not. No page chooses its own sign-in target, so none of them can choose a 404.
The token goes the other way too: nobody is handed one they did not need.
`src/orderlink.ts` says where an order lives for the person being sent there —
the bare path for its buyer and for an admin, `?token=…` for whoever it took a
token to get here — and `openOrder` reads the same predicate, so a buyer who
opened their order by account never finds its secret written into their
history by a redirect or a link on the page. Stripe's `success_url` and
`cancel_url` still carry it: that browser leaves this origin, and a forge
session that lapses while it is away must not make the way back a 404.
The terminal takes the same three roles from the environment, and gives each
of them what the pages give it. Stock and the tax table read for anybody the
forge names. The outbox, the codes, the cards and the changes read for an
admin alone, because a receipt carries a gift card's code in full, the card
list is every balance in the shop, and the changes name the people who run it.
Orders are neither, because `/orders` is neither: whoever the forge named sees
the orders on their own account and nobody else's, an admin sees the shop's,
and an anonymous keyboard cannot open the tab at all.
`desk.ordersFor(who, filter)` is the one place those rows are chosen — a
function from `Who` to rows, so the rule is tested without a pty.
Every key that does anything — moving stock, refunding, writing a code,
issuing or voiding a card, setting a rate — is an admin's, and so are the two
keys that only read something out: `c`, which prints a balance, and `h`, which
prints the stock ledger. The exception is `/`, which narrows the rows already
in front of whoever pressed it: it reaches no further than they can already
see, so the buyer at the keyboard may press it on their own orders.
`src/desk.ts` holds one table for all of this, and the tab bar and the foot of
the screen are built from it, so nothing can be offered without being gated.
Rate limits count the address the socket came from, never the first entry of
`x-forwarded-for` — see [What a rate limit is keyed on](#what-a-rate-limit-is-keyed-on)
@@ -357,11 +431,12 @@
saying so.
| `src/db.ts` | The schema, and `open(dir)`: a directory in, a database out |
| `src/fresh.ts` | A database of a test file's own, opened before the file imports anything that queries |
| `src/catalog.ts` `src/inventory.ts` `src/orders.ts` | Products, the stock ledger, orders and refunds |
| `src/cart.ts` `src/codes.ts` `src/mine.ts` `src/money.ts` `src/sign.ts` | The signed cart, the codes cookie, the orders this browser placed, integer cents, HMACs |
| `src/cart.ts` `src/codes.ts` `src/mine.ts` `src/money.ts` `src/sign.ts` | The signed cart, the codes cookie, the guest orders this browser found, integer cents, HMACs |
| `src/discounts.ts` `src/giftcards.ts` `src/tax.ts` | What a code is worth, what a card holds, what the rate is |
| `src/who.ts` `src/session.ts` | Who the forge says is asking; the session that carries the CSRF token |
| `src/orderlink.ts` | Where an order lives for the person being handed the link: with its token, or without it |
| `src/changes.ts` | What an admin changed to the catalog, a code or a rate, and who they were |
| `src/desk.ts` | The terminal's typed commands: a line of text into a code, a card or a rate |
| `src/desk.ts` | The terminal's gate and its typed commands: who may read which tab and press which key, whose orders they see, and a line of text into a code, a card or a rate |
| `src/peer.ts` `src/ratelimit.ts` | Where a request came from, as far as it can be proved; the buckets keyed on it |
| `src/gateway.ts` `src/mail.ts` | Stripe or the mock, the outbox |
| `src/shop.ts` `src/admin.ts` | Handlers for the shop and for `/admin` |
@@ -414,22 +489,23 @@
live stream within about a second, not on that page's next load. `1`–`7`
switch between stock, orders, the outbox, discount codes, gift cards, the tax
table and the changes an admin made to any of it — everything `/admin`
can see — and `j`/`k` move. A tab whose rows are the shop's own business is an
admin's to open: a non-admin gets stock and tax, the other five are marked
with a `·` in the tab bar and answer "That is an admin's to do." without
leaving the tab they are on:
admin's to open: a non-admin gets stock, tax and their own orders, the other
four are marked with a `·` in the tab bar and answer without leaving the tab
they are on:
| Tab | Keys |
| --- | --- |
| stock | `s` moves stock with a reason, `h` shows the last of the ledger |
| orders | `/` finds an order by number, name or email — the terminal's half of `/orders` — and `r` refunds what is left of one and puts it back on the shelf |
| orders | the orders you may see — your account's, or the shop's for an admin. `/` narrows them by number, name or email, and `r` (an admin's) refunds what is left of one and puts it back on the shelf |
| codes | `n` writes a code (`CODE 20% [min 25] [uses 100] [until 2026-12-31]`), `t` turns one on or off, `c` looks a code up |
| cards | `i` issues a card (`25 a sorry-for-the-wait card`) and prints its code once, `v` voids or revives one, `c` looks a code up |
| tax | `e` sets a rate (`COUNTRY / REGION / 8.75 / what to call it`), `d` sets the rate for anywhere the table does not name, `x` removes one |
| changes | reads only: the last hundred changes an admin made to the catalog, the codes or the tax table, newest first — the terminal's half of `/admin/changes`. A change made here writes one of these rows too, naming the account the forge put at the keyboard |
`q` leaves. The first line says who the forge named and what they may read;
`FORGE_APP_USER_ROLE` has to be `admin` for any of the keys above, `c` and `h`
included — one prints a card's balance and a code's full terms, the other the
stock ledger. `ssh` gets you to the screen, not past the door. The parsing,
the gates and the refusals are `src/desk.ts`, so they are tested without a
pty.
`FORGE_APP_USER_ROLE` has to be `admin` for every key above except `/` — `c`
and `h` included, since one prints a card's balance and a code's full terms
and the other the stock ledger. `ssh` gets you to the screen, not past the
door, and what is on the screen is only ever what the same person could open
on the web. The parsing, the gates, the choice of rows and the refusals are
all `src/desk.ts`, so they are tested without a pty.
@@ -11,7 +11,6 @@
import type { Applied } from "./codes.ts";
import type { CartLine } from "./cart.ts";
import type { Peer } from "./peer.ts";
import type { Session } from "./session.ts";
import { returnTo } from "./who.ts";
import type { Who } from "./who.ts";
export type Ctx = {
@@ -22,6 +21,13 @@
export type Ctx = {
  session: Session;
  /** Who the forge says is asking, verified in src/who.ts. */
  who: Who;
  /**
   * Where signing in comes back to: this page when a GET answers it, and a
   * page that does when it does not — see `returnTo` in src/who.ts. Worked
   * out once, at the front door, so no page can offer a way in that lands on
   * a 404.
   */
  backTo: string;
  /** Parsed for POST routes; null for GET and for routes that read the body themselves. */
  form: FormData | null;
  /**
@@ -54,7 +60,7 @@
export function render(
    layout({
      title: options.title,
      who: ctx.who,
      path: returnTo(ctx.url),
      path: ctx.backTo,
      cartCount: cartCount(ctx.cart),
      categories: categories(),
      current: options.current,
@@ -271,6 +271,11 @@
function migrate(handle: Database): void {
  addColumn(handle, "order", "tax_label", "TEXT NOT NULL DEFAULT ''");
  addColumn(handle, "variant", "gift_card_cents", "INTEGER NOT NULL DEFAULT 0");
  addColumn(handle, "order_item", "gift_card_cents", "INTEGER NOT NULL DEFAULT 0");
  // The account an order belongs to. Empty on the orders placed before there
  // were accounts: those stay guest orders, reached with their access token.
  addColumn(handle, "order", "buyer_id", "TEXT NOT NULL DEFAULT ''");
  addColumn(handle, "order", "buyer_name", "TEXT NOT NULL DEFAULT ''");
  handle.exec('CREATE INDEX IF NOT EXISTS order_buyer ON "order"(buyer_id, id DESC)');
}
/**
@@ -341,6 +346,10 @@
export type Order = {
  number: string;
  access_token: string;
  status: string;
  /** The forge account that placed it; "" for a guest order from before accounts. */
  buyer_id: string;
  /** That account's name as it was at the sale. Never an email address. */
  buyer_name: string;
  email: string;
  name: string;
  address1: string;
@@ -7,21 +7,28 @@
 * be tested without a pty — a command is text in and a message out, and the
 * work itself goes through the same modules the admin pages use.
 *
 * Reaching the terminal is not permission to use it. Everything below is what
 * Reaching the terminal is not permission to use it. The work below is what
 * /admin does — issuing a card prints its code once, and looking a code up
 * reads out a balance — so the forge has to have named an admin at the
 * keyboard. `DESK` is the one place that says so, for reading as much as for
 * doing: the gate in `src/tty.ts` and the foot of its screen both read it, so
 * a key cannot be offered without being gated or gated without being offered,
 * and a tab cannot be opened by someone who may not read what is on it.
 *
 * Reading is not all or nothing, though, because the web pages are not: what a
 * person can do on the page they should be able to do here. `ordersFor` is
 * `/orders` in the terminal — an account's own orders and nobody else's — and
 * it is a function from `Who` to rows, so the rule is tested without a pty.
 */
import * as changes from "./changes.ts";
import * as discounts from "./discounts.ts";
import * as giftcards from "./giftcards.ts";
import * as orders from "./orders.ts";
import * as tax from "./tax.ts";
import { db } from "./db.ts";
import { formatCents, parseCents } from "./money.ts";
import type { Order } from "./db.ts";
import type { Who } from "./who.ts";
export type Done = { ok: boolean; message: string };
@@ -39,50 +46,67 @@
export type Tab = (typeof TABS)[number];
/**
 * Every tab, who may look at it, and the keys it offers — each key with the
 * words the screen's foot uses.
 * words the screen's foot uses and who may press it.
 *
 * `read: "admin"` is not squeamishness about internal pages. An order names a
 * person and where they live; a receipt in the outbox carries a gift card's
 * code in full, which is bearer money; the card list is every balance in the
 * shop and the notes the shop wrote to itself about them; the code list is
 * every discount that exists, including the ones nobody was told about. That
 * is the same reason `c` is an admin's key, so it is the same gate.
 * `read: "admin"` is not squeamishness about internal pages. A receipt in the
 * outbox carries a gift card's code in full, which is bearer money; the card
 * list is every balance in the shop and the notes the shop wrote to itself
 * about them; the code list is every discount that exists, including the ones
 * nobody was told about. That is the same reason `c` is an admin's key, so it
 * is the same gate.
 *
 * `read: "own"` is the rule the orders page has: an order belongs to the
 * account that bought it, so the rows a person sees here are the rows `/orders`
 * would list for them — their own and nobody else's. An admin sees the shop's.
 * Whoever the forge did not name sees nothing, because nothing is theirs.
 *
 * Stock and the tax table are the shop's public face — what is on the shelf
 * and what it is taxed at — so they stay open to whoever the forge named.
 *
 * A key marked `"reader"` changes nothing and reads nothing that is not
 * already on the tab, so whoever may read the tab may press it; every key that
 * does the desk's work, or reads a code out, is an `"admin"`'s.
 */
const DESK: Record<Tab, { read: "anyone" | "admin"; keys: { key: string; label: string }[] }> = {
  stock: { read: "anyone", keys: [{ key: "s", label: "s move stock" }, { key: "h", label: "h ledger" }] },
  orders: {
    read: "admin",
type Offer = { key: string; label: string; press: "admin" | "reader" };
const DESK: Record<Tab, { read: "anyone" | "own" | "admin"; keys: Offer[] }> = {
  stock: {
    read: "anyone",
    keys: [
      { key: "/", label: "/ find" },
      { key: "r", label: "r refund the rest and restock" },
      { key: "s", label: "s move stock", press: "admin" },
      { key: "h", label: "h ledger", press: "admin" },
    ],
  },
  orders: {
    read: "own",
    keys: [
      { key: "/", label: "/ find", press: "reader" },
      { key: "r", label: "r refund the rest and restock", press: "admin" },
    ],
  },
  outbox: { read: "admin", keys: [] },
  codes: {
    read: "admin",
    keys: [
      { key: "n", label: "n new code" },
      { key: "t", label: "t on/off" },
      { key: "c", label: "c check a code" },
      { key: "n", label: "n new code", press: "admin" },
      { key: "t", label: "t on/off", press: "admin" },
      { key: "c", label: "c check a code", press: "admin" },
    ],
  },
  cards: {
    read: "admin",
    keys: [
      { key: "i", label: "i issue a card" },
      { key: "v", label: "v void/revive" },
      { key: "c", label: "c check a code" },
      { key: "i", label: "i issue a card", press: "admin" },
      { key: "v", label: "v void/revive", press: "admin" },
      { key: "c", label: "c check a code", press: "admin" },
    ],
  },
  tax: {
    read: "anyone",
    keys: [
      { key: "e", label: "e set a rate" },
      { key: "d", label: "d default rate" },
      { key: "x", label: "x remove" },
      { key: "e", label: "e set a rate", press: "admin" },
      { key: "d", label: "d default rate", press: "admin" },
      { key: "x", label: "x remove", press: "admin" },
    ],
  },
  // Who changed a price, a code or a rate is the shop's own business, and it
@@ -90,19 +114,48 @@
const DESK: Record<Tab, { read: "anyone" | "admin"; keys: { key: string; label:
  changes: { read: "admin", keys: [] },
};
/** True when this key on this tab is the desk's work, and so an admin's. */
export const needsAdmin = (tab: Tab, key: string): boolean => DESK[tab].keys.some((offer) => offer.key === key);
/**
 * True when this key on this tab is the desk's work, and so an admin's. The
 * terminal asks `mayPress`, which is this and the tab's reading rule together;
 * this is here on its own because it is the half the invariant is stated in:
 * nothing an admin's key does is ever in `offered` for anybody else.
 */
export const needsAdmin = (tab: Tab, key: string): boolean =>
  DESK[tab].keys.some((offer) => offer.key === key && offer.press === "admin");
/** True when what is printed on this tab is an admin's to read. */
export const needsAdminToRead = (tab: Tab): boolean => DESK[tab].read === "admin";
/** True when this tab has anything at all to say to this person. */
export const canRead = (tab: Tab, who: Who): boolean =>
  who.role === "admin" || DESK[tab].read === "anyone" || (DESK[tab].read === "own" && who.role !== "anon");
/** The tabs this person may open. A non-admin gets the ones that are not private. */
export const visible = (who: Who): Tab[] =>
  TABS.filter((tab) => who.role === "admin" || !needsAdminToRead(tab));
export const visible = (who: Who): Tab[] => TABS.filter((tab) => canRead(tab, who));
/** What this person may do on this tab. Nothing, unless the forge named an admin. */
/** True when this person may press this key on this tab. */
export const mayPress = (tab: Tab, key: string, who: Who): boolean =>
  DESK[tab].keys.some(
    (offer) => offer.key === key && (offer.press === "admin" ? who.role === "admin" : canRead(tab, who)),
  );
/** True when this key means anything on this tab, whoever is pressing it. */
export const knows = (tab: Tab, key: string): boolean => DESK[tab].keys.some((offer) => offer.key === key);
/** What this person may do on this tab, in the words the screen's foot uses. */
export const offered = (tab: Tab, who: Who): string[] =>
  who.role === "admin" ? DESK[tab].keys.map((offer) => offer.label) : [];
  DESK[tab].keys.filter((offer) => mayPress(tab, offer.key, who)).map((offer) => offer.label);
/**
 * The orders this person may see at the keyboard, narrowed by what `/` is
 * looking for. It is `/orders`' rule, said once for the terminal: an admin
 * sees the shop's orders, anybody else the forge named sees the ones on their
 * own account, and whoever the forge did not name sees none — there is nothing
 * here that is theirs. A pty is not needed to check it: `Who` in, rows out.
 */
export const ordersFor = (who: Who, filter = "", limit = 100): Order[] =>
  who.role === "admin"
    ? orders.recent(limit, filter)
    : who.role === "user"
      ? orders.forBuyer(who.id, limit, filter)
      : [];
const no = (message: string): Done => ({ ok: false, message });
const yes = (message: string): Done => ({ ok: true, message });
@@ -99,7 +99,7 @@
export function layout(chrome: Chrome): string {
  <p><span class="env" style="background: ${env === "production" ? "#16653d" : "#1d4ed8"}">${escape(where)}</span>
  ${commit ? `<span class="muted"> @ ${escape(commit)}</span>` : ""}
  — a demonstration store: no goods ship and no money moves.</p>
  <p><a href="/orders">Find an order</a> · <a href="/gift-cards">Gift cards</a> — buy one, or see what is left on the one you hold.</p>
  <p><a href="/orders">Your orders</a> · <a href="/gift-cards">Gift cards</a> — buy one, or see what is left on the one you hold.</p>
  <p>${
    ssh
      ? `Same shop in a terminal: <code>${escape(ssh)}</code>`
@@ -68,7 +68,9 @@
export function receiptText(order: Order, items: OrderItem[], giftCardCodes: str
          ? "a gift card, in full"
          : "the mock gateway"
    }.`,
    `Lost the link to this order? The "Find an order" page takes ${order.number} with this email address.`,
    order.buyer_name === ""
      ? `Lost the link to this order? The "Your orders" page takes ${order.number} with this email address.`
      : `This order belongs to ${order.buyer_name}: it is listed on the "Your orders" page, signed in as them.`,
    "This is a demonstration store: no goods ship and no money moves.",
  ].join("\n");
}
@@ -1,11 +1,15 @@
/**
 * The orders this browser has placed, in a signed cookie beside the cart.
 * The guest orders this browser has found, in a signed cookie beside the cart.
 *
 * An order placed by an account is listed from the account, so what is left
 * for a cookie is the guest orders — the rows from before an order had an
 * account, which have nothing but their access token.
 *
 * Numbers and nothing else: the access token that actually opens an order is
 * read from the database on every render, so editing this cookie can only
 * change which order number is being claimed — and a number alone opens
 * nothing, because the link is built from the token in the row. Ten is as far
 * back as a cookie should remember; older orders are found with the form at
 * back as a cookie should remember; anything older is found with the form at
 * `/orders`, which asks for the email as well.
 */
@@ -0,0 +1,31 @@
/**
 * Where an order lives, for the person being handed the link.
 *
 * An order opens two ways: for the account it belongs to — and for an admin —
 * because the row says so, or for whoever holds its access token. When the row
 * is enough, the token has no business in the URL: it would be a secret
 * written into that person's history, their bookmarks and the `Referer` of
 * every link they follow next, for a page that did not need it. When the row
 * is not enough, the token is the only thing that opens the page, so the link
 * carries it.
 *
 * This is not a second door. `openOrder` in `src/shop.ts` is still the only
 * place that decides who may open an order; this asks the same question about
 * a link rather than about a request, and `openOrder` reads `opensByAccount`
 * from here so the two cannot drift apart.
 */
import type { Order } from "./db.ts";
import type { Who } from "./who.ts";
/** True when the row itself opens this order for this person. */
export const opensByAccount = (who: Who, order: Order): boolean =>
  who.role === "admin" || (who.role === "user" && order.buyer_id !== "" && order.buyer_id === who.id);
/** What a link to this order carries in its query for this person: nothing, or the token. */
export const tokenQuery = (who: Who, order: Order): string =>
  opensByAccount(who, order) ? "" : `?token=${encodeURIComponent(order.access_token)}`;
/** The order's page, or its payment page, as this person should be sent to it. */
export const linkTo = (who: Who, order: Order, page: "orders" | "pay" = "orders"): string =>
  `/${page}/${order.number}${tokenQuery(who, order)}`;
@@ -38,6 +38,9 @@
export type Address = {
  country: string;
};
/** The account an order belongs to: who the forge signed in, and nothing else. */
export type Buyer = { id: string; name: string };
export type PlaceResult = { ok: true; order: Order; reused: boolean } | { ok: false; error: string };
const ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
@@ -69,16 +72,41 @@
export const note = (orderId: number, kind: string, detail = ""): void => {
  db.query("INSERT INTO order_event (order_id, kind, detail) VALUES (?1, ?2, ?3)").run(orderId, kind, detail);
};
/** A needle for LIKE: the shopper's text is data, and `%` and `_` are theirs to type. */
const like = (needle: string): string => `%${needle.replace(/[\\%_]/g, (c) => "\\" + c)}%`;
/**
 * The orders one account placed, newest first, narrowed by a needle the way
 * the admin's search is. An empty id belongs to nobody, so it matches nothing:
 * the guest orders are not one account's to list. Whatever is typed, the
 * `buyer_id` is the caller's, so this can only narrow — never widen.
 */
export const forBuyer = (buyerId: string, limit = 50, query = ""): Order[] => {
  if (buyerId === "") return [];
  const needle = query.trim();
  if (needle === "")
    return db
      .query<Order, [string, number]>('SELECT * FROM "order" WHERE buyer_id = ?1 ORDER BY id DESC LIMIT ?2')
      .all(buyerId, limit);
  return db
    .query<Order, [string, string, number]>(
      `SELECT * FROM "order" WHERE buyer_id = ?1
         AND (number LIKE ?2 ESCAPE '\\' OR email LIKE ?2 ESCAPE '\\' OR name LIKE ?2 ESCAPE '\\')
       ORDER BY id DESC LIMIT ?3`,
    )
    .all(buyerId, like(needle), limit);
};
export const recent = (limit = 50, query = ""): Order[] => {
  const needle = query.trim();
  if (needle === "") return db.query<Order, [number]>('SELECT * FROM "order" ORDER BY id DESC LIMIT ?1').all(limit);
  const like = `%${needle.replace(/[\\%_]/g, (c) => "\\" + c)}%`;
  return db
    .query<Order, [string, number]>(
      `SELECT * FROM "order" WHERE number LIKE ?1 ESCAPE '\\' OR email LIKE ?1 ESCAPE '\\' OR name LIKE ?1 ESCAPE '\\'
         OR buyer_name LIKE ?1 ESCAPE '\\'
       ORDER BY id DESC LIMIT ?2`,
    )
    .all(like, limit);
    .all(like(needle), limit);
};
/** Remember the gateway's handle for an unpaid order (a Stripe session id). */
@@ -123,6 +151,8 @@
export function splitRefund(order: Order, amount_cents: number): { gateway_cents
 */
export function place(input: {
  address: Address;
  /** The account buying. An order is nobody's only if it was placed before accounts. */
  buyer: Buyer;
  cart: CartLine[];
  codes: Applied;
  /** What the checkout page showed, to be told when it went stale. */
@@ -163,10 +193,12 @@
export function place(input: {
        try {
          created = db
            .query<Order, any>(
              `INSERT INTO "order" (number, access_token, email, name, address1, address2, city, region, postal, country,
              `INSERT INTO "order" (number, access_token, buyer_id, buyer_name, email, name, address1, address2, city,
                 region, postal, country,
                 subtotal_cents, discount_code, discount_cents, shipping_cents, tax_cents, tax_rate_bp, tax_label,
                 gift_card_cents, total_cents, gateway, idempotency_key)
               VALUES ($number, $access_token, $email, $name, $address1, $address2, $city, $region, $postal, $country,
               VALUES ($number, $access_token, $buyer_id, $buyer_name, $email, $name, $address1, $address2, $city,
                 $region, $postal, $country,
                 $subtotal_cents, $discount_code, $discount_cents, $shipping_cents, $tax_cents, $tax_rate_bp, $tax_label,
                 $gift_card_cents, $total_cents, $gateway, $idempotency_key)
               RETURNING *`,
@@ -174,6 +206,8 @@
export function place(input: {
            .get({
              $number: orderNumber(),
              $access_token: randomBytes(18).toString("base64url"),
              $buyer_id: input.buyer.id.slice(0, 64),
              $buyer_name: input.buyer.name.slice(0, 120),
              $email: input.address.email,
              $name: input.address.name,
              $address1: input.address.address1,
@@ -233,7 +267,13 @@
export function place(input: {
        if (!takeStock(item.variant_id, item.quantity, `sold on ${created.number}`, created.id))
          throw new Error(`OUT_OF_STOCK:${item.product_title} (${item.variant_name})`);
      }
      note(created.id, "placed", `${itemRows.length} line${itemRows.length === 1 ? "" : "s"}, awaiting payment`);
      note(
        created.id,
        "placed",
        `${itemRows.length} line${itemRows.length === 1 ? "" : "s"}, awaiting payment${
          created.buyer_name === "" ? "" : ` — ${created.buyer_name}`
        }`,
      );
      return created;
    })();
  } catch (error) {
@@ -100,6 +100,14 @@
${live(
${live("latest-orders", ORDER_EVENTS, orderRows(latest))}
`;
/**
 * The account an order belongs to, beside the email the shopper typed. They
 * are different things: an account name is not an email address, and an order
 * from before accounts belongs to nobody but whoever holds its token.
 */
const account = (order: Order): string =>
  order.buyer_name === "" ? "guest" : `account ${escape(order.buyer_name)}`;
export function orderRows(orders: Order[]): string {
  if (orders.length === 0) return '<p class="muted">No orders yet.</p>';
  // Fixed columns: a row arriving at the top cannot move the ones below it
@@ -112,7 +120,9 @@
export function orderRows(orders: Order[]): string {
      (order) => `<tr>
    <td><a href="/admin/orders/${escape(order.number)}">${escape(order.number)}</a></td>
    <td class="muted">${escape(order.created_at)}</td>
    <td>${escape(order.name)}<div class="muted" style="font-size:.85rem">${escape(order.email)}</div></td>
    <td>${escape(order.name)}<div class="muted" style="font-size:.85rem">${escape(order.email)} · ${account(
      order,
    )}</div></td>
    <td>${statusPill(order.status)}</td>
    <td class="num price">${escape(formatCents(order.total_cents))}</td>
  </tr>`,
@@ -124,7 +134,8 @@
export const orders = (list: Order[], query: string): string => `
${nav("orders")}
<h1>Orders</h1>
<form method="get" action="/admin/orders" class="row-actions" style="margin-bottom:1rem">
  <input name="q" value="${escape(query)}" placeholder="Number, name or email" maxlength="80" style="max-width:22rem">
  <input name="q" value="${escape(query)}" placeholder="Number, name, email or account" maxlength="80"
    style="max-width:22rem">
  <button class="btn ghost">Search</button>
</form>
${live("order-list", ORDER_EVENTS, orderRows(list))}
@@ -145,7 +156,7 @@
export function order(
  return `
${nav("orders")}
<h1>${escape(found.number)} ${statusPill(found.status)}</h1>
<p class="lede">${escape(found.name)} · ${escape(found.email)} · ${escape(found.gateway)}${
<p class="lede">${escape(found.name)} · ${escape(found.email)} · ${account(found)} · ${escape(found.gateway)}${
    found.payment_ref ? ` · ${escape(found.payment_ref)}` : ""
  }</p>
${message ? `<p class="notice${message.bad ? " bad" : ""}">${escape(message.text)}</p>` : ""}
@@ -5,8 +5,10 @@
import { csrfField, escape } from "../html.ts";
import { formatCents } from "../money.ts";
import { FORGE_LINK_ATTRS, signInHref } from "../who.ts";
import type { Quote } from "../cart.ts";
import type { Session } from "../session.ts";
import type { Who } from "../who.ts";
const row = (label: string, value: string, className = ""): string =>
  `<div class="row ${className}"><span>${label}</span><span class="price">${value}</span></div>`;
@@ -65,7 +67,12 @@
export function codeBox(quote: Quote, session: Session, back: "cart" | "checkout
</div>`;
}
export function page(quote: Quote, session: Session, message?: string): string {
/**
 * The cart itself is open to anybody; buying is not, because an order belongs
 * to an account. A shopper who is not signed in is told that here, with a full
 * cart in front of them, rather than after they have typed an address.
 */
export function page(quote: Quote, session: Session, who: Who, message?: string): string {
  if (quote.lines.length === 0)
    return `<h1>Your cart</h1><p class="lede">Nothing in it yet.</p><p><a class="btn" href="/">Look around</a></p>`;
  const rows = quote.lines
@@ -106,6 +113,13 @@
export function page(quote: Quote, session: Session, message?: string): string {
  return `
<h1>Your cart</h1>
${message ? `<p class="notice">${escape(message)}</p>` : ""}
${
  who.role === "anon"
    ? `<p class="notice">Buying needs an account — this cart does not.
       <a ${FORGE_LINK_ATTRS} href="${escape(signInHref("/checkout"))}">Sign in to buy</a>
       and your cart comes with you.</p>`
    : ""
}
${quote.problems.concat(quote.code_problems).map((problem) => `<p class="notice bad">${escape(problem)}</p>`).join("\n")}
<table>
  <thead><tr><th>Item</th><th class="num">Price</th><th>Quantity</th><th class="num">Line</th><th></th></tr></thead>
@@ -9,6 +9,8 @@
import { HOME_COUNTRY } from "../tax.ts";
import { csrfField, escape } from "../html.ts";
import { dueCents, formatCents } from "../money.ts";
import { codeBox, totals } from "./cart.ts";
import { tokenQuery } from "../orderlink.ts";
import { FORGE_LINK_ATTRS, signInHref } from "../who.ts";
import type { Quote } from "../cart.ts";
import type { Order, OrderItem, Payment } from "../db.ts";
import type { Shortfall } from "../orders.ts";
@@ -28,14 +30,22 @@
const field = (
    ${options.autocomplete ? `autocomplete="${escape(options.autocomplete)}"` : ""}>
</label></div>`;
export function checkout(
  quote: Quote,
  session: Session,
  gateway: GatewayInfo,
  idempotencyKey: string,
  values: Record<string, string>,
  error?: string,
): string {
/**
 * Checkout. An order belongs to an account, so a shopper the forge has not
 * signed in is shown the same order summary with the address form replaced by
 * one way forward: sign in, and come back to this page with this cart.
 */
export function checkout(input: {
  quote: Quote;
  session: Session;
  /** Who the forge says is buying; anon sees the invitation instead of the form. */
  who: Who;
  gateway: GatewayInfo;
  idempotencyKey: string;
  values: Record<string, string>;
  error?: string;
}): string {
  const { quote, session, who, gateway, values, error } = input;
  const summary = quote.lines
    .map(
      (line) =>
@@ -43,15 +53,21 @@
export function checkout(
         <td class="num">${line.quantity}</td><td class="num price">${escape(formatCents(line.line_total_cents))}</td></tr>`,
    )
    .join("\n");
  return `
<h1>Checkout</h1>
${error ? `<p class="notice bad">${escape(error)}</p>` : ""}
${quote.problems.concat(quote.code_problems).map((problem) => `<p class="notice bad">${escape(problem)}</p>`).join("\n")}
<div class="product">
  <form method="post" action="/checkout">
  const left =
    who.role === "anon"
      ? `<div>
    <h2 style="margin-top:0">Sign in to buy</h2>
    <p>An order belongs to an account: it is how you find it again, and how this shop knows
    whose it is. Browsing and this cart do not need one.</p>
    <p><a class="btn" ${FORGE_LINK_ATTRS} href="${escape(signInHref("/checkout"))}">Sign in to buy</a></p>
    <p class="muted" style="font-size:.88rem">Your cart is kept exactly as it is, and the address is
    asked for on the way back.</p>
  </div>`
      : `<form method="post" action="/checkout">
    ${csrfField(session)}
    <input type="hidden" name="idempotency" value="${escape(idempotencyKey)}">
    <input type="hidden" name="idempotency" value="${escape(input.idempotencyKey)}">
    <h2 style="margin-top:0">Where it goes</h2>
    <p class="muted" style="font-size:.88rem">This order will belong to <strong>${escape(who.name)}</strong>.</p>
    <div class="fields">
      ${field("email", "Email", values.email ?? "", { wide: true, type: "email", autocomplete: "email" })}
      ${field("name", "Full name", values.name ?? "", { wide: true, autocomplete: "name" })}
@@ -68,7 +84,13 @@
${quote.problems.concat(quote.code_problems).map((problem) => `<p class="notice
    </div>
    <p class="muted" style="font-size:.88rem; margin-top:1rem">Payment is taken next, by ${escape(gateway.label)}.</p>
    <button class="btn" style="margin-top:.5rem">Continue to payment</button>
  </form>
  </form>`;
  return `
<h1>Checkout</h1>
${error ? `<p class="notice bad">${escape(error)}</p>` : ""}
${quote.problems.concat(quote.code_problems).map((problem) => `<p class="notice bad">${escape(problem)}</p>`).join("\n")}
<div class="product">
  ${left}
  <div>
    <h2 style="margin-top:0">Your order</h2>
    <table><tbody>${summary}</tbody></table>
@@ -221,6 +243,9 @@
export function confirmation(
  // A card's code is printed once, on the receipt. Say so here: a buyer who
  // closes this tab without opening it has bought something they cannot spend.
  const cards = items.reduce((count, item) => count + (item.gift_card_cents > 0 ? item.quantity : 0), 0);
  // What every link away from here carries: nothing for the account this
  // order opens for, the token for whoever it took a token to get here.
  const key = tokenQuery(who, order);
  return `
<h1>${paid ? "Thank you" : "Order " + escape(order.number)}</h1>
<p class="lede">Order ${escape(order.number)} · ${statusPill(order.status)} · placed ${escape(order.created_at)} UTC</p>
@@ -229,22 +254,20 @@
${
    ? shortPayment(order, short)
    : order.status === "pending_payment"
      ? `<p class="notice">This order is not paid yet.
       <a href="/pay/${escape(order.number)}?token=${escape(order.access_token)}">Finish paying</a>.</p>`
       <a href="/pay/${escape(order.number)}${escape(key)}">Finish paying</a>.</p>`
      : ""
}
${
  paid && email
    ? `<p class="notice">A receipt was written to <strong>${escape(order.email)}</strong>.
       <a href="/orders/${escape(order.number)}/receipt?token=${escape(order.access_token)}">Read it</a>
       <a href="/orders/${escape(order.number)}/receipt${escape(key)}">Read it</a>
       — this store has no mail server, so receipts are kept here instead of sent.</p>`
    : ""
}
${
  paid && cards > 0
    ? `<p class="notice">${cards === 1 ? "The gift card's code is" : `The ${cards} gift card codes are`} on the receipt,
       and that is the only copy. <a href="/orders/${escape(order.number)}/receipt?token=${escape(
         order.access_token,
       )}">Open the receipt</a> and keep ${cards === 1 ? "it" : "them"} somewhere safe — whoever has the code can spend it,
       and that is the only copy. <a href="/orders/${escape(order.number)}/receipt${escape(key)}">Open the receipt</a> and keep ${cards === 1 ? "it" : "them"} somewhere safe — whoever has the code can spend it,
       and <a href="/gift-cards">/gift-cards</a> says what is left on one.</p>`
    : ""
}
@@ -252,14 +275,19 @@
${itemsTable(items)}
${orderTotals(order, refunded)}
<h2>Shipping to</h2>
<p>${addressBlock(order)}<br><span class="muted">${escape(order.email)}</span></p>
<p class="muted">Keep this address — it is what opens this order. If you lose it,
<a href="/orders">find the order</a> again with its number and ${escape(order.email)}.
${
  order.buyer_id === ""
    ? `<p class="muted">Keep this address — it is what opens this order. If you lose it,
<a href="/orders">find the order</a> again with its number and ${escape(order.email)}.`
    : `<p class="muted">This order belongs to <strong>${escape(order.buyer_name)}</strong>: it is listed in
<a href="/orders">your orders</a> and opens there without a link to keep.`
}
${who.role === "admin" ? `<a href="/admin/orders/${escape(order.number)}">Open in admin</a>.` : ""}</p>
`;
}
/** The receipt, rendered as the email it would have been. */
export const receipt = (order: Order, email: Email): string => `
export const receipt = (order: Order, email: Email, who: Who): string => `
<div class="receipt">
  <div class="head">
    <div><strong>From</strong> [email protected]</div>
@@ -270,6 +298,6 @@
export const receipt = (order: Order, email: Email): string => `
  <pre>${escape(email.body)}</pre>
</div>
<p style="text-align:center; margin-top:1.5rem">
  <a class="btn ghost" href="/orders/${escape(order.number)}?token=${escape(order.access_token)}">Back to the order</a>
  <a class="btn ghost" href="/orders/${escape(order.number)}${escape(tokenQuery(who, order))}">Back to the order</a>
</p>
`;
@@ -1,66 +0,0 @@
/**
 * "Find an order": the way back to an order once the link is gone.
 *
 * Two things are on this page — the orders this browser remembers placing,
 * and a form that asks for an order number and the email it was placed with.
 * Every link here carries the order's own access token, so the page that
 * opens is the same one the shopper was sent to at checkout.
 */
import { csrfField, escape } from "../html.ts";
import { formatCents } from "../money.ts";
import { statusPill } from "./checkout.ts";
import type { Order } from "../db.ts";
import type { Session } from "../session.ts";
const row = (order: Order): string => `<tr>
  <td><a href="/orders/${escape(order.number)}?token=${escape(order.access_token)}">${escape(order.number)}</a></td>
  <td class="muted">${escape(order.created_at)} UTC</td>
  <td>${statusPill(order.status)}</td>
  <td class="num price">${escape(formatCents(order.total_cents))}</td>
</tr>`;
export function find(
  mine: Order[],
  session: Session,
  values: { number?: string; email?: string } = {},
  error?: string,
): string {
  return `
<h1>Find an order</h1>
<p class="lede">An order is private, so it opens with its own link. Type the order number and the
email it was placed with and the link is handed back to you.</p>
${error ? `<p class="notice bad">${escape(error)}</p>` : ""}
<form method="post" action="/orders/find" class="lookup">
  ${csrfField(session)}
  <div>
    <label>Order number
      <input name="number" value="${escape(values.number ?? "")}" maxlength="20" required
        placeholder="BZ-XXXXXXXX" autocapitalize="characters" autocomplete="off">
    </label>
  </div>
  <div>
    <label>Email
      <input name="email" type="email" value="${escape(values.email ?? "")}" maxlength="200" required
        autocomplete="email">
    </label>
    <button class="btn" style="margin-top:.75rem">Find it</button>
  </div>
</form>
${
  mine.length === 0
    ? `<p class="muted" style="margin-top:2rem">No orders have been placed from this browser.</p>`
    : `<h2 style="margin-top:2rem">From this browser</h2>
<table>
  <thead><tr><th>Order</th><th>Placed</th><th>Status</th><th class="num">Total</th></tr></thead>
  <tbody>${mine.map(row).join("\n")}</tbody>
</table>
<p class="muted">The last ${mine.length === 1 ? "order" : mine.length + " orders"} placed here, remembered in a
signed cookie that holds order numbers and nothing else. On a shared computer, drop it:</p>
<form method="post" action="/orders/forget">
  ${csrfField(session)}
  <button class="btn ghost">Forget these orders</button>
</form>`
}
`;
}
@@ -0,0 +1,127 @@
/**
 * `/orders`: what an account has bought, and the way back to a guest order.
 *
 * An order belongs to the account that placed it, so an account's own orders
 * are listed here and their links carry no token — the row says whose they
 * are. A shopper the forge has not signed in is shown the door in, never a
 * list: there is nothing here that is anybody's until somebody is somebody.
 *
 * Under that, whoever is asking, the guest orders this browser has found —
 * rows from before an order had an account, which have nothing but their
 * access token — and the form that finds one by its number and the email it
 * was placed with. That half belongs to the browser rather than to an account,
 * so an anonymous shopper sees it too: it is the only half that is theirs.
 */
import { csrfField, escape } from "../html.ts";
import { formatCents } from "../money.ts";
import { statusPill } from "./checkout.ts";
import { FORGE_LINK_ATTRS, signInHref } from "../who.ts";
import type { Order } from "../db.ts";
import type { Session } from "../session.ts";
import type { Who } from "../who.ts";
/** An order this account owns: it opens for them, so the link needs nothing. */
const ownRow = (order: Order): string => `<tr>
  <td><a href="/orders/${escape(order.number)}">${escape(order.number)}</a></td>
  <td class="muted">${escape(order.created_at)} UTC</td>
  <td>${statusPill(order.status)}</td>
  <td class="num price">${escape(formatCents(order.total_cents))}</td>
</tr>`;
/** A guest order: only its own access token opens it, so the link carries one. */
const guestRow = (order: Order): string => `<tr>
  <td><a href="/orders/${escape(order.number)}?token=${escape(order.access_token)}">${escape(order.number)}</a></td>
  <td class="muted">${escape(order.created_at)} UTC</td>
  <td>${statusPill(order.status)}</td>
  <td class="num price">${escape(formatCents(order.total_cents))}</td>
</tr>`;
const table = (rows: string): string => `<table>
  <thead><tr><th>Order</th><th>Placed</th><th>Status</th><th class="num">Total</th></tr></thead>
  <tbody>${rows}</tbody>
</table>`;
/** The form that finds an order nobody's account can claim. */
const lookup = (session: Session, values: { number?: string; email?: string }): string => `
<form method="post" action="/orders/find" class="lookup">
  ${csrfField(session)}
  <div>
    <label>Order number
      <input name="number" value="${escape(values.number ?? "")}" maxlength="20" required
        placeholder="BZ-XXXXXXXX" autocapitalize="characters" autocomplete="off">
    </label>
  </div>
  <div>
    <label>Email
      <input name="email" type="email" value="${escape(values.email ?? "")}" maxlength="200" required
        autocomplete="email">
    </label>
    <button class="btn" style="margin-top:.75rem">Find it</button>
  </div>
</form>`;
/**
 * The guest half, shown to whoever is holding the cookie — signed in or not.
 * A guest order is found by a browser, not by an account, so the browser that
 * found it has to be able to see the list it was added to and to drop it.
 */
const guestHalf = (guests: Order[], session: Session): string =>
  guests.length === 0
    ? ""
    : `<h2 style="margin-top:2rem">Guest orders found in this browser</h2>
<p class="muted">Placed before an order had an account, so an access token is all they have. They are
remembered in a signed cookie that holds order numbers and nothing else; on a shared computer, drop it:</p>
${table(guests.map(guestRow).join("\n"))}
<form method="post" action="/orders/forget">
  ${csrfField(session)}
  <button class="btn ghost">Forget these orders</button>
</form>`;
const findHalf = (session: Session, values: { number?: string; email?: string }): string => `
<h2 style="margin-top:2rem">Find a guest order</h2>
<p class="muted">An order placed as a guest, before accounts, opens with its own link. Type the order
number and the email it was placed with and the link is handed back to you. An order bought with an
account is not found this way — sign in and it is listed above.</p>
${lookup(session, values)}`;
export function page(input: {
  who: Who;
  /** The signed-in account's own orders, newest first. Empty for anon. */
  mine: Order[];
  /** Guest orders this browser has found: no account owns them. */
  guests: Order[];
  session: Session;
  /** Where signing in should come back to. */
  path: string;
  values?: { number?: string; email?: string };
  error?: string;
}): string {
  const values = input.values ?? {};
  const error = input.error ? `<p class="notice bad">${escape(input.error)}</p>` : "";
  if (input.who.role === "anon")
    return `
<h1>Your orders</h1>
<p class="lede">An order belongs to the account that placed it. Sign in and the orders you have
bought are listed here, each opening without a link to keep.</p>
${error}
<p><a class="btn" ${FORGE_LINK_ATTRS} href="${escape(signInHref(input.path))}">Sign in to see your orders</a></p>
${guestHalf(input.guests, input.session)}
${findHalf(input.session, values)}
`;
  return `
<h1>Your orders</h1>
<p class="lede">The orders on <strong>${escape(input.who.name)}</strong>, newest first. Each one opens
for this account — there is no link to keep.</p>
${error}
${
  input.mine.length === 0
    ? `<p class="muted">Nothing bought on this account yet.</p><p><a class="btn" href="/">Look around</a></p>`
    : table(input.mine.map(ownRow).join("\n"))
}
${guestHalf(input.guests, input.session)}
${findHalf(input.session, values)}
`;
}
@@ -41,7 +41,7 @@
export const routes: Route[] = [
  { method: "POST", pattern: "/pay/:number/stripe", handler: shop.payStripe },
  { method: "POST", pattern: "/webhooks/stripe", handler: shop.stripeWebhook, csrf: false, raw: true },
  { method: "GET", pattern: "/orders", handler: (ctx) => shop.findForm(ctx) },
  { method: "GET", pattern: "/orders", handler: (ctx) => shop.ordersPage(ctx) },
  { method: "POST", pattern: "/orders/find", handler: shop.findOrder },
  { method: "POST", pattern: "/orders/forget", handler: shop.forgetOrders },
  { method: "GET", pattern: "/orders/:number", handler: shop.orderPage },
@@ -79,6 +79,16 @@
export const routes: Route[] = [
export type Match = { route: Route; params: Record<string, string> };
/**
 * True when a GET of this route's own path renders a page. A POST-only
 * pattern is not one — `/orders/find` is answered by `GET /orders/:number`,
 * which is a 404 for an order called "find" — so the pattern has to be listed
 * for GET itself, not merely be shaped like something that is. The front door
 * asks this to work out where signing in comes back to.
 */
export const getAnswers = (pattern: string): boolean =>
  routes.some((route) => route.method === "GET" && route.pattern === pattern);
/** A path segment a browser mangled is still a string, not a crash. */
const decodeOrRaw = (segment: string): string => {
  try {
@@ -35,6 +35,11 @@
class Shopper {
  /** Who the forge says this browser is; undefined is a signed-out visitor. */
  constructor(private person?: Person) {}
  /** The same browser, and the same cookies, once the forge has signed it in. */
  signIn(person: Person): void {
    this.person = person;
  }
  private forge(): Record<string, string> {
    return identityHeaders(this.person);
  }
@@ -97,6 +102,17 @@
class Shopper {
/** An admin, the way the forge signs one in. */
const asAdmin = (): Shopper => new Shopper({ id: "u_1", name: "ada", role: "admin" });
/**
 * A shopper with an account, because buying needs one: an order belongs to
 * the account that placed it. Each call is a different person.
 */
let accounts = 0;
const account = (): Person => {
  accounts += 1;
  return { id: `u_shopper_${accounts}`, name: `shopper${accounts}`, role: "user" };
};
const asCustomer = (): Shopper => new Shopper(account());
const variantId = (sku: string): number =>
  db.query<{ id: number }, [string]>("SELECT id FROM variant WHERE sku = ?1").get(sku)!.id;
const stockOf = (sku: string): number =>
@@ -344,7 +360,7 @@
test("a cart cookie from somewhere else is ignored", async () => {
test("checkout refuses an address it cannot use", async () => {
  const orders = (): number => db.query<{ n: number }, []>('SELECT COUNT(*) AS n FROM "order"').get()!.n;
  const before = orders();
  const shopper = new Shopper();
  const shopper = asCustomer();
  const product = await shopper.page("/p/house-espresso");
  await shopper.post(
    "/cart/add",
@@ -371,7 +387,7 @@
test("checkout refuses an address it cannot use", async () => {
});
test("a purchase takes stock, records a charge and writes a receipt", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const before = stockOf("COF-GUJI-250");
  const { number, token } = await buy(shopper, "COF-GUJI-250", 2);
  expect(stockOf("COF-GUJI-250")).toBe(before - 2);
@@ -403,7 +419,7 @@
test("a purchase takes stock, records a charge and writes a receipt", async () =
test("a discount, a part-spent gift card and a state's rate become an order that adds up", async () => {
  limit.forget();
  const shopper = new Shopper();
  const shopper = asCustomer();
  // A card someone has already spent $15 of, so $35 of its $50 is left.
  const { card, code } = giftcards.issue({ cents: 5000, note: "bought earlier" });
  expect(giftcards.spend(card.id, 1500, "spent at another till")).toBe(true);
@@ -487,8 +503,8 @@
test("two orders on one gift card spend what is on it and no more", async () =>
  const { card, code } = giftcards.issue({ cents: 3000, note: "one card, two shoppers" });
  // Two shoppers hold the same code, each with $23.32 to pay.
  const first = new Shopper();
  const second = new Shopper();
  const first = asCustomer();
  const second = asCustomer();
  for (const shopper of [first, second]) {
    await addToCart(shopper, "COF-HOUSE-250", 1);
    expect((await applyCode(shopper, code)).headers.get("location")).toContain("m=applied");
@@ -539,16 +555,156 @@
test("two orders on one gift card spend what is on it and no more", async () =>
  expect(giftcards.byId(card.id)!.balance_cents).toBe(0);
});
test("an order is only reached with its own token", async () => {
  const shopper = new Shopper();
test("an order opens for its buyer with no token, and for nobody else without one", async () => {
  const shopper = asCustomer();
  const { number, token } = await buy(shopper, "COF-HOUSE-250", 1);
  expect((await shopper.get(`/orders/${number}`)).status).toBe(404);
  expect((await shopper.get(`/orders/${number}?token=wrong`)).status).toBe(404);
  expect((await shopper.get(`/orders/${number}?token=${encodeURIComponent(token)}`)).status).toBe(200);
  // Its buyer needs nothing: the row says whose it is.
  expect((await shopper.get(`/orders/${number}`)).status).toBe(200);
  expect((await shopper.get(`/orders/${number}/receipt`)).status).toBe(200);
  expect(await shopper.page(`/orders/${number}`)).toContain(number);
  // A second account is a stranger, signed in or not, and so is a bad token.
  const other = asCustomer();
  expect((await other.get(`/orders/${number}`)).status).toBe(404);
  expect((await other.get(`/orders/${number}/receipt`)).status).toBe(404);
  expect((await other.get(`/pay/${number}`)).status).toBe(404);
  expect((await new Shopper().get(`/orders/${number}`)).status).toBe(404);
  expect((await shopper.get(`/orders/${number}?token=wrong`)).status).toBe(200); // still theirs
  expect((await other.get(`/orders/${number}?token=wrong`)).status).toBe(404);
  // The token still opens it for whoever holds the link, which is what the
  // receipt and Stripe's return URL carry.
  expect((await new Shopper().get(`/orders/${number}?token=${encodeURIComponent(token)}`)).status).toBe(200);
  expect((await other.get(`/orders/${number}?token=${encodeURIComponent(token)}`)).status).toBe(200);
  // And an admin keeps their way in.
  expect((await asAdmin().get(`/orders/${number}`)).status).toBe(200);
});
test("an order belongs to the account that placed it", async () => {
  const shopper = asCustomer();
  const { number } = await buy(shopper, "COF-HOUSE-250", 1);
  const order = orderNamed(number);
  expect(order.buyer_id).toMatch(/^u_shopper_\d+$/);
  expect(order.buyer_name).toMatch(/^shopper\d+$/);
  // The email is the address the shopper typed, never the account's name.
  expect(order.email).toBe("[email protected]");
  expect(await asAdmin().page(`/admin/orders/${number}`)).toContain(`account ${order.buyer_name}`);
  expect(await asAdmin().page("/admin/orders")).toContain(`account ${order.buyer_name}`);
});
test("a cart filled as a guest becomes that account's order once they sign in", async () => {
  limit.forget();
  const shopper = new Shopper();
  await addToCart(shopper, "COF-GUJI-250", 1);
  expect((await applyCode(shopper, "welcome10")).headers.get("location")).toContain("m=applied");
  // Checkout shows the same order summary, and one way forward.
  const invited = await shopper.page("/checkout");
  expect(invited).toContain("Sign in to buy");
  expect(invited).toContain('href="/__forge/signin?to=%2Fcheckout"');
  expect(invited).toContain("Ethiopia Guji");
  expect(invited).not.toContain('name="address1"');
  expect(await shopper.page("/cart")).toContain("Buying needs an account");
  // And a POST writes nothing at all: no order, no stock taken, no code used.
  const orders = () => db.query<{ n: number }, []>('SELECT COUNT(*) AS n FROM "order"').get()!.n;
  const used = () => db.query<any, []>("SELECT used_count FROM discount WHERE code = 'WELCOME10'").get()!.used_count;
  const before = { orders: orders(), stock: stockOf("COF-GUJI-250"), used: used() };
  const refused = await shopper.post(
    "/checkout",
    { ...ADDRESS, idempotency: "anything" },
    Shopper.tokenIn(invited),
  );
  expect(refused.status).toBe(303);
  expect(refused.headers.get("location")).toBe("/checkout");
  expect(orders()).toBe(before.orders);
  expect(stockOf("COF-GUJI-250")).toBe(before.stock);
  expect(used()).toBe(before.used);
  // The same browser, the same cart, once the forge has signed it in.
  const person = account();
  shopper.signIn(person);
  const form = await shopper.page("/checkout");
  expect(form).toContain('name="address1"');
  expect(form).toContain(person.name);
  expect(form).toContain("Ethiopia Guji");
  const placed = await submitCheckout(shopper);
  expect(placed.status).toBe(303);
  const { number } = orderAt(placed.headers.get("location")!);
  expect(orderNamed(number).buyer_id).toBe(person.id);
  expect(stockOf("COF-GUJI-250")).toBe(before.stock - 1);
  limit.forget();
});
test("a guest order from before accounts keeps its story: the token, and the form", async () => {
  limit.forget();
  // A row as it was written before an order had an account: no buyer at all.
  const legacy = db
    .query<any, []>(
      `INSERT INTO "order" (number, access_token, email, name, address1, city, postal, country,
         subtotal_cents, shipping_cents, tax_cents, total_cents, idempotency_key, status)
       VALUES ('BZ-LEGACY01', 'legacy-token-abc', '[email protected]', 'Old Guest', '9 Old Road', 'Testville',
         '12345', 'United States', 1000, 600, 0, 1600, 'legacy-key', 'paid')
       RETURNING *`,
    )
    .get()!;
  expect(legacy.buyer_id).toBe("");
  expect(legacy.buyer_name).toBe("");
  const guest = new Shopper();
  expect((await guest.get("/orders/BZ-LEGACY01")).status).toBe(404);
  const opened = await guest.get(`/orders/BZ-LEGACY01?token=${legacy.access_token}`);
  expect(opened.status).toBe(200);
  expect(await opened.text()).toContain("BZ-LEGACY01");
  // An account that finds it by number and email sees it listed as a guest
  // order — and can drop it, because a shared browser is not a shopper's.
  const shopper = asCustomer();
  const form = await shopper.page("/orders");
  const found = await shopper.post(
    "/orders/find",
    { number: "BZ-LEGACY01", email: "[email protected]" },
    Shopper.tokenIn(form),
  );
  expect(found.status).toBe(303);
  expect(found.headers.get("location")).toContain("token=");
  const listed = await shopper.page("/orders");
  expect(listed).toContain("BZ-LEGACY01");
  expect(listed).toContain("Guest orders found in this browser");
  const forgotten = await shopper.post("/orders/forget", {}, Shopper.tokenIn(listed));
  expect(forgotten.status).toBe(303);
  expect(await shopper.page("/orders")).not.toContain("BZ-LEGACY01");
  // Forgetting is a POST from this page and nowhere else.
  expect((await shopper.post("/orders/forget", {})).status).toBe(403);
  // The same door for a browser the forge has not signed in, because a guest
  // order is a browser's and not an account's: what the cookie was written
  // with is a list they can see, and a list they can drop. A cookie nobody can
  // read is worse than no cookie at all.
  const anon = new Shopper();
  const invitation = await anon.page("/orders");
  expect(invitation).toContain("Sign in to see your orders");
  expect(invitation).not.toContain("Guest orders found in this browser");
  const handed = await anon.post(
    "/orders/find",
    { number: "BZ-LEGACY01", email: "[email protected]" },
    Shopper.tokenIn(invitation),
  );
  expect(handed.status).toBe(303);
  const anonList = await anon.page("/orders");
  expect(anonList).toContain("BZ-LEGACY01");
  expect(anonList).toContain("Guest orders found in this browser");
  const dropped = await anon.post("/orders/forget", {}, Shopper.tokenIn(anonList));
  expect(dropped.status).toBe(303);
  expect(await anon.page("/orders")).not.toContain("BZ-LEGACY01");
  limit.forget();
});
test("a declined payment leaves the order unpaid and charges nothing", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const product = await shopper.page("/p/stoneware-mug");
  await shopper.post("/cart/add", { variant: String(variantId("KIT-MUG-OAT")), quantity: "1" }, Shopper.tokenIn(product));
  const checkout = await shopper.page("/checkout");
@@ -581,7 +737,7 @@
test("a declined payment leaves the order unpaid and charges nothing", async ()
});
test("the same checkout form submitted twice places one order", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const product = await shopper.page("/p/paper-filters");
  await shopper.post("/cart/add", { variant: String(variantId("BRW-FILT-100")), quantity: "1" }, Shopper.tokenIn(product));
  const checkout = await shopper.page("/checkout");
@@ -604,7 +760,7 @@
test("the same checkout form submitted twice places one order", async () => {
});
test("something sold out cannot be bought", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const product = await shopper.page("/p/stoneware-mug");
  expect(product).toContain("sold out"); // KIT-MUG-RUST is seeded at zero
  const added = await shopper.post(
@@ -637,7 +793,7 @@
test("something sold out cannot be bought", async () => {
test("checkout is rate limited", async () => {
  limit.forget();
  const shopper = new Shopper();
  const shopper = asCustomer();
  const product = await shopper.page("/p/paper-filters");
  await shopper.post("/cart/add", { variant: String(variantId("BRW-FILT-100")), quantity: "1" }, Shopper.tokenIn(product));
  const checkout = await shopper.page("/checkout");
@@ -678,7 +834,9 @@
test("the admin form refuses an expiry that is not a date, on the page as at the
test("the checkout bucket is the whole shop's, and it refills", async () => {
  limit.forget();
  const first = new Shopper();
  // Both browsers are signed in: an anon POST /checkout never reaches the till,
  // so a bucket emptied by one of those would prove nothing about the till.
  const first = asCustomer();
  const product = await first.page("/p/paper-filters");
  await first.post("/cart/add", { variant: String(variantId("BRW-FILT-100")), quantity: "1" }, Shopper.tokenIn(product));
  const token = Shopper.tokenIn(await first.page("/checkout"));
@@ -692,7 +850,7 @@
test("the checkout bucket is the whole shop's, and it refills", async () => {
  // keyed on that and nothing else, so an emptied till is emptied for the next
  // shopper too. That is the trade the capacity is set for: thirty checkouts a
  // minute is a shop's minute, which ordinary trade never spends.
  const second = new Shopper();
  const second = asCustomer();
  const theirs = await second.page("/p/paper-filters");
  await second.post("/cart/add", { variant: String(variantId("BRW-FILT-100")), quantity: "1" }, Shopper.tokenIn(theirs));
  const checkout = await second.page("/checkout");
@@ -720,7 +878,7 @@
test("an unsigned webhook is refused", async () => {
test("/admin opens for an admin the forge signed, and refunds and restocks", async () => {
  limit.forget();
  const shopper = new Shopper();
  const shopper = asCustomer();
  const { number } = await buy(shopper, "COF-GUJI-1000", 1);
  const admin = asAdmin();
@@ -777,34 +935,109 @@
test("no link to the forge carries a referrer, so the page's query stays here",
});
test("signing in from a page the token opened lands somewhere that answers", async () => {
  limit.forget();
  // Mid-purchase on /pay/:number?token=…: the token is deliberately kept out
  // of to=, so the return has to be a page that opens without it.
  const shopper = new Shopper();
  await addToCart(shopper, "COF-HOUSE-250", 1);
  const placed = await submitCheckout(shopper);
  const person = account();
  const buyer = new Shopper(person);
  await addToCart(buyer, "COF-HOUSE-250", 1);
  const placed = await submitCheckout(buyer);
  const { number, token } = orderAt(placed.headers.get("location")!);
  /** Open a page with its token, follow the header's "Sign in", come back. */
  const throughTheHeader = async (path: string): Promise<void> => {
    const page = await shopper.page(path);
  /**
   * A browser holding the link and no account: open the page with its token,
   * follow the header's "Sign in", and come back as `whom` to a page that
   * answers with `listed` on it.
   */
  const throughTheHeader = async (path: string, whom: Person, listed: string): Promise<void> => {
    const holder = new Shopper();
    const page = await holder.page(path);
    expect(page).toContain("Sign in");
    const to = decodeURIComponent(/\/__forge\/signin\?to=([^"]+)"/.exec(page)![1]!);
    expect(to).not.toContain(token);
    // the forge signs them in and sends the same browser on to `to=`
    const signedIn = new Shopper({ id: "u_9", name: "cy", role: "user" });
    signedIn.jar = shopper.jar;
    const landed = await signedIn.get(to);
    holder.signIn(whom);
    const landed = await holder.get(to);
    expect(landed.status).toBe(200);
    // and the order is one click from where they land: this browser's orders
    // are listed there, each with its own token link
    expect(await landed.text()).toContain(`/orders/${number}?token=${token}`);
    expect(await landed.text()).toContain(listed);
  };
  await throughTheHeader(`/pay/${number}?token=${encodeURIComponent(token)}`);
  await throughTheHeader(`/orders/${number}?token=${encodeURIComponent(token)}`);
  expect((await payMock(shopper, number, token)).status).toBe(303);
  await throughTheHeader(`/orders/${number}/receipt?token=${encodeURIComponent(token)}`);
  // The buyer, on a browser the forge has not signed them into yet: they land
  // on their own orders, and this one opens for them with no token at all.
  await throughTheHeader(`/pay/${number}?token=${encodeURIComponent(token)}`, person, `href="/orders/${number}"`);
  // The same order as a row from before accounts — nothing but its token —
  // which is now the only way to be part-way through paying with no account.
  db.query('UPDATE "order" SET buyer_id = \'\', buyer_name = \'\' WHERE number = ?1').run(number);
  const stranger: Person = { id: "u_9", name: "cy", role: "user" };
  // The order is one click from where they land: the guest orders this
  // browser found are listed there, each with its own token link.
  const guestLink = `/orders/${number}?token=${token}`;
  await throughTheHeader(`/pay/${number}?token=${encodeURIComponent(token)}`, stranger, guestLink);
  await throughTheHeader(`/orders/${number}?token=${encodeURIComponent(token)}`, stranger, guestLink);
  expect((await payMock(new Shopper(), number, token)).status).toBe(303);
  await throughTheHeader(`/orders/${number}/receipt?token=${encodeURIComponent(token)}`, stranger, guestLink);
  limit.forget();
});
test("a missed order lookup still offers a way in that answers", async () => {
  limit.forget();
  // POST /orders/find renders "Your orders" when the lookup misses, and a GET
  // of /orders/find is a 404: the sign-in offered on that page must not point
  // at the page it is standing on.
  const guest = new Shopper();
  const page = await guest.page("/orders");
  const missed = await guest.post(
    "/orders/find",
    { number: "BZ-NOTHERE", email: "[email protected]" },
    Shopper.tokenIn(page),
  );
  expect(missed.status).toBe(200);
  const body = await missed.text();
  expect(body).toContain("No guest order here matches");
  expect(body).not.toContain("to=%2Forders%2Ffind");
  // both the page's button and the header's link, and they are the same one
  expect([...body.matchAll(/\/__forge\/signin\?to=([^"]+)"/g)].map((found) => found[1])).toEqual([
    "%2Forders",
    "%2Forders",
  ]);
  expect((await guest.get("/orders")).status).toBe(200);
  expect((await guest.get("/orders/find")).status).toBe(404);
  limit.forget();
});
test("the token stays out of the URL of a buyer the order opens for anyway", async () => {
  limit.forget();
  const person = account();
  const buyer = new Shopper(person);
  await addToCart(buyer, "COF-GUJI-250", 1);
  const placed = await submitCheckout(buyer);
  const { number, token } = orderAt(placed.headers.get("location")!);
  // The buyer, signed in, opens the payment page by account — no token in the
  // query — and approving lands them on the order with none either.
  const payPage = await buyer.page(`/pay/${number}`);
  const paid = await buyer.post(`/pay/${number}/mock`, { token, decision: "approve" }, Shopper.tokenIn(payPage));
  expect(paid.headers.get("location")).toBe(`/orders/${number}`);
  // and the order's own page links on without handing them their token back
  const confirmation = await buyer.page(`/orders/${number}`);
  expect(confirmation).toContain(`href="/orders/${number}/receipt"`);
  expect(confirmation).not.toContain(token);
  expect(await buyer.page(`/orders/${number}/receipt`)).toContain(`href="/orders/${number}"`);
  // A browser holding nothing but the token is here because of the token, so
  // every link it is handed still carries one.
  const holder = new Shopper();
  const held = await holder.page(`/orders/${number}?token=${encodeURIComponent(token)}`);
  expect(held).toContain(`/orders/${number}/receipt?token=${token}`);
  // pending again, so the "not paid yet" link is the one on the page
  db.query('UPDATE "order" SET status = \'pending_payment\' WHERE number = ?1').run(number);
  expect(await holder.page(`/orders/${number}?token=${encodeURIComponent(token)}`)).toContain(
    `/pay/${number}?token=${token}`,
  );
  expect(await buyer.page(`/orders/${number}`)).toContain(`href="/pay/${number}"`);
  limit.forget();
});
test("/admin is 403 and a sign-in link for everybody the forge did not sign as an admin", async () => {
@@ -1042,43 +1275,56 @@
test("a long ledger says it was cut off, and a void card offers nothing to spend
  expect(full).not.toContain("The last 20 movements");
  limit.forget();
});
test("an order is found again with its number and the email it was placed with", async () => {
test("the find form is the guest door only: an account's order is not handed out", async () => {
  limit.forget();
  const shopper = new Shopper();
  const shopper = asCustomer();
  const { number, token } = await buy(shopper, "COF-GUJI-250", 1);
  const id = orderNamed(number).id;
  const trail = (): string[] =>
    db
      .query<{ kind: string }, [number]>("SELECT kind FROM order_event WHERE order_id = ?1")
      .all(id)
      .map((row) => row.kind);
  // Another browser knows nothing until it names both the order and the email.
  // Another browser knows the number and the email — everything the form asks
  // for — and this order has an owner, so the form is not its door: the words
  // are a miss's, no token is handed back, and nothing is written to its trail.
  const stranger = new Shopper();
  expect((await stranger.get(`/orders/${number}`)).status).toBe(404);
  const form = await stranger.page("/orders");
  const wrong = await stranger.post(
    "/orders/find",
    { number, email: "someone-else@example.com" },
    Shopper.tokenIn(form),
  );
  expect(wrong.status).toBe(200);
  expect(await wrong.text()).toContain("No order here matches");
  const before = trail();
  const tried = await stranger.post("/orders/find", { number, email: "[email protected]" }, Shopper.tokenIn(form));
  expect(tried.status).toBe(200);
  const said = await tried.text();
  expect(said).toContain("No guest order here matches");
  expect(said).not.toContain(token);
  expect(trail()).toEqual(before);
  expect(trail()).not.toContain("looked-up");
  const found = await stranger.post("/orders/find", { number, email: "[email protected]" }, Shopper.tokenIn(form));
  expect(found.status).toBe(303);
  const where = orderAt(found.headers.get("location")!);
  expect(where.number).toBe(number);
  expect(where.token).toBe(token);
  expect(await stranger.page(found.headers.get("location")!)).toContain(number);
  // The two ways in that the order does have are untouched: its own token,
  // and the account it belongs to.
  expect((await stranger.get(`/orders/${number}?token=${encodeURIComponent(token)}`)).status).toBe(200);
  expect(await shopper.page("/orders")).toContain(number);
  limit.forget();
});
test("a number that was never issued is refused in the same words as a wrong email", async () => {
test("a number that was never issued, a wrong email and an owned order are refused in the same words", async () => {
  limit.forget();
  const shopper = new Shopper();
  const shopper = asCustomer();
  const form = await shopper.page("/orders");
  const refusal = async (fields: Record<string, string>): Promise<string> =>
    (await shopper.post("/orders/find", fields, Shopper.tokenIn(form))).text();
  const invented = await refusal({ number: "BZ-ZZZZZZZZ", email: "[email protected]" });
  const { number } = await buy(shopper, "COF-HOUSE-250", 1);
  const mismatched = await refusal({ number, email: "[email protected]" });
  expect(invented).toContain("No order here matches");
  expect(mismatched).toContain("No order here matches");
  // The right pair on an order that belongs to an account: the same words, so
  // the form says nothing about which numbers are real or which are owned.
  const owned = await refusal({ number, email: "[email protected]" });
  const words = "No guest order here matches that number and email address.";
  expect(invented).toContain(words);
  expect(mismatched).toContain(words);
  expect(owned).toContain(words);
  expect(owned).not.toContain(orderNamed(number).access_token);
  limit.forget();
});
@@ -1120,14 +1366,27 @@
test("a spent limit cannot be refilled by changing x-forwarded-for", async () =>
  limit.forget();
});
test("the orders a browser placed are listed at /orders, and only for that browser", async () => {
test("/orders lists an account's own orders, and shows nobody else's", async () => {
  limit.forget();
  const shopper = new Shopper();
  const { number, token } = await buy(shopper, "COF-GUJI-250", 1);
  const shopper = asCustomer();
  const { number } = await buy(shopper, "COF-GUJI-250", 1);
  const mine = await shopper.page("/orders");
  expect(mine).toContain(number);
  expect(mine).toContain(`/orders/${number}?token=${token}`);
  expect(await new Shopper().page("/orders")).not.toContain(number);
  // Their own order opens for them, so the link carries no token.
  expect(mine).toContain(`href="/orders/${number}"`);
  expect(mine).not.toContain("token=");
  // Another account's list is their own, and empty.
  const other = asCustomer();
  const theirs = await other.page("/orders");
  expect(theirs).not.toContain(number);
  expect(theirs).toContain("Nothing bought on this account yet");
  // And a shopper the forge has not signed in is offered the door, not a list.
  const anon = await new Shopper().page("/orders");
  expect(anon).not.toContain(number);
  expect(anon).toContain("Sign in to see your orders");
  expect(anon).toContain("/__forge/signin?to=%2Forders");
  limit.forget();
});
@@ -1138,23 +1397,6 @@
test("the order-lookup form has a class of its own, not the header search's", as
  expect(page.match(/class="find"/g)?.length).toBe(1);
});
test("a shared browser can forget the orders it remembers", async () => {
  limit.forget();
  const shopper = new Shopper();
  const { number } = await buy(shopper, "COF-GUJI-250", 1);
  const listed = await shopper.page("/orders");
  expect(listed).toContain(number);
  const forgotten = await shopper.post("/orders/forget", {}, Shopper.tokenIn(listed));
  expect(forgotten.status).toBe(303);
  const after = await shopper.page("/orders");
  expect(after).not.toContain(number);
  expect(after).toContain("No orders have been placed from this browser");
  // Forgetting is a POST from this page and nowhere else.
  expect((await shopper.post("/orders/forget", {})).status).toBe(403);
  limit.forget();
});
test("a variant that is not the named product's own is not added to the cart", async () => {
  const shopper = new Shopper();
  const product = await shopper.page("/p/stoneware-mug");
@@ -1212,7 +1454,7 @@
test("the rate the cart estimates is the rate the order charges, from one table"
  tax.setDefaultRateBp(2000);
  tax.upsertRate({ country: tax.HOME_COUNTRY, region: "", rate_bp: 1000, label: "US sales tax", active: true });
  try {
    const shopper = new Shopper();
    const shopper = asCustomer(); // the order at the end of it needs an account
    await addToCart(shopper, "COF-GUJI-250", 2); // $38.00 of goods
    const cart = await shopper.page("/cart");
@@ -1417,13 +1659,13 @@
const watch = async (stop: AbortController): Promise<Response> => {
  return fetch(`${base}/admin/events?since=${here.id}`, { headers: ADMIN_HEADERS(), signal: stop.signal });
};
test("an admin watching the stream hears an order a stranger places", async () => {
test("an admin watching the stream hears an order as a shopper places it", async () => {
  const stop = new AbortController();
  const stream = await watch(stop);
  expect(stream.status).toBe(200);
  expect(stream.headers.get("content-type")).toBe("text/event-stream");
  const shopper = new Shopper();
  const shopper = asCustomer();
  await addToCart(shopper, "COF-GUJI-250", 1);
  const placed = await submitCheckout(shopper, { email: "[email protected]" });
  expect(placed.status).toBe(303);
@@ -1451,7 +1693,7 @@
test("an admin watching the stream hears an order a stranger places", async () =
});
test("paying and refunding an order reach the stream, once each", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  await addToCart(shopper, "COF-HOUSE-250", 1);
  const placed = await submitCheckout(shopper, { email: "[email protected]" });
  const { number, token } = orderAt(placed.headers.get("location")!);
@@ -24,14 +24,14 @@
import {
  useSecret,
} from "./session.ts";
import { loadSecret } from "./sign.ts";
import { match } from "./routes.ts";
import { getAnswers, match } from "./routes.ts";
import { notFound } from "./shop.ts";
import { peerOf, trustedHops } from "./peer.ts";
import { seed } from "./catalog.ts";
import { seed as seedDiscounts } from "./discounts.ts";
import { seed as seedTax } from "./tax.ts";
import { HAND_OFF, readForm, readText, text } from "./http.ts";
import { whoIs } from "./who.ts";
import { returnTo, whoIs } from "./who.ts";
import type { Who } from "./who.ts";
import type { Ctx } from "./context.ts";
@@ -138,6 +138,12 @@
export const server = Bun.serve({
    if (method === "POST" && !sameOrigin(request)) return finish(text("forbidden", 403), []);
    const found = match(method, url.pathname);
    // Where a sign-in on this page comes back to, decided once and for every
    // page: this URL when a GET of it renders a page, and a page that does
    // when it does not. A POST-only path — a missed order lookup, a declined
    // mock payment — renders a page like any other, and that page must not
    // offer a way in that lands on a 404.
    const backTo = returnTo(url, found !== null && getAnswers(found.route.pattern));
    const session = loadSession(cookies[SESSION_COOKIE]);
    // Identity is the forge's to assert and ours to verify; the cookie above
    // only carries the CSRF token.
@@ -146,7 +152,7 @@
export const server = Bun.serve({
      outgoing.push(cookie(SESSION_COOKIE, session.sid, { maxAge: 60 * 60 * 24 * 30, secure: publicOrigin.startsWith("https:") }));
    if (!found) {
      const ctx = context(request, url, {}, session, who, null, null, cookies, outgoing, self);
      const ctx = context(request, url, {}, session, who, backTo, null, null, cookies, outgoing, self);
      return finish(notFound(ctx), outgoing);
    }
@@ -173,7 +179,7 @@
export const server = Bun.serve({
        return finish(text("that form was not from here — go back and try again", 403), outgoing);
    }
    const ctx = context(request, url, found.params, session, who, form, body, cookies, outgoing, self);
    const ctx = context(request, url, found.params, session, who, backTo, form, body, cookies, outgoing, self);
    try {
      const response = await found.route.handler(ctx);
      return finish(request.method === "HEAD" ? new Response(null, response) : response, outgoing);
@@ -190,6 +196,7 @@
function context(
  params: Record<string, string>,
  session: ReturnType<typeof loadSession>,
  who: Who,
  backTo: string,
  form: FormData | null,
  body: string | null,
  cookies: Record<string, string>,
@@ -202,6 +209,7 @@
function context(
    params,
    session,
    who,
    backTo,
    form,
    body,
    cart: decodeCart(cookies[CART_COOKIE], secret),
@@ -2,9 +2,11 @@
 * The storefront's handlers: browse, cart, checkout, payment, order.
 *
 * The rules that matter live here. A cart cookie may say anything; prices and
 * stock come from the database. An order is reached only with its access
 * token, compared in constant time. Checkout and payment are rate limited.
 * Nothing that takes money happens on a GET.
 * stock come from the database. Browsing and the cart are open to anybody;
 * buying needs an account, because an order belongs to one. An order opens for
 * the account that placed it, or for whoever holds its access token, compared
 * in constant time — and that decision is made in `openOrder` alone. Checkout
 * and payment are rate limited. Nothing that takes money happens on a GET.
 */
import * as cart from "./cart.ts";
@@ -31,12 +33,13 @@
import {
  variantsOf,
} from "./catalog.ts";
import { field, handOff, intField, looksLikeEmail, redirect, text } from "./http.ts";
import { find as findPage } from "./pages/find.ts";
import { page as ordersPageView } from "./pages/orders.ts";
import { render, type Ctx } from "./context.ts";
import { page as cartPage } from "./pages/cart.ts";
import { chosen } from "./gateway.ts";
import { equals, hmac, sign, unsign } from "./sign.ts";
import { forOrder } from "./mail.ts";
import { linkTo, opensByAccount } from "./orderlink.ts";
import { dueCents, parseQuantity } from "./money.ts";
import { escape } from "./html.ts";
import type { Order } from "./db.ts";
@@ -58,11 +61,16 @@
const saveCodes = (ctx: Ctx, applied: codes.Applied): void => {
  ctx.codes = applied;
};
/** The order numbers this browser has placed, so `/orders` can list them. */
/** The guest orders this browser has found, so `/orders` can list them. */
const myNumbers = (ctx: Ctx): string[] => mine.decode(ctx.cookies[mine.COOKIE], ctx.secret);
const rememberOrder = (ctx: Ctx, number: string): void => {
  ctx.setCookie(jar(ctx, mine.COOKIE, mine.encode(mine.remember(myNumbers(ctx), number), ctx.secret)));
/**
 * An order an account owns is listed from the account, so only a guest order
 * — one with nothing but its token — is worth a cookie.
 */
const rememberOrder = (ctx: Ctx, order: Order): void => {
  if (order.buyer_id !== "") return;
  ctx.setCookie(jar(ctx, mine.COOKIE, mine.encode(mine.remember(myNumbers(ctx), order.number), ctx.secret)));
};
/** A shared browser should be able to stop being this shopper's. */
@@ -157,7 +165,7 @@
const CART_MESSAGES: Record<string, string> = {
export function cartView(ctx: Ctx, error?: string): Response {
  const quote = cart.quote(ctx.cart, { codes: ctx.codes });
  const key = (ctx.url.searchParams.get("m") ?? "").slice(0, 20);
  return render(ctx, { title: "Cart" }, cartPage(quote, ctx.session, error ?? CART_MESSAGES[key]));
  return render(ctx, { title: "Cart" }, cartPage(quote, ctx.session, ctx.who, error ?? CART_MESSAGES[key]));
}
/**
@@ -239,19 +247,43 @@
const idempotencyOk = (ctx: Ctx, given: string): string | undefined => {
  return opened !== undefined && opened.startsWith(`idem:${ctx.session.sid}:`) ? opened : undefined;
};
/**
 * The address form, or — for a shopper the forge has not signed in — the same
 * order summary with one way forward: sign in. Nothing about the cart is
 * touched either way, so the cart is still there when they come back.
 *
 * The forge knows an account's name, not its email address, and an account
 * name is not one: the email box is prefilled only when what the forge gave us
 * is itself an email, and the account's name is written on the order beside
 * it, never into the email column.
 */
export function checkoutForm(ctx: Ctx, error?: string, values: Record<string, string> = {}): Response {
  const quote = cart.quote(ctx.cart, { codes: ctx.codes });
  if (quote.lines.length === 0) return redirect("/cart");
  const prefill =
    ctx.who.role === "anon" || !looksLikeEmail(ctx.who.name) ? {} : { email: ctx.who.name };
  return render(
    ctx,
    { title: "Checkout" },
    pages.checkout(quote, ctx.session, chosen(), idempotencyFor(ctx), { country: tax.HOME_COUNTRY, ...values }, error),
    pages.checkout({
      quote,
      session: ctx.session,
      who: ctx.who,
      gateway: chosen(),
      idempotencyKey: idempotencyFor(ctx),
      values: { country: tax.HOME_COUNTRY, ...prefill, ...values },
      error,
    }),
  );
}
export function placeOrder(ctx: Ctx): Response {
  if (!limit.take(limit.CHECKOUT, ctx.peer))
    return tooMany(ctx, limit.retryAfter(limit.CHECKOUT, ctx.peer), "checkout");
  // An order belongs to an account, so there is nothing to place without one:
  // no row, no stock taken, no code redeemed. Back to the page that says so.
  if (ctx.who.role === "anon") return redirect("/checkout");
  const buyer = { id: ctx.who.id, name: ctx.who.name };
  const values = {
    email: field(ctx.form, "email", 200),
    name: field(ctx.form, "name", 120),
@@ -276,6 +308,7 @@
export function placeOrder(ctx: Ctx): Response {
  const shown = cart.quote(ctx.cart, { codes: ctx.codes });
  const result = orders.place({
    address: values,
    buyer,
    cart: ctx.cart,
    codes: ctx.codes,
    shown,
@@ -285,27 +318,40 @@
export function placeOrder(ctx: Ctx): Response {
  if (!result.ok) return checkoutForm(ctx, result.error, values);
  saveCart(ctx, []);
  saveCodes(ctx, codes.NONE);
  rememberOrder(ctx, result.order.number);
  rememberOrder(ctx, result.order);
  const where = dueCents(result.order) === 0 ? "orders" : "pay";
  return redirect(`/${where}/${result.order.number}?token=${encodeURIComponent(result.order.access_token)}`);
}
// --- payment ----------------------------------------------------------------
/** An order is only ever reached with its own token, compared in constant time. */
/**
 * Who may open an order, decided here and nowhere else. Three ways in, in
 * order of how much they prove: an admin, the account the order belongs to,
 * and whoever holds the order's own access token — compared in constant time,
 * because a token is a secret. A guest order from before accounts has no
 * buyer, so the token is all it has; a signed-in stranger is a stranger.
 *
 * A token that opens a guest order is this browser finding it, exactly as the
 * form at `/orders` is, so the number is remembered the same way: signing in
 * from here drops the token from `to=` and lands on `/orders`, which has to
 * be able to list the order that was open a moment ago.
 */
function openOrder(ctx: Ctx, tokenFrom: "query" | "form"): Order | null {
  const number = (ctx.params.number ?? "").slice(0, 20);
  const token =
    tokenFrom === "query" ? (ctx.url.searchParams.get("token") ?? "").slice(0, 64) : field(ctx.form, "token", 64);
  const order = orders.byNumber(number);
  if (!order) return null;
  if (ctx.who.role === "admin") return order;
  return token.length > 0 && equals(token, order.access_token) ? order : null;
  if (opensByAccount(ctx.who, order)) return order;
  if (token.length === 0 || !equals(token, order.access_token)) return null;
  rememberOrder(ctx, order);
  return order;
}
/** Where an order lives, for whoever holds its token. */
const orderLink = (order: Order): string =>
  `/orders/${order.number}?token=${encodeURIComponent(order.access_token)}`;
/** Where an order lives for whoever is being sent there: src/orderlink.ts. */
const orderLink = (ctx: Ctx, order: Order, page: "orders" | "pay" = "orders"): string =>
  linkTo(ctx.who, order, page);
/**
 * An order a gateway has already paid something towards is not offered to a
@@ -317,7 +363,7 @@
const alreadyCharged = (order: Order): boolean => orders.shortfall(order) !== nu
export function payPage(ctx: Ctx, error?: string): Response {
  const order = openOrder(ctx, "query");
  if (!order) return notFound(ctx);
  if (order.status !== "pending_payment" || alreadyCharged(order)) return redirect(orderLink(order));
  if (order.status !== "pending_payment" || alreadyCharged(order)) return redirect(orderLink(ctx, order));
  return render(
    ctx,
    { title: `Pay ${order.number}` },
@@ -330,8 +376,8 @@
export function payMock(ctx: Ctx): Response {
  if (!limit.take(limit.PAYMENT, ctx.peer)) return tooMany(ctx, limit.retryAfter(limit.PAYMENT, ctx.peer), "payment");
  const order = openOrder(ctx, "form");
  if (!order) return notFound(ctx);
  if (order.status !== "pending_payment" || alreadyCharged(order)) return redirect(orderLink(order));
  if (chosen().kind !== "mock") return redirect(`/pay/${order.number}?token=${encodeURIComponent(order.access_token)}`);
  if (order.status !== "pending_payment" || alreadyCharged(order)) return redirect(orderLink(ctx, order));
  if (chosen().kind !== "mock") return redirect(orderLink(ctx, order, "pay"));
  const decision = field(ctx.form, "decision", 10);
  if (decision !== "approve") {
    orders.note(order.id, "declined", "the mock gateway was asked to decline");
@@ -343,7 +389,7 @@
export function payMock(ctx: Ctx): Response {
    ref: `mock_${crypto.randomUUID().replace(/-/g, "").slice(0, 20)}`,
    amount_cents: dueCents(order),
  });
  return redirect(`/orders/${paid.number}?token=${encodeURIComponent(paid.access_token)}`);
  return redirect(orderLink(ctx, paid));
}
const payPageFor = (ctx: Ctx, order: Order, error: string): Response =>
@@ -358,8 +404,11 @@
export async function payStripe(ctx: Ctx): Promise<Response> {
  if (!limit.take(limit.PAYMENT, ctx.peer)) return tooMany(ctx, limit.retryAfter(limit.PAYMENT, ctx.peer), "payment");
  const order = openOrder(ctx, "form");
  if (!order) return notFound(ctx);
  if (order.status !== "pending_payment" || alreadyCharged(order)) return redirect(orderLink(order));
  if (order.status !== "pending_payment" || alreadyCharged(order)) return redirect(orderLink(ctx, order));
  if (chosen().kind !== "stripe") return payPageFor(ctx, order, "Stripe is not configured; use the mock gateway.");
  // Stripe's two URLs carry the token whoever is paying: the browser leaves
  // this origin and comes back, and a forge session that lapsed while it was
  // away must not turn the way back into a 404.
  const back = `${publicOrigin()}/orders/${order.number}?token=${encodeURIComponent(order.access_token)}`;
  const session = await gateway.startCheckout(order, orders.itemsOf(order.id), {
    success: back,
@@ -388,28 +437,49 @@
export async function orderPage(ctx: Ctx): Promise<Response> {
}
/**
 * "Find an order". The orders this browser remembers are listed with their
 * own links; anything older is found by naming the order and the email it was
 * placed with.
 * `/orders`. An account's own orders, newest first, each opening without a
 * token because the row says whose it is. A shopper the forge has not signed
 * in gets the invitation to sign in and no list of anything.
 *
 * Under that, whoever is asking, the guest orders this browser has found —
 * rows from before accounts, which have nothing but their token — and the form
 * that finds one by its number and the email it was placed with.
 */
export function findForm(
export function ordersPage(
  ctx: Ctx,
  error?: string,
  values: { number?: string; email?: string } = {},
): Response {
  const mine = ctx.who.role === "anon" ? [] : orders.forBuyer(ctx.who.id);
      
        sentinelcrew
        1mo ago
        outdated
      
      Anchored to this line because this forge's review API wants one, and it is also the fix.
I read every changed line, ran the suite at this head (90 pass, 0 fail), walked the preview as a guest, and ran src/tty.ts with FORGE_APP_USER_ROLE=user. The core of this is right and I want to say so first: ownership is decided in openOrder and nowhere else, the three ways in are an admin, buyer_id === who.id from the verified header, and a constant-time token compare; buyer_id is only ever written from ctx.who in placeOrder; forBuyer is parameterised with %/_ escaped and can only narrow; the anon POST /checkout writes no row, takes no stock and redeems no code (I confirmed on the preview: 303 to /checkout, cart intact); /orders/find now refuses an owned order in a miss's words, after the same digest, with nothing written to its trail; every page is cache-control: no-store, so opening an order by account rather than by URL token does not become a shared-cache leak. The terminal matches the page — as nora I got stock/orders/tax, 3 answered "That is an admin's to read." without drawing the tab, r was refused, / was offered — and desk.ordersFor is tested for nora/sam/admin/anon including % as a needle. The new behaviours all have tests that would fail without them.
Two things to do before this lands.
1. Fix first: the sign-in button this pull adds can land on a 404, which is the thing #42 just fixed. ordersPage passes path: returnTo(ctx.url), and it is also the renderer for a failed POST /orders/find — so on that page the new Sign in to see your orders button points at /__forge/signin?to=%2Forders%2Ffind, and GET /orders/find is a 404 (verified on the preview). A shopper who mistypes a guest lookup and then signs in lands on nothing. The page is always the /orders page, so the fix is to stop deriving it: pass path: "/orders" (the header's link on that response has the same target today and gets fixed with it). Worth a test alongside the existing "signing in from a page the token opened lands somewhere that answers".
2. It does not merge. Head 54055fa merges dc3c613, but main is now b40cb34 — #37, #48 and #53 landed since, and the forge reports conflicts in README.md and src/tty.ts. #53 rewrote desk.ts (an admin's change naming who made it) and #48 changed how bodies are read, so the merge lands on exactly the gating table this pull rewrites. Merge main, re-run bun test, and re-check the terminal gate by hand afterwards.
Smaller, take or leave:
desk.needsAdmin is now called only from units.test.ts; tty.ts uses knows/mayPress. Either keep it as the thing the offered/gated invariant is stated in terms of, or drop it.
payMock and the not-pending redirects still put ?token= back in the URL for a signed-in buyer who opened the order without one, writing the token into their history for no reason. order.buyer_id === "" ? "?token=…" : "" would keep it out.
src/who.ts's comment on WITHOUT_SECRET still describes "Find an order" listing "the orders this browser placed"; that page is now an account's list plus a guest half.
The pull description says /orders/find "still hands back the token for any order on number-plus-email, which is unchanged behaviour" — the code does the opposite, and the opposite is right. Please correct the description, since it is what the next reader trusts.
Nothing here is a data leak and nothing needs rethinking; fix the sign-in target, merge main green, and I will approve.
    
  // The guest orders this browser found are shown to whoever is holding the
  // cookie, signed in or not. A guest order is a guest's to find, and a cookie
  // nobody can see is a cookie nobody can drop.
  const held = myNumbers(ctx)
    .map((number) => orders.byNumber(number))
    .filter((order): order is Order => order !== null);
  return render(ctx, { title: "Find an order" }, findPage(held, ctx.session, values, error));
    .filter((order): order is Order => order !== null && order.buyer_id === "");
  return render(
    ctx,
    { title: "Your orders" },
    ordersPageView({ who: ctx.who, mine, guests: held, session: ctx.session, path: ctx.backTo, values, error }),
  );
}
/**
 * The number and the email must both be right, and a wrong pair is refused in
 * the same words whether or not the order exists: this form must not be a way
 * to learn which order numbers are real. The email is compared as a keyed
 * digest, so neither its length nor its first wrong letter times differently,
 * and a number that matches nothing is digested against a fixed string so
 * that both paths do the same work as well as say the same thing.
 * This form is the guest door, and only the guest door. An order that belongs
 * to an account has a door of its own — its buyer signs in and `/orders` lists
 * it — so handing back its access token to whoever knows a number and an email
 * address would be giving away an owned order to a stranger. Since accounts,
 * the pair is no longer proof of anything; it was only ever the best a guest
 * order had.
 *
 * So: the number and the email must both be right, the order must be nobody's,
 * and every refusal is the same words whether the order does not exist, does
 * not match, or is not this form's to hand over. This must not be a way to
 * learn which order numbers are real, nor which of them belong to an account.
 * The email is compared as a keyed digest, so neither its length nor its first
 * wrong letter times differently, and a number that matches nothing is
 * digested against a fixed string so that every path does the same work as
 * well as says the same thing.
 */
/**
 * Stands in for the email of an order that is not there. The email on the form
@@ -418,24 +488,31 @@
export function findForm(
 */
const NO_SUCH_EMAIL = "no-such-order";
const NOT_FOUND =
  "No guest order here matches that number and email address. An order bought with an account is not " +
  "found this way: sign in, and it is listed in your orders.";
export function findOrder(ctx: Ctx): Response {
  if (!limit.take(limit.LOOKUP, ctx.peer)) return tooMany(ctx, limit.retryAfter(limit.LOOKUP, ctx.peer), "lookup");
  const number = field(ctx.form, "number", 20).toUpperCase();
  const email = field(ctx.form, "email", 200);
  const values = { number, email };
  if (!mine.looksLikeNumber(number) || !looksLikeEmail(email))
    return findForm(ctx, "An order number looks like BZ-XXXXXXXX, with the email it was placed with.", values);
    return ordersPage(ctx, "An order number looks like BZ-XXXXXXXX, with the email it was placed with.", values);
  const order = orders.byNumber(number);
  const found = orders.byNumber(number);
  const digest = (value: string): string => hmac(ctx.secret, `order-email:${value.trim().toLowerCase()}`);
  const matched = equals(digest(email), digest(order?.email ?? NO_SUCH_EMAIL));
  if (!order || !matched)
    return findForm(ctx, "No order here matches that number and email address.", values);
  const matched = equals(digest(email), digest(found?.email ?? NO_SUCH_EMAIL));
  // An owned order is refused after the same digest a miss does, and leaves no
  // mark on the order's trail: a stranger learns nothing, not even that they
  // guessed right.
  const order = found !== null && found.buyer_id === "" ? found : null;
  if (!order || !matched) return ordersPage(ctx, NOT_FOUND, values);
  // The address, not the header: what goes in the trail has to be a fact.
  orders.note(order.id, "looked-up", `found from ${ctx.peer.address}`);
  rememberOrder(ctx, order.number);
  return redirect(`/orders/${order.number}?token=${encodeURIComponent(order.access_token)}`);
  rememberOrder(ctx, order);
  return redirect(orderLink(ctx, order));
}
export async function receiptPage(ctx: Ctx): Promise<Response> {
@@ -443,7 +520,7 @@
export async function receiptPage(ctx: Ctx): Promise<Response> {
  if (!order) return notFound(ctx);
  const email = forOrder(order.id);
  if (!email) return notFound(ctx);
  return render(ctx, { title: `Receipt ${order.number}` }, pages.receipt(order, email));
  return render(ctx, { title: `Receipt ${order.number}` }, pages.receipt(order, email, ctx.who));
}
/**
@@ -259,6 +259,16 @@
class Shopper {
  }
}
/**
 * A shopper with an account, because buying needs one: an order belongs to
 * the account that placed it. Each call is a different person.
 */
let accounts = 0;
const asCustomer = (): Shopper => {
  accounts += 1;
  return new Shopper({ id: `u_shopper_${accounts}`, name: `shopper${accounts}`, role: "user" });
};
// --- what the database says --------------------------------------------------
const variantId = (sku: string): number =>
@@ -380,7 +390,7 @@
async function admin(): Promise<Shopper> {
// --- the Checkout Session ----------------------------------------------------
test("a Checkout Session is built from the order's lines and asks for what is due", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-GUJI-250", quantity: 2 }]);
  const order = orderNamed(placed.number);
  const at = seen.length;
@@ -460,7 +470,7 @@
async function issueGiftCard(amount: string, note: string): Promise<string> {
}
test("a discount and a gift card come off what Stripe is asked for", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const code = await issueGiftCard("10.00", "for the Stripe path");
  const placed = await placeOrder(shopper, [{ sku: "COF-GUJI-1000", quantity: 1 }], ["welcome10", code]);
  const order = orderNamed(placed.number);
@@ -501,7 +511,7 @@
test("a discount and a gift card come off what Stripe is asked for", async () =>
// --- coming back -------------------------------------------------------------
test("the shopper coming back settles the order once", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-HOUSE-250", quantity: 1 }]);
  const started = await pressPayWithCard(shopper, placed);
  const sessionId = sessionIdIn(started.headers.get("location")!);
@@ -540,7 +550,7 @@
test("the shopper coming back settles the order once", async () => {
// --- the webhook -------------------------------------------------------------
test("a signed webhook pays an order that never came back", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "BRW-FILT-100", quantity: 2 }]);
  const started = await pressPayWithCard(shopper, placed);
  const sessionId = sessionIdIn(started.headers.get("location")!);
@@ -565,7 +575,7 @@
test("a signed webhook pays an order that never came back", async () => {
});
test("a webhook after a return leaves exactly one charge", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "KIT-MUG-OAT", quantity: 1 }]);
  const started = await pressPayWithCard(shopper, placed);
  const sessionId = sessionIdIn(started.headers.get("location")!);
@@ -595,7 +605,7 @@
test("a webhook after a return leaves exactly one charge", async () => {
// --- a payment that does not cover the order ---------------------------------
test("a short return is written down and the order is not called paid", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-GUJI-250", quantity: 2 }]);
  const started = await pressPayWithCard(shopper, placed);
  const sessionId = sessionIdIn(started.headers.get("location")!);
@@ -646,7 +656,7 @@
test("a short return is written down and the order is not called paid", async ()
});
test("a short webhook leaves the order pending and the shortfall on the admin page", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "BRW-FILT-100", quantity: 1 }]);
  const started = await pressPayWithCard(shopper, placed);
  const sessionId = sessionIdIn(started.headers.get("location")!);
@@ -674,7 +684,7 @@
test("a short webhook leaves the order pending and the shortfall on the admin pa
});
test("the exact amount still settles once, and a short event afterwards changes nothing", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-HOUSE-250", quantity: 2 }]);
  const started = await pressPayWithCard(shopper, placed);
  const sessionId = sessionIdIn(started.headers.get("location")!);
@@ -700,7 +710,7 @@
test("the exact amount still settles once, and a short event afterwards changes
// --- refunds -----------------------------------------------------------------
test("an admin's refund goes to Stripe with the intent, the cents and a key", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-GUJI-1000", quantity: 1 }]);
  const started = await pressPayWithCard(shopper, placed);
  const sessionId = sessionIdIn(started.headers.get("location")!);
@@ -746,7 +756,7 @@
test("an admin's refund goes to Stripe with the intent, the cents and a key", as
});
test("a refund Stripe refuses leaves the ledger exactly as it was", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-GUJI-250", quantity: 1 }]);
  const started = await pressPayWithCard(shopper, placed);
  payAtStripe(sessionIdIn(started.headers.get("location")!));
@@ -777,7 +787,7 @@
test("a refund Stripe refuses leaves the ledger exactly as it was", async () =>
// --- when Stripe is not there ------------------------------------------------
test("Stripe answering 500 leaves the order unpaid and says so in a sentence", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-HOUSE-250", quantity: 1 }]);
  failing = true;
  const response = await pressPayWithCard(shopper, placed);
@@ -792,7 +802,7 @@
test("Stripe answering 500 leaves the order unpaid and says so in a sentence", a
});
test("Stripe unreachable leaves the order unpaid and says so in a sentence", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "COF-HOUSE-250", quantity: 1 }]);
  const at = seen.length;
@@ -813,7 +823,7 @@
test("Stripe unreachable leaves the order unpaid and says so in a sentence", asy
});
test("a live key is refused and no request reaches Stripe", async () => {
  const shopper = new Shopper();
  const shopper = asCustomer();
  const placed = await placeOrder(shopper, [{ sku: "BRW-FILT-100", quantity: 1 }]);
  // Same order, same database, an app whose key is a live one.
@@ -8,17 +8,23 @@
 * Reaching this screen is not the same as being allowed to use it: every key
 * that changes something — and c, which reads a code out — is an admin's,
 * here as on the web, and so is every tab whose rows are the shop's own
 * business. Orders, the outbox, the codes and the cards are all of those:
 * a receipt carries a gift card's code in full, and that code is money to
 * whoever reads it. `src/desk.ts` holds the one table both gates read.
 * business. The outbox, the codes and the cards are those: a receipt carries a
 * gift card's code in full, and that code is money to whoever reads it.
 *
 * The orders tab is the one that is neither open nor closed, because the page
 * is not either: an order belongs to the account that bought it, so whoever
 * the forge named here sees the rows `/orders` would list for them and nothing
 * else, an admin sees the shop's, and an anonymous keyboard sees none.
 * `src/desk.ts` holds the one table all of these gates read, and `ordersFor`
 * is the one place the rows are chosen.
 *
 * 1..7 switch between stock, orders, the outbox, discount codes, gift cards,
 * the tax table and the changes an admin made to any of it — everything
 * /admin can see. j/k move, and each tab says
 * at its foot what it can do: s moves stock with a reason, / finds an order by
 * number, name or email, r refunds what is left of an order and puts it back
 * on the shelf, n writes a code, i issues a card, e sets a tax rate, c looks a
 * code up. q leaves. Plain ANSI, no dependencies.
 * /admin can see. j/k move, and each tab says at its foot what it can do: s
 * moves stock with a reason, / narrows the orders in front of you by number,
 * name or email, r refunds what is left of an order and puts it back on the
 * shelf, n writes a code, i issues a card, e sets a tax rate, c looks a code
 * up. q leaves. Plain ANSI, no dependencies.
 */
import * as desk from "./desk.ts";
@@ -29,7 +35,7 @@
import { db } from "./db.ts";
import { chosen } from "./gateway.ts";
import { formatCents } from "./money.ts";
import { history, addStock, setStock } from "./inventory.ts";
import { itemsOf, paymentsOf, recent, refund, refundableCents, refundedCents, shortfall } from "./orders.ts";
import { itemsOf, paymentsOf, refund, refundableCents, refundedCents, shortfall } from "./orders.ts";
import { outbox } from "./mail.ts";
import { atKeyboard } from "./who.ts";
import { nameOf, recent as recentChanges, type Reading } from "./changes.ts";
@@ -38,7 +44,11 @@
import type { GiftCard, Order, TaxRate } from "./db.ts";
const person = atKeyboard();
const isAdmin = person.role === "admin";
const readable = desk.visible(person).join(", ");
const onlyReads = ` — ${readable} read, nothing here changes anything`;
// What a non-admin gets, said on the first screen: the tabs that open at all,
// and that the orders among them are this account's own and nobody else's.
const onlyReads = ` — ${readable} read${
  desk.canRead("orders", person) ? " (orders: your own)" : ""
}, nothing here changes anything`;
const whoLine =
  person.role === "anon"
    ? `the forge did not name you (anonymous)${onlyReads}`
@@ -77,8 +87,9 @@
let message = "";
// the same needle /admin/orders takes.
let filter = "";
// What the orders tab is showing: every order, or the ones `/` narrowed to.
const orderRows = (): Order[] => recent(100, filter);
// What the orders tab is showing: the orders this person may see — an admin's
// is the shop's, anybody else's is their own account's — narrowed by `/`.
const orderRows = (): Order[] => desk.ordersFor(person, filter);
const rowsFor = (): unknown[] =>
  tab === "stock"
@@ -101,9 +112,21 @@
const say = (done: desk.Done): string => (done.ok ? done.message : `${esc}33m${d
/** The refusal the desk never gets to give, because a non-admin never reaches it. */
const notYours = say({ ok: false, message: "That is an admin's to do." });
/** The same for a tab: nothing on it is drawn, so nothing on it leaks. */
const notForYou = say({
  ok: false,
  message:
    person.role === "anon"
      ? "The forge did not name you, so nothing here is yours to read."
      : "That is an admin's to read.",
});
/** True when this key is this person's to press on the tab they are on. */
const may = (key: string): boolean => desk.mayPress(tab, key, person);
/**
 * The foot of the screen. A key this person may not press is not offered:
 * `desk.offered` is the same list `desk.needsAdmin` gates on, h included.
 * `desk.offered` is the same list `desk.mayPress` gates on, h included.
 */
const hints = (): string =>
  [
@@ -117,7 +140,7 @@
const hints = (): string =>
/** The tab bar. A tab this person may not read is named but marked closed. */
const tabBar = (): string =>
  TABS.map((name, i) => {
    const closed = !isAdmin && desk.needsAdminToRead(name);
    const closed = !desk.canRead(name, person);
    const text = `${i + 1} ${name}${closed ? "·" : ""}`;
    return name === tab ? bold(text) : dim(text);
  }).join("  ");
@@ -127,6 +150,11 @@
const windowOf = (row: { starts_at: string | null; expires_at: string | null }):
function detail(order: Order): string[] {
  const lines = [""];
  // The account it belongs to, beside the address the shopper typed. An order
  // from before accounts belongs to nobody but whoever holds its token.
  lines.push(
    `    ${dim("account")} ${order.buyer_name === "" ? "guest" : order.buyer_name}   ${dim("email")} ${order.email}`,
  );
  for (const item of itemsOf(order.id))
    lines.push(
      `    ${item.product_title} — ${item.variant_name} x${item.quantity}  ${formatCents(
@@ -293,32 +321,32 @@
process.stdin.on("data", (key: string) => {
  const count = rowsFor().length;
  if (key === "j" || key === "\x1b[B") cursor = Math.min(cursor + 1, Math.max(0, count - 1));
  if (key === "k" || key === "\x1b[A") cursor = Math.max(cursor - 1, 0);
  // A tab whose rows are the shop's own business is not opened at all for a
  // non-admin: the screen stays where it was and says why, so nothing private
  // is ever drawn.
  // A tab this person may not read is not opened at all: the screen stays
  // where it was and says why, so nothing private is ever drawn.
  const asTab = TABS[Number(key) - 1];
  if (asTab && !isAdmin && desk.needsAdminToRead(asTab)) message = notYours;
  if (asTab && !desk.canRead(asTab, person)) message = notForYou;
  else if (asTab) ((tab = asTab), (cursor = 0));
  // Every key from here down either changes something or reads a code out, so
  // every one of them is an admin's. A non-admin gets one refusal; the desk
  // below is never reached.
  if (!isAdmin && desk.needsAdmin(tab, key)) message = notYours;
  if (key === "s" && tab === "stock" && isAdmin)
  // Every key from here down either changes something, reads a code out, or
  // narrows what is already on the screen. `desk.mayPress` says which of those
  // this person may do; whoever may not gets one refusal and the desk below is
  // never reached.
  if (desk.knows(tab, key) && !may(key)) message = notYours;
  if (key === "s" && tab === "stock" && may("s"))
    prompt = { label: "Move (e.g. 12 a delivery arrived):", text: "", run: moveStock };
  if (key === "/" && tab === "orders" && isAdmin)
  if (key === "/" && tab === "orders" && may("/"))
    prompt = { label: "Find an order (number, name or email):", text: filter, run: findOrders };
  if (key === "r" && tab === "orders" && isAdmin) prompt = { label: "Refund the rest — reason:", text: "", run: refundRest };
  if (key === "c" && (tab === "codes" || tab === "cards") && isAdmin)
  if (key === "r" && tab === "orders" && may("r")) prompt = { label: "Refund the rest — reason:", text: "", run: refundRest };
  if (key === "c" && (tab === "codes" || tab === "cards") && may("c"))
    prompt = { label: "Check a code:", text: "", run: (value) => say(desk.look(value)) };
  if (key === "n" && tab === "codes" && isAdmin)
  if (key === "n" && tab === "codes" && may("n"))
    prompt = { label: `New code (${desk.NEW_DISCOUNT_SHAPE}):`, text: "", run: (value) => say(desk.newDiscount(value)) };
  if (key === "t" && tab === "codes" && isAdmin) {
  if (key === "t" && tab === "codes" && may("t")) {
    const code = discounts.withUse()[cursor];
    message = say(code ? desk.toggleDiscount(code.id) : { ok: false, message: "No code selected." });
  }
  if (key === "i" && tab === "cards" && isAdmin)
  if (key === "i" && tab === "cards" && may("i"))
    prompt = { label: "Issue a card (e.g. 25 a sorry-for-the-wait card):", text: "", run: (value) => say(desk.issueCard(value)) };
  if (key === "v" && tab === "cards" && isAdmin) {
  if (key === "v" && tab === "cards" && may("v")) {
    const card = giftcards.all()[cursor];
    prompt = {
      label: card && card.active !== 1 ? "Bring it back — reason:" : "Void it — reason:",
@@ -326,11 +354,11 @@
process.stdin.on("data", (key: string) => {
      run: (value) => say(card ? desk.toggleCard(card.id, value) : { ok: false, message: "No card selected." }),
    };
  }
  if (key === "e" && tab === "tax" && isAdmin)
  if (key === "e" && tab === "tax" && may("e"))
    prompt = { label: `Set a rate (${desk.RATE_SHAPE}):`, text: "", run: (value) => say(desk.setRate(value)) };
  if (key === "d" && tab === "tax" && isAdmin)
  if (key === "d" && tab === "tax" && may("d"))
    prompt = { label: "Rate anywhere the table does not name (e.g. 8.5):", text: "", run: (value) => say(desk.setDefaultRate(value)) };
  if (key === "x" && tab === "tax" && isAdmin) {
  if (key === "x" && tab === "tax" && may("x")) {
    const rate = tax.rates()[cursor];
    prompt = {
      label: rate ? `Remove ${rate.country} ${rate.region || "(whole country)"}? y/n:` : "Nothing selected — press enter:",
@@ -338,7 +366,7 @@
process.stdin.on("data", (key: string) => {
      run: (value) => say(rate ? desk.removeRate(rate.id, value) : { ok: false, message: "No rate selected." }),
    };
  }
  if (key === "h" && tab === "stock" && isAdmin)
  if (key === "h" && tab === "stock" && may("h"))
    message = history(8)
      .map((entry) => dim(`${entry.at}  ${entry.sku}  ${entry.delta > 0 ? "+" : ""}${entry.delta}  ${entry.reason}`))
      .join("\r\n");
@@ -24,6 +24,7 @@
const giftcards = await import("./giftcards.ts");
const live = await import("./live.ts");
const tax = await import("./tax.ts");
const orders = await import("./orders.ts");
const { getAnswers } = await import("./routes.ts");
const dbModule = await import("./db.ts");
const { db, forgetPasswordSettings, getSetting, setSetting } = dbModule;
@@ -532,7 +533,7 @@
test("every key that does the desk's work needs an admin, and is offered to nobo
  const shopper = { role: "user", id: "7", name: "nora" } as const;
  const anon = { role: "anon" } as const;
  // The seven keys this pull added, plus the two that were already there.
  // Every key that changes something, or reads a code out, is an admin's.
  expect(desk.needsAdmin("cards", "i")).toBe(true);
  expect(desk.needsAdmin("cards", "v")).toBe(true);
  expect(desk.needsAdmin("cards", "c")).toBe(true); // c reads a balance out
@@ -544,50 +545,108 @@
test("every key that does the desk's work needs an admin, and is offered to nobo
  expect(desk.needsAdmin("stock", "s")).toBe(true);
  expect(desk.needsAdmin("orders", "r")).toBe(true);
  expect(desk.needsAdmin("stock", "h")).toBe(true); // h reads the stock ledger out
  // `/` narrows the rows already in front of whoever pressed it, and those are
  // their own, so it is the one key a reader may press.
  expect(desk.needsAdmin("orders", "/")).toBe(false);
  expect(desk.mayPress("orders", "/", shopper)).toBe(true);
  expect(desk.mayPress("orders", "/", anon)).toBe(false); // nothing to narrow
  expect(desk.mayPress("orders", "r", shopper)).toBe(false);
  // Moving and switching tabs are not the desk's, and a key is only the
  // desk's on the tab it belongs to.
  for (const tab of desk.TABS) for (const key of ["j", "k", "q", "1", "6"]) expect(desk.needsAdmin(tab, key)).toBe(false);
  expect(desk.needsAdmin("outbox", "i")).toBe(false);
  expect(desk.needsAdmin("stock", "n")).toBe(false);
  expect(desk.knows("stock", "n")).toBe(false);
  expect(desk.knows("orders", "r")).toBe(true);
  for (const tab of desk.TABS) {
    // The foot of the screen and the gate read the same table: everything
    // offered needs an admin, and everything that needs one is offered.
    // The foot of the screen and the gate read the same table: a key is
    // offered to exactly the person who may press it.
    const keys = ["/", ..."abcdefghilmnoprstuvwxyz".split("")];
    const gated = keys.filter((key) => desk.needsAdmin(tab, key));
    expect(desk.offered(tab, admin).map((label) => label[0]).sort()).toEqual(gated.sort());
    // Whoever the forge did not name an admin is offered nothing at all.
    expect(desk.offered(tab, shopper)).toEqual([]);
    for (const who of [admin, shopper, anon]) {
      const pressable = keys.filter((key) => desk.mayPress(tab, key, who));
      expect(desk.offered(tab, who).map((label) => label[0]).sort()).toEqual(pressable.sort());
    }
    // Whoever the forge did not name an admin is offered no work at all.
    expect(desk.offered(tab, shopper).filter((label) => desk.needsAdmin(tab, label[0]!))).toEqual([]);
    expect(desk.offered(tab, anon)).toEqual([]);
  }
  expect(desk.offered("cards", admin)).toContain("i issue a card");
  expect(desk.offered("orders", shopper)).toEqual(["/ find"]);
});
test("the tabs that print a code, a receipt or a person are an admin's to read", () => {
test("the tabs that print a code or a receipt are an admin's to read, and orders are the buyer's", () => {
  const admin = { role: "admin", id: "1", name: "root" } as const;
  const shopper = { role: "user", id: "7", name: "nora" } as const;
  const anon = { role: "anon" } as const;
  // A receipt in the outbox carries a gift card's code in full, an order
  // carries a name and an address, the card list is every balance in the shop
  // and the code list is every discount that exists — all of it the shop's.
  expect(desk.needsAdminToRead("orders")).toBe(true);
  expect(desk.needsAdminToRead("outbox")).toBe(true);
  expect(desk.needsAdminToRead("cards")).toBe(true);
  expect(desk.needsAdminToRead("codes")).toBe(true);
  // A receipt in the outbox carries a gift card's code in full, the card list
  // is every balance in the shop and the code list is every discount that
  // exists — all of it the shop's, none of it any one shopper's.
  for (const tab of ["outbox", "cards", "codes"] as const) {
    expect(desk.canRead(tab, admin)).toBe(true);
    expect(desk.canRead(tab, shopper)).toBe(false);
    expect(desk.canRead(tab, anon)).toBe(false);
  }
  // What is on the shelf and what it is taxed at is the shop's public face.
  expect(desk.needsAdminToRead("stock")).toBe(false);
  expect(desk.needsAdminToRead("tax")).toBe(false);
  for (const tab of ["stock", "tax"] as const)
    for (const who of [admin, shopper, anon]) expect(desk.canRead(tab, who)).toBe(true);
  // Orders open for whoever the forge named, because what opens is their own.
  expect(desk.canRead("orders", shopper)).toBe(true);
  expect(desk.canRead("orders", anon)).toBe(false);
  expect(desk.visible(admin)).toEqual([...desk.TABS]);
  expect(desk.visible(shopper)).toEqual(["stock", "tax"]);
  expect(desk.visible(shopper)).toEqual(["stock", "orders", "tax"]);
  expect(desk.visible(anon)).toEqual(["stock", "tax"]);
  // Nothing a non-admin can open offers a key they may not press, and the
  // first tab the terminal opens on is one of them.
  for (const tab of desk.visible(shopper)) expect(desk.offered(tab, shopper)).toEqual([]);
  expect(desk.visible(shopper)[0]).toBe(desk.TABS[0]);
  // The first tab the terminal opens on is one everybody can read.
  expect(desk.visible(anon)[0]).toBe(desk.TABS[0]);
});
test("the terminal's orders tab is /orders: an account's own, an admin's the shop's, anon's none", () => {
  const admin = { role: "admin", id: "u_admin", name: "root" } as const;
  const nora = { role: "user", id: "u_nora", name: "nora" } as const;
  const sam = { role: "user", id: "u_sam", name: "sam" } as const;
  const anon = { role: "anon" } as const;
  // 'token' for the access token, like every row this file writes by hand:
  // what is under test is who an order is listed for, and nothing here opens
  // one with its token.
  const place = (buyer: { id: string; name: string } | null, email: string, name: string): string => {
    const number = `BZ-${Math.random().toString(36).slice(2, 10).toUpperCase().replace(/[^A-Z0-9]/g, "X")}`;
    db.query(
      `INSERT INTO "order" (number, access_token, buyer_id, buyer_name, email, name, address1, city, postal, country,
         subtotal_cents, shipping_cents, tax_cents, total_cents, gateway, idempotency_key)
       VALUES (?1, 'token', ?2, ?3, ?4, ?5, '1 Road', 'Town', '12345', 'UNITED STATES', 1000, 0, 0, 1000, 'mock', ?1)`,
    ).run(number, buyer?.id ?? "", buyer?.name ?? "", email, name);
    return number;
  };
  const hers = place(nora, "[email protected]", "Nora Example");
  const his = place(sam, "[email protected]", "Sam Example");
  const guest = place(null, "[email protected]", "A Guest");
  const numbers = (who: Parameters<typeof desk.ordersFor>[0], filter = ""): string[] =>
    desk.ordersFor(who, filter).map((order) => order.number);
  // Her own, and nothing of his or the shop's guest orders.
  expect(numbers(nora)).toContain(hers);
  expect(numbers(nora)).not.toContain(his);
  expect(numbers(nora)).not.toContain(guest);
  expect(numbers(sam)).toEqual([his]);
  // An admin sees the shop's, guest rows and all; anon sees nothing at all.
  expect(numbers(admin)).toEqual(expect.arrayContaining([hers, his, guest]));
  expect(numbers(anon)).toEqual([]);
  // `/` narrows what is already in front of you; it never reaches past it,
  // whatever is typed — another person's email, or a wildcard.
  expect(numbers(nora, "nora")).toEqual([hers]);
  expect(numbers(nora, "[email protected]")).toEqual([]);
  expect(numbers(nora, "%")).toEqual([]);
  expect(numbers(nora, his)).toEqual([]);
  expect(numbers(admin, "[email protected]")).toEqual([his]);
  expect(numbers(anon, "nora")).toEqual([]);
});
test("a rate limit counts an address the caller cannot choose", () => {
@@ -757,3 +816,16 @@
test("two databases from the factory know nothing of each other", () => {
    elsewhere.close(false);
  }
});
test("the route table knows which paths a GET answers", () => {
  // /orders/find is shaped like /orders/:number, which a GET does answer —
  // for an order called "find", which is a 404. The pattern is what counts.
  expect(getAnswers("/orders/find")).toBe(false);
  expect(getAnswers("/pay/:number/mock")).toBe(false);
  expect(getAnswers("/orders/forget")).toBe(false);
  expect(getAnswers("/orders")).toBe(true);
  expect(getAnswers("/orders/:number")).toBe(true);
  // both methods on one path: the page is still its own way back
  expect(getAnswers("/checkout")).toBe(true);
  expect(getAnswers("/gift-cards")).toBe(true);
});
@@ -1,7 +1,7 @@
/** The identity check, on its own: what the forge signs, and what it does not. */
import { expect, test } from "bun:test";
import { atKeyboard, returnTo, signInHref, stamp, whoIs, WITHOUT_SECRET } from "./who.ts";
import { atKeyboard, returnTo, signInHref, SOMEWHERE_THAT_ANSWERS, stamp, whoIs } from "./who.ts";
const KEY = "a-key-only-the-forge-and-this-app-know";
@@ -105,13 +105,25 @@
test("a page the token opened comes back as one that opens without it", () => {
  const at = (href: string) => returnTo(new URL(href, "https://bazaar.example"));
  // /pay/1001 without its token is a 404, so the return is "Find an order",
  // which answers for anyone and links the orders this browser placed.
  expect(at("/pay/1001?token=secret")).toBe(WITHOUT_SECRET);
  expect(at("/orders/1001?token=secret")).toBe(WITHOUT_SECRET);
  expect(at("/orders/1001/receipt?token=secret&m=x")).toBe(WITHOUT_SECRET);
  expect(at("/pay/1001?token=secret")).toBe(SOMEWHERE_THAT_ANSWERS);
  expect(at("/orders/1001?token=secret")).toBe(SOMEWHERE_THAT_ANSWERS);
  expect(at("/orders/1001/receipt?token=secret&m=x")).toBe(SOMEWHERE_THAT_ANSWERS);
  // an empty token opened nothing: that page is still its own return
  expect(at("/orders/1001?token=")).toBe("/orders/1001");
});
test("a page no GET answers comes back as one that does", () => {
  const at = (href: string, answersGet: boolean) => returnTo(new URL(href, "https://bazaar.example"), answersGet);
  // POST-only: /orders/find renders "Your orders" when a lookup misses, and
  // /pay/1001/mock renders the payment page when the mock declines. A GET of
  // either is a 404 — the front door says so from the route table — so
  // neither is a page to come back to.
  expect(at("/orders/find", false)).toBe(SOMEWHERE_THAT_ANSWERS);
  expect(at("/pay/1001/mock", false)).toBe(SOMEWHERE_THAT_ANSWERS);
  // a page that does answer is still its own return, query and all
  expect(at("/cart?m=applied", true)).toBe("/cart?m=applied");
});
test("a path a browser would read as a host comes back as the root", () => {
  const at = (pathname: string) => {
    const url = new URL("https://bazaar.example/");
@@ -91,8 +91,12 @@
export const signInHref = (to: string): string => `/__forge/signin?to=${encodeUR
 *
 * A page the secret was what opened cannot come back as itself: `/pay/1001`
 * without its token is a 404, and a shopper part-way through paying who
 * signed in would land on nothing. When a secret is dropped, `WITHOUT_SECRET`
 * comes back instead — a page that opens for whoever follows it.
 * signed in would land on nothing. Neither can a page that only a POST
 * reaches: `/orders/find` renders "Your orders" when a lookup misses, but a
 * GET of it is a 404, so coming back to where the browser is standing is the
 * same dead end. Both land on `SOMEWHERE_THAT_ANSWERS` instead — hence
 * `answersGet`, which the front door hands in from the route table: whether
 * this request's own path is one a GET renders a page for.
 *
 * `//evil.com/x` is a path to us and an off-origin URL to a browser, so a
 * pathname that could be read as a host does not travel: the root comes back
@@ -102,18 +106,19 @@
export const signInHref = (to: string): string => `/__forge/signin?to=${encodeUR
const SECRET_PARAMS = ["token"];
/**
 * Where a page that only opened because of a secret sends a person instead.
 * "Find an order" answers for anybody, and it lists the orders this browser
 * placed with their own token links, so the order — or the payment that was
 * half-made — is one click from where the return lands.
 * Where a person lands when the page they are on cannot be come back to.
 * `/orders` opens for anybody: an account's own orders once the forge has
 * signed them in, and under them the guest orders this browser has found,
 * each with its own token link — so the order, or the payment that was
 * half-made, is one click from where the return lands.
 */
export const WITHOUT_SECRET = "/orders";
export const SOMEWHERE_THAT_ANSWERS = "/orders";
export function returnTo(url: URL): string {
export function returnTo(url: URL, answersGet = true): string {
  if (!/^\/($|[^/\\])/.test(url.pathname)) return "/";
  const query = new URLSearchParams(url.search);
  const opened = SECRET_PARAMS.some((name) => query.getAll(name).some((value) => value !== ""));
  if (opened) return WITHOUT_SECRET;
  if (opened || !answersGet) return SOMEWHERE_THAT_ANSWERS;
  for (const name of SECRET_PARAMS) query.delete(name);
  const search = query.toString();
  const to = search === "" ? url.pathname : `${url.pathname}?${search}`;
		@@ -4,10 +4,12 @@ A small shop: a catalog with categories and search, product pages with
4	4	variants and stock, a cart in a signed cookie, discount codes and gift cards,
5	5	tax by where the parcel goes, a gift card balance window, checkout with an
6	6	address, a payment step, receipts, and an `/admin` for products, inventory,
7		codes, cards, tax and orders with refunds. Every price is an integer number
8		of cents, every form carries a CSRF token, and checkout, payment, typing a
9		code, reading a gift card's balance and finding an order are each rate
10		limited on their own. A category or a search longer than 24 things is
	7	codes, cards, tax and orders with refunds. Looking around and filling a cart
	8	need no account; buying needs one, because an order belongs to the account
	9	that placed it and `/orders` is that account's list of them. Every price is an
	10	integer number of cents, every form carries a CSRF token, and checkout,
	11	payment, typing a code, reading a gift card's balance and finding an order are
	12	each rate limited on their own. A category or a search longer than 24 things is
11	13	paged, so a listing is never a page without an end and never hides what is
12	14	past the end of it.
13	15
		@@ -106,26 +108,71 @@ the goods, plus gift cards being bought — and only then is a card's balance
106	108	taken off to leave what the gateway is asked for. `bun test` reconciles a
107	109	cart with all three against the order it becomes.
108	110
109		## Finding an order again
	111	## An account buys; browsing does not need one
110	112
111		An order is private, so it opens with its own access token and nothing else —
112		which leaves the shopper who closed the tab with no way back. `/orders` is
113		that way back, and it has two halves:
	113	`/`, a category, a product page, the cart, adding to it, changing it and
	114	typing a code all work signed out, exactly as they always did. Buying is where
	115	an account starts, because an order has to belong to somebody:
114	116
115		- From this browser. Placing an order appends its number to a signed
116		`mine` cookie, at most ten deep. The cookie holds numbers and nothing else;
117		the link is built from the access token read out of the row, so editing the
118		cookie changes which number is being claimed and never what opens. A shared
119		computer is not a shopper's, so Forget these orders drops the cookie.
120		- The form. An order number and the email it was placed with. Both have to
121		be right, the email is compared as a keyed digest so no letter of it times
122		differently — and a number that matches nothing is digested against a fixed
123		string, so a miss does the same work as a match — and a pair that does not
124		match is refused in the same words whether or not the number exists. This
125		form is not a way to learn which order numbers are real. It is rate limited
126		like the other guessable things (see below), and a lookup that succeeds
127		leaves a `looked-up` row in the order's events with the address it came
128		from.
	117	- `GET /checkout` for a shopper the forge has not signed in shows the same
	118	order summary with the address form replaced by Sign in to buy, pointing
	119	at `/__forge/signin?to=/checkout`. Nothing about the cart is touched, so the
	120	same cart is there on the way back. The cart page says it too, with a full
	121	cart in front of the shopper rather than after they have typed an address.
	122	- `POST /checkout` without an account writes nothing at all — no order row, no
	123	stock taken, no code redeemed — and answers with a 303 back to `/checkout`.
	124	- An order records `buyer_id` and `buyer_name` from the verified identity. The
	125	`email` column is still the address the shopper typed: a forge account name
	126	is not an email address and is never written there. The email box is
	127	prefilled only when what the forge gave us is itself an email.
	128
	129	The account is also who an order opens for. `src/shop.ts`'s `openOrder` is the
	130	only place that decides, and it knows three ways in: an admin, the account the
	131	order belongs to, and whoever holds the order's own access token, compared in
	132	constant time. So `/orders/<number>`, its receipt and `/pay/<number>` open for
	133	their buyer with no `?token=` at all, and a signed-in stranger gets the same
	134	404 a stranger has always got.
	135
	136	### What the access token is still for
	137
	138	It is not dead code. The orders placed before accounts existed — `buyer_id` is
	139	`''` on every one of them, added with `addColumn` and a default so they keep
	140	rendering — have nothing else, and the token is still what travels: in the
	141	receipt, in the mock gateway's forms, and in the `success_url` and
	142	`cancel_url` Stripe sends a shopper back to. `to=` and `rel="noreferrer"` keep
	143	it out of the sign-in links, as before.
	144
	145	## Finding a guest order again
	146
	147	`/orders` is an account's own orders, newest first — number, date, status,
	148	total and a link that needs no token. A shopper who is not signed in is
	149	offered the way in and never a list of anything. Under the list are the two
	150	halves of the way back to a guest order:
	151
	152	- Found in this browser. A guest order found here appends its number to a
	153	signed `mine` cookie, at most ten deep — found through the form below, or by
	154	opening the order with its own token, which is the same browser finding the
	155	same order and is what makes signing in mid-purchase land somewhere useful. The cookie holds numbers and nothing
	156	else; the link is built from the access token read out of the row, so editing
	157	the cookie changes which number is being claimed and never what opens. A
	158	shared computer is not a shopper's, so Forget these orders drops the
	159	cookie. An order an account owns is listed from the account, so it is never
	160	put in the cookie. This half is shown to whoever is holding the cookie,
	161	signed in or not: a guest order belongs to a browser, and a list nobody can
	162	see is a list nobody can drop.
	163	- The form, for a guest order and nothing else. An order number and the
	164	email it was placed with. An order that belongs to an account is not found
	165	this way — it has a door of its own, and a number and an email are not proof
	166	of being its buyer — so it is refused in the words a miss gets, after the
	167	same work, and leaves nothing in its trail. Both fields have to be right, the
	168	email is compared as a keyed digest so no letter of it times differently —
	169	and a number that matches nothing is digested against a fixed string, so a
	170	miss does the same work as a match — and every refusal is the same words
	171	whether the number does not exist, does not match, or is not this form's to
	172	hand over. This form is not a way to learn which order numbers are real, nor
	173	which of them are owned. It is rate limited like the other guessable things
	174	(see below), and a lookup that succeeds leaves a `looked-up` row in the
	175	order's events with the address it came from.
129	176
130	177	### What a rate limit is keyed on
131	178
		@@ -236,8 +283,8 @@ session cookie is still there, but it only carries the CSRF token now.
236	283
237	284	\| Who \| What \|
238	285	\| --- \| --- \|
239		\| anon \| Reads the shop: catalog, search, product pages, the cart, and an order with the order's own token. \|
240		\| user \| Buys: everything anon can do, and the header names them. \|
	286	\| anon \| Reads the shop: catalog, search, product pages, the cart with everything it does, and an order with the order's own token. Cannot buy. \|
	287	\| user \| Buys: everything anon can do, and an order of their own — `/orders` lists it, their order, receipt and payment pages open without a token, and the terminal's orders tab shows the same list. \|
241	288	\| admin \| Runs the shop: every path under `/admin`, and any order without its token. \|
242	289
243	290	Anyone who is not an admin gets one page at `/admin`, status 403, whose only
		@@ -248,23 +295,50 @@ from `/search?q=beans` comes back to the results — with one exception: an
248	295	order's `token` is stripped, because it opens that order to whoever holds it
249	296	and the sign-in path is handed to the forge. A page the token was what opened
250	297	(`/pay/:number`, `/orders/:number`, its receipt) is a 404 without it, so those
251		come back to `/orders` instead — "Find an order" opens for anybody, and lists
252		this browser's orders with their own links, so a shopper who signs in
253		part-way through paying is one click from finishing. Those links also carry
	298	come back to `/orders` instead, which opens for anybody: the account's own
	299	orders once they are signed in, and under them the guest orders this browser
	300	has opened, each with its own token link — so a shopper who signs in part-way
	301	through paying is one click from finishing either way. Those links also carry
254	302	`rel="noreferrer"`: `/__forge/*` shares this origin, so the `Referer` would
255	303	otherwise hand over the very URL `to` was careful to clean.
256	304
257		The terminal takes the same three roles from the environment. Stock and the
258		tax table read for anybody the forge names; orders,
259		the outbox, the codes, the cards and the changes do not, because a receipt
260		carries a gift card's code in full, an order carries a name and an address,
261		the card list is every balance in the shop, and the changes name the people
262		who run it. Every key that does anything — moving stock,
263		refunding, writing a code, issuing or voiding a card, setting a rate — is an
264		admin's, and so are the two keys that only read something out: `c`, which
265		prints a balance, and `h`, which prints the stock ledger. `src/desk.ts` holds
266		one table for both, and the tab bar and the foot of the screen are built from
267		it, so nothing can be offered without being gated.
	305	A page only a POST reaches is the same dead end: a missed lookup at
	306	`POST /orders/find` renders "Your orders", and a declined mock payment at
	307	`POST /pay/:number/mock` renders the payment page, but a GET of either is a
	308	404. So `to` is worked out once, at the front door, and handed to every page
	309	as `ctx.backTo`: this URL when a GET renders a page for the route's own
	310	pattern — `getAnswers` in `src/routes.ts`, asked of the pattern, because
	311	`/orders/find` is shaped like `/orders/:number` — and `/orders` when it does
	312	not. No page chooses its own sign-in target, so none of them can choose a 404.
	313
	314	The token goes the other way too: nobody is handed one they did not need.
	315	`src/orderlink.ts` says where an order lives for the person being sent there —
	316	the bare path for its buyer and for an admin, `?token=…` for whoever it took a
	317	token to get here — and `openOrder` reads the same predicate, so a buyer who
	318	opened their order by account never finds its secret written into their
	319	history by a redirect or a link on the page. Stripe's `success_url` and
	320	`cancel_url` still carry it: that browser leaves this origin, and a forge
	321	session that lapses while it is away must not make the way back a 404.
	322
	323	The terminal takes the same three roles from the environment, and gives each
	324	of them what the pages give it. Stock and the tax table read for anybody the
	325	forge names. The outbox, the codes, the cards and the changes read for an
	326	admin alone, because a receipt carries a gift card's code in full, the card
	327	list is every balance in the shop, and the changes name the people who run it.
	328	Orders are neither, because `/orders` is neither: whoever the forge named sees
	329	the orders on their own account and nobody else's, an admin sees the shop's,
	330	and an anonymous keyboard cannot open the tab at all.
	331	`desk.ordersFor(who, filter)` is the one place those rows are chosen — a
	332	function from `Who` to rows, so the rule is tested without a pty.
	333
	334	Every key that does anything — moving stock, refunding, writing a code,
	335	issuing or voiding a card, setting a rate — is an admin's, and so are the two
	336	keys that only read something out: `c`, which prints a balance, and `h`, which
	337	prints the stock ledger. The exception is `/`, which narrows the rows already
	338	in front of whoever pressed it: it reaches no further than they can already
	339	see, so the buyer at the keyboard may press it on their own orders.
	340	`src/desk.ts` holds one table for all of this, and the tab bar and the foot of
	341	the screen are built from it, so nothing can be offered without being gated.
268	342
269	343	Rate limits count the address the socket came from, never the first entry of
270	344	`x-forwarded-for` — see [What a rate limit is keyed on](#what-a-rate-limit-is-keyed-on)
		@@ -357,11 +431,12 @@ saying so.
357	431	\| `src/db.ts` \| The schema, and `open(dir)`: a directory in, a database out \|
358	432	\| `src/fresh.ts` \| A database of a test file's own, opened before the file imports anything that queries \|
359	433	\| `src/catalog.ts` `src/inventory.ts` `src/orders.ts` \| Products, the stock ledger, orders and refunds \|
360		\| `src/cart.ts` `src/codes.ts` `src/mine.ts` `src/money.ts` `src/sign.ts` \| The signed cart, the codes cookie, the orders this browser placed, integer cents, HMACs \|
	434	\| `src/cart.ts` `src/codes.ts` `src/mine.ts` `src/money.ts` `src/sign.ts` \| The signed cart, the codes cookie, the guest orders this browser found, integer cents, HMACs \|
361	435	\| `src/discounts.ts` `src/giftcards.ts` `src/tax.ts` \| What a code is worth, what a card holds, what the rate is \|
362	436	\| `src/who.ts` `src/session.ts` \| Who the forge says is asking; the session that carries the CSRF token \|
	437	\| `src/orderlink.ts` \| Where an order lives for the person being handed the link: with its token, or without it \|
363	438	\| `src/changes.ts` \| What an admin changed to the catalog, a code or a rate, and who they were \|
364		\| `src/desk.ts` \| The terminal's typed commands: a line of text into a code, a card or a rate \|
	439	\| `src/desk.ts` \| The terminal's gate and its typed commands: who may read which tab and press which key, whose orders they see, and a line of text into a code, a card or a rate \|
365	440	\| `src/peer.ts` `src/ratelimit.ts` \| Where a request came from, as far as it can be proved; the buckets keyed on it \|
366	441	\| `src/gateway.ts` `src/mail.ts` \| Stripe or the mock, the outbox \|
367	442	\| `src/shop.ts` `src/admin.ts` \| Handlers for the shop and for `/admin` \|
		@@ -414,22 +489,23 @@ live stream within about a second, not on that page's next load. `1`–`7`
414	489	switch between stock, orders, the outbox, discount codes, gift cards, the tax
415	490	table and the changes an admin made to any of it — everything `/admin`
416	491	can see — and `j`/`k` move. A tab whose rows are the shop's own business is an
417		admin's to open: a non-admin gets stock and tax, the other five are marked
418		with a `·` in the tab bar and answer "That is an admin's to do." without
419		leaving the tab they are on:
	492	admin's to open: a non-admin gets stock, tax and their own orders, the other
	493	four are marked with a `·` in the tab bar and answer without leaving the tab
	494	they are on:
420	495
421	496	\| Tab \| Keys \|
422	497	\| --- \| --- \|
423	498	\| stock \| `s` moves stock with a reason, `h` shows the last of the ledger \|
424		\| orders \| `/` finds an order by number, name or email — the terminal's half of `/orders` — and `r` refunds what is left of one and puts it back on the shelf \|
	499	\| orders \| the orders you may see — your account's, or the shop's for an admin. `/` narrows them by number, name or email, and `r` (an admin's) refunds what is left of one and puts it back on the shelf \|
425	500	\| codes \| `n` writes a code (`CODE 20% [min 25] [uses 100] [until 2026-12-31]`), `t` turns one on or off, `c` looks a code up \|
426	501	\| cards \| `i` issues a card (`25 a sorry-for-the-wait card`) and prints its code once, `v` voids or revives one, `c` looks a code up \|
427	502	\| tax \| `e` sets a rate (`COUNTRY / REGION / 8.75 / what to call it`), `d` sets the rate for anywhere the table does not name, `x` removes one \|
428	503	\| changes \| reads only: the last hundred changes an admin made to the catalog, the codes or the tax table, newest first — the terminal's half of `/admin/changes`. A change made here writes one of these rows too, naming the account the forge put at the keyboard \|
429	504
430	505	`q` leaves. The first line says who the forge named and what they may read;
431		`FORGE_APP_USER_ROLE` has to be `admin` for any of the keys above, `c` and `h`
432		included — one prints a card's balance and a code's full terms, the other the
433		stock ledger. `ssh` gets you to the screen, not past the door. The parsing,
434		the gates and the refusals are `src/desk.ts`, so they are tested without a
435		pty.
	506	`FORGE_APP_USER_ROLE` has to be `admin` for every key above except `/` — `c`
	507	and `h` included, since one prints a card's balance and a code's full terms
	508	and the other the stock ledger. `ssh` gets you to the screen, not past the
	509	door, and what is on the screen is only ever what the same person could open
	510	on the web. The parsing, the gates, the choice of rows and the refusals are
	511	all `src/desk.ts`, so they are tested without a pty.
		@@ -11,7 +11,6 @@ import type { Applied } from "./codes.ts";
11	11	import type { CartLine } from "./cart.ts";
12	12	import type { Peer } from "./peer.ts";
13	13	import type { Session } from "./session.ts";
14		import { returnTo } from "./who.ts";
15	14	import type { Who } from "./who.ts";
16	15
17	16	export type Ctx = {
		@@ -22,6 +21,13 @@ export type Ctx = {
22	21	session: Session;
23	22	/** Who the forge says is asking, verified in src/who.ts. */
24	23	who: Who;
	24	/**
	25	* Where signing in comes back to: this page when a GET answers it, and a
	26	* page that does when it does not — see `returnTo` in src/who.ts. Worked
	27	* out once, at the front door, so no page can offer a way in that lands on
	28	* a 404.
	29	*/
	30	backTo: string;
25	31	/** Parsed for POST routes; null for GET and for routes that read the body themselves. */
26	32	form: FormData \| null;
27	33	/**
		@@ -54,7 +60,7 @@ export function render(
54	60	layout({
55	61	title: options.title,
56	62	who: ctx.who,
57		path: returnTo(ctx.url),
	63	path: ctx.backTo,
58	64	cartCount: cartCount(ctx.cart),
59	65	categories: categories(),
60	66	current: options.current,
		@@ -271,6 +271,11 @@ function migrate(handle: Database): void {
271	271	addColumn(handle, "order", "tax_label", "TEXT NOT NULL DEFAULT ''");
272	272	addColumn(handle, "variant", "gift_card_cents", "INTEGER NOT NULL DEFAULT 0");
273	273	addColumn(handle, "order_item", "gift_card_cents", "INTEGER NOT NULL DEFAULT 0");
	274	// The account an order belongs to. Empty on the orders placed before there
	275	// were accounts: those stay guest orders, reached with their access token.
	276	addColumn(handle, "order", "buyer_id", "TEXT NOT NULL DEFAULT ''");
	277	addColumn(handle, "order", "buyer_name", "TEXT NOT NULL DEFAULT ''");
	278	handle.exec('CREATE INDEX IF NOT EXISTS order_buyer ON "order"(buyer_id, id DESC)');
274	279	}
275	280
276	281	/**
		@@ -341,6 +346,10 @@ export type Order = {
341	346	number: string;
342	347	access_token: string;
343	348	status: string;
	349	/** The forge account that placed it; "" for a guest order from before accounts. */
	350	buyer_id: string;
	351	/** That account's name as it was at the sale. Never an email address. */
	352	buyer_name: string;
344	353	email: string;
345	354	name: string;
346	355	address1: string;
		@@ -7,21 +7,28 @@
7	7	* be tested without a pty — a command is text in and a message out, and the
8	8	* work itself goes through the same modules the admin pages use.
9	9	*
10		* Reaching the terminal is not permission to use it. Everything below is what
	10	* Reaching the terminal is not permission to use it. The work below is what
11	11	* /admin does — issuing a card prints its code once, and looking a code up
12	12	* reads out a balance — so the forge has to have named an admin at the
13	13	* keyboard. `DESK` is the one place that says so, for reading as much as for
14	14	* doing: the gate in `src/tty.ts` and the foot of its screen both read it, so
15	15	* a key cannot be offered without being gated or gated without being offered,
16	16	* and a tab cannot be opened by someone who may not read what is on it.
	17	*
	18	* Reading is not all or nothing, though, because the web pages are not: what a
	19	* person can do on the page they should be able to do here. `ordersFor` is
	20	* `/orders` in the terminal — an account's own orders and nobody else's — and
	21	* it is a function from `Who` to rows, so the rule is tested without a pty.
17	22	*/
18	23
19	24	import * as changes from "./changes.ts";
20	25	import * as discounts from "./discounts.ts";
21	26	import * as giftcards from "./giftcards.ts";
	27	import * as orders from "./orders.ts";
22	28	import * as tax from "./tax.ts";
23	29	import { db } from "./db.ts";
24	30	import { formatCents, parseCents } from "./money.ts";
	31	import type { Order } from "./db.ts";
25	32	import type { Who } from "./who.ts";
26	33
27	34	export type Done = { ok: boolean; message: string };
		@@ -39,50 +46,67 @@ export type Tab = (typeof TABS)[number];
39	46
40	47	/**
41	48	* Every tab, who may look at it, and the keys it offers — each key with the
42		* words the screen's foot uses.
	49	* words the screen's foot uses and who may press it.
43	50	*
44		* `read: "admin"` is not squeamishness about internal pages. An order names a
45		* person and where they live; a receipt in the outbox carries a gift card's
46		* code in full, which is bearer money; the card list is every balance in the
47		* shop and the notes the shop wrote to itself about them; the code list is
48		* every discount that exists, including the ones nobody was told about. That
49		* is the same reason `c` is an admin's key, so it is the same gate.
	51	* `read: "admin"` is not squeamishness about internal pages. A receipt in the
	52	* outbox carries a gift card's code in full, which is bearer money; the card
	53	* list is every balance in the shop and the notes the shop wrote to itself
	54	* about them; the code list is every discount that exists, including the ones
	55	* nobody was told about. That is the same reason `c` is an admin's key, so it
	56	* is the same gate.
	57	*
	58	* `read: "own"` is the rule the orders page has: an order belongs to the
	59	* account that bought it, so the rows a person sees here are the rows `/orders`
	60	* would list for them — their own and nobody else's. An admin sees the shop's.
	61	* Whoever the forge did not name sees nothing, because nothing is theirs.
50	62	*
51	63	* Stock and the tax table are the shop's public face — what is on the shelf
52	64	* and what it is taxed at — so they stay open to whoever the forge named.
	65	*
	66	* A key marked `"reader"` changes nothing and reads nothing that is not
	67	* already on the tab, so whoever may read the tab may press it; every key that
	68	* does the desk's work, or reads a code out, is an `"admin"`'s.
53	69	*/
54		const DESK: Record<Tab, { read: "anyone" \| "admin"; keys: { key: string; label: string }[] }> = {
55		stock: { read: "anyone", keys: [{ key: "s", label: "s move stock" }, { key: "h", label: "h ledger" }] },
56		orders: {
57		read: "admin",
	70	type Offer = { key: string; label: string; press: "admin" \| "reader" };
	71
	72	const DESK: Record<Tab, { read: "anyone" \| "own" \| "admin"; keys: Offer[] }> = {
	73	stock: {
	74	read: "anyone",
58	75	keys: [
59		{ key: "/", label: "/ find" },
60		{ key: "r", label: "r refund the rest and restock" },
	76	{ key: "s", label: "s move stock", press: "admin" },
	77	{ key: "h", label: "h ledger", press: "admin" },
	78	],
	79	},
	80	orders: {
	81	read: "own",
	82	keys: [
	83	{ key: "/", label: "/ find", press: "reader" },
	84	{ key: "r", label: "r refund the rest and restock", press: "admin" },
61	85	],
62	86	},
63	87	outbox: { read: "admin", keys: [] },
64	88	codes: {
65	89	read: "admin",
66	90	keys: [
67		{ key: "n", label: "n new code" },
68		{ key: "t", label: "t on/off" },
69		{ key: "c", label: "c check a code" },
	91	{ key: "n", label: "n new code", press: "admin" },
	92	{ key: "t", label: "t on/off", press: "admin" },
	93	{ key: "c", label: "c check a code", press: "admin" },
70	94	],
71	95	},
72	96	cards: {
73	97	read: "admin",
74	98	keys: [
75		{ key: "i", label: "i issue a card" },
76		{ key: "v", label: "v void/revive" },
77		{ key: "c", label: "c check a code" },
	99	{ key: "i", label: "i issue a card", press: "admin" },
	100	{ key: "v", label: "v void/revive", press: "admin" },
	101	{ key: "c", label: "c check a code", press: "admin" },
78	102	],
79	103	},
80	104	tax: {
81	105	read: "anyone",
82	106	keys: [
83		{ key: "e", label: "e set a rate" },
84		{ key: "d", label: "d default rate" },
85		{ key: "x", label: "x remove" },
	107	{ key: "e", label: "e set a rate", press: "admin" },
	108	{ key: "d", label: "d default rate", press: "admin" },
	109	{ key: "x", label: "x remove", press: "admin" },
86	110	],
87	111	},
88	112	// Who changed a price, a code or a rate is the shop's own business, and it
		@@ -90,19 +114,48 @@ const DESK: Record<Tab, { read: "anyone" \| "admin"; keys: { key: string; label:
90	114	changes: { read: "admin", keys: [] },
91	115	};
92	116
93		/** True when this key on this tab is the desk's work, and so an admin's. */
94		export const needsAdmin = (tab: Tab, key: string): boolean => DESK[tab].keys.some((offer) => offer.key === key);
	117	/**
	118	* True when this key on this tab is the desk's work, and so an admin's. The
	119	* terminal asks `mayPress`, which is this and the tab's reading rule together;
	120	* this is here on its own because it is the half the invariant is stated in:
	121	* nothing an admin's key does is ever in `offered` for anybody else.
	122	*/
	123	export const needsAdmin = (tab: Tab, key: string): boolean =>
	124	DESK[tab].keys.some((offer) => offer.key === key && offer.press === "admin");
95	125
96		/** True when what is printed on this tab is an admin's to read. */
97		export const needsAdminToRead = (tab: Tab): boolean => DESK[tab].read === "admin";
	126	/** True when this tab has anything at all to say to this person. */
	127	export const canRead = (tab: Tab, who: Who): boolean =>
	128	who.role === "admin" \|\| DESK[tab].read === "anyone" \|\| (DESK[tab].read === "own" && who.role !== "anon");
98	129
99	130	/** The tabs this person may open. A non-admin gets the ones that are not private. */
100		export const visible = (who: Who): Tab[] =>
101		TABS.filter((tab) => who.role === "admin" \|\| !needsAdminToRead(tab));
	131	export const visible = (who: Who): Tab[] => TABS.filter((tab) => canRead(tab, who));
102	132
103		/** What this person may do on this tab. Nothing, unless the forge named an admin. */
	133	/** True when this person may press this key on this tab. */
	134	export const mayPress = (tab: Tab, key: string, who: Who): boolean =>
	135	DESK[tab].keys.some(
	136	(offer) => offer.key === key && (offer.press === "admin" ? who.role === "admin" : canRead(tab, who)),
	137	);
	138
	139	/** True when this key means anything on this tab, whoever is pressing it. */
	140	export const knows = (tab: Tab, key: string): boolean => DESK[tab].keys.some((offer) => offer.key === key);
	141
	142	/** What this person may do on this tab, in the words the screen's foot uses. */
104	143	export const offered = (tab: Tab, who: Who): string[] =>
105		who.role === "admin" ? DESK[tab].keys.map((offer) => offer.label) : [];
	144	DESK[tab].keys.filter((offer) => mayPress(tab, offer.key, who)).map((offer) => offer.label);
	145
	146	/**
	147	* The orders this person may see at the keyboard, narrowed by what `/` is
	148	* looking for. It is `/orders`' rule, said once for the terminal: an admin
	149	* sees the shop's orders, anybody else the forge named sees the ones on their
	150	* own account, and whoever the forge did not name sees none — there is nothing
	151	* here that is theirs. A pty is not needed to check it: `Who` in, rows out.
	152	*/
	153	export const ordersFor = (who: Who, filter = "", limit = 100): Order[] =>
	154	who.role === "admin"
	155	? orders.recent(limit, filter)
	156	: who.role === "user"
	157	? orders.forBuyer(who.id, limit, filter)
	158	: [];
106	159
107	160	const no = (message: string): Done => ({ ok: false, message });
108	161	const yes = (message: string): Done => ({ ok: true, message });
		@@ -99,7 +99,7 @@ export function layout(chrome: Chrome): string {
99	99	<p><span class="env" style="background: ${env === "production" ? "#16653d" : "#1d4ed8"}">${escape(where)}</span>
100	100	${commit ? `<span class="muted"> @ ${escape(commit)}</span>` : ""}
101	101	— a demonstration store: no goods ship and no money moves.</p>
102		<p><a href="/orders">Find an order</a> · <a href="/gift-cards">Gift cards</a> — buy one, or see what is left on the one you hold.</p>
	102	<p><a href="/orders">Your orders</a> · <a href="/gift-cards">Gift cards</a> — buy one, or see what is left on the one you hold.</p>
103	103	<p>${
104	104	ssh
105	105	? `Same shop in a terminal: <code>${escape(ssh)}</code>`
		@@ -68,7 +68,9 @@ export function receiptText(order: Order, items: OrderItem[], giftCardCodes: str
68	68	? "a gift card, in full"
69	69	: "the mock gateway"
70	70	}.`,
71		`Lost the link to this order? The "Find an order" page takes ${order.number} with this email address.`,
	71	order.buyer_name === ""
	72	? `Lost the link to this order? The "Your orders" page takes ${order.number} with this email address.`
	73	: `This order belongs to ${order.buyer_name}: it is listed on the "Your orders" page, signed in as them.`,
72	74	"This is a demonstration store: no goods ship and no money moves.",
73	75	].join("\n");
74	76	}
		@@ -1,11 +1,15 @@
1	1	/**
2		* The orders this browser has placed, in a signed cookie beside the cart.
	2	* The guest orders this browser has found, in a signed cookie beside the cart.
	3	*
	4	* An order placed by an account is listed from the account, so what is left
	5	* for a cookie is the guest orders — the rows from before an order had an
	6	* account, which have nothing but their access token.
3	7	*
4	8	* Numbers and nothing else: the access token that actually opens an order is
5	9	* read from the database on every render, so editing this cookie can only
6	10	* change which order number is being claimed — and a number alone opens
7	11	* nothing, because the link is built from the token in the row. Ten is as far
8		* back as a cookie should remember; older orders are found with the form at
	12	* back as a cookie should remember; anything older is found with the form at
9	13	* `/orders`, which asks for the email as well.
10	14	*/
11	15
		@@ -0,0 +1,31 @@
	1	/**
	2	* Where an order lives, for the person being handed the link.
	3	*
	4	* An order opens two ways: for the account it belongs to — and for an admin —
	5	* because the row says so, or for whoever holds its access token. When the row
	6	* is enough, the token has no business in the URL: it would be a secret
	7	* written into that person's history, their bookmarks and the `Referer` of
	8	* every link they follow next, for a page that did not need it. When the row
	9	* is not enough, the token is the only thing that opens the page, so the link
	10	* carries it.
	11	*
	12	* This is not a second door. `openOrder` in `src/shop.ts` is still the only
	13	* place that decides who may open an order; this asks the same question about
	14	* a link rather than about a request, and `openOrder` reads `opensByAccount`
	15	* from here so the two cannot drift apart.
	16	*/
	17
	18	import type { Order } from "./db.ts";
	19	import type { Who } from "./who.ts";
	20
	21	/** True when the row itself opens this order for this person. */
	22	export const opensByAccount = (who: Who, order: Order): boolean =>
	23	who.role === "admin" \|\| (who.role === "user" && order.buyer_id !== "" && order.buyer_id === who.id);
	24
	25	/** What a link to this order carries in its query for this person: nothing, or the token. */
	26	export const tokenQuery = (who: Who, order: Order): string =>
	27	opensByAccount(who, order) ? "" : `?token=${encodeURIComponent(order.access_token)}`;
	28
	29	/** The order's page, or its payment page, as this person should be sent to it. */
	30	export const linkTo = (who: Who, order: Order, page: "orders" \| "pay" = "orders"): string =>
	31	`/${page}/${order.number}${tokenQuery(who, order)}`;
		@@ -38,6 +38,9 @@ export type Address = {
38	38	country: string;
39	39	};
40	40
	41	/** The account an order belongs to: who the forge signed in, and nothing else. */
	42	export type Buyer = { id: string; name: string };
	43
41	44	export type PlaceResult = { ok: true; order: Order; reused: boolean } \| { ok: false; error: string };
42	45
43	46	const ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
		@@ -69,16 +72,41 @@ export const note = (orderId: number, kind: string, detail = ""): void => {
69	72	db.query("INSERT INTO order_event (order_id, kind, detail) VALUES (?1, ?2, ?3)").run(orderId, kind, detail);
70	73	};
71	74
	75	/** A needle for LIKE: the shopper's text is data, and `%` and `_` are theirs to type. */
	76	const like = (needle: string): string => `%${needle.replace(/[\\%_]/g, (c) => "\\" + c)}%`;
	77
	78	/**
	79	* The orders one account placed, newest first, narrowed by a needle the way
	80	* the admin's search is. An empty id belongs to nobody, so it matches nothing:
	81	* the guest orders are not one account's to list. Whatever is typed, the
	82	* `buyer_id` is the caller's, so this can only narrow — never widen.
	83	*/
	84	export const forBuyer = (buyerId: string, limit = 50, query = ""): Order[] => {
	85	if (buyerId === "") return [];
	86	const needle = query.trim();
	87	if (needle === "")
	88	return db
	89	.query<Order, [string, number]>('SELECT * FROM "order" WHERE buyer_id = ?1 ORDER BY id DESC LIMIT ?2')
	90	.all(buyerId, limit);
	91	return db
	92	.query<Order, [string, string, number]>(
	93	`SELECT * FROM "order" WHERE buyer_id = ?1
	94	AND (number LIKE ?2 ESCAPE '\\' OR email LIKE ?2 ESCAPE '\\' OR name LIKE ?2 ESCAPE '\\')
	95	ORDER BY id DESC LIMIT ?3`,
	96	)
	97	.all(buyerId, like(needle), limit);
	98	};
	99
72	100	export const recent = (limit = 50, query = ""): Order[] => {
73	101	const needle = query.trim();
74	102	if (needle === "") return db.query<Order, [number]>('SELECT * FROM "order" ORDER BY id DESC LIMIT ?1').all(limit);
75		const like = `%${needle.replace(/[\\%_]/g, (c) => "\\" + c)}%`;
76	103	return db
77	104	.query<Order, [string, number]>(
78	105	`SELECT * FROM "order" WHERE number LIKE ?1 ESCAPE '\\' OR email LIKE ?1 ESCAPE '\\' OR name LIKE ?1 ESCAPE '\\'
	106	OR buyer_name LIKE ?1 ESCAPE '\\'
79	107	ORDER BY id DESC LIMIT ?2`,
80	108	)
81		.all(like, limit);
	109	.all(like(needle), limit);
82	110	};
83	111
84	112	/** Remember the gateway's handle for an unpaid order (a Stripe session id). */
		@@ -123,6 +151,8 @@ export function splitRefund(order: Order, amount_cents: number): { gateway_cents
123	151	*/
124	152	export function place(input: {
125	153	address: Address;
	154	/** The account buying. An order is nobody's only if it was placed before accounts. */
	155	buyer: Buyer;
126	156	cart: CartLine[];
127	157	codes: Applied;
128	158	/** What the checkout page showed, to be told when it went stale. */
		@@ -163,10 +193,12 @@ export function place(input: {
163	193	try {
164	194	created = db
165	195	.query<Order, any>(
166		`INSERT INTO "order" (number, access_token, email, name, address1, address2, city, region, postal, country,
	196	`INSERT INTO "order" (number, access_token, buyer_id, buyer_name, email, name, address1, address2, city,
	197	region, postal, country,
167	198	subtotal_cents, discount_code, discount_cents, shipping_cents, tax_cents, tax_rate_bp, tax_label,
168	199	gift_card_cents, total_cents, gateway, idempotency_key)
169		VALUES ($number, $access_token, $email, $name, $address1, $address2, $city, $region, $postal, $country,
	200	VALUES ($number, $access_token, $buyer_id, $buyer_name, $email, $name, $address1, $address2, $city,
	201	$region, $postal, $country,
170	202	$subtotal_cents, $discount_code, $discount_cents, $shipping_cents, $tax_cents, $tax_rate_bp, $tax_label,
171	203	$gift_card_cents, $total_cents, $gateway, $idempotency_key)
172	204	RETURNING *`,
		@@ -174,6 +206,8 @@ export function place(input: {
174	206	.get({
175	207	$number: orderNumber(),
176	208	$access_token: randomBytes(18).toString("base64url"),
	209	$buyer_id: input.buyer.id.slice(0, 64),
	210	$buyer_name: input.buyer.name.slice(0, 120),
177	211	$email: input.address.email,
178	212	$name: input.address.name,
179	213	$address1: input.address.address1,
		@@ -233,7 +267,13 @@ export function place(input: {
233	267	if (!takeStock(item.variant_id, item.quantity, `sold on ${created.number}`, created.id))
234	268	throw new Error(`OUT_OF_STOCK:${item.product_title} (${item.variant_name})`);
235	269	}
236		note(created.id, "placed", `${itemRows.length} line${itemRows.length === 1 ? "" : "s"}, awaiting payment`);
	270	note(
	271	created.id,
	272	"placed",
	273	`${itemRows.length} line${itemRows.length === 1 ? "" : "s"}, awaiting payment${
	274	created.buyer_name === "" ? "" : ` — ${created.buyer_name}`
	275	}`,
	276	);
237	277	return created;
238	278	})();
239	279	} catch (error) {
		@@ -100,6 +100,14 @@ ${live(
100	100	${live("latest-orders", ORDER_EVENTS, orderRows(latest))}
101	101	`;
102	102
	103	/**
	104	* The account an order belongs to, beside the email the shopper typed. They
	105	* are different things: an account name is not an email address, and an order
	106	* from before accounts belongs to nobody but whoever holds its token.
	107	*/
	108	const account = (order: Order): string =>
	109	order.buyer_name === "" ? "guest" : `account ${escape(order.buyer_name)}`;
	110
103	111	export function orderRows(orders: Order[]): string {
104	112	if (orders.length === 0) return '<p class="muted">No orders yet.</p>';
105	113	// Fixed columns: a row arriving at the top cannot move the ones below it
		@@ -112,7 +120,9 @@ export function orderRows(orders: Order[]): string {
112	120	(order) => `<tr>
113	121	<td><a href="/admin/orders/${escape(order.number)}">${escape(order.number)}</a></td>
114	122	<td class="muted">${escape(order.created_at)}</td>
115		<td>${escape(order.name)}<div class="muted" style="font-size:.85rem">${escape(order.email)}</div></td>
	123	<td>${escape(order.name)}<div class="muted" style="font-size:.85rem">${escape(order.email)} · ${account(
	124	order,
	125	)}</div></td>
116	126	<td>${statusPill(order.status)}</td>
117	127	<td class="num price">${escape(formatCents(order.total_cents))}</td>
118	128	</tr>`,
		@@ -124,7 +134,8 @@ export const orders = (list: Order[], query: string): string => `
124	134	${nav("orders")}
125	135	<h1>Orders</h1>
126	136	<form method="get" action="/admin/orders" class="row-actions" style="margin-bottom:1rem">
127		<input name="q" value="${escape(query)}" placeholder="Number, name or email" maxlength="80" style="max-width:22rem">
	137	<input name="q" value="${escape(query)}" placeholder="Number, name, email or account" maxlength="80"
	138	style="max-width:22rem">
128	139	<button class="btn ghost">Search</button>
129	140	</form>
130	141	${live("order-list", ORDER_EVENTS, orderRows(list))}
		@@ -145,7 +156,7 @@ export function order(
145	156	return `
146	157	${nav("orders")}
147	158	<h1>${escape(found.number)} ${statusPill(found.status)}</h1>
148		<p class="lede">${escape(found.name)} · ${escape(found.email)} · ${escape(found.gateway)}${
	159	<p class="lede">${escape(found.name)} · ${escape(found.email)} · ${account(found)} · ${escape(found.gateway)}${
149	160	found.payment_ref ? ` · ${escape(found.payment_ref)}` : ""
150	161	}</p>
151	162	${message ? `<p class="notice${message.bad ? " bad" : ""}">${escape(message.text)}</p>` : ""}