@tokenoftrust/storefront-runner 1.4.0 → 1.4.2-rc.0

package/apps/storefront/astro.config.mjs

@@ -57,6 +57,7 @@ const gitSha = (() => {
 import preact from "@astrojs/preact";
 import tailwindcss from "@tailwindcss/vite";
 import { tenantHotReload } from "./dev-plugins/tenant-hot-reload.mjs";
+import { materializeGuard } from "./integrations/materialize-guard.mjs";
 
 // SSR on Cloudflare Workers. `output: 'server'` because every response is
 // tenant-resolved at the edge from the Host header (see src/middleware).
@@ -88,7 +89,22 @@ export default defineConfig({
     // images get rehosted to R2 in Phase 1 ETL (see DECISIONS.md).
     imageService: "compile",
   }),
-  integrations: [preact({ compat: true })],
+  integrations: [
+    // Refuse to build unless every Gitea-classified tenant is materialized from
+    // Gitea at a pinned ref — intrinsic to `astro build`, not just deploy.sh, so
+    // no build path can silently bake empty/stale real-tenant content.
+    materializeGuard(),
+    preact({ compat: true }),
+    // Astro's file-based router ignores ANY path segment starting with "_" (see
+    // `astro/dist/core/routing/create-manifest.js`), so a page literally named
+    // `pages/__evidence.astro` silently never becomes a route (confirmed by build:
+    // no "/__evidence" entry lands in the route manifest, and it 404s in dev — the
+    // SAME latent gap `pages/__preview/version.ts` has, pre-existing and out of
+    // scope here). `injectRoute` is the supported way to bind an arbitrary URL
+    // pattern to a component that lives OUTSIDE `src/pages` (so it never competes
+    // with file-based routing), which is how `/__evidence` — the diagnostic evidence
+    // instrument panel — is wired to a real route.
+  ],
   vite: {
     // Build-time constants: the CLI install spec the cockpit hands out (next vs latest),
     // and this build's commit SHA reported by /health.

package/apps/storefront/integrations/materialize-guard.mjs

@@ -0,0 +1,56 @@
+import {
+  assertPinnedMaterialized,
+  checkPinned,
+} from "../../../scripts/tenant/materialize-tenant-content.mjs";
+
+/**
+ * Refuse `astro build` when any Gitea-classified tenant's content isn't
+ * materialized from Gitea at a pinned ref. Runs in `astro:build:start`, so the
+ * guard is INTRINSIC to the build — it fires for a bare `astro build`, `pnpm
+ * build`, or a deploy.sh build alike, never letting an unmaterialized real
+ * tenant bake empty content into the Worker.
+ *
+ * TOT_TENANT_REF   also assert every stamp is EXACTLY this commit (off-ref → refuse)
+ * TOT_ALLOW_UNPINNED=1  tolerate a default-branch (unpinned) materialize
+ * TOT_FRAMEWORK_ONLY_BUILD=1  tolerate ABSENT tenant content (a credential-less
+ *   compile check bakes nothing, so there is nothing stale to guard). Populated
+ *   content without a pinned Gitea stamp still refuses — this never weakens the
+ *   deploy path, which materializes first and never sets this.
+ * TOT_BUILD_TENANTS  comma-separated tenant ids to scope the guard to. A per-tenant
+ *   STATIC publish (materialize-tenant.mjs) sets this to the single tenant it renders,
+ *   so a SIBLING Gitea tenant that isn't part of THIS publish can't block it. Unset ⇒
+ *   guard every Gitea tenant — the Worker-deploy contract, where all tenants are
+ *   served from one Worker at once and any unmaterialized tenant IS a real hazard.
+ */
+export function materializeGuard() {
+  return {
+    name: "materialize-guard",
+    hooks: {
+      "astro:build:start": (ctx = {}) => {
+        const logger = ctx.logger;
+        const expectRef = process.env.TOT_TENANT_REF || null;
+        const allowUnpinned = process.env.TOT_ALLOW_UNPINNED === "1";
+        const scoped = (process.env.TOT_BUILD_TENANTS || "")
+          .split(",")
+          .map((t) => t.trim())
+          .filter(Boolean);
+        const onlyTenants = scoped.length > 0 ? scoped : null;
+        if (process.env.TOT_FRAMEWORK_ONLY_BUILD === "1") {
+          const { problems } = checkPinned(undefined, { expectRef, allowUnpinned, onlyTenants });
+          const absent = problems.filter((p) => p.reason === "absent");
+          const real = problems.filter((p) => p.reason !== "absent");
+          if (absent.length) {
+            const msg = `[materialize-guard] framework-only build: ${absent.length} tenant(s) absent (nothing baked): ${absent.map((p) => p.tenant).join(", ")}`;
+            if (logger && typeof logger.info === "function") logger.info(msg);
+            else console.log(msg);
+          }
+          if (real.length) {
+            assertPinnedMaterialized({ expectRef, allowUnpinned, onlyTenants });
+          }
+          return;
+        }
+        assertPinnedMaterialized({ expectRef, allowUnpinned, onlyTenants });
+      },
+    },
+  };
+}

package/apps/storefront/migrations-apps/0001_woozy_lyja.sql

@@ -0,0 +1,22 @@
+CREATE TABLE `activity_events` (
+	`id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`action` text NOT NULL,
+	`actor_kind` text NOT NULL,
+	`actor_id` text NOT NULL,
+	`actor_ref` text,
+	`source` text NOT NULL,
+	`status` text NOT NULL,
+	`error_class` text,
+	`duration_ms` integer,
+	`change_id` text,
+	`trace_id` text,
+	`payload` text DEFAULT '{}' NOT NULL,
+	`schema_version` integer NOT NULL,
+	`at` text NOT NULL,
+	`ingested_at` text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `idx_activity_tenant_at` ON `activity_events` (`tenant_id`,`at`);--> statement-breakpoint
+CREATE INDEX `idx_activity_tenant_action` ON `activity_events` (`tenant_id`,`action`);--> statement-breakpoint
+CREATE INDEX `idx_activity_change` ON `activity_events` (`change_id`);

package/apps/storefront/migrations-apps/0002_good_switch.sql

@@ -0,0 +1,26 @@
+CREATE TABLE `newsletter_sends` (
+	`tenant_id` text NOT NULL,
+	`collection` text NOT NULL,
+	`digest_id` text NOT NULL,
+	`post_slugs` text DEFAULT '[]' NOT NULL,
+	`recipient_count` integer DEFAULT 0 NOT NULL,
+	`sent_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `collection`, `digest_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `newsletter_subscribers` (
+	`tenant_id` text NOT NULL,
+	`collection` text NOT NULL,
+	`email` text NOT NULL,
+	`status` text DEFAULT 'pending' NOT NULL,
+	`token` text NOT NULL,
+	`consent_source` text,
+	`consent_ip_hash` text,
+	`subscribed_at` text NOT NULL,
+	`confirmed_at` text,
+	`unsubscribed_at` text,
+	`last_sent_at` text,
+	PRIMARY KEY(`tenant_id`, `collection`, `email`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_newsletter_tenant_coll_status` ON `newsletter_subscribers` (`tenant_id`,`collection`,`status`);

package/apps/storefront/migrations-apps/0003_mute_marauders.sql

@@ -0,0 +1,12 @@
+CREATE TABLE `social_tokens` (
+	`tenant_id` text NOT NULL,
+	`network` text NOT NULL,
+	`ciphertext` text NOT NULL,
+	`iv` text NOT NULL,
+	`expires_at` text,
+	`created_at` text NOT NULL,
+	`updated_at` text NOT NULL,
+	PRIMARY KEY(`tenant_id`, `network`)
+);
+--> statement-breakpoint
+CREATE INDEX `idx_social_tokens_tenant` ON `social_tokens` (`tenant_id`);