more cart

pkg/cart/cart-grain.go

@@ -86,6 +86,25 @@ type Notice struct {
 	Code      *string   `json:"code,omitempty"`
 }
 
+// PushToken is the Go-level mirror of cart_messages.PushToken: a generic,
+// provider-agnostic push-delivery target. Stored on the grain so the
+// abandoned-cart recovery scanner can hand it to a notifier without
+// re-decoding proto messages; the wire shape lives in proto/cart.proto.
+//
+// SECURITY: the raw Token persists verbatim to the per-pod event log
+// (CartGrain JSON-marshals PushTokens on every mutation). Anyone with read
+// access to the cart service's data dir — PVC snapshots, debug dumps, log
+// archival — can extract device handles. A future hardening pass should
+// either hash-on-write (hash.compareAtLaunch) for stateless matching or
+// encrypt-at-rest with a key the notifier owns. v0 keeps the seam: a real
+// notifier should treat the stored token as opaque, fetch any canonical
+// canonicalised handle from the input side (frontend/web SDK), and use
+// what's here only for routing.
+type PushToken struct {
+	Platform string `json:"platform"`
+	Token    string `json:"token"`
+}
+
 type CartPaymentStatus string
 
 const (
@@ -151,6 +170,14 @@ type CartGrain struct {
 	Notifications       []CartNotification              `json:"cartNotification,omitempty"`
 	SubscriptionDetails map[string]*SubscriptionDetails `json:"subscriptionDetails,omitempty"`
 
+	// Email is the cart's recovery contact address. Set explicitly via the
+	// SetRecoveryContact mutation (independent of the linked profile's email),
+	// so abandoned-cart recovery can fire before login. Empty string = no email.
+	Email string `json:"email,omitempty"`
+	// PushTokens holds every push delivery target the shopper attached to this
+	// cart. Empty list = no push. PUT-style replaced by SetRecoveryContact.
+	PushTokens []PushToken `json:"pushTokens,omitempty"`
+
 	//CheckoutOrderId        string                          `json:"checkoutOrderId,omitempty"`
 	CheckoutStatus *CartPaymentStatus `json:"checkoutStatus,omitempty"`
 	//CheckoutCountry        string                          `json:"checkoutCountry,omitempty"`