commerce/crates/core/src/ at main · lgtm.shop/commerce · Tangled

lgtm.shop / commerce

6

Pilot atproto-native commerce backend

6

commerce / crates / core / src /

at main 16 files

Nate Moore feat(core): set a User-Agent on all outbound third-party HTTP 4w ago

feat(core): channel-assertion verification (HS256 trusted-transport JWT) + config gating

4 weeks ago

feat(fulfillment): Order carries shipping recipient; Printful submit sends it Add Recipient (name/email/raw address) to the Order domain type and build the Printful POST /orders recipient block from it, mapping Stripe's address shape to Printful's. A physical order with no recipient is a typed error — never POST an unfulfillable draft. Recipient is None at draft time; the paid webhook seals it on and the worker loads it (subsequent commits).

1 month ago

feat(core): channel-assertion verification (HS256 trusted-transport JWT) + config gating

4 weeks ago

M0 T2: docker-compose postgres, .env.example, Config + seal/open crypto helpers Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 months ago

feat(core): canonical DAG-CBOR encoding + real CIDv1 record addressing

1 month ago

M5/6 T25: PgPermissionedStore — PG-backed PermissionedStore with 2-member ACL + cross-space isolation Phase 1 backing for lgtm_core::store::PermissionedStore (SPEC §8). ensure_space upserts space + 2-member list (idempotent on owner/type/skey, is_public=false); put/get/list/delete dispatch on collection to order_record / address_record (body_enc sealed with ChaCha20-Poly1305) / receipt_record (cbor+sig+sha256 receipt_hash) / fulfillment. assert_member enforces the 2-member confidentiality boundary against cross-customer leakage (cycle f proves a non-member DID is rejected with Error::NotAMember). Also adds Error::Store variant to lgtm_core and #[derive(Clone, Debug)] to RecordAddr to support addr.clone() in get/list. 9/9 tests pass against live Postgres (sqlx::test isolated pools). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 months ago

feat(stripe): capture buyer email + shipping recipient + amounts from session Widen NormalizedEvent::PaymentCaptured with an optional CheckoutCapture carrying the session id, buyer email, recipient name+address, and shipping/tax totals that Stripe collects on a completed Checkout Session (accepts both the current collected_information.shipping_details and the legacy shipping_details location). Non-Stripe providers pass None.

1 month ago

core: ids newtypes, Currency/Money, Error enum Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 months ago

feat(core): route fulfillment webhooks + Printful URL-token auth - Registry::fulfillment_by_id resolves a fulfillment provider by integration id. - Integration::verify_webhook gains a query: &str param so each provider owns its auth (Stripe: signature header; Printful: URL token). - Printful does not sign webhooks (confirmed against developers.printful.com), so drop the invented x-printful-signature HMAC and authenticate via a shared token in the registered webhook URL (?token=<secret>), constant-time compared.

1 month ago

feat(core): set a User-Agent on all outbound third-party HTTP Shared lgtm_core::user_agent() -> "lgtm.shop/commerce@v{version}" applied to every outbound client: the Resolver (Slingshot/PLC/PDS probes), the atproto OAuth client, and the Stripe + Printful clients. Identifying ourselves is basic good-netizen practice.

4 weeks ago

M9 T33: web InboundSurface — cart -> validated, priced DraftOrder Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 months ago

feat(core): set a User-Agent on all outbound third-party HTTP Shared lgtm_core::user_agent() -> "lgtm.shop/commerce@v{version}" applied to every outbound client: the Resolver (Slingshot/PLC/PDS probes), the atproto OAuth client, and the Stripe + Printful clients. Identifying ourselves is basic good-netizen practice.

4 weeks ago

feat(fulfillment): Order carries shipping recipient; Printful submit sends it Add Recipient (name/email/raw address) to the Order domain type and build the Printful POST /orders recipient block from it, mapping Stripe's address shape to Printful's. A physical order with no recipient is a typed error — never POST an unfulfillable draft. Recipient is None at draft time; the paid webhook seals it on and the worker loads it (subsequent commits).

1 month ago

fix: align permissioned-data addressing + OAuth scope with 0016 alpha Reconcile the permissioned (spaces) tier against the current alpha state of atproto#5187 and proposals#100. Two real bugs plus spec drift. - URI scheme: permissioned records now use the public at:// scheme with a literal `space` marker segment, not a distinct ats:// scheme. Fix space_uri/space_ref_uri (+ tests), createAddress ref builder/assert, and the spaceRef lexicon descriptions. - OAuth scope: name the store authority explicitly (authority defaults to self); a bare space:{type} scope authorized nothing in store-anchored order spaces. - Sync surface: getRepoState -> getLatestCommit + getRepo; note DPoP-bound space credential and unregisterNotify. - Soften the §1 relationship-enumeration invariant for the new listSpaces; document the three simplespace policies (managing-app as a guest->DID lever) and member-preserving space deletion.

1 month ago

fix(checkout): make real Stripe checkout succeed (was a bare 400 for every order) With fake-payments off, every POST /api/checkout returned an empty-body 400. The real Stripe path could never succeed: place_order sent empty success_url/ cancel_url and DbVariantLookup left product_uri (used as the Stripe line-item name) empty. Stripe rejects both, and the handler swallowed the error with a bare `Err(_) => 400`, making it undebuggable from the storefront. - Thread configurable redirect URLs through place_order. New optional env vars LGTM_CHECKOUT_SUCCESS_URL / LGTM_CHECKOUT_CANCEL_URL, defaulting to {public_url}/checkout/success?session_id={CHECKOUT_SESSION_ID} and {public_url}/cart. - DbVariantLookup joins product for the real at_uri + title; carry a display name through VariantInfo -> DraftLine -> OrderItem to the Stripe line item (fallback title -> SKU -> "Item"). Name is a checkout-time snapshot, not persisted in P1. - Map checkout errors: validation/currency/not-found -> descriptive 400; missing key / provider rejection -> logged in full + generic 502, never a bare empty 400. Tests: place_order fake now asserts non-empty URLs + names are forwarded; DbVariantLookup join covered (title + SKU fallback); config default/override.

1 month ago

M9 T33: web InboundSurface — cart -> validated, priced DraftOrder Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 months ago