commerce/crates/core/src/ at main · lgtm.shop/commerce · Tangled

lgtm.shop / commerce

5

Pilot atproto-native commerce backend

5

commerce / crates / core / src /

at main 13 files

Nate Moore feat(config): add LGTM_SHOP_URL to derive both checkout redirect URLs 1d ago

fix(checkout): make real Stripe checkout succeed (was a bare 400 for every order) With fake-payments off, every POST /api/checkout returned an empty-body 400. The real Stripe path could never succeed: place_order sent empty success_url/ cancel_url and DbVariantLookup left product_uri (used as the Stripe line-item name) empty. Stripe rejects both, and the handler swallowed the error with a bare `Err(_) => 400`, making it undebuggable from the storefront. - Thread configurable redirect URLs through place_order. New optional env vars LGTM_CHECKOUT_SUCCESS_URL / LGTM_CHECKOUT_CANCEL_URL, defaulting to {public_url}/checkout/success?session_id={CHECKOUT_SESSION_ID} and {public_url}/cart. - DbVariantLookup joins product for the real at_uri + title; carry a display name through VariantInfo -> DraftLine -> OrderItem to the Stripe line item (fallback title -> SKU -> "Item"). Name is a checkout-time snapshot, not persisted in P1. - Map checkout errors: validation/currency/not-found -> descriptive 400; missing key / provider rejection -> logged in full + generic 502, never a bare empty 400. Tests: place_order fake now asserts non-empty URLs + names are forwarded; DbVariantLookup join covered (title + SKU fallback); config default/override.

1 day ago

feat(config): add LGTM_SHOP_URL to derive both checkout redirect URLs Stripe success/cancel redirects belong on the storefront (www), not the backend public_url. Add LGTM_SHOP_URL as the storefront base so a single var drives both redirects; falls back to public_url when unset. LGTM_CHECKOUT_SUCCESS_URL / LGTM_CHECKOUT_CANCEL_URL still override individually. Documented in .env.example and the README env table.

1 day ago

M0 T2: docker-compose postgres, .env.example, Config + seal/open crypto helpers Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago

M5/6 T25: PgPermissionedStore — PG-backed PermissionedStore with 2-member ACL + cross-space isolation Phase 1 backing for lgtm_core::store::PermissionedStore (SPEC §8). ensure_space upserts space + 2-member list (idempotent on owner/type/skey, is_public=false); put/get/list/delete dispatch on collection to order_record / address_record (body_enc sealed with ChaCha20-Poly1305) / receipt_record (cbor+sig+sha256 receipt_hash) / fulfillment. assert_member enforces the 2-member confidentiality boundary against cross-customer leakage (cycle f proves a non-member DID is rejected with Error::NotAMember). Also adds Error::Store variant to lgtm_core and #[derive(Clone, Debug)] to RecordAddr to support addr.clone() in get/list. 9/9 tests pass against live Postgres (sqlx::test isolated pools). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago

M9 T33: web InboundSurface — cart -> validated, priced DraftOrder Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago

core: ids newtypes, Currency/Money, Error enum Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago

feat(core): route fulfillment webhooks + Printful URL-token auth - Registry::fulfillment_by_id resolves a fulfillment provider by integration id. - Integration::verify_webhook gains a query: &str param so each provider owns its auth (Stripe: signature header; Printful: URL token). - Printful does not sign webhooks (confirmed against developers.printful.com), so drop the invented x-printful-signature HMAC and authenticate via a shared token in the registered webhook URL (?token=<secret>), constant-time compared.

2 days ago

feat(integrations): Stripe PaymentProvider with webhook verify + event mapping - Adds hmac + hex to workspace deps - Adds NullStore + Registry::empty() to lgtm-core for test fixtures - Derives Debug on NormalizedEvent (needed for test assertions) - Implements StripePayment: HMAC-SHA256 webhook sig verification, PaymentCaptured/PaymentRefunded event mapping, create_subscription->Unsupported - All 7 Stripe unit tests pass; live checkout test is #[ignore]d Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago

M9 T33: web InboundSurface — cart -> validated, priced DraftOrder Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago

fix(checkout): make real Stripe checkout succeed (was a bare 400 for every order) With fake-payments off, every POST /api/checkout returned an empty-body 400. The real Stripe path could never succeed: place_order sent empty success_url/ cancel_url and DbVariantLookup left product_uri (used as the Stripe line-item name) empty. Stripe rejects both, and the handler swallowed the error with a bare `Err(_) => 400`, making it undebuggable from the storefront. - Thread configurable redirect URLs through place_order. New optional env vars LGTM_CHECKOUT_SUCCESS_URL / LGTM_CHECKOUT_CANCEL_URL, defaulting to {public_url}/checkout/success?session_id={CHECKOUT_SESSION_ID} and {public_url}/cart. - DbVariantLookup joins product for the real at_uri + title; carry a display name through VariantInfo -> DraftLine -> OrderItem to the Stripe line item (fallback title -> SKU -> "Item"). Name is a checkout-time snapshot, not persisted in P1. - Map checkout errors: validation/currency/not-found -> descriptive 400; missing key / provider rejection -> logged in full + generic 502, never a bare empty 400. Tests: place_order fake now asserts non-empty URLs + names are forwarded; DbVariantLookup join covered (title + SKU fallback); config default/override.

1 day ago

feat(spaces): align permissioned addressing/type/authority with 0016 draft ats:// 6-component space_uri + space_ref_uri; orderSpace space declaration (type:space) whose collections are the four permissioned leaves; ensure_space uses the orderSpace space type (record collections unchanged); buyer OAuth scope is space:...orderSpace; space_did authority = store_did (simplespace, no minted per-space DID). PG-canonical runtime behavior unchanged.

1 week ago

fix(checkout): make real Stripe checkout succeed (was a bare 400 for every order) With fake-payments off, every POST /api/checkout returned an empty-body 400. The real Stripe path could never succeed: place_order sent empty success_url/ cancel_url and DbVariantLookup left product_uri (used as the Stripe line-item name) empty. Stripe rejects both, and the handler swallowed the error with a bare `Err(_) => 400`, making it undebuggable from the storefront. - Thread configurable redirect URLs through place_order. New optional env vars LGTM_CHECKOUT_SUCCESS_URL / LGTM_CHECKOUT_CANCEL_URL, defaulting to {public_url}/checkout/success?session_id={CHECKOUT_SESSION_ID} and {public_url}/cart. - DbVariantLookup joins product for the real at_uri + title; carry a display name through VariantInfo -> DraftLine -> OrderItem to the Stripe line item (fallback title -> SKU -> "Item"). Name is a checkout-time snapshot, not persisted in P1. - Map checkout errors: validation/currency/not-found -> descriptive 400; missing key / provider rejection -> logged in full + generic 502, never a bare empty 400. Tests: place_order fake now asserts non-empty URLs + names are forwarded; DbVariantLookup join covered (title + SKU fallback); config default/override.

1 day ago

M9 T33: web InboundSurface — cart -> validated, priced DraftOrder Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

1 month ago