@shop-on/customer-runtime 0.2.0 → 0.4.0

package/dist/handoff-state.d.ts

@@ -0,0 +1,25 @@
+//#region src/handoff-state.d.ts
+/**
+ * Shared rules for the states that bind a handoff to the browser that started
+ * it, used by their minters and their checkers. The formats are a shape check
+ * only: each consumer verifies the value against its own cookie.
+ *
+ * - `checkout_state`: `ts "." base64url(HMAC-SHA256)`, minted by checkout's
+ *   `/begin`, carried by the theme onto the cart handoff URL.
+ * - `state` (theme): 32 random bytes base64url, minted by theme-server's
+ *   `account_state` cookie; the account `return_to` sanitizer passes it
+ *   through on storefront hosts.
+ */
+export declare const CHECKOUT_STATE_FORMAT: RegExp;
+export declare const ACCOUNT_STATE_FORMAT: RegExp;
+/** Loopback: the one place a state may travel over http (local theme dev).
+ *  Takes `URL#hostname`, which keeps the IPv6 brackets (`[::1]`). */
+export declare function isLoopback(hostname: string): boolean;
+/**
+ * For every response that redirects to or from a URL holding a state: a
+ * cached copy would hand one browser's state to the next, and a Referer would
+ * carry it to whatever the next page loads. Server-only; the server module is
+ * imported here so a client-reachable importer of the formats stays clean.
+ */
+export declare function markResponsePrivate(): Promise<void>;
+//#endregion

package/dist/handoff-state.js

@@ -0,0 +1,32 @@
+//#region src/handoff-state.ts
+/**
+* Shared rules for the states that bind a handoff to the browser that started
+* it, used by their minters and their checkers. The formats are a shape check
+* only: each consumer verifies the value against its own cookie.
+*
+* - `checkout_state`: `ts "." base64url(HMAC-SHA256)`, minted by checkout's
+*   `/begin`, carried by the theme onto the cart handoff URL.
+* - `state` (theme): 32 random bytes base64url, minted by theme-server's
+*   `account_state` cookie; the account `return_to` sanitizer passes it
+*   through on storefront hosts.
+*/
+const CHECKOUT_STATE_FORMAT = /^\d{10}\.[A-Za-z0-9_-]{43}$/;
+const ACCOUNT_STATE_FORMAT = /^[A-Za-z0-9_-]{43}$/;
+/** Loopback: the one place a state may travel over http (local theme dev).
+*  Takes `URL#hostname`, which keeps the IPv6 brackets (`[::1]`). */
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+/**
+* For every response that redirects to or from a URL holding a state: a
+* cached copy would hand one browser's state to the next, and a Referer would
+* carry it to whatever the next page loads. Server-only; the server module is
+* imported here so a client-reachable importer of the formats stays clean.
+*/
+async function markResponsePrivate() {
+	const { setResponseHeader } = await import("@tanstack/react-start/server");
+	setResponseHeader("Referrer-Policy", "no-referrer");
+	setResponseHeader("Cache-Control", "no-store");
+}
+//#endregion
+export { ACCOUNT_STATE_FORMAT, CHECKOUT_STATE_FORMAT, isLoopback, markResponsePrivate };

package/dist/session-cookie.d.ts

@@ -10,7 +10,9 @@
  *
  * The returned `ShopBoundCookieConfig` is shape-compatible with
  * `SealedSessionConfig` — pass it straight to `openSession`
- * (`./sealed-session`). This module stays free of TanStack imports.
+ * (`./sealed-session`). theme-server's cart and customer cookies use the
+ * same config; a theme isolate serves one shop, so they skip the payload
+ * binding. This module stays free of TanStack imports.
  */
 export interface ShopBoundSession {
   shopHandle: string;

package/dist/session-cookie.js

@@ -1,11 +1,22 @@
 //#region src/session-cookie.ts
+/**
+* Storefronts on `<handle>.adorly.mn` run merchant script, and `adorly.mn` is
+* not a public suffix, so any storefront can set a same-named cookie for the
+* parent domain and fix a buyer into the attacker's session. Only the host
+* itself can set a `__Host-` cookie. The prefix requires `Secure`, so
+* plain-http dev keeps the bare name.
+*/
+function hostOnlyCookieName(base, secure) {
+	return secure ? `__Host-${base}` : base;
+}
 function createShopBoundCookieConfig(opts) {
+	const secure = opts.secure ?? process.env.NODE_ENV === "production";
 	return {
-		name: opts.name,
+		name: hostOnlyCookieName(opts.name, secure),
 		password: opts.password,
 		...opts.maxAge !== void 0 ? { maxAge: opts.maxAge } : {},
 		cookie: {
-			secure: opts.secure ?? process.env.NODE_ENV === "production",
+			secure,
 			httpOnly: true,
 			sameSite: "lax",
 			path: "/"

package/dist/storefront-bounce.d.ts

@@ -0,0 +1,10 @@
+//#region src/storefront-bounce.d.ts
+/**
+ * The storefront's own `/account` bounce, coming back to `returnToPath`.
+ * Account and checkout sign a buyer in through it rather than linking to
+ * account directly: the theme issues the `state` its customer handoff is
+ * bound to, bounces to account, and consumes the handoff on the way back.
+ * Pure, so either app can build the link in a component.
+ */
+export declare function storefrontAccountBounceUrl(storefrontRoot: string, returnToPath: string): string;
+//#endregion

package/dist/storefront-bounce.js

@@ -0,0 +1,15 @@
+//#region src/storefront-bounce.ts
+/**
+* The storefront's own `/account` bounce, coming back to `returnToPath`.
+* Account and checkout sign a buyer in through it rather than linking to
+* account directly: the theme issues the `state` its customer handoff is
+* bound to, bounces to account, and consumes the handoff on the way back.
+* Pure, so either app can build the link in a component.
+*/
+function storefrontAccountBounceUrl(storefrontRoot, returnToPath) {
+	const url = new URL("/account", storefrontRoot);
+	url.searchParams.set("return_to", returnToPath);
+	return url.toString();
+}
+//#endregion
+export { storefrontAccountBounceUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shop-on/customer-runtime",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "license": "SEE LICENSE IN dist/LICENSE.md",
   "files": [
     "dist"
@@ -10,6 +10,7 @@
     "./customer-session-handoff": "./dist/customer-session-handoff.js",
     "./graphql": "./dist/graphql.js",
     "./handoff": "./dist/handoff.js",
+    "./handoff-state": "./dist/handoff-state.js",
     "./lease": "./dist/lease.js",
     "./oauth": "./dist/oauth.js",
     "./relay": "./dist/relay.js",
@@ -17,6 +18,7 @@
     "./sealed-session": "./dist/sealed-session.js",
     "./session-cookie": "./dist/session-cookie.js",
     "./shop-context": "./dist/shop-context.js",
+    "./storefront-bounce": "./dist/storefront-bounce.js",
     "./trace": "./dist/trace.js",
     "./package.json": "./package.json"
   },