@tokenoftrust/cli 2.0.4 → 2.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.4",
+  "version": "2.0.5",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/viewer-session.mjs

@@ -85,9 +85,23 @@ export async function resolveViewerTransport({
   const base = tenantBase(tenant, storefrontUrl);
   let res;
   try {
+    // `content-type: application/json` is REQUIRED, not decoration. Astro's origin
+    // check rejects any unsafe-method request that is cross-origin AND either
+    // form-like (`application/x-www-form-urlencoded`, `multipart/form-data`,
+    // `text/plain`) or carries no content-type at all. Node's `fetch` sends no
+    // `Origin`, so every request from here is "cross-origin" — declaring JSON is what
+    // takes it out of the form-POST class the check guards. It is an honest
+    // declaration, not a bypass: a browser cannot send `application/json`
+    // cross-origin without a CORS preflight this worker never answers, so the
+    // anti-CSRF property is preserved exactly. Spoofing an `Origin` header instead
+    // would assert a browser context that does not exist and protect nothing.
     res = await fetchImpl(`${base}/api/dev/cli-session`, {
       method: "POST",
-      headers: { authorization: `Bearer ${dev.token}` },
+      headers: {
+        authorization: `Bearer ${dev.token}`,
+        "content-type": "application/json",
+      },
+      body: "{}",
     });
   } catch (e) {
     return {