@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.1

package/apps/storefront/src/lib/membership/model.ts

@@ -11,8 +11,7 @@
  * a tier explicitly asserts `real: true`, the widget marks its figures as
  * illustrative ("e.g." affordance + a group-level "Illustrative figures" label)
  * so example numbers are never presented as a live offer. This mirrors the
- * platform-owned / never-faked discipline of the compliance widgets (decision
- * `compliance-widgets-platform-owned`).
+ * platform-owned / never-faked discipline of the compliance widgets.
  */
 
 /**

package/apps/storefront/src/lib/newsletter/confirmationEmail.ts

@@ -1,10 +1,10 @@
 /**
- * Double-opt-in confirmation mail — STUB (N2).
+ * Double-opt-in confirmation mail — STUB.
  *
  * The storefront Worker sends no email itself: every existing "email" flow is
  * delegated over HTTP to tot20, and there is no bulk/marketing sender in-repo
  * (docs/plans/2026-08-22-newsletter-send-spike.md §1). Wiring the real send is
- * the ESP-pipeline unit N4's job — it replaces the body of this function with a
+ * the ESP-pipeline's job — it replaces the body of this function with a
  * transactional send (confirm link in the body). Until then we only LOG intent,
  * and never let a send failure fail the subscribe (the pending row + returned
  * token are the durable state; the mail is a follow-up).

package/apps/storefront/src/lib/newsletter/consent.ts

@@ -1,8 +1,8 @@
 /**
- * Consent-record primitives for the newsletter double-opt-in flow (N2).
+ * Consent-record primitives for the newsletter double-opt-in flow.
  *
  * `randomToken` mints the opaque per-subscriber secret that both the confirm and
- * (N3) unsubscribe links carry — Web Crypto only (no `node:*`) so it runs
+ * unsubscribe links carry — Web Crypto only (no `node:*`) so it runs
  * identically in the Worker and in tests. `hashConsentIp` is the GDPR-safe IP
  * record: we store `sha256(ip + ":" + salt)`, NEVER the raw IP (repo convention:
  * opaque hashes only, cf. `apps/orders/customerHash.ts`).

package/apps/storefront/src/lib/newsletter/send.ts

@@ -1,6 +1,6 @@
 /**
- * Weekly-digest send orchestration (newsletter-send epic, N4). A single callable
- * `sendWeeklyDigest` that N5's admin trigger endpoint invokes; this unit builds
+ * Weekly-digest send orchestration (newsletter-send epic). A single callable
+ * `sendWeeklyDigest` that the admin trigger endpoint invokes; this unit builds
  * NO HTTP route. Flow (docs/plans/2026-08-22-newsletter-send-spike.md §5–6):
  *
  *   1. Compute this period's `digestId` (`<collection>-<ISO-week>`) and short-
@@ -144,7 +144,7 @@ async function selectNewPosts(
 /**
  * Compute what a weekly digest WOULD send this period — post count, post slugs,
  * and confirmed-recipient count — WITHOUT calling the ESP or writing any ledger
- * row. Backs the admin "Send digest" dry-run/confirm dialog (N5).
+ * row. Backs the admin "Send digest" dry-run/confirm dialog.
  */
 export async function previewWeeklyDigest(
   tenantId: string,

package/apps/storefront/src/lib/previewReload.ts

@@ -62,6 +62,58 @@ export function buildPreviewReloadScript(opts: {
 })();`;
 }
 
+/**
+ * Client that surfaces CSP violations IN THE PREVIEW LOOP (test env only).
+ *
+ * A strict CSP blocks a disallowed resource silently — no page error, just a
+ * missing embed (this is exactly how the Pipedrive-form block escaped the dev
+ * loop and became a platform escalation). The browser DOES fire a
+ * `securitypolicyviolation` event for every block, so we listen for it and paint
+ * a small, dismissible banner naming the blocked directive + URI, right on the
+ * page the developer is previewing. `/api/csp-report` stays as the async
+ * telemetry sink; this is the human-facing, real-time, zero-round-trip signal.
+ *
+ * All dynamic text is written via textContent (never innerHTML), so a hostile
+ * blockedURI can't inject markup. Kept tiny + dependency-free.
+ */
+export function buildCspViolationBannerScript(): string {
+  return `(() => {
+  if (window.__totCspBanner) return; window.__totCspBanner = true;
+  const seen = new Set();
+  let box = null;
+  const ensureBox = () => {
+    if (box) return box;
+    box = document.createElement("div");
+    box.setAttribute("role", "alert");
+    box.style.cssText = "position:fixed;left:12px;bottom:12px;z-index:2147483647;max-width:min(92vw,520px);font:13px/1.45 system-ui,sans-serif;background:#7f1d1d;color:#fff;padding:10px 12px;border-radius:8px;box-shadow:0 6px 24px rgba(0,0,0,.35)";
+    const h = document.createElement("strong");
+    h.textContent = "⚠ Content-Security-Policy blocked " + "resources on this preview";
+    h.style.cssText = "display:block;margin-bottom:4px";
+    const x = document.createElement("button");
+    x.textContent = "✕";
+    x.setAttribute("aria-label", "Dismiss");
+    x.style.cssText = "position:absolute;top:6px;right:8px;background:none;border:0;color:#fff;font-size:14px;cursor:pointer";
+    x.addEventListener("click", () => box.remove());
+    const list = document.createElement("ul");
+    list.style.cssText = "margin:0;padding-left:18px";
+    box.append(h, x, list);
+    box.__list = list;
+    (document.body || document.documentElement).appendChild(box);
+    return box;
+  };
+  document.addEventListener("securitypolicyviolation", (e) => {
+    const directive = e.effectiveDirective || e.violatedDirective || "";
+    const uri = e.blockedURI || "(inline)";
+    const key = directive + "|" + uri;
+    if (seen.has(key)) return; seen.add(key);
+    const li = document.createElement("li");
+    // textContent only (never raw-HTML assignment) so the URI can't inject markup.
+    li.textContent = uri + "  —  blocked by " + directive;
+    ensureBox().__list.appendChild(li);
+  });
+})();`;
+}
+
 /** True when a response is HTML we can inject into. */
 export function isHtmlResponse(response: Response): boolean {
   if (response.status !== 200) return false;
@@ -76,7 +128,11 @@ export function injectPreviewReloadHtml(
   html: string,
   opts: { tenantId: string; basePath: string; nonce: string; pollMs?: number },
 ): string {
-  const script = `<script nonce="${opts.nonce}">${buildPreviewReloadScript(opts)}</script>`;
+  // Two nonce-carrying scripts: the on-publish reload client, and the CSP
+  // violation banner (both test-env only, injected via the same seam).
+  const script =
+    `<script nonce="${opts.nonce}">${buildPreviewReloadScript(opts)}</script>` +
+    `<script nonce="${opts.nonce}">${buildCspViolationBannerScript()}</script>`;
   if (/<\/body>/i.test(html)) {
     return html.replace(/<\/body>/i, `${script}</body>`);
   }