@tokenoftrust/storefront-runner 2.0.2 → 2.0.3

package/apps/storefront/src/lib/dev/cockpitStore.ts

@@ -1,57 +0,0 @@
-/**
- * "Which store is this cockpit request about?" — the ONE resolver the hosted
- * cockpit page, its /api/dev/* routes, and the CLI sign-in-code mint all share, so
- * they never disagree about the developer's store.
- *
- * Rule: the URL wins WHEN THE VIEWER CAN ACCESS IT. The middleware has already
- * resolved the request's host/path to `locals.tenant` (the trusted, authenticated
- * store seam — never client body input), so when that is a SPECIFIC store (not the
- * public marketing home) and the signed-in developer holds a membership for it (or a
- * live staff admission), that store is authoritative. Otherwise we fall back to the
- * session's own first store (the generic-host `/cockpit` case), and for an
- * anonymous viewer to the path store's branding, else the caller-supplied `?tenant=`.
- *
- * Access is gated with the SAME primitive (`viewerCanAccess`) the vendor dashboard
- * uses, so a developer can never steer the mint at a store they don't belong to; a
- * store they can't access simply falls through to their own.
- */
-import type { APIContext } from "astro";
-import type { SessionRecord } from "@/lib/auth/session";
-import { PUBLIC_HOME_TENANT_ID } from "@/lib/auth/loginGate";
-import { viewerCanAccess, type StaffAdmission } from "@/lib/dashboard/tenantSelection";
-
-/** The request's host/path-resolved store resource, or "" when it's the marketing home. */
-function pathStoreResource(context: Pick<APIContext, "locals">): string {
-  const t = context.locals?.tenant;
-  if (!t || t.tenant_id === PUBLIC_HOME_TENANT_ID) return "";
-  return (t.appDomain || t.tenant_id || "").toLowerCase();
-}
-
-/**
- * Resolve the store this cockpit request is scoped to, as a lowercased resource
- * (appDomain/tenant_id). Empty string when nothing resolves (e.g. anonymous on the
- * generic host with no `?tenant=`).
- */
-export function resolveCockpitStoreResource(
-  context: Pick<APIContext, "locals" | "url">,
-  session: SessionRecord | null,
-): string {
-  const pathStore = pathStoreResource(context);
-
-  if (session) {
-    // The URL wins when the signed-in developer can actually access that store.
-    if (pathStore) {
-      const staff: StaffAdmission | undefined = session.staffSelection
-        ? { selection: session.staffSelection, nowSeconds: Math.floor(Date.now() / 1000) }
-        : undefined;
-      if (viewerCanAccess(session.tenants, pathStore, staff)) return pathStore;
-    }
-    // Generic host, or a store the viewer doesn't belong to: their own first store.
-    return (session.tenants?.[0]?.resource ?? session.resource ?? "").toLowerCase();
-  }
-
-  // Anonymous: the path store is just branding (no privileged mint happens), else the
-  // caller-supplied preview hint. Never overrides a signed-in developer (handled above).
-  if (pathStore) return pathStore;
-  return (context.url?.searchParams.get("tenant") ?? "").toLowerCase();
-}