Bump version to 0.21.1

CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.21.1] - 2026-09-25
+
+### Changed
+- `GuestOrderClaimer` and its `UserAuthenticated` listener moved from 3dealer's own
+  `App\Services`/`App\Listeners` into `Modules\Core\Customer\Services\GuestOrderClaimer` /
+  `Listeners\ClaimGuestOrdersOnLogin`, registered in `CustomerServiceProvider` — attaching a
+  placed guest order to an account once its billing `contact_email` case-insensitively matches
+  the account's email (only ever safe right after the shopper has proved they own that email: a
+  login code, or 3dealer's own email-change confirmation) was already core-appropriate logic
+  with no 3dealer-specific behavior. `Account\EmailController::verify()` now calls the core
+  service directly.
+
+## [0.21.0] - 2026-09-25
+
+### Added
+- `Modules\Core\File` — a generic, storage-backend-agnostic file registry: `Models\File` (a
+  `files` table row per stored file — disk, path, original name, mime, size, a `purpose` tag,
+  and a nullable polymorphic owner), `Services\FileService` (store/retrieve/download/exists/
+  delete/list/`pruneUnowned`, delegating every actual byte-level operation to a
+  `Contracts\FileAdapterInterface` resolved per disk — `Adapters\LocalFileAdapter` today, the
+  same contextual-binding pattern `Shipping\Contracts\CarrierFulfillmentInterface` already uses
+  per carrier, so a future `S3FileAdapter` is one class and one more match arm, nothing else
+  changes), and `Http\Controllers\DownloadFileController` — a signed-URL-only route
+  (`files.download`) any consuming app can mint a link to, serving either inline (a preview) or
+  as a forced download (`?download=1`).
+- `Modules\Core\File\Http\Controllers\UploadFileController` — an abstract base for "accept an
+  upload, validate it, store it via `FileService`, return its id" endpoints. Which
+  extensions/sizes are acceptable is deliberately left to a concrete subclass's own
+  `purpose()`/`validationRules()` overrides (ordinary server-side PHP, never trusting anything
+  the request itself claims about its own limits) — a real policy decision that can differ per
+  site and even per product/field, not something a shared base class or config file could
+  express safely.
+- `boboko:file:prune-unowned {purpose}` — deletes every unowned `File` of a given purpose past
+  its grace period (`--hours`, default 24). Generic: any consuming app schedules it once per
+  purpose string it stores files under.
+- `Modules\Core\Cart\Events\CartLineAdded`/`Checkout\Events\OrderPlaced` listeners
+  (`File\Listeners\AttachCustomFieldFileToCartLine`/`TransferCustomFieldFileOwnership`) that
+  re-point a `File`'s ownership from unowned → the real `CartLine` once one exists, then from
+  that `CartLine` → the `OrderLine` an order is placed with — so a File referenced by a product
+  custom field survives the cart it originated from being cleared, without ever being copied.
+
+### Changed
+- The admin order-lines table's collapsible details dropdown (next to the existing price
+  breakdown) now shows a product's custom-field answers (`OrderLine.meta.custom_fields`) — a
+  bordered table matching the existing price-breakdown one, with a thumbnail preview and a
+  download-icon link for a file answer, resolved through `File\Services\FileService`'s signed
+  route. Previously never shown anywhere in the admin.
+- 3dealer's product custom-field photo upload (`CustomFieldUploadController`), cart line meta
+  (`CartController::customFieldsMeta()`), and pruning (formerly its own `PruneCustomFieldUploads`
+  command) now go through `Modules\Core\File` instead of a bespoke `Crypt::encryptString({disk,
+  path, name, mime})` reference scheme — a cart/order line's file answer is now just a `File`
+  row's `file_id`, with `File` as the single source of truth for every other detail.
+
 ## [0.20.2] - 2026-09-25
 
 ### Changed

composer.json

@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.20.2",
+  "version": "0.21.1",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"

src/Customer/Listeners/ClaimGuestOrdersOnLogin.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Modules\Core\Customer\Listeners;
+
+use Modules\Core\Auth\Events\UserAuthenticated;
+use Modules\Core\Customer\Services\GuestOrderClaimer;
+
+/**
+ * Registered from Providers\CustomerServiceProvider — UserAuthenticated
+ * only fires after a valid login code, which is what makes matching
+ * placed guest orders by email safe (see GuestOrderClaimer's own
+ * docblock).
+ */
+class ClaimGuestOrdersOnLogin
+{
+    public function __construct(
+        private readonly GuestOrderClaimer $claimer,
+    ) {}
+
+    public function handle(UserAuthenticated $event): void
+    {
+        $this->claimer->claim($event->user);
+    }
+}

src/Customer/Services/GuestOrderClaimer.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Modules\Core\Customer\Services;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Lunar\Base\LunarUser;
+use Lunar\Models\Order;
+
+/**
+ * Attaches placed guest orders to an account when their billing email
+ * matches the account's email, case-insensitively. Only ever called right
+ * after the shopper has proved they own that email — a login code
+ * (Auth\Events\UserAuthenticated), or the code confirming an email change
+ * (a consuming app's own email-change flow, e.g. 3dealer's Account\
+ * EmailController::verify()) — which is what makes matching on email safe.
+ *
+ * Only orders with no customer_id AND no user_id are touched: an order
+ * already attached to any account (guest or otherwise) is left alone.
+ */
+class GuestOrderClaimer
+{
+    public function claim(Authenticatable&LunarUser $user): int
+    {
+        $customer = $user->latestCustomer();
+
+        if (! $customer || ! $user->email) {
+            return 0;
+        }
+
+        return Order::query()
+            ->whereNotNull('placed_at')
+            ->whereNull('customer_id')
+            ->whereNull('user_id')
+            ->whereHas('billingAddress', fn ($query) => $query
+                ->whereRaw('lower(contact_email) = ?', [strtolower($user->email)]))
+            ->update([
+                'customer_id' => $customer->id,
+                'user_id' => $user->id,
+            ]);
+    }
+}

src/Providers/CustomerServiceProvider.php

@@ -6,11 +6,13 @@ use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
 use Lunar\Facades\ModelManifest;
 use Lunar\Models\Contracts\Customer as LunarCustomer;
+use Modules\Core\Auth\Events\UserAuthenticated;
 use Modules\Core\Auth\Events\UserCreated;
 use Modules\Core\Customer\Events\CustomerAddressCreated;
 use Modules\Core\Customer\Events\CustomerAddressDeleted;
 use Modules\Core\Customer\Events\CustomerAddressUpdated;
 use Modules\Core\Customer\Events\CustomerProfileUpdated;
+use Modules\Core\Customer\Listeners\ClaimGuestOrdersOnLogin;
 use Modules\Core\Customer\Listeners\CreateCustomerForUser;
 use Modules\Core\Customer\Listeners\LogCustomerAccountActivity;
 use Modules\Core\Customer\Models\Customer;
@@ -35,6 +37,7 @@ class CustomerServiceProvider extends ServiceProvider
         $this->app->booted(fn () => ModelManifest::replace(LunarCustomer::class, Customer::class));
 
         Event::listen(UserCreated::class, CreateCustomerForUser::class);
+        Event::listen(UserAuthenticated::class, ClaimGuestOrdersOnLogin::class);
 
         Event::listen(CustomerAddressCreated::class, [LogCustomerAccountActivity::class, 'handleAddressCreated']);
         Event::listen(CustomerAddressUpdated::class, [LogCustomerAccountActivity::class, 'handleAddressUpdated']);