@tokenoftrust/storefront-runner 2.0.10 → 2.0.11

package/apps/storefront/src/lib/auth/loginGate.ts

@@ -144,6 +144,39 @@ export function isPublicPath(pathname: string): boolean {
   return pathname === "/api/cli/policy";
 }
 
+/**
+ * The CLI viewer-session mint (`/api/dev/cli-session`) — how an invited developer
+ * turns their own `tot login` MCP token into a storefront session so `tot accept`
+ * can reach the ship surface. Like the static-bundle upload it governs its OWN,
+ * stricter auth and must reach its handler rather than being masked behind the
+ * "Coming soon" holding page.
+ *
+ * Gate-exemption does NOT weaken it, on three independent grounds:
+ *   - It authenticates ITSELF: no `Authorization: Bearer <token>` → 401
+ *     `missing_bearer`. It reads no cookie, so it carries zero ambient authority.
+ *   - It resolves WHO that opaque token is only by asking the MCP over the
+ *     service-secret seam, fail-closed (unconfigured seam, transport fault, non-2xx,
+ *     unparseable body, or absent email all → 401).
+ *   - The session it mints is capability `member`, roles `[]` — byte-for-byte the
+ *     one `/api/auth/magic-exchange` produces from the same `reissueSubjectToken` →
+ *     verify → `createSession` path, and that route is ALREADY exempt via
+ *     {@link isAuthPath}. So this exposes no reachable surface that is not.
+ *
+ * It also grants no admission: a developer holding no membership for this host gets
+ * a session that STILL fails `sessionAdmitsHost`, so the gate stays closed to them.
+ *
+ * Matched in BOTH addressing forms, like {@link isCandidatePreviewPath} — the gate
+ * sees the PRE-STRIP request path, so a tenant reached by path prefix arrives as
+ * `/<tenant>/api/dev/cli-session`. The CLI addresses tenants exactly that way (the
+ * shared storefront origin serves every tenant under a path prefix, which is the only
+ * form that works for a tenant whose apex has not cut over), so an exact-match-only
+ * exemption would never fire for the one caller this route exists to serve.
+ */
+export function isDevCliSessionPath(pathname: string): boolean {
+  if (pathname === "/api/dev/cli-session") return true;
+  return /^\/[^/]+\/api\/dev\/cli-session$/.test(pathname);
+}
+
 /**
  * The authenticated static-bundle staging upload (`/api/publish/stage-bundle`).
  * Like the candidate-preview control plane, it governs its OWN, stricter auth (a
@@ -266,6 +299,8 @@ export function evaluateLoginGate(input: LoginGateInput): LoginGateDecision {
   if (isCandidatePreviewPath(input.pathname)) return { action: "pass" };
   // The static-bundle staging upload carries its own private_key_jwt auth.
   if (isStaticBundleUploadPath(input.pathname)) return { action: "pass" };
+  // The CLI viewer-session mint carries its own bearer auth — see isDevCliSessionPath.
+  if (isDevCliSessionPath(input.pathname)) return { action: "pass" };
   // QA content-bypass: a request presenting the server-configured token passes for
   // public content only. NEVER for admin/cockpit/api — that guard lives here (not
   // just in middleware) so /admin stays gated even if the flag is set upstream.

package/apps/storefront/src/lib/tot/syncState.ts

@@ -65,6 +65,8 @@ export interface CatalogSyncState {
   source: SyncStateSourceMode;
   fidelity: SyncStateFidelity;
   lastSyncAt: string | null;
+  /** True when the most recent sync loaded with record errors; absent on a pre-hsby-B3 catalog. */
+  lastSyncHadErrors?: boolean;
   products: SyncStateEntity;
   collections: SyncStateEntity;
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",