@tokenoftrust/cli 4.7.2 → 4.7.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "4.7.2",
+  "version": "4.7.3",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/viewer-session.mjs

@@ -54,6 +54,29 @@ function originOf(url) {
   }
 }
 
+/** The hosted storefront Worker's own public origins (`[env.preview]`). Only a
+ *  storefront called at one of these EXACT origins may steer the CLI to present a
+ *  session for a different MCP issuer: anything reached through `--url` /
+ *  `TOT_STOREFRONT_URL` is user input, and a hostile one could otherwise name the
+ *  prod issuer and collect that session. */
+export const FIRST_PARTY_STOREFRONT_ORIGINS = Object.freeze(new Set([
+  DEFAULT_STOREFRONT_ORIGIN,
+  "https://storefront.tokenoftrust.workers.dev",
+]));
+
+/** The Token of Trust MCP issuers a first-party storefront may name. Exact origins. */
+export const TOKEN_OF_TRUST_MCP_ORIGINS = Object.freeze(new Set([
+  "https://mcp.tokenoftrust.com",
+  "https://mcp.qa.tokenoftrust.com",
+]));
+
+/** True only when BOTH sides are declared first-party, by exact origin. */
+function mayPresentSessionFor(storefrontBase, issuer) {
+  const storefront = originOf(storefrontBase);
+  return Boolean(storefront && issuer &&
+    FIRST_PARTY_STOREFRONT_ORIGINS.has(storefront) && TOKEN_OF_TRUST_MCP_ORIGINS.has(issuer));
+}
+
 /**
  * Turn a non-2xx `/api/dev/cli-session` response into one clean, actionable
  * `{ message, hint }` — the ONE place this CLI interprets that endpoint's refusal
@@ -91,9 +114,13 @@ export function describeCliSessionRefusal(status, body, signedInMcpUrl) {
   if (error === "unresolved_token" && trustedMcp) {
     const signedInOrigin = originOf(signedInMcpUrl);
     if (signedInOrigin && signedInOrigin !== trustedMcp) {
+      // `TOT_SELECTED_MCP_URL=… tot login` adds a session for the storefront's MCP
+      // WITHOUT rebinding this checkout (`tot login --mcp` inside a checkout would
+      // move every command there to the other tier). Once that session exists,
+      // `resolveViewerTransport` uses it for the hosted storefront on its own.
       return {
-        message: `you're signed in to ${signedInOrigin}, but this store trusts ${trustedMcp}.`,
-        hint: `run \`tot login --mcp ${trustedMcp}\` (or unset TOT_MCP_URL), then re-run.`,
+        message: `you're signed in to ${signedInOrigin}, but the hosted storefront trusts ${trustedMcp}.`,
+        hint: `sign in to it once with \`TOT_SELECTED_MCP_URL=${trustedMcp} tot login\` (this checkout stays on ${signedInOrigin}), then re-run.`,
       };
     }
   }
@@ -150,42 +177,48 @@ export async function resolveViewerTransport({
   }
 
   const base = tenantBase(tenant, storefrontUrl);
-  let res;
-  try {
-    // `content-type: application/json` is REQUIRED, not decoration. Astro's origin
-    // check rejects any unsafe-method request that is cross-origin AND either
-    // form-like (`application/x-www-form-urlencoded`, `multipart/form-data`,
-    // `text/plain`) or carries no content-type at all. Node's `fetch` sends no
-    // `Origin`, so every request from here is "cross-origin" — declaring JSON is what
-    // takes it out of the form-POST class the check guards. It is an honest
-    // declaration, not a bypass: a browser cannot send `application/json`
-    // cross-origin without a CORS preflight this worker never answers, so the
-    // anti-CSRF property is preserved exactly. Spoofing an `Origin` header instead
-    // would assert a browser context that does not exist and protect nothing.
-    vlog(`POST ${base}/api/dev/cli-session`);
-    res = await fetchImpl(`${base}/api/dev/cli-session`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${dev.token}`,
-        "content-type": "application/json",
-      },
-      body: "{}",
-    });
-  } catch (e) {
-    return {
-      ok: false,
-      message: `couldn't reach ${base} to start a session: ${e?.message || e}`,
-      hint: "check the --tenant domain / your network, then re-run.",
-    };
+  const first = await mintSession(base, dev.token, fetchImpl, vlog);
+  if (!first.ok) return first.refusal;
+  /** @type {any} */
+  let res = first.response;
+
+  // The hosted storefront trusts ONE MCP issuer, independent of the tier this
+  // checkout is bound to (a QA-registry store is still served by the shared
+  // storefront). When it names a different issuer, the session to present is the
+  // one for THAT issuer — the checkout's own binding is for the registry, not for
+  // this transport. Use it when the developer holds one; otherwise fall through
+  // to the refusal, which says how to get one without rebinding the checkout.
+  if (res.status === 401) {
+    const body = await readJson(res);
+    const trustedMcp = typeof body?.trustedMcp === "string" ? body.trustedMcp : null;
+    const signedInOrigin = originOf(dev.mcpUrl);
+    if (
+      body?.error === "unresolved_token" &&
+      mayPresentSessionFor(base, trustedMcp) &&
+      signedInOrigin && signedInOrigin !== trustedMcp
+    ) {
+      let trustedDev = null;
+      try {
+        trustedDev = await resolveDev(null, { ...env, TOT_SELECTED_MCP_URL: trustedMcp }, { fetchImpl });
+      } catch {
+        /* no usable session for the storefront's issuer — report the mismatch below */
+      }
+      if (trustedDev?.token && originOf(trustedDev.mcpUrl) === trustedMcp) {
+        vlog(`cli-session: retrying with your ${trustedMcp} session`);
+        const retry = await mintSession(base, trustedDev.token, fetchImpl, vlog);
+        if (!retry.ok) return retry.refusal;
+        res = retry.response;
+        dev = trustedDev;
+      } else {
+        res = replayJson(res, body);
+      }
+    } else {
+      res = replayJson(res, body);
+    }
   }
-  vlog(`cli-session → HTTP ${res.status}`);
+
   if (res.status === 401 || res.status === 502 || res.status === 503) {
-    let body = null;
-    try {
-      body = await res.json();
-    } catch {
-      /* non-JSON error body — describeCliSessionRefusal falls back cleanly */
-    }
+    const body = await readJson(res);
     if (body?.error || body?.code) vlog(`cli-session error: ${[body.error, body.code].filter(Boolean).join(" / ")}`);
     const { message, hint } = describeCliSessionRefusal(res.status, body, dev.mcpUrl);
     return { ok: false, message, hint };
@@ -218,3 +251,64 @@ export async function resolveViewerTransport({
     },
   };
 }
+
+/** The refusal body, or null when the body is not JSON (describeCliSessionRefusal
+ *  falls back cleanly). Any other failure — a body already consumed, a stream
+ *  error — is a bug or a fault, not "no body", and propagates.
+ *  @param {{ json: () => Promise<any> }} res */
+async function readJson(res) {
+  try {
+    return await res.json();
+  } catch (e) {
+    if (!(e instanceof SyntaxError)) throw e;
+    return null;
+  }
+}
+
+/** A response whose body was already read, re-readable once more. */
+function replayJson(res, body) {
+  return { ok: res.ok, status: res.status, headers: res.headers, json: async () => body };
+}
+
+/**
+ * POST the bearer to `<base>/api/dev/cli-session`.
+ * @returns {Promise<{ ok: true, response: any } | { ok: false, refusal: { ok: false, message: string, hint: string } }>}
+ */
+async function mintSession(base, token, fetchImpl, vlog) {
+  let res;
+  try {
+    // `content-type: application/json` is REQUIRED, not decoration. Astro's origin
+    // check rejects any unsafe-method request that is cross-origin AND either
+    // form-like (`application/x-www-form-urlencoded`, `multipart/form-data`,
+    // `text/plain`) or carries no content-type at all. Node's `fetch` sends no
+    // `Origin`, so every request from here is "cross-origin" — declaring JSON is what
+    // takes it out of the form-POST class the check guards. It is an honest
+    // declaration, not a bypass: a browser cannot send `application/json`
+    // cross-origin without a CORS preflight this worker never answers, so the
+    // anti-CSRF property is preserved exactly. Spoofing an `Origin` header instead
+    // would assert a browser context that does not exist and protect nothing.
+    vlog(`POST ${base}/api/dev/cli-session`);
+    res = await fetchImpl(`${base}/api/dev/cli-session`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json",
+      },
+      body: "{}",
+      // Never follow a redirect with the bearer attached: a 3xx is a refusal here
+      // (non-2xx), so the token only ever reaches the origin it was addressed to.
+      redirect: "manual",
+    });
+  } catch (e) {
+    return {
+      ok: false,
+      refusal: {
+        ok: false,
+        message: `couldn't reach ${base} to start a session: ${e?.message || e}`,
+        hint: "check the --tenant domain / your network, then re-run.",
+      },
+    };
+  }
+  vlog(`cli-session → HTTP ${res.status}`);
+  return { ok: true, response: res };
+}