@shop-on/customer-runtime 0.2.0 → 0.3.0

package/dist/handoff-state.d.ts

@@ -0,0 +1,25 @@
+//#region src/handoff-state.d.ts
+/**
+ * Shared rules for the states that bind a handoff to the browser that started
+ * it, used by their minters, the account `return_to` sanitizer that passes
+ * them through, and their checkers. The formats are a shape check only: each
+ * consumer verifies the value against its own cookie.
+ *
+ * - `checkout_state`: `ts "." base64url(HMAC-SHA256)`, minted by checkout's
+ *   `/begin` and `/sign-in`.
+ * - `state` (theme): 32 random bytes base64url, minted by theme-server's
+ *   `account_state` cookie.
+ */
+export declare const CHECKOUT_STATE_FORMAT: RegExp;
+export declare const ACCOUNT_STATE_FORMAT: RegExp;
+/** Loopback: the one place a state may travel over http (local theme dev).
+ *  Takes `URL#hostname`, which keeps the IPv6 brackets (`[::1]`). */
+export declare function isLoopback(hostname: string): boolean;
+/**
+ * For every response that redirects to or from a URL holding a state: a
+ * cached copy would hand one browser's state to the next, and a Referer would
+ * carry it to whatever the next page loads. Server-only; the server module is
+ * imported here so a client-reachable importer of the formats stays clean.
+ */
+export declare function markResponsePrivate(): Promise<void>;
+//#endregion

package/dist/handoff-state.js

@@ -0,0 +1,32 @@
+//#region src/handoff-state.ts
+/**
+* Shared rules for the states that bind a handoff to the browser that started
+* it, used by their minters, the account `return_to` sanitizer that passes
+* them through, and their checkers. The formats are a shape check only: each
+* consumer verifies the value against its own cookie.
+*
+* - `checkout_state`: `ts "." base64url(HMAC-SHA256)`, minted by checkout's
+*   `/begin` and `/sign-in`.
+* - `state` (theme): 32 random bytes base64url, minted by theme-server's
+*   `account_state` cookie.
+*/
+const CHECKOUT_STATE_FORMAT = /^\d{10}\.[A-Za-z0-9_-]{43}$/;
+const ACCOUNT_STATE_FORMAT = /^[A-Za-z0-9_-]{43}$/;
+/** Loopback: the one place a state may travel over http (local theme dev).
+*  Takes `URL#hostname`, which keeps the IPv6 brackets (`[::1]`). */
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/**
+* For every response that redirects to or from a URL holding a state: a
+* cached copy would hand one browser's state to the next, and a Referer would
+* carry it to whatever the next page loads. Server-only; the server module is
+* imported here so a client-reachable importer of the formats stays clean.
+*/
+async function markResponsePrivate() {
+	const { setResponseHeader } = await import("@tanstack/react-start/server");
+	setResponseHeader("Referrer-Policy", "no-referrer");
+	setResponseHeader("Cache-Control", "no-store");
+}
+//#endregion
+export { ACCOUNT_STATE_FORMAT, CHECKOUT_STATE_FORMAT, isLoopback, markResponsePrivate };

package/dist/session-cookie.d.ts

@@ -10,7 +10,9 @@
  *
  * The returned `ShopBoundCookieConfig` is shape-compatible with
  * `SealedSessionConfig` — pass it straight to `openSession`
- * (`./sealed-session`). This module stays free of TanStack imports.
+ * (`./sealed-session`). theme-server's cart and customer cookies use the
+ * same config; a theme isolate serves one shop, so they skip the payload
+ * binding. This module stays free of TanStack imports.
  */
 export interface ShopBoundSession {
   shopHandle: string;

package/dist/session-cookie.js

@@ -1,11 +1,22 @@
 //#region src/session-cookie.ts
+/**
+* Storefronts on `<handle>.adorly.mn` run merchant script, and `adorly.mn` is
+* not a public suffix, so any storefront can set a same-named cookie for the
+* parent domain and fix a buyer into the attacker's session. Only the host
+* itself can set a `__Host-` cookie. The prefix requires `Secure`, so
+* plain-http dev keeps the bare name.
+*/
+function hostOnlyCookieName(base, secure) {
+	return secure ? `__Host-${base}` : base;
+}
 function createShopBoundCookieConfig(opts) {
+	const secure = opts.secure ?? process.env.NODE_ENV === "production";
 	return {
-		name: opts.name,
+		name: hostOnlyCookieName(opts.name, secure),
 		password: opts.password,
 		...opts.maxAge !== void 0 ? { maxAge: opts.maxAge } : {},
 		cookie: {
-			secure: opts.secure ?? process.env.NODE_ENV === "production",
+			secure,
 			httpOnly: true,
 			sameSite: "lax",
 			path: "/"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shop-on/customer-runtime",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "license": "SEE LICENSE IN dist/LICENSE.md",
   "files": [
     "dist"
@@ -10,6 +10,7 @@
     "./customer-session-handoff": "./dist/customer-session-handoff.js",
     "./graphql": "./dist/graphql.js",
     "./handoff": "./dist/handoff.js",
+    "./handoff-state": "./dist/handoff-state.js",
     "./lease": "./dist/lease.js",
     "./oauth": "./dist/oauth.js",
     "./relay": "./dist/relay.js",