{{ $installation->app->name }}
Installed {{ $installation->installed_at?->diffForHumans() ?? 'recently' }}
'.fake()->sentence().'
', + 'type' => 'manual', + 'status' => 'active', + ]; + } + + public function draft(): static + { + return $this->state(fn (array $attributes) => ['status' => 'draft']); + } + + public function archived(): static + { + return $this->state(fn (array $attributes) => ['status' => 'archived']); + } + + public function automated(): static + { + return $this->state(fn (array $attributes) => ['type' => 'automated']); + } +} diff --git a/database/factories/CustomerAddressFactory.php b/database/factories/CustomerAddressFactory.php new file mode 100644 index 00000000..d7491913 --- /dev/null +++ b/database/factories/CustomerAddressFactory.php @@ -0,0 +1,37 @@ + Customer::factory(), + 'label' => fake()->randomElement(['Home', 'Work', 'Other']), + 'address_json' => [ + 'first_name' => fake()->firstName(), + 'last_name' => fake()->lastName(), + 'company' => '', + 'address1' => fake()->streetAddress(), + 'address2' => '', + 'city' => fake()->city(), + 'province' => '', + 'province_code' => '', + 'country' => 'Germany', + 'country_code' => 'DE', + 'zip' => fake()->postcode(), + 'phone' => fake()->phoneNumber(), + ], + 'is_default' => false, + ]; + } + + public function default(): static + { + return $this->state(fn (array $attributes) => ['is_default' => true]); + } +} diff --git a/database/factories/CustomerFactory.php b/database/factories/CustomerFactory.php new file mode 100644 index 00000000..4cb2a185 --- /dev/null +++ b/database/factories/CustomerFactory.php @@ -0,0 +1,33 @@ + Store::factory(), + 'email' => fake()->unique()->safeEmail(), + 'password_hash' => static::$password ??= Hash::make('password'), + 'name' => fake()->name(), + 'marketing_opt_in' => fake()->boolean(30), + ]; + } + + public function guest(): static + { + return $this->state(fn (array $attributes) => ['password_hash' => null]); + } + + public function optedInMarketing(): static + { + return $this->state(fn (array $attributes) => ['marketing_opt_in' => true]); + } +} diff --git a/database/factories/DiscountFactory.php b/database/factories/DiscountFactory.php new file mode 100644 index 00000000..56f72e9e --- /dev/null +++ b/database/factories/DiscountFactory.php @@ -0,0 +1,63 @@ + Store::factory(), + 'type' => 'code', + 'code' => fake()->unique()->bothify('????##'), + 'value_type' => 'percent', + 'value_amount' => 10, + 'starts_at' => now()->subMonth(), + 'ends_at' => now()->addYear(), + 'usage_limit' => null, + 'usage_count' => 0, + 'rules_json' => [], + 'status' => 'active', + ]; + } + + public function fixed(int $amountCents): static + { + return $this->state(fn (array $attributes) => ['value_type' => 'fixed', 'value_amount' => $amountCents]); + } + + public function freeShipping(): static + { + return $this->state(fn (array $attributes) => ['value_type' => 'free_shipping', 'value_amount' => 0]); + } + + public function expired(): static + { + return $this->state(fn (array $attributes) => [ + 'starts_at' => now()->subYear(), 'ends_at' => now()->subDay(), 'status' => 'expired', + ]); + } + + public function maxedOut(): static + { + return $this->state(fn (array $attributes) => ['usage_limit' => 5, 'usage_count' => 5]); + } + + public function automatic(): static + { + return $this->state(fn (array $attributes) => ['type' => 'automatic', 'code' => null]); + } + + public function draft(): static + { + return $this->state(fn (array $attributes) => ['status' => 'draft']); + } + + public function disabled(): static + { + return $this->state(fn (array $attributes) => ['status' => 'disabled', 'starts_at' => now()->subDay()]); + } +} diff --git a/database/factories/FulfillmentFactory.php b/database/factories/FulfillmentFactory.php new file mode 100644 index 00000000..0ed59df2 --- /dev/null +++ b/database/factories/FulfillmentFactory.php @@ -0,0 +1,35 @@ +bothify('??########'); + + return [ + 'order_id' => Order::factory(), + 'status' => 'shipped', + 'tracking_company' => fake()->randomElement(['DHL', 'UPS', 'FedEx', 'DPD']), + 'tracking_number' => $trackingNumber, + 'tracking_url' => 'https://tracking.example.com/'.$trackingNumber, + 'shipped_at' => now(), + ]; + } + + public function pending(): static + { + return $this->state(fn (array $attributes) => [ + 'status' => 'pending', 'tracking_number' => null, 'tracking_url' => null, 'shipped_at' => null, + ]); + } + + public function delivered(): static + { + return $this->state(fn (array $attributes) => ['status' => 'delivered']); + } +} diff --git a/database/factories/FulfillmentLineFactory.php b/database/factories/FulfillmentLineFactory.php new file mode 100644 index 00000000..08263bea --- /dev/null +++ b/database/factories/FulfillmentLineFactory.php @@ -0,0 +1,19 @@ + Fulfillment::factory(), + 'order_line_id' => OrderLine::factory(), + 'quantity' => 1, + ]; + } +} diff --git a/database/factories/InventoryItemFactory.php b/database/factories/InventoryItemFactory.php new file mode 100644 index 00000000..98b13f25 --- /dev/null +++ b/database/factories/InventoryItemFactory.php @@ -0,0 +1,36 @@ + Store::factory(), + 'variant_id' => ProductVariant::factory(), + 'quantity_on_hand' => fake()->numberBetween(0, 100), + 'quantity_reserved' => 0, + 'policy' => 'deny', + ]; + } + + public function outOfStock(): static + { + return $this->state(fn (array $attributes) => ['quantity_on_hand' => 0]); + } + + public function continuePolicy(): static + { + return $this->state(fn (array $attributes) => ['policy' => 'continue']); + } + + public function lowStock(): static + { + return $this->state(fn (array $attributes) => ['quantity_on_hand' => fake()->numberBetween(1, 3)]); + } +} diff --git a/database/factories/NavigationItemFactory.php b/database/factories/NavigationItemFactory.php new file mode 100644 index 00000000..24d4f68b --- /dev/null +++ b/database/factories/NavigationItemFactory.php @@ -0,0 +1,36 @@ + NavigationMenu::factory(), + 'type' => 'link', + 'label' => fake()->words(2, true), + 'url' => '/', + 'resource_id' => null, + 'position' => 0, + ]; + } + + public function page(int $pageId): static + { + return $this->state(fn (array $attributes) => ['type' => 'page', 'url' => null, 'resource_id' => $pageId]); + } + + public function collection(int $collectionId): static + { + return $this->state(fn (array $attributes) => ['type' => 'collection', 'url' => null, 'resource_id' => $collectionId]); + } + + public function product(int $productId): static + { + return $this->state(fn (array $attributes) => ['type' => 'product', 'url' => null, 'resource_id' => $productId]); + } +} diff --git a/database/factories/NavigationMenuFactory.php b/database/factories/NavigationMenuFactory.php new file mode 100644 index 00000000..a4c8a060 --- /dev/null +++ b/database/factories/NavigationMenuFactory.php @@ -0,0 +1,18 @@ + Store::factory(), + 'handle' => fake()->unique()->slug(2), + 'title' => fake()->words(2, true), + ]; + } +} diff --git a/database/factories/OrderFactory.php b/database/factories/OrderFactory.php new file mode 100644 index 00000000..c0cf8fcb --- /dev/null +++ b/database/factories/OrderFactory.php @@ -0,0 +1,95 @@ + fake()->firstName(), + 'last_name' => fake()->lastName(), + 'company' => '', + 'address1' => fake()->streetAddress(), + 'address2' => '', + 'city' => fake()->city(), + 'province' => '', + 'province_code' => '', + 'country' => 'Germany', + 'country_code' => 'DE', + 'zip' => fake()->postcode(), + 'phone' => fake()->phoneNumber(), + ]; + + return [ + 'store_id' => Store::factory(), + 'customer_id' => Customer::factory(), + 'order_number' => '#'.fake()->unique()->numberBetween(1001, 999999), + 'payment_method' => 'credit_card', + 'status' => 'paid', + 'financial_status' => 'paid', + 'fulfillment_status' => 'unfulfilled', + 'currency' => 'EUR', + 'subtotal_amount' => 4998, + 'discount_amount' => 0, + 'shipping_amount' => 499, + 'tax_amount' => 798, + 'total_amount' => 5497, + 'email' => fake()->safeEmail(), + 'billing_address_json' => $address, + 'shipping_address_json' => $address, + 'placed_at' => now(), + ]; + } + + public function pending(): static + { + return $this->state(fn (array $attributes) => ['status' => 'pending', 'financial_status' => 'pending']); + } + + public function pendingBankTransfer(): static + { + return $this->state(fn (array $attributes) => [ + 'status' => 'pending', 'financial_status' => 'pending', 'payment_method' => 'bank_transfer', + ]); + } + + public function fulfilled(): static + { + return $this->state(fn (array $attributes) => ['status' => 'fulfilled', 'fulfillment_status' => 'fulfilled']); + } + + public function cancelled(): static + { + return $this->state(fn (array $attributes) => ['status' => 'cancelled', 'financial_status' => 'refunded']); + } + + public function refunded(): static + { + return $this->state(fn (array $attributes) => ['status' => 'refunded', 'financial_status' => 'refunded']); + } + + public function partiallyFulfilled(): static + { + return $this->state(fn (array $attributes) => ['fulfillment_status' => 'partial']); + } + + public function creditCard(): static + { + return $this->state(fn (array $attributes) => ['payment_method' => 'credit_card']); + } + + public function paypal(): static + { + return $this->state(fn (array $attributes) => ['payment_method' => 'paypal']); + } + + public function bankTransfer(): static + { + return $this->state(fn (array $attributes) => ['payment_method' => 'bank_transfer']); + } +} diff --git a/database/factories/OrderLineFactory.php b/database/factories/OrderLineFactory.php new file mode 100644 index 00000000..8ae3a737 --- /dev/null +++ b/database/factories/OrderLineFactory.php @@ -0,0 +1,27 @@ + Order::factory(), + 'product_id' => Product::factory(), + 'variant_id' => ProductVariant::factory(), + 'title_snapshot' => fake()->words(3, true), + 'sku_snapshot' => fake()->bothify('SKU-####-???'), + 'quantity' => fake()->numberBetween(1, 3), + 'unit_price_amount' => fake()->numberBetween(999, 19999), + 'total_amount' => fn (array $attributes): int => $attributes['unit_price_amount'] * $attributes['quantity'], + 'tax_lines_json' => [], + 'discount_allocations_json' => [], + ]; + } +} diff --git a/database/factories/OrganizationFactory.php b/database/factories/OrganizationFactory.php new file mode 100644 index 00000000..19afbfdb --- /dev/null +++ b/database/factories/OrganizationFactory.php @@ -0,0 +1,16 @@ + fake()->company(), + 'billing_email' => fake()->unique()->companyEmail(), + ]; + } +} diff --git a/database/factories/PageFactory.php b/database/factories/PageFactory.php new file mode 100644 index 00000000..b96a9e07 --- /dev/null +++ b/database/factories/PageFactory.php @@ -0,0 +1,34 @@ +unique()->words(3, true); + + return [ + 'store_id' => Store::factory(), + 'title' => Str::title($title), + 'handle' => Str::slug($title), + 'body_html' => ''.fake()->sentence().'
'.fake()->paragraphs(3, true).'
', + 'status' => 'published', + 'published_at' => now(), + ]; + } + + public function draft(): static + { + return $this->state(fn (array $attributes) => ['status' => 'draft', 'published_at' => null]); + } + + public function archived(): static + { + return $this->state(fn (array $attributes) => ['status' => 'archived']); + } +} diff --git a/database/factories/PaymentFactory.php b/database/factories/PaymentFactory.php new file mode 100644 index 00000000..2ce36439 --- /dev/null +++ b/database/factories/PaymentFactory.php @@ -0,0 +1,53 @@ + Order::factory(), + 'provider' => 'mock', + 'method' => 'credit_card', + 'provider_payment_id' => 'mock_'.fake()->regexify('[A-Za-z0-9]{20}'), + 'status' => 'captured', + 'amount' => fake()->numberBetween(999, 99999), + 'currency' => 'EUR', + 'raw_json_encrypted' => null, + ]; + } + + public function pending(): static + { + return $this->state(fn (array $attributes) => ['status' => 'pending']); + } + + public function failed(): static + { + return $this->state(fn (array $attributes) => ['status' => 'failed']); + } + + public function refunded(): static + { + return $this->state(fn (array $attributes) => ['status' => 'refunded']); + } + + public function creditCard(): static + { + return $this->state(fn (array $attributes) => ['method' => 'credit_card']); + } + + public function paypal(): static + { + return $this->state(fn (array $attributes) => ['method' => 'paypal']); + } + + public function bankTransfer(): static + { + return $this->state(fn (array $attributes) => ['method' => 'bank_transfer']); + } +} diff --git a/database/factories/ProductFactory.php b/database/factories/ProductFactory.php new file mode 100644 index 00000000..9245df40 --- /dev/null +++ b/database/factories/ProductFactory.php @@ -0,0 +1,53 @@ +unique()->words(3, true); + + return [ + 'store_id' => Store::factory(), + 'title' => Str::title($title), + 'handle' => Str::slug($title), + 'status' => 'active', + 'description_html' => ''.fake()->paragraph().'
'.fake()->paragraph().'
', + 'vendor' => fake()->company(), + 'product_type' => fake()->randomElement(['Shirts', 'Pants', 'Shoes', 'Accessories', 'Electronics', 'Books']), + 'tags' => fake()->randomElements(['new', 'sale', 'trending', 'popular', 'limited'], fake()->numberBetween(1, 3)), + 'published_at' => now(), + ]; + } + + public function draft(): static + { + return $this->state(fn (array $attributes) => ['status' => 'draft', 'published_at' => null]); + } + + public function archived(): static + { + return $this->state(fn (array $attributes) => ['status' => 'archived']); + } + + public function withVariants(int $count = 1): static + { + return $this->afterCreating(function (Product $product) use ($count): void { + ProductVariant::factory()->count($count)->for($product)->create(); + }); + } + + public function withDefaultVariant(int $price = 1000): static + { + return $this->afterCreating(function (Product $product) use ($price): void { + ProductVariant::factory()->default()->for($product)->create(['price_amount' => $price]); + }); + } +} diff --git a/database/factories/ProductVariantFactory.php b/database/factories/ProductVariantFactory.php new file mode 100644 index 00000000..8f98df7a --- /dev/null +++ b/database/factories/ProductVariantFactory.php @@ -0,0 +1,49 @@ + Product::factory(), + 'sku' => fake()->unique()->bothify('SKU-####-???'), + 'barcode' => fake()->ean13(), + 'price_amount' => fake()->numberBetween(999, 19999), + 'compare_at_amount' => null, + 'currency' => 'EUR', + 'weight_g' => fake()->numberBetween(100, 5000), + 'requires_shipping' => true, + 'is_default' => false, + 'position' => 0, + 'status' => 'active', + ]; + } + + public function onSale(): static + { + return $this->state(fn (array $attributes) => [ + 'price_amount' => fake()->numberBetween(9999, 19999), + 'compare_at_amount' => fake()->numberBetween(20000, 39999), + ]); + } + + public function digital(): static + { + return $this->state(fn (array $attributes) => ['requires_shipping' => false, 'weight_g' => 0]); + } + + public function default(): static + { + return $this->state(fn (array $attributes) => ['is_default' => true]); + } + + public function archived(): static + { + return $this->state(fn (array $attributes) => ['status' => 'archived']); + } +} diff --git a/database/factories/RefundFactory.php b/database/factories/RefundFactory.php new file mode 100644 index 00000000..bb9213bb --- /dev/null +++ b/database/factories/RefundFactory.php @@ -0,0 +1,32 @@ + Order::factory(), + 'payment_id' => Payment::factory(), + 'amount' => fake()->numberBetween(999, 19999), + 'reason' => fake()->sentence(), + 'status' => 'processed', + 'provider_refund_id' => 'mock_re_'.fake()->regexify('[A-Za-z0-9]{20}'), + ]; + } + + public function pending(): static + { + return $this->state(fn (array $attributes) => ['status' => 'pending', 'provider_refund_id' => null]); + } + + public function failed(): static + { + return $this->state(fn (array $attributes) => ['status' => 'failed']); + } +} diff --git a/database/factories/ShippingRateFactory.php b/database/factories/ShippingRateFactory.php new file mode 100644 index 00000000..4aebe032 --- /dev/null +++ b/database/factories/ShippingRateFactory.php @@ -0,0 +1,37 @@ + ShippingZone::factory(), + 'name' => fake()->randomElement(['Standard', 'Express', 'Economy']), + 'type' => 'flat', + 'config_json' => ['amount' => 499], + 'is_active' => true, + ]; + } + + public function inactive(): static + { + return $this->state(fn (array $attributes) => ['is_active' => false]); + } + + public function weightBased(): static + { + return $this->state(fn (array $attributes) => [ + 'type' => 'weight', + 'config_json' => ['ranges' => [ + ['min_g' => 0, 'max_g' => 500, 'amount' => 399], + ['min_g' => 501, 'max_g' => 2000, 'amount' => 699], + ['min_g' => 2001, 'amount' => 1299], + ]], + ]); + } +} diff --git a/database/factories/ShippingZoneFactory.php b/database/factories/ShippingZoneFactory.php new file mode 100644 index 00000000..9d95d609 --- /dev/null +++ b/database/factories/ShippingZoneFactory.php @@ -0,0 +1,19 @@ + Store::factory(), + 'name' => fake()->country(), + 'countries_json' => ['DE'], + 'regions_json' => [], + ]; + } +} diff --git a/database/factories/StoreDomainFactory.php b/database/factories/StoreDomainFactory.php new file mode 100644 index 00000000..3911354f --- /dev/null +++ b/database/factories/StoreDomainFactory.php @@ -0,0 +1,35 @@ + Store::factory(), + 'hostname' => fake()->unique()->domainName(), + 'type' => 'storefront', + 'is_primary' => true, + 'tls_mode' => 'managed', + ]; + } + + public function admin(): static + { + return $this->state(fn (array $attributes) => ['type' => 'admin']); + } + + public function api(): static + { + return $this->state(fn (array $attributes) => ['type' => 'api']); + } + + public function secondary(): static + { + return $this->state(fn (array $attributes) => ['is_primary' => false]); + } +} diff --git a/database/factories/StoreFactory.php b/database/factories/StoreFactory.php new file mode 100644 index 00000000..f6c3fa88 --- /dev/null +++ b/database/factories/StoreFactory.php @@ -0,0 +1,27 @@ + Organization::factory(), + 'name' => fake()->company().' Store', + 'handle' => fake()->unique()->slug(2), + 'status' => 'active', + 'default_currency' => 'EUR', + 'default_locale' => 'en', + 'timezone' => 'Europe/Berlin', + ]; + } + + public function suspended(): static + { + return $this->state(fn (array $attributes) => ['status' => 'suspended']); + } +} diff --git a/database/factories/ThemeFactory.php b/database/factories/ThemeFactory.php new file mode 100644 index 00000000..1ccad6d6 --- /dev/null +++ b/database/factories/ThemeFactory.php @@ -0,0 +1,25 @@ + Store::factory(), + 'name' => 'Default Theme', + 'version' => '1.0.0', + 'status' => 'published', + 'published_at' => now(), + ]; + } + + public function draft(): static + { + return $this->state(fn (array $attributes) => ['status' => 'draft', 'published_at' => null]); + } +} diff --git a/database/factories/UserFactory.php b/database/factories/UserFactory.php index 80da5ac7..6add344f 100644 --- a/database/factories/UserFactory.php +++ b/database/factories/UserFactory.php @@ -27,7 +27,9 @@ public function definition(): array 'name' => fake()->name(), 'email' => fake()->unique()->safeEmail(), 'email_verified_at' => now(), - 'password' => static::$password ??= Hash::make('password'), + 'password_hash' => static::$password ??= Hash::make('password'), + 'status' => 'active', + 'last_login_at' => fake()->dateTimeBetween('-30 days'), 'remember_token' => Str::random(10), 'two_factor_secret' => null, 'two_factor_recovery_codes' => null, @@ -56,4 +58,11 @@ public function withTwoFactor(): static 'two_factor_confirmed_at' => now(), ]); } + + public function disabled(): static + { + return $this->state(fn (array $attributes) => [ + 'status' => 'disabled', + ]); + } } diff --git a/database/migrations/0001_01_01_000000_create_users_table.php b/database/migrations/0001_01_01_000000_create_users_table.php index 05fb5d9e..7b45db4a 100644 --- a/database/migrations/0001_01_01_000000_create_users_table.php +++ b/database/migrations/0001_01_01_000000_create_users_table.php @@ -13,12 +13,17 @@ public function up(): void { Schema::create('users', function (Blueprint $table) { $table->id(); + $table->string('email'); + $table->string('password_hash'); $table->string('name'); - $table->string('email')->unique(); + $table->enum('status', ['active', 'disabled'])->default('active'); $table->timestamp('email_verified_at')->nullable(); - $table->string('password'); + $table->timestamp('last_login_at')->nullable(); $table->rememberToken(); $table->timestamps(); + + $table->unique('email', 'idx_users_email'); + $table->index('status', 'idx_users_status'); }); Schema::create('password_reset_tokens', function (Blueprint $table) { diff --git a/database/migrations/2025_08_14_170933_add_two_factor_columns_to_users_table.php b/database/migrations/2025_08_14_170933_add_two_factor_columns_to_users_table.php index 187d974d..a008f488 100644 --- a/database/migrations/2025_08_14_170933_add_two_factor_columns_to_users_table.php +++ b/database/migrations/2025_08_14_170933_add_two_factor_columns_to_users_table.php @@ -12,7 +12,7 @@ public function up(): void { Schema::table('users', function (Blueprint $table) { - $table->text('two_factor_secret')->after('password')->nullable(); + $table->text('two_factor_secret')->after('password_hash')->nullable(); $table->text('two_factor_recovery_codes')->after('two_factor_secret')->nullable(); $table->timestamp('two_factor_confirmed_at')->after('two_factor_recovery_codes')->nullable(); }); diff --git a/database/migrations/2026_01_01_000100_create_foundation_tables.php b/database/migrations/2026_01_01_000100_create_foundation_tables.php new file mode 100644 index 00000000..bfd97271 --- /dev/null +++ b/database/migrations/2026_01_01_000100_create_foundation_tables.php @@ -0,0 +1,103 @@ +id(); + $table->string('name'); + $table->string('billing_email'); + $table->timestamps(); + $table->index('billing_email', 'idx_organizations_billing_email'); + }); + + Schema::create('apps', function (Blueprint $table) { + $table->id(); + $table->string('name'); + $table->enum('status', ['active', 'disabled'])->default('active'); + $table->timestamp('created_at')->nullable(); + $table->index('status', 'idx_apps_status'); + }); + + Schema::create('stores', function (Blueprint $table) { + $table->id(); + $table->foreignId('organization_id')->constrained()->cascadeOnDelete(); + $table->string('name'); + $table->string('handle'); + $table->enum('status', ['active', 'suspended'])->default('active'); + $table->string('default_currency')->default('USD'); + $table->string('default_locale')->default('en'); + $table->string('timezone')->default('UTC'); + $table->timestamps(); + $table->unique('handle', 'idx_stores_handle'); + $table->index('organization_id', 'idx_stores_organization_id'); + $table->index('status', 'idx_stores_status'); + }); + + Schema::create('store_domains', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('hostname'); + $table->enum('type', ['storefront', 'admin', 'api'])->default('storefront'); + $table->boolean('is_primary')->default(false); + $table->enum('tls_mode', ['managed', 'bring_your_own'])->default('managed'); + $table->timestamp('created_at')->nullable(); + $table->unique('hostname', 'idx_store_domains_hostname'); + $table->index('store_id', 'idx_store_domains_store_id'); + $table->index(['store_id', 'is_primary'], 'idx_store_domains_store_primary'); + }); + + Schema::create('store_users', function (Blueprint $table) { + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('user_id')->constrained()->cascadeOnDelete(); + $table->enum('role', ['owner', 'admin', 'staff', 'support'])->default('staff'); + $table->timestamp('created_at')->nullable(); + $table->primary(['store_id', 'user_id']); + $table->index('user_id', 'idx_store_users_user_id'); + $table->index(['store_id', 'role'], 'idx_store_users_role'); + }); + + Schema::create('store_settings', function (Blueprint $table) { + $table->unsignedBigInteger('store_id')->primary(); + $table->text('settings_json')->default('{}'); + $table->timestamp('updated_at')->nullable(); + $table->foreign('store_id')->references('id')->on('stores')->cascadeOnDelete(); + }); + + Schema::create('customer_password_reset_tokens', function (Blueprint $table) { + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('email'); + $table->string('token'); + $table->timestamp('created_at')->nullable(); + $table->primary(['store_id', 'email']); + }); + + Schema::create('personal_access_tokens', function (Blueprint $table) { + $table->id(); + $table->morphs('tokenable'); + $table->string('name'); + $table->string('token', 64)->unique(); + $table->text('abilities')->nullable(); + $table->timestamp('last_used_at')->nullable(); + $table->timestamp('expires_at')->nullable()->index(); + $table->timestamps(); + }); + } + + public function down(): void + { + Schema::dropIfExists('personal_access_tokens'); + Schema::dropIfExists('customer_password_reset_tokens'); + Schema::dropIfExists('store_settings'); + Schema::dropIfExists('store_users'); + Schema::dropIfExists('store_domains'); + Schema::dropIfExists('stores'); + Schema::dropIfExists('apps'); + Schema::dropIfExists('organizations'); + } +}; diff --git a/database/migrations/2026_01_01_000200_create_tenant_root_tables.php b/database/migrations/2026_01_01_000200_create_tenant_root_tables.php new file mode 100644 index 00000000..08c8b230 --- /dev/null +++ b/database/migrations/2026_01_01_000200_create_tenant_root_tables.php @@ -0,0 +1,177 @@ +id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('email'); + $table->string('password_hash')->nullable(); + $table->string('name')->nullable(); + $table->boolean('marketing_opt_in')->default(false); + $table->timestamps(); + $table->unique(['store_id', 'email'], 'idx_customers_store_email'); + $table->index('store_id', 'idx_customers_store_id'); + }); + + Schema::create('themes', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('name'); + $table->string('version')->nullable(); + $table->enum('status', ['draft', 'published'])->default('draft'); + $table->timestamp('published_at')->nullable(); + $table->timestamps(); + $table->index('store_id', 'idx_themes_store_id'); + $table->index(['store_id', 'status'], 'idx_themes_store_status'); + }); + + Schema::create('pages', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('title'); + $table->string('handle'); + $table->text('body_html')->nullable(); + $table->enum('status', ['draft', 'published', 'archived'])->default('draft'); + $table->timestamp('published_at')->nullable(); + $table->timestamps(); + $table->unique(['store_id', 'handle'], 'idx_pages_store_handle'); + $table->index('store_id', 'idx_pages_store_id'); + $table->index(['store_id', 'status'], 'idx_pages_store_status'); + }); + + Schema::create('navigation_menus', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('handle'); + $table->string('title'); + $table->timestamps(); + $table->unique(['store_id', 'handle'], 'idx_navigation_menus_store_handle'); + $table->index('store_id', 'idx_navigation_menus_store_id'); + }); + + Schema::create('search_settings', function (Blueprint $table) { + $table->unsignedBigInteger('store_id')->primary(); + $table->text('synonyms_json')->default('[]'); + $table->text('stop_words_json')->default('[]'); + $table->timestamp('updated_at')->nullable(); + $table->foreign('store_id')->references('id')->on('stores')->cascadeOnDelete(); + }); + + Schema::create('shipping_zones', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('name'); + $table->text('countries_json')->default('[]'); + $table->text('regions_json')->default('[]'); + $table->index('store_id', 'idx_shipping_zones_store_id'); + }); + + Schema::create('tax_settings', function (Blueprint $table) { + $table->unsignedBigInteger('store_id')->primary(); + $table->enum('mode', ['manual', 'provider'])->default('manual'); + $table->enum('provider', ['stripe_tax', 'none'])->default('none'); + $table->boolean('prices_include_tax')->default(false); + $table->text('config_json')->default('{}'); + $table->foreign('store_id')->references('id')->on('stores')->cascadeOnDelete(); + }); + + Schema::create('discounts', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->enum('type', ['code', 'automatic'])->default('code'); + $table->string('code')->nullable(); + $table->enum('value_type', ['fixed', 'percent', 'free_shipping']); + $table->integer('value_amount')->default(0); + $table->timestamp('starts_at'); + $table->timestamp('ends_at')->nullable(); + $table->integer('usage_limit')->nullable(); + $table->integer('usage_count')->default(0); + $table->text('rules_json')->default('{}'); + $table->enum('status', ['draft', 'active', 'expired', 'disabled'])->default('active'); + $table->timestamps(); + $table->unique(['store_id', 'code'], 'idx_discounts_store_code'); + $table->index('store_id', 'idx_discounts_store_id'); + $table->index(['store_id', 'status'], 'idx_discounts_store_status'); + $table->index(['store_id', 'type'], 'idx_discounts_store_type'); + }); + + Schema::create('products', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('title'); + $table->string('handle'); + $table->enum('status', ['draft', 'active', 'archived'])->default('draft'); + $table->text('description_html')->nullable(); + $table->string('vendor')->nullable(); + $table->string('product_type')->nullable(); + $table->text('tags')->default('[]'); + $table->timestamp('published_at')->nullable(); + $table->timestamps(); + $table->unique(['store_id', 'handle'], 'idx_products_store_handle'); + $table->index('store_id', 'idx_products_store_id'); + $table->index(['store_id', 'status'], 'idx_products_store_status'); + $table->index(['store_id', 'published_at'], 'idx_products_published_at'); + $table->index(['store_id', 'vendor'], 'idx_products_vendor'); + $table->index(['store_id', 'product_type'], 'idx_products_product_type'); + }); + + Schema::create('collections', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('title'); + $table->string('handle'); + $table->text('description_html')->nullable(); + $table->enum('type', ['manual', 'automated'])->default('manual'); + $table->enum('status', ['draft', 'active', 'archived'])->default('active'); + $table->timestamps(); + $table->unique(['store_id', 'handle'], 'idx_collections_store_handle'); + $table->index('store_id', 'idx_collections_store_id'); + $table->index(['store_id', 'status'], 'idx_collections_store_status'); + }); + + Schema::create('app_installations', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('app_id')->constrained()->cascadeOnDelete(); + $table->text('scopes_json')->default('[]'); + $table->enum('status', ['active', 'suspended', 'uninstalled'])->default('active'); + $table->timestamp('installed_at')->nullable(); + $table->unique(['store_id', 'app_id'], 'idx_app_installations_store_app'); + $table->index('store_id', 'idx_app_installations_store_id'); + $table->index('app_id', 'idx_app_installations_app_id'); + }); + + Schema::create('oauth_clients', function (Blueprint $table) { + $table->id(); + $table->foreignId('app_id')->constrained()->cascadeOnDelete(); + $table->string('client_id'); + $table->text('client_secret_encrypted'); + $table->text('redirect_uris_json')->default('[]'); + $table->unique('client_id', 'idx_oauth_clients_client_id'); + $table->index('app_id', 'idx_oauth_clients_app_id'); + }); + } + + public function down(): void + { + Schema::dropIfExists('oauth_clients'); + Schema::dropIfExists('app_installations'); + Schema::dropIfExists('collections'); + Schema::dropIfExists('products'); + Schema::dropIfExists('discounts'); + Schema::dropIfExists('tax_settings'); + Schema::dropIfExists('shipping_zones'); + Schema::dropIfExists('search_settings'); + Schema::dropIfExists('navigation_menus'); + Schema::dropIfExists('pages'); + Schema::dropIfExists('themes'); + Schema::dropIfExists('customers'); + } +}; diff --git a/database/migrations/2026_01_01_000300_create_dependent_tables.php b/database/migrations/2026_01_01_000300_create_dependent_tables.php new file mode 100644 index 00000000..7738b5ac --- /dev/null +++ b/database/migrations/2026_01_01_000300_create_dependent_tables.php @@ -0,0 +1,185 @@ +id(); + $table->foreignId('product_id')->constrained()->cascadeOnDelete(); + $table->string('name'); + $table->integer('position')->default(0); + $table->index('product_id', 'idx_product_options_product_id'); + $table->unique(['product_id', 'position'], 'idx_product_options_product_position'); + }); + + Schema::create('product_variants', function (Blueprint $table) { + $table->id(); + $table->foreignId('product_id')->constrained()->cascadeOnDelete(); + $table->string('sku')->nullable(); + $table->string('barcode')->nullable(); + $table->integer('price_amount')->default(0); + $table->integer('compare_at_amount')->nullable(); + $table->string('currency')->default('USD'); + $table->integer('weight_g')->nullable(); + $table->boolean('requires_shipping')->default(true); + $table->boolean('is_default')->default(false); + $table->integer('position')->default(0); + $table->enum('status', ['active', 'archived'])->default('active'); + $table->timestamps(); + $table->index('product_id', 'idx_product_variants_product_id'); + $table->index('sku', 'idx_product_variants_sku'); + $table->index('barcode', 'idx_product_variants_barcode'); + $table->index(['product_id', 'position'], 'idx_product_variants_product_position'); + $table->index(['product_id', 'is_default'], 'idx_product_variants_product_default'); + }); + + Schema::create('product_media', function (Blueprint $table) { + $table->id(); + $table->foreignId('product_id')->constrained()->cascadeOnDelete(); + $table->enum('type', ['image', 'video'])->default('image'); + $table->string('storage_key'); + $table->string('alt_text')->nullable(); + $table->integer('width')->nullable(); + $table->integer('height')->nullable(); + $table->string('mime_type')->nullable(); + $table->integer('byte_size')->nullable(); + $table->integer('position')->default(0); + $table->enum('status', ['processing', 'ready', 'failed'])->default('processing'); + $table->timestamp('created_at')->nullable(); + $table->index('product_id', 'idx_product_media_product_id'); + $table->index(['product_id', 'position'], 'idx_product_media_product_position'); + $table->index('status', 'idx_product_media_status'); + }); + + Schema::create('collection_products', function (Blueprint $table) { + $table->foreignId('collection_id')->constrained()->cascadeOnDelete(); + $table->foreignId('product_id')->constrained()->cascadeOnDelete(); + $table->integer('position')->default(0); + $table->primary(['collection_id', 'product_id']); + $table->index('product_id', 'idx_collection_products_product_id'); + $table->index(['collection_id', 'position'], 'idx_collection_products_position'); + }); + + Schema::create('customer_addresses', function (Blueprint $table) { + $table->id(); + $table->foreignId('customer_id')->constrained()->cascadeOnDelete(); + $table->string('label')->nullable(); + $table->text('address_json')->default('{}'); + $table->boolean('is_default')->default(false); + $table->index('customer_id', 'idx_customer_addresses_customer_id'); + $table->index(['customer_id', 'is_default'], 'idx_customer_addresses_default'); + }); + + Schema::create('carts', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('customer_id')->nullable()->constrained()->nullOnDelete(); + $table->string('currency')->default('USD'); + $table->integer('cart_version')->default(1); + $table->enum('status', ['active', 'converted', 'abandoned'])->default('active'); + $table->timestamps(); + $table->index('store_id', 'idx_carts_store_id'); + $table->index('customer_id', 'idx_carts_customer_id'); + $table->index(['store_id', 'status'], 'idx_carts_store_status'); + }); + + Schema::create('navigation_items', function (Blueprint $table) { + $table->id(); + $table->foreignId('menu_id')->constrained('navigation_menus')->cascadeOnDelete(); + $table->enum('type', ['link', 'page', 'collection', 'product'])->default('link'); + $table->string('label'); + $table->string('url')->nullable(); + $table->unsignedBigInteger('resource_id')->nullable(); + $table->integer('position')->default(0); + $table->index('menu_id', 'idx_navigation_items_menu_id'); + $table->index(['menu_id', 'position'], 'idx_navigation_items_menu_position'); + }); + + Schema::create('theme_files', function (Blueprint $table) { + $table->id(); + $table->foreignId('theme_id')->constrained()->cascadeOnDelete(); + $table->string('path'); + $table->string('storage_key'); + $table->string('sha256'); + $table->integer('byte_size')->default(0); + $table->unique(['theme_id', 'path'], 'idx_theme_files_theme_path'); + $table->index('theme_id', 'idx_theme_files_theme_id'); + }); + + Schema::create('theme_settings', function (Blueprint $table) { + $table->unsignedBigInteger('theme_id')->primary(); + $table->text('settings_json')->default('{}'); + $table->timestamp('updated_at')->nullable(); + $table->foreign('theme_id')->references('id')->on('themes')->cascadeOnDelete(); + }); + + Schema::create('search_queries', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->text('query'); + $table->text('filters_json')->nullable(); + $table->integer('results_count')->default(0); + $table->timestamp('created_at')->nullable(); + $table->index('store_id', 'idx_search_queries_store_id'); + $table->index(['store_id', 'created_at'], 'idx_search_queries_store_created'); + $table->index(['store_id', 'query'], 'idx_search_queries_store_query'); + }); + + Schema::create('shipping_rates', function (Blueprint $table) { + $table->id(); + $table->foreignId('zone_id')->constrained('shipping_zones')->cascadeOnDelete(); + $table->string('name'); + $table->enum('type', ['flat', 'weight', 'price', 'carrier'])->default('flat'); + $table->text('config_json')->default('{}'); + $table->boolean('is_active')->default(true); + $table->index('zone_id', 'idx_shipping_rates_zone_id'); + $table->index(['zone_id', 'is_active'], 'idx_shipping_rates_zone_active'); + }); + + Schema::create('oauth_tokens', function (Blueprint $table) { + $table->id(); + $table->foreignId('installation_id')->constrained('app_installations')->cascadeOnDelete(); + $table->string('access_token_hash'); + $table->string('refresh_token_hash')->nullable(); + $table->timestamp('expires_at'); + $table->index('installation_id', 'idx_oauth_tokens_installation_id'); + $table->unique('access_token_hash', 'idx_oauth_tokens_access_hash'); + $table->index('expires_at', 'idx_oauth_tokens_expires_at'); + }); + + Schema::create('webhook_subscriptions', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('app_installation_id')->nullable()->constrained()->cascadeOnDelete(); + $table->string('event_type'); + $table->string('target_url'); + $table->text('signing_secret_encrypted'); + $table->enum('status', ['active', 'paused', 'disabled'])->default('active'); + $table->index('store_id', 'idx_webhook_subscriptions_store_id'); + $table->index(['store_id', 'event_type'], 'idx_webhook_subscriptions_store_event'); + $table->index('app_installation_id', 'idx_webhook_subscriptions_installation'); + }); + } + + public function down(): void + { + Schema::dropIfExists('webhook_subscriptions'); + Schema::dropIfExists('oauth_tokens'); + Schema::dropIfExists('shipping_rates'); + Schema::dropIfExists('search_queries'); + Schema::dropIfExists('theme_settings'); + Schema::dropIfExists('theme_files'); + Schema::dropIfExists('navigation_items'); + Schema::dropIfExists('carts'); + Schema::dropIfExists('customer_addresses'); + Schema::dropIfExists('collection_products'); + Schema::dropIfExists('product_media'); + Schema::dropIfExists('product_variants'); + Schema::dropIfExists('product_options'); + } +}; diff --git a/database/migrations/2026_01_01_000400_create_transaction_tables.php b/database/migrations/2026_01_01_000400_create_transaction_tables.php new file mode 100644 index 00000000..ab90d79b --- /dev/null +++ b/database/migrations/2026_01_01_000400_create_transaction_tables.php @@ -0,0 +1,155 @@ +id(); + $table->foreignId('product_option_id')->constrained()->cascadeOnDelete(); + $table->string('value'); + $table->integer('position')->default(0); + $table->index('product_option_id', 'idx_product_option_values_option_id'); + $table->unique(['product_option_id', 'position'], 'idx_product_option_values_option_position'); + }); + + Schema::create('inventory_items', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('variant_id')->constrained('product_variants')->cascadeOnDelete(); + $table->integer('quantity_on_hand')->default(0); + $table->integer('quantity_reserved')->default(0); + $table->enum('policy', ['deny', 'continue'])->default('deny'); + $table->unique('variant_id', 'idx_inventory_items_variant_id'); + $table->index('store_id', 'idx_inventory_items_store_id'); + }); + + Schema::create('cart_lines', function (Blueprint $table) { + $table->id(); + $table->foreignId('cart_id')->constrained()->cascadeOnDelete(); + $table->foreignId('variant_id')->constrained('product_variants')->cascadeOnDelete(); + $table->integer('quantity')->default(1); + $table->integer('unit_price_amount')->default(0); + $table->integer('line_subtotal_amount')->default(0); + $table->integer('line_discount_amount')->default(0); + $table->integer('line_total_amount')->default(0); + $table->index('cart_id', 'idx_cart_lines_cart_id'); + $table->unique(['cart_id', 'variant_id'], 'idx_cart_lines_cart_variant'); + }); + + Schema::create('checkouts', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('cart_id')->constrained()->cascadeOnDelete(); + $table->foreignId('customer_id')->nullable()->constrained()->nullOnDelete(); + $table->enum('status', ['started', 'addressed', 'shipping_selected', 'payment_selected', 'completed', 'expired'])->default('started'); + $table->enum('payment_method', ['credit_card', 'paypal', 'bank_transfer'])->nullable(); + $table->string('email')->nullable(); + $table->text('shipping_address_json')->nullable(); + $table->text('billing_address_json')->nullable(); + $table->unsignedBigInteger('shipping_method_id')->nullable(); + $table->string('discount_code')->nullable(); + $table->text('tax_provider_snapshot_json')->nullable(); + $table->text('totals_json')->nullable(); + $table->timestamp('expires_at')->nullable(); + $table->timestamps(); + $table->index('store_id', 'idx_checkouts_store_id'); + $table->index('cart_id', 'idx_checkouts_cart_id'); + $table->index('customer_id', 'idx_checkouts_customer_id'); + $table->index(['store_id', 'status'], 'idx_checkouts_status'); + $table->index('expires_at', 'idx_checkouts_expires_at'); + }); + + Schema::create('orders', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('customer_id')->nullable()->constrained()->nullOnDelete(); + $table->string('order_number'); + $table->enum('payment_method', ['credit_card', 'paypal', 'bank_transfer']); + $table->enum('status', ['pending', 'paid', 'fulfilled', 'cancelled', 'refunded'])->default('pending'); + $table->enum('financial_status', ['pending', 'authorized', 'paid', 'partially_refunded', 'refunded', 'voided'])->default('pending'); + $table->enum('fulfillment_status', ['unfulfilled', 'partial', 'fulfilled'])->default('unfulfilled'); + $table->string('currency')->default('USD'); + $table->integer('subtotal_amount')->default(0); + $table->integer('discount_amount')->default(0); + $table->integer('shipping_amount')->default(0); + $table->integer('tax_amount')->default(0); + $table->integer('total_amount')->default(0); + $table->string('email')->nullable(); + $table->text('billing_address_json')->nullable(); + $table->text('shipping_address_json')->nullable(); + $table->timestamp('placed_at')->nullable(); + $table->timestamps(); + $table->unique(['store_id', 'order_number'], 'idx_orders_store_order_number'); + $table->index('store_id', 'idx_orders_store_id'); + $table->index('customer_id', 'idx_orders_customer_id'); + $table->index(['store_id', 'status'], 'idx_orders_store_status'); + $table->index(['store_id', 'financial_status'], 'idx_orders_store_financial'); + $table->index(['store_id', 'fulfillment_status'], 'idx_orders_store_fulfillment'); + $table->index(['store_id', 'placed_at'], 'idx_orders_placed_at'); + }); + + Schema::create('analytics_events', function (Blueprint $table) { + $table->id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->string('type'); + $table->string('session_id')->nullable(); + $table->foreignId('customer_id')->nullable()->constrained()->nullOnDelete(); + $table->text('properties_json')->default('{}'); + $table->string('client_event_id')->nullable(); + $table->timestamp('occurred_at')->nullable(); + $table->timestamp('created_at')->nullable(); + $table->index('store_id', 'idx_analytics_events_store_id'); + $table->index(['store_id', 'type'], 'idx_analytics_events_store_type'); + $table->index(['store_id', 'created_at'], 'idx_analytics_events_store_created'); + $table->index('session_id', 'idx_analytics_events_session'); + $table->index('customer_id', 'idx_analytics_events_customer'); + $table->unique(['store_id', 'client_event_id'], 'idx_analytics_events_client_event'); + }); + + Schema::create('analytics_daily', function (Blueprint $table) { + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->date('date'); + $table->integer('orders_count')->default(0); + $table->integer('revenue_amount')->default(0); + $table->integer('aov_amount')->default(0); + $table->integer('visits_count')->default(0); + $table->integer('add_to_cart_count')->default(0); + $table->integer('checkout_started_count')->default(0); + $table->integer('checkout_completed_count')->default(0); + $table->primary(['store_id', 'date']); + $table->index(['store_id', 'date'], 'idx_analytics_daily_store_date'); + }); + + Schema::create('webhook_deliveries', function (Blueprint $table) { + $table->id(); + $table->foreignId('subscription_id')->constrained('webhook_subscriptions')->cascadeOnDelete(); + $table->string('event_id'); + $table->integer('attempt_count')->default(1); + $table->enum('status', ['pending', 'success', 'failed'])->default('pending'); + $table->timestamp('last_attempt_at')->nullable(); + $table->integer('response_code')->nullable(); + $table->text('response_body_snippet')->nullable(); + $table->index('subscription_id', 'idx_webhook_deliveries_subscription_id'); + $table->index('event_id', 'idx_webhook_deliveries_event_id'); + $table->index('status', 'idx_webhook_deliveries_status'); + $table->index('last_attempt_at', 'idx_webhook_deliveries_last_attempt'); + }); + } + + public function down(): void + { + Schema::dropIfExists('webhook_deliveries'); + Schema::dropIfExists('analytics_daily'); + Schema::dropIfExists('analytics_events'); + Schema::dropIfExists('orders'); + Schema::dropIfExists('checkouts'); + Schema::dropIfExists('cart_lines'); + Schema::dropIfExists('inventory_items'); + Schema::dropIfExists('product_option_values'); + } +}; diff --git a/database/migrations/2026_01_01_000500_create_order_detail_tables.php b/database/migrations/2026_01_01_000500_create_order_detail_tables.php new file mode 100644 index 00000000..69c654e7 --- /dev/null +++ b/database/migrations/2026_01_01_000500_create_order_detail_tables.php @@ -0,0 +1,74 @@ +foreignId('variant_id')->constrained('product_variants')->cascadeOnDelete(); + $table->foreignId('product_option_value_id')->constrained()->cascadeOnDelete(); + $table->primary(['variant_id', 'product_option_value_id']); + $table->index('product_option_value_id', 'idx_variant_option_values_value_id'); + }); + + Schema::create('order_lines', function (Blueprint $table) { + $table->id(); + $table->foreignId('order_id')->constrained()->cascadeOnDelete(); + $table->foreignId('product_id')->nullable()->constrained()->nullOnDelete(); + $table->foreignId('variant_id')->nullable()->constrained('product_variants')->nullOnDelete(); + $table->string('title_snapshot'); + $table->string('sku_snapshot')->nullable(); + $table->integer('quantity')->default(1); + $table->integer('unit_price_amount')->default(0); + $table->integer('total_amount')->default(0); + $table->text('tax_lines_json')->default('[]'); + $table->text('discount_allocations_json')->default('[]'); + $table->index('order_id', 'idx_order_lines_order_id'); + $table->index('product_id', 'idx_order_lines_product_id'); + $table->index('variant_id', 'idx_order_lines_variant_id'); + }); + + Schema::create('payments', function (Blueprint $table) { + $table->id(); + $table->foreignId('order_id')->constrained()->cascadeOnDelete(); + $table->enum('provider', ['mock'])->default('mock'); + $table->enum('method', ['credit_card', 'paypal', 'bank_transfer']); + $table->string('provider_payment_id')->nullable(); + $table->enum('status', ['pending', 'captured', 'failed', 'refunded'])->default('pending'); + $table->integer('amount')->default(0); + $table->string('currency')->default('USD'); + $table->text('raw_json_encrypted')->nullable(); + $table->timestamp('created_at')->nullable(); + $table->index('order_id', 'idx_payments_order_id'); + $table->index(['provider', 'provider_payment_id'], 'idx_payments_provider_id'); + $table->index('method', 'idx_payments_method'); + $table->index('status', 'idx_payments_status'); + }); + + Schema::create('fulfillments', function (Blueprint $table) { + $table->id(); + $table->foreignId('order_id')->constrained()->cascadeOnDelete(); + $table->enum('status', ['pending', 'shipped', 'delivered'])->default('pending'); + $table->string('tracking_company')->nullable(); + $table->string('tracking_number')->nullable(); + $table->string('tracking_url')->nullable(); + $table->timestamp('shipped_at')->nullable(); + $table->timestamp('created_at')->nullable(); + $table->index('order_id', 'idx_fulfillments_order_id'); + $table->index('status', 'idx_fulfillments_status'); + $table->index(['tracking_company', 'tracking_number'], 'idx_fulfillments_tracking'); + }); + } + + public function down(): void + { + Schema::dropIfExists('fulfillments'); + Schema::dropIfExists('payments'); + Schema::dropIfExists('order_lines'); + Schema::dropIfExists('variant_option_values'); + } +}; diff --git a/database/migrations/2026_01_01_000600_create_refund_and_fulfillment_line_tables.php b/database/migrations/2026_01_01_000600_create_refund_and_fulfillment_line_tables.php new file mode 100644 index 00000000..cc4d7e86 --- /dev/null +++ b/database/migrations/2026_01_01_000600_create_refund_and_fulfillment_line_tables.php @@ -0,0 +1,40 @@ +id(); + $table->foreignId('order_id')->constrained()->cascadeOnDelete(); + $table->foreignId('payment_id')->constrained()->cascadeOnDelete(); + $table->integer('amount')->default(0); + $table->text('reason')->nullable(); + $table->enum('status', ['pending', 'processed', 'failed'])->default('pending'); + $table->string('provider_refund_id')->nullable(); + $table->timestamp('created_at')->nullable(); + $table->index('order_id', 'idx_refunds_order_id'); + $table->index('payment_id', 'idx_refunds_payment_id'); + $table->index('status', 'idx_refunds_status'); + }); + + Schema::create('fulfillment_lines', function (Blueprint $table) { + $table->id(); + $table->foreignId('fulfillment_id')->constrained()->cascadeOnDelete(); + $table->foreignId('order_line_id')->constrained()->cascadeOnDelete(); + $table->integer('quantity')->default(1); + $table->index('fulfillment_id', 'idx_fulfillment_lines_fulfillment_id'); + $table->unique(['fulfillment_id', 'order_line_id'], 'idx_fulfillment_lines_fulfillment_order_line'); + }); + } + + public function down(): void + { + Schema::dropIfExists('fulfillment_lines'); + Schema::dropIfExists('refunds'); + } +}; diff --git a/database/migrations/2026_01_01_000700_create_products_fts_table.php b/database/migrations/2026_01_01_000700_create_products_fts_table.php new file mode 100644 index 00000000..4d08daad --- /dev/null +++ b/database/migrations/2026_01_01_000700_create_products_fts_table.php @@ -0,0 +1,27 @@ +id(); + $table->foreignId('store_id')->constrained()->cascadeOnDelete(); + $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete(); + $table->string('format')->default('csv'); + $table->json('filters_json')->default('{}'); + $table->enum('status', ['queued', 'processing', 'completed', 'failed'])->default('queued'); + $table->unsignedInteger('row_count')->default(0); + $table->string('storage_key')->nullable(); + $table->text('error_message')->nullable(); + $table->timestamp('completed_at')->nullable(); + $table->timestamps(); + $table->index(['store_id', 'status']); + }); + } + + public function down(): void + { + Schema::dropIfExists('order_exports'); + } +}; diff --git a/database/migrations/2026_01_01_000810_enforce_store_owner_uniqueness.php b/database/migrations/2026_01_01_000810_enforce_store_owner_uniqueness.php new file mode 100644 index 00000000..9ca04998 --- /dev/null +++ b/database/migrations/2026_01_01_000810_enforce_store_owner_uniqueness.php @@ -0,0 +1,17 @@ +id(); + $table->foreignId('refund_id')->constrained()->cascadeOnDelete(); + $table->foreignId('order_line_id')->constrained()->cascadeOnDelete(); + $table->unsignedInteger('quantity'); + $table->integer('amount')->default(0); + $table->unique(['refund_id', 'order_line_id']); + $table->index('order_line_id'); + }); + } + + public function down(): void + { + Schema::dropIfExists('refund_lines'); + } +}; diff --git a/database/seeders/AnalyticsSeeder.php b/database/seeders/AnalyticsSeeder.php new file mode 100644 index 00000000..29edbaf0 --- /dev/null +++ b/database/seeders/AnalyticsSeeder.php @@ -0,0 +1,25 @@ +where('handle', 'acme-fashion')->firstOrFail(); + foreach (range(29, 0) as $offset) { + $orders = 3 + (($offset * 7) % 10); + $revenue = $orders * (6500 + (($offset * 137) % 4000)); + DB::table('analytics_daily')->updateOrInsert(['store_id' => $store->id, 'date' => now()->subDays($offset)->toDateString()], [ + 'orders_count' => $orders, 'revenue_amount' => $revenue, 'aov_amount' => intdiv($revenue, $orders), + 'visits_count' => 90 + (($offset * 17) % 120), 'add_to_cart_count' => 20 + (($offset * 5) % 35), + 'checkout_started_count' => 10 + (($offset * 3) % 20), 'checkout_completed_count' => $orders, + ]); + } + } +} diff --git a/database/seeders/CollectionSeeder.php b/database/seeders/CollectionSeeder.php new file mode 100644 index 00000000..022ec0d5 --- /dev/null +++ b/database/seeders/CollectionSeeder.php @@ -0,0 +1,31 @@ + [ + ['New Arrivals', 'new-arrivals', 'Discover the latest additions to our store.'], + ['T-Shirts', 't-shirts', 'Premium cotton tees for every occasion.'], + ['Pants & Jeans', 'pants-jeans', 'Find the perfect fit from our denim and trouser range.'], + ['Sale', 'sale', 'Great deals on selected items.'], + ], + 'acme-electronics' => [['Featured', 'featured', 'Premium technology for work and play.'], ['Accessories', 'accessories', 'Essential accessories for every setup.']], + ]; + foreach ($sets as $handle => $collections) { + $store = Store::query()->where('handle', $handle)->firstOrFail(); + foreach ($collections as [$title, $collectionHandle, $description]) { + Collection::withoutGlobalScopes()->updateOrCreate(['store_id' => $store->id, 'handle' => $collectionHandle], [ + 'title' => $title, 'description_html' => "{$description}
", 'type' => 'manual', 'status' => 'active', + ]); + } + } + } +} diff --git a/database/seeders/CustomerSeeder.php b/database/seeders/CustomerSeeder.php new file mode 100644 index 00000000..3bfb0217 --- /dev/null +++ b/database/seeders/CustomerSeeder.php @@ -0,0 +1,64 @@ +where('handle', 'acme-fashion')->firstOrFail(); + $electronics = Store::query()->where('handle', 'acme-electronics')->firstOrFail(); + $fashionCustomers = [ + ['customer@acme.test', 'John Doe', true], ['jane@example.com', 'Jane Smith', false], + ['michael@example.com', 'Michael Brown', true], ['sarah@example.com', 'Sarah Wilson', false], + ['david@example.com', 'David Lee', true], ['emma@example.com', 'Emma Garcia', false], + ['james@example.com', 'James Taylor', false], ['lisa@example.com', 'Lisa Anderson', true], + ['robert@example.com', 'Robert Martinez', false], ['anna@example.com', 'Anna Thomas', true], + ]; + foreach ($fashionCustomers as $index => [$email, $name, $marketing]) { + $customer = $this->customer($fashion, $email, $name, $marketing); + $this->address($customer, 'Home', true, [ + 'first_name' => str($name)->before(' ')->toString(), 'last_name' => str($name)->after(' ')->toString(), + 'company' => null, 'address1' => $index === 0 ? 'Hauptstrasse 1' : ($index === 1 ? 'Schillerstrasse 45' : 'Musterstrasse '.($index + 10)), + 'address2' => null, 'city' => $index === 1 ? 'Munich' : 'Berlin', 'province' => $index === 1 ? 'Bavaria' : 'Berlin', + 'province_code' => $index === 1 ? 'BY' : 'BE', 'country' => 'DE', 'country_code' => 'DE', + 'postal_code' => $index === 1 ? '80336' : '10115', 'zip' => $index === 1 ? '80336' : '10115', + 'phone' => $index === 0 ? '+49 30 12345678' : null, + ]); + if ($index === 0) { + $this->address($customer, 'Work', false, [ + 'first_name' => 'John', 'last_name' => 'Doe', 'company' => 'Acme Corp', 'address1' => 'Friedrichstrasse 100', + 'address2' => '3rd Floor', 'city' => 'Berlin', 'province' => 'Berlin', 'province_code' => 'BE', + 'country' => 'DE', 'country_code' => 'DE', 'postal_code' => '10117', 'zip' => '10117', 'phone' => '+49 30 87654321', + ]); + } + } + + foreach ([['techfan@example.com', 'Tech Fan'], ['gadgetlover@example.com', 'Gadget Lover']] as $index => [$email, $name]) { + $customer = $this->customer($electronics, $email, $name, false); + $this->address($customer, 'Home', true, [ + 'first_name' => str($name)->before(' ')->toString(), 'last_name' => str($name)->after(' ')->toString(), + 'address1' => 'Technikweg '.($index + 1), 'city' => 'Berlin', 'province' => 'Berlin', 'province_code' => 'BE', + 'country' => 'DE', 'country_code' => 'DE', 'postal_code' => '10115', 'zip' => '10115', + ]); + } + } + + private function customer(Store $store, string $email, string $name, bool $marketing): Customer + { + return Customer::withoutGlobalScopes()->updateOrCreate(['store_id' => $store->id, 'email' => $email], [ + 'name' => $name, 'password_hash' => Hash::make('password'), 'marketing_opt_in' => $marketing, + ]); + } + + /** @param arrayOur Story
Acme Fashion creates modern essentials with purpose from our Berlin studio.
Our Values
Ethical sourcing, sustainability and fair labour guide every decision.
Our Team
Our Berlin-based designers build lasting wardrobes, not passing trends.
'], + ['FAQ', 'faq', 'Frequently Asked Questions
How long does shipping take?
Germany orders arrive in 2-4 days, express in 1-2 days, and EU orders in 5-7 days.
What is your return policy?
Return unworn items in original packaging within 30 days.
Do you ship internationally?
We ship across the EU and to the US, UK, Canada and Australia.
How do I track an order?
We email your tracking number as soon as it ships.
'], + ['Shipping & Returns', 'shipping-returns', 'Shipping & Returns
Shipping rates
- Germany standard: 4.99 EUR
- Germany express: 9.99 EUR
- EU: 8.99 EUR
- International: 14.99 EUR
Returns are accepted for 30 days. Customers pay return postage unless an item is defective.
'], + ['Privacy Policy', 'privacy-policy', 'Information We Collect
We collect the details needed to fulfil your order.
How We Use Your Information
We use data only to provide and improve our service.
Cookies
Essential cookies keep your cart and account secure.
Contact
privacy@acme-fashion.test
'], + ['Terms of Service', 'terms', 'Orders and Payments
Orders are charged in EUR and prices include tax.
Product Descriptions
Screen colours may vary slightly from physical items.
Limitation of Liability
Liability is limited as permitted by law.
Governing Law
The laws of the Federal Republic of Germany apply.
'], + ] as [$title, $handle, $body]) { + Page::withoutGlobalScopes()->updateOrCreate(['store_id' => $store->id, 'handle' => $handle], [ + 'title' => $title, 'body_html' => $body, 'status' => 'published', 'published_at' => now()->subMonths(3), + ]); + } + } +} diff --git a/database/seeders/ProductSeeder.php b/database/seeders/ProductSeeder.php new file mode 100644 index 00000000..d0825a72 --- /dev/null +++ b/database/seeders/ProductSeeder.php @@ -0,0 +1,135 @@ +where('handle', 'acme-fashion')->firstOrFail(); + $electronics = Store::query()->where('handle', 'acme-electronics')->firstOrFail(); + + $products = [ + ['Classic Cotton T-Shirt', 'classic-cotton-t-shirt', 'Acme Basics', 'T-Shirts', ['new', 'popular'], 2499, null, 200, 15, 'deny', true, ['Size' => ['S', 'M', 'L', 'XL'], 'Color' => ['White', 'Black', 'Navy']], ['new-arrivals', 't-shirts'], 'A timeless classic cotton t-shirt. Comfortable, breathable, and perfect for everyday wear.'], + ['Premium Slim Fit Jeans', 'premium-slim-fit-jeans', 'Acme Denim', 'Pants', ['new', 'sale'], 7999, 9999, 800, 8, 'deny', true, ['Size' => ['28', '30', '32', '34', '36'], 'Color' => ['Blue', 'Black']], ['new-arrivals', 'pants-jeans', 'sale'], 'Slim fit jeans crafted from premium stretch denim. Comfortable all-day wear with a modern silhouette.'], + ['Organic Hoodie', 'organic-hoodie', 'Acme Basics', 'Hoodies', ['new', 'trending'], 5999, null, 500, 20, 'deny', true, ['Size' => ['S', 'M', 'L', 'XL']], ['new-arrivals'], 'Made from 100% organic cotton. Warm, soft, and sustainably produced.'], + ['Leather Belt', 'leather-belt', 'Acme Accessories', 'Accessories', ['popular'], 3499, null, 150, 25, 'deny', true, ['Size' => ['S/M', 'L/XL'], 'Color' => ['Brown', 'Black']], [], 'Genuine leather belt with brushed metal buckle. A wardrobe essential.'], + ['Running Sneakers', 'running-sneakers', 'Acme Sport', 'Shoes', ['trending'], 11999, null, 600, 5, 'deny', true, ['Size' => ['EU 38', 'EU 39', 'EU 40', 'EU 41', 'EU 42', 'EU 43', 'EU 44'], 'Color' => ['White', 'Black']], ['new-arrivals'], 'Lightweight running sneakers with responsive cushioning and breathable mesh upper.'], + ['Graphic Print Tee', 'graphic-print-tee', 'Acme Basics', 'T-Shirts', ['new'], 2999, null, 210, 18, 'deny', true, ['Size' => ['S', 'M', 'L', 'XL']], ['t-shirts'], 'Bold graphic print on soft cotton. Express yourself with this statement piece.'], + ['V-Neck Linen Tee', 'v-neck-linen-tee', 'Acme Basics', 'T-Shirts', ['popular'], 3499, null, 180, 12, 'deny', true, ['Size' => ['S', 'M', 'L'], 'Color' => ['Beige', 'Olive', 'Sky Blue']], ['t-shirts'], 'Lightweight linen blend v-neck. Perfect for warm summer days.'], + ['Striped Polo Shirt', 'striped-polo-shirt', 'Acme Basics', 'T-Shirts', ['sale'], 2799, 3999, 250, 10, 'deny', true, ['Size' => ['S', 'M', 'L', 'XL']], ['t-shirts', 'sale'], 'Classic striped polo with a modern relaxed fit. Knitted collar and two-button placket.'], + ['Cargo Pants', 'cargo-pants', 'Acme Workwear', 'Pants', ['popular'], 5499, null, 700, 14, 'deny', true, ['Size' => ['30', '32', '34', '36'], 'Color' => ['Khaki', 'Olive', 'Black']], ['pants-jeans'], 'Utility cargo pants with multiple pockets. Durable cotton twill construction.'], + ['Chino Shorts', 'chino-shorts', 'Acme Basics', 'Pants', ['new', 'trending'], 3999, null, 350, 16, 'deny', true, ['Size' => ['30', '32', '34', '36'], 'Color' => ['Navy', 'Sand']], ['pants-jeans', 'new-arrivals'], 'Tailored chino shorts. Comfortable stretch fabric with a clean silhouette.'], + ['Wide Leg Trousers', 'wide-leg-trousers', 'Acme Denim', 'Pants', ['sale'], 4999, 6999, 550, 7, 'deny', true, ['Size' => ['S', 'M', 'L']], ['pants-jeans', 'sale'], 'Relaxed wide leg trousers with a high waist. Flowing drape in premium woven fabric.'], + ['Wool Scarf', 'wool-scarf', 'Acme Accessories', 'Accessories', ['popular'], 2999, null, 120, 30, 'deny', true, ['Color' => ['Grey', 'Burgundy', 'Navy']], [], 'Warm merino wool scarf. Soft hand feel, naturally breathable and temperature regulating.'], + ['Canvas Tote Bag', 'canvas-tote-bag', 'Acme Accessories', 'Accessories', ['trending'], 1999, null, 300, 40, 'deny', true, ['Color' => ['Natural', 'Black']], [], 'Heavy-duty canvas tote bag with reinforced handles. Spacious enough for daily essentials.'], + ['Bucket Hat', 'bucket-hat', 'Acme Accessories', 'Accessories', ['new', 'trending'], 2499, null, 80, 22, 'deny', true, ['Size' => ['S/M', 'L/XL'], 'Color' => ['Beige', 'Black', 'Olive']], ['new-arrivals'], 'Lightweight bucket hat for sun protection. Packable design, washed cotton twill.'], + ['Unreleased Winter Jacket', 'unreleased-winter-jacket', 'Acme Outerwear', 'Jackets', ['limited'], 14999, null, 900, 0, 'deny', true, ['Size' => ['S', 'M', 'L', 'XL']], [], 'Upcoming winter collection piece. Insulated puffer jacket with water-resistant shell.', 'draft'], + ['Discontinued Raincoat', 'discontinued-raincoat', 'Acme Outerwear', 'Jackets', [], 8999, null, 400, 3, 'deny', true, ['Size' => ['M', 'L']], [], 'Lightweight waterproof raincoat. This product has been discontinued.', 'archived'], + ['Limited Edition Sneakers', 'limited-edition-sneakers', 'Acme Sport', 'Shoes', ['limited'], 15999, null, 650, 0, 'deny', true, ['Size' => ['EU 40', 'EU 42', 'EU 44']], [], 'Limited edition collaboration sneakers. Once they are gone, they are gone.'], + ['Backorder Denim Jacket', 'backorder-denim-jacket', 'Acme Denim', 'Jackets', ['popular'], 9999, null, 750, 0, 'continue', true, ['Size' => ['S', 'M', 'L', 'XL']], [], 'Classic denim jacket. Currently on backorder - ships within 2-3 weeks.'], + ['Gift Card', 'gift-card', 'Acme Fashion', 'Gift Cards', ['popular'], [2500, 5000, 10000], null, 0, 9999, 'deny', false, ['Amount' => ['25 EUR', '50 EUR', '100 EUR']], [], 'Digital gift card delivered via email. The perfect gift when you are not sure what to choose.'], + ['Cashmere Overcoat', 'cashmere-overcoat', 'Acme Premium', 'Jackets', ['limited', 'new'], 49999, null, 1200, 3, 'deny', true, ['Size' => ['S', 'M', 'L'], 'Color' => ['Camel', 'Charcoal']], ['new-arrivals'], 'Luxurious cashmere-blend overcoat. Impeccable tailoring with silk lining.'], + ]; + + foreach ($products as $position => $definition) { + $this->seedProduct($fashion, $definition, $position); + } + + foreach ([ + ['Pro Laptop 15', 'pro-laptop-15', 'TechCorp', 'Laptops', ['featured'], [99999, 119999, 149999], null, 1800, 10, 'deny', true, ['Storage' => ['256GB', '512GB', '1TB']], ['featured'], 'Professional laptop with a brilliant 15-inch display.'], + ['Wireless Headphones', 'wireless-headphones', 'AudioMax', 'Audio', ['featured'], 14999, null, 250, 25, 'deny', true, ['Color' => ['Black', 'Silver']], ['featured'], 'Immersive wireless audio with active noise cancellation.'], + ['USB-C Cable 2m', 'usb-c-cable-2m', 'CablePro', 'Cables', ['accessory'], 1299, null, 50, 200, 'deny', true, [], ['accessories'], 'Durable two-metre USB-C charging and data cable.'], + ['Mechanical Keyboard', 'mechanical-keyboard', 'KeyTech', 'Peripherals', ['featured'], 12999, null, 1100, 15, 'deny', true, ['Switch Type' => ['Red', 'Blue', 'Brown']], ['featured'], 'Precision mechanical keyboard for work and gaming.'], + ['Monitor Stand', 'monitor-stand', 'DeskGear', 'Accessories', ['accessory'], 4999, null, 2500, 30, 'deny', true, [], ['accessories'], 'Ergonomic monitor stand with integrated storage.'], + ] as $position => $definition) { + $this->seedProduct($electronics, $definition, $position); + } + } + + /** @param array'.$description.'
', + 'vendor' => $vendor, + 'product_type' => $type, + 'tags' => $tags, + 'published_at' => $status === 'draft' ? null : ($status === 'archived' ? now()->subMonths(6) : now()), + ]); + + if (! $product->variants()->exists()) { + $groups = []; + foreach ($options as $optionPosition => $values) { + $option = $product->options()->create(['name' => $optionPosition, 'position' => count($groups)]); + $groups[] = collect($values)->values()->map(fn (string $value, int $valuePosition) => $option->values()->create(['value' => $value, 'position' => $valuePosition]))->all(); + } + $combinations = $groups === [] ? [[]] : $this->cartesian($groups); + foreach ($combinations as $position => $combination) { + $price = is_array($prices) ? (int) ($prices[$position] ?? end($prices)) : (int) $prices; + $sku = $handle === 'gift-card' + ? ['ACME-GIFT-25', 'ACME-GIFT-50', 'ACME-GIFT-100'][$position] + : strtoupper('ACME-'.substr(preg_replace('/[^a-z0-9]/', '', $handle), 0, 8).'-'.($position + 1)); + $variant = $product->variants()->create([ + 'sku' => $sku, + 'barcode' => null, + 'price_amount' => $price, + 'compare_at_amount' => $compareAt, + 'currency' => 'EUR', + 'weight_g' => $weight, + 'requires_shipping' => $requiresShipping, + 'is_default' => $position === 0, + 'position' => $position, + 'status' => 'active', + ]); + if ($combination !== []) { + $variant->optionValues()->sync(collect($combination)->pluck('id')->all()); + } + InventoryItem::withoutGlobalScopes()->updateOrCreate( + ['variant_id' => $variant->id], + [ + 'store_id' => $store->id, + 'quantity_on_hand' => $inventory, + 'quantity_reserved' => 0, + 'policy' => $policy, + ], + ); + } + } + + $collectionIds = Collection::withoutGlobalScopes()->where('store_id', $store->id)->whereIn('handle', $collections)->pluck('id', 'handle'); + $sync = []; + foreach ($collections as $position => $collectionHandle) { + if (isset($collectionIds[$collectionHandle])) { + $sync[$collectionIds[$collectionHandle]] = ['position' => $productPosition]; + } + } + $product->collections()->sync($sync); + } + + /** @param list
+ Export CSV @if($exportUrl)Download export@endifToday Last 7 days Last 30 days Custom All Storefront API All Desktop Mobile Tablet
+
+ Rank Product Units sold Revenue Share {{ $index + 1 }} {{ $product['title'] }} {{ $product['units'] }} {{ $product['percentage'] }}%
+
+
diff --git a/resources/views/admin/apps/index.blade.php b/resources/views/admin/apps/index.blade.php
new file mode 100644
index 00000000..7cd9f4ab
--- /dev/null
+++ b/resources/views/admin/apps/index.blade.php
@@ -0,0 +1,5 @@
+{{ number_format($ordersCount) }}
{{ number_format($conversionRate, 2) }}%
@php $max=max(1,collect($salesChartData)->max('revenue') ?? 1); @endphp @forelse($salesChartData as $point)
@empty
No sales data for this period.
@endforelse- Visits
- {{ number_format($visitsCount) }}
- Add to cart
- {{ number_format($addToCartCount) }}
- Checkout started
- {{ number_format($checkoutStartedCount) }}
- Orders
- {{ number_format($ordersCount) }}
@forelse($topReferrers as $source)
{{ $source['source'] }}{{ $source['sessions'] }} sessions{{ $source['conversion'] }}%
@emptyNo referrer data yet.
@endforelse
+
diff --git a/resources/views/admin/apps/show.blade.php b/resources/views/admin/apps/show.blade.php
new file mode 100644
index 00000000..5da5e4c4
--- /dev/null
+++ b/resources/views/admin/apps/show.blade.php
@@ -0,0 +1,25 @@
+Installed apps
@if($this->installedApps->isEmpty())@foreach($this->installedApps as $installation)
@endifAvailable apps
@foreach($this->availableApps as $app)Install
{{ $app->name }}
Ready to install
+
+
+ @php($status = $installation->status instanceof BackedEnum ? $installation->status->value : $installation->status)
+ @if($status === 'active')
+ Suspend
+ @elseif($status === 'suspended')
+ Resume
+ @endif
+ Uninstall
+
+
+
+
+ Event URL Status Deliveries {{ $webhook->event_type }} {{ $webhook->target_url }} {{ $webhook->deliveries->count() }}
+
+
diff --git a/resources/views/admin/auth/forgot-password.blade.php b/resources/views/admin/auth/forgot-password.blade.php
new file mode 100644
index 00000000..a6a2f32d
--- /dev/null
+++ b/resources/views/admin/auth/forgot-password.blade.php
@@ -0,0 +1,13 @@
+Installed {{ $installation->installed_at?->diffForHumans() ?? 'recently' }}
{{ number_format($this->usage['calls']) }}
Recorded webhook calls
{{ $this->usage['last_call_at'] ? Illuminate\Support\Carbon::parse($this->usage['last_call_at'])->diffForHumans() : 'Never' }}
@forelse((array)$installation->scopes_json as $scope)
No scopes granted.
@endforelseReset your password
+Enter your email and we’ll send reset instructions if an account exists.
+ @if($sent) +If that email exists, we sent a reset link.
+ @else
+
+ @endif
+ Back to sign in
+Sign in to your store
+Manage products, orders, customers, and your storefront.
+ @if(session('status')){{ session('status') }}
@endif
+
+Choose a new password
+ +
+ @if($adminRole !== 'support')Add collection @endif All statuses Active Archived Add collection
+ Title Products Status Updated Actions @if($adminRole === 'support'){{ $collection->title }}@else{{ $collection->title }}@endif {{ $collection->products_count }} {{ $collection->updated_at->diffForHumans(short: true) }} @if(in_array($adminRole, ['owner','admin'])) {{ $this->collections->links() }}
+
+ @endif
+
diff --git a/resources/views/admin/customers/index.blade.php b/resources/views/admin/customers/index.blade.php
new file mode 100644
index 00000000..c698db92
--- /dev/null
+++ b/resources/views/admin/customers/index.blade.php
@@ -0,0 +1,10 @@
+/{{ $collection->handle }}
+
+ Name Email Orders Total spent Customer since {{ $customer->name ?: 'Guest customer' }} {{ $customer->email }} {{ $customer->orders_count }} {{ $customer->created_at->format('M j, Y') }} {{ $this->customers->links() }}
+
+
diff --git a/resources/views/admin/customers/show.blade.php b/resources/views/admin/customers/show.blade.php
new file mode 100644
index 00000000..b3560cd2
--- /dev/null
+++ b/resources/views/admin/customers/show.blade.php
@@ -0,0 +1,18 @@
+
+
diff --git a/resources/views/admin/dashboard.blade.php b/resources/views/admin/dashboard.blade.php
new file mode 100644
index 00000000..c1edca97
--- /dev/null
+++ b/resources/views/admin/dashboard.blade.php
@@ -0,0 +1,66 @@
+
+
+ @if($adminRole !== 'support')Add
+
+
+
+
+
+
+
+
+ - Name
- {{ $customer->name ?: 'Not provided' }}
- {{ $customer->email }}
- Created
- {{ $customer->created_at->format('M j, Y g:i A') }}
- Account
- {{ $customer->password_hash ? 'Registered' : 'Guest checkout' }}
| Order | Date | Payment | Total |
|---|---|---|---|
| {{ $order->order_number }} | {{ ($order->placed_at ?? $order->created_at)->format('M j, Y') }} | ||
| This customer has no orders yet. | |||
{{ $this->orders->links() }}
+ @forelse($customer->addresses as $address)@php $a = (array)$address->address_json; @endphpSet as default @endif@empty
+ {{ $address->label ?: 'Address' }}
@if($address->is_default){{ trim(($a['first_name'] ?? '').' '.($a['last_name'] ?? '')) }}
{{ $a['address1'] ?? '' }}
@if($a['address2'] ?? null){{ $a['address2'] }}
@endif{{ $a['zip'] ?? '' }} {{ $a['city'] ?? '' }}
{{ $a['country'] ?? $a['country_code'] ?? '' }}
@if(!$address->is_default && $adminRole !== 'support')No saved addresses.
@endforelse
+
+
+
+ Today
+ Last 7 days
+ Last 30 days
+ Custom range
+
+
+
+
+ @if($dateRange === 'custom')
+
+
+ @endif
+
+ @php
+ $kpis = [
+ ['label' => 'Total sales', 'value' => number_format($totalSales / 100, 2).' '.$adminStore->default_currency, 'change' => $salesChange],
+ ['label' => 'Orders', 'value' => number_format($ordersCount), 'change' => $ordersChange],
+ ['label' => 'Average order value', 'value' => number_format($averageOrderValue / 100, 2).' '.$adminStore->default_currency, 'change' => $aovChange],
+ ['label' => 'Visitors', 'value' => number_format($visitorsCount), 'change' => $visitorsChange],
+ ];
+ @endphp
+
+ @foreach($kpis as $kpi)
+
+
+ @endforeach
+
+
+ @php $chartMax = max(1, ...array_column($ordersChartData, 'count')); @endphp
+
+
+
+
diff --git a/resources/views/admin/developers/index.blade.php b/resources/views/admin/developers/index.blade.php
new file mode 100644
index 00000000..b3fd8a7f
--- /dev/null
+++ b/resources/views/admin/developers/index.blade.php
@@ -0,0 +1,28 @@
+{{ $kpi['label'] }}
+{{ $kpi['value'] }}
+
+ @foreach($ordersChartData as $point)
+
+
+
+ @endforeach
+ {{ $point['date'] }}: {{ $point['count'] }}
+ @if($loop->first || $loop->last || $loop->iteration % 7 === 0){{ $point['date'] }}@else@endif
+
+
+
+
+
+ @php $funnelMax = max(1, $funnelData['visits']); $steps = ['visits' => 'Visits', 'add_to_cart' => 'Add to cart', 'checkout_started' => 'Checkout started', 'checkout_completed' => 'Checkout completed']; @endphp
+
+
+| Product | Units sold | Revenue |
|---|---|---|
| {{ $product['title'] }} | {{ number_format($product['units_sold']) }} | |
| No sales data for this period. | ||
+ @foreach($steps as $key => $label)
+
+ @endforeach
+
+ {{ $label }}{{ number_format($funnelData[$key]) }}
+
+ Generate new token
+ Name Last used Created Actions {{ Str::after($token->name, 'store:'.$adminStore->id.':') }} {{ $token->last_used_at?->diffForHumans() ?? 'Never' }} {{ $token->created_at->format('M j, Y') }} Revoke
+
+
+ Add webhook
+ Event type Endpoint Status Deliveries Actions {{ $webhook->event_type }} {{ $webhook->target_url }} {{ $webhook->deliveries->count() }}
+
+
diff --git a/resources/views/admin/discounts/form.blade.php b/resources/views/admin/discounts/form.blade.php
new file mode 100644
index 00000000..075eb5a1
--- /dev/null
+++ b/resources/views/admin/discounts/form.blade.php
@@ -0,0 +1,17 @@
+
diff --git a/resources/views/admin/discounts/index.blade.php b/resources/views/admin/discounts/index.blade.php
new file mode 100644
index 00000000..a1d38ae4
--- /dev/null
+++ b/resources/views/admin/discounts/index.blade.php
@@ -0,0 +1,8 @@
+Copy this token now
It will not be shown again.
{{ $generatedToken }}
+ @if($adminRole !== 'support')Create discount @endif All statuses Active Scheduled Expired Discount Type Value Usage Status Dates Actions @if($adminRole === 'support'){{ $discount->code ?: 'Automatic discount' }}@else{{ $discount->code ?: 'Automatic discount' }}@endif @if($valueType === 'percent'){{ $discount->value_amount }}%@elseif($valueType === 'fixed') {{ $discount->usage_count }} / {{ $discount->usage_limit ?? 'unlimited' }} {{ $discount->starts_at?->format('M j, Y') }}@if($discount->ends_at)
to {{ $discount->ends_at->format('M j, Y') }}@endif @if(in_array($adminRole,['owner','admin'])) {{ $this->discounts->links() }}
+
diff --git a/resources/views/admin/inventory/index.blade.php b/resources/views/admin/inventory/index.blade.php
new file mode 100644
index 00000000..a80662de
--- /dev/null
+++ b/resources/views/admin/inventory/index.blade.php
@@ -0,0 +1,12 @@
+to {{ $discount->ends_at->format('M j, Y') }}@endif
+ All stock In stock Low stock Out of stock
+ Product Variant SKU On hand Reserved Available Policy {{ $item->variant->product->title }} {{ $variantName }} {{ $item->variant->sku ?: '—' }} {{ $item->quantity_reserved }} {{ $this->inventoryItems->links() }}
+
+
diff --git a/resources/views/admin/layout/sidebar.blade.php b/resources/views/admin/layout/sidebar.blade.php
new file mode 100644
index 00000000..d99c3ca6
--- /dev/null
+++ b/resources/views/admin/layout/sidebar.blade.php
@@ -0,0 +1,43 @@
+@php
+ $items = [
+ ['label' => 'Dashboard', 'path' => '/admin', 'match' => 'admin.dashboard', 'icon' => 'chart-bar-square'],
+ ['group' => 'Products'],
+ ['label' => 'Products', 'path' => '/admin/products', 'match' => 'admin.products.*', 'icon' => 'cube'],
+ ['label' => 'Collections', 'path' => '/admin/collections', 'match' => 'admin.collections.*', 'icon' => 'rectangle-stack'],
+ ['label' => 'Inventory', 'path' => '/admin/inventory', 'match' => 'admin.inventory.*', 'icon' => 'archive-box'],
+ ['group' => 'Sales'],
+ ['label' => 'Orders', 'path' => '/admin/orders', 'match' => 'admin.orders.*', 'icon' => 'shopping-bag'],
+ ['label' => 'Customers', 'path' => '/admin/customers', 'match' => 'admin.customers.*', 'icon' => 'users'],
+ ['label' => 'Discounts', 'path' => '/admin/discounts', 'match' => 'admin.discounts.*', 'icon' => 'tag'],
+ ['group' => 'Content'],
+ ['label' => 'Pages', 'path' => '/admin/pages', 'match' => 'admin.pages.*', 'icon' => 'document-text'],
+ ['label' => 'Navigation', 'path' => '/admin/navigation', 'match' => 'admin.navigation.*', 'icon' => 'bars-3', 'roles' => ['owner','admin']],
+ ['label' => 'Themes', 'path' => '/admin/themes', 'match' => 'admin.themes.*', 'icon' => 'paint-brush', 'roles' => ['owner','admin']],
+ ['group' => 'Insights'],
+ ['label' => 'Analytics', 'path' => '/admin/analytics', 'match' => 'admin.analytics.*', 'icon' => 'chart-pie', 'roles' => ['owner','admin','staff']],
+ ['label' => 'Search', 'path' => '/admin/search/settings', 'match' => 'admin.search.*', 'icon' => 'magnifying-glass', 'roles' => ['owner','admin']],
+ ['label' => 'Settings', 'path' => '/admin/settings', 'match' => 'admin.settings.*', 'icon' => 'cog-6-tooth', 'roles' => ['owner','admin']],
+ ['label' => 'Apps', 'path' => '/admin/apps', 'match' => 'admin.apps.*', 'icon' => 'squares-2x2', 'roles' => ['owner','admin']],
+ ['label' => 'Developers', 'path' => '/admin/developers', 'match' => 'admin.developers.*', 'icon' => 'code-bracket', 'roles' => ['owner','admin']],
+ ];
+@endphp
+
diff --git a/resources/views/admin/layout/top-bar.blade.php b/resources/views/admin/layout/top-bar.blade.php
new file mode 100644
index 00000000..fa0befb0
--- /dev/null
+++ b/resources/views/admin/layout/top-bar.blade.php
@@ -0,0 +1,36 @@
+
+
+ {{ $currentStoreName }}
+
+ @foreach($stores as $store)
+ {{ $store->name }}
+ @endforeach
+
+
+
+
+
+
+
+
+ {{ $user?->initials() }}
+ {{ $user?->name }}
+
+
+
+ Settings
+ Log out
+
+
+
+{{ $user?->name }}
{{ $user?->email }}
+
+
+
+
+
+
+
+ @if(($breadcrumbs ?? []) !== [])
+
+ @endif
+ {{ $slot }}
+
+
+
+
+
+
+ @fluxScripts
+
+
diff --git a/resources/views/admin/layouts/auth.blade.php b/resources/views/admin/layouts/auth.blade.php
new file mode 100644
index 00000000..0e11e629
--- /dev/null
+++ b/resources/views/admin/layouts/auth.blade.php
@@ -0,0 +1,26 @@
+
+
+
+ @include('partials.head')
+
+
+
+
+
+
+
+
+
+ S
+ {{ config('app.name', 'Shop') }} Admin
+
+ {{ $slot }}
+
+
+ Add item Save menu
+
diff --git a/resources/views/admin/orders/index.blade.php b/resources/views/admin/orders/index.blade.php
new file mode 100644
index 00000000..53c909cc
--- /dev/null
+++ b/resources/views/admin/orders/index.blade.php
@@ -0,0 +1,11 @@
+Menus
@foreach($this->menus as $menu)@endforeach
@forelse($menuItems as $index => $item)
+ {{ $item['label'] }}
{{ $item['type'] }}: {{ $item['url'] ?: ($item['resource_id'] ?? '—') }}
This menu has no items.
@endforelse
+
+ Customer Payment Fulfillment {{ $order->order_number }} {{ $order->placed_at?->format('M j, Y g:i A') ?: $order->created_at->format('M j, Y g:i A') }} {{ $this->orders->links() }}
+
+
diff --git a/resources/views/admin/orders/show.blade.php b/resources/views/admin/orders/show.blade.php
new file mode 100644
index 00000000..5be46d28
--- /dev/null
+++ b/resources/views/admin/orders/show.blade.php
@@ -0,0 +1,45 @@
+@php
+ $financial = $order->financial_status->value ?? $order->financial_status;
+ $fulfillmentStatus = $order->fulfillment_status->value ?? $order->fulfillment_status;
+ $paymentMethod = $order->payment_method->value ?? $order->payment_method;
+ $addressLines = fn($address) => array_filter([trim(($address['first_name'] ?? '').' '.($address['last_name'] ?? '')), $address['line1'] ?? $address['address_line_1'] ?? null, $address['line2'] ?? $address['address_line_2'] ?? null, trim(($address['postal_code'] ?? '').' '.($address['city'] ?? '')), $address['province'] ?? $address['state'] ?? null, $address['country'] ?? $address['country_code'] ?? null]);
+@endphp
+@foreach(['all','pending','paid','fulfilled','cancelled','refunded'] as $status)@endforeach
+ {{ $order->customer?->name ?: 'Guest' }}
{{ $order->email }}
+
+
+
+ Payment must be confirmed before items can be fulfilled. Current financial status: {{ Str::headline($financial) }}. @endif
+
+
diff --git a/resources/views/admin/pages/form.blade.php b/resources/views/admin/pages/form.blade.php
new file mode 100644
index 00000000..14775f91
--- /dev/null
+++ b/resources/views/admin/pages/form.blade.php
@@ -0,0 +1,8 @@
+
diff --git a/resources/views/admin/pages/index.blade.php b/resources/views/admin/pages/index.blade.php
new file mode 100644
index 00000000..a1012268
--- /dev/null
+++ b/resources/views/admin/pages/index.blade.php
@@ -0,0 +1,10 @@
+
+ @if($paymentMethod === 'bank_transfer' && $financial === 'pending' && $adminRole !== 'support')Confirm payment @endif
+ @if(in_array($financial, ['paid','partially_refunded']) && $fulfillmentStatus !== 'fulfilled' && $adminRole !== 'support')Create fulfillment Refund
+ @if(!in_array($financial, ['paid','partially_refunded']))
+
+
+
+
+
+
+
+
+
+
+
+
+ | Product | SKU | Qty | Unit price | Total |
|---|---|---|---|---|
| {{ $line->title_snapshot }} | {{ $line->sku_snapshot ?: '—' }} | {{ $line->quantity }} |
- Subtotal
- Discount
- -
- Shipping
- Tax
- Total
@forelse($order->payments as $payment)
{{ Str::headline($payment->method->value ?? $payment->method) }}
{{ $payment->provider_payment_id ?: 'No provider reference' }}
No payment records.
@endforelse@forelse($order->fulfillments as $fulfillment)
+ @if(($fulfillment->status->value ?? $fulfillment->status) === 'pending' && $adminRole !== 'support')Mark shipped @elseif(($fulfillment->status->value ?? $fulfillment->status) === 'shipped' && $adminRole !== 'support')Mark delivered @endif
{{ $fulfillment->tracking_company ?: 'No carrier' }} · {{ $fulfillment->tracking_number ?: 'No tracking number' }}
@if($fulfillment->tracking_url)Track shipment@endif- @foreach($fulfillment->lines as $line)
- {{ $line->quantity }} × {{ $line->orderLine?->title_snapshot }} @endforeach
No fulfillments created yet.
@endforelseOrder placed
{{ ($order->placed_at ?? $order->created_at)->format('M j, Y g:i A') }}
@foreach($order->payments as $payment)Payment {{ Str::headline($payment->status->value ?? $payment->status) }}
{{ $payment->created_at?->format('M j, Y g:i A') }}
@endforeach @foreach($order->refunds as $refund)Refund {{ Str::headline($refund->status->value ?? $refund->status) }}
· {{ $refund->created_at?->format('M j, Y g:i A') }} @endforeach
+ View customer @endif@foreach($addressLines((array)$order->shipping_address_json) as $line)
+ @foreach($addressLines((array)$order->billing_address_json) as $line)
+
+ {{ $order->customer?->name ?: 'Guest' }}
{{ $order->email }}
@if($order->customer){{ $line }}
@endforeach{{ $line }}
@endforeach
+ Create page Create page Title Handle Status Updated {{ $page->title }} /{{ $page->handle }} {{ $page->updated_at->diffForHumans(short: true) }} {{ $this->pages->links() }}
+
diff --git a/resources/views/admin/products/form.blade.php b/resources/views/admin/products/form.blade.php
new file mode 100644
index 00000000..ba663bb3
--- /dev/null
+++ b/resources/views/admin/products/form.blade.php
@@ -0,0 +1,71 @@
+
diff --git a/resources/views/admin/products/index.blade.php b/resources/views/admin/products/index.blade.php
new file mode 100644
index 00000000..d7f66d37
--- /dev/null
+++ b/resources/views/admin/products/index.blade.php
@@ -0,0 +1,48 @@
+
+
+ @if($adminRole !== 'support')Add product @endif
+
+
+
+
+ All statuses Draft Active Archived All types @foreach($this->productTypes as $type){{ $type }} @endforeach
+
+
+ @if(count($selectedIds) && $adminRole !== 'support')
+
+ @endif
+
+ @if($this->products->isEmpty() && $search === '' && $statusFilter === 'all' && $typeFilter === '')
+ Add product
+ Image Status Inventory Type Vendor
+ @if($image)->url($image->storage_key) }})
@else
+ {{ $product->title }}
+ {{ $inventory }}
+ {{ $product->product_type ?: '—' }} {{ $product->vendor ?: '—' }} {{ $product->updated_at->diffForHumans(short: true) }}
+
+ @empty{{ $this->products->links() }}
+
+ @endif
+
diff --git a/resources/views/admin/search/settings.blade.php b/resources/views/admin/search/settings.blade.php
new file mode 100644
index 00000000..52cbea2e
--- /dev/null
+++ b/resources/views/admin/search/settings.blade.php
@@ -0,0 +1,7 @@
+{{ $product->variants_count }} {{ Str::plural('variant', $product->variants_count) }}
+ Add synonym group Reindex now @if($reindexProgress !== null)@endifSave
+
diff --git a/resources/views/admin/settings/checkout.blade.php b/resources/views/admin/settings/checkout.blade.php
new file mode 100644
index 00000000..40193c92
--- /dev/null
+++ b/resources/views/admin/settings/checkout.blade.php
@@ -0,0 +1,9 @@
+@foreach($synonymGroups as $index => $group)
Last indexed: {{ $lastIndexedAt ? Illuminate\Support\Carbon::parse($lastIndexedAt)->diffForHumans() : 'Never' }}
{{ $reindexProgress }}% complete
+
diff --git a/resources/views/admin/settings/index.blade.php b/resources/views/admin/settings/index.blade.php
new file mode 100644
index 00000000..d7f3a999
--- /dev/null
+++ b/resources/views/admin/settings/index.blade.php
@@ -0,0 +1,40 @@
+
+
+ Add domain
+ Hostname Type Primary TLS Actions {{ $domain->hostname }} @if($domain->is_primary)
+
+ @endif
+
+
diff --git a/resources/views/admin/settings/notifications.blade.php b/resources/views/admin/settings/notifications.blade.php
new file mode 100644
index 00000000..fc2b83b4
--- /dev/null
+++ b/resources/views/admin/settings/notifications.blade.php
@@ -0,0 +1,9 @@
+@unless($domain->is_primary)Set primary
@endunless
+
diff --git a/resources/views/admin/settings/shipping.blade.php b/resources/views/admin/settings/shipping.blade.php
new file mode 100644
index 00000000..75d36812
--- /dev/null
+++ b/resources/views/admin/settings/shipping.blade.php
@@ -0,0 +1,23 @@
+
+ Add zone @if($testResult)
+
+
diff --git a/resources/views/admin/settings/taxes.blade.php b/resources/views/admin/settings/taxes.blade.php
new file mode 100644
index 00000000..476fb45a
--- /dev/null
+++ b/resources/views/admin/settings/taxes.blade.php
@@ -0,0 +1,16 @@
+
diff --git a/resources/views/admin/themes/editor.blade.php b/resources/views/admin/themes/editor.blade.php
new file mode 100644
index 00000000..5598be64
--- /dev/null
+++ b/resources/views/admin/themes/editor.blade.php
@@ -0,0 +1,16 @@
+
+ @forelse($this->zones as $zone)
+
+ Edit Delete Name Type Price Status Actions {{ $rate->name }} Edit Add rate
+ @emptyAdd zone
+
+ @if($testResult['zone'])
@endifMatched zone: {{ $testResult['zone'] }}
- @foreach($testResult['rates'] as $resultRate)
- {{ $resultRate['name'] }} —
No shipping zone matches this address.
@endif
+ Back to themes Save Save and publish
diff --git a/resources/views/admin/themes/index.blade.php b/resources/views/admin/themes/index.blade.php
new file mode 100644
index 00000000..e6908c58
--- /dev/null
+++ b/resources/views/admin/themes/index.blade.php
@@ -0,0 +1,17 @@
+
+
+
+
+
diff --git a/resources/views/components/admin/breadcrumbs.blade.php b/resources/views/components/admin/breadcrumbs.blade.php
new file mode 100644
index 00000000..750e23bf
--- /dev/null
+++ b/resources/views/components/admin/breadcrumbs.blade.php
@@ -0,0 +1,41 @@
+@props([
+ 'items' => [],
+ 'includeHome' => true,
+])
+
+@php
+ $items = collect($items)->values();
+ $firstLabel = strtolower((string) data_get($items->first(), 'label', ''));
+
+ if ($includeHome && $firstLabel !== 'home') {
+ $items->prepend(['label' => __('Home'), 'url' => url('/admin')]);
+ }
+@endphp
+
+
diff --git a/resources/views/components/admin/card.blade.php b/resources/views/components/admin/card.blade.php
new file mode 100644
index 00000000..d596d1c0
--- /dev/null
+++ b/resources/views/components/admin/card.blade.php
@@ -0,0 +1,40 @@
+@props([
+ 'as' => 'section',
+ 'title' => null,
+ 'description' => null,
+ 'headingLevel' => 'h2',
+ 'padding' => true,
+])
+
+@php
+ $tag = in_array(strtolower((string) $as), ['div', 'section', 'article', 'aside'], true)
+ ? strtolower((string) $as)
+ : 'section';
+ $headingLevel = in_array(strtolower((string) $headingLevel), ['h2', 'h3', 'h4'], true)
+ ? strtolower((string) $headingLevel)
+ : 'h2';
+@endphp
+
+<{{ $tag }} {{ $attributes->class(['admin-card', 'p-6' => $padding]) }}>
+ @if (filled($title) || filled($description) || isset($actions))
+
+ @foreach($this->themes as $theme)@php $status=$theme->status instanceof BackedEnum ? $theme->status->value : $theme->status; @endphp
+ $status === 'published', 'border-zinc-200 dark:border-zinc-800' => $status !== 'published'])>
+ Customize @if($status !== 'published')Publish @endifDuplicate @if($status !== 'published')
+ @endforeach
+
+ @endif
+{{ $theme->name }}
Version {{ $theme->version }}
+ @if (filled($title))
+ <{{ $headingLevel }} class="text-base font-semibold text-zinc-950 dark:text-white">{{ $title }}
+ @endif
+
+ @if (filled($description))
+
+
+ @isset($actions)
+ {{ $description }}
+ @endif +{{ $actions }}
+ @endisset
+ filled($title) || filled($description) || isset($actions)])>
+ {{ $slot }}
+
+
diff --git a/resources/views/components/admin/confirmation-modal.blade.php b/resources/views/components/admin/confirmation-modal.blade.php
new file mode 100644
index 00000000..e5a3b6e0
--- /dev/null
+++ b/resources/views/components/admin/confirmation-modal.blade.php
@@ -0,0 +1,56 @@
+@props([
+ 'name',
+ 'title',
+ 'description' => null,
+ 'confirmAction' => null,
+ 'confirmLabel' => 'Confirm',
+ 'confirmingLabel' => 'Working…',
+ 'cancelLabel' => 'Cancel',
+ 'target' => null,
+ 'show' => false,
+])
+
+@php
+ $name = preg_match('/^[a-zA-Z][a-zA-Z0-9_-]*$/', (string) $name) === 1 ? (string) $name : 'confirmation-modal';
+ $confirmAction = filled($confirmAction) && preg_match('/^[a-zA-Z][a-zA-Z0-9_]*(\([^)]*\))?$/', (string) $confirmAction) === 1
+ ? (string) $confirmAction
+ : null;
+ if (blank($target) && filled($confirmAction)) {
+ $target = \Illuminate\Support\Str::before($confirmAction, '(');
+ }
+@endphp
+
+@isset($trigger)
+
+
+
+ {{ $title }}
+
+ @if (filled($description))
+ {{ $description }}
+ @endif
+
+ @if (! $slot->isEmpty())
+
+
+ {{ $slot }}
+ @endif
+
+
+ {{ $cancelLabel }}
+
+
+ @if (filled($confirmAction))
+
+ {{ $confirmLabel }}
+ {{ $confirmingLabel }}
+
+ @else
+ {{ $confirmLabel }}
+ @endif
+
+ class('admin-empty-state') }}>
+ @isset($icon)
+
diff --git a/resources/views/components/admin/field.blade.php b/resources/views/components/admin/field.blade.php
new file mode 100644
index 00000000..7ba1a649
--- /dev/null
+++ b/resources/views/components/admin/field.blade.php
@@ -0,0 +1,33 @@
+@props([
+ 'name',
+ 'label',
+ 'for' => null,
+ 'description' => null,
+ 'error' => null,
+ 'required' => false,
+])
+
+@php
+ $errors ??= new \Illuminate\Support\ViewErrorBag();
+ $error ??= $errors->first((string) $name);
+ $fieldId = $for ?: str_replace(['.', '[', ']'], '-', (string) $name);
+ $descriptionId = $fieldId.'-description';
+ $errorId = $fieldId.'-error';
+@endphp
+
+{{ $icon }}
+ @else
+
+ @endisset
+
+ {{ $title }}
+ + @if (filled($description)) +{{ $description }}
+ @endif + + @isset($action) +{{ $action }}
+ @endisset
+{{ $error }}
+ @endif +
+
+
+
+
+ {{ $title }}
+ @if (filled($description)) +{{ $description }}
+ @endif +{{ $slot }}
+ class('space-y-3') }}>
+
+
+ @if ((int) $selectedCount > 0)
+
+ @endif
+
diff --git a/resources/views/components/admin/loading-overlay.blade.php b/resources/views/components/admin/loading-overlay.blade.php
new file mode 100644
index 00000000..8a240bda
--- /dev/null
+++ b/resources/views/components/admin/loading-overlay.blade.php
@@ -0,0 +1,19 @@
+@props([
+ 'target' => null,
+ 'label' => 'Loading',
+ 'delay' => true,
+])
+
+class('admin-loading-overlay') }}
+ @if ($delay) wire:loading.delay.flex @else wire:loading.flex @endif
+ @if (filled($target)) wire:target="{{ $target }}" @endif
+ role="status"
+ aria-live="polite"
+>
+
+ {{ $label }}
+
diff --git a/resources/views/components/admin/money.blade.php b/resources/views/components/admin/money.blade.php
new file mode 100644
index 00000000..6ec02a9f
--- /dev/null
+++ b/resources/views/components/admin/money.blade.php
@@ -0,0 +1,14 @@
+@props([
+ 'amount',
+ 'currency' => 'USD',
+])
+
+@php
+ $amount = (int) $amount;
+ $currency = strtoupper((string) $currency);
+ $currency = preg_match('/^[A-Z]{3}$/', $currency) === 1 ? $currency : 'USD';
+ $sign = $amount < 0 ? '-' : '';
+ $formatted = $sign.number_format(abs($amount) / 100, 2, '.', ',').' '.$currency;
+@endphp
+
+class('whitespace-nowrap tabular-nums') }}>{{ $formatted }}
diff --git a/resources/views/components/admin/page-header.blade.php b/resources/views/components/admin/page-header.blade.php
new file mode 100644
index 00000000..5e18b354
--- /dev/null
+++ b/resources/views/components/admin/page-header.blade.php
@@ -0,0 +1,25 @@
+@props([
+ 'title',
+ 'description' => null,
+ 'breadcrumbs' => [],
+])
+
+
+
+
+
+
+ @isset($actions)
+ {{ $title }}
+ + @if (filled($description)) +{{ $description }}
+ @endif +{{ $actions }}
+ @endisset
+ class('admin-sticky-save-wrap') }}
+ @if ($dirtyOnly) wire:dirty @endif
+>
+
+
+
+
diff --git a/resources/views/components/admin/switch.blade.php b/resources/views/components/admin/switch.blade.php
new file mode 100644
index 00000000..79b29807
--- /dev/null
+++ b/resources/views/components/admin/switch.blade.php
@@ -0,0 +1,28 @@
+@props([
+ 'label',
+ 'description' => null,
+ 'checked' => false,
+])
+
+
diff --git a/resources/views/components/admin/table-empty.blade.php b/resources/views/components/admin/table-empty.blade.php
new file mode 100644
index 00000000..6eeb366e
--- /dev/null
+++ b/resources/views/components/admin/table-empty.blade.php
@@ -0,0 +1,29 @@
+@props([
+ 'colspan' => 1,
+ 'title' => 'No results',
+ 'description' => null,
+])
+
+
+ @isset($icon)
+
+ {{ $icon }}
+ @else
+
+ @endisset
+
+ {{ $title }}
+ + @if (filled($description)) +{{ $description }}
+ @endif + + @isset($action) +{{ $action }}
+ @endisset
+ class('admin-table-shell') }}>
+
diff --git a/resources/views/components/admin/tabs.blade.php b/resources/views/components/admin/tabs.blade.php
new file mode 100644
index 00000000..fd4ab1f8
--- /dev/null
+++ b/resources/views/components/admin/tabs.blade.php
@@ -0,0 +1,49 @@
+@props([
+ 'items',
+ 'active',
+ 'wireModel' => null,
+ 'label' => 'Filters',
+])
+
+@php
+ $active = $active instanceof \BackedEnum ? $active->value : (string) $active;
+ $wireModel = filled($wireModel) && preg_match('/^[a-zA-Z][a-zA-Z0-9_.]*$/', (string) $wireModel) === 1
+ ? (string) $wireModel
+ : null;
+@endphp
+
+
+
+ @if (filled($caption))
+
+
+ @if (filled($loadingTarget))
+
+
+ @isset($pagination)
+
+ @endisset
+class('admin-tabs') }} role="tablist" aria-label="{{ $label }}">
+ @foreach ($items as $item)
+ @php
+ $value = data_get($item, 'value', data_get($item, 'label', ''));
+ $value = $value instanceof \BackedEnum ? $value->value : (string) $value;
+ $itemLabel = (string) data_get($item, 'label', \Illuminate\Support\Str::headline($value));
+ $url = data_get($item, 'url');
+ $count = data_get($item, 'count');
+ $disabled = (bool) data_get($item, 'disabled', false);
+ $isActive = $active === $value;
+ $setAction = $wireModel
+ ? '$set('.\Illuminate\Support\Js::from($wireModel).', '.\Illuminate\Support\Js::from($value).')'
+ : null;
+ @endphp
+
+ @if (filled($url))
+
+ {{ $itemLabel }}
+ @if ($count !== null){{ $count }}@endif
+
+ @else
+
+ @endif
+ @endforeach
+
diff --git a/resources/views/components/admin/toast-container.blade.php b/resources/views/components/admin/toast-container.blade.php
new file mode 100644
index 00000000..13031a02
--- /dev/null
+++ b/resources/views/components/admin/toast-container.blade.php
@@ -0,0 +1,69 @@
+@props([
+ 'duration' => 5000,
+ 'initial' => [],
+])
+
+@php
+ $duration = max(1000, min(30000, (int) $duration));
+ $initial = collect($initial)
+ ->map(fn (mixed $toast): array => [
+ 'type' => in_array(data_get($toast, 'type'), ['success', 'error', 'info'], true) ? data_get($toast, 'type') : 'info',
+ 'message' => (string) data_get($toast, 'message', ''),
+ ])
+ ->filter(fn (array $toast): bool => $toast['message'] !== '')
+ ->values()
+ ->all();
+@endphp
+
+class('admin-toast-region') }}
+ aria-live="polite"
+ aria-relevant="additions"
+>
+
+
diff --git a/resources/views/components/storefront/account-shell.blade.php b/resources/views/components/storefront/account-shell.blade.php
new file mode 100644
index 00000000..18c977a9
--- /dev/null
+++ b/resources/views/components/storefront/account-shell.blade.php
@@ -0,0 +1,2 @@
+@props(['heading', 'intro' => null])
+
+
+
+
+
+
+
+
+
+{{ $heading }}
@if($intro){{ $intro }}
@endif{{ $slot }}
+ <{{ $headingLevel }} class="storefront-line-clamp-2 text-sm font-semibold leading-5 text-zinc-950 dark:text-white">
+
+ {{ $title }}
+
+
+
+
+
+
+
+ @if ($showQuickAdd)
+
+ @if ($isSoldOut || $variants->isEmpty())
+
+ @elseif ($variants->count() === 1)
+
+ @else
+
+ {{ __('Choose options') }}
+
+ @endif
+
+ @endif
+ except(['id'])->class('inline-flex items-center overflow-hidden rounded-lg border border-zinc-300 bg-white shadow-sm dark:border-zinc-700 dark:bg-zinc-900') }}
+>
+
+
+
+
+
+
+
diff --git a/resources/views/components/storefront/rich-text.blade.php b/resources/views/components/storefront/rich-text.blade.php
new file mode 100644
index 00000000..9c67564f
--- /dev/null
+++ b/resources/views/components/storefront/rich-text.blade.php
@@ -0,0 +1,87 @@
+@props([
+ 'html' => '',
+])
+
+@php
+ $source = (string) $html;
+ $source = preg_replace(
+ '#<(script|style|iframe|object|embed|template|svg|math)\b[^>]*>.*?#is',
+ '',
+ $source,
+ ) ?? '';
+ $source = preg_replace('#<(script|style|iframe|object|embed|template|svg|math)\b[^>]*/?>#is', '', $source) ?? '';
+
+ $allowedTags = 'Add an address to make checkout faster. Account recovery Enter your email and we’ll send reset instructions if an account exists. Welcome back Don’t have an account? Create one Join us Already have an account? Log in Account recovery No orders yet {{ optional($order->placed_at)->format('M j, Y') }} SKU {{ $line->sku_snapshot }} Quantity {{ $line->quantity }} {{ str_replace('_',' ', $order->payment_method instanceof \BackedEnum ? $order->payment_method->value : $order->payment_method) }} {{ $fulfillment->tracking_company }} · {{ $fulfillment->tracking_number }} {{ $discountError }} {{ $message }} {{ $line->variant->optionValues->pluck('value')->join(' / ') }} {{ $message }} {{ $message }} {{ $message }} {{ $message }} {{ $message }} {{ $line->variant->product->title }} {{ $line->variant->optionValues->pluck('value')->join(' / ') }} {{ $discountError }} Order {{ $order->order_number }} We’ve sent a confirmation to {{ $order->email }}. We’ll let you know when your order is on its way. Please transfer the total amount to the following account: Please complete your transfer within 7 days. Your order will be processed once payment is confirmed. {{ $line->title_snapshot }} Quantity: {{ $line->quantity }} {{ str_replace('_', ' ', $order->payment_method instanceof \BackedEnum ? $order->payment_method->value : $order->payment_method) }} Step 1 {{ $email }} Enter your contact details to continue. Step 2 Available after contact information. Step 3 {{ data_get($chosenRate, 'name', 'Selected shipping method') }} Available after your address. Step 4 Available after shipping. Browse by story Explore pieces grouped to make finding your next favorite easy. Please check back shortly. {{ $collection->products_count }} {{ str('product')->plural($collection->products_count) }} Collection {{ $products->total() }} {{ str('product')->plural($products->total()) }} Try adjusting your filters or browse the full collection. Your cart is empty {{ $line->variant->optionValues->pluck('value')->join(' / ') }} Products are coming soon. A note from us Subscribe for thoughtful product updates, useful stories, and occasional offers. {{ $message }} Type at least two characters to search. No results for “{{ $query }}” We’re currently performing maintenance. Please check back shortly. {{ $currentStore->name }}
+ {{ data_get($settings, 'home.hero.subheading') }}
+ Curated for you New and noteworthy {{ $currentStore->name }} {{ $product->vendor }} {{ $message }} {{ $results->total() }} results Try a different search term or clear your filters. Created through the API. Answers. Built for long days. Soft cotton.
';
+ $source = strip_tags($source, $allowedTags);
+ $sanitized = e(strip_tags($source));
+
+ if (class_exists(\DOMDocument::class) && $source !== '') {
+ $document = new \DOMDocument('1.0', 'UTF-8');
+ $previousSetting = libxml_use_internal_errors(true);
+ $document->loadHTML(
+ ''.$source.'',
+ LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD,
+ );
+ libxml_clear_errors();
+ libxml_use_internal_errors($previousSetting);
+
+ $xpath = new \DOMXPath($document);
+
+ foreach ($xpath->query('//*[@*]') ?: [] as $element) {
+ $tagName = strtolower($element->nodeName);
+
+ foreach (iterator_to_array($element->attributes) as $attribute) {
+ $attributeName = strtolower($attribute->nodeName);
+ $isAllowedAnchorAttribute = $tagName === 'a'
+ && in_array($attributeName, ['href', 'title', 'target', 'rel'], true);
+ $isAllowedId = $attributeName === 'id'
+ && preg_match('/^[a-zA-Z][a-zA-Z0-9_:\-.]*$/', $attribute->nodeValue) === 1;
+
+ if (! $isAllowedAnchorAttribute && ! $isAllowedId) {
+ $element->removeAttributeNode($attribute);
+ }
+ }
+
+ if ($tagName !== 'a') {
+ continue;
+ }
+
+ $href = trim(html_entity_decode($element->getAttribute('href'), ENT_QUOTES | ENT_HTML5, 'UTF-8'));
+ $scheme = strtolower((string) parse_url($href, PHP_URL_SCHEME));
+
+ if ($href === '' || preg_match('/[\x00-\x1F\x7F]/', $href) === 1 || ($scheme !== '' && ! in_array($scheme, ['http', 'https', 'mailto', 'tel'], true))) {
+ $element->removeAttribute('href');
+ }
+
+ if ($element->hasAttribute('target') && $element->getAttribute('target') !== '_blank') {
+ $element->removeAttribute('target');
+ }
+
+ if ($element->getAttribute('target') === '_blank') {
+ $element->setAttribute('rel', 'noopener noreferrer');
+ } else {
+ $element->removeAttribute('rel');
+ }
+ }
+
+ foreach ($xpath->query('//comment()') ?: [] as $comment) {
+ $comment->parentNode?->removeChild($comment);
+ }
+
+ $root = $document->getElementById('storefront-rich-text-root');
+
+ if ($root) {
+ $sanitized = '';
+
+ foreach ($root->childNodes as $child) {
+ $sanitized .= $document->saveHTML($child);
+ }
+ }
+ }
+@endphp
+
+@if (trim(strip_tags($sanitized)) !== '')
+ class('storefront-prose') }}>
+ {!! $sanitized !!}
+
+@endif
diff --git a/resources/views/errors/404.blade.php b/resources/views/errors/404.blade.php
new file mode 100644
index 00000000..799c74fa
--- /dev/null
+++ b/resources/views/errors/404.blade.php
@@ -0,0 +1 @@
+@include('storefront.errors.404')
diff --git a/resources/views/errors/503.blade.php b/resources/views/errors/503.blade.php
new file mode 100644
index 00000000..c5bb725f
--- /dev/null
+++ b/resources/views/errors/503.blade.php
@@ -0,0 +1 @@
+@include('storefront.errors.503')
diff --git a/resources/views/partials/head.blade.php b/resources/views/partials/head.blade.php
index dce80588..9f5d9ec7 100644
--- a/resources/views/partials/head.blade.php
+++ b/resources/views/partials/head.blade.php
@@ -3,7 +3,6 @@
@elseNo saved addresses
@foreach($this->addresses as $saved)@php($data = is_string($saved->address_json) ? json_decode($saved->address_json,true) : (array)$saved->address_json)@endif
+ {{ $saved->label ?: 'Address' }}
{{ data_get($data,'first_name') }} {{ data_get($data,'last_name') }}
{{ data_get($data,'address1') }}@if(data_get($data,'address2'))
{{ data_get($data,'address2') }}@endif
{{ data_get($data,'zip',data_get($data,'postal_code')) }} {{ data_get($data,'city') }}
{{ data_get($data,'country_code',data_get($data,'country')) }}@if(!$saved->is_default)@endif
+{{ $editingId ? 'Edit address' : 'Add address' }}
diff --git a/resources/views/storefront/account/auth/login.blade.php b/resources/views/storefront/account/auth/login.blade.php
new file mode 100644
index 00000000..9792d1e7
--- /dev/null
+++ b/resources/views/storefront/account/auth/login.blade.php
@@ -0,0 +1,14 @@
+Reset your password
@if($sent)If that email exists, we sent a reset link.Back to login@else@endif
+
diff --git a/resources/views/storefront/account/auth/register.blade.php b/resources/views/storefront/account/auth/register.blade.php
new file mode 100644
index 00000000..574fe4a4
--- /dev/null
+++ b/resources/views/storefront/account/auth/register.blade.php
@@ -0,0 +1 @@
+
+
+Log in to your account
+ @error('credentials')
+ {{ $message }}@enderror
+
+
diff --git a/resources/views/storefront/account/auth/reset-password.blade.php b/resources/views/storefront/account/auth/reset-password.blade.php
new file mode 100644
index 00000000..914a3624
--- /dev/null
+++ b/resources/views/storefront/account/auth/reset-password.blade.php
@@ -0,0 +1 @@
+Create an account
diff --git a/resources/views/storefront/account/dashboard.blade.php b/resources/views/storefront/account/dashboard.blade.php
new file mode 100644
index 00000000..199718de
--- /dev/null
+++ b/resources/views/storefront/account/dashboard.blade.php
@@ -0,0 +1,4 @@
+Choose a new password
@if($orders->isEmpty())Recent Orders
@if($orders->isNotEmpty())View all@endif@else@endifOrder Date Status Total {{ $order->order_number }} {{ optional($order->placed_at)->format('M j, Y') }} @foreach($orders as $order)
+ Order {{ $order->order_number }}
Total@endforeachOrder Date Status Total Action {{ $order->order_number }} {{ optional($order->placed_at)->format('M j, Y') }} View
+ @endif
+
+ Items
@foreach($order->lines as $line)@php($media = optional(optional($line->product)->media->first())->storage_key)@endforeach@if($media)@endif
{{ $line->title_snapshot }}
@if($line->sku_snapshot)
+ Shipping Address
{{ data_get($shipping,'first_name') }} {{ data_get($shipping,'last_name') }}
{{ data_get($shipping,'address1') }}
{{ data_get($shipping,'zip',data_get($shipping,'postal_code')) }} {{ data_get($shipping,'city') }}
{{ data_get($shipping,'country_code',data_get($shipping,'country')) }}Billing Address
{{ data_get($billing,'first_name') }} {{ data_get($billing,'last_name') }}
{{ data_get($billing,'address1') }}
{{ data_get($billing,'zip',data_get($billing,'postal_code')) }} {{ data_get($billing,'city') }}Payment
+ @if($order->fulfillments->isNotEmpty())@if($order->discount_amount > 0)@endifFulfillment
@foreach($order->fulfillments as $fulfillment)@endforeach{{ $fulfillment->status instanceof \BackedEnum ? $fulfillment->status->value : $fulfillment->status }}@if($fulfillment->tracking_url)Track shipment (opens in a new tab)@endif@if($fulfillment->tracking_company)
+ @if ($discountCode !== '' && ($discountAmount > 0 || $freeShippingDiscount))
+
diff --git a/resources/views/storefront/cart/show.blade.php b/resources/views/storefront/cart/show.blade.php
new file mode 100644
index 00000000..2e200915
--- /dev/null
+++ b/resources/views/storefront/cart/show.blade.php
@@ -0,0 +1,30 @@
+{{ $discountCode }} {{ $freeShippingDiscount ? '(Free shipping)' : '' }}
+ @else
+
+ @if ($discountError)
+
diff --git a/resources/views/storefront/checkout/_address-fields.blade.php b/resources/views/storefront/checkout/_address-fields.blade.php
new file mode 100644
index 00000000..abb3177a
--- /dev/null
+++ b/resources/views/storefront/checkout/_address-fields.blade.php
@@ -0,0 +1,50 @@
+@php($idPrefix = str_replace('.', '-', $prefix))
+Your Cart
+
+ @if (! $this->cart || $this->cart->lines->isEmpty())
+
+ @else
+
+
+ @endif
+@endif
+
{{ $line->variant->product->title }}
+ {{ $line->quantity }}
+
+
diff --git a/resources/views/storefront/checkout/_summary.blade.php b/resources/views/storefront/checkout/_summary.blade.php
new file mode 100644
index 00000000..10446848
--- /dev/null
+++ b/resources/views/storefront/checkout/_summary.blade.php
@@ -0,0 +1,17 @@
+
+
+
+ @error($prefix.'.first_name')
+
+
+
+ @error($prefix.'.last_name')
+
+
+
+
+
+
+
+ @error($prefix.'.address1')
+
+
+
+
+
+
+
+ @error($prefix.'.postal_code')
+
+
+
+ @error($prefix.'.city')
+
+
+
+
+
+
+
+
+
+
+
+
+Order Summary
+
+ @foreach ($checkout->cart->lines as $line)
+ @php($media = optional($line->variant->product->media->first())->storage_key)
+
+
+ @if ($discountCode !== '' && $checkout->discount_code)
+
+ @endforeach
+ @if($media)@endif{{ $line->quantity }}
{{ $discountCode }}
+ @else
+
+ @if($discountError)
+@if($this->totals['discount'] > 0)@endif
+
diff --git a/resources/views/storefront/checkout/show.blade.php b/resources/views/storefront/checkout/show.blade.php
new file mode 100644
index 00000000..82286114
--- /dev/null
+++ b/resources/views/storefront/checkout/show.blade.php
@@ -0,0 +1,104 @@
+Thank you for your order!
Bank Transfer Instructions
Order Summary
@foreach($order->lines as $line)@endforeach@php($media = optional(optional($line->product)->media->first())->storage_key)@if($media)@endif
+
+ Shipping Address
{{ data_get($shippingAddress, 'first_name') }} {{ data_get($shippingAddress, 'last_name') }}
{{ data_get($shippingAddress, 'address1') }}
{{ data_get($shippingAddress, 'zip', data_get($shippingAddress, 'postal_code')) }} {{ data_get($shippingAddress, 'city') }}
{{ data_get($shippingAddress, 'country_code', data_get($shippingAddress, 'country')) }}Payment Method
+
+
+@if($order->discount_amount > 0)@endif
+
diff --git a/resources/views/storefront/collections/_filters.blade.php b/resources/views/storefront/collections/_filters.blade.php
new file mode 100644
index 00000000..1f36895d
--- /dev/null
+++ b/resources/views/storefront/collections/_filters.blade.php
@@ -0,0 +1,20 @@
+
+ {{ $currentStore->name }}
+ Secure checkout
+
+
+
+ @include('storefront.checkout._summary')
+
+
+
+
+
+
+
+ Checkout
+
+
+ @if ($step === 1)
+
+ @elseif ($step > 1)
+ @if($step > 1)@endifContact information
+ @if ($step === 2)
+
+ @elseif ($step > 2)
+ {{ $shipping['first_name'] }} {{ $shipping['last_name'] }}@if($step > 2)@endifShipping address
{{ $shipping['address1'] }}@if($shipping['address2']), {{ $shipping['address2'] }}@endif
{{ $shipping['postal_code'] }} {{ $shipping['city'] }}, {{ $shipping['country'] }}
+ @else
+ @if ($step === 3)
+
+ @elseif ($step > 3)
+ @php($chosenRate = collect($shippingRates)->firstWhere('id', $shippingRateId))
+ @if($step > 3)@endifShipping method
+ @if ($step === 4)
+
+ @elsePayment method
+
diff --git a/resources/views/storefront/collections/index.blade.php b/resources/views/storefront/collections/index.blade.php
new file mode 100644
index 00000000..f7aa3415
--- /dev/null
+++ b/resources/views/storefront/collections/index.blade.php
@@ -0,0 +1,38 @@
+
+
+
+ @if ($this->productTypes !== [])
+
+ @endif
+ @if ($this->availableVendors !== [])
+
+ @endif
+Filters
@if ($this->hasActiveFilters)@endif
+
diff --git a/resources/views/storefront/collections/show.blade.php b/resources/views/storefront/collections/show.blade.php
new file mode 100644
index 00000000..20c19093
--- /dev/null
+++ b/resources/views/storefront/collections/show.blade.php
@@ -0,0 +1,74 @@
+Collections
+
+
+
+ @else
+ Collections are coming soon
+
+ @foreach ($collections as $collection)
+ @php($media = optional(optional($collection->products->first())->media->first())->storage_key)
+
+
+ @endif
+
+ @if ($media)
+
+
+ @else
+
{{ str($collection->title)->substr(0, 1) }}
+ @endif
+
+
+
+ @endforeach
+
+
+
+ {{ $collection->title }}
+
+
diff --git a/resources/views/storefront/components/cart-drawer.blade.php b/resources/views/storefront/components/cart-drawer.blade.php
new file mode 100644
index 00000000..6d1da776
--- /dev/null
+++ b/resources/views/storefront/components/cart-drawer.blade.php
@@ -0,0 +1,40 @@
+{{ $collection->title }}
+ @if ($collection->description_html)
+
+
+
+
+ @if ($this->hasActiveFilters)
+
+ @if ($inStock)@endif
+ @if ($minPrice !== '')@endif
+ @if ($maxPrice !== '')@endif
+ @foreach ($types as $type)@endforeach
+ @foreach ($vendors as $vendor)@endforeach
+
+
+ @endif
+
+
+
+
+
+
+
+
+
+
+
+
+ Filters
+ @include('storefront.collections._filters')
+
+
+
+
+
+ @else
+ No products found
+
+ @foreach ($products as $product)
+
+
+ @endif
+
+
diff --git a/resources/views/storefront/components/featured-products.blade.php b/resources/views/storefront/components/featured-products.blade.php
new file mode 100644
index 00000000..39ff4d42
--- /dev/null
+++ b/resources/views/storefront/components/featured-products.blade.php
@@ -0,0 +1,7 @@
+
+
+
+Your Cart ({{ $this->cartItemCount }})
+
+
+
+ @else
+
+
+ @foreach ($this->cart->lines as $line)
+ @php($media = optional($line->variant->product->media->first())->storage_key)
+
+
+
+ @endif
+ @endif
+
+
+
+
+ {{ $line->variant->product->title }}
+ {{ $line->quantity }}
+ @forelse ($products as $product)
+
diff --git a/resources/views/storefront/components/newsletter-signup.blade.php b/resources/views/storefront/components/newsletter-signup.blade.php
new file mode 100644
index 00000000..5f561176
--- /dev/null
+++ b/resources/views/storefront/components/newsletter-signup.blade.php
@@ -0,0 +1,23 @@
+
+
+Stay in the loop
+
+ @if ($subscribed)
+
+ Thanks for subscribing!
+ @else
+
+ @error('email')
+ @for ($index = 0; $index < $count; $index++)
+
diff --git a/resources/views/storefront/components/search-modal.blade.php b/resources/views/storefront/components/search-modal.blade.php
new file mode 100644
index 00000000..1ee62c6f
--- /dev/null
+++ b/resources/views/storefront/components/search-modal.blade.php
@@ -0,0 +1,19 @@
+
+
+
+
+
+ @endfor
+
+
diff --git a/resources/views/storefront/errors/404.blade.php b/resources/views/storefront/errors/404.blade.php
new file mode 100644
index 00000000..3978a303
--- /dev/null
+++ b/resources/views/storefront/errors/404.blade.php
@@ -0,0 +1,2 @@
+@php($store = $currentStore ?? (app()->bound('current_store') ? app('current_store') : null))
+
+
+
+
+ @if (mb_strlen(trim($query)) < 2)
+
+ Products
@foreach($products as $product)@endif
+ @if($collections !== [])@if($product['image']){{ $product['title'] }}@endif
Collections
@foreach($collections as $collection){{ $collection['title'] }}@endforeach@endif
+
+ @endif
+ {{ str($store?->name ?? config('app.name'))->substr(0,1) }}We’ll be back soon
+ @foreach ((array) data_get($settings, 'home.sections', []) as $section)
+ @if ($section === 'hero' && data_get($settings, 'home.hero.enabled', true))
+
diff --git a/resources/views/storefront/layouts/app.blade.php b/resources/views/storefront/layouts/app.blade.php
new file mode 100644
index 00000000..a88e4ba3
--- /dev/null
+++ b/resources/views/storefront/layouts/app.blade.php
@@ -0,0 +1,97 @@
+@php
+ $mode = data_get($themeSettings, 'dark_mode', 'system');
+ $mode = in_array($mode, ['system', 'toggle', 'light', 'dark'], true) ? $mode : 'system';
+ $primary = data_get($themeSettings, 'colors.primary', '#2563eb');
+ $secondary = data_get($themeSettings, 'colors.secondary', '#18181b');
+ $accent = data_get($themeSettings, 'colors.accent', '#ea580c');
+ $primary = preg_match('/^#[0-9a-f]{6}$/i', (string) $primary) ? $primary : '#2563eb';
+ $secondary = preg_match('/^#[0-9a-f]{6}$/i', (string) $secondary) ? $secondary : '#18181b';
+ $accent = preg_match('/^#[0-9a-f]{6}$/i', (string) $accent) ? $accent : '#ea580c';
+
+ $cartCount = 0;
+ if (class_exists(\App\Services\CartService::class)) {
+ $cart = app(\App\Services\CartService::class)->resolveForSession($currentStore, $storefrontCustomer);
+ $cartCount = $cart ? (int) $cart->lines()->sum('quantity') : 0;
+ }
+
+ app()->setLocale((string) ($currentStore->default_locale ?: config('app.locale')));
+
+ $organizationJson = json_encode([
+ '@context' => 'https://schema.org',
+ '@type' => 'Organization',
+ 'name' => $currentStore->name,
+ 'url' => url('/'),
+ ], JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
+@endphp
+
+
+ @endif
+
+
+
+
+
+
+ {{ data_get($settings, 'home.hero.heading') }}
+
+
+
+
+
+
+
+
+ Shop collections
+
+ @foreach ($collections as $collection)
+ @php($image = optional(optional($collection->products->first())->media->first())->storage_key)
+
+ @if ($image)
+
+ View all collections
+
+ @else
+
+ @endif
+
+
+
+
+ @endforeach
+ {{ $collection->title }}
+ Shop now
+
+
+
+
+
+
+ Featured products
+
+
+
+ @if(data_get($themeSettings, 'announcement.url')){{ data_get($themeSettings, 'announcement.text') }}@else{{ data_get($themeSettings, 'announcement.text') }}@endif
+
+
+
+
+
+ {{ $page->title }}
+
+
diff --git a/resources/views/storefront/search/_filters.blade.php b/resources/views/storefront/search/_filters.blade.php
new file mode 100644
index 00000000..05883b5d
--- /dev/null
+++ b/resources/views/storefront/search/_filters.blade.php
@@ -0,0 +1 @@
+
+
+
+
+
+ @else
+
+ @foreach ($product->media as $index => $media)
+
+
+
+ @endforeach
+
+
+ @foreach ($product->media as $index => $media)
+
+ @endforeach
+
+
+ @foreach ($product->media as $index => $media)
+
+ @endif
+
+ @endforeach
+
{{ $product->title }}
+
+
+ @if ($this->selectedVariant)
+
+
+ @error('variant'){{ $message }}@enderror
+
+
+ @foreach ($product->options as $option)
+
+ @endforeach
+
+
+ @php($inventory = $this->selectedVariant?->inventoryItem)
+
+ @if ($this->selectedVariant && $inventory)
+ @if ($this->availableQuantity === null && (int) $inventory->quantity_on_hand <= 0)
+ Available on backorder
+ @elseif ($this->availableQuantity === 0)
+ Out of stock
+ @elseif ($this->availableQuantity !== null && $this->availableQuantity <= 10)
+ Only {{ $this->availableQuantity }} left in stock
+ @else
+ In stock
+ @endif
+ @endif
+
+
+
+
+
+ @if ($product->description_html)
+
+ @endif
+
+ @php($tags = is_string($product->tags) ? json_decode($product->tags, true) : $product->tags)
+ @if (is_array($tags) && $tags !== [])
+ @foreach ($tags as $tag){{ $tag }}@endforeach
+ @endif
+
diff --git a/resources/views/storefront/search/index.blade.php b/resources/views/storefront/search/index.blade.php
new file mode 100644
index 00000000..e9f438ce
--- /dev/null
+++ b/resources/views/storefront/search/index.blade.php
@@ -0,0 +1,23 @@
+@if($this->productTypes !== [])@endif @if($this->availableVendors !== [])@endifFilters
@if($this->hasActiveFilters)@endif
+
diff --git a/resources/views/welcome.blade.php b/resources/views/welcome.blade.php
index a808a399..827943ca 100644
--- a/resources/views/welcome.blade.php
+++ b/resources/views/welcome.blade.php
@@ -6,7 +6,6 @@
{{ $query !== '' ? $results->total().' results for “'.$query.'”' : 'Search products' }}
+
+ @error('query')
+
+
+ @endif
+
+
+ Filters
@include('storefront.search._filters')
+ @else
+ No results found for “{{ $query }}”
@foreach($results as $product)
+ @endif
+
+
+
+HTML;
+
+ $product = Product::factory()->for($context['store'])->create([
+ 'description_html' => $malicious,
+ ]);
+ $page = Page::factory()->for($context['store'])->create([
+ 'body_html' => $malicious,
+ ]);
+
+ foreach ([$product->getRawOriginal('description_html'), $page->getRawOriginal('body_html')] as $persisted) {
+ expect($persisted)
+ ->toContain('Safe copy
') + ->toContain('Safe link') + ->toContain('')
+ ->not->toContain('script')
+ ->not->toContain('iframe')
+ ->not->toContain('javascript')
+ ->not->toContain('data:image')
+ ->not->toContain('onclick')
+ ->not->toContain('onerror')
+ ->not->toContain('style=')
+ ->not->toContain('target=')
+ ->not->toContain('rel=')
+ ->not->toContain('width=');
+ }
+
+ $product->update(['description_html' => 'Updated
']); + $page->update(['body_html' => 'Quoted']); + + expect($product->refresh()->getRawOriginal('description_html'))->toBe('
Updated
') + ->and($page->refresh()->getRawOriginal('body_html'))->toBe('Quoted'); + }); +}); + +describe('theme preview isolation', function () { + it('only exposes a draft preview to an authorized admin of that storefront tenant', function () { + $storeA = createStoreContext(); + $published = Theme::factory()->for($storeA['store'])->create([ + 'name' => 'Published A', + 'status' => 'published', + ]); + $published->settings()->create(['settings_json' => [ + 'colors' => ['primary' => '#112233'], + ]]); + $draft = Theme::factory()->draft()->for($storeA['store'])->create(['name' => 'Draft A']); + $draft->settings()->create(['settings_json' => [ + 'colors' => ['primary' => '#abcdef'], + ]]); + + $storeB = createStoreContext(); + $foreignDraft = Theme::factory()->draft()->for($storeB['store'])->create(['name' => 'Draft B']); + $foreignDraft->settings()->create(['settings_json' => [ + 'colors' => ['primary' => '#fedcba'], + ]]); + + $previewUrl = "http://{$storeA['domain']->hostname}/?theme_preview={$draft->id}"; + + $this->withSession(["theme_preview.{$draft->id}" => ['colors' => ['primary' => '#ff0000']]]) + ->get($previewUrl) + ->assertOk() + ->assertSee('--storefront-primary: #112233', false) + ->assertDontSee('#abcdef', false) + ->assertDontSee('#ff0000', false); + + $this->actingAs($storeB['user'], 'web') + ->get($previewUrl) + ->assertOk() + ->assertSee('--storefront-primary: #112233', false) + ->assertDontSee('#abcdef', false); + + $this->actingAs($storeA['user'], 'web') + ->get($previewUrl) + ->assertOk() + ->assertSee('--storefront-primary: #abcdef', false) + ->assertDontSee('--storefront-primary: #112233', false); + + $this->get("http://{$storeA['domain']->hostname}/?theme_preview={$foreignDraft->id}") + ->assertOk() + ->assertSee('--storefront-primary: #112233', false) + ->assertDontSee('#fedcba', false); + }); +}); diff --git a/tests/Feature/Shop/SecurityHardeningTest.php b/tests/Feature/Shop/SecurityHardeningTest.php new file mode 100644 index 00000000..f091a558 --- /dev/null +++ b/tests/Feature/Shop/SecurityHardeningTest.php @@ -0,0 +1,161 @@ +disabled()->create(); + + $this->post(route('login.store'), [ + 'email' => $user->email, + 'password' => 'password', + ])->assertSessionHasErrors('email'); + $this->assertGuest('web'); + + $this->actingAs($user)->get('/dashboard')->assertRedirect('/login'); + $this->assertGuest('web'); + }); + + it('rejects and revokes a disabled users Sanctum token', function () { + $context = createStoreContext(); + $token = $context['user']->createToken('disabled-user', [ + 'store:'.$context['store']->id, + ]); + $context['user']->update(['status' => 'disabled']); + + $this->withToken($token->plainTextToken) + ->getJson('/api/admin/v1/stores/'.$context['store']->id.'/me') + ->assertUnauthorized(); + + expect(DB::table('personal_access_tokens')->where('id', $token->accessToken->id)->exists())->toBeFalse(); + }); + + it('builds reset links from the canonical application URL regardless of Host', function () { + Notification::fake(); + config(['app.url' => 'https://canonical.shop.test']); + request()->headers->set('host', 'attacker.example'); + $user = User::factory()->create(); + + expect(Password::broker('users')->sendResetLink(['email' => $user->email])) + ->toBe(Password::RESET_LINK_SENT); + + Notification::assertSentTo($user, ResetPassword::class, function (ResetPassword $notification) use ($user): bool { + $url = $notification->toMail($user)->actionUrl; + + return str_starts_with($url, 'https://canonical.shop.test/admin/reset-password/') + && ! str_contains($url, 'attacker.example'); + }); + }); +}); + +describe('customer identity hardening', function () { + it('creates a fresh account without claiming a guest customer or historical orders', function () { + $store = createStoreContext()['store']; + $guest = Customer::factory()->guest()->for($store)->create(['email' => 'buyer@example.test']); + $historical = Order::factory()->for($store)->for($guest)->create(['email' => 'buyer@example.test']); + + $account = app(CustomerService::class)->register($store, [ + 'name' => 'Buyer', + 'email' => 'buyer@example.test', + 'password' => 'secure-password', + ]); + + expect($account->id)->not->toBe($guest->id) + ->and($account->email)->toBe('buyer@example.test') + ->and($guest->refresh()->email)->toEndWith('@unclaimed.invalid') + ->and($historical->refresh()->customer_id)->toBe($guest->id) + ->and($account->orders()->count())->toBe(0); + }); + + it('does not restore a customer session or remember token in another store', function () { + $storeA = createStoreContext()['store']; + $storeB = createStoreContext()['store']; + $customer = Customer::factory()->for($storeA)->create(); + bindStore($storeB); + + $provider = Auth::createUserProvider('customers'); + + expect($provider?->retrieveById($customer->id))->toBeNull() + ->and($provider?->retrieveByToken($customer->id, 'remember-me'))->toBeNull(); + }); +}); + +describe('untrusted persisted content hardening', function () { + it('permits relative and HTTP links but drops executable URL schemes', function () { + $store = createStoreContext()['store']; + $menu = NavigationMenu::factory()->for($store)->create(); + $unsafeItem = NavigationItem::factory()->for($menu, 'menu')->create(['url' => 'javascript:alert(1)']); + $safeItem = NavigationItem::factory()->for($menu, 'menu')->create(['url' => '/collections/new']); + $theme = Theme::factory()->for($store)->create(); + $settings = $theme->settings()->create(['settings_json' => [ + 'announcement' => ['url' => 'javascript:alert(1)'], + 'home' => ['hero' => ['cta_url' => 'https://example.test/sale']], + ]]); + $order = Order::factory()->for($store)->create(['customer_id' => null]); + $fulfillment = Fulfillment::factory()->for($order)->create(['tracking_url' => 'data:text/html,pwned']); + + expect($unsafeItem->url)->toBeNull() + ->and(DB::table('navigation_items')->where('id', $unsafeItem->id)->value('url'))->toBeNull() + ->and($safeItem->url)->toBe('/collections/new') + ->and(data_get($settings->settings_json, 'announcement.url'))->toBeNull() + ->and(data_get($settings->settings_json, 'home.hero.cta_url'))->toBe('https://example.test/sale') + ->and($fulfillment->tracking_url)->toBeNull() + ->and(DB::table('fulfillments')->where('id', $fulfillment->id)->value('tracking_url'))->toBeNull(); + }); + + it('never serializes encrypted provider payment payloads', function () { + $payment = Payment::factory()->create(['raw_json_encrypted' => ['secret' => 'provider-data']]); + + expect($payment->toArray())->not->toHaveKey('raw_json_encrypted') + ->and($payment->toJson())->not->toContain('provider-data'); + }); +}); + +it('resolves checkout confirmation only from the immutable order id snapshot', function () { + $store = createStoreContext()['store']; + $cart = Cart::factory()->for($store)->create(); + $expected = Order::factory()->for($store)->create(['customer_id' => null, 'email' => 'guest@example.test']); + $other = Order::factory()->for($store)->create(['customer_id' => null, 'email' => 'guest@example.test']); + $checkout = Checkout::factory()->completed()->for($store)->for($cart)->create([ + 'email' => 'guest@example.test', + 'totals_json' => ['order_id' => $expected->id], + ]); + session([ + 'checkout_access.'.$checkout->id => true, + 'last_order_id' => $other->id, + ]); + + Livewire::test(Confirmation::class, ['checkoutId' => $checkout->id]) + ->assertSet('order.id', $expected->id); +}); + +it('blocks Livewire mutations after a store is suspended', function () { + $context = createStoreContext(); + actingAsAdmin($context['user'], $context['store']); + $context['store']->update(['status' => 'suspended']); + bindStore($context['store']->refresh()); + app()->instance('request', Request::create('/livewire/update', 'POST')); + + expect(fn () => (new AdminSettings)->boot()) + ->toThrow(HttpException::class, 'This store is suspended.'); +}); diff --git a/tests/Feature/Shop/SideEffectsSearchAnalyticsJobsTest.php b/tests/Feature/Shop/SideEffectsSearchAnalyticsJobsTest.php new file mode 100644 index 00000000..85dca711 --- /dev/null +++ b/tests/Feature/Shop/SideEffectsSearchAnalyticsJobsTest.php @@ -0,0 +1,451 @@ +instance(DnsResolver::class, new class implements DnsResolver + { + public function resolve(string $hostname): array + { + return ['8.8.8.8']; + } + }); +}); + +describe('search indexing and discovery', function () { + it('finds active published products by prefix and isolates tenants', function () { + $storeA = createStoreContext()['store']; + $storeB = createStoreContext()['store']; + Product::factory()->for($storeA)->create([ + 'title' => 'Blue Cotton T-Shirt', + 'handle' => 'blue-cotton-shirt', + 'description_html' => '
Organic everyday essential
', + 'vendor' => 'Acme Basics', + ]); + Product::factory()->for($storeA)->create(['title' => 'Red Wool Sweater', 'handle' => 'red-wool-sweater']); + Product::factory()->for($storeA)->draft()->create(['title' => 'Cotton Draft', 'handle' => 'cotton-draft']); + Product::factory()->for($storeA)->archived()->create(['title' => 'Cotton Archive', 'handle' => 'cotton-archive']); + Product::factory()->for($storeB)->create(['title' => 'Cotton From Other Store', 'handle' => 'other-cotton']); + bindStore($storeA); + + $results = app(SearchService::class)->search($storeA, 'cott'); + + expect($results->total())->toBe(1) + ->and($results->items()[0]->title)->toBe('Blue Cotton T-Shirt') + ->and(SearchQuery::query()->latest('id')->first()->query)->toBe('cott') + ->and(SearchQuery::query()->latest('id')->first()->results_count)->toBe(1); + }); + + it('updates and removes FTS records through product observation', function () { + $store = createStoreContext()['store']; + $product = Product::factory()->for($store)->create(['title' => 'Original Search Phrase', 'handle' => 'search-observer']); + $search = app(SearchService::class); + + expect($search->search($store, 'Original')->total())->toBe(1); + $product->update(['title' => 'Replacement Discovery Phrase']); + expect($search->search($store, 'Original')->total())->toBe(0) + ->and($search->search($store, 'Replace')->total())->toBe(1); + $product->delete(); + expect($search->search($store, 'Replace')->total())->toBe(0); + }); + + it('paginates results and limits autocomplete suggestions', function () { + $store = createStoreContext()['store']; + foreach (range(1, 25) as $number) { + Product::factory()->for($store)->create([ + 'title' => "Summer Item {$number}", + 'handle' => "summer-item-{$number}", + ]); + } + $search = app(SearchService::class); + LengthAwarePaginator::currentPageResolver(fn (): int => 2); + $page = $search->search($store, 'Summer', perPage: 12); + LengthAwarePaginator::currentPageResolver(fn (): int => 1); + $suggestions = $search->autocomplete($store, 'Sum', 5); + + expect($page->total())->toBe(25) + ->and($page->currentPage())->toBe(2) + ->and($page->items())->toHaveCount(12) + ->and($suggestions)->toHaveCount(5); + }); + + it('sanitizes FTS operators instead of exposing query syntax errors', function () { + $store = createStoreContext()['store']; + Product::factory()->for($store)->create(['title' => 'Safe Cotton Product', 'handle' => 'safe-cotton']); + + $results = app(SearchService::class)->search($store, 'cotton" OR *'); + + expect($results)->toBeInstanceOf(LengthAwarePaginator::class); + }); +}); + +describe('analytics ingestion and aggregation', function () { + it('deduplicates client events inside a store but not across stores', function () { + $storeA = createStoreContext()['store']; + $storeB = createStoreContext()['store']; + $service = app(AnalyticsService::class); + $first = $service->track($storeA, 'page_view', ['path' => '/'], 'session-a', clientEventId: 'client-1'); + $duplicate = $service->track($storeA, 'page_view', ['path' => '/again'], 'session-b', clientEventId: 'client-1'); + $other = $service->track($storeB, 'page_view', ['path' => '/'], 'session-c', clientEventId: 'client-1'); + + expect($duplicate->id)->toBe($first->id) + ->and($other->id)->not->toBe($first->id) + ->and(AnalyticsEvent::withoutGlobalScopes()->where('client_event_id', 'client-1')->count())->toBe(2); + }); + + it('rejects unsupported event types', function () { + $store = createStoreContext()['store']; + + app(AnalyticsService::class)->track($store, 'execute_script'); + })->throws(InvalidArgumentException::class); + + it('aggregates visits conversions revenue and AOV idempotently', function () { + $store = createStoreContext()['store']; + $date = CarbonImmutable::parse('2026-07-10 12:00:00', 'UTC'); + $analytics = app(AnalyticsService::class); + foreach (['visitor-a', 'visitor-a', 'visitor-b'] as $index => $session) { + $analytics->track($store, 'page_view', [], $session, clientEventId: "page-{$index}", occurredAt: $date); + } + foreach (range(1, 3) as $index) { + $analytics->track($store, 'add_to_cart', [], 'visitor-a', clientEventId: "cart-{$index}", occurredAt: $date); + } + foreach ([1000, 2000, 3000] as $index => $total) { + $analytics->track($store, 'checkout_completed', ['total_amount' => $total], 'buyer', clientEventId: "order-{$index}", occurredAt: $date); + } + $analytics->track($store, 'checkout_started', [], 'buyer', clientEventId: 'checkout-start', occurredAt: $date); + + $first = $analytics->aggregate($store, '2026-07-10'); + $second = $analytics->aggregate($store, '2026-07-10'); + + expect($first->orders_count)->toBe(3) + ->and($first->revenue_amount)->toBe(6000) + ->and($first->aov_amount)->toBe(2000) + ->and($first->visits_count)->toBe(2) + ->and($first->add_to_cart_count)->toBe(3) + ->and($first->checkout_started_count)->toBe(1) + ->and($second->getAttributes())->toMatchArray($first->getAttributes()) + ->and(AnalyticsDaily::withoutGlobalScopes()->where('store_id', $store->id)->count())->toBe(1); + }); + + it('aggregates every active store through the scheduled job', function () { + $storeA = createStoreContext()['store']; + $storeB = createStoreContext()['store']; + $service = app(AnalyticsService::class); + $date = now()->subDay()->startOfDay()->addHour(); + $service->track($storeA, 'checkout_completed', ['total_amount' => 1000], 'a', clientEventId: 'a-order', occurredAt: $date); + $service->track($storeB, 'checkout_completed', ['total_amount' => 2500], 'b', clientEventId: 'b-order', occurredAt: $date); + + (new AggregateAnalytics($date->toDateString()))->handle($service); + + expect(AnalyticsDaily::withoutGlobalScopes()->where('date', $date->toDateString())->count())->toBe(2) + ->and(AnalyticsDaily::withoutGlobalScopes()->where('store_id', $storeA->id)->value('revenue_amount'))->toBe(1000) + ->and(AnalyticsDaily::withoutGlobalScopes()->where('store_id', $storeB->id)->value('revenue_amount'))->toBe(2500); + }); +}); + +describe('webhook dispatch delivery and circuit breaking', function () { + it('queues one delivery for each matching active subscription', function () { + Queue::fake(); + $store = createStoreContext()['store']; + $matching = WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $store->id, + 'event_type' => 'order.created', + 'target_url' => 'https://hooks.example/orders', + 'signing_secret_encrypted' => 'top-secret', + 'status' => 'active', + ]); + WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $store->id, + 'event_type' => 'product.created', + 'target_url' => 'https://hooks.example/products', + 'signing_secret_encrypted' => 'top-secret', + 'status' => 'active', + ]); + WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $store->id, + 'event_type' => 'order.created', + 'target_url' => 'https://hooks.example/paused', + 'signing_secret_encrypted' => 'top-secret', + 'status' => 'paused', + ]); + + app(WebhookService::class)->dispatch($store, 'order.created', ['order_id' => 42]); + + expect($matching->deliveries)->toHaveCount(1) + ->and($matching->deliveries->first()->status->value)->toBe('pending') + ->and($matching->deliveries->first()->attempt_count)->toBe(0); + Queue::assertPushed(DeliverWebhook::class, 1); + Queue::assertPushed(DeliverWebhook::class, fn (DeliverWebhook $job): bool => $job->eventType === 'order.created' && $job->payload === ['order_id' => 42]); + }); + + it('posts signed JSON and records a successful response', function () { + Http::fake(['https://hooks.example/*' => Http::response('accepted', 202)]); + $store = createStoreContext()['store']; + $subscription = WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $store->id, + 'event_type' => 'order.created', + 'target_url' => 'https://hooks.example/orders', + 'signing_secret_encrypted' => 'test-secret', + 'status' => 'active', + ]); + $delivery = $subscription->deliveries()->create(['event_id' => (string) Str::uuid(), 'attempt_count' => 0, 'status' => 'pending']); + $payload = ['order_id' => 42, 'total_amount' => 5000]; + + (new DeliverWebhook($delivery, 'order.created', $payload))->handle(app(WebhookService::class)); + + expect($delivery->refresh()->status->value)->toBe('success') + ->and($delivery->attempt_count)->toBe(1) + ->and($delivery->response_code)->toBe(202) + ->and($delivery->response_body_snippet)->toBe('accepted'); + Http::assertSent(function ($request) use ($delivery, $payload): bool { + $body = json_encode($payload, JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES); + $timestamp = (string) ($request->header('X-Platform-Timestamp')[0] ?? ''); + + return $request->url() === 'https://hooks.example/orders' + && $request->body() === $body + && ctype_digit($timestamp) + && $request->hasHeader('X-Platform-Event', 'order.created') + && $request->hasHeader('X-Platform-Delivery-Id', $delivery->event_id) + && $request->hasHeader('X-Platform-Signature', hash_hmac('sha256', $timestamp.'.'.$body, 'test-secret')); + }); + }); + + it('records failures and exposes the required retry schedule', function () { + Http::fake(['https://hooks.example/*' => Http::response('broken', 500)]); + $store = createStoreContext()['store']; + $subscription = WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $store->id, + 'event_type' => 'order.created', + 'target_url' => 'https://hooks.example/orders', + 'signing_secret_encrypted' => 'secret', + 'status' => 'active', + ]); + $delivery = $subscription->deliveries()->create(['event_id' => (string) Str::uuid(), 'attempt_count' => 0, 'status' => 'pending']); + $job = new DeliverWebhook($delivery, 'order.created', ['order_id' => 1]); + + expect(fn () => $job->handle(app(WebhookService::class)))->toThrow(RequestException::class) + ->and($delivery->refresh()->status->value)->toBe('failed') + ->and($delivery->attempt_count)->toBe(1) + ->and($delivery->response_code)->toBe(500) + ->and($job->tries)->toBe(6) + ->and($job->backoff)->toBe([60, 300, 1800, 7200, 43200]); + }); + + it('pauses a subscription after five consecutive delivery failures', function () { + $store = createStoreContext()['store']; + $subscription = WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $store->id, + 'event_type' => 'order.created', + 'target_url' => 'https://hooks.example/orders', + 'signing_secret_encrypted' => 'secret', + 'status' => 'active', + ]); + foreach (range(1, 5) as $attempt) { + $delivery = $subscription->deliveries()->create([ + 'event_id' => (string) Str::uuid(), + 'attempt_count' => 6, + 'status' => 'failed', + 'last_attempt_at' => now(), + ]); + } + + app(WebhookService::class)->recordFailure($delivery); + + expect($subscription->refresh()->status->value)->toBe('paused'); + }); + + it('encrypts subscription secrets at rest', function () { + $store = createStoreContext()['store']; + $subscription = WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $store->id, + 'event_type' => 'order.created', + 'target_url' => 'https://hooks.example/orders', + 'signing_secret_encrypted' => 'plain-secret', + 'status' => 'active', + ]); + $raw = DB::table('webhook_subscriptions')->where('id', $subscription->id)->value('signing_secret_encrypted'); + + expect($raw)->not->toContain('plain-secret') + ->and($subscription->signing_secret_encrypted)->toBe('plain-secret'); + }); +}); + +describe('domain side effects audit and media', function () { + it('turns order creation into notification webhook and deduplicated analytics', function () { + Notification::fake(); + Queue::fake(); + $fixture = paidOrderFixture(); + WebhookSubscription::withoutGlobalScopes()->create([ + 'store_id' => $fixture['store']->id, + 'event_type' => 'order.created', + 'target_url' => 'https://hooks.example/orders', + 'signing_secret_encrypted' => 'secret', + 'status' => 'active', + ]); + + event(new OrderCreated($fixture['order'])); + event(new OrderCreated($fixture['order'])); + + Notification::assertSentOnDemand(OrderLifecycleNotification::class, function (OrderLifecycleNotification $notification, array $channels, object $notifiable) use ($fixture): bool { + return $notification->type === 'confirmed' + && $notification->order->is($fixture['order']) + && ($notifiable->routes['mail'] ?? null) === $fixture['order']->email; + }); + expect(AnalyticsEvent::withoutGlobalScopes() + ->where('store_id', $fixture['store']->id) + ->where('client_event_id', "order:{$fixture['order']->id}:completed") + ->count())->toBe(1) + ->and(WebhookDelivery::query()->count())->toBe(2); + Queue::assertPushed(DeliverWebhook::class, 2); + }); + + it('writes structured audit changes with actor tenant and resource', function () { + $context = createStoreContext(); + actingAsAdmin($context['user'], $context['store']); + $product = Product::factory()->for($context['store'])->create(['title' => 'Before Audit', 'handle' => 'audit-product']); + /** @var LoggerInterface&MockInterface $auditChannel */ + $auditChannel = Mockery::mock(LoggerInterface::class); + $auditChannel->shouldReceive('info')->once()->with('product.updated', Mockery::on(function (array $context) use ($product): bool { + return $context['event'] === 'product.updated' + && $context['user_id'] !== null + && $context['store_id'] === $product->store_id + && $context['resource_type'] === 'product' + && $context['resource_id'] === $product->id + && $context['changes']['title'] === ['Before Audit', 'After Audit']; + })); + Log::shouldReceive('channel')->once()->with('audit')->andReturn($auditChannel); + + $product->update(['title' => 'After Audit']); + }); + + it('generates every media rendition and deletes all files with the record', function () { + Storage::fake('public'); + $store = createStoreContext()['store']; + $product = Product::factory()->for($store)->create(); + $file = UploadedFile::fake()->image('catalog.png', 1200, 800); + $source = $file->storeAs('media/originals', 'catalog.png', 'public'); + $media = $product->media()->create([ + 'type' => 'image', + 'storage_key' => $source, + 'alt_text' => 'Catalog image', + 'position' => 0, + 'status' => 'processing', + ]); + + (new ProcessMediaUpload($media))->handle(); + + expect($media->refresh()->status->value)->toBe('ready') + ->and($media->width)->toBe(1200) + ->and($media->height)->toBe(800) + ->and($media->mime_type)->toBe('image/png') + ->and($media->byte_size)->toBeGreaterThan(0); + foreach (['thumbnail', 'small', 'medium', 'large'] as $size) { + Storage::disk('public')->assertExists("media/{$product->id}/{$media->id}/{$size}.png"); + Storage::disk('public')->assertExists("media/{$product->id}/{$media->id}/{$size}.webp"); + } + + $media->delete(); + Storage::disk('public')->assertMissing($source); + foreach (['thumbnail', 'small', 'medium', 'large'] as $size) { + Storage::disk('public')->assertMissing("media/{$product->id}/{$media->id}/{$size}.png"); + Storage::disk('public')->assertMissing("media/{$product->id}/{$media->id}/{$size}.webp"); + } + }); + + it('marks invalid media failed and preserves the original for diagnosis', function () { + Storage::fake('public'); + $store = createStoreContext()['store']; + $product = Product::factory()->for($store)->create(); + $file = UploadedFile::fake()->createWithContent('invalid.png', 'not an image'); + $source = $file->storeAs('media/originals', 'invalid.png', 'public'); + $media = $product->media()->create(['type' => 'image', 'storage_key' => $source, 'position' => 0, 'status' => 'processing']); + + expect(fn () => (new ProcessMediaUpload($media))->handle())->toThrow(RuntimeException::class) + ->and($media->refresh()->status->value)->toBe('failed'); + Storage::disk('public')->assertExists($source); + }); +}); + +describe('maintenance scheduling and seeded acceptance data', function () { + it('abandons stale carts releases checkout reservations and leaves fresh carts active', function () { + $stale = checkoutReadyForPayment(); + DB::table('carts')->where('id', $stale['cart']->id)->update(['updated_at' => now()->subDays(15)]); + $freshStore = createStoreContext()['store']; + $fresh = app(CartService::class)->create($freshStore); + + (new CleanupAbandonedCarts)->handle(app(CheckoutService::class)); + + expect($stale['cart']->refresh()->status->value)->toBe('abandoned') + ->and($stale['checkout']->refresh()->status->value)->toBe('expired') + ->and($stale['variant']->inventoryItem->refresh()->quantity_reserved)->toBe(0) + ->and($fresh->refresh()->status->value)->toBe('active'); + }); + + it('registers all four required recurring jobs', function () { + Artisan::call('schedule:list'); + $output = Artisan::output(); + + expect($output)->toContain('ExpireAbandonedCheckouts') + ->and($output)->toContain('CleanupAbandonedCarts') + ->and($output)->toContain('AggregateAnalytics') + ->and($output)->toContain('CancelUnpaidBankTransferOrders') + ->and($output)->toContain('*/15 * * * *') + ->and($output)->toContain('30 0 * * *') + ->and($output)->toContain('0 1 * * *') + ->and($output)->toContain('0 2 * * *'); + }); + + it('seeds the exact demo tenants credentials catalog and isolation markers', function () { + $this->seed(); + $fashion = Store::query()->where('handle', 'acme-fashion')->firstOrFail(); + $electronics = Store::query()->where('handle', 'acme-electronics')->firstOrFail(); + $admin = User::query()->where('email', 'admin@acme.test')->firstOrFail(); + $customer = Customer::withoutGlobalScopes()->where('store_id', $fashion->id)->where('email', 'customer@acme.test')->firstOrFail(); + + expect(Store::query()->count())->toBe(2) + ->and($fashion->domains()->where('hostname', 'shop.test')->exists())->toBeTrue() + ->and($fashion->products()->count())->toBe(20) + ->and($electronics->products()->count())->toBe(5) + ->and($fashion->products()->where('handle', 'classic-cotton-t-shirt')->exists())->toBeTrue() + ->and($fashion->products()->where('handle', 'unreleased-winter-jacket')->where('status', 'draft')->exists())->toBeTrue() + ->and($fashion->products()->where('handle', 'gift-card')->whereHas('variants', fn ($query) => $query->where('requires_shipping', false))->exists())->toBeTrue() + ->and($electronics->products()->where('handle', 'pro-laptop-15')->exists())->toBeTrue() + ->and(password_verify('password', $admin->password_hash))->toBeTrue() + ->and(password_verify('password', $customer->password_hash))->toBeTrue() + ->and($admin->roleForStore($fashion)?->value)->toBe('owner'); + }); +}); diff --git a/tests/Feature/Shop/StorefrontApiTest.php b/tests/Feature/Shop/StorefrontApiTest.php new file mode 100644 index 00000000..273d802f --- /dev/null +++ b/tests/Feature/Shop/StorefrontApiTest.php @@ -0,0 +1,553 @@ +hostname.'/api/storefront/v1/'.ltrim($path, '/'); +} + +/** @return array{cart_id: int, email: string} */ +function storefrontCheckoutPayload(int $cartId, string $email = 'buyer@example.test'): array +{ + return ['cart_id' => $cartId, 'email' => $email]; +} + +/** @return array{payment_method: string, card_number: string, card_expiry: string, card_cvc: string, card_holder: string} */ +function storefrontCardPayment(string $number): array +{ + return [ + 'payment_method' => 'credit_card', + 'card_number' => $number, + 'card_expiry' => '12/30', + 'card_cvc' => '123', + 'card_holder' => 'Ada Lovelace', + ]; +} + +describe('storefront cart API', function () { + it('creates retrieves mutates and versions a cart', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store'], variantAttributes: ['price_amount' => 2500]); + + $created = $this->postJson(storefrontApiUrl($context, 'carts')) + ->assertCreated() + ->assertJsonPath('cart_version', 1) + ->assertJsonPath('currency', $context['store']->default_currency) + ->assertJsonCount(0, 'lines'); + $cartId = $created->json('id'); + + $added = $this->postJson(storefrontApiUrl($context, "carts/{$cartId}/lines"), [ + 'variant_id' => $sku['variant']->id, + 'quantity' => 2, + 'expected_version' => 1, + ])->assertCreated() + ->assertJsonPath('cart_version', 2) + ->assertJsonPath('totals.subtotal', 5000) + ->assertJsonPath('lines.0.quantity', 2) + ->assertJsonPath('lines.0.line_total_amount', 5000); + $lineId = $added->json('lines.0.id'); + + $this->getJson(storefrontApiUrl($context, "carts/{$cartId}")) + ->assertOk() + ->assertJsonCount(1, 'lines') + ->assertJsonPath('lines.0.product_title', $sku['product']->title); + + $this->putJson(storefrontApiUrl($context, "carts/{$cartId}/lines/{$lineId}"), [ + 'quantity' => 0, + 'cart_version' => 2, + ])->assertUnprocessable()->assertJsonValidationErrors('quantity'); + + $this->putJson(storefrontApiUrl($context, "carts/{$cartId}/lines/{$lineId}"), [ + 'quantity' => 3, + ])->assertUnprocessable()->assertJsonValidationErrors('cart_version'); + + $this->putJson(storefrontApiUrl($context, "carts/{$cartId}/lines/{$lineId}"), [ + 'quantity' => 3, + 'cart_version' => 2, + ])->assertOk() + ->assertJsonPath('cart_version', 3) + ->assertJsonPath('lines.0.quantity', 3) + ->assertJsonPath('lines.0.line_subtotal_amount', 7500); + + $this->putJson(storefrontApiUrl($context, "carts/{$cartId}/lines/{$lineId}"), [ + 'quantity' => 4, + 'cart_version' => 2, + ])->assertConflict() + ->assertJsonPath('data.cart_version', 3) + ->assertJsonPath('data.lines.0.quantity', 3); + + $this->deleteJson(storefrontApiUrl($context, "carts/{$cartId}/lines/{$lineId}"), [ + 'cart_version' => 3, + ])->assertOk() + ->assertJsonPath('cart_version', 4) + ->assertJsonCount(0, 'lines'); + }); + + it('returns validation responses for invalid quantities variants and inventory', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store'], inventoryAttributes: ['quantity_on_hand' => 1]); + $cart = app(CartService::class)->create($context['store']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + + $this->postJson(storefrontApiUrl($context, "carts/{$cart->id}/lines"), [ + 'variant_id' => 999999, + 'quantity' => 1, + ])->assertUnprocessable()->assertJsonValidationErrors('variant_id'); + + $this->postJson(storefrontApiUrl($context, "carts/{$cart->id}/lines"), [ + 'variant_id' => $sku['variant']->id, + 'quantity' => 0, + ])->assertUnprocessable()->assertJsonValidationErrors('quantity'); + + $this->postJson(storefrontApiUrl($context, "carts/{$cart->id}/lines"), [ + 'variant_id' => $sku['variant']->id, + 'quantity' => 2, + ])->assertUnprocessable()->assertJsonValidationErrors('quantity'); + }); + + it('does not reveal carts or variants from another tenant', function () { + $contextA = createStoreContext(); + $contextB = createStoreContext(); + $foreignSku = makeSellableVariant($contextB['store']); + $foreignCart = app(CartService::class)->create($contextB['store']); + bindStore($contextA['store']); + $cart = app(CartService::class)->create($contextA['store']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + + $this->getJson(storefrontApiUrl($contextA, "carts/{$foreignCart->id}"))->assertNotFound(); + $this->postJson(storefrontApiUrl($contextA, "carts/{$cart->id}/lines"), [ + 'variant_id' => $foreignSku['variant']->id, + 'quantity' => 1, + ])->assertUnprocessable()->assertJsonValidationErrors('variant_id'); + $this->getJson(storefrontApiUrl($contextA, 'carts/999999'))->assertNotFound(); + }); +}); + +describe('storefront cart and checkout ownership', function () { + it('does not let one anonymous session show or mutate another sessions cart or checkout', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store']); + + $cartAId = $this->postJson(storefrontApiUrl($context, 'carts')) + ->assertCreated() + ->json('id'); + $lineAId = $this->postJson(storefrontApiUrl($context, "carts/{$cartAId}/lines"), [ + 'variant_id' => $sku['variant']->id, + 'quantity' => 1, + 'expected_version' => 1, + ])->assertCreated()->json('lines.0.id'); + $checkoutAId = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cartAId, 'session-a@example.test')) + ->assertCreated() + ->assertJsonPath('email', 'session-a@example.test') + ->json('id'); + + $this->flushSession(); + $cartBId = $this->postJson(storefrontApiUrl($context, 'carts')) + ->assertCreated() + ->json('id'); + expect($cartBId)->not->toBe($cartAId); + + $this->getJson(storefrontApiUrl($context, "carts/{$cartAId}"))->assertNotFound(); + $this->postJson(storefrontApiUrl($context, "carts/{$cartAId}/lines"), [ + 'variant_id' => $sku['variant']->id, + 'quantity' => 1, + 'expected_version' => 2, + ])->assertNotFound(); + $this->putJson(storefrontApiUrl($context, "carts/{$cartAId}/lines/{$lineAId}"), [ + 'quantity' => 5, + 'cart_version' => 2, + ])->assertNotFound(); + $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cartAId))->assertNotFound(); + $this->getJson(storefrontApiUrl($context, "checkouts/{$checkoutAId}"))->assertNotFound(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutAId}/address"), validCheckoutAddress()) + ->assertNotFound(); + + $cartA = Cart::withoutGlobalScopes()->with('lines')->findOrFail($cartAId); + $checkoutA = Checkout::withoutGlobalScopes()->findOrFail($checkoutAId); + expect($cartA->cart_version)->toBe(2) + ->and($cartA->lines)->toHaveCount(1) + ->and($cartA->lines->first()->quantity)->toBe(1) + ->and($checkoutA->status->value)->toBe('started') + ->and($checkoutA->email)->toBe('session-a@example.test'); + }); + + it('does not let an authenticated customer access another customers cart or checkout', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store']); + $customerA = Customer::factory()->for($context['store'])->create(); + $customerB = Customer::factory()->for($context['store'])->create(); + $carts = app(CartService::class); + $checkouts = app(CheckoutService::class); + + $cartA = $carts->create($context['store'], $customerA); + $carts->addLine($cartA, $sku['variant'], 1); + $checkoutA = $checkouts->create($cartA); + $cartB = $carts->create($context['store'], $customerB); + $lineB = $carts->addLine($cartB, $sku['variant'], 1); + $checkoutB = $checkouts->create($cartB); + + actingAsCustomer($customerA); + $this->withSession(['cart_id' => $cartB->id]); + + $this->getJson(storefrontApiUrl($context, "carts/{$cartA->id}"))->assertOk(); + $this->getJson(storefrontApiUrl($context, "checkouts/{$checkoutA->id}"))->assertOk(); + $this->getJson(storefrontApiUrl($context, "carts/{$cartB->id}"))->assertNotFound(); + $this->postJson(storefrontApiUrl($context, "carts/{$cartB->id}/lines"), [ + 'variant_id' => $sku['variant']->id, + 'quantity' => 1, + 'expected_version' => 2, + ])->assertNotFound(); + $this->putJson(storefrontApiUrl($context, "carts/{$cartB->id}/lines/{$lineB->id}"), [ + 'quantity' => 5, + 'cart_version' => 2, + ])->assertNotFound(); + $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cartB->id))->assertNotFound(); + $this->getJson(storefrontApiUrl($context, "checkouts/{$checkoutB->id}"))->assertNotFound(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutB->id}/address"), validCheckoutAddress()) + ->assertNotFound(); + + expect($cartB->refresh()->cart_version)->toBe(2) + ->and($lineB->refresh()->quantity)->toBe(1) + ->and($checkoutB->refresh()->status->value)->toBe('started') + ->and($checkoutB->email)->toBeNull(); + }); +}); + +describe('storefront checkout API', function () { + it('keeps one live checkout per cart and refreshes its starting email', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store']); + ['cart' => $cart] = makeCartWithLine($context['store'], $sku['variant']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + + $first = $this->postJson( + storefrontApiUrl($context, 'checkouts'), + storefrontCheckoutPayload($cart->id, 'first@example.test'), + )->assertCreated(); + $second = $this->postJson( + storefrontApiUrl($context, 'checkouts'), + storefrontCheckoutPayload($cart->id, 'second@example.test'), + )->assertCreated(); + + expect($second->json('id'))->toBe($first->json('id')) + ->and($second->json('email'))->toBe('second@example.test') + ->and($cart->checkouts()->whereNotIn('status', ['completed', 'expired'])->count())->toBe(1); + }); + + it('rejects every cart mutation after payment selection', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store']); + ['cart' => $cart, 'line' => $line] = makeCartWithLine($context['store'], $sku['variant']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + $zone = ShippingZone::factory()->for($context['store'])->create(['countries_json' => ['DE']]); + $rate = ShippingRate::factory()->for($zone, 'zone')->create(); + $checkoutId = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cart->id)) + ->assertCreated()->json('id'); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), validCheckoutAddress())->assertOk(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/shipping-method"), ['shipping_method_id' => $rate->id])->assertOk(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/payment-method"), ['payment_method' => 'credit_card']) + ->assertOk()->assertJsonPath('status', 'payment_selected'); + + $this->postJson(storefrontApiUrl($context, "carts/{$cart->id}/lines"), [ + 'variant_id' => $sku['variant']->id, + 'quantity' => 1, + 'expected_version' => 2, + ])->assertUnprocessable()->assertJsonValidationErrors('variant_id'); + $this->putJson(storefrontApiUrl($context, "carts/{$cart->id}/lines/{$line->id}"), [ + 'quantity' => 5, + 'cart_version' => 2, + ])->assertUnprocessable()->assertJsonValidationErrors('cart'); + $this->deleteJson(storefrontApiUrl($context, "carts/{$cart->id}/lines/{$line->id}"), [ + 'cart_version' => 2, + ])->assertUnprocessable()->assertJsonValidationErrors('cart'); + + expect($cart->refresh()->cart_version)->toBe(2) + ->and($line->refresh()->quantity)->toBe(1) + ->and($sku['inventory']->refresh()->quantity_reserved)->toBe(1); + }); + + it('returns gone for an expired checkout', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store']); + ['cart' => $cart] = makeCartWithLine($context['store'], $sku['variant']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + $checkoutId = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cart->id)) + ->assertCreated()->json('id'); + Checkout::withoutGlobalScopes()->whereKey($checkoutId)->update(['expires_at' => now()->subMinute()]); + + $this->getJson(storefrontApiUrl($context, "checkouts/{$checkoutId}"))->assertGone(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), validCheckoutAddress())->assertGone(); + }); + + it('requires complete matching payment fields before charging', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store']); + ['cart' => $cart] = makeCartWithLine($context['store'], $sku['variant']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + $zone = ShippingZone::factory()->for($context['store'])->create(['countries_json' => ['DE']]); + $rate = ShippingRate::factory()->for($zone, 'zone')->create(); + $checkoutId = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cart->id)) + ->assertCreated()->json('id'); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), validCheckoutAddress())->assertOk(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/shipping-method"), ['shipping_method_id' => $rate->id])->assertOk(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/payment-method"), ['payment_method' => 'credit_card'])->assertOk(); + + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/pay"), []) + ->assertUnprocessable()->assertJsonValidationErrors('payment_method'); + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/pay"), ['payment_method' => 'credit_card']) + ->assertUnprocessable()->assertJsonValidationErrors(['card_number', 'card_expiry', 'card_cvc', 'card_holder']); + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/pay"), ['payment_method' => 'paypal']) + ->assertUnprocessable()->assertJsonValidationErrors('payment_method'); + + expect(Order::withoutGlobalScopes()->where('store_id', $context['store']->id)->count())->toBe(0) + ->and(Payment::query()->count())->toBe(0) + ->and($sku['inventory']->refresh()->quantity_reserved)->toBe(1); + }); + + it('progresses a digital-only checkout without a shipping address or rate', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store'], variantAttributes: [ + 'requires_shipping' => false, + 'weight_g' => 0, + ]); + ['cart' => $cart] = makeCartWithLine($context['store'], $sku['variant']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + $checkoutId = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cart->id, 'reader@example.test')) + ->assertCreated()->json('id'); + + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), []) + ->assertOk() + ->assertJsonPath('status', 'addressed') + ->assertJsonPath('shipping_address_json', null) + ->assertJsonCount(0, 'available_shipping_methods'); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/shipping-method"), ['shipping_method_id' => null]) + ->assertOk() + ->assertJsonPath('status', 'shipping_selected') + ->assertJsonPath('shipping_method_id', null) + ->assertJsonPath('totals.shipping', 0); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/payment-method"), ['payment_method' => 'paypal']) + ->assertOk(); + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/pay"), ['payment_method' => 'paypal']) + ->assertOk() + ->assertJsonPath('order.financial_status', 'paid'); + }); + + it('completes and idempotently repeats a discounted card checkout', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store'], variantAttributes: ['price_amount' => 2500]); + ['cart' => $cart] = makeCartWithLine($context['store'], $sku['variant'], 2); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + $zone = ShippingZone::factory()->for($context['store'])->create(['countries_json' => ['DE']]); + $rate = ShippingRate::factory()->for($zone, 'zone')->create(['config_json' => ['amount' => 499]]); + Discount::factory()->for($context['store'])->create(['code' => 'API10', 'value_type' => 'percent', 'value_amount' => 10]); + + $created = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cart->id)) + ->assertCreated() + ->assertJsonPath('status', 'started') + ->assertJsonPath('email', 'buyer@example.test'); + $checkoutId = $created->json('id'); + + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), validCheckoutAddress()) + ->assertOk() + ->assertJsonPath('status', 'addressed') + ->assertJsonPath('available_shipping_methods.0.id', $rate->id) + ->assertJsonPath('available_shipping_methods.0.price_amount', 499); + + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/shipping-method"), ['shipping_method_id' => $rate->id]) + ->assertOk() + ->assertJsonPath('status', 'shipping_selected') + ->assertJsonPath('totals.shipping', 499); + + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/apply-discount"), ['code' => 'api10']) + ->assertOk() + ->assertJsonPath('discount_code', 'api10') + ->assertJsonPath('totals.discount', 500); + + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/payment-method"), ['payment_method' => 'credit_card']) + ->assertOk() + ->assertJsonPath('status', 'payment_selected'); + + $paid = $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/pay"), storefrontCardPayment('4242 4242 4242 4242')) + ->assertOk() + ->assertJsonPath('status', 'completed') + ->assertJsonPath('order.financial_status', 'paid') + ->assertJsonPath('order.total_amount', 4999) + ->assertJsonPath('next_cart.status', 'active') + ->assertJsonPath('next_cart.item_count', 0); + $orderId = $paid->json('order.id'); + $nextCartId = $paid->json('next_cart.id'); + + expect($nextCartId)->not->toBe($cart->id); + $this->getJson(storefrontApiUrl($context, "carts/{$nextCartId}")) + ->assertOk() + ->assertJsonPath('status', 'active') + ->assertJsonPath('totals.item_count', 0); + $this->get('http://'.$context['domain']->hostname.'/') + ->assertOk() + ->assertSee('cartCount: 0', false); + + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/pay"), storefrontCardPayment('4242 4242 4242 4242')) + ->assertOk() + ->assertJsonPath('order.id', $orderId) + ->assertJsonPath('next_cart.id', $nextCartId) + ->assertJsonPath('next_cart.item_count', 0); + + expect(Order::withoutGlobalScopes()->where('store_id', $context['store']->id)->count())->toBe(1) + ->and(Payment::query()->where('order_id', $orderId)->count())->toBe(1) + ->and($sku['inventory']->refresh()->quantity_on_hand)->toBe(18) + ->and($sku['inventory']->quantity_reserved)->toBe(0); + }); + + it('returns a stable decline code and releases inventory', function () { + $context = createStoreContext(); + $sku = makeSellableVariant($context['store']); + ['cart' => $cart] = makeCartWithLine($context['store'], $sku['variant']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$cart->id]]); + $zone = ShippingZone::factory()->for($context['store'])->create(['countries_json' => ['DE']]); + $rate = ShippingRate::factory()->for($zone, 'zone')->create(); + $checkoutId = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cart->id))->json('id'); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), validCheckoutAddress())->assertOk(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/shipping-method"), ['shipping_method_id' => $rate->id])->assertOk(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/payment-method"), ['payment_method' => 'credit_card'])->assertOk(); + + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/pay"), storefrontCardPayment('4000 0000 0000 0002')) + ->assertUnprocessable() + ->assertJsonPath('error_code', 'card_declined'); + + expect($sku['inventory']->refresh()->quantity_reserved)->toBe(0) + ->and(Order::withoutGlobalScopes()->where('store_id', $context['store']->id)->count())->toBe(0); + }); + + it('translates invalid checkout domain input into 422 responses', function () { + $context = createStoreContext(); + $empty = app(CartService::class)->create($context['store']); + $this->withSession(['cart_id' => $empty->id, 'api_cart_ids' => [$empty->id]]); + + $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($empty->id)) + ->assertUnprocessable() + ->assertJsonValidationErrors('cart_id'); + + $sku = makeSellableVariant($context['store']); + ['cart' => $cart] = makeCartWithLine($context['store'], $sku['variant']); + $this->withSession(['cart_id' => $cart->id, 'api_cart_ids' => [$empty->id, $cart->id]]); + $this->postJson(storefrontApiUrl($context, 'checkouts'), ['cart_id' => $cart->id]) + ->assertUnprocessable() + ->assertJsonValidationErrors('email'); + $checkoutId = $this->postJson(storefrontApiUrl($context, 'checkouts'), storefrontCheckoutPayload($cart->id))->json('id'); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), [ + 'email' => 'buyer@example.test', + 'shipping_address' => [ + 'first_name' => 'Ada', 'last_name' => 'Lovelace', 'address1' => 'Street 1', + 'country_code' => 'DE', 'postal_code' => '10115', + ], + ])->assertUnprocessable()->assertJsonValidationErrors('shipping_address.city'); + + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), validCheckoutAddress()) + ->assertUnprocessable() + ->assertJsonValidationErrors('shipping_address'); + + $zone = ShippingZone::factory()->for($context['store'])->create(['countries_json' => ['DE']]); + ShippingRate::factory()->for($zone, 'zone')->create(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/address"), validCheckoutAddress())->assertOk(); + $wrongZone = ShippingZone::factory()->for($context['store'])->create(['countries_json' => ['US']]); + $wrongRate = ShippingRate::factory()->for($wrongZone, 'zone')->create(); + $this->putJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/shipping-method"), ['shipping_method_id' => $wrongRate->id]) + ->assertUnprocessable() + ->assertJsonValidationErrors('shipping_method_id'); + + $this->postJson(storefrontApiUrl($context, "checkouts/{$checkoutId}/apply-discount"), ['code' => 'MISSING']) + ->assertUnprocessable() + ->assertJsonPath('error_code', 'not_found'); + }); +}); + +describe('storefront search analytics and order API', function () { + it('searches suggests validates and rate limits queries', function () { + $context = createStoreContext(); + Product::factory()->for($context['store'])->create(['title' => 'Summer Cotton Dress', 'handle' => 'summer-cotton-dress']); + + $this->getJson(storefrontApiUrl($context, 'search?q=cott')) + ->assertOk() + ->assertJsonPath('pagination.total', 1) + ->assertJsonPath('results.0.title', 'Summer Cotton Dress'); + $this->getJson(storefrontApiUrl($context, 'search/suggest?q=sum')) + ->assertOk() + ->assertJsonPath('suggestions.0.title', 'Summer Cotton Dress'); + $this->getJson(storefrontApiUrl($context, 'search/suggest?q=a'))->assertOk(); + $this->getJson(storefrontApiUrl($context, 'search/suggest?q=')) + ->assertUnprocessable()->assertJsonValidationErrors('q'); + + $this->withServerVariables(['REMOTE_ADDR' => '198.51.100.10']); + foreach (range(1, 30) as $attempt) { + $this->getJson(storefrontApiUrl($context, 'search?q=none'))->assertOk(); + } + $this->getJson(storefrontApiUrl($context, 'search?q=none'))->assertTooManyRequests(); + }); + + it('accepts analytics batches deduplicates events and validates shape', function () { + $context = createStoreContext(); + $customer = Customer::factory()->for($context['store'])->create(); + actingAsCustomer($customer); + $event = [ + 'type' => 'add_to_cart', + 'session_id' => 'session-api', + 'client_event_id' => 'event-api-1', + 'occurred_at' => now()->toIso8601String(), + 'properties' => ['variant_id' => 42], + ]; + + $this->postJson(storefrontApiUrl($context, 'analytics/events'), ['events' => [$event, $event]]) + ->assertStatus(202) + ->assertJsonPath('accepted', 1) + ->assertJsonPath('rejected', 1); + + $stored = AnalyticsEvent::withoutGlobalScopes()->where('store_id', $context['store']->id)->firstOrFail(); + expect(AnalyticsEvent::withoutGlobalScopes()->where('store_id', $context['store']->id)->count())->toBe(1) + ->and($stored->customer_id)->toBe($customer->id) + ->and($stored->properties_json)->toBe(['variant_id' => 42]); + + $this->postJson(storefrontApiUrl($context, 'analytics/events'), ['events' => [[ + 'type' => 'not_supported', + 'session_id' => 'x', + 'client_event_id' => 'bad', + 'occurred_at' => 'not-a-date', + ]]])->assertUnprocessable()->assertJsonValidationErrors(['events.0.type', 'events.0.occurred_at']); + }); + + it('requires a signed order token and scopes the order to its tenant', function () { + $context = createStoreContext(); + $order = Order::factory()->for($context['store'])->create([ + 'customer_id' => null, + 'order_number' => '#API1001', + 'email' => 'buyer@example.test', + ]); + OrderLine::factory()->for($order)->create(['product_id' => null, 'variant_id' => null, 'title_snapshot' => 'Historic Item']); + $token = hash_hmac('sha256', $order->order_number.'|'.$order->email, (string) config('app.key')); + $number = rawurlencode($order->order_number); + + $this->getJson(storefrontApiUrl($context, "orders/{$number}"))->assertUnauthorized(); + $this->getJson(storefrontApiUrl($context, "orders/{$number}?token=wrong"))->assertUnauthorized(); + $this->getJson(storefrontApiUrl($context, "orders/{$number}?token={$token}")) + ->assertOk() + ->assertJsonPath('order_number', '#API1001') + ->assertJsonPath('lines.0.title_snapshot', 'Historic Item'); + + $other = createStoreContext(); + $this->getJson(storefrontApiUrl($other, "orders/{$number}?token={$token}"))->assertNotFound(); + }); +}); diff --git a/tests/Feature/Shop/TenancyAndAuthorizationTest.php b/tests/Feature/Shop/TenancyAndAuthorizationTest.php new file mode 100644 index 00000000..6091d190 --- /dev/null +++ b/tests/Feature/Shop/TenancyAndAuthorizationTest.php @@ -0,0 +1,216 @@ +getJson("http://{$context['domain']->hostname}/api/storefront/v1/search?q=unfindable") + ->assertOk() + ->assertJsonPath('pagination.total', 0); + + expect(app('current_store')->is($context['store']))->toBeTrue() + ->and(Cache::get('store_domain:'.$context['domain']->hostname))->toBe($context['store']->id); + }); + + it('rejects unknown and suspended storefront hosts', function () { + $this->getJson('http://missing-shop.test/api/storefront/v1/search?q=anything') + ->assertNotFound(); + + $context = createStoreContext(storeAttributes: ['status' => 'suspended']); + $this->getJson("http://{$context['domain']->hostname}/api/storefront/v1/search?q=anything") + ->assertStatus(503); + }); + + it('scopes reads creates and direct identifiers to the current store', function () { + $storeA = createStoreContext()['store']; + Product::factory()->count(3)->for($storeA)->create(); + Order::factory()->count(2)->for($storeA)->create(['customer_id' => null]); + + $storeB = Store::factory()->create(); + $foreign = Product::factory()->count(5)->for($storeB)->create()->first(); + Order::factory()->count(4)->for($storeB)->create(['customer_id' => null]); + + bindStore($storeA); + $created = Product::query()->create([ + 'title' => 'Scoped Product', + 'handle' => 'scoped-product', + 'status' => 'draft', + 'tags' => [], + ]); + + expect(Product::query()->count())->toBe(4) + ->and(Order::query()->count())->toBe(2) + ->and($created->store_id)->toBe($storeA->id) + ->and(Product::query()->find($foreign->id))->toBeNull() + ->and(Product::withoutGlobalScope(StoreScope::class)->count())->toBe(9); + }); + + it('allows one customer email per store, not globally', function () { + $storeA = createStoreContext()['store']; + $storeB = createStoreContext()['store']; + $service = app(CustomerService::class); + + $customerA = $service->register($storeA, [ + 'name' => 'Same Buyer', + 'email' => 'same@example.test', + 'password' => 'correct-horse', + ]); + $customerB = $service->register($storeB, [ + 'name' => 'Same Buyer', + 'email' => 'same@example.test', + 'password' => 'correct-horse', + ]); + + expect($customerA->store_id)->not->toBe($customerB->store_id) + ->and(Customer::withoutGlobalScopes()->where('email', 'same@example.test')->count())->toBe(2); + + $service->register($storeA, [ + 'name' => 'Duplicate', + 'email' => 'same@example.test', + 'password' => 'correct-horse', + ]); + })->throws(ValidationException::class); +}); + +describe('role policies', function () { + it('returns the typed role for a store and null elsewhere', function () { + $context = createStoreContext(StoreUserRole::Staff); + $unrelated = Store::factory()->create(); + + expect($context['user']->roleForStore($context['store']))->toBe(StoreUserRole::Staff) + ->and($context['user']->roleForStore($unrelated))->toBeNull(); + }); + + it('enforces product permissions for every store role', function (string $role, bool $create, bool $delete) { + $context = createStoreContext($role); + $product = Product::factory()->for($context['store'])->create(); + $policy = new ProductPolicy; + + expect($policy->view($context['user'], $product))->toBeTrue() + ->and($policy->create($context['user']))->toBe($create) + ->and($policy->update($context['user'], $product))->toBe($create) + ->and($policy->delete($context['user'], $product))->toBe($delete); + })->with([ + 'owner' => ['owner', true, true], + 'admin' => ['admin', true, true], + 'staff' => ['staff', true, false], + 'support' => ['support', false, false], + ]); + + it('enforces order refund and fulfillment permissions for every store role', function (string $role, bool $mutate, bool $refund) { + $context = createStoreContext($role); + $order = Order::factory()->for($context['store'])->create(['customer_id' => null]); + $orders = new OrderPolicy; + $refunds = new RefundPolicy; + + expect($orders->view($context['user'], $order))->toBeTrue() + ->and($orders->update($context['user'], $order))->toBe($mutate) + ->and($orders->fulfill($context['user'], $order))->toBe($mutate) + ->and($orders->refund($context['user'], $order))->toBe($refund) + ->and($refunds->create($context['user'], $order))->toBe($refund); + })->with([ + 'owner' => ['owner', true, true], + 'admin' => ['admin', true, true], + 'staff' => ['staff', true, false], + 'support read-only' => ['support', false, false], + ]); + + it('restricts settings staff management and store deletion', function (string $role, bool $settings, bool $delete) { + $context = createStoreContext($role); + $policy = new StorePolicy; + + expect($policy->view($context['user'], $context['store']))->toBeTrue() + ->and($policy->update($context['user'], $context['store']))->toBe($settings) + ->and($policy->manageStaff($context['user'], $context['store']))->toBe($settings) + ->and($policy->delete($context['user'], $context['store']))->toBe($delete); + })->with([ + 'owner' => ['owner', true, true], + 'admin' => ['admin', true, false], + 'staff' => ['staff', false, false], + 'support' => ['support', false, false], + ]); + + it('never authorizes a resource from another tenant', function () { + $context = createStoreContext('owner'); + $other = Store::factory()->create(); + $foreignProduct = Product::factory()->for($other)->create(); + + expect((new ProductPolicy)->update($context['user'], $foreignProduct))->toBeFalse(); + }); +}); + +describe('Sanctum administration tokens', function () { + it('persists abilities and authenticates a bearer token', function () { + $context = createStoreContext(); + $token = $context['user']->createToken('qa', [ + 'read-products', + 'write-products', + 'store:'.$context['store']->id, + ]); + + expect($token->accessToken->abilities)->toBe([ + 'read-products', + 'write-products', + 'store:'.$context['store']->id, + ]) + ->and($token->plainTextToken)->toContain('|'); + + $this->withToken($token->plainTextToken) + ->getJson("/api/admin/v1/stores/{$context['store']->id}/products") + ->assertOk() + ->assertJsonStructure(['data', 'meta' => ['current_page', 'last_page', 'total']]); + }); + + it('rejects missing invalid revoked and cross-store tokens', function () { + $context = createStoreContext(); + $otherStore = Store::factory()->create(); + + $this->getJson("/api/admin/v1/stores/{$context['store']->id}/products")->assertUnauthorized(); + $this->withToken('definitely-invalid')->getJson("/api/admin/v1/stores/{$context['store']->id}/products")->assertUnauthorized(); + + $token = $context['user']->createToken('revoked', [ + 'read-products', + 'store:'.$context['store']->id, + ]); + $plain = $token->plainTextToken; + $token->accessToken->delete(); + $this->withToken($plain)->getJson("/api/admin/v1/stores/{$context['store']->id}/products")->assertUnauthorized(); + + $valid = $context['user']->createToken('valid', [ + 'read-products', + 'store:'.$context['store']->id, + ]); + $this->withToken($valid->plainTextToken) + ->getJson("/api/admin/v1/stores/{$otherStore->id}/products") + ->assertForbidden(); + }); + + it('enforces token abilities on product mutations', function () { + $context = createStoreContext(); + $readOnly = $context['user']->createToken('reader', [ + 'read-products', + 'store:'.$context['store']->id, + ]); + + $this->withToken($readOnly->plainTextToken) + ->postJson("/api/admin/v1/stores/{$context['store']->id}/products", [ + 'title' => 'Forbidden Product', + 'variant' => ['price_amount' => 1000], + ]) + ->assertForbidden(); + }); +}); diff --git a/tests/Feature/Shop/ThemeArchiveAndSearchStatusTest.php b/tests/Feature/Shop/ThemeArchiveAndSearchStatusTest.php new file mode 100644 index 00000000..b414b9ce --- /dev/null +++ b/tests/Feature/Shop/ThemeArchiveAndSearchStatusTest.php @@ -0,0 +1,355 @@ + $entries + */ +function acceptanceThemeArchive(array $entries): UploadedFile +{ + $path = tempnam(sys_get_temp_dir(), 'acceptance-theme-'); + $zip = new ZipArchive; + $result = $zip->open($path, ZipArchive::OVERWRITE); + expect($result)->toBeTrue(); + + foreach ($entries as $name => $contents) { + $zip->addFromString($name, $contents); + } + + $zip->close(); + + return new UploadedFile($path, 'theme.zip', 'application/zip', null, true); +} + +/** @return array