GPSR product safety and traceability fields

Paid pluginsize Mplanned, not built

Indicative price, not an offer: €29–59/month or bundled with Omnibus

Generated from docs/plan/paid/gpsr-product-safety-and-traceability-fields/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Paid module (EUR 29–59/month or bundled with Omnibus Directive) that adds mandatory product safety and traceability fields for the EU GPSR (General Product Safety Regulation), effective 13 Dec 2024. Merchants must capture manufacturer, EU Responsible Person, product safety warnings, and batch/serial numbers. AstroBaaS currently has no product attributes system, so merchants cannot add custom fields at all.

The problem

No fields for manufacturer, EU Responsible Person, or safety warnings. GPSR is mandatory since 13 Dec 2024. AstroBaaS merchants cannot add fields at all, so GPSR compliance is impossible. Selling non-compliant products risks product seizure, fines, and loss of market access in the EU.

What it does

• Product attributes system (precondition, core, or in this module): allows merchants to define custom fields (text, select, multi-select, checkbox, date)
• GPSR-specific attributes (pre-built templates): Manufacturer (text), Manufacturer Country (select, dropdown of EU countries), EU Responsible Person (text + address), Product Safety Warnings (rich text, allow-listed HTML), PQ Code/Batch Number (text), Expiry Date (date), Safety Certifications (multi-select: CE, UL, RoHS, etc.)
• Admin product editor: each attribute is a form field (text, rich text, select, etc.); GPSR fields are optional but recommended
• Product API: returns attributes in response (GET /api/products/:id includes attributes array)
• Public product pages: theme can display GPSR fields (manufacturer, safety warnings, certifications) using template variables
• Product import: CSV import includes columns for GPSR fields (batch import for large catalogues)

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• No automated GPSR compliance checking — AstroBaaS does not validate that a product is legally compliant (reason: legality depends on the product type, materials, and use case; merchant must research their product)
• No audit or filing with EU authorities — attributes are stored; merchant must report to their national regulator (reason: GPSR reporting is a legal/administrative process, not an API problem)

Data model

Depends on whether product attributes system exists in core. If core has attributes: Product.attributes (array of {attribute_id, value}). If not in core, this module provides it: new Attribute entity {id, name, label, type (text|select|multi_select|date), product_type_id} and ProductAttribute {product_id, attribute_id, value}. New GPSR-specific attributes in a pre-built set. Migration to create GPSR attributes on module activation.

API

• POST /api/product-attributes { name, label, type, options? } (create custom attribute)
• GET /api/product-attributes (list available attributes)
• PUT /api/products/:id/attributes { attribute_id: value, … } (set product attributes)
• GET /api/products/:id (response includes attributes array)
• POST /api/products/import-csv { csv_file } (import with attribute columns)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Product editor gains ‘Product Attributes’ tab. GPSR attributes are shown as form fields (Manufacturer, EU Responsible Person, Warnings, Batch Number, Expiry Date, Certifications). Merchant can add custom attributes (Settings → Product Attributes). Product list can filter by attribute (e.g., ‘Certifications: CE’).

The seam — why this is paid

If core provides product attributes: this module pre-loads GPSR-specific attributes and provides template/guidance. If core does not provide attributes: this module (or a separate ‘Product Attributes’ core feature) must be built first. Merchant owns entering accurate GPSR data. Themes own displaying the attributes on public pages.

EU compliance obligation (per-country). Part of compliance pack with Omnibus and VAT.

Dependencies

• Product attributes system (core or this module, if not in core)
• Product entity (core)
• CSV import (core, needs extension to support attributes)
• Theme template system (to display attributes)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Product attributes system exists and merchant can create custom attributes
• Activating this module pre-loads GPSR attributes (Manufacturer, EU Responsible Person, Safety Warnings, Certifications)
• Product editor shows GPSR fields; merchant fills Manufacturer=‘ACME Ltd’, EU Responsible Person=‘John Smith, Berlin’, Certifications=‘CE, RoHS’
• GET /api/products/:id returns attributes in the response: {attributes: [{attribute_id: ‘manufacturer’, value: ‘ACME Ltd’}, …]}
• Public product page displays Safety Warnings and Certifications using theme template variables {{product.attributes.warnings}}, {{product.attributes.certifications}}
• CSV import includes columns ‘Manufacturer’, ‘EU_Responsible_Person’, ‘Safety_Warnings’, ‘Certifications’; bulk import sets attributes for all rows

Risks

Product attributes system does not exist in core; building it from scratch is a separate project (Medium/Large size). Merchant forgets to fill GPSR fields; product is non-compliant but system has no enforcement (module is advisory). Theme does not display GPSR fields; customers never see compliance info. CSV column names are wrong (‘Manufacturer’ vs. ‘manufacturer’); import silently skips. Merchant enters illegal/false safety info; AstroBaaS cannot validate.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.