libretech
20afcd4416
PUT /orders/:uuid/cart passed the body through sanitize.contentAPI.input, which keeps every public writable attribute, to the order update. The shop forwards the browser's body unchanged, so a browser could set paymentAuthorised on its own order, and the order lifecycle then generated and mailed the invoice. The handler now parses the body with parseCustomerUpdate and writes only the fields it returns, plus the customer it finds or creates from the invoice address. A body with any other field is answered 400 with the error list, and the warning it logs names the fields, not their values. A delivery method that does not exist is answered 400. Once the payment is authorised, the order is locked for the customer: the update, add-product and remove-product answer 409. Refs libretech/mp#71
libreshop/cms
Strapi-based content backend (catalogue, orders, customers).
Part of the libreshop toolkit. Image
published at git.librete.ch/libreshop/cms on every push to main
and on v* tags.
Source
This repo was extracted from mp/cms/ on 2026-04-29; mp was the
first concrete adapter consuming the toolkit. mp's compose.yml now
pulls git.librete.ch/libreshop/cms:<pin> instead of building locally.
Build locally
docker build -t libreshop/cms:dev .
Adapter contract
See docker-entrypoint.sh and Dockerfile for the runtime surface.
Adapters configure the component via env vars and bind-mounted volumes;
do not patch the running container or rely on internal paths.