libretech bfcbbfac39 fix(orders): forward only the checkout's fields on an order update ...

PUT /api/orders/:uuid forwarded the browser's body to the CMS unchanged. It
now forwards { data } with only the seven fields of the checkout's steps:
email, acceptedTermsAndConditionsAt, invoiceAddress, deliveryAddress,
invoiceAddressStructured, deliveryAddressStructured and delivery. Any other
field, a field beside data, or a body of another shape is answered 400
"Invalid order update" with the CMS's error format, without calling the
CMS. The values are left to the CMS, which checks them and stays the
authority; this is defence in depth.

pickCustomerUpdate (server/utils/customerUpdate.ts) is pure and tested with
the exact payloads of steps 1 and 2 and with every server-only attribute of
the order.

Refs libretech/mp#71

2026-10-09 02:32:20 +02:00

..

cmsApi.ts

feat(orders): pass the CMS's status and safe error fields to the browser

2026-10-09 02:32:14 +02:00

cmsError.ts

feat(orders): pass the CMS's status and safe error fields to the browser

2026-10-09 02:32:14 +02:00

coverSlug.ts

feat: extract shop from mp/shop — initial libreshop/shop

2026-04-29 17:48:56 +02:00

customerUpdate.ts

fix(orders): forward only the checkout's fields on an order update

2026-10-09 02:32:20 +02:00