3 Commits

Include renames

Author	SHA1	Message	Date
libretech	66e5800418	fix(order): capture only the PayPal order the checkout stored, verified against the order ... The capture took the PayPal order id from the URL and captured it with Prefer: return=minimal, then marked the order paid on status COMPLETED. The checkout never stored its PayPal order (the paypalOrderId written at capture was no schema attribute and was dropped), and neither the order nor the amount was compared. A buyer could pay a cheap order and call the capture of an expensive one with that PayPal order id: the expensive order was marked paid and invoiced. checkPaymentStatus also turned every error into the string "/result/error", which failed the capture without a log. checkout now answers 409 for a paid order and 400 with the missing fields for an order without email, invoice address or delivery method. It stores the id of the PayPal order it created as paypalOrderId and answers { id, links } as before. A PayPal error is answered 502. capturePayment is an adapter for src/checkout/capture-payment.ts. It reads the PayPal order with GET, captures with Prefer: return=representation and a PayPal-Request-Id, and writes paymentAuthorised, paymentStatus "captured", paypalCaptureId and paymentCapturedAt with where { id, paypalOrderId }. updateByUuid, addProduct and removeProduct set paypalOrderId to null in the write that changes the order, so a changed cart or address needs a new checkout, and an earlier approval cannot be captured for it. PayPalApi gains getOrder and captureOrder, which return PayPal's parsed JSON and let errors propagate. createSessionOrThrow logs an error by name, message and status code instead of the error object, which holds the request with its Authorization header; its request building is unchanged. Refs libretech/mp#71	2026-10-09 01:12:31 +02:00
libretech	9b0c6af8b7	Test the checkout code; publish images only for releases (#5) ... - src/checkout/ (PayPal order request, pricing, VAT) and src/logging/format.ts hold the checkout's pure code, moved out of PayPalApi, the product service and config without a behaviour change. - npm test runs node:test on the TypeScript sources (type stripping), with no dependencies: 21 tests, 13 pin today's output, 8 describe the correct behaviour for the known defects of libretech/mp#67 and are marked todo. - CI: the tests run in the image's base (node:22.14.0-alpine) for every pull request, push to main and release tag. The image is built for pull requests and built and published only for v* tags; main no longer publishes :main and :sha-* images. Refs libretech/mp#71 Co-authored-by: Michael Czechowski <mail@librete.ch>	2026-10-08 22:36:47 +02:00
Michael Czechowski	32a296baf2	feat: extract cms from mp/cms — initial libreshop/cms ... Source moved verbatim from mp/cms/ on 2026-04-29; mp was the first concrete adapter consuming the libreshop toolkit. Builds and publishes git.librete.ch/libreshop/cms on every main / v* push via the standard .gitea/workflows/build.yml shared across libreshop components.	2026-04-29 17:48:30 +02:00