@blamejs/blamejs-shop 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.2 (2026-05-30) — **Creating a product lands you on its detail screen to finish setup.** Creating a product from the admin console now takes you straight to that product's detail screen — where you add a variant, set its price, and add stock — instead of returning you to the product list. A banner on the new product names the remaining steps to make it sellable. This removes the hunt-for-the-product-you-just-made step from the catalog setup flow. **Changed:** *Product create flows straight into editing* — Submitting the new-product form now redirects to the product's detail screen with a banner naming the next steps — add a variant with a SKU, set its price, and add stock — rather than bouncing back to the product list. Configuring a just-created product no longer requires finding it again first.
+
+- v0.3.1 (2026-05-30) — **Fix CSRF origin check refusing authenticated forms behind a TLS-terminating proxy.** The token-based CSRF protection added in 0.3.0 runs an Origin/Referer pre-check on every state-changing request. When the app is served behind a proxy that terminates TLS and forwards plain HTTP to the application — a CDN or load balancer, the standard production topology — the application saw the connection as HTTP and rebuilt its own origin as `http://<host>`, while the browser's request carried `Origin: https://<host>`. That bare scheme mismatch made the check refuse every legitimate same-origin POST as cross-origin, blocking sign-in and every account and admin form. The CSRF gate now trusts the forwarded protocol header — the same proxy stance the session cookies already use — so it derives the real public origin, and it matches against an explicit allowlist of the public origin(s), configurable via SHOP_PUBLIC_ORIGINS. The token cookie also regains its `__Host-` prefix over the forwarded HTTPS connection. No operator action is required for the default origin. **Fixed:** *Authenticated forms no longer refused behind a TLS-terminating proxy* — The CSRF origin pre-check derived the application origin from the raw proxied connection scheme, so a same-origin browser POST carrying `Origin: https://<host>` was refused as cross-origin under a CDN that forwards plain HTTP. The gate now trusts the forwarded `x-forwarded-proto` and matches against an explicit public-origin allowlist — `SHOP_PUBLIC_ORIGINS` (comma-separated), defaulting to the canonical origin — so sign-in and the account and admin forms submit correctly. The double-submit token cookie also regains its `__Host-` prefix over the forwarded HTTPS connection.
+
 - v0.3.0 (2026-05-30) — **Token-based CSRF protection on the account and admin forms.** Every state-changing form on the customer account surface — subscriptions, addresses, wishlist, returns, reviews, loyalty, referrals, passkey management, profile, checkout — and the entire admin console now carries a per-request double-submit CSRF token that is validated on submission. This is a defense-in-depth layer on top of the existing SameSite session cookies and the fetch-metadata cross-site gate. It lands with an update of the vendored blamejs runtime to v0.13.46, whose createApp now wires CSRF into the request lifecycle by default (closing the long-standing gap where it was documented but not enforced). The edge-rendered, cached storefront forms (add-to-cart, cookie consent, newsletter, currency switch) keep their SameSite + fetch-metadata defense — a per-session token cannot be embedded in HTML that is cached and identical for every visitor, and forcing one would break no-JS submission. No operator action or configuration change is required. **Security:** *Per-form CSRF tokens on account and admin* — The container-rendered account and admin forms now embed a hidden `_csrf` field carrying a per-request double-submit token; the server validates it (constant-time) on every state-changing POST. The passkey enrolment / sign-in islands send the matching token in the `X-CSRF-Token` header. This is layered on top of — not a replacement for — the SameSite session cookies and the fetch-metadata cross-site refusal already in place. · *Vendored blamejs runtime updated to v0.13.46* — createApp now wires CSRF (double-submit cookie), plus the cookie / CSP-nonce / fetch-metadata / body-parser layers, into the request lifecycle by default. The shop adopts the CSRF default scoped so the edge-cached, dual-rendered storefront endpoints (cart, consent, newsletter, currency) remain on their SameSite + fetch-metadata defense, while the authenticated account and admin surfaces gain the token check. A lint rule now flags any new edge-rendered POST form that would need that exemption.
 
 ## v0.2.x

package/lib/admin.js

@@ -507,10 +507,13 @@ function mount(router, deps) {
       return p;
     }),
     async function (req, res) {
-      // Browser form submit — create, then redirect (PRG). Bad input
+      // Browser form submit — create, then redirect (PRG) straight to the
+      // new product's detail screen so the operator continues setup (variant,
+      // price, stock) there instead of hunting for it in the list. Bad input
       // re-renders the products page with a notice, never a 500.
+      var made;
       try {
-        await catalog.products.create(req.body || {});
+        made = await catalog.products.create(req.body || {});
       } catch (e) {
         if (e instanceof TypeError || e.code === "CATALOG_DUPLICATE" || /slug|exists|duplicate/i.test(e.message || "")) {
           var page = await catalog.products.list({ limit: 100 });
@@ -521,8 +524,8 @@ function mount(router, deps) {
         }
         throw e;
       }
-      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".product.create", outcome: "success", metadata: {} });
-      _redirect(res, "/admin/products?created=1");
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".product.create", outcome: "success", metadata: { id: made.id } });
+      _redirect(res, "/admin/products/" + encodeURIComponent(made.id) + "?created=1");
     },
   ));
 
@@ -629,8 +632,9 @@ function mount(router, deps) {
         prices_by_variant: model.prices_by_variant, media: model.media,
         asset_prefix: assetPrefix, upload_available: !!r2,
         default_currency: await _defaultCurrency(),
-        saved:  url && url.searchParams.get("saved"),
-        notice: (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
+        saved:   url && url.searchParams.get("saved"),
+        created: url && url.searchParams.get("created"),
+        notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed." : null,
       }));
     },
   ));
@@ -7943,6 +7947,7 @@ function renderAdminProduct(opts) {
   var pid = _htmlEscape(p.id);
 
   var saved   = opts.saved   ? "<div class=\"banner banner--ok\">Saved.</div>" : "";
+  var created = opts.created ? "<div class=\"banner banner--ok\">Product created. Add a variant with a SKU, set its price, and add stock to make it sellable.</div>" : "";
   var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
 
   // ---- product fields edit ---------------------------------------------
@@ -8128,7 +8133,7 @@ function renderAdminProduct(opts) {
       "<span class=\"status-pill " + statusCls + "\">" + _htmlEscape(p.status) + "</span>" +
       " · <a href=\"/products/" + _htmlEscape(encodeURIComponent(p.slug)) + "\" target=\"_blank\" rel=\"noreferrer\">View on storefront &rarr;</a></p>";
 
-  var body = "<section><h2>" + _htmlEscape(p.title) + "</h2>" + saved + notice + head +
+  var body = "<section><h2>" + _htmlEscape(p.title) + "</h2>" + created + saved + notice + head +
     "<div class=\"actions-row mt-0\">" + archiveAction + "</div>" +
     editForm + "</section>" + variantsSection + mediaSection;
   return _renderAdminShell(opts.shop_name, "Product " + p.slug, body, "products", opts.nav_available);

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.0",
+  "version": "0.3.2",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/security-middleware.js

@@ -108,6 +108,20 @@ var EDGE_POST_PATHS = [
   "/announcements/",
 ];
 
+// The TLS-terminated public origin(s) the storefront is served on. Behind
+// the Cloudflare Worker the container socket is plain http, so the CSRF
+// origin pre-check would otherwise build `http://<host>` and refuse every
+// same-origin browser POST (which carries `Origin: https://<host>`) on a
+// bare scheme mismatch — breaking sign-in and every authenticated form.
+// The csrf gate below trusts the Worker-forwarded `x-forwarded-proto` (so
+// it derives the real https origin) AND carries this explicit allowlist as
+// belt-and-suspenders for the public host. Override with the comma-
+// separated SHOP_PUBLIC_ORIGINS for an alternate deploy; the default is
+// the canonical origin the Worker + storefront already use as their
+// fallback.
+var PUBLIC_ORIGINS = (process.env.SHOP_PUBLIC_ORIGINS || "https://blamejs.shop")
+  .split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+
 /**
  * Resolve the real client IP for rate-limit keying. Reads the
  * Cloudflare-injected `cf-connecting-ip` first (the canonical single
@@ -184,7 +198,21 @@ function mountRouteGuards(r) {
   // shells render it into a hidden `_csrf` field. `skipStateless` passes
   // cookie-less and bearer-token (Authorization-header) requests through —
   // they cannot be CSRF-ed (no ambient cookie credential to abuse).
-  var csrfGate = b.middleware.csrfProtect({ cookie: true, skipStateless: true });
+  var csrfGate = b.middleware.csrfProtect({
+    cookie:        true,
+    skipStateless: true,
+    // Behind the Cloudflare Worker the container connection is plain http
+    // while the visitor is on https; trustProxy opts in the Worker-set
+    // `x-forwarded-proto` so the origin pre-check derives the real public
+    // origin (and the token cookie carries the `__Host-csrf` prefix),
+    // matching the session-cookie stance (storefront `_secureForReq`).
+    // allowedOrigins is the explicit public-host allowlist so a legitimate
+    // same-origin POST is never refused as cross-origin on a proxy
+    // scheme/host mismatch — the regression that breaks sign-in + every
+    // authenticated form behind the CDN.
+    trustProxy:     true,
+    allowedOrigins: PUBLIC_ORIGINS,
+  });
   r.use(function csrfGuard(req, res, next) {
     var pathname = req.pathname || req.url || "/";
     if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {