@tokenoftrust/storefront-runner 1.4.0 → 1.4.1

package/apps/storefront/src/pages/api/dashboard/enter-vendor.ts

@@ -29,6 +29,7 @@ import {
   StaffVendorAccessClientError,
 } from "@/lib/dashboard/staffVendorAccess";
 import { mintBrokerAssertion, BrokerAssertionError } from "@/lib/auth/brokerAssertion";
+import { resolveUiActor, recordUiActivity } from "@/lib/activity/uiActor";
 
 export const prerender = false;
 
@@ -57,6 +58,11 @@ export async function POST(context: APIContext): Promise<Response> {
     typeof body.vendorAppDomain === "string" ? body.vendorAppDomain.trim() : "";
   if (!vendorAppDomain) return json({ error: "vendorAppDomain is required" }, 400);
 
+  // D11: staff-impersonation audit event. Resolve the actor AFTER the staff gate above,
+  // so the cohort is always `admin` (a ToT-staff session); the staff email is PII and is
+  // never stored (actor.id is its salted hash). Reused at each emit exit point below.
+  const activityActor = await resolveUiActor(context, {});
+
   let client;
   try {
     client = await createStaffVendorAccessClient();
@@ -84,6 +90,12 @@ export async function POST(context: APIContext): Promise<Response> {
   // capability, and writes the audit row. We admit ONLY on its ok.
   const result = await client.grantStaffAccess(brokerAssertion, vendorAppDomain);
   if (!result.ok) {
+    recordUiActivity(activityActor, {
+      action: "dashboard.vendor_entered",
+      outcome: { status: "refused", errorClass: result.reason ?? `http_${result.status}` },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain } },
+    });
     return json(
       { error: result.message, reason: result.reason, code: result.code },
       staffAccessHttpStatus(result.reason, result.status),
@@ -103,6 +115,12 @@ export async function POST(context: APIContext): Promise<Response> {
     // No SESSION KV / no cookie (e.g. plain `astro dev`) — the audit row is
     // written but we can't persist the marker. Fail closed so the viewer isn't
     // told they're admitted when the guard can't see it.
+    recordUiActivity(activityActor, {
+      action: "dashboard.vendor_entered",
+      outcome: { status: "failed", errorClass: "session_store_unavailable" },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+    });
     return json({ error: "session store unavailable; cannot persist admission" }, 503);
   }
   const updated = await updateSession(
@@ -112,9 +130,21 @@ export async function POST(context: APIContext): Promise<Response> {
     nowSeconds,
   );
   if (!updated) {
+    recordUiActivity(activityActor, {
+      action: "dashboard.vendor_entered",
+      outcome: { status: "failed", errorClass: "session_expired" },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+    });
     return json({ error: "session expired; sign in again" }, 401);
   }
 
+  recordUiActivity(activityActor, {
+    action: "dashboard.vendor_entered",
+    outcome: { status: "succeeded" },
+    scope: { tenantId: vendorAppDomain },
+    payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+  });
   return json({
     ok: true,
     appDomain: vendorAppDomain,

package/apps/storefront/src/pages/auth/login.astro

@@ -11,6 +11,7 @@
  * reach the browser. Inline style carries the per-request CSP nonce.
  */
 import { normalizeEmailHint } from "@/lib/privacy/emailHint";
+import { safeNext } from "@/lib/auth/route";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.
@@ -24,10 +25,10 @@ const sent = url.searchParams.get("sent") === "1";
 const email = (url.searchParams.get("email") ?? "").trim();
 const emailHint = normalizeEmailHint(url.searchParams.get("email_hint")) ?? "";
 const errorCode = url.searchParams.get("error");
-const next = (() => {
-  const n = url.searchParams.get("next") ?? "/";
-  return n.startsWith("/") && !n.startsWith("//") ? n : "/";
-})();
+// Same open-redirect chokepoint the verify endpoint + login gate use — never a
+// parallel weaker copy (this value is threaded into the sign-in form's hidden
+// `next` and back to /api/auth/verify, which re-checks it with the same guard).
+const next = safeNext(url.searchParams.get("next"));
 
 // RFC 9470 step-up: tot core told /api/auth/verify (or /api/auth/magic-exchange,
 // which redirects to /auth/magic instead) that it needs a fresher credential

package/apps/storefront/src/pages/cockpit.astro

@@ -27,6 +27,7 @@ import { readViewerSession } from "@/lib/auth/route";
 import { staticTenants } from "@/config/tenants";
 import { resolvePreviewTenant } from "@/config/previewTenantLookup";
 import { readTenantPreviewStatus, isStoreNotSetUp } from "@/lib/dev/previewStatus";
+import { ensureCockpitVcBinding } from "@/lib/dev/vcBinding";
 import { resolveDevApiBase } from "@/lib/dev/apiBase";
 import { resolveCockpitStoreResource } from "@/lib/dev/cockpitStore";
 import { normalizeEmailHint, redactEmailForHint } from "@/lib/privacy/emailHint";
@@ -132,6 +133,30 @@ const storeNotSetUp =
 // hasStoreAccess) for anything that mints a command or starts the activity poll.
 const canSetupStore = hasStoreAccess && !noResolvableStore && !storeNotSetUp;
 
+// vc-app-binding safety-net (08-18, §5): a BROWSER-FIRST developer reached this page
+// via the storefront's own sign-in (a tot_session cookie) without ever crossing an
+// MCP binding seam (rendezvous approve / native OAuth), so `appForCaller` doesn't
+// resolve them and the `tot start` command we're about to hand them would 403 with
+// "No version-control app is bound." Ensure the binding now — on-behalf of the
+// verified session identity, via the app's private_key_jwt channel. Best-effort +
+// fail-open (never blocks render), throttled to once per browser session so it stays
+// off the hot render path; the authority-seam binding + backfill remain the real
+// guarantee. Gated on canSetupStore (entitled + resolvable + provisioned), the exact
+// condition under which we render a runnable command.
+if (canSetupStore && session && !Astro.cookies.has("tot_vc_bound")) {
+  const vcBind = await ensureCockpitVcBinding(session.email);
+  if (vcBind.ok) {
+    // Throttle only on a real success — a fail-open miss retries on the next load.
+    Astro.cookies.set("tot_vc_bound", "1", {
+      path: "/",
+      httpOnly: true,
+      sameSite: "lax",
+      secure: true,
+      maxAge: 3600, // re-check hourly so a lost/revoked binding self-heals
+    });
+  }
+}
+
 // Signed in, but either no developer capability on any store OR (staff bypass) no store
 // resolves for this viewer/host — an honest recovery state (not a 401): show what to
 // do, not the fastpath. NOTE: storeNotSetUp is deliberately NOT folded in here — it is
@@ -2651,6 +2676,17 @@ const hostedActivityScript = `
         var rzvTimer = null, rzvCode = null, rzvDecided = false;
         function rzvShow(el) { if (el) el.hidden = false; }
         function rzvHide(el) { if (el) el.hidden = true; }
+        // Once the terminal has ATTACHED, the command has plainly been pasted and
+        // run — hide the copy affordances so the approve prompt is the page's
+        // single focus (DZ 2026-08-18). An EXPIRED sign-in restores the generate
+        // button (a fresh mint is needed); the stale command's copy icon stays gone.
+        function rzvHideCopyCtas() {
+          if (btn) btn.hidden = true;
+          if (copyIcon) copyIcon.hidden = true;
+        }
+        function rzvRestoreGenerate() {
+          if (btn) btn.hidden = false;
+        }
         function rzvStopPoll() { if (rzvTimer) { clearTimeout(rzvTimer); rzvTimer = null; } }
         function rzvFinish(msg) {
           rzvStopPoll(); rzvDecided = true;
@@ -2669,13 +2705,14 @@ const hostedActivityScript = `
           } catch (e) { rzvTimer = setTimeout(rzvPoll, 2800); return; }
           if (!r || !r.ok) { rzvTimer = setTimeout(rzvPoll, 3200); return; }
           if (b.state === "attached" && b.fingerprint) {
+            rzvHideCopyCtas();
             rzvHide(rzvWait); rzvShow(rzvConfirm);
             if (rzvFp) { rzvFp.textContent = b.fingerprint; rzvFp.setAttribute("data-fp", b.fingerprint); }
             return; // stop polling — wait for the human decision
           }
-          if (b.state === "approved") { rzvFinish("Signed in ✓ — your terminal is good to go."); return; }
-          if (b.state === "denied") { rzvFinish("Rejected — that terminal wasn’t approved. You’re safe; generate a fresh command to try again."); return; }
-          if (b.state === "expired") { rzvFinish("This sign-in expired. Generate a fresh setup command above."); return; }
+          if (b.state === "approved") { rzvHideCopyCtas(); rzvFinish("Signed in ✓ — your terminal is good to go."); return; }
+          if (b.state === "denied") { rzvHideCopyCtas(); rzvFinish("Rejected — that terminal wasn’t approved. You’re safe; generate a fresh command to try again."); return; }
+          if (b.state === "expired") { rzvRestoreGenerate(); rzvFinish("This sign-in expired. Generate a fresh setup command above."); return; }
           rzvTimer = setTimeout(rzvPoll, 2500); // pending → keep watching
         }
         function rzvStart(code) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/activity/README.md

@@ -0,0 +1,146 @@
+# Operational activity telemetry — the actor×action contract (card D0)
+
+The foundation the D1–D8 cards build on. Everything here is **pure types + pure
+functions** in `@tot/public-runtime` (the node-free, dependency-free edge base),
+so the storefront server, the Cloudflare Worker edge bundle, and the CLI's JS
+mirror can all consume it. Nothing here does I/O or picks a store — the store
+**decision** and cost model live in the repo-root `DECISIONS.md` §8; the
+per-action store **routing** lives on each catalog entry (`sinks`).
+
+Files:
+
+| File | What |
+|------|------|
+| `event.ts` | The `ActivityEvent` envelope, `ACTIVITY_SCHEMA_VERSION`, `newEventId()`. |
+| `catalog.ts` | The allowlisted `ACTION_CATALOG` registry + `ActionKey` + guards. |
+| `redaction.ts` | Default-deny redaction contract + `createActivityEvent()` (the safe constructor). |
+
+## The envelope
+
+One event says: **an ACTOR performed an ACTION, here is the OUTCOME**, scoped to
+a tenant/change, from a source, at a time. The design invariant is a hard split
+between two zones:
+
+- **Core fields** (`v`, `id`, `at`, `actor`, `action`, `source`, `scope`,
+  `outcome`) — *always safe to store, never redacted*. They carry no free text
+  and no third-party PII **by construction**: `actor.id` is opaque, `action` is
+  an allowlisted catalog key, `outcome.errorClass` is a low-cardinality class
+  (never a raw message).
+- **`payload`** (`args` + `rendered`) — the *extensible, always-redacted* zone.
+  Whatever a call site puts here is default-**denied**.
+
+```ts
+import { createActivityEvent } from "@tot/public-runtime";
+
+const { event, report } = createActivityEvent({
+  action: "cli.command.result",          // must be a catalog key (compile-checked)
+  actor:  { kind: "dev", id: hashedDevId },
+  source: "cli",
+  scope:  { tenantId, traceId },
+  outcome:{ status: "succeeded", durationMs: 812 },
+  payload:{ args: { command: "ship", cliVersion: "1.4.0", exitCode: 0,
+                    secretToken: "…" } }, // ← dropped: not allowlisted / key canary
+});
+// event.payload.args === { command: "ship", cliVersion: "1.4.0", exitCode: 0 }
+```
+
+`createActivityEvent()` is the **only** sanctioned constructor: it fills
+`v`/`id`/`at` and runs the raw payload through the redaction contract, so you
+**cannot** produce an event whose payload skipped redaction.
+
+## The action catalog
+
+`action` is never a free string — it is a key of `ACTION_CATALOG`. Each entry
+declares `actors` (who may emit it), `source`, `sinks` (store routing), and the
+default-deny `argsAllow` / `renderedAllow` payload allowlists. Adding a new
+action = a deliberate edit to `catalog.ts` (+ the CLI mirror, below), never an
+ad-hoc string at a call site. This is what keeps the D5 query surface and the
+D6/D7 alert rules tractable.
+
+### The naming standard (two tiers)
+
+Every key is dot-namespaced and its **first segment is a `<domain>`** — there are
+**no un-namespaced keys**. The domain prefix is stable so dashboards and alert rules
+can glob it (`change.*`, `preview.*`, …). Within that, the catalog uses **two shapes**,
+chosen by whether the action is atomic or two-phase:
+
+- **`<domain>.<verb>` (imperative)** — an **atomic** action that happens in one shot.
+  Examples: `change.ship`, `change.revert`, `change.go_live`, `grant.invite`,
+  `grant.revoke`, `store.connect`, `preview.override`.
+- **`<domain>.<entity>.<verb|state>` (participle/state)** — a **two-phase / async**
+  action that **opens then closes** (an invoke/result pair, or a received→terminal span).
+  Examples: `cli.command.invoked` + `cli.command.result`, `preview.build.requested` +
+  `preview.build.completed`, `webhook.reconcile.received` + `reconcile.terminal`.
+
+The **domain must be one of the closed set**: `cli`, `dev`, `preview`, `webhook`,
+`reconcile`, `deploy`, `change`, `content`, `grant`, `store`, `app`, `agent`, `system`.
+Adding a key with a new domain is a deliberate decision — widen this list here first.
+
+**Two-phase pairing going forward:** a **new** two-phase action pairs `.invoked` /
+`.result`. The pre-existing `.requested` / `.completed` (`preview.build.*`) and
+`.received` / `.terminal` (`webhook.reconcile.received` + `reconcile.terminal`) pairs are
+**grandfathered as-is — do not rename them** (`alerts.ts` hardcodes some of these literals,
+so a rename would silently break the D7 detectors).
+
+The initial catalog was reverse-engineered from the activity surfaces that **already
+exist informally** in this repo (CLI dispatch + `~/.tot/activity.log`, the obstacle
+beacon, the local→hosted dev bridge, preview/reconcile/webhook, deploy provenance, the
+ShipLoop `CHANGE_STATES` + admin ship routes, app installs), so D1–D3 map onto it 1:1.
+
+## The redaction contract (the D8 attack surface)
+
+Applied to `payload` for every event, in order:
+
+1. **Default-deny allowlist** — only the top-level keys named by the action's
+   `argsAllow`/`renderedAllow` are eligible. Everything else is **dropped**: not
+   stored, not logged, never "kept raw and redacted later".
+2. **Primitive-only values** — an allowlisted value must be string/number/bool.
+   Objects/arrays are dropped (nested structures are where secrets hide; we do
+   not walk them). Structured args flatten into named primitive keys at the call
+   site.
+3. **Canary scan** — allowlisted primitives are scanned for secret/PII **shapes**
+   (JWT, bearer, AWS/GitHub/Slack/OpenAI keys, private keys, email, card, phone,
+   high-entropy tokens) and secret-looking **key names** (`token`, `secret`,
+   `password`, `authorization`, …). A value hit → replaced with `«redacted»` and
+   reported (`report.canaryTripped`); a key-name hit → dropped outright.
+
+The `RedactionReport` returned alongside the event carries **the fact of** each
+drop/hit (lane, key, reason, canary label) — never the offending value. D4's
+ingest logs it and emits `system.ingest.rejected` when a canary trips; D6/D7
+alert on `canaryTripped`.
+
+## Consuming this from the downstream cards
+
+- **D1 server `recordActivity()`** — import `createActivityEvent`, build the
+  event, fan out to the sinks named on the action's `spec.sinks` (start with
+  `logs`; supersede the interim `apps/storefront/src/lib/activity/recordActivity.ts`
+  slice, whose `candidate.reject` becomes `change.reject`).
+- **D2 deploy provenance** — emit `deploy.version_observed`.
+- **D3 CLI `emitActivity`** — the CLI is **pure JS and does not import TS
+  packages** (it publishes to npm standalone and mirrors TS contracts with
+  keep-in-step tests, e.g. `no-gitea-links.test.mjs`). So D3 ships a small JS
+  mirror of the `ActionKey` list + the safe-constructor shape, plus a
+  keep-in-step test that fails the build if the mirror drifts from
+  `catalog.ts`. **Do not** make the CLI depend on `@tot/public-runtime`.
+- **D4 ingest + store** — validate with `isActionKey` + `isActorAllowed`, run
+  `redactPayload` (belt-and-suspenders even though emitters already redacted),
+  route by `spec.sinks`. See `DECISIONS.md` §8 for the D1 table (`activity_events`
+  in `STOREFRONT_APPS_DB`, alongside the existing `app_audit_log`) and the
+  Analytics Engine binding to provision.
+- **D5 query/timeline UI** — reads the `timeline`-sink rows from D1.
+
+## Open questions deliberately left for downstream
+
+- **Actor-id pseudonymization salt** (D1/D4). This module scrubs PII that leaks
+  into the *payload*, but `actor.id` in the core zone is the emitter's job to
+  pseudonymize. A shared salted non-reversible hash helper (salt as a Worker
+  secret) should land with D1/D4 — do **not** bake a weak unsalted hash into this
+  edge-shipped package.
+- **Analytics Engine binding + D1 `activity_events` schema** (D4). Named in
+  `DECISIONS.md` §8; the actual `wrangler.toml` binding and the Drizzle migration
+  are D4's to write.
+- **Retention/pruning job for the D1 timeline** (D4/D5). Arbitrary retention is
+  the reason the queryable cohort is in D1 not Analytics Engine; the pruning
+  cron is downstream.
+- **Agent cohort payload** — `agent.action.*` keys are a placeholder spine with
+  minimal args until the agent-cohort card defines what an agent may record.