2b2281e · 8804e4e · 8874981 · a35bf00 · 96e79b6 · 4cf6b27
@@ -2,11 +2,12 @@
A small shop: a catalog with categories and search, product pages with
variants and stock, a cart in a signed cookie, discount codes and gift cards,
tax by where the parcel goes, checkout with an address, a payment step,
receipts, and an `/admin` for products, inventory, codes, cards, tax and
orders with refunds. Every price is an integer number of cents, every form
carries a CSRF token, and checkout, payment, typing a code and finding an
order are rate limited. A category or a search longer than 24 things is
tax by where the parcel goes, a gift card balance window, checkout with an
address, a payment step, receipts, and an `/admin` for products, inventory,
codes, cards, tax and orders with refunds. Every price is an integer number
of cents, every form carries a CSRF token, and checkout, payment, typing a
code, reading a gift card's balance and finding an order are each rate
limited on their own. A category or a search longer than 24 things is
paged, so a listing is never a page without an end and never hides what is
past the end of it.
@@ -52,10 +53,16 @@
takes off.
- **Discount codes** are a percent, a fixed number of cents, or free
  shipping, with an optional minimum, a start and expiry, and a cap on how
  many times they can be used. A discount applies to goods only — money is
  not bought at a discount — and the cap is taken with a conditional `UPDATE`
  inside the order's transaction, so a code with one use left goes to one
  person. Every use, and every use given back when an order is cancelled, is
  a row in `discount_redemption`. `WELCOME10` and `SHIPFREE` are seeded.
  not bought at a discount — and every limit it carries is checked again by
  the conditional `UPDATE` inside the order's transaction: whether it is on,
  whether now is inside its window, and whether a use is left. A code with
  one use left goes to one person, and a code that expires between the cart
  and the order is not taken anyway. Every use, and every use given back when an order is cancelled, is
  a row in `discount_redemption`. An expiry is stored as a stamp and compared
  as text, so it has to be a real day: `discounts.endOfDay` parses it and
  round-trips it, and the form and the terminal both refuse `2026-99-99`
  rather than store a code that outlasts every date there is.
  `WELCOME10` and `SHIPFREE` are seeded.
- **Gift cards** are sold as an ordinary product (`/p/gift-card`) and issued
  when the order is paid; the code is printed once, on the receipt. Only the
  code's HMAC and its last four characters are stored, so the table cannot be
@@ -63,7 +70,18 @@
takes off.
  `gift_card_entry`, and spending is conditional on the balance being there,
  so two checkouts racing for the last $5 cannot both win and a balance never
  goes below zero. What a card cannot cover is left for the gateway; a card
  that covers the lot means there is no gateway to ask.
  that covers the lot means there is no gateway to ask. `/gift-cards` shows
  whoever holds a code what is left on it and every movement of it: the code
  is asked for with a POST so it never lands in a URL or a log, the page has
  its own rate limit so reading a balance never costs a shopper the right to
  apply a code at the till, and a code the shop does not know is refused in
  the same words as one that is empty. Each movement is named in the shop's
  own fixed words — "Issued", "Spent on an order", "Taken off the card" —
  never the note an admin typed to themselves when they voided it. The window
  shows the last twenty movements and says so when there are more, and it
  offers to spend the card only while it is live and has something on it.
  The confirmation page says, next to the gift card line, that the code is on
  the receipt and that this is the only copy.
- **Tax** is a table of rates in basis points by country and region
  (`/admin/tax`), matched on the address the shopper typed — the exact region
  first, then the country, then a default. It is taken on goods after the
@@ -104,7 +122,7 @@
that way back, and it has two halves:
A limit only limits if the caller cannot choose which bucket it spends, so
`src/peer.ts` decides where a request came from and a bucket is keyed on that
and nothing else: the address the socket arrived on. `X-Forwarded-For` is not
read. It would be the useful thing — it names the shopper behind a proxy — but
read on the strength of its own existence. It would be the useful thing — it names the shopper behind a proxy — but
only if a proxy we trust appends to it, and nothing this app can see from the
inside proves that one does. A client can send that header itself, and a hint
nobody vouches for is the caller's own word; keyed on the leftmost entry, as
@@ -113,11 +131,20 @@
this app used to be, every bucket here was ten tries per invented header.
The consequence is deliberate and worth knowing: behind the forge's proxy every
shopper arrives on the same address, so these are the **shop's** limits rather
than each shopper's, and the capacities in `src/ratelimit.ts` are set for a
shop — 30 checkouts a minute, 30 codes every two minutes, 30 order lookups
every five. Ordinary trade never meets them; guessing at a gift card code or
an order number runs out of tries long before it runs out of guesses. If the
forge ever says it appends a hop of its own, the rightmost entry becomes worth
reading and `src/peer.ts` is the one file that changes.
shop — 30 checkouts a minute, 30 codes and 30 balance checks every two
minutes, 30 order lookups every five. Ordinary trade never meets them;
guessing at a gift card code or
an order number runs out of tries long before it runs out of guesses.
The one thing that can vouch for the header is the deployment, and only by
counting. `FORGE_APP_TRUSTED_HOPS` says how many proxies of ours stand in
front of the socket; a proxy appends the peer it saw to the **right** of the
chain, so with `1` the shopper is the right-hand entry, with `2` the one
before that, and everything further left — where a client writes what it likes
— is never read. Set it and the limits above go back to being each shopper's.
Unset, which is how the forge runs today, the header is not read at all, and
nothing is inferred from the shape of an address: a guess about who is proxying
is not a fact about it. `src/peer.ts` is the only file that reads the header.
The address is checked for the shape of one before it is used, which is also
why the `looked-up` note on an order can only ever hold an address and not a
@@ -165,6 +192,7 @@
request made at all. No test in this repository talks to the network.
| Variable | Meaning |
| --- | --- |
| `FORGE_APP_IDENTITY_KEY` | The key the forge signs `x-forge-identity` with, verified in `src/who.ts`. Unset means no request can be verified: everybody is anonymous and `/admin` is closed to everybody. There is no password and no way around this. |
| `FORGE_APP_TRUSTED_HOPS` | How many proxies of ours stand in front of the socket, for the address a rate limit counts. `1` means `x-forwarded-for`'s right-hand entry is the client. Unset or `0`, the header is not read at all and a bucket is the whole shop's. |
| `APP_SECRET` | Signs cart cookies, sessions, CSRF tokens and order links. Generated into `FORGE_APP_DATA/secret` when unset. |
| `STRIPE_SECRET_KEY` | A Stripe **test** key turns on real Stripe Checkout. |
| `STRIPE_WEBHOOK_SECRET` | Verifies `POST /webhooks/stripe`. |
@@ -198,9 +226,24 @@
from `/search?q=beans` comes back to the results — with one exception: an
order's `token` is stripped, because it opens that order to whoever holds it
and the sign-in path is handed to the forge. Those links also carry
`rel="noreferrer"`: `/__forge/*` shares this origin, so the `Referer` would
otherwise hand over the very URL `to` was careful to clean. The terminal takes
the same three roles from the environment and keeps stock moves and refunds
for an admin.
otherwise hand over the very URL `to` was careful to clean.
The terminal takes the same three roles from the environment. Stock and the
tax table read for anybody the forge names; orders,
the outbox, the codes and the cards do not, because a receipt carries a gift
card's code in full, an order carries a name and an address, and the card list
is every balance in the shop. Every key that does anything — moving stock,
refunding, writing a code, issuing or voiding a card, setting a rate — is an
admin's, and so are the two keys that only read something out: `c`, which
prints a balance, and `h`, which prints the stock ledger. `src/desk.ts` holds
one table for both, and the tab bar and the foot of the screen are built from
it, so nothing can be offered without being gated.
Rate limits count the address the socket came from, never the first entry of
`x-forwarded-for` — see [What a rate limit is keyed on](#what-a-rate-limit-is-keyed-on)
for why, and for the one declaration that changes it. Reading a gift card's
balance gets a bucket of its own there, separate from typing a code at the
till: someone reading their card over and over must still be able to spend it.
## Shape
@@ -213,18 +256,35 @@
for an admin.
| `src/cart.ts` `src/codes.ts` `src/mine.ts` `src/money.ts` `src/sign.ts` | The signed cart, the codes cookie, the orders this browser placed, integer cents, HMACs |
| `src/discounts.ts` `src/giftcards.ts` `src/tax.ts` | What a code is worth, what a card holds, what the rate is |
| `src/who.ts` `src/session.ts` | Who the forge says is asking; the session that carries the CSRF token |
| `src/desk.ts` | The terminal's typed commands: a line of text into a code, a card or a rate |
| `src/peer.ts` `src/ratelimit.ts` | Where a request came from, as far as it can be proved; the buckets keyed on it |
| `src/gateway.ts` `src/mail.ts` | Stripe or the mock, the outbox |
| `src/shop.ts` `src/admin.ts` | Handlers for the shop and for `/admin` |
| `src/pages/*.ts` `src/html.ts` `src/style.ts` | Rendering; the stylesheet is served under a name made from its own contents |
| `src/units.test.ts` `src/server.test.ts` `src/stripe.test.ts` | The rules on their own, the shop over HTTP, the Stripe path against a fake Stripe |
| `src/units.test.ts` `src/server.test.ts` `src/stripe.test.ts` `src/proxy.test.ts` | The rules on their own, the shop over HTTP, the Stripe path against a fake Stripe, the app booted behind a declared proxy |
## The terminal
The same shop over the same data. The exact command is in `FORGE_APP_SSH`
when the app runs; the footer of every page prints it verbatim, and says the
terminal is off when it is unset. `1/2/3` switch between stock, orders and the
outbox, `j`/`k` move, `s` moves stock with a reason, `/` finds an order by
number, name or email — the terminal's half of `/orders` — `r` refunds the rest
of an order and puts it back on the shelf, `q` leaves. The first line says who
the forge named at the keyboard; `s` and `r` are an admin's.
terminal is off when it is unset. `1`–`6` switch between stock, orders, the
outbox, discount codes, gift cards and the tax table — everything `/admin`
can see — and `j`/`k` move. A tab whose rows are the shop's own business is an
admin's to open: a non-admin gets stock and tax, the other four are marked
with a `·` in the tab bar and answer "That is an admin's to do." without
leaving the tab they are on:
| Tab | Keys |
| --- | --- |
| stock | `s` moves stock with a reason, `h` shows the last of the ledger |
| orders | `/` finds an order by number, name or email — the terminal's half of `/orders` — and `r` refunds what is left of one and puts it back on the shelf |
| codes | `n` writes a code (`CODE 20% [min 25] [uses 100] [until 2026-12-31]`), `t` turns one on or off, `c` looks a code up |
| cards | `i` issues a card (`25 a sorry-for-the-wait card`) and prints its code once, `v` voids or revives one, `c` looks a code up |
| tax | `e` sets a rate (`COUNTRY / REGION / 8.75 / what to call it`), `d` sets the rate for anywhere the table does not name, `x` removes one |
`q` leaves. The first line says who the forge named and what they may read;
`FORGE_APP_USER_ROLE` has to be `admin` for any of the keys above, `c` and `h`
included — one prints a card's balance and a code's full terms, the other the
stock ledger. `ssh` gets you to the screen, not past the door. The parsing,
the gates and the refusals are `src/desk.ts`, so they are tested without a
pty.
@@ -316,9 +316,9 @@
export function discountList(ctx: Ctx): Response {
  return render(ctx, { title: "Discounts", admin: true }, pages.discounts(ctx.session, discounts.withUse(), messageFrom(ctx)));
}
/** A date is a date or it is nothing; a percent is basis points of a whole. */
/** A date is a real date or it is nothing; a percent is basis points of a whole. */
const dayOrNull = (value: string): string | null | undefined =>
  value === "" ? null : /^\d{4}-\d{2}-\d{2}$/.test(value) ? `${value} 23:59:59` : undefined;
  value === "" ? null : discounts.endOfDay(value);
export function discountCreate(ctx: Ctx): Response {
  const blocked = guard(ctx);
@@ -0,0 +1,245 @@
/**
 * The desk: what someone at the counter does to codes, cards and tax rates,
 * said as one line of text.
 *
 * The terminal has no forms, so every action it offers is a typed line. The
 * parsing and the refusals live here rather than in `src/tty.ts`, so they can
 * be tested without a pty — a command is text in and a message out, and the
 * work itself goes through the same modules the admin pages use.
 *
 * Reaching the terminal is not permission to use it. Everything below is what
 * /admin does — issuing a card prints its code once, and looking a code up
 * reads out a balance — so the forge has to have named an admin at the
 * keyboard. `DESK` is the one place that says so, for reading as much as for
 * doing: the gate in `src/tty.ts` and the foot of its screen both read it, so
 * a key cannot be offered without being gated or gated without being offered,
 * and a tab cannot be opened by someone who may not read what is on it.
 */
import * as discounts from "./discounts.ts";
import * as giftcards from "./giftcards.ts";
import * as tax from "./tax.ts";
import { formatCents, parseCents } from "./money.ts";
import type { Who } from "./who.ts";
export type Done = { ok: boolean; message: string };
export const TABS = ["stock", "orders", "outbox", "codes", "cards", "tax"] as const;
export type Tab = (typeof TABS)[number];
/**
 * Every tab, who may look at it, and the keys it offers — each key with the
 * words the screen's foot uses.
 *
 * `read: "admin"` is not squeamishness about internal pages. An order names a
 * person and where they live; a receipt in the outbox carries a gift card's
 * code in full, which is bearer money; the card list is every balance in the
 * shop and the notes the shop wrote to itself about them; the code list is
 * every discount that exists, including the ones nobody was told about. That
 * is the same reason `c` is an admin's key, so it is the same gate.
 *
 * Stock and the tax table are the shop's public face — what is on the shelf
 * and what it is taxed at — so they stay open to whoever the forge named.
 */
const DESK: Record<Tab, { read: "anyone" | "admin"; keys: { key: string; label: string }[] }> = {
  stock: { read: "anyone", keys: [{ key: "s", label: "s move stock" }, { key: "h", label: "h ledger" }] },
  orders: {
    read: "admin",
    keys: [
      { key: "/", label: "/ find" },
      { key: "r", label: "r refund the rest and restock" },
    ],
  },
  outbox: { read: "admin", keys: [] },
  codes: {
    read: "admin",
    keys: [
      { key: "n", label: "n new code" },
      { key: "t", label: "t on/off" },
      { key: "c", label: "c check a code" },
    ],
  },
  cards: {
    read: "admin",
    keys: [
      { key: "i", label: "i issue a card" },
      { key: "v", label: "v void/revive" },
      { key: "c", label: "c check a code" },
    ],
  },
  tax: {
    read: "anyone",
    keys: [
      { key: "e", label: "e set a rate" },
      { key: "d", label: "d default rate" },
      { key: "x", label: "x remove" },
    ],
  },
};
/** True when this key on this tab is the desk's work, and so an admin's. */
export const needsAdmin = (tab: Tab, key: string): boolean => DESK[tab].keys.some((offer) => offer.key === key);
/** True when what is printed on this tab is an admin's to read. */
export const needsAdminToRead = (tab: Tab): boolean => DESK[tab].read === "admin";
/** The tabs this person may open. A non-admin gets the ones that are not private. */
export const visible = (who: Who): Tab[] =>
  TABS.filter((tab) => who.role === "admin" || !needsAdminToRead(tab));
/** What this person may do on this tab. Nothing, unless the forge named an admin. */
export const offered = (tab: Tab, who: Who): string[] =>
  who.role === "admin" ? DESK[tab].keys.map((offer) => offer.label) : [];
const no = (message: string): Done => ({ ok: false, message });
const yes = (message: string): Done => ({ ok: true, message });
const words = (line: string): string[] => line.trim().split(/\s+/).filter((word) => word !== "");
/** "20%" is a percentage, "free" is free shipping, "5" and "$5.00" are money. */
function readValue(text: string): { kind: "percent" | "fixed" | "free_shipping"; value: number } | undefined {
      
        sentinelcrew
        1mo ago
        outdated
      
      I bought /p/gift-card on the preview, paid the mock gateway, took GC-····M8RG off the receipt and typed it at /gift-cards: balance, issue amount and the ledger row came back in 149 ms, the code was not echoed, the lookup is a POST with a CSRF token (a POST without one is 403), and an unknown code is refused in the cart's own words. The redeem fix is the best part of this pull — putting the window into the same conditional UPDATE that takes the use is the right place for it, and the test that would fail without the window condition proves it. Two things need fixing before this lands.
1. High — the branch predates the identity change, and its new terminal actions have no role check. This is based on 5991215; main is now 1d0fbed, and the pull does not merge (conflicts in README.md, src/tty.ts, src/units.test.ts). src/tty.ts here imports ensureDemoPassword from src/session.ts and prints /admin password (generated, …) on the first screen — that export is gone from main, so the terminal will not even start after the merge. More important: main's tty takes who is at the keyboard from atKeyboard() and gates s and r on person.role === "admin", and the seven new keys added here — n, t, i, v, e, d, x — are ungated, so a non-admin who reaches the terminal could mint gift cards, write a customer's balance to zero and rewrite the tax table. The README says it outright: "Whoever got through ssh is as privileged as /admin". That is the assumption main deliberately dropped. Fix first: rebase onto main, delete the generated-password lines from src/tty.ts and the README, and put isAdmin in front of every desk action exactly as main does for s and r (if (key === "i" && tab === "cards" && isAdmin), and the same for the rest — c/look prints a discount's full terms and a card's balance, so gate that too; leave tabs 4–6 readable). The desk itself is well shaped: text in, message out, tested without a pty, work done through the same modules the admin pages use. It only needs the door in front of it.
2. Medium — the guessing limit on /gift-cards does not hold in front of a real client. Fourteen POSTs from here with a rotating x-forwarded-for all answered 200; the same fourteen without the header hit 429 with retry-after: 10 after ten. context() in src/server.ts builds ctx.ip from the first entry of a client-supplied header, so the bucket the README and the new test both rely on is keyed on something the guesser chooses. 32^12 of code space means blind guessing is impractical regardless, so this is defence in depth rather than an open till — but this pull is the one that puts a discoverable, footer-linked oracle on a bearer instrument, so it is the pull that should make the limit real: prefer self.requestIP() and only consult x-forwarded-for when the forge's proxy is known to be in front, taking the last hop rather than the first. src/server.ts is untouched here, which is why this is second and not first.
3. Low — the ledger shows the shop's own words to the card holder. entriesOf reasons are printed verbatim, so the reason an admin types when voiding a card (v prompts "Void it — reason:") lands on a page anyone holding the code can read. It is escaped, so this is disclosure and not injection, but "voided" would serve the holder just as well as whatever the admin typed to themselves.
4. Nit — the confirmation page does not say where the code is. /orders/:number shows the paid gift card line with no hint that the only copy of the code is one click away on the receipt; a buyer who closes that tab has nothing. One sentence on the confirmation next to the gift card line would save the support mail.
The balance window is a good idea, the shape is right (a page module, a handler, the existing bucket, no new dependency), and the direction is served: a stranger can still buy the one thing and the money trail still reconciles. Rebase, gate the terminal, and I will look again.
    
  const lowered = text.toLowerCase();
  if (lowered === "free" || lowered === "freeship" || lowered === "shipping")
    return { kind: "free_shipping", value: 0 };
  if (text.endsWith("%")) {
    const points = parseCents(text.slice(0, -1));
    return points === undefined || points > 10000 ? undefined : { kind: "percent", value: points };
  }
  const cents = parseCents(text);
  return cents === undefined || cents === 0 ? undefined : { kind: "fixed", value: cents };
}
export const NEW_DISCOUNT_SHAPE = "CODE 20% [min 25] [uses 100] [until 2026-12-31]";
/** "SPRING20 20% min 25 uses 100 until 2026-12-31" — one code, however limited. */
export function newDiscount(line: string): Done {
  const parts = words(line);
  const code = discounts.normalizeCode(parts[0] ?? "");
  if (code.length < 3) return no("A code is at least three letters, like SPRING20.");
  const worth = readValue(parts[1] ?? "");
  if (!worth) return no(`A discount is 20%, 5.00 or free. Say: ${NEW_DISCOUNT_SHAPE}`);
  let min = 0;
  let uses: number | null = null;
  let expires: string | null = null;
  for (let i = 2; i < parts.length; i += 2) {
    const word = parts[i]!.toLowerCase();
    const argument = parts[i + 1] ?? "";
    if (word === "min") {
      const cents = parseCents(argument);
      if (cents === undefined) return no("A minimum is an amount of money, like 25 or 25.00.");
      min = cents;
    } else if (word === "uses" || word === "max") {
      if (!/^\d{1,6}$/.test(argument)) return no("A limit is a whole number of uses, like 100.");
      uses = Number(argument);
    } else if (word === "until" || word === "expires") {
      const day = discounts.endOfDay(argument);
      if (day === undefined) return no("An expiry is a date like 2026-12-31.");
      expires = day;
    } else return no(`I do not know "${word}". Say: ${NEW_DISCOUNT_SHAPE}`);
  }
  if (discounts.byCode(code)) return no(`${code} already exists.`);
  try {
    const id = discounts.create({
      code,
      kind: worth.kind,
      value: worth.value,
      min_subtotal_cents: min,
      max_redemptions: uses,
      starts_at: null,
      expires_at: expires,
    });
    const made = discounts.byId(id)!;
    return yes(
      `${made.code} — ${discounts.describe(made)}${min > 0 ? `, over ${formatCents(min)}` : ""}${
        uses === null ? "" : `, ${uses} use${uses === 1 ? "" : "s"}`
      }${expires === null ? "" : `, until ${expires.slice(0, 10)}`}.`,
    );
  } catch {
    return no(`${code} could not be created.`);
  }
}
export function toggleDiscount(id: number): Done {
  const found = discounts.byId(id);
  if (!found) return no("No code selected.");
  discounts.setActive(found.id, found.active !== 1);
  return yes(`${found.code} is now ${found.active === 1 ? "off" : "on"}.`);
}
/** "25 a sorry-for-the-wait card": an amount, then the reason it exists. */
export function issueCard(line: string): Done {
  const parts = words(line);
  const cents = parseCents(parts[0] ?? "");
  if (cents === undefined || cents <= 0) return no("A card is worth an amount of money, like 25 or 25.00.");
  const issued = giftcards.issue({ cents, note: parts.slice(1).join(" ").slice(0, 120) || "issued at the terminal" });
  return yes(`${issued.code} — ${formatCents(cents)}. This is the only copy of the code.`);
}
export function toggleCard(id: number, reason: string): Done {
  const card = giftcards.byId(id);
  if (!card) return no("No card selected.");
  const reviving = card.active !== 1;
  giftcards.setActive(card.id, reviving, reason.trim() || "voided at the terminal");
  return yes(
    reviving
      ? `····${card.last4} can be used again; it holds ${formatCents(giftcards.byId(card.id)!.balance_cents)}.`
      : `····${card.last4} is void and its ${formatCents(card.balance_cents)} written off.`,
  );
}
/**
 * One box for both kinds of code, the same as the cart's: whoever is asking
 * does not know which of the two they were handed.
 */
export function look(typed: string): Done {
  const asDiscount = discounts.byCode(typed);
  if (asDiscount)
    return yes(
      `${asDiscount.code} — ${discounts.describe(asDiscount)}${
        asDiscount.min_subtotal_cents > 0 ? ` over ${formatCents(asDiscount.min_subtotal_cents)}` : ""
      }, used ${asDiscount.used_count}${asDiscount.max_redemptions === null ? "" : ` of ${asDiscount.max_redemptions}`}${
        asDiscount.expires_at ? `, until ${asDiscount.expires_at.slice(0, 10)}` : ""
      }${asDiscount.active === 1 ? "" : " (off)"}.`,
    );
  const card = giftcards.byCode(typed);
  if (card)
    return yes(
      `····${card.last4} holds ${formatCents(card.balance_cents)} of ${formatCents(card.initial_cents)}${
        card.active === 1 ? "" : " (void)"
      }${card.note ? ` — ${card.note}` : ""}.`,
    );
  return no("That is not a code this shop knows.");
}
export const RATE_SHAPE = "COUNTRY / REGION / 8.75 / what to call it";
/** "UNITED STATES / CA / 8.75 / California sales tax"; an empty region is the country's own. */
export function setRate(line: string): Done {
  const parts = line.split("/").map((part) => part.trim());
  if (parts.length < 3) return no(`A rate is: ${RATE_SHAPE}`);
  const country = tax.normalize(parts[0] ?? "");
  const region = tax.normalize(parts[1] ?? "");
  const points = parseCents(parts[2] ?? "");
  if (country === "") return no("A rate needs a country.");
  if (points === undefined || points > 10000) return no("A rate is a percentage between 0 and 100, like 8.75.");
  const label = (parts[3] ?? "").slice(0, 60).trim() || `${country}${region ? ` ${region}` : ""} tax`;
  tax.upsertRate({ country, region, rate_bp: points, label, active: true });
  return yes(`${country}${region ? ` ${region}` : ""} — ${(points / 100).toFixed(2)}% (${label}).`);
}
export function setDefaultRate(text: string): Done {
  const points = parseCents(text.trim());
  if (points === undefined || points > 10000) return no("A rate is a percentage between 0 and 100, like 8.5.");
  tax.setDefaultRateBp(points);
  return yes(`Anywhere the table does not name is taxed at ${(points / 100).toFixed(2)}%.`);
}
export function removeRate(id: number, confirmation: string): Done {
  const rate = tax.rateById(id);
  if (!rate) return no("No rate selected.");
  if (!/^y(es)?$/i.test(confirmation.trim())) return no(`${rate.country} ${rate.region} kept.`);
  tax.removeRate(rate.id);
  return yes(`${rate.country}${rate.region ? ` ${rate.region}` : ""} removed; it now falls to the default.`);
}
@@ -49,6 +49,24 @@
export const describe = (discount: Discount): string =>
      ? `${formatCents(discount.value)} off`
      : "free shipping";
/** The shape dates are stored in: "2026-12-31 23:59:59", comparable as text. */
export const stampOf = (now: Date): string => now.toISOString().slice(0, 19).replace("T", " ");
/**
 * The last second of a day, or undefined when that is not a day.
 *
 * Stamps are compared as text, so a date nobody can reach — 2026-99-99, or
 * the 30th of February — sorts after every real one and makes a code that
 * never expires. The shape is not enough: the day is parsed and round-tripped,
 * and only a date that comes back as itself is stored.
 */
export function endOfDay(day: string): string | undefined {
  if (!/^\d{4}-\d{2}-\d{2}$/.test(day)) return undefined;
  const parsed = new Date(`${day}T00:00:00Z`);
  if (Number.isNaN(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== day) return undefined;
  return `${day} 23:59:59`;
}
/**
 * Is this code usable right now, against this much in goods? The answer is
 * advice: `redeem` decides, inside the order's transaction.
@@ -57,7 +75,7 @@
export function evaluate(code: string, base_cents: number, now = new Date()): Ch
  const discount = byCode(code);
  if (!discount) return { ok: false, error: "That code is not one this shop knows." };
  if (discount.active !== 1) return { ok: false, error: `${discount.code} is no longer being accepted.` };
  const stamp = now.toISOString().slice(0, 19).replace("T", " ");
  const stamp = stampOf(now);
  if (discount.starts_at && stamp < discount.starts_at)
    return { ok: false, error: `${discount.code} cannot be used yet.` };
  if (discount.expires_at && stamp > discount.expires_at)
@@ -82,14 +100,20 @@
export function evaluate(code: string, base_cents: number, now = new Date()): Ch
/**
 * Take one use of the code for an order. False when there was none left to
 * take — the caller is inside a transaction and turns that into a refusal.
 *
 * Every limit the code carries is in this one statement: whether it is on,
 * whether now is inside its window, and whether a use is left. `evaluate`
 * said the same thing a moment earlier, but only this decides, so a code that
 * expired or was switched off in between is not taken anyway.
 */
export function redeem(discountId: number, orderId: number, amount_cents: number): boolean {
export function redeem(discountId: number, orderId: number, amount_cents: number, now = new Date()): boolean {
  const changes = db
    .query(
      `UPDATE discount SET used_count = used_count + 1
       WHERE id = ?1 AND active = 1 AND (max_redemptions IS NULL OR used_count < max_redemptions)`,
       WHERE id = ?1 AND active = 1 AND (max_redemptions IS NULL OR used_count < max_redemptions)
         AND (starts_at IS NULL OR starts_at <= ?2) AND (expires_at IS NULL OR expires_at >= ?2)`,
    )
    .run(discountId).changes;
    .run(discountId, stampOf(now)).changes;
  if (changes !== 1) return false;
  db.query(
    "INSERT INTO discount_redemption (discount_id, order_id, kind, amount_cents) VALUES (?1, ?2, 'redeemed', ?3)",
@@ -67,6 +67,37 @@
export const entriesOf = (giftCardId: number, limit = 50): Entry[] =>
    )
    .all(giftCardId, limit);
export type PublicEntry = { at: string; delta: number; what: string };
/**
 * The card's movements as the person holding the code is told them.
 *
 * The `reason` column is where the shop talks to itself: an admin types one
 * when they void a card, and that note was written to a colleague, not to a
 * customer. The row's own facts say everything the holder needs — which way
 * the money went, and whether an order was involved — so the words here are
 * the shop's, fixed, and the same for every card.
 */
export function publicEntriesOf(giftCardId: number, limit = 50): PublicEntry[] {
  const first = db
    .query<{ id: number | null }, [number]>("SELECT MIN(id) AS id FROM gift_card_entry WHERE gift_card_id = ?1")
    .get(giftCardId);
  return entriesOf(giftCardId, limit).map((entry) => ({
    at: entry.at,
    delta: entry.delta,
    what:
      entry.id === first?.id
        ? "Issued"
        : entry.delta > 0
          ? entry.order_id === null
            ? "Put on the card"
            : "Put back from an order"
          : entry.order_id === null
            ? "Taken off the card"
            : "Spent on an order",
  }));
}
export const entriesForOrder = (orderId: number): (Entry & { last4: string })[] =>
  db
    .query<Entry & { last4: string }, [number]>(
@@ -90,8 +90,8 @@
export function layout(chrome: Chrome): string {
<footer class="bottom"><div class="wrap">
  <p><span class="env" style="background: ${env === "production" ? "#16653d" : "#1d4ed8"}">${escape(where)}</span>
  ${commit ? `<span class="muted"> @ ${escape(commit)}</span>` : ""}
  — a demonstration store: no goods ship and no money moves.
  <a href="/orders">Find an order</a></p>
  — a demonstration store: no goods ship and no money moves.</p>
  <p><a href="/orders">Find an order</a> · <a href="/gift-cards">Gift cards</a> — buy one, or see what is left on the one you hold.</p>
  <p>${
    ssh
      ? `Same shop in a terminal: <code>${escape(ssh)}</code>`
@@ -49,7 +49,8 @@
export function receiptText(order: Order, items: OrderItem[], giftCardCodes: str
          "",
          "Your gift card" + (giftCardCodes.length === 1 ? "" : "s") + " — this is the only copy of the code:",
          ...giftCardCodes.map((code) => `  ${code}`),
          "  Type it at the cart to spend it. It never expires.",
          "  Type it at the cart to spend it, or at /gift-cards to see what is",
          "  left on it. It never expires.",
        ]
      : []),
    "",
@@ -198,7 +198,7 @@
export function place(input: {
      if (priced.discount_code !== "") {
        const discount = discounts.byCode(priced.discount_code)!;
        if (!discounts.redeem(discount.id, created.id, priced.discount_cents))
          throw new Error(`CODE_GONE:${priced.discount_code} was used up while you were checking out.`);
          throw new Error(`CODE_GONE:${priced.discount_code} stopped applying while you were checking out.`);
        note(created.id, "discount", `${discount.code} — ${discounts.describe(discount)}`);
      }
      if (priced.gift_card_cents > 0) {
@@ -59,6 +59,9 @@
export function codeBox(quote: Quote, session: Session, back: "cart" | "checkout
    ${quote.discount_code !== "" ? remove("discount", quote.discount_code) : ""}
    ${quote.gift_card_last4 !== "" ? remove("gift", `····${quote.gift_card_last4}`) : ""}
  </div>
  <p class="muted" style="margin:.5rem 0 0; font-size:.88rem">
    Holding a gift card? <a href="/gift-cards">See what is left on it</a>.
  </p>
</div>`;
}
@@ -203,6 +203,9 @@
export function confirmation(
  who: Who,
): string {
  const paid = order.status === "paid" || order.status === "refunded" || order.status === "partially_refunded";
  // A card's code is printed once, on the receipt. Say so here: a buyer who
  // closes this tab without opening it has bought something they cannot spend.
  const cards = items.reduce((count, item) => count + (item.gift_card_cents > 0 ? item.quantity : 0), 0);
  return `
<h1>${paid ? "Thank you" : "Order " + escape(order.number)}</h1>
<p class="lede">Order ${escape(order.number)} · ${statusPill(order.status)} · placed ${escape(order.created_at)} UTC</p>
@@ -219,6 +222,15 @@
${
       — this store has no mail server, so receipts are kept here instead of sent.</p>`
    : ""
}
${
  paid && cards > 0
    ? `<p class="notice">${cards === 1 ? "The gift card's code is" : `The ${cards} gift card codes are`} on the receipt,
       and that is the only copy. <a href="/orders/${escape(order.number)}/receipt?token=${escape(
         order.access_token,
       )}">Open the receipt</a> and keep ${cards === 1 ? "it" : "them"} somewhere safe — whoever has the code can spend it,
       and <a href="/gift-cards">/gift-cards</a> says what is left on one.</p>`
    : ""
}
${itemsTable(items)}
${orderTotals(order, refunded)}
<h2>Shipping to</h2>
@@ -0,0 +1,72 @@
/**
 * The gift card window: what is left on a card, and every movement of it.
 *
 * The code is asked for with a POST and never put in a URL — a bearer code
 * does not belong in a browser's history or in an access log — and the page
 * shows the card by its last four characters, never the code that was typed.
 * The ledger is the shop's own words for each movement, not the note an admin
 * typed to themselves: `giftcards.publicEntriesOf` decides them.
 */
import { csrfField, escape } from "../html.ts";
import { formatCents } from "../money.ts";
import type { PublicEntry } from "../giftcards.ts";
import type { GiftCard } from "../db.ts";
import type { Session } from "../session.ts";
/** `shown` is set when the ledger was cut off at that many rows. */
export type Found = { card: GiftCard; entries: PublicEntry[]; shown?: number };
const ledger = (entries: PublicEntry[]): string =>
  entries.length === 0
    ? ""
    : `<table>
  <thead><tr><th>When</th><th>What happened</th><th class="num">Amount</th></tr></thead>
  <tbody>${entries
    .map(
      (entry) => `<tr>
    <td class="muted">${escape(entry.at)}</td>
    <td>${escape(entry.what)}</td>
    <td class="num price">${entry.delta > 0 ? "+" : ""}${escape(formatCents(entry.delta))}</td>
  </tr>`,
    )
    .join("\n")}</tbody>
</table>`;
export function page(session: Session, found?: Found, error?: string): string {
  return `
<h1>Gift cards</h1>
<p class="lede">A gift card is money already paid for. Type its code to see what is left on it, or apply it in your cart to spend it. <a href="/p/gift-card">Buy one</a> and its code arrives on the receipt.</p>
${error ? `<p class="notice bad">${escape(error)}</p>` : ""}
<form method="post" action="/gift-cards" class="row-actions" style="margin:1rem 0">
  ${csrfField(session)}
  <input name="code" maxlength="40" placeholder="GC-XXXX-XXXX-XXXX" aria-label="Gift card code"
    style="max-width:16rem" autocapitalize="characters" autocomplete="off" spellcheck="false">
  <button class="btn">Check the balance</button>
</form>
${
  found
    ? `<div class="totals">
  <div class="row"><span>Card <span class="muted">····${escape(found.card.last4)}</span></span><span class="price">${escape(
    formatCents(found.card.initial_cents),
  )} issued</span></div>
  <div class="row grand"><span>${found.card.active === 1 ? "On the card now" : "Void — nothing can be spent"}</span><span class="price">${escape(
    formatCents(found.card.balance_cents),
  )}</span></div>
</div>
${ledger(found.entries)}
${
  found.shown
    ? `<p class="muted">The last ${found.shown} movements. Older ones are not shown, so these rows may not add up to the balance above.</p>`
    : ""
}
${
  found.card.active === 1 && found.card.balance_cents > 0
    ? `<p><a class="btn" href="/cart">Spend it in your cart</a></p>`
    : ""
}`
    : ""
}
<p class="muted">Cards do not expire. Keep the code: it is the only copy, and whoever has it can spend it.</p>
`;
}
@@ -6,15 +6,22 @@
 * socket actually arrived on, which is the one thing here that is not the
 * caller's to write.
 *
 * `X-Forwarded-For` is not read. It would be the useful thing — it names the
 * shopper behind a proxy — but only if a proxy we trust appends to it, and
 * nothing this app can see from the inside proves that one does. Anything a
 * client sends arrives in that header too, and a hint nobody vouches for is
 * the caller's own word: a limit keyed on the caller's own word is not a
 * limit, which is what the leftmost entry made of every bucket here before.
 * So it is dropped, and a bucket behind the forge's proxy is the whole shop's
 * — see the README. If the forge ever says it appends a hop of its own, the
 * rightmost entry becomes worth reading and this is the one file that changes.
 * `X-Forwarded-For` is not read on the strength of its own existence. It would
 * be the useful thing — it names the shopper behind a proxy — but only if a
 * proxy we trust appends to it, and a hint nobody vouches for is the caller's
 * own word: a limit keyed on the caller's own word is not a limit, which is
 * what the leftmost entry made of every bucket here before. So the default is
 * that it is dropped, and a bucket behind the forge's proxy is the whole
 * shop's — see the README.
 *
 * The one thing that can vouch for it is the deployment, and only by counting:
 * FORGE_APP_TRUSTED_HOPS says how many proxies of ours stand in front of the
 * socket. A proxy appends the peer it saw to the right-hand end of the chain,
 * so with one trusted hop the shopper is the right-hand entry, with two it is
 * the one before that, and everything further left is a stranger's typing and
 * never read. Unset — which is how the forge runs today — nothing in the
 * header is read at all. Nothing is inferred from the shape of an address:
 * a guess about who is proxying is not a fact about it.
 *
 * Nothing leaves here unchecked. The address keys a bucket and it is also
 * written into `order_event` detail, where an auditor reads it, so it has to
@@ -22,13 +29,20 @@
 */
export type Peer = {
  /** The socket's address. The caller cannot choose this one. */
  /** The socket's address, or the shopper a declared proxy vouched for. */
  address: string;
};
/** The longest an address can be: an IPv6 one with an IPv4 tail inside it. */
export const MAX = 45;
/** How many proxies of ours stand in front of the socket, if we were told. */
export function trustedHops(value: string | null | undefined): number | undefined {
  if (value === undefined || value === null || value.trim() === "") return undefined;
  const hops = Number(value.trim());
  return Number.isInteger(hops) && hops >= 0 && hops <= 8 ? hops : undefined;
}
/**
 * The value as an address, or null. Four octets of at most 255, or hex digits
 * and colons; everything else — a hostname, a comma, a space, a word an
@@ -43,5 +57,22 @@
export function address(value: string | null | undefined): string | null {
  return null;
}
/** `socket` is the address the request actually arrived on, or nothing yet. */
export const peerOf = (socket: string | null | undefined): Peer => ({ address: address(socket) ?? "local" });
/**
 * `socket` is the address the request actually arrived on, or nothing yet.
 * `proxied.hops` is the number the deployment declared: without it the header
 * is not read, and with it a chain shorter than promised is not the chain we
 * were promised, so the socket is what is left that cannot be forged.
 */
export function peerOf(
  socket: string | null | undefined,
  proxied: { forwardedFor?: string | null; hops?: number } = {},
): Peer {
  const peer = address(socket) ?? "local";
  const hops = proxied.hops;
  if (hops === undefined || hops === 0) return { address: peer };
  const chain = (proxied.forwardedFor ?? "")
    .split(",")
    .map((hop) => address(hop))
    .filter((hop): hop is string => hop !== null);
  return { address: chain.length >= hops ? chain[chain.length - hops]! : peer };
}
@@ -0,0 +1,129 @@
/**
 * The app behind a proxy it was told about.
 *
 * `src/peer.ts` decides on its own whether `x-forwarded-for` counts, and the
 * unit tests hold it to that. This file is the wiring: the app is booted in its
 * own process with FORGE_APP_TRUSTED_HOPS set, because the number is read once
 * at start, and then asked the only question that matters — does a bucket
 * follow the shopper the proxy named, and only that one.
 */
import { afterAll, beforeAll, expect, test } from "bun:test";
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
const dataDir = mkdtempSync(join(tmpdir(), "bazaar-proxy-"));
const limits = await import("./ratelimit.ts");
type App = { base: string; stop: () => Promise<void> };
/** Boot `bun run src/server.ts` and wait for the line that says it is up. */
async function boot(env: Record<string, string>): Promise<App> {
  const proc = Bun.spawn(["bun", "run", "src/server.ts"], {
    cwd: join(import.meta.dir, ".."),
    env: { ...process.env, PORT: "0", FORGE_APP_DATA: dataDir, ...env },
    stdout: "pipe",
    stderr: "inherit",
  });
  const reader = proc.stdout.getReader();
  const decoder = new TextDecoder();
  const listening = /listening on (http:\/\/\S+)/;
  const deadline = Date.now() + 15_000;
  let log = "";
  while (!listening.test(log)) {
    if (Date.now() > deadline) throw new Error(`the app did not start in time:\n${log}`);
    const { value, done } = await reader.read();
    if (done) throw new Error(`the app exited before it listened:\n${log}`);
    log += decoder.decode(value);
  }
  void (async () => {
    try {
      while (!(await reader.read()).done);
    } catch {}
  })();
  return {
    base: listening.exec(log)![1]!,
    stop: async () => {
      proc.kill();
      await proc.exited;
    },
  };
}
let app: App;
beforeAll(async () => {
  app = await boot({ FORGE_APP_TRUSTED_HOPS: "1" });
});
afterAll(async () => {
  await app?.stop();
});
/** A browser with a cookie jar and a chain it claims to have come through. */
class Visitor {
  jar = new Map<string, string>();
  constructor(private chain: string) {}
  private remember(response: Response): void {
    for (const line of response.headers.getSetCookie()) {
      const [pair] = line.split(";");
      const eq = pair!.indexOf("=");
      this.jar.set(pair!.slice(0, eq), pair!.slice(eq + 1));
    }
  }
  private headers(): Record<string, string> {
    return {
      cookie: [...this.jar].map(([name, value]) => `${name}=${value}`).join("; "),
      "sec-fetch-site": "same-origin",
      "x-forwarded-for": this.chain,
    };
  }
  async token(): Promise<string> {
    const response = await fetch(app.base + "/orders", { headers: this.headers(), redirect: "manual" });
    this.remember(response);
    return /name="csrf" value="([^"]+)"/.exec(await response.text())?.[1] ?? "";
  }
  /** One guess at somebody's order, which is what the LOOKUP bucket counts. */
  async guess(csrf: string): Promise<Response> {
    const body = new URLSearchParams({ number: "BZ-ZZZZZZZZ", email: "[email protected]", csrf });
    const response = await fetch(app.base + "/orders/find", {
      method: "POST",
      body,
      headers: { ...this.headers(), "content-type": "application/x-www-form-urlencoded" },
      redirect: "manual",
    });
    this.remember(response);
    return response;
  }
}
/** Spend a visitor's bucket, and say what the last answer was. */
async function spend(visitor: Visitor): Promise<Response> {
  const csrf = await visitor.token();
  let last = new Response();
  for (let attempt = 0; attempt < limits.LOOKUP.capacity + 2; attempt++) last = await visitor.guess(csrf);
  return last;
}
test("with one hop declared, the shopper the proxy named gets the bucket", async () => {
  // The proxy appends what it saw on the right, so the right-hand entry is the
  // shopper and everything left of it is the shopper's own typing.
  const guesser = new Visitor("10.9.9.9, 203.0.113.7");
  expect((await spend(guesser)).status).toBe(429);
  // Left-hand entries are the caller's to invent, and inventing them buys
  // nothing: the same right-hand entry is the same bucket.
  const sameShopper = new Visitor("198.51.100.44, 203.0.113.7");
  expect((await sameShopper.guess(await sameShopper.token())).status).toBe(429);
  // Another shopper behind the same proxy is another bucket, so one guesser
  // does not close the lookup form for the shop.
  const neighbour = new Visitor("10.9.9.9, 203.0.113.8");
  expect((await neighbour.guess(await neighbour.token())).status).toBe(200);
});
@@ -1,12 +1,13 @@
/**
 * Rate limits. A token bucket per key, in memory: this is one process, and a
 * limit that resets when the app restarts is still a limit. Checkout, payment,
 * typing a code and finding an order each get their own bucket so a busy shop
 * cannot lock anyone out of the others.
 * typing a code, reading a balance and finding an order each get their own
 * bucket so a busy shop cannot lock anyone out of the others.
 *
 * A bucket is keyed on the peer's address and nothing else (see src/peer.ts):
 * on a header the caller writes it would be no limit at all. Behind the
 * forge's proxy that address is the proxy's, so these are the shop's limits
 * forge's proxy that address is the proxy's unless the deployment declared how
 * many of its own hops stand in front, so assume these are the shop's limits
 * rather than each shopper's, and the capacities are set for a shop: enough
 * that ordinary trade never meets them, low enough that guessing at a code or
 * an order number runs out of tries long before it runs out of guesses.
@@ -19,11 +20,19 @@
const buckets = new Map<string, Bucket>();
export type Limit = { name: string; capacity: number; perSeconds: number };
/**
 * An address is not always one person: an office, a school, or the forge's own
 * proxy all arrive as one, so a capacity here is a whole shop's minute rather
 * than one shopper's. That is why these are in the dozens and not the units.
 */
export const CHECKOUT: Limit = { name: "checkout", capacity: 30, perSeconds: 60 };
export const PAYMENT: Limit = { name: "payment", capacity: 60, perSeconds: 60 };
// Codes are guessable in principle, so trying them is the slowest thing here.
export const CODES: Limit = { name: "codes", capacity: 30, perSeconds: 120 };
// So is an order number with an email beside it: a few tries, then wait.
// Looking at a balance is its own bucket: someone reading their card over and
// over must still be able to spend it at the till.
export const BALANCE: Limit = { name: "balance", capacity: 30, perSeconds: 120 };
// An order number with an email beside it is guessable too: a few tries, then wait.
export const LOOKUP: Limit = { name: "lookup", capacity: 30, perSeconds: 300 };
/** True when the caller may proceed; false when the bucket is empty. */
@@ -29,6 +29,9 @@
export const routes: Route[] = [
  { method: "POST", pattern: "/cart/add", handler: shop.addToCart },
  { method: "POST", pattern: "/cart/update", handler: shop.updateCart },
  { method: "GET", pattern: "/gift-cards", handler: (ctx) => shop.giftCardPage(ctx) },
  { method: "POST", pattern: "/gift-cards", handler: shop.giftCardCheck },
  { method: "GET", pattern: "/checkout", handler: (ctx) => shop.checkoutForm(ctx) },
  { method: "POST", pattern: "/checkout", handler: shop.placeOrder },
@@ -13,6 +13,7 @@
const { server } = await import("./server.ts");
const { db } = await import("./db.ts");
const limit = await import("./ratelimit.ts");
const giftcards = await import("./giftcards.ts");
const discounts = await import("./discounts.ts");
const base = `http://${server.hostname}:${server.port}`;
type Person = { id: string; name: string; role: "user" | "admin"; expiresMs?: number };
@@ -389,6 +390,12 @@
test("a discount, a part-spent gift card and a state's rate become an order that
      .get(order.id)!.amount_cents,
  ).toBe(570);
  // The confirmation says where the only copy of the new card's code is.
  const confirmation = await shopper.page(`/orders/${number}?token=${encodeURIComponent(token)}`);
  expect(confirmation).toContain("The gift card's code is");
  expect(confirmation).toContain(`/orders/${number}/receipt`);
  expect(confirmation).not.toContain("GC-"); // the code itself is on the receipt, not here
  const receipt = await shopper.page(`/orders/${number}/receipt?token=${encodeURIComponent(token)}`);
  expect(receipt).toContain("Discount (WELCOME10)");
  expect(receipt).toContain("California sales tax (8.75%)");
@@ -569,6 +576,60 @@
test("checkout is rate limited", async () => {
  limit.forget();
});
test("the admin form refuses an expiry that is not a date, on the page as at the desk", async () => {
  const admin = asAdmin();
  const page = await admin.page("/admin/discounts");
  const token = Shopper.tokenIn(page);
  const sent = await admin.post(
    "/admin/discounts",
    { code: "NEVEREXP", kind: "percent", value: "10", expires: "2026-99-99" },
    token,
  );
  expect(sent.headers.get("location")).toContain("m=bad-date");
  expect(discounts.byCode("NEVEREXP")).toBeNull();
  const good = await admin.post(
    "/admin/discounts",
    { code: "REALDATE", kind: "percent", value: "10", expires: "2026-12-31" },
    token,
  );
  expect(good.headers.get("location")).toContain("m=created");
  expect(discounts.byCode("REALDATE")!.expires_at).toBe("2026-12-31 23:59:59");
});
test("the checkout bucket is the whole shop's, and it refills", async () => {
  limit.forget();
  const first = new Shopper();
  const product = await first.page("/p/paper-filters");
  await first.post("/cart/add", { variant: String(variantId("BRW-FILT-100")), quantity: "1" }, Shopper.tokenIn(product));
  const token = Shopper.tokenIn(await first.page("/checkout"));
  let last = new Response();
  for (let attempt = 0; attempt < limit.CHECKOUT.capacity + 2; attempt++)
    last = await first.post("/checkout", { idempotency: "stale", email: "x" }, token);
  expect(last.status).toBe(429);
  expect(Number(last.headers.get("retry-after"))).toBeGreaterThan(0);
  // Everyone behind one address arrives on the same socket, and a bucket is
  // keyed on that and nothing else, so an emptied till is emptied for the next
  // shopper too. That is the trade the capacity is set for: thirty checkouts a
  // minute is a shop's minute, which ordinary trade never spends.
  const second = new Shopper();
  const theirs = await second.page("/p/paper-filters");
  await second.post("/cart/add", { variant: String(variantId("BRW-FILT-100")), quantity: "1" }, Shopper.tokenIn(theirs));
  const checkout = await second.page("/checkout");
  expect((await second.post("/checkout", { idempotency: "stale", email: "x" }, Shopper.tokenIn(checkout))).status).toBe(
    429,
  );
  // A limit that never lets go is an outage; once the bucket refills the till
  // takes the same browser's order again.
  limit.forget();
  const tried = await second.post("/checkout", { idempotency: "stale", email: "x" }, Shopper.tokenIn(checkout));
  expect(tried.status).toBe(200);
  expect(await tried.text()).toContain("went stale");
  limit.forget();
});
test("an unsigned webhook is refused", async () => {
  const response = await fetch(base + "/webhooks/stripe", {
    method: "POST",
@@ -755,6 +816,122 @@
test("an admin adds a product and a variant, and the shop sells it", async () =>
  expect(stockOf("KIT-SPOON-1")).toBe(5);
});
test("whoever holds a gift card's code can see what is left on it, and nobody else learns anything", async () => {
  limit.forget();
  const { card, code } = giftcards.issue({ cents: 2500, note: "a present" });
  expect(giftcards.spend(card.id, 1000, "spent on something else")).toBe(true);
  const holder = new Shopper();
  const form = await holder.page("/gift-cards");
  expect(form).toContain("Gift cards");
  expect(form).not.toContain(code); // nothing is known until the code is typed
  expect(await holder.page("/")).toContain('href="/gift-cards"'); // reachable without a cart
  const checked = await holder.post("/gift-cards", { code: code.toLowerCase() }, Shopper.tokenIn(form));
  expect(checked.status).toBe(200);
  const page = await checked.text();
  expect(page).toContain(`····${card.last4}`);
  expect(page).toContain("$15.00"); // what is left
  expect(page).toContain("$25.00 issued");
  expect(page).toContain("-$10.00");
  // The movements are the shop's own words, not the note it wrote to itself.
  expect(page).toContain("Issued");
  expect(page).toContain("Taken off the card");
  expect(page).not.toContain("spent on something else");
  expect(page).not.toContain(code); // the code itself is never echoed back
  // The code was posted, so it is not in a URL anyone logs.
  expect(checked.headers.get("location")).toBeNull();
  // A code the shop does not know is refused in the cart's own words.
  const stranger = await holder.post("/gift-cards", { code: "GC-ZZZZ-ZZZZ-ZZZZ" }, Shopper.tokenIn(form));
  const refusal = await stranger.text();
  expect(refusal).toContain("not one this shop knows");
  expect(refusal).not.toContain("issued");
  // Guessing codes is the slowest thing in the shop.
  let last = new Response();
  for (let attempt = 0; attempt < limit.BALANCE.capacity + 2; attempt++)
    last = await holder.post("/gift-cards", { code: `GC-AAAA-BBBB-${attempt}` }, Shopper.tokenIn(form));
  expect(last.status).toBe(429);
  expect(Number(last.headers.get("retry-after"))).toBeGreaterThan(0);
  limit.forget();
});
test("a guesser cannot buy a fresh rate limit with a header they typed themselves", async () => {
  limit.forget();
  const holder = new Shopper();
  const form = await holder.page("/gift-cards");
  const token = Shopper.tokenIn(form);
  // Every one of these claims to come from somewhere else. The bucket counts
  // the socket, which is the same socket every time, so the limit still bites.
  let last = new Response();
  for (let attempt = 0; attempt < limit.BALANCE.capacity + 4; attempt++)
    last = await holder.post(
      "/gift-cards",
      { code: `GC-AAAA-CCCC-${attempt}` },
      token,
      { "x-forwarded-for": `198.51.100.${attempt}, 203.0.113.${attempt}` },
    );
  expect(last.status).toBe(429);
  expect(Number(last.headers.get("retry-after"))).toBeGreaterThan(0);
  limit.forget();
});
test("reading a balance does not use up the tokens for spending a code", async () => {
  limit.forget();
  const holder = new Shopper();
  const form = await holder.page("/gift-cards");
  const token = Shopper.tokenIn(form);
  // Empty the balance window's own bucket.
  let last = new Response();
  for (let attempt = 0; attempt < limit.BALANCE.capacity + 1; attempt++)
    last = await holder.post("/gift-cards", { code: `GC-AAAA-DDDD-${attempt}` }, token);
  expect(last.status).toBe(429);
  // The till is a different bucket, so the same visitor can still check out.
  await addToCart(holder, "COF-GUJI-250", 1);
  const applied = await applyCode(holder, "welcome10");
  expect(applied.status).toBe(303);
  expect(applied.headers.get("location")).toContain("m=applied");
  limit.forget();
});
test("a long ledger says it was cut off, and a void card offers nothing to spend", async () => {
  limit.forget();
  const { card, code } = giftcards.issue({ cents: 100, note: "much used" });
  for (let n = 0; n < 22; n++) expect(giftcards.credit(card.id, 100, `top-up ${n}`)).toBe(true);
  const holder = new Shopper();
  const form = await holder.page("/gift-cards");
  const checked = await holder.post("/gift-cards", { code }, Shopper.tokenIn(form));
  const page = await checked.text();
  expect(page).toContain("The last 20 movements");
  expect(page).toContain("Spend it in your cart"); // live card, money on it
  // Voided: the balance is written away, so there is nothing to spend.
  giftcards.setActive(card.id, false, "lost in the post");
  const voided = await holder.post("/gift-cards", { code }, Shopper.tokenIn(form)).then((r) => r.text());
  expect(voided).toContain("Void — nothing can be spent");
  expect(voided).not.toContain("Spend it in your cart");
  // A live card with nothing left is the same: no link, and no cut-off note.
  const empty = giftcards.issue({ cents: 500, note: "spent out" });
  expect(giftcards.spend(empty.card.id, 500, "spent at another till")).toBe(true);
  const flat = await holder.post("/gift-cards", { code: empty.code }, Shopper.tokenIn(form)).then((r) => r.text());
  expect(flat).not.toContain("Spend it in your cart");
  expect(flat).not.toContain("The last 20 movements");
  // Exactly as many movements as the window holds is not a cut-off: issuing
  // wrote the first row, so nineteen more make twenty and nothing is hidden.
  const exact = giftcards.issue({ cents: 100, note: "twenty on the nose" });
  for (let n = 0; n < 19; n++) expect(giftcards.credit(exact.card.id, 100, `top-up ${n}`)).toBe(true);
  const full = await holder.post("/gift-cards", { code: exact.code }, Shopper.tokenIn(form)).then((r) => r.text());
  expect(full).toContain("$20.00"); // twenty rows of a dollar, all of them shown
  expect(full).not.toContain("The last 20 movements");
  limit.forget();
});
test("an order is found again with its number and the email it was placed with", async () => {
  limit.forget();
  const shopper = new Shopper();
@@ -25,7 +25,7 @@
import {
import { loadSecret } from "./sign.ts";
import { match } from "./routes.ts";
import { notFound } from "./shop.ts";
import { peerOf } from "./peer.ts";
import { peerOf, trustedHops } from "./peer.ts";
import { seed } from "./catalog.ts";
import { seed as seedDiscounts } from "./discounts.ts";
import { seed as seedTax } from "./tax.ts";
@@ -65,6 +65,12 @@
const SECURITY: Record<string, string> = {
// (Sec-Fetch-Site, or Origin); a request that names another site is refused.
// The app's public address is what the forge told us, never the socket's.
const publicOrigin = new URL(process.env.FORGE_APP_URL ?? "http://localhost").origin;
// Whether `x-forwarded-for` may be read at all is the deployment's to declare,
// not ours to guess: FORGE_APP_TRUSTED_HOPS is how many proxies of ours stand
// in front of the socket. Unset — which is how the forge runs today — the
// header is a stranger's typing and src/peer.ts does not read it.
const hops = trustedHops(process.env.FORGE_APP_TRUSTED_HOPS);
const sameOrigin = (request: Request): boolean => {
  const site = request.headers.get("sec-fetch-site");
  if (site !== null) return site === "same-origin" || site === "none";
@@ -176,8 +182,12 @@
function context(
    cookies,
    setCookie: (value: string) => outgoing.push(value),
    secure: publicOrigin.startsWith("https:"),
    // The socket, never a header: see src/peer.ts for why nothing else counts.
    peer: peerOf(self.requestIP(request)?.address),
    // The socket, unless the deployment declared the proxies in front of it:
    // see src/peer.ts for why nothing a caller writes counts on its own.
    peer: peerOf(self.requestIP(request)?.address, {
      forwardedFor: request.headers.get("x-forwarded-for"),
      hops,
    }),
  };
}
@@ -15,6 +15,7 @@
import * as giftcards from "./giftcards.ts";
import * as limit from "./ratelimit.ts";
import * as mine from "./mine.ts";
import * as orders from "./orders.ts";
import * as giftCardPages from "./pages/giftcard.ts";
import * as pages from "./pages/checkout.ts";
import * as storefront from "./pages/storefront.ts";
import {
@@ -190,6 +191,36 @@
export function applyCode(ctx: Ctx): Response {
const codeRefused = (ctx: Ctx, back: string, error: string): Response =>
  back === "/checkout" ? checkoutForm(ctx, error) : cartView(ctx, error);
/**
 * What is left on a gift card, for whoever holds the code. It is asked for
 * with a POST so the code stays out of the URL, it is rate limited like any
 * other code, and an unknown code is refused in the same words the cart uses
 * — this page is not a way to find out which codes exist.
 */
export function giftCardPage(ctx: Ctx, found?: giftCardPages.Found, error?: string): Response {
  return render(ctx, { title: "Gift cards" }, giftCardPages.page(ctx.session, found, error));
}
/** How many movements the window shows; the page says so when it is full. */
const LEDGER_ROWS = 20;
export function giftCardCheck(ctx: Ctx): Response {
  if (!limit.take(limit.BALANCE, ctx.peer)) return tooMany(ctx, limit.retryAfter(limit.BALANCE, ctx.peer), "balance");
  const typed = field(ctx.form, "code", 40);
  if (typed === "") return giftCardPage(ctx, undefined, "Type the code from your receipt.");
  const card = giftcards.byCode(typed);
  if (!card) return giftCardPage(ctx, undefined, "That gift card is not one this shop knows.");
  // One row more than the window is asked for, so "older ones are not shown"
  // is said when an older one exists and not when the card has exactly enough.
  const entries = giftcards.publicEntriesOf(card.id, LEDGER_ROWS + 1);
  const more = entries.length > LEDGER_ROWS;
  return giftCardPage(ctx, {
    card,
    entries: more ? entries.slice(0, LEDGER_ROWS) : entries,
    shown: more ? LEDGER_ROWS : undefined,
  });
}
export function removeCode(ctx: Ctx): Response {
  const which = field(ctx.form, "which", 10);
  const back = field(ctx.form, "back", 20) === "checkout" ? "/checkout" : "/cart";
@@ -4,15 +4,26 @@
 * use — the same catalog, the same orders, the same ledger.
 *
 * Who is at the keyboard comes from the forge too: FORGE_APP_USER,
 * FORGE_APP_USER_ID and FORGE_APP_USER_ROLE, named on the first screen. Moving
 * stock and refunding are an admin's to do, here as on the web.
 * FORGE_APP_USER_ID and FORGE_APP_USER_ROLE, named on the first screen.
 * Reaching this screen is not the same as being allowed to use it: every key
 * that changes something — and c, which reads a code out — is an admin's,
 * here as on the web, and so is every tab whose rows are the shop's own
 * business. Orders, the outbox, the codes and the cards are all of those:
 * a receipt carries a gift card's code in full, and that code is money to
 * whoever reads it. `src/desk.ts` holds the one table both gates read.
 *
 * 1/2/3 switch between stock, orders and the outbox. j/k move, s moves stock
 * with a reason, / finds an order by number, name or email, r refunds what is
 * left of an order and puts it back on the shelf, q leaves. Plain ANSI, no
 * dependencies.
 * 1..6 switch between stock, orders, the outbox, discount codes, gift cards
 * and the tax table — everything /admin can see. j/k move, and each tab says
 * at its foot what it can do: s moves stock with a reason, / finds an order by
 * number, name or email, r refunds what is left of an order and puts it back
 * on the shelf, n writes a code, i issues a card, e sets a tax rate, c looks a
 * code up. q leaves. Plain ANSI, no dependencies.
 */
import * as desk from "./desk.ts";
import * as discounts from "./discounts.ts";
import * as giftcards from "./giftcards.ts";
import * as tax from "./tax.ts";
import { db } from "./db.ts";
import { chosen } from "./gateway.ts";
import { formatCents } from "./money.ts";
@@ -20,16 +31,16 @@
import { history, addStock, setStock } from "./inventory.ts";
import { itemsOf, paymentsOf, recent, refund, refundableCents, refundedCents } from "./orders.ts";
import { outbox } from "./mail.ts";
import { atKeyboard } from "./who.ts";
import type { Order } from "./db.ts";
import type { GiftCard, Order, TaxRate } from "./db.ts";
const person = atKeyboard();
const isAdmin = person.role === "admin";
const readable = desk.visible(person).join(", ");
const onlyReads = ` — ${readable} read, nothing here changes anything`;
const whoLine =
  person.role === "anon"
    ? "the forge did not name you (anonymous) — stock moves and refunds are closed"
    : `signed in as ${person.name} (${person.id}) · ${person.role}${
        isAdmin ? "" : " — stock moves and refunds are for an admin"
      }`;
    ? `the forge did not name you (anonymous)${onlyReads}`
    : `signed in as ${person.name} (${person.id}) · ${person.role}${isAdmin ? "" : onlyReads}`;
const where =
  process.env.FORGE_APP_ENV === "preview"
@@ -53,7 +64,10 @@
const stockRows = (): Row[] =>
    )
    .all();
let tab: "stock" | "orders" | "outbox" = "stock";
const TABS = desk.TABS;
type Tab = desk.Tab;
let tab: Tab = "stock";
let cursor = 0;
let prompt: { label: string; text: string; run: (value: string) => string } | undefined;
let message = "";
@@ -61,9 +75,51 @@
let message = "";
// the same needle /admin/orders takes.
let filter = "";
// What the orders tab is showing: every order, or the ones `/` narrowed to.
const orderRows = (): Order[] => recent(100, filter);
const rowsFor = (): unknown[] => (tab === "stock" ? stockRows() : tab === "orders" ? orderRows() : outbox(50));
const rowsFor = (): unknown[] =>
  tab === "stock"
    ? stockRows()
    : tab === "orders"
      ? orderRows()
      : tab === "outbox"
        ? outbox(50)
        : tab === "codes"
          ? discounts.withUse()
          : tab === "cards"
            ? giftcards.all()
            : tax.rates();
/** A message from the desk, with a refusal marked so it cannot be missed. */
const say = (done: desk.Done): string => (done.ok ? done.message : `${esc}33m${done.message}${esc}0m`);
/** The refusal the desk never gets to give, because a non-admin never reaches it. */
const notYours = say({ ok: false, message: "That is an admin's to do." });
/**
 * The foot of the screen. A key this person may not press is not offered:
 * `desk.offered` is the same list `desk.needsAdmin` gates on, h included.
 */
const hints = (): string =>
  [
    "1-6 tabs",
    "j/k move",
    ...desk.offered(tab, person),
    ...(tab === "orders" && filter !== "" ? [`showing “${filter}”`] : []),
    "q quit",
  ].join(" · ");
/** The tab bar. A tab this person may not read is named but marked closed. */
const tabBar = (): string =>
  TABS.map((name, i) => {
    const closed = !isAdmin && desk.needsAdminToRead(name);
    const text = `${i + 1} ${name}${closed ? "·" : ""}`;
    return name === tab ? bold(text) : dim(text);
  }).join("  ");
const windowOf = (row: { starts_at: string | null; expires_at: string | null }): string =>
  row.expires_at ? `until ${row.expires_at.slice(0, 10)}` : row.starts_at ? `from ${row.starts_at.slice(0, 10)}` : "";
function detail(order: Order): string[] {
  const lines = [""];
@@ -85,11 +141,7 @@
function draw(): void {
  const lines: string[] = [];
  lines.push(`${bold("bazaar")}  ${dim(where)}  ${dim(chosen().label)}`);
  lines.push(dim(whoLine));
  lines.push(
    ["stock", "orders", "outbox"]
      .map((name, i) => (name === tab ? bold(`${i + 1} ${name}`) : dim(`${i + 1} ${name}`)))
      .join("  "),
  );
  lines.push(tabBar());
  lines.push("");
  if (rows.length === 0) lines.push(dim("Nothing here yet."));
  if (tab === "stock")
@@ -116,19 +168,42 @@
function draw(): void {
      lines.push(`${mark} ${i === cursor ? bold(email.subject) : email.subject}  ${dim(email.to_address)}`);
      if (i === cursor) lines.push("", ...email.body.split("\n").map((line) => `    ${dim(line)}`));
    });
  if (tab === "codes")
    (rows as discounts.DiscountStats[]).forEach((code, i) => {
      const mark = i === cursor ? "▸" : " ";
      const used = `${code.redeemed - code.released}${code.max_redemptions === null ? "" : `/${code.max_redemptions}`}`;
      const text = `${code.code.padEnd(18)} ${discounts.describe(code).padEnd(16)} ${(code.min_subtotal_cents > 0 ? `over ${formatCents(code.min_subtotal_cents)}` : "").padEnd(14)} ${used.padStart(
        7,
      )} used ${formatCents(code.given_cents).padStart(10)} given ${code.active === 1 ? "" : " off"}`;
      lines.push(`${mark} ${i === cursor ? bold(text) : text}${windowOf(code) ? dim(`  ${windowOf(code)}`) : ""}`);
    });
  if (tab === "cards")
    (rows as GiftCard[]).forEach((card, i) => {
      const mark = i === cursor ? "▸" : " ";
      const text = `····${card.last4.padEnd(8)} ${formatCents(card.balance_cents).padStart(10)} of ${formatCents(
        card.initial_cents,
      ).padStart(10)} ${card.active === 1 ? "    " : " void"}  ${card.note.slice(0, 34)}`;
      lines.push(`${mark} ${i === cursor ? bold(text) : text}`);
      if (i === cursor)
        lines.push(
          ...giftcards
            .entriesOf(card.id, 6)
            .map((entry) => `    ${dim(`${entry.at}  ${entry.delta > 0 ? "+" : ""}${formatCents(entry.delta)}  ${entry.reason}`)}`),
        );
    });
  if (tab === "tax") {
    lines.push(dim(`  anywhere else  ${(tax.defaultRateBp() / 100).toFixed(2)}%  (d to change)`), "");
    (rows as TaxRate[]).forEach((rate, i) => {
      const mark = i === cursor ? "▸" : " ";
      const text = `${rate.country.padEnd(20)} ${(rate.region || "—").padEnd(6)} ${((rate.rate_bp / 100).toFixed(2) + "%").padStart(
        7,
      )}  ${rate.label.slice(0, 30)}`;
      lines.push(`${mark} ${i === cursor ? bold(text) : text}`);
    });
  }
  lines.push("");
  if (message) lines.push(message, "");
  lines.push(
    prompt === undefined
      ? dim(
          tab === "stock"
            ? `1/2/3 tabs · j/k move${isAdmin ? " · s move stock" : ""} · h ledger · q quit`
            : tab === "orders"
              ? `1/2/3 tabs · j/k move · / find${filter ? ` (“${filter}”)` : ""}${isAdmin ? " · r refund the rest and restock" : ""} · q quit`
              : "1/2/3 tabs · j/k move · q quit",
        )
      : `${prompt.label} ${prompt.text}${esc}7m ${esc}0m`,
  );
  lines.push(prompt === undefined ? dim(hints()) : `${prompt.label} ${prompt.text}${esc}7m ${esc}0m`);
  out(`${esc}2J${esc}H` + lines.join("\r\n"));
}
@@ -196,18 +271,52 @@
process.stdin.on("data", (key: string) => {
  const count = rowsFor().length;
  if (key === "j" || key === "\x1b[B") cursor = Math.min(cursor + 1, Math.max(0, count - 1));
  if (key === "k" || key === "\x1b[A") cursor = Math.max(cursor - 1, 0);
  if (key === "1") ((tab = "stock"), (cursor = 0));
  if (key === "2") ((tab = "orders"), (cursor = 0));
  if (key === "3") ((tab = "outbox"), (cursor = 0));
  if (key === "s" && tab === "stock")
    if (isAdmin) prompt = { label: "Move (e.g. 12 a delivery arrived):", text: "", run: moveStock };
    else message = "Moving stock is for an admin.";
  if (key === "/" && tab === "orders")
  // A tab whose rows are the shop's own business is not opened at all for a
  // non-admin: the screen stays where it was and says why, so nothing private
  // is ever drawn.
  const asTab = TABS[Number(key) - 1];
  if (asTab && !isAdmin && desk.needsAdminToRead(asTab)) message = notYours;
  else if (asTab) ((tab = asTab), (cursor = 0));
  // Every key from here down either changes something or reads a code out, so
  // every one of them is an admin's. A non-admin gets one refusal; the desk
  // below is never reached.
  if (!isAdmin && desk.needsAdmin(tab, key)) message = notYours;
  if (key === "s" && tab === "stock" && isAdmin)
    prompt = { label: "Move (e.g. 12 a delivery arrived):", text: "", run: moveStock };
  if (key === "/" && tab === "orders" && isAdmin)
    prompt = { label: "Find an order (number, name or email):", text: filter, run: findOrders };
  if (key === "r" && tab === "orders")
    if (isAdmin) prompt = { label: "Refund the rest — reason:", text: "", run: refundRest };
    else message = "Refunding is for an admin.";
  if (key === "h" && tab === "stock")
  if (key === "r" && tab === "orders" && isAdmin) prompt = { label: "Refund the rest — reason:", text: "", run: refundRest };
  if (key === "c" && (tab === "codes" || tab === "cards") && isAdmin)
    prompt = { label: "Check a code:", text: "", run: (value) => say(desk.look(value)) };
  if (key === "n" && tab === "codes" && isAdmin)
    prompt = { label: `New code (${desk.NEW_DISCOUNT_SHAPE}):`, text: "", run: (value) => say(desk.newDiscount(value)) };
  if (key === "t" && tab === "codes" && isAdmin) {
    const code = discounts.withUse()[cursor];
    message = say(code ? desk.toggleDiscount(code.id) : { ok: false, message: "No code selected." });
  }
  if (key === "i" && tab === "cards" && isAdmin)
    prompt = { label: "Issue a card (e.g. 25 a sorry-for-the-wait card):", text: "", run: (value) => say(desk.issueCard(value)) };
  if (key === "v" && tab === "cards" && isAdmin) {
    const card = giftcards.all()[cursor];
    prompt = {
      label: card && card.active !== 1 ? "Bring it back — reason:" : "Void it — reason:",
      text: "",
      run: (value) => say(card ? desk.toggleCard(card.id, value) : { ok: false, message: "No card selected." }),
    };
  }
  if (key === "e" && tab === "tax" && isAdmin)
    prompt = { label: `Set a rate (${desk.RATE_SHAPE}):`, text: "", run: (value) => say(desk.setRate(value)) };
  if (key === "d" && tab === "tax" && isAdmin)
    prompt = { label: "Rate anywhere the table does not name (e.g. 8.5):", text: "", run: (value) => say(desk.setDefaultRate(value)) };
  if (key === "x" && tab === "tax" && isAdmin) {
    const rate = tax.rates()[cursor];
    prompt = {
      label: rate ? `Remove ${rate.country} ${rate.region || "(whole country)"}? y/n:` : "Nothing selected — press enter:",
      text: "",
      run: (value) => say(rate ? desk.removeRate(rate.id, value) : { ok: false, message: "No rate selected." }),
    };
  }
  if (key === "h" && tab === "stock" && isAdmin)
    message = history(8)
      .map((entry) => dim(`${entry.at}  ${entry.sku}  ${entry.delta > 0 ? "+" : ""}${entry.delta}  ${entry.reason}`))
      .join("\r\n");
@@ -15,6 +15,7 @@
const mine = await import("./mine.ts");
const peer = await import("./peer.ts");
const { escape } = await import("./html.ts");
const catalog = await import("./catalog.ts");
const desk = await import("./desk.ts");
const discounts = await import("./discounts.ts");
const giftcards = await import("./giftcards.ts");
const tax = await import("./tax.ts");
@@ -304,3 +305,284 @@
test("the settings the admin password left behind are deleted, and nothing else
  expect(getSetting("admin_salt")).toBeUndefined();
  expect(getSetting("tax_default_bp")).toBe("800");
});
/** An order row to hang a redemption on, without going through checkout. */
const bareOrder = (number: string): number =>
  db
    .query<{ id: number }, [string]>(
      `INSERT INTO "order" (number, access_token, email, name, address1, city, postal, country,
         subtotal_cents, shipping_cents, tax_cents, total_cents, idempotency_key)
       VALUES (?1, 'token', '[email protected]', 'A Buyer', '1 Road', 'Town', '00000', 'UNITED STATES',
         0, 0, 0, 0, ?1) RETURNING id`,
    )
    .get(number)!.id;
test("a code's limits and expiry are enforced where the use is taken, not only where it is shown", () => {
  const orderId = bareOrder("BZ-REDEEM-1");
  const used = (id: number): number => discounts.byId(id)!.used_count;
  const rows = (id: number): number =>
    db.query<{ n: number }, [number]>("SELECT COUNT(*) AS n FROM discount_redemption WHERE discount_id = ?1").get(id)!.n;
  // Expired at the moment it is taken: evaluate would refuse it too, but this
  // is the statement that decides, and it refuses without writing anything.
  const expired = discounts.create({
    code: "GONE-BY-NOW",
    kind: "fixed",
    value: 500,
    min_subtotal_cents: 0,
    max_redemptions: null,
    starts_at: null,
    expires_at: "2020-01-01 23:59:59",
  });
  expect(discounts.redeem(expired, orderId, 500)).toBe(false);
  expect(used(expired)).toBe(0);
  expect(rows(expired)).toBe(0);
  // Not yet started is the same refusal from the other side.
  const early = discounts.create({
    code: "NOT-YET",
    kind: "fixed",
    value: 500,
    min_subtotal_cents: 0,
    max_redemptions: null,
    starts_at: "2099-01-01 00:00:00",
    expires_at: null,
  });
  expect(discounts.redeem(early, orderId, 500)).toBe(false);
  expect(used(early)).toBe(0);
  // One that is live, with one use: the first takes it and the second cannot.
  const once = discounts.create({
    code: "ONE-USE-ONLY",
    kind: "fixed",
    value: 500,
    min_subtotal_cents: 0,
    max_redemptions: 1,
    starts_at: null,
    expires_at: "2099-12-31 23:59:59",
  });
  expect(discounts.redeem(once, orderId, 500)).toBe(true);
  expect(discounts.redeem(once, orderId, 500)).toBe(false);
  expect(used(once)).toBe(1);
  expect(rows(once)).toBe(1);
  // The same code, read at a moment after its window closes: still refused.
  const later = new Date("2100-01-01T00:00:00Z");
  const roomy = discounts.create({
    code: "ROOMY",
    kind: "fixed",
    value: 500,
    min_subtotal_cents: 0,
    max_redemptions: null,
    starts_at: null,
    expires_at: "2099-12-31 23:59:59",
  });
  expect(discounts.redeem(roomy, orderId, 500, later)).toBe(false);
  expect(used(roomy)).toBe(0);
  // A use given back is a row of its own, and the counter follows it.
  discounts.release(once, orderId, 500);
  expect(used(once)).toBe(0);
  expect(rows(once)).toBe(2);
  expect(discounts.withUse().find((row) => row.code === "ONE-USE-ONLY")!.given_cents).toBe(0);
});
test("the terminal's typed commands do what the admin forms do", () => {
  // A discount, with every limit the form offers, in one line.
  const made = desk.newDiscount("spring20 20% min 25 uses 100 until 2026-12-31");
  expect(made.ok).toBe(true);
  const spring = discounts.byCode("SPRING20")!;
  expect(spring.kind).toBe("percent");
  expect(spring.value).toBe(2000);
  expect(spring.min_subtotal_cents).toBe(2500);
  expect(spring.max_redemptions).toBe(100);
  expect(spring.expires_at).toBe("2026-12-31 23:59:59");
  expect(discounts.worth(spring, 5000)).toBe(1000);
  expect(desk.newDiscount("spring20 20%").ok).toBe(false); // already exists
  expect(desk.newDiscount("XY 20%").ok).toBe(false); // too short to be a code
  expect(desk.newDiscount("HALFOFF 120%").ok).toBe(false); // more than the goods
  expect(desk.newDiscount("NOPE 5.00 min bananas").ok).toBe(false);
  expect(desk.newDiscount("NOPE 5.00 forever 1").ok).toBe(false); // a word it does not know
  expect(desk.newDiscount("NOPE 5.00 until soon").ok).toBe(false);
  // A date nobody can reach sorts after every real stamp, so it would be a
  // code that never expires. The shape is not enough: the day has to be a day.
  expect(desk.newDiscount("NOPE 10% until 2026-99-99").ok).toBe(false);
  expect(desk.newDiscount("NOPE 10% until 2026-02-30").ok).toBe(false);
  expect(desk.newDiscount("NOPE 10% until 0000-00-00").ok).toBe(false);
  expect(discounts.byCode("NOPE")).toBeNull(); // a refused line writes nothing
  expect(desk.newDiscount("POSTFREE free").ok).toBe(true);
  expect(discounts.byCode("POSTFREE")!.kind).toBe("free_shipping");
  // On and off, the same switch the admin page has.
  expect(desk.toggleDiscount(spring.id).ok).toBe(true);
  expect(discounts.byId(spring.id)!.active).toBe(0);
  expect(discounts.evaluate("SPRING20", 5000).ok).toBe(false);
  desk.toggleDiscount(spring.id);
  expect(discounts.byId(spring.id)!.active).toBe(1);
  // A card, issued and then read back by the code it printed once.
  const issued = desk.issueCard("25 a sorry-for-the-wait card");
  expect(issued.ok).toBe(true);
  const code = /GC-[A-Z0-9-]+/.exec(issued.message)![0];
  expect(giftcards.byCode(code)!.balance_cents).toBe(2500);
  expect(desk.look(code).message).toContain("$25.00");
  expect(desk.look("SPRING20").message).toContain("20% off");
  expect(desk.look("no-such-code-at-all").ok).toBe(false);
  expect(desk.issueCard("bananas").ok).toBe(false);
  // Voiding writes the balance away and says so; reviving leaves it at zero.
  const card = giftcards.byCode(code)!;
  expect(desk.toggleCard(card.id, "lost in the post").ok).toBe(true);
  expect(giftcards.byId(card.id)!.balance_cents).toBe(0);
  expect(giftcards.entriesOf(card.id)[0]!.reason).toBe("lost in the post");
  desk.toggleCard(card.id, "found again");
  expect(giftcards.byId(card.id)!.active).toBe(1);
  // A tax rate, and the default behind it.
  expect(desk.setRate("united states / wa / 10.25 / Washington sales tax").ok).toBe(true);
  expect(tax.rateFor({ country: "United States", region: "WA" })).toEqual({
    rate_bp: 1025,
    label: "Washington sales tax",
  });
  expect(desk.setRate("nowhere / / 200").ok).toBe(false); // over 100%
  expect(desk.setRate("one part only").ok).toBe(false);
  expect(desk.setRate(" / CA / 5").ok).toBe(false); // no country
  expect(desk.setDefaultRate("bananas").ok).toBe(false);
  expect(desk.setDefaultRate("9").ok).toBe(true);
  expect(tax.defaultRateBp()).toBe(900);
  // Removing asks first, and a rate that is gone falls to the default.
  const washington = tax.rates().find((rate) => rate.region === "WA")!;
  expect(desk.removeRate(washington.id, "n").ok).toBe(false);
  expect(tax.rateById(washington.id)).not.toBeNull();
  expect(desk.removeRate(washington.id, "yes").ok).toBe(true);
  expect(tax.rateById(washington.id)).toBeNull();
  expect(tax.rateFor({ country: "United States", region: "WA" }).rate_bp).toBe(850); // the country's own rate
  desk.setDefaultRate("8.5");
});
test("every key that does the desk's work needs an admin, and is offered to nobody else", () => {
  const admin = { role: "admin", id: "1", name: "root" } as const;
  const shopper = { role: "user", id: "7", name: "nora" } as const;
  const anon = { role: "anon" } as const;
  // The seven keys this pull added, plus the two that were already there.
  expect(desk.needsAdmin("cards", "i")).toBe(true);
  expect(desk.needsAdmin("cards", "v")).toBe(true);
  expect(desk.needsAdmin("cards", "c")).toBe(true); // c reads a balance out
  expect(desk.needsAdmin("codes", "n")).toBe(true);
  expect(desk.needsAdmin("codes", "t")).toBe(true);
  expect(desk.needsAdmin("tax", "e")).toBe(true);
  expect(desk.needsAdmin("tax", "d")).toBe(true);
  expect(desk.needsAdmin("tax", "x")).toBe(true);
  expect(desk.needsAdmin("stock", "s")).toBe(true);
  expect(desk.needsAdmin("orders", "r")).toBe(true);
  expect(desk.needsAdmin("stock", "h")).toBe(true); // h reads the stock ledger out
  // Moving and switching tabs are not the desk's, and a key is only the
  // desk's on the tab it belongs to.
  for (const tab of desk.TABS) for (const key of ["j", "k", "q", "1", "6"]) expect(desk.needsAdmin(tab, key)).toBe(false);
  expect(desk.needsAdmin("outbox", "i")).toBe(false);
  expect(desk.needsAdmin("stock", "n")).toBe(false);
  for (const tab of desk.TABS) {
    // The foot of the screen and the gate read the same table: everything
    // offered needs an admin, and everything that needs one is offered.
    const keys = ["/", ..."abcdefghilmnoprstuvwxyz".split("")];
    const gated = keys.filter((key) => desk.needsAdmin(tab, key));
    expect(desk.offered(tab, admin).map((label) => label[0]).sort()).toEqual(gated.sort());
    // Whoever the forge did not name an admin is offered nothing at all.
    expect(desk.offered(tab, shopper)).toEqual([]);
    expect(desk.offered(tab, anon)).toEqual([]);
  }
  expect(desk.offered("cards", admin)).toContain("i issue a card");
});
test("the tabs that print a code, a receipt or a person are an admin's to read", () => {
  const admin = { role: "admin", id: "1", name: "root" } as const;
  const shopper = { role: "user", id: "7", name: "nora" } as const;
  const anon = { role: "anon" } as const;
  // A receipt in the outbox carries a gift card's code in full, an order
  // carries a name and an address, the card list is every balance in the shop
  // and the code list is every discount that exists — all of it the shop's.
  expect(desk.needsAdminToRead("orders")).toBe(true);
  expect(desk.needsAdminToRead("outbox")).toBe(true);
  expect(desk.needsAdminToRead("cards")).toBe(true);
  expect(desk.needsAdminToRead("codes")).toBe(true);
  // What is on the shelf and what it is taxed at is the shop's public face.
  expect(desk.needsAdminToRead("stock")).toBe(false);
  expect(desk.needsAdminToRead("tax")).toBe(false);
  expect(desk.visible(admin)).toEqual([...desk.TABS]);
  expect(desk.visible(shopper)).toEqual(["stock", "tax"]);
  expect(desk.visible(anon)).toEqual(["stock", "tax"]);
  // Nothing a non-admin can open offers a key they may not press, and the
  // first tab the terminal opens on is one of them.
  for (const tab of desk.visible(shopper)) expect(desk.offered(tab, shopper)).toEqual([]);
  expect(desk.visible(shopper)[0]).toBe(desk.TABS[0]);
});
test("a rate limit counts an address the caller cannot choose", () => {
  const client = "203.0.113.7"; // a real one, out on the internet
  const proxy = "10.1.2.3"; // the forge, on its own network
  const forged = "198.51.100.1"; // what a guesser types to get a fresh bucket
  // Nobody vouched for the header, so it is not read: the socket is the key,
  // whether the socket is a shopper's or the forge's proxy.
  expect(peer.peerOf(client, { forwardedFor: forged })).toEqual({ address: client });
  expect(peer.peerOf(proxy, { forwardedFor: `${forged}, ${client}` })).toEqual({ address: proxy });
  // Declaring no hops of our own says the same thing out loud.
  expect(peer.peerOf(client, { forwardedFor: forged, hops: 0 })).toEqual({ address: client });
  // No socket to stand on is one shared bucket, which is still a limit.
  expect(peer.peerOf(undefined, { forwardedFor: forged })).toEqual({ address: "local" });
});
test("a deployment that knows how many proxies are in front says so, and is believed exactly", () => {
  const client = "203.0.113.7";
  const forged = "198.51.100.1"; // what the caller wrote, at the far left
  // The proxy's own address can be public, so no range tells us it is ours.
  const publicProxy = "192.0.2.50";
  expect(peer.trustedHops("1")).toBe(1);
  expect(peer.trustedHops("2")).toBe(2);
  expect(peer.trustedHops("0")).toBe(0);
  expect(peer.trustedHops(undefined)).toBeUndefined();
  expect(peer.trustedHops("")).toBeUndefined();
  expect(peer.trustedHops("lots")).toBeUndefined();
  expect(peer.trustedHops("-1")).toBeUndefined();
  expect(peer.trustedHops("99")).toBeUndefined(); // nobody has 99 proxies
  // One hop: the right-hand entry is what our proxy saw, and that is the client.
  const one = { hops: 1 };
  expect(peer.peerOf(publicProxy, { ...one, forwardedFor: `${forged}, ${client}` })).toEqual({ address: client });
  // Two hops: one more entry is skipped, and what the client typed is not read.
  const two = { hops: 2 };
  expect(peer.peerOf(publicProxy, { ...two, forwardedFor: `${forged}, ${client}, 10.9.9.9` })).toEqual({
    address: client,
  });
  // A chain shorter than the hops we were promised is not the chain we were
  // promised, so it is not read; nor is an entry that is not an address.
  expect(peer.peerOf(publicProxy, { ...two, forwardedFor: client })).toEqual({ address: publicProxy });
  expect(peer.peerOf(publicProxy, { ...one, forwardedFor: "" })).toEqual({ address: publicProxy });
  expect(peer.peerOf(publicProxy, { ...one, forwardedFor: "not an address" })).toEqual({ address: publicProxy });
  // IPv6 arrives the same way.
  expect(peer.peerOf("::1", { ...one, forwardedFor: "fd00::1, 2001:db8::1" })).toEqual({ address: "2001:db8::1" });
});
test("a card's holder is told what happened, not what the shop wrote to itself", () => {
  const { card } = giftcards.issue({ cents: 4000, note: "a present" });
  const orderId = bareOrder("BZ-CARD-WORDS");
  expect(giftcards.spend(card.id, 1000, "paid on BZ-CARD-WORDS", orderId)).toBe(true);
  giftcards.setActive(card.id, false, "chargeback from the buyer, do not honour");
  const shown = giftcards.publicEntriesOf(card.id);
  expect(shown.map((entry) => entry.what)).toEqual(["Taken off the card", "Spent on an order", "Issued"]);
  expect(shown.map((entry) => entry.delta)).toEqual([-3000, -1000, 4000]);
  for (const entry of shown) expect(entry.what).not.toContain("chargeback");
  // The shop's own view keeps every word of it.
  expect(giftcards.entriesOf(card.id)[0]!.reason).toBe("chargeback from the buyer, do not honour");
});
		@@ -2,11 +2,12 @@
2	2
3	3	A small shop: a catalog with categories and search, product pages with
4	4	variants and stock, a cart in a signed cookie, discount codes and gift cards,
5		tax by where the parcel goes, checkout with an address, a payment step,
6		receipts, and an `/admin` for products, inventory, codes, cards, tax and
7		orders with refunds. Every price is an integer number of cents, every form
8		carries a CSRF token, and checkout, payment, typing a code and finding an
9		order are rate limited. A category or a search longer than 24 things is
	5	tax by where the parcel goes, a gift card balance window, checkout with an
	6	address, a payment step, receipts, and an `/admin` for products, inventory,
	7	codes, cards, tax and orders with refunds. Every price is an integer number
	8	of cents, every form carries a CSRF token, and checkout, payment, typing a
	9	code, reading a gift card's balance and finding an order are each rate
	10	limited on their own. A category or a search longer than 24 things is
10	11	paged, so a listing is never a page without an end and never hides what is
11	12	past the end of it.
12	13
		@@ -52,10 +53,16 @@ takes off.
52	53	- Discount codes are a percent, a fixed number of cents, or free
53	54	shipping, with an optional minimum, a start and expiry, and a cap on how
54	55	many times they can be used. A discount applies to goods only — money is
55		not bought at a discount — and the cap is taken with a conditional `UPDATE`
56		inside the order's transaction, so a code with one use left goes to one
57		person. Every use, and every use given back when an order is cancelled, is
58		a row in `discount_redemption`. `WELCOME10` and `SHIPFREE` are seeded.
	56	not bought at a discount — and every limit it carries is checked again by
	57	the conditional `UPDATE` inside the order's transaction: whether it is on,
	58	whether now is inside its window, and whether a use is left. A code with
	59	one use left goes to one person, and a code that expires between the cart
	60	and the order is not taken anyway. Every use, and every use given back when an order is cancelled, is
	61	a row in `discount_redemption`. An expiry is stored as a stamp and compared
	62	as text, so it has to be a real day: `discounts.endOfDay` parses it and
	63	round-trips it, and the form and the terminal both refuse `2026-99-99`
	64	rather than store a code that outlasts every date there is.
	65	`WELCOME10` and `SHIPFREE` are seeded.
59	66	- Gift cards are sold as an ordinary product (`/p/gift-card`) and issued
60	67	when the order is paid; the code is printed once, on the receipt. Only the
61	68	code's HMAC and its last four characters are stored, so the table cannot be
		@@ -63,7 +70,18 @@ takes off.
63	70	`gift_card_entry`, and spending is conditional on the balance being there,
64	71	so two checkouts racing for the last $5 cannot both win and a balance never
65	72	goes below zero. What a card cannot cover is left for the gateway; a card
66		that covers the lot means there is no gateway to ask.
	73	that covers the lot means there is no gateway to ask. `/gift-cards` shows
	74	whoever holds a code what is left on it and every movement of it: the code
	75	is asked for with a POST so it never lands in a URL or a log, the page has
	76	its own rate limit so reading a balance never costs a shopper the right to
	77	apply a code at the till, and a code the shop does not know is refused in
	78	the same words as one that is empty. Each movement is named in the shop's
	79	own fixed words — "Issued", "Spent on an order", "Taken off the card" —
	80	never the note an admin typed to themselves when they voided it. The window
	81	shows the last twenty movements and says so when there are more, and it
	82	offers to spend the card only while it is live and has something on it.
	83	The confirmation page says, next to the gift card line, that the code is on
	84	the receipt and that this is the only copy.
67	85	- Tax is a table of rates in basis points by country and region
68	86	(`/admin/tax`), matched on the address the shopper typed — the exact region
69	87	first, then the country, then a default. It is taken on goods after the
		@@ -104,7 +122,7 @@ that way back, and it has two halves:
104	122	A limit only limits if the caller cannot choose which bucket it spends, so
105	123	`src/peer.ts` decides where a request came from and a bucket is keyed on that
106	124	and nothing else: the address the socket arrived on. `X-Forwarded-For` is not
107		read. It would be the useful thing — it names the shopper behind a proxy — but
	125	read on the strength of its own existence. It would be the useful thing — it names the shopper behind a proxy — but
108	126	only if a proxy we trust appends to it, and nothing this app can see from the
109	127	inside proves that one does. A client can send that header itself, and a hint
110	128	nobody vouches for is the caller's own word; keyed on the leftmost entry, as
		@@ -113,11 +131,20 @@ this app used to be, every bucket here was ten tries per invented header.
113	131	The consequence is deliberate and worth knowing: behind the forge's proxy every
114	132	shopper arrives on the same address, so these are the shop's limits rather
115	133	than each shopper's, and the capacities in `src/ratelimit.ts` are set for a
116		shop — 30 checkouts a minute, 30 codes every two minutes, 30 order lookups
117		every five. Ordinary trade never meets them; guessing at a gift card code or
118		an order number runs out of tries long before it runs out of guesses. If the
119		forge ever says it appends a hop of its own, the rightmost entry becomes worth
120		reading and `src/peer.ts` is the one file that changes.
	134	shop — 30 checkouts a minute, 30 codes and 30 balance checks every two
	135	minutes, 30 order lookups every five. Ordinary trade never meets them;
	136	guessing at a gift card code or
	137	an order number runs out of tries long before it runs out of guesses.
	138
	139	The one thing that can vouch for the header is the deployment, and only by
	140	counting. `FORGE_APP_TRUSTED_HOPS` says how many proxies of ours stand in
	141	front of the socket; a proxy appends the peer it saw to the right of the
	142	chain, so with `1` the shopper is the right-hand entry, with `2` the one
	143	before that, and everything further left — where a client writes what it likes
	144	— is never read. Set it and the limits above go back to being each shopper's.
	145	Unset, which is how the forge runs today, the header is not read at all, and
	146	nothing is inferred from the shape of an address: a guess about who is proxying
	147	is not a fact about it. `src/peer.ts` is the only file that reads the header.
121	148
122	149	The address is checked for the shape of one before it is used, which is also
123	150	why the `looked-up` note on an order can only ever hold an address and not a
		@@ -165,6 +192,7 @@ request made at all. No test in this repository talks to the network.
165	192	\| Variable \| Meaning \|
166	193	\| --- \| --- \|
167	194	\| `FORGE_APP_IDENTITY_KEY` \| The key the forge signs `x-forge-identity` with, verified in `src/who.ts`. Unset means no request can be verified: everybody is anonymous and `/admin` is closed to everybody. There is no password and no way around this. \|
	195	\| `FORGE_APP_TRUSTED_HOPS` \| How many proxies of ours stand in front of the socket, for the address a rate limit counts. `1` means `x-forwarded-for`'s right-hand entry is the client. Unset or `0`, the header is not read at all and a bucket is the whole shop's. \|
168	196	\| `APP_SECRET` \| Signs cart cookies, sessions, CSRF tokens and order links. Generated into `FORGE_APP_DATA/secret` when unset. \|
169	197	\| `STRIPE_SECRET_KEY` \| A Stripe test key turns on real Stripe Checkout. \|
170	198	\| `STRIPE_WEBHOOK_SECRET` \| Verifies `POST /webhooks/stripe`. \|
		@@ -198,9 +226,24 @@ from `/search?q=beans` comes back to the results — with one exception: an
198	226	order's `token` is stripped, because it opens that order to whoever holds it
199	227	and the sign-in path is handed to the forge. Those links also carry
200	228	`rel="noreferrer"`: `/__forge/*` shares this origin, so the `Referer` would
201		otherwise hand over the very URL `to` was careful to clean. The terminal takes
202		the same three roles from the environment and keeps stock moves and refunds
203		for an admin.
	229	otherwise hand over the very URL `to` was careful to clean.
	230
	231	The terminal takes the same three roles from the environment. Stock and the
	232	tax table read for anybody the forge names; orders,
	233	the outbox, the codes and the cards do not, because a receipt carries a gift
	234	card's code in full, an order carries a name and an address, and the card list
	235	is every balance in the shop. Every key that does anything — moving stock,
	236	refunding, writing a code, issuing or voiding a card, setting a rate — is an
	237	admin's, and so are the two keys that only read something out: `c`, which
	238	prints a balance, and `h`, which prints the stock ledger. `src/desk.ts` holds
	239	one table for both, and the tab bar and the foot of the screen are built from
	240	it, so nothing can be offered without being gated.
	241
	242	Rate limits count the address the socket came from, never the first entry of
	243	`x-forwarded-for` — see [What a rate limit is keyed on](#what-a-rate-limit-is-keyed-on)
	244	for why, and for the one declaration that changes it. Reading a gift card's
	245	balance gets a bucket of its own there, separate from typing a code at the
	246	till: someone reading their card over and over must still be able to spend it.
204	247
205	248	## Shape
206	249
		@@ -213,18 +256,35 @@ for an admin.
213	256	\| `src/cart.ts` `src/codes.ts` `src/mine.ts` `src/money.ts` `src/sign.ts` \| The signed cart, the codes cookie, the orders this browser placed, integer cents, HMACs \|
214	257	\| `src/discounts.ts` `src/giftcards.ts` `src/tax.ts` \| What a code is worth, what a card holds, what the rate is \|
215	258	\| `src/who.ts` `src/session.ts` \| Who the forge says is asking; the session that carries the CSRF token \|
	259	\| `src/desk.ts` \| The terminal's typed commands: a line of text into a code, a card or a rate \|
216	260	\| `src/peer.ts` `src/ratelimit.ts` \| Where a request came from, as far as it can be proved; the buckets keyed on it \|
217	261	\| `src/gateway.ts` `src/mail.ts` \| Stripe or the mock, the outbox \|
218	262	\| `src/shop.ts` `src/admin.ts` \| Handlers for the shop and for `/admin` \|
219	263	\| `src/pages/*.ts` `src/html.ts` `src/style.ts` \| Rendering; the stylesheet is served under a name made from its own contents \|
220		\| `src/units.test.ts` `src/server.test.ts` `src/stripe.test.ts` \| The rules on their own, the shop over HTTP, the Stripe path against a fake Stripe \|
	264	\| `src/units.test.ts` `src/server.test.ts` `src/stripe.test.ts` `src/proxy.test.ts` \| The rules on their own, the shop over HTTP, the Stripe path against a fake Stripe, the app booted behind a declared proxy \|
221	265
222	266	## The terminal
223	267
224	268	The same shop over the same data. The exact command is in `FORGE_APP_SSH`
225	269	when the app runs; the footer of every page prints it verbatim, and says the
226		terminal is off when it is unset. `1/2/3` switch between stock, orders and the
227		outbox, `j`/`k` move, `s` moves stock with a reason, `/` finds an order by
228		number, name or email — the terminal's half of `/orders` — `r` refunds the rest
229		of an order and puts it back on the shelf, `q` leaves. The first line says who
230		the forge named at the keyboard; `s` and `r` are an admin's.
	270	terminal is off when it is unset. `1`–`6` switch between stock, orders, the
	271	outbox, discount codes, gift cards and the tax table — everything `/admin`
	272	can see — and `j`/`k` move. A tab whose rows are the shop's own business is an
	273	admin's to open: a non-admin gets stock and tax, the other four are marked
	274	with a `·` in the tab bar and answer "That is an admin's to do." without
	275	leaving the tab they are on:
	276
	277	\| Tab \| Keys \|
	278	\| --- \| --- \|
	279	\| stock \| `s` moves stock with a reason, `h` shows the last of the ledger \|
	280	\| orders \| `/` finds an order by number, name or email — the terminal's half of `/orders` — and `r` refunds what is left of one and puts it back on the shelf \|
	281	\| codes \| `n` writes a code (`CODE 20% [min 25] [uses 100] [until 2026-12-31]`), `t` turns one on or off, `c` looks a code up \|
	282	\| cards \| `i` issues a card (`25 a sorry-for-the-wait card`) and prints its code once, `v` voids or revives one, `c` looks a code up \|
	283	\| tax \| `e` sets a rate (`COUNTRY / REGION / 8.75 / what to call it`), `d` sets the rate for anywhere the table does not name, `x` removes one \|
	284
	285	`q` leaves. The first line says who the forge named and what they may read;
	286	`FORGE_APP_USER_ROLE` has to be `admin` for any of the keys above, `c` and `h`
	287	included — one prints a card's balance and a code's full terms, the other the
	288	stock ledger. `ssh` gets you to the screen, not past the door. The parsing,
	289	the gates and the refusals are `src/desk.ts`, so they are tested without a
	290	pty.
		@@ -316,9 +316,9 @@ export function discountList(ctx: Ctx): Response {
316	316	return render(ctx, { title: "Discounts", admin: true }, pages.discounts(ctx.session, discounts.withUse(), messageFrom(ctx)));
317	317	}
318	318
319		/** A date is a date or it is nothing; a percent is basis points of a whole. */
	319	/** A date is a real date or it is nothing; a percent is basis points of a whole. */
320	320	const dayOrNull = (value: string): string \| null \| undefined =>
321		value === "" ? null : /^\d{4}-\d{2}-\d{2}$/.test(value) ? `${value} 23:59:59` : undefined;
	321	value === "" ? null : discounts.endOfDay(value);
322	322
323	323	export function discountCreate(ctx: Ctx): Response {
324	324	const blocked = guard(ctx);
		@@ -0,0 +1,245 @@
	1	/**
	2	* The desk: what someone at the counter does to codes, cards and tax rates,
	3	* said as one line of text.
	4	*
	5	* The terminal has no forms, so every action it offers is a typed line. The
	6	* parsing and the refusals live here rather than in `src/tty.ts`, so they can
	7	* be tested without a pty — a command is text in and a message out, and the
	8	* work itself goes through the same modules the admin pages use.
	9	*
	10	* Reaching the terminal is not permission to use it. Everything below is what
	11	* /admin does — issuing a card prints its code once, and looking a code up
	12	* reads out a balance — so the forge has to have named an admin at the
	13	* keyboard. `DESK` is the one place that says so, for reading as much as for
	14	* doing: the gate in `src/tty.ts` and the foot of its screen both read it, so
	15	* a key cannot be offered without being gated or gated without being offered,
	16	* and a tab cannot be opened by someone who may not read what is on it.
	17	*/
	18
	19	import * as discounts from "./discounts.ts";
	20	import * as giftcards from "./giftcards.ts";
	21	import * as tax from "./tax.ts";
	22	import { formatCents, parseCents } from "./money.ts";
	23	import type { Who } from "./who.ts";
	24
	25	export type Done = { ok: boolean; message: string };
	26
	27	export const TABS = ["stock", "orders", "outbox", "codes", "cards", "tax"] as const;
	28	export type Tab = (typeof TABS)[number];
	29
	30	/**
	31	* Every tab, who may look at it, and the keys it offers — each key with the
	32	* words the screen's foot uses.
	33	*
	34	* `read: "admin"` is not squeamishness about internal pages. An order names a
	35	* person and where they live; a receipt in the outbox carries a gift card's
	36	* code in full, which is bearer money; the card list is every balance in the
	37	* shop and the notes the shop wrote to itself about them; the code list is
	38	* every discount that exists, including the ones nobody was told about. That
	39	* is the same reason `c` is an admin's key, so it is the same gate.
	40	*
	41	* Stock and the tax table are the shop's public face — what is on the shelf
	42	* and what it is taxed at — so they stay open to whoever the forge named.
	43	*/
	44	const DESK: Record<Tab, { read: "anyone" \| "admin"; keys: { key: string; label: string }[] }> = {
	45	stock: { read: "anyone", keys: [{ key: "s", label: "s move stock" }, { key: "h", label: "h ledger" }] },
	46	orders: {
	47	read: "admin",
	48	keys: [
	49	{ key: "/", label: "/ find" },
	50	{ key: "r", label: "r refund the rest and restock" },
	51	],
	52	},
	53	outbox: { read: "admin", keys: [] },
	54	codes: {
	55	read: "admin",
	56	keys: [
	57	{ key: "n", label: "n new code" },
	58	{ key: "t", label: "t on/off" },
	59	{ key: "c", label: "c check a code" },
	60	],
	61	},
	62	cards: {
	63	read: "admin",
	64	keys: [
	65	{ key: "i", label: "i issue a card" },
	66	{ key: "v", label: "v void/revive" },
	67	{ key: "c", label: "c check a code" },
	68	],
	69	},
	70	tax: {
	71	read: "anyone",
	72	keys: [
	73	{ key: "e", label: "e set a rate" },
	74	{ key: "d", label: "d default rate" },
	75	{ key: "x", label: "x remove" },
	76	],
	77	},
	78	};
	79
	80	/** True when this key on this tab is the desk's work, and so an admin's. */
	81	export const needsAdmin = (tab: Tab, key: string): boolean => DESK[tab].keys.some((offer) => offer.key === key);
	82
	83	/** True when what is printed on this tab is an admin's to read. */
	84	export const needsAdminToRead = (tab: Tab): boolean => DESK[tab].read === "admin";
	85
	86	/** The tabs this person may open. A non-admin gets the ones that are not private. */
	87	export const visible = (who: Who): Tab[] =>
	88	TABS.filter((tab) => who.role === "admin" \|\| !needsAdminToRead(tab));
	89
	90	/** What this person may do on this tab. Nothing, unless the forge named an admin. */
	91	export const offered = (tab: Tab, who: Who): string[] =>
	92	who.role === "admin" ? DESK[tab].keys.map((offer) => offer.label) : [];
	93
	94	const no = (message: string): Done => ({ ok: false, message });
	95	const yes = (message: string): Done => ({ ok: true, message });
	96
	97	const words = (line: string): string[] => line.trim().split(/\s+/).filter((word) => word !== "");
	98
	99	/** "20%" is a percentage, "free" is free shipping, "5" and "$5.00" are money. */
	100	function readValue(text: string): { kind: "percent" \| "fixed" \| "free_shipping"; value: number } \| undefined {
		sentinelcrew 1mo ago outdated I bought `/p/gift-card` on the preview, paid the mock gateway, took `GC-····M8RG` off the receipt and typed it at `/gift-cards`: balance, issue amount and the ledger row came back in 149 ms, the code was not echoed, the lookup is a POST with a CSRF token (a POST without one is 403), and an unknown code is refused in the cart's own words. The `redeem` fix is the best part of this pull — putting the window into the same conditional `UPDATE` that takes the use is the right place for it, and the test that would fail without the window condition proves it. Two things need fixing before this lands. 1. High — the branch predates the identity change, and its new terminal actions have no role check. This is based on `5991215`; `main` is now `1d0fbed`, and the pull does not merge (conflicts in `README.md`, `src/tty.ts`, `src/units.test.ts`). `src/tty.ts` here imports `ensureDemoPassword` from `src/session.ts` and prints `/admin password (generated, …)` on the first screen — that export is gone from `main`, so the terminal will not even start after the merge. More important: `main`'s tty takes who is at the keyboard from `atKeyboard()` and gates `s` and `r` on `person.role === "admin"`, and the seven new keys added here — `n`, `t`, `i`, `v`, `e`, `d`, `x` — are ungated, so a non-admin who reaches the terminal could mint gift cards, write a customer's balance to zero and rewrite the tax table. The README says it outright: "Whoever got through `ssh` is as privileged as `/admin`". That is the assumption `main` deliberately dropped. Fix first: rebase onto `main`, delete the generated-password lines from `src/tty.ts` and the README, and put `isAdmin` in front of every desk action exactly as `main` does for `s` and `r` (`if (key === "i" && tab === "cards" && isAdmin)`, and the same for the rest — `c`/`look` prints a discount's full terms and a card's balance, so gate that too; leave tabs 4–6 readable). The desk itself is well shaped: text in, message out, tested without a pty, work done through the same modules the admin pages use. It only needs the door in front of it. 2. Medium — the guessing limit on `/gift-cards` does not hold in front of a real client. Fourteen POSTs from here with a rotating `x-forwarded-for` all answered 200; the same fourteen without the header hit 429 with `retry-after: 10` after ten. `context()` in `src/server.ts` builds `ctx.ip` from the first entry of a client-supplied header, so the bucket the README and the new test both rely on is keyed on something the guesser chooses. 32^12 of code space means blind guessing is impractical regardless, so this is defence in depth rather than an open till — but this pull is the one that puts a discoverable, footer-linked oracle on a bearer instrument, so it is the pull that should make the limit real: prefer `self.requestIP()` and only consult `x-forwarded-for` when the forge's proxy is known to be in front, taking the last hop rather than the first. `src/server.ts` is untouched here, which is why this is second and not first. 3. Low — the ledger shows the shop's own words to the card holder. `entriesOf` reasons are printed verbatim, so the reason an admin types when voiding a card (`v` prompts "Void it — reason:") lands on a page anyone holding the code can read. It is escaped, so this is disclosure and not injection, but "voided" would serve the holder just as well as whatever the admin typed to themselves. 4. Nit — the confirmation page does not say where the code is. `/orders/:number` shows the paid gift card line with no hint that the only copy of the code is one click away on the receipt; a buyer who closes that tab has nothing. One sentence on the confirmation next to the gift card line would save the support mail. The balance window is a good idea, the shape is right (a page module, a handler, the existing bucket, no new dependency), and the direction is served: a stranger can still buy the one thing and the money trail still reconciles. Rebase, gate the terminal, and I will look again.
	101	const lowered = text.toLowerCase();
	102	if (lowered === "free" \|\| lowered === "freeship" \|\| lowered === "shipping")
	103	return { kind: "free_shipping", value: 0 };
	104	if (text.endsWith("%")) {
	105	const points = parseCents(text.slice(0, -1));
	106	return points === undefined \|\| points > 10000 ? undefined : { kind: "percent", value: points };
	107	}
	108	const cents = parseCents(text);
	109	return cents === undefined \|\| cents === 0 ? undefined : { kind: "fixed", value: cents };
	110	}
	111
	112	export const NEW_DISCOUNT_SHAPE = "CODE 20% [min 25] [uses 100] [until 2026-12-31]";
	113
	114	/** "SPRING20 20% min 25 uses 100 until 2026-12-31" — one code, however limited. */
	115	export function newDiscount(line: string): Done {
	116	const parts = words(line);
	117	const code = discounts.normalizeCode(parts[0] ?? "");
	118	if (code.length < 3) return no("A code is at least three letters, like SPRING20.");
	119	const worth = readValue(parts[1] ?? "");
	120	if (!worth) return no(`A discount is 20%, 5.00 or free. Say: ${NEW_DISCOUNT_SHAPE}`);
	121
	122	let min = 0;
	123	let uses: number \| null = null;
	124	let expires: string \| null = null;
	125	for (let i = 2; i < parts.length; i += 2) {
	126	const word = parts[i]!.toLowerCase();
	127	const argument = parts[i + 1] ?? "";
	128	if (word === "min") {
	129	const cents = parseCents(argument);
	130	if (cents === undefined) return no("A minimum is an amount of money, like 25 or 25.00.");
	131	min = cents;
	132	} else if (word === "uses" \|\| word === "max") {
	133	if (!/^\d{1,6}$/.test(argument)) return no("A limit is a whole number of uses, like 100.");
	134	uses = Number(argument);
	135	} else if (word === "until" \|\| word === "expires") {
	136	const day = discounts.endOfDay(argument);
	137	if (day === undefined) return no("An expiry is a date like 2026-12-31.");
	138	expires = day;
	139	} else return no(`I do not know "${word}". Say: ${NEW_DISCOUNT_SHAPE}`);
	140	}
	141
	142	if (discounts.byCode(code)) return no(`${code} already exists.`);
	143	try {
	144	const id = discounts.create({
	145	code,
	146	kind: worth.kind,
	147	value: worth.value,
	148	min_subtotal_cents: min,
	149	max_redemptions: uses,
	150	starts_at: null,
	151	expires_at: expires,
	152	});
	153	const made = discounts.byId(id)!;
	154	return yes(
	155	`${made.code} — ${discounts.describe(made)}${min > 0 ? `, over ${formatCents(min)}` : ""}${
	156	uses === null ? "" : `, ${uses} use${uses === 1 ? "" : "s"}`
	157	}${expires === null ? "" : `, until ${expires.slice(0, 10)}`}.`,
	158	);
	159	} catch {
	160	return no(`${code} could not be created.`);
	161	}
	162	}
	163
	164	export function toggleDiscount(id: number): Done {
	165	const found = discounts.byId(id);
	166	if (!found) return no("No code selected.");
	167	discounts.setActive(found.id, found.active !== 1);
	168	return yes(`${found.code} is now ${found.active === 1 ? "off" : "on"}.`);
	169	}
	170
	171	/** "25 a sorry-for-the-wait card": an amount, then the reason it exists. */
	172	export function issueCard(line: string): Done {
	173	const parts = words(line);
	174	const cents = parseCents(parts[0] ?? "");
	175	if (cents === undefined \|\| cents <= 0) return no("A card is worth an amount of money, like 25 or 25.00.");
	176	const issued = giftcards.issue({ cents, note: parts.slice(1).join(" ").slice(0, 120) \|\| "issued at the terminal" });
	177	return yes(`${issued.code} — ${formatCents(cents)}. This is the only copy of the code.`);
	178	}
	179
	180	export function toggleCard(id: number, reason: string): Done {
	181	const card = giftcards.byId(id);
	182	if (!card) return no("No card selected.");
	183	const reviving = card.active !== 1;
	184	giftcards.setActive(card.id, reviving, reason.trim() \|\| "voided at the terminal");
	185	return yes(
	186	reviving
	187	? `····${card.last4} can be used again; it holds ${formatCents(giftcards.byId(card.id)!.balance_cents)}.`
	188	: `····${card.last4} is void and its ${formatCents(card.balance_cents)} written off.`,
	189	);
	190	}
	191
	192	/**
	193	* One box for both kinds of code, the same as the cart's: whoever is asking
	194	* does not know which of the two they were handed.
	195	*/
	196	export function look(typed: string): Done {
	197	const asDiscount = discounts.byCode(typed);
	198	if (asDiscount)
	199	return yes(
	200	`${asDiscount.code} — ${discounts.describe(asDiscount)}${
	201	asDiscount.min_subtotal_cents > 0 ? ` over ${formatCents(asDiscount.min_subtotal_cents)}` : ""
	202	}, used ${asDiscount.used_count}${asDiscount.max_redemptions === null ? "" : ` of ${asDiscount.max_redemptions}`}${
	203	asDiscount.expires_at ? `, until ${asDiscount.expires_at.slice(0, 10)}` : ""
	204	}${asDiscount.active === 1 ? "" : " (off)"}.`,
	205	);
	206	const card = giftcards.byCode(typed);
	207	if (card)
	208	return yes(
	209	`····${card.last4} holds ${formatCents(card.balance_cents)} of ${formatCents(card.initial_cents)}${
	210	card.active === 1 ? "" : " (void)"
	211	}${card.note ? ` — ${card.note}` : ""}.`,
	212	);
	213	return no("That is not a code this shop knows.");
	214	}
	215
	216	export const RATE_SHAPE = "COUNTRY / REGION / 8.75 / what to call it";
	217
	218	/** "UNITED STATES / CA / 8.75 / California sales tax"; an empty region is the country's own. */
	219	export function setRate(line: string): Done {
	220	const parts = line.split("/").map((part) => part.trim());
	221	if (parts.length < 3) return no(`A rate is: ${RATE_SHAPE}`);
	222	const country = tax.normalize(parts[0] ?? "");
	223	const region = tax.normalize(parts[1] ?? "");
	224	const points = parseCents(parts[2] ?? "");
	225	if (country === "") return no("A rate needs a country.");
	226	if (points === undefined \|\| points > 10000) return no("A rate is a percentage between 0 and 100, like 8.75.");
	227	const label = (parts[3] ?? "").slice(0, 60).trim() \|\| `${country}${region ? ` ${region}` : ""} tax`;
	228	tax.upsertRate({ country, region, rate_bp: points, label, active: true });
	229	return yes(`${country}${region ? ` ${region}` : ""} — ${(points / 100).toFixed(2)}% (${label}).`);
	230	}
	231
	232	export function setDefaultRate(text: string): Done {
	233	const points = parseCents(text.trim());
	234	if (points === undefined \|\| points > 10000) return no("A rate is a percentage between 0 and 100, like 8.5.");
	235	tax.setDefaultRateBp(points);
	236	return yes(`Anywhere the table does not name is taxed at ${(points / 100).toFixed(2)}%.`);
	237	}
	238
	239	export function removeRate(id: number, confirmation: string): Done {
	240	const rate = tax.rateById(id);
	241	if (!rate) return no("No rate selected.");
	242	if (!/^y(es)?$/i.test(confirmation.trim())) return no(`${rate.country} ${rate.region} kept.`);
	243	tax.removeRate(rate.id);
	244	return yes(`${rate.country}${rate.region ? ` ${rate.region}` : ""} removed; it now falls to the default.`);
	245	}
		@@ -49,6 +49,24 @@ export const describe = (discount: Discount): string =>
49	49	? `${formatCents(discount.value)} off`
50	50	: "free shipping";
51	51
	52	/** The shape dates are stored in: "2026-12-31 23:59:59", comparable as text. */
	53	export const stampOf = (now: Date): string => now.toISOString().slice(0, 19).replace("T", " ");
	54
	55	/**
	56	* The last second of a day, or undefined when that is not a day.
	57	*
	58	* Stamps are compared as text, so a date nobody can reach — 2026-99-99, or
	59	* the 30th of February — sorts after every real one and makes a code that
	60	* never expires. The shape is not enough: the day is parsed and round-tripped,
	61	* and only a date that comes back as itself is stored.
	62	*/
	63	export function endOfDay(day: string): string \| undefined {
	64	if (!/^\d{4}-\d{2}-\d{2}$/.test(day)) return undefined;
	65	const parsed = new Date(`${day}T00:00:00Z`);
	66	if (Number.isNaN(parsed.getTime()) \|\| parsed.toISOString().slice(0, 10) !== day) return undefined;
	67	return `${day} 23:59:59`;
	68	}
	69
52	70	/**
53	71	* Is this code usable right now, against this much in goods? The answer is
54	72	* advice: `redeem` decides, inside the order's transaction.
		@@ -57,7 +75,7 @@ export function evaluate(code: string, base_cents: number, now = new Date()): Ch
57	75	const discount = byCode(code);
58	76	if (!discount) return { ok: false, error: "That code is not one this shop knows." };
59	77	if (discount.active !== 1) return { ok: false, error: `${discount.code} is no longer being accepted.` };
60		const stamp = now.toISOString().slice(0, 19).replace("T", " ");
	78	const stamp = stampOf(now);
61	79	if (discount.starts_at && stamp < discount.starts_at)
62	80	return { ok: false, error: `${discount.code} cannot be used yet.` };
63	81	if (discount.expires_at && stamp > discount.expires_at)
		@@ -82,14 +100,20 @@ export function evaluate(code: string, base_cents: number, now = new Date()): Ch
82	100	/**
83	101	* Take one use of the code for an order. False when there was none left to
84	102	* take — the caller is inside a transaction and turns that into a refusal.
	103	*
	104	* Every limit the code carries is in this one statement: whether it is on,
	105	* whether now is inside its window, and whether a use is left. `evaluate`
	106	* said the same thing a moment earlier, but only this decides, so a code that
	107	* expired or was switched off in between is not taken anyway.
85	108	*/
86		export function redeem(discountId: number, orderId: number, amount_cents: number): boolean {
	109	export function redeem(discountId: number, orderId: number, amount_cents: number, now = new Date()): boolean {
87	110	const changes = db
88	111	.query(
89	112	`UPDATE discount SET used_count = used_count + 1
90		WHERE id = ?1 AND active = 1 AND (max_redemptions IS NULL OR used_count < max_redemptions)`,
	113	WHERE id = ?1 AND active = 1 AND (max_redemptions IS NULL OR used_count < max_redemptions)
	114	AND (starts_at IS NULL OR starts_at <= ?2) AND (expires_at IS NULL OR expires_at >= ?2)`,
91	115	)
92		.run(discountId).changes;
	116	.run(discountId, stampOf(now)).changes;
93	117	if (changes !== 1) return false;
94	118	db.query(
95	119	"INSERT INTO discount_redemption (discount_id, order_id, kind, amount_cents) VALUES (?1, ?2, 'redeemed', ?3)",
		@@ -67,6 +67,37 @@ export const entriesOf = (giftCardId: number, limit = 50): Entry[] =>
67	67	)
68	68	.all(giftCardId, limit);
69	69
	70	export type PublicEntry = { at: string; delta: number; what: string };
	71
	72	/**
	73	* The card's movements as the person holding the code is told them.
	74	*
	75	* The `reason` column is where the shop talks to itself: an admin types one
	76	* when they void a card, and that note was written to a colleague, not to a
	77	* customer. The row's own facts say everything the holder needs — which way
	78	* the money went, and whether an order was involved — so the words here are
	79	* the shop's, fixed, and the same for every card.
	80	*/
	81	export function publicEntriesOf(giftCardId: number, limit = 50): PublicEntry[] {
	82	const first = db
	83	.query<{ id: number \| null }, [number]>("SELECT MIN(id) AS id FROM gift_card_entry WHERE gift_card_id = ?1")
	84	.get(giftCardId);
	85	return entriesOf(giftCardId, limit).map((entry) => ({
	86	at: entry.at,
	87	delta: entry.delta,
	88	what:
	89	entry.id === first?.id
	90	? "Issued"
	91	: entry.delta > 0
	92	? entry.order_id === null
	93	? "Put on the card"
	94	: "Put back from an order"
	95	: entry.order_id === null
	96	? "Taken off the card"
	97	: "Spent on an order",
	98	}));
	99	}
	100
70	101	export const entriesForOrder = (orderId: number): (Entry & { last4: string })[] =>
71	102	db
72	103	.query<Entry & { last4: string }, [number]>(
		@@ -90,8 +90,8 @@ export function layout(chrome: Chrome): string {
90	90	<footer class="bottom"><div class="wrap">
91	91	<p><span class="env" style="background: ${env === "production" ? "#16653d" : "#1d4ed8"}">${escape(where)}</span>
92	92	${commit ? `<span class="muted"> @ ${escape(commit)}</span>` : ""}
93		— a demonstration store: no goods ship and no money moves.
94		<a href="/orders">Find an order</a></p>
	93	— a demonstration store: no goods ship and no money moves.</p>
	94	<p><a href="/orders">Find an order</a> · <a href="/gift-cards">Gift cards</a> — buy one, or see what is left on the one you hold.</p>
95	95	<p>${
96	96	ssh
97	97	? `Same shop in a terminal: <code>${escape(ssh)}</code>`
		@@ -49,7 +49,8 @@ export function receiptText(order: Order, items: OrderItem[], giftCardCodes: str
49	49	"",
50	50	"Your gift card" + (giftCardCodes.length === 1 ? "" : "s") + " — this is the only copy of the code:",
51	51	...giftCardCodes.map((code) => ` ${code}`),
52		" Type it at the cart to spend it. It never expires.",
	52	" Type it at the cart to spend it, or at /gift-cards to see what is",
	53	" left on it. It never expires.",
53	54	]
54	55	: []),
55	56	"",
		@@ -198,7 +198,7 @@ export function place(input: {
198	198	if (priced.discount_code !== "") {
199	199	const discount = discounts.byCode(priced.discount_code)!;
200	200	if (!discounts.redeem(discount.id, created.id, priced.discount_cents))
201		throw new Error(`CODE_GONE:${priced.discount_code} was used up while you were checking out.`);
	201	throw new Error(`CODE_GONE:${priced.discount_code} stopped applying while you were checking out.`);
202	202	note(created.id, "discount", `${discount.code} — ${discounts.describe(discount)}`);
203	203	}
204	204	if (priced.gift_card_cents > 0) {
		@@ -59,6 +59,9 @@ export function codeBox(quote: Quote, session: Session, back: "cart" \| "checkout
59	59	${quote.discount_code !== "" ? remove("discount", quote.discount_code) : ""}
60	60	${quote.gift_card_last4 !== "" ? remove("gift", `····${quote.gift_card_last4}`) : ""}
61	61	</div>
	62	<p class="muted" style="margin:.5rem 0 0; font-size:.88rem">
	63	Holding a gift card? <a href="/gift-cards">See what is left on it</a>.
	64	</p>
62	65	</div>`;
63	66	}
64	67
		@@ -203,6 +203,9 @@ export function confirmation(
203	203	who: Who,
204	204	): string {
205	205	const paid = order.status === "paid" \|\| order.status === "refunded" \|\| order.status === "partially_refunded";
	206	// A card's code is printed once, on the receipt. Say so here: a buyer who
	207	// closes this tab without opening it has bought something they cannot spend.
	208	const cards = items.reduce((count, item) => count + (item.gift_card_cents > 0 ? item.quantity : 0), 0);
206	209	return `
207	210	<h1>${paid ? "Thank you" : "Order " + escape(order.number)}</h1>
208	211	<p class="lede">Order ${escape(order.number)} · ${statusPill(order.status)} · placed ${escape(order.created_at)} UTC</p>
		@@ -219,6 +222,15 @@ ${
219	222	— this store has no mail server, so receipts are kept here instead of sent.</p>`
220	223	: ""
221	224	}
	225	${
	226	paid && cards > 0
	227	? `<p class="notice">${cards === 1 ? "The gift card's code is" : `The ${cards} gift card codes are`} on the receipt,
	228	and that is the only copy. <a href="/orders/${escape(order.number)}/receipt?token=${escape(
	229	order.access_token,
	230	)}">Open the receipt</a> and keep ${cards === 1 ? "it" : "them"} somewhere safe — whoever has the code can spend it,
	231	and <a href="/gift-cards">/gift-cards</a> says what is left on one.</p>`
	232	: ""
	233	}
222	234	${itemsTable(items)}
223	235	${orderTotals(order, refunded)}
224	236	<h2>Shipping to</h2>