@shop-on/customer-runtime 0.1.0 → 0.3.0

package/dist/graphql.js

@@ -1,4 +1,5 @@
 import { relayHeaders } from "./relay.js";
+import { traceHeaders } from "./trace.js";
 import { evictStorefrontToken, getStorefrontToken } from "./oauth.js";
 import { ClientError, GraphQLClient } from "graphql-request";
 //#region src/graphql.ts
@@ -23,6 +24,7 @@ function buildClient(token, extra) {
 async function storefrontRequest(shopHandle, document, variables, options) {
 	const extra = {
 		...options?.customerSessionToken ? { "X-Customer-Session": options.customerSessionToken } : {},
+		...traceHeaders(),
 		...relayHeaders()
 	};
 	let token = await getStorefrontToken(shopHandle);

package/dist/handoff-state.d.ts

@@ -0,0 +1,25 @@
+//#region src/handoff-state.d.ts
+/**
+ * Shared rules for the states that bind a handoff to the browser that started
+ * it, used by their minters, the account `return_to` sanitizer that passes
+ * them through, and their checkers. The formats are a shape check only: each
+ * consumer verifies the value against its own cookie.
+ *
+ * - `checkout_state`: `ts "." base64url(HMAC-SHA256)`, minted by checkout's
+ *   `/begin` and `/sign-in`.
+ * - `state` (theme): 32 random bytes base64url, minted by theme-server's
+ *   `account_state` cookie.
+ */
+export declare const CHECKOUT_STATE_FORMAT: RegExp;
+export declare const ACCOUNT_STATE_FORMAT: RegExp;
+/** Loopback: the one place a state may travel over http (local theme dev).
+ *  Takes `URL#hostname`, which keeps the IPv6 brackets (`[::1]`). */
+export declare function isLoopback(hostname: string): boolean;
+/**
+ * For every response that redirects to or from a URL holding a state: a
+ * cached copy would hand one browser's state to the next, and a Referer would
+ * carry it to whatever the next page loads. Server-only; the server module is
+ * imported here so a client-reachable importer of the formats stays clean.
+ */
+export declare function markResponsePrivate(): Promise<void>;
+//#endregion

package/dist/handoff-state.js

@@ -0,0 +1,32 @@
+//#region src/handoff-state.ts
+/**
+* Shared rules for the states that bind a handoff to the browser that started
+* it, used by their minters, the account `return_to` sanitizer that passes
+* them through, and their checkers. The formats are a shape check only: each
+* consumer verifies the value against its own cookie.
+*
+* - `checkout_state`: `ts "." base64url(HMAC-SHA256)`, minted by checkout's
+*   `/begin` and `/sign-in`.
+* - `state` (theme): 32 random bytes base64url, minted by theme-server's
+*   `account_state` cookie.
+*/
+const CHECKOUT_STATE_FORMAT = /^\d{10}\.[A-Za-z0-9_-]{43}$/;
+const ACCOUNT_STATE_FORMAT = /^[A-Za-z0-9_-]{43}$/;
+/** Loopback: the one place a state may travel over http (local theme dev).
+*  Takes `URL#hostname`, which keeps the IPv6 brackets (`[::1]`). */
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/**
+* For every response that redirects to or from a URL holding a state: a
+* cached copy would hand one browser's state to the next, and a Referer would
+* carry it to whatever the next page loads. Server-only; the server module is
+* imported here so a client-reachable importer of the formats stays clean.
+*/
+async function markResponsePrivate() {
+	const { setResponseHeader } = await import("@tanstack/react-start/server");
+	setResponseHeader("Referrer-Policy", "no-referrer");
+	setResponseHeader("Cache-Control", "no-store");
+}
+//#endregion
+export { ACCOUNT_STATE_FORMAT, CHECKOUT_STATE_FORMAT, isLoopback, markResponsePrivate };

package/dist/internal-api.js

@@ -1,4 +1,5 @@
 import { relayHeaders } from "./relay.js";
+import { traceHeaders } from "./trace.js";
 //#region src/internal-api.ts
 function apiUrl() {
 	return process.env.SPN_CUSTOMER_API_URL ?? "http://localhost:3003";
@@ -40,6 +41,7 @@ async function internalPost(path, body, { signal } = {}) {
 		headers: {
 			"Content-Type": "application/json",
 			"X-Internal-Auth": secret,
+			...traceHeaders(),
 			...relayHeaders()
 		},
 		body: JSON.stringify(body),
@@ -59,6 +61,7 @@ async function internalDelete(path) {
 		method: "DELETE",
 		headers: {
 			"X-Internal-Auth": secret,
+			...traceHeaders(),
 			...relayHeaders()
 		}
 	});

package/dist/relay.js

@@ -1,6 +1,11 @@
 import { currentRequest } from "./request-scope.js";
-import { isIP } from "node:net";
 //#region src/relay.ts
+const IPV4_OCTET = "(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+const IPV4 = new RegExp(`^${IPV4_OCTET}(\\.${IPV4_OCTET}){3}$`);
+function isIP(value) {
+	if (IPV4.test(value)) return true;
+	return /^[\da-f:.]+$/i.test(value) && value.includes(":") && URL.canParse(`http://[${value}]`);
+}
 /**
 * `X-Buyer-IP` from Cloudflare's `CF-Connecting-IP` on the request this call
 * runs under, plus `X-Relay-Auth` when SPN_RELAY_SECRET is set. Empty outside

package/dist/request-scope.js

@@ -2,7 +2,7 @@
 const EVENT_STORAGE_KEY = Symbol.for("tanstack-start:event-storage");
 /** The request this call runs under; undefined outside one (browser, tests, pre-handler). */
 function currentRequest() {
-	return globalThis[EVENT_STORAGE_KEY]?.getStore()?.h3Event?.req;
+	return globalThis[EVENT_STORAGE_KEY]?.getStore()?.request;
 }
 const slots = /* @__PURE__ */ new WeakMap();
 /**

package/dist/sealed-session.d.ts

@@ -0,0 +1,27 @@
+//#region src/sealed-session.d.ts
+export interface SealedSessionConfig {
+  name: string;
+  /** At least 32 chars. */
+  password: string;
+  /** Seconds. Seal TTL plus an absolute cap counted from the first write. */
+  maxAge?: number;
+  cookie: {
+    secure: boolean;
+    httpOnly: true;
+    sameSite: "lax";
+    path: "/";
+    /** Seconds. Sent as Max-Age, refreshed on every write. */
+    maxAge?: number;
+  };
+}
+export interface SealedSession<T> {
+  /** Live: reflects every write committed so far in this request. */
+  readonly data: Partial<T>;
+  update(patch: Partial<T>): Promise<void>;
+  clear(): Promise<void>;
+}
+export declare class SessionTooLargeError extends Error {
+  constructor(name: string, length: number);
+}
+export declare function openSession<T>(config: SealedSessionConfig): Promise<SealedSession<T>>;
+//#endregion

package/dist/sealed-session.js

@@ -0,0 +1,154 @@
+import { requestSlot } from "./request-scope.js";
+import { deleteCookie, getCookie, setCookie } from "@tanstack/react-start/server";
+import { defaults, seal, unseal } from "iron-webcrypto";
+//#region src/sealed-session.ts
+/**
+* Encrypted cookie sessions, wire-compatible with the `useSession` TanStack
+* Start 1.168 shipped (h3 2.0.1-rc.20) and 1.169 removed. Both seal
+* `{ id, createdAt, data }` with iron (Fe26.2, iron's defaults), so a cookie
+* either one wrote opens in the other — no sign-out on deploy, and a rollback
+* stays safe. `test/fixtures/h3-sessions.json` holds cookies Start 1.168
+* minted; `test/sealed-session.test.ts` keeps them opening.
+*
+* Where it deliberately differs from h3:
+* - A read never writes. h3 minted and set an empty session on every
+*   cookieless read.
+* - `clear()` sticks for the rest of the request. h3 re-read the stale
+*   request cookie afterwards.
+* - Writes are one cookie, never chunked. A seal over 3,800 chars throws
+*   `SessionTooLargeError` instead. h3's chunked cookies still open, and
+*   the next write or clear deletes their chunks.
+* - No `x-<name>-session` request header.
+*
+* Each request shares one state per cookie name (`requestSlot`), so parallel
+* opens unseal once, and writes queue: each merges onto the state the one
+* before it committed, in call order.
+*/
+var SessionTooLargeError = class extends Error {
+	constructor(name, length) {
+		super(`Session "${name}" seals to ${length} chars, over the ${MAX_SEALED_LENGTH} limit`);
+		this.name = "SessionTooLargeError";
+	}
+};
+const MAX_SEALED_LENGTH = 3800;
+const CHUNKED = "__chunked__";
+const MAX_CHUNKS = 100;
+const DEFAULT_COOKIE = {
+	path: "/",
+	secure: true,
+	httpOnly: true
+};
+const empty = () => ({
+	id: "",
+	createdAt: 0,
+	data: {}
+});
+async function openSession(config) {
+	if (typeof config.password !== "string" || config.password.length < 32) throw new Error(`Session "${config.name}" needs a password of at least 32 characters`);
+	const init = () => {
+		const slot = {
+			chain: Promise.resolve(),
+			state: empty()
+		};
+		slot.chain = read(config).then((state) => {
+			slot.state = state;
+		});
+		return slot;
+	};
+	const slot = requestSlot(Symbol.for(`shop-on:sealed-session:${config.name}`), init) ?? init();
+	await slot.chain;
+	const enqueue = (run) => {
+		const result = slot.chain.then(run);
+		slot.chain = result.catch(() => {});
+		return result;
+	};
+	return {
+		get data() {
+			return slot.state.data;
+		},
+		update: (patch) => enqueue(() => write(config, slot, patch)),
+		clear: () => enqueue(() => {
+			slot.state = empty();
+			deleteCookie(config.name, {
+				...DEFAULT_COOKIE,
+				...config.cookie
+			});
+			deleteChunks(config);
+		})
+	};
+}
+function sealOptions(config) {
+	return {
+		...defaults,
+		ttl: config.maxAge ? config.maxAge * 1e3 : 0
+	};
+}
+async function read(config) {
+	const sealed = readSealed(config.name);
+	if (!sealed) return empty();
+	try {
+		const opened = await unseal(sealed, config.password, sealOptions(config));
+		if (typeof opened?.id !== "string" || !opened.id || typeof opened.createdAt !== "number") return empty();
+		if (config.maxAge && Date.now() - opened.createdAt > config.maxAge * 1e3) return empty();
+		const data = opened.data && typeof opened.data === "object" ? { ...opened.data } : {};
+		return {
+			id: opened.id,
+			createdAt: opened.createdAt,
+			data
+		};
+	} catch {
+		return empty();
+	}
+}
+/** The request's sealed value, reassembled from h3's chunks when it split one. */
+function readSealed(name) {
+	const value = getCookie(name);
+	const count = chunkCount(value);
+	if (!count) return value?.startsWith(CHUNKED) ? void 0 : value;
+	const chunks = [];
+	for (let i = 1; i <= count; i++) {
+		const chunk = getCookie(`${name}.${i}`);
+		if (!chunk) return void 0;
+		chunks.push(chunk);
+	}
+	return chunks.join("");
+}
+function chunkCount(value) {
+	if (!value?.startsWith(CHUNKED)) return 0;
+	const count = Number.parseInt(value.slice(11), 10);
+	return Number.isInteger(count) && count >= 1 && count <= MAX_CHUNKS ? count : 0;
+}
+function deleteChunks(config) {
+	const count = chunkCount(getCookie(config.name));
+	for (let i = 1; i <= count; i++) deleteCookie(`${config.name}.${i}`, {
+		...DEFAULT_COOKIE,
+		...config.cookie
+	});
+}
+async function write(config, slot, patch) {
+	const previous = slot.state;
+	const fresh = !previous.id || Object.keys(previous.data).length === 0;
+	const data = JSON.parse(JSON.stringify({
+		...previous.data,
+		...patch
+	}));
+	const next = fresh ? {
+		id: globalThis.crypto.randomUUID(),
+		createdAt: Date.now(),
+		data
+	} : {
+		...previous,
+		data
+	};
+	const sealed = await seal(next, config.password, sealOptions(config));
+	if (sealed.length > MAX_SEALED_LENGTH) throw new SessionTooLargeError(config.name, sealed.length);
+	slot.state = next;
+	setCookie(config.name, sealed, {
+		...DEFAULT_COOKIE,
+		expires: config.maxAge ? new Date(next.createdAt + config.maxAge * 1e3) : void 0,
+		...config.cookie
+	});
+	deleteChunks(config);
+}
+//#endregion
+export { SessionTooLargeError, openSession };

package/dist/session-cookie.d.ts

@@ -8,9 +8,11 @@
  * `undefined` for both "missing" and "wrong shop" so callers handle them
  * uniformly (treat as logged-out).
  *
- * The returned `ShopBoundCookieConfig` is shape-compatible with TanStack
- * Start's `SessionConfig` — pass it straight to `useSession`. We don't
- * import the TanStack type here so the package stays runtime-agnostic.
+ * The returned `ShopBoundCookieConfig` is shape-compatible with
+ * `SealedSessionConfig` — pass it straight to `openSession`
+ * (`./sealed-session`). theme-server's cart and customer cookies use the
+ * same config; a theme isolate serves one shop, so they skip the payload
+ * binding. This module stays free of TanStack imports.
  */
 export interface ShopBoundSession {
   shopHandle: string;

package/dist/session-cookie.js

@@ -1,11 +1,22 @@
 //#region src/session-cookie.ts
+/**
+* Storefronts on `<handle>.adorly.mn` run merchant script, and `adorly.mn` is
+* not a public suffix, so any storefront can set a same-named cookie for the
+* parent domain and fix a buyer into the attacker's session. Only the host
+* itself can set a `__Host-` cookie. The prefix requires `Secure`, so
+* plain-http dev keeps the bare name.
+*/
+function hostOnlyCookieName(base, secure) {
+	return secure ? `__Host-${base}` : base;
+}
 function createShopBoundCookieConfig(opts) {
+	const secure = opts.secure ?? process.env.NODE_ENV === "production";
 	return {
-		name: opts.name,
+		name: hostOnlyCookieName(opts.name, secure),
 		password: opts.password,
 		...opts.maxAge !== void 0 ? { maxAge: opts.maxAge } : {},
 		cookie: {
-			secure: opts.secure ?? process.env.NODE_ENV === "production",
+			secure,
 			httpOnly: true,
 			sameSite: "lax",
 			path: "/"

package/dist/trace.d.ts

@@ -0,0 +1,13 @@
+//#region src/trace.d.ts
+export interface TraceOptions {
+  /** Continue a valid incoming `traceparent`. Only behind a proxy that started the trace (Traefik). */
+  continueIncoming?: boolean;
+}
+/**
+ * `traceparent` for the request this call runs under: one minted once per
+ * request, or with `continueIncoming` the incoming ids when valid; always
+ * sampled. Empty outside a request. Send it to our own api only, never to a
+ * third party.
+ */
+export declare function traceHeaders({ continueIncoming }?: TraceOptions): Record<string, string>;
+//#endregion

package/dist/trace.js

@@ -0,0 +1,25 @@
+import { currentRequest, requestSlot } from "./request-scope.js";
+//#region src/trace.ts
+const TRACEPARENT = /^00-((?!0{32})[\da-f]{32})-((?!0{16})[\da-f]{16})-[\da-f]{2}$/;
+const MINTED = Symbol("minted traceparent");
+function randomHex(bytes) {
+	const buf = crypto.getRandomValues(new Uint8Array(bytes));
+	if (buf.every((b) => b === 0)) buf[0] = 1;
+	return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* `traceparent` for the request this call runs under: one minted once per
+* request, or with `continueIncoming` the incoming ids when valid; always
+* sampled. Empty outside a request. Send it to our own api only, never to a
+* third party.
+*/
+function traceHeaders({ continueIncoming = false } = {}) {
+	if (continueIncoming) {
+		const incoming = currentRequest()?.headers.get("traceparent")?.match(TRACEPARENT);
+		if (incoming) return { traceparent: `00-${incoming[1]}-${incoming[2]}-01` };
+	}
+	const traceparent = requestSlot(MINTED, () => `00-${randomHex(16)}-${randomHex(8)}-01`);
+	return traceparent ? { traceparent } : {};
+}
+//#endregion
+export { traceHeaders };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shop-on/customer-runtime",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "license": "SEE LICENSE IN dist/LICENSE.md",
   "files": [
     "dist"
@@ -10,27 +10,34 @@
     "./customer-session-handoff": "./dist/customer-session-handoff.js",
     "./graphql": "./dist/graphql.js",
     "./handoff": "./dist/handoff.js",
+    "./handoff-state": "./dist/handoff-state.js",
     "./lease": "./dist/lease.js",
     "./oauth": "./dist/oauth.js",
     "./relay": "./dist/relay.js",
     "./request-scope": "./dist/request-scope.js",
+    "./sealed-session": "./dist/sealed-session.js",
     "./session-cookie": "./dist/session-cookie.js",
     "./shop-context": "./dist/shop-context.js",
+    "./trace": "./dist/trace.js",
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "gql.tada": "1.11.3",
-    "graphql-request": "7.4.0"
+    "gql.tada": "1.11.4",
+    "graphql-request": "7.4.0",
+    "iron-webcrypto": "2.0.0"
   },
   "devDependencies": {
-    "@tanstack/react-start": "1.168.60",
-    "@types/node": "26.6.3",
+    "@tanstack/react-start": "1.169.3",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2",
-    "vitest": "5.0.3"
+    "vitest": "5.0.5"
+  },
+  "peerDependencies": {
+    "@tanstack/react-start": "~1.169.3"
   },
   "scripts": {
     "check-types": "tsc --noEmit",
-    "test": "vitest run",
+    "test": "vitest run --maxWorkers=2",
     "test:watch": "vitest"
   }
 }