@tokenoftrust/storefront-runner 2.0.1 → 2.0.2

package/apps/storefront/dev-plugins/tenant-hot-reload.mjs

@@ -4,7 +4,9 @@ import { readdirSync, existsSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { markSave, reportServerUp } from "./dev-loop-state.mjs";
 import { isTransientWatchFile } from "../../../scripts/dev/transient-files.mjs";
-import { E2E_TENANT_DIR, tenantDirSegments } from "../../../scripts/lib/tenant-dirs.mjs";
+import { E2E_TENANT_DIR, tenantDirSegments, tenantDirRelative } from "../../../scripts/lib/tenant-dirs.mjs";
+import { validateSavedFile } from "./tenant-validate-on-save.mjs";
+import { validateTenant } from "../../../scripts/tenant/validate.mjs";
 import { readFile } from "node:fs/promises";
 
 // Repo-root tenants/ dir (colocated tenant layout) + the generated static dest
@@ -15,6 +17,10 @@ const REPO_ROOT = fileURLToPath(new URL("../../..", import.meta.url));
 const TENANTS_DIR = join(REPO_ROOT, "tenants").replace(/\\/g, "/");
 const PUBLIC_TENANTS_DEST = fileURLToPath(new URL("../public/tenants", import.meta.url));
 
+/** Per-file finding signatures, so an unchanged warning is not reprinted on every
+ *  keystroke-save. Lives for the dev server's lifetime. */
+const savedFileFindings = new Map();
+
 /**
  * Load a TS module's exports for Node-side (plugin) use, reusing Vite's own
  * transform pipeline instead of a plain `import` (which can't parse `.ts`) or
@@ -265,6 +271,18 @@ export function tenantHotReload() {
       // matching reload is timestamped by dev-loop-monitor's ws/hot wrap.
       markSave(rest, "change");
 
+      // Validate the save — deliberately NOT awaited. The reload branches below
+      // dispatch exactly as they did before, and the findings arrive in the
+      // terminal a beat later. Putting this in the reload path would tax every
+      // save to report something that is almost always empty.
+      void validateSavedFile({
+        tenantDir: join(REPO_ROOT, tenantDirRelative(id)),
+        tenantId: id,
+        rest,
+        memo: savedFileFindings,
+        validate: validateTenant,
+      });
+
       // Content HTML: the change invalidates the SSR module graph, so the
       // Cloudflare Vite plugin reloads the worker and — once it is ready — emits
       // its own correctly-timed full-reload (which the injected Vite HMR client

package/apps/storefront/dev-plugins/tenant-validate-on-save.mjs

@@ -0,0 +1,78 @@
+/**
+ * Validate a tenant file on save, OFF the reload path.
+ *
+ * The validator's warnings used to reach a developer only if they remembered to
+ * run `tot validate`, or at `tot submit` — both after the fact. The earliest
+ * moment is the save itself, and `tot dev` already watches every tenant file.
+ *
+ * The constraint is that the dev loop's whole value is save→HMR speed, so this
+ * must never sit in that path: `handleHotUpdate` fires this and does not await it.
+ * The reload is dispatched exactly as before and the findings land a beat later in
+ * the terminal. A whole-tenant pass measures ~13ms, so there is no need to scope
+ * the validator itself — only to keep it off the critical path.
+ *
+ * Errors are NOT reported here. An error already blocks `tot submit`, and the dev
+ * loop is where a page is half-written by definition — a fragment mid-edit
+ * legitimately fails checks it will pass a keystroke later. Warnings are the ones
+ * that otherwise ship silently, which is the gap this closes.
+ */
+
+/** Findings worth interrupting a save for: warnings on the file just saved. */
+export function findingsForSavedFile(findings, rest) {
+  const target = String(rest || "").replace(/\\/g, "/");
+    return (findings || []).filter(
+    (f) => f.level !== "error" && String(f.file || "").replace(/\\/g, "/").endsWith(target),
+  );
+}
+
+/** A stable identity for a file's finding set, so an unchanged set is not reprinted. */
+export function findingsSignature(findings) {
+  return findings.map((f) => `${f.rule}:${f.message}`).sort().join("|");
+}
+
+/**
+ * Decide what to print for one save. Pure: the caller owns the memo and the
+ * console. Returns null when there is nothing new to say — an unchanged finding
+ * set on every keystroke-save is noise that trains people to ignore the channel.
+ *
+ * @param {{ findings: any[], rest: string, previousSignature: string | undefined }} input
+ * @returns {{ signature: string, lines: string[] } | null}
+ */
+export function reportForSave({ findings, rest, previousSignature }) {
+  const mine = findingsForSavedFile(findings, rest);
+  const signature = findingsSignature(mine);
+  if (signature === (previousSignature ?? "")) return null;
+  // Newly clean: say so once, so a fixed warning visibly clears rather than just
+  // never being mentioned again.
+  if (!mine.length) return { signature, lines: [`  ✓ ${rest} — validation warnings cleared`] };
+  return {
+    signature,
+    lines: [
+      `  ⚠ ${rest} — ${mine.length} validation warning(s)`,
+      ...mine.map((f) => `    ⚠ [${f.rule}] ${f.message}`),
+    ],
+  };
+}
+
+/**
+ * Run the validator for the tenant owning the saved file and print anything new.
+ * Never throws and never returns a rejected promise: a validator fault must not
+ * break the dev loop, which is the thing the developer is actually using.
+ *
+ * @param {{ tenantDir: string, tenantId: string, rest: string,
+ *   memo: Map<string, string>, validate: (dir: string, opts?: any) => any,
+ *   log?: (line: string) => void }} input
+ */
+export async function validateSavedFile({ tenantDir, tenantId, rest, memo, validate, log = console.error }) {
+  let findings;
+  try {
+    ({ findings } = validate(tenantDir, { tenantId }));
+  } catch {
+    return; // a validator fault is never worth breaking the loop over
+  }
+  const key = `${tenantId}/${rest}`;
+  const report = reportForSave({ findings, rest, previousSignature: memo.get(key) });
+  if (!report) return;
+  memo.set(key, report.signature);
+  for (const line of report.lines) log(line);
+}

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -42,11 +42,16 @@ const { tenant, basePath } = Astro.locals;
 
 // Viewer capability, mirrored from the same session model the API routes gate
 // on (resolveOwnerSession admits capability owner|admin). UX-only: the server
-// re-authorizes every action.
+// re-authorizes every action. Checked against `envelope.targetTenant`, not the
+// routed `tenant.appDomain` — a ToT-staff viewer operating a store other than
+// the one that served this admin route must be checked against the tenant
+// they SELECTED, else a real grant on the selected tenant reads as "none".
 const viewerSession = await readViewerSession(Astro);
-// Session capability counts only when the session's resource IS this tenant.
+// Session capability counts only when the session's resource IS the selected tenant.
 const sessionCapability =
-  viewerSession?.resource === tenant.appDomain ? viewerSession.capability : undefined;
+  viewerSession && viewerSession.resource === envelope.targetTenant
+    ? viewerSession.capability
+    : undefined;
 const viewerCapability =
   Astro.locals.viewer?.capability ?? sessionCapability ?? "none";
 // A signed-in DEVELOPER (not owner/admin) may hold an explicit, owner-revocable
@@ -58,7 +63,7 @@ let viewerCanShip = viewerCapability === "owner" || viewerCapability === "admin"
 if (!viewerCanShip && Astro.locals.viewer?.email) {
   const shipGrant = await resolveViewerShipCapability(
     Astro.locals.viewer.email,
-    tenant.appDomain,
+    envelope.targetTenant,
   );
   if (shipGrant === "ship-on-behalf") viewerCanShip = true;
 }

package/apps/storefront/src/middleware/index.ts

@@ -69,6 +69,7 @@ import {
   PUBLIC_HOME_TENANT_ID,
 } from "@/lib/auth/loginGate";
 import { resolveAdminLanding, isAdminSelectPath } from "@/lib/auth/adminLanding";
+import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
 import { gatedHoldingResponse } from "@/lib/auth/gatePage";
 import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
 import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
@@ -258,7 +259,22 @@ export const onRequest = defineMiddleware(async (context, next) => {
       // an explicit vendor selection sees the staffRoles-scoped capability. The
       // ship gates (decideIsOwner/resolveShipPrincipal) read this capability,
       // so binding it here keeps owner-resolution server-side + tenant-correct.
-      const hostCapability = sessionHostCapability(viewerRecord, tenant.appDomain, nowSeconds);
+      //
+      // On an admin path, "the host" a staff viewer is really acting on is the
+      // ?asTenant= impersonation target (mirrors admin.astro/AdminPublishTab.astro's
+      // own resolveAdminTenantMode call) — resolving capability against the routed
+      // host instead left a staff viewer who selected another tenant reading as
+      // "not an owner" of it even while holding a real grant, because their
+      // staffSelection is bound to the SELECTED tenant, never the host app.
+      const capabilityHost = isAdminPath(url.pathname)
+        ? resolveAdminTenantMode({
+            session: viewerRecord,
+            adminAppTenant: tenant.appDomain,
+            requestedTarget: url.searchParams.get("asTenant"),
+            nowSeconds,
+          }).envelope.targetTenant
+        : tenant.appDomain;
+      const hostCapability = sessionHostCapability(viewerRecord, capabilityHost, nowSeconds);
       locals.viewer = {
         email: viewerRecord.email,
         roles: hostCapability ? [hostCapability] : viewerRecord.roles,

package/apps/storefront/src/pages/admin.astro

@@ -54,25 +54,14 @@ const viewerEmail = (Astro.locals.viewer?.email ?? viewerSession?.email ?? "").t
 const viewerDomain = viewerEmail.split("@").at(-1) ?? "";
 const canViewInternalGuide = viewerDomain === "tokenoftrust.com";
 
-// dg6 — admin session ENTRY resolved SERVER-SIDE against the resolved tenant's
-// appDomain (never client input, never a bearer secret): an authenticated
-// owner/team member for THIS tenant reaches the admin context; a non-member /
-// anonymous visitor was already held at the sign-in gate (middleware). Consumes
-// u10's owner + ship-capability model; the go-live tabs (AdminPublishTab) read
-// the same host-bound `Astro.locals.viewer.capability`, so the shell just stamps
-// the authoritative principal for chrome + tests — it does not re-gate.
-const adminEntry = resolveAdminEntry({
-  record: viewerSession,
-  hostResource: tenant.appDomain,
-  nowSeconds: Math.floor(Date.now() / 1000),
-});
-
 // Internal admin-app tenant mode (baseline doc §Admin App As Tenant,
 // tenant-envelope-contract): every mounted tab receives an explicit
 // { adminAppTenant, targetTenant } envelope. Only a real ToT-staff session
 // may move targetTenant away from the routed tenant, and only to a tenant
 // they already have real access to — see lib/adminTenantEnvelope.ts for the
-// authorization rule (deny-by-default, refused not hidden-only).
+// authorization rule (deny-by-default, refused not hidden-only). Resolved
+// BEFORE adminEntry below: a staff viewer's capability must be checked
+// against the tenant they selected, not the app's routed host.
 const adminTenantMode = resolveAdminTenantMode({
   session: viewerSession,
   adminAppTenant: tenant.appDomain,
@@ -80,6 +69,19 @@ const adminTenantMode = resolveAdminTenantMode({
   nowSeconds: Math.floor(Date.now() / 1000),
 });
 const { envelope: tenantEnvelope, isStaff, pickerTenants, deniedTarget } = adminTenantMode;
+
+// dg6 — admin session ENTRY resolved SERVER-SIDE against the SELECTED tenant's
+// appDomain (never client input, never a bearer secret): an authenticated
+// owner/team member for THIS tenant reaches the admin context; a non-member /
+// anonymous visitor was already held at the sign-in gate (middleware). Consumes
+// u10's owner + ship-capability model; the go-live tabs (AdminPublishTab) read
+// the same tenant-bound `Astro.locals.viewer.capability`, so the shell just stamps
+// the authoritative principal for chrome + tests — it does not re-gate.
+const adminEntry = resolveAdminEntry({
+  record: viewerSession,
+  hostResource: tenantEnvelope.targetTenant,
+  nowSeconds: Math.floor(Date.now() / 1000),
+});
 ---
 
 <!doctype html>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",