@shop-on/customer-runtime 0.4.0 → 0.6.0

package/dist/internal-api.d.ts

@@ -0,0 +1,21 @@
+//#region src/internal-api.d.ts
+export declare class InternalApiError extends Error {
+  readonly status: number;
+  readonly bodySnippet: string;
+  constructor(path: string, status: number, bodySnippet: string);
+}
+/**
+ * POST a JSON body to `/api/internal/customer/<path>`. Throws
+ * `InternalApiError` on non-2xx so callers can decide how to map status →
+ * domain outcome (e.g. token mint maps 404 → CredentialsUnavailableError).
+ */
+export declare function internalPost<TResponse>(path: string, body: unknown, { signal }?: {
+  signal?: AbortSignal;
+}): Promise<TResponse>;
+/**
+ * DELETE `/api/internal/customer/<path>`. Used by the handoff consume path —
+ * the endpoint always returns 200 (with `{ ok: false, reason }` on miss), so
+ * a non-2xx here is a real error, not a domain miss.
+ */
+export declare function internalDelete<TResponse>(path: string): Promise<TResponse>;
+//#endregion

package/dist/relay.d.ts

@@ -5,4 +5,10 @@
  * a request or without a valid IP. Spread these last into outgoing headers.
  */
 export declare function relayHeaders(): Record<string, string>;
+/**
+ * `X-Client-IP` from `CF-Connecting-IP` plus `X-Relay-Auth`, for the developers
+ * and platform Workers' api calls. Empty without SPN_STAFF_RELAY_SECRET, outside
+ * a request, or without a valid IP: with no secret Rails would ignore the IP.
+ */
+export declare function staffRelayHeaders(): Record<string, string>;
 //#endregion

package/dist/relay.js

@@ -20,5 +20,19 @@ function relayHeaders() {
 		"X-Relay-Auth": secret
 	} : { "X-Buyer-IP": ip };
 }
+/**
+* `X-Client-IP` from `CF-Connecting-IP` plus `X-Relay-Auth`, for the developers
+* and platform Workers' api calls. Empty without SPN_STAFF_RELAY_SECRET, outside
+* a request, or without a valid IP: with no secret Rails would ignore the IP.
+*/
+function staffRelayHeaders() {
+	const secret = process.env.SPN_STAFF_RELAY_SECRET;
+	const ip = currentRequest()?.headers.get("cf-connecting-ip");
+	if (!secret || !ip || !isIP(ip)) return {};
+	return {
+		"X-Client-IP": ip,
+		"X-Relay-Auth": secret
+	};
+}
 //#endregion
-export { relayHeaders };
+export { relayHeaders, staffRelayHeaders };

package/dist/session-cookie.d.ts

@@ -29,6 +29,14 @@ export interface ShopBoundCookieConfig {
     path: "/";
   };
 }
+/**
+ * Storefronts on `<handle>.adorly.mn` run merchant script, and `adorly.mn` is
+ * not a public suffix, so any storefront can set a same-named cookie for the
+ * parent domain and fix a buyer (or a staff app's user) into the attacker's
+ * session. Only the host itself can set a `__Host-` cookie. The prefix
+ * requires `Secure`, so plain-http dev keeps the bare name.
+ */
+export declare function hostOnlyCookieName(base: string, secure?: boolean): string;
 export declare function createShopBoundCookieConfig(opts: {
   name: string;
   password: string;

package/dist/session-cookie.js

@@ -2,11 +2,11 @@
 /**
 * Storefronts on `<handle>.adorly.mn` run merchant script, and `adorly.mn` is
 * not a public suffix, so any storefront can set a same-named cookie for the
-* parent domain and fix a buyer into the attacker's session. Only the host
-* itself can set a `__Host-` cookie. The prefix requires `Secure`, so
-* plain-http dev keeps the bare name.
+* parent domain and fix a buyer (or a staff app's user) into the attacker's
+* session. Only the host itself can set a `__Host-` cookie. The prefix
+* requires `Secure`, so plain-http dev keeps the bare name.
 */
-function hostOnlyCookieName(base, secure) {
+function hostOnlyCookieName(base, secure = process.env.NODE_ENV === "production") {
 	return secure ? `__Host-${base}` : base;
 }
 function createShopBoundCookieConfig(opts) {
@@ -36,4 +36,4 @@ function validateShopBinding(payload, expectedShopHandle) {
 	return payload;
 }
 //#endregion
-export { createShopBoundCookieConfig, validateShopBinding };
+export { createShopBoundCookieConfig, hostOnlyCookieName, validateShopBinding };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shop-on/customer-runtime",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "license": "SEE LICENSE IN dist/LICENSE.md",
   "files": [
     "dist"
@@ -11,6 +11,7 @@
     "./graphql": "./dist/graphql.js",
     "./handoff": "./dist/handoff.js",
     "./handoff-state": "./dist/handoff-state.js",
+    "./internal-api": "./dist/internal-api.js",
     "./lease": "./dist/lease.js",
     "./oauth": "./dist/oauth.js",
     "./relay": "./dist/relay.js",