@tokenoftrust/storefront-runner 2.0.2 → 2.0.3

package/apps/storefront/src/lib/publish/stageBundleUpload.ts

@@ -1,215 +0,0 @@
-/**
- * Authenticated static-bundle STAGING upload — the Worker-side write surface that
- * lets CI stage a materialized bundle's objects into the `STATIC_BUNDLES` R2
- * binding WITHOUT a static R2 S3-compatible key pair (`R2_ACCESS_KEY_ID`/
- * `R2_SECRET_ACCESS_KEY`). CI proves identity with the SAME OIDC→AWS→SSM→
- * `private_key_jwt` chain it already uses to authenticate to MCP
- * (`scripts/publish/ci-mcp-read-remote.mjs`): it mints a short-lived RS256
- * `client_assertion` under its dedicated confidential client
- * (`storefront-ci.tokenoftrust.com` / kid `storefront-ci-publish-1`, the key held
- * only in SSM), audience-bound to THIS upload endpoint, and the Worker verifies
- * the signature against that client's PUBLISHED public JWKS.
- *
- * This is a WRITE path to a production-serving bucket, so the auth boundary is
- * deliberately as strong as the MCP leg:
- *   - RS256 signature over the CI client's JWKS (no shared static secret).
- *   - `iss == sub == <expected CI client id>` (RFC 7523 §3).
- *   - `aud == <this exact upload endpoint>` (RFC 8707 resource binding) — an
- *     assertion minted for MCP's token endpoint can never be replayed here, and
- *     vice versa.
- *   - `exp`/`iat` freshness (jose enforces `exp`; assertions live ~60s).
- *   - `jti` one-time-use replay rejection (KV-backed), mirroring MCP's replay
- *     store — so a captured assertion can't be replayed inside its TTL window.
- *   - Object key confined to `versions/<digest>/…`: a valid CI credential can
- *     only write immutable version archives, never the `live/` pointer or any
- *     other bucket key.
- *
- * The KEY SCHEME (`versions/<digest>/<rel>`) MUST byte-match the read side
- * (`@tot/public-runtime` `staticBundleObjectKey`/`staticBundleManifestKey`) and
- * the CI writer (`scripts/publish/lib/r2-publish.mjs` `r2ObjectKey`) — the same
- * lockstep those two already keep. MANIFEST-LAST ordering (the manifest is the
- * "fully staged" signal) is the CALLER's responsibility (CI writes it last, the
- * same as `writeBundleToR2`); this surface writes exactly the one object it is
- * handed per request.
- */
-import { createLocalJWKSet, jwtVerify, type JSONWebKeySet, type JWTPayload } from "jose";
-
-/** The only signature algorithm accepted (matches the CI minter). */
-export const STAGE_BUNDLE_UPLOAD_ALG = "RS256";
-
-/** The route this surface is mounted at — the canonical `aud`/resource identifier. */
-export const STAGE_BUNDLE_UPLOAD_PATH = "/api/publish/stage-bundle";
-
-/** Default CI confidential-client id (`iss == sub`), overridable per env. */
-export const DEFAULT_STAGE_BUNDLE_UPLOAD_ISSUER = "storefront-ci.tokenoftrust.com";
-
-/** How long a used `jti` is remembered — the assertion TTL (~60s) plus clock skew. */
-export const STAGE_BUNDLE_JTI_TTL_SECONDS = 120;
-
-/** Clock skew tolerated on `exp`/`iat`, in seconds. */
-const CLOCK_TOLERANCE_SECONDS = 5;
-
-/**
- * The `versions/<digest>/<rel>` keys a CI credential is allowed to write. The
- * digest is a lowercase hex tree digest; `rel` is a bundle-relative POSIX path
- * with no traversal. Anything else (a bare key, `live/…`, an absolute path, a
- * `..` segment) is refused with 400 — the write authority is bounded to
- * immutable version archives regardless of a valid signature.
- */
-const VERSION_KEY_RE = /^versions\/[a-f0-9]{8,}\/.+$/;
-
-/** Minimal R2 surface this module needs — structural, so tests pass a fake. */
-export interface StageBundleUploadBucket {
-  head(key: string): Promise<{ key: string } | null>;
-  put(
-    key: string,
-    value: ArrayBuffer | ArrayBufferView,
-    options?: { httpMetadata?: { contentType?: string } },
-  ): Promise<unknown>;
-}
-
-/**
- * One-time-use `jti` store. `checkAndRemember` returns `true` when the `jti` was
- * unseen (and records it), `false` when it was already used (a replay). Backed by
- * KV in the deployed Worker; omitted in dev/tests where no KV is bound (replay
- * protection then relies on the ~60s `aud`-bound `exp` window alone).
- */
-export interface JtiReplayStore {
-  checkAndRemember(jti: string, ttlSeconds: number): Promise<boolean>;
-}
-
-export interface StageBundleUploadConfig {
-  /** The CI client's published PUBLIC JWKS (verifies the assertion signature). */
-  jwks: JSONWebKeySet;
-  /** Expected `iss == sub` (the CI confidential-client id). */
-  issuer: string;
-  /** Expected `aud` — this exact upload endpoint URL (RFC 8707 resource). */
-  audience: string;
-}
-
-/** A KV-namespace-shaped store (`get`/`put`) — the deployed jti replay backing. */
-export interface JtiKvLike {
-  get(key: string): Promise<string | null>;
-  put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>;
-}
-
-/** Build a KV-backed {@link JtiReplayStore}. Keyed under a dedicated prefix. */
-export function kvJtiReplayStore(kv: JtiKvLike): JtiReplayStore {
-  return {
-    async checkAndRemember(jti, ttlSeconds) {
-      const key = `stage-bundle-jti:${jti}`;
-      if (await kv.get(key)) return false;
-      // KV's minimum expirationTtl is 60s; the TTL default already exceeds it.
-      await kv.put(key, "1", { expirationTtl: Math.max(60, ttlSeconds) });
-      return true;
-    },
-  };
-}
-
-function json(status: number, body: Record<string, unknown>): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-}
-
-/** Extract the bearer assertion from the Authorization header, or null. */
-function bearer(request: Request): string | null {
-  const h = request.headers.get("authorization");
-  if (!h) return null;
-  const m = /^Bearer (.+)$/.exec(h.trim());
-  return m ? m[1]!.trim() : null;
-}
-
-/**
- * Verify the CI `client_assertion`: RS256 signature over the configured JWKS,
- * `iss`/`sub`/`aud` exact match, `exp` freshness, and one-time `jti`. Returns the
- * verified payload, or a `Response` (401) to return verbatim on any failure — no
- * failure detail beyond a stable machine reason is leaked.
- */
-export async function verifyUploadAssertion(
-  token: string,
-  config: StageBundleUploadConfig,
-  jtiStore?: JtiReplayStore,
-): Promise<{ payload: JWTPayload } | { reject: Response }> {
-  let payload: JWTPayload;
-  try {
-    const keys = createLocalJWKSet(config.jwks);
-    ({ payload } = await jwtVerify(token, keys, {
-      algorithms: [STAGE_BUNDLE_UPLOAD_ALG],
-      issuer: config.issuer,
-      audience: config.audience,
-      clockTolerance: CLOCK_TOLERANCE_SECONDS,
-    }));
-  } catch {
-    // Signature, iss/aud mismatch, or expiry — one opaque 401 (never which).
-    return { reject: json(401, { error: "invalid_assertion" }) };
-  }
-  // RFC 7523 §3: sub must equal the client id (iss). jose verifies iss but not
-  // that sub matches it, so assert it explicitly.
-  if (payload.sub !== config.issuer) {
-    return { reject: json(401, { error: "invalid_assertion" }) };
-  }
-  const jti = typeof payload.jti === "string" ? payload.jti : "";
-  if (!jti) {
-    return { reject: json(401, { error: "invalid_assertion" }) };
-  }
-  if (jtiStore) {
-    const fresh = await jtiStore.checkAndRemember(jti, STAGE_BUNDLE_JTI_TTL_SECONDS);
-    if (!fresh) return { reject: json(401, { error: "assertion_replayed" }) };
-  }
-  return { payload };
-}
-
-/** True iff `key` is a well-formed, traversal-free `versions/<digest>/<rel>` key. */
-export function isSafeVersionKey(key: string): boolean {
-  if (!VERSION_KEY_RE.test(key)) return false;
-  return !key.split("/").some((seg) => seg === ".." || seg === "." || seg === "");
-}
-
-/**
- * Handle one authenticated staging request against `bucket`:
- *   - `PUT  ?key=versions/<digest>/<rel>` — write the request body as that object.
- *   - `HEAD ?key=versions/<digest>/<rel>` — 200 if present, 404 if not (the CI
- *     idempotency probe, mirroring `r2ObjectExists`).
- * Both require a valid CI assertion; the key is confined to `versions/<digest>/`.
- */
-export async function handleStageBundleUpload(opts: {
-  request: Request;
-  bucket: StageBundleUploadBucket;
-  config: StageBundleUploadConfig;
-  jtiStore?: JtiReplayStore;
-}): Promise<Response> {
-  const { request, bucket, config, jtiStore } = opts;
-  const method = request.method.toUpperCase();
-  if (method !== "PUT" && method !== "HEAD") {
-    return json(405, { error: "method_not_allowed" });
-  }
-
-  const token = bearer(request);
-  if (!token) return json(401, { error: "missing_bearer" });
-
-  // HEAD is a read/probe and must NOT consume the one-time jti (a PUT retry after
-  // a probe would then falsely 401 as a replay). Only PUT records the jti.
-  const verified = await verifyUploadAssertion(
-    token,
-    config,
-    method === "PUT" ? jtiStore : undefined,
-  );
-  if ("reject" in verified) return verified.reject;
-
-  const key = new URL(request.url).searchParams.get("key") ?? "";
-  if (!isSafeVersionKey(key)) {
-    return json(400, { error: "invalid_key" });
-  }
-
-  if (method === "HEAD") {
-    const obj = await bucket.head(key);
-    return new Response(null, { status: obj ? 200 : 404 });
-  }
-
-  const body = await request.arrayBuffer();
-  const contentType = request.headers.get("content-type") ?? undefined;
-  await bucket.put(key, body, contentType ? { httpMetadata: { contentType } } : undefined);
-  return json(200, { key, staged: true });
-}

package/apps/storefront/src/lib/publish/streamLogConsole.ts

@@ -1,142 +0,0 @@
-/**
- * Pure formatting for the admin Publish tab's shared SCROLLING LIVE-LOG console —
- * the "CI build log" panel reused across ALL FOUR long-running flows (build /
- * integrate / rebuild / ship). Where `buildStream.ts` owns the build-flight
- * stage-RAIL (checkmarks), this owns the LOG: one human-readable, timestamped line
- * appended per server-pushed `phase` event, then a terminal ✓/✗ line.
- *
- * It is transport-agnostic (it consumes already-parsed {@link SseEvent}s from
- * `parseSseChunk`) and flow-agnostic: ONE phase→label map covers every phase any of
- * the four routes emits, so the SAME console renders an integrate merge, a ship
- * promote, or a build read with no per-flow branching. The terminal-line extractor
- * reads the union of the four routes' honest result shapes (build's
- * `ok`/`outcome`/`errors`, the queue's `ok`/`queueState`/`statusMessage`/`reason`,
- * ship's `ok`/`state`/`message`) without any one flow's assumptions leaking in.
- *
- * The DOM wiring that appends these to a scrollable `<div>` and auto-scrolls is
- * verified on a live preview, per this codebase's client-island convention (see
- * `reviewReleaseWorkspace/controller.ts`). Only this pure formatting is unit-tested.
- */
-import type { SseEvent } from "./buildStream.js";
-
-/**
- * The human label for every `phase` a streamed route emits, across all four flows.
- * Deliberately honest-but-neutral wording so the SAME line reads true whether the
- * phase came from a candidate build or an aggregate rebuild.
- */
-export const STREAM_PHASE_LABEL: Record<string, string> = {
-  // Accept-to-preview (integrate) — the queue's merge boundary.
-  merging: "Merging your change into the shared preview…",
-  // Build (candidate) — head resolution.
-  resolving: "Locating the pull request's latest commit…",
-  // Shared reconcile boundaries (build candidate + aggregate integrate/rebuild).
-  reading: "Reading and validating your store's files…",
-  publishing: "Building and publishing this version…",
-  checking: "Re-running the combined evidence checks…",
-  // Publish-live (ship) — the orchestrator's post-gate boundaries.
-  pinning: "Pinning the exact reviewed build…",
-  promoting: "Promoting the reviewed build to your live channel…",
-  verifying: "Verifying your live store serves the new build…",
-  recording: "Recording the release in your ledger…",
-};
-
-/**
- * The label for one phase: a server-supplied `label` wins (a route may send a more
- * specific line, e.g. build's "Locating the latest commit for PR #12…"), else the
- * shared map, else `null` for an unknown phase (the caller ignores it — never
- * fabricates a line for a phase it doesn't understand).
- */
-export function phaseLogLabel(phase: string, serverLabel?: string | null): string | null {
-  if (serverLabel && serverLabel.trim()) return serverLabel.trim();
-  return STREAM_PHASE_LABEL[phase] ?? null;
-}
-
-/** `m:ss` elapsed, matching the dialog's own elapsed-clock format. Clamps negatives to 0. */
-export function formatElapsed(ms: number): string {
-  const s = Math.max(0, Math.floor(ms / 1000));
-  return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")}`;
-}
-
-/**
- * The log line for a `phase` event, or `null` to skip (unknown phase / not a phase
- * event). Shape: `[m:ss] <label>`. Pure — the console appends the returned string.
- */
-export function logLineForPhase(
-  ev: SseEvent,
-  elapsedMs: number,
-): string | null {
-  if (ev.event !== "phase") return null;
-  let parsed: unknown = null;
-  try {
-    parsed = JSON.parse(ev.data);
-  } catch {
-    return null;
-  }
-  const phase = parsed && typeof (parsed as { phase?: unknown }).phase === "string"
-    ? (parsed as { phase: string }).phase
-    : null;
-  if (!phase) return null;
-  const serverLabel =
-    parsed && typeof (parsed as { label?: unknown }).label === "string"
-      ? (parsed as { label: string }).label
-      : null;
-  const label = phaseLogLabel(phase, serverLabel);
-  if (!label) return null;
-  return `[${formatElapsed(elapsedMs)}] ${label}`;
-}
-
-/** A terminal result across the four flows — the union of their honest shapes. */
-export interface StreamTerminalResult {
-  ok?: boolean;
-  /** build */
-  outcome?: string | null;
-  errors?: string[] | null;
-  error?: string | null;
-  /** integrate/rebuild */
-  queueState?: string | null;
-  statusMessage?: string | null;
-  reason?: string | null;
-  /** ship */
-  state?: string | null;
-  message?: string | null;
-}
-
-/** True iff the terminal result is a clean success, reading each flow's own success signal. */
-export function isStreamResultOk(result: StreamTerminalResult): boolean {
-  if (result.state !== undefined && result.state !== null) return result.state === "shipped";
-  if (result.ok === true) return true;
-  return result.outcome === "ok";
-}
-
-/** A SHORT one-line reason for a non-ok terminal (the full detail lives in the outcome phase). */
-function streamResultReason(result: StreamTerminalResult): string {
-  const first = (v: string[] | null | undefined) => (v && v.length ? v[0] : "");
-  const candidate =
-    result.statusMessage ||
-    result.message ||
-    first(result.errors) ||
-    result.error ||
-    (result.outcome === "blocked" ? "a check blocked this build" : "") ||
-    result.reason ||
-    result.queueState ||
-    result.state ||
-    "it did not complete";
-  const line = String(candidate).replace(/\s+/g, " ").trim();
-  return line.length > 160 ? line.slice(0, 157) + "…" : line;
-}
-
-/**
- * The terminal log line for a `result` event: `{ ok, line }`. `line` is
- * `[m:ss] ✓ Done.` on success, `[m:ss] ✗ Stopped — <short reason>` otherwise. Pure.
- */
-export function terminalLogLine(
-  result: StreamTerminalResult,
-  elapsedMs: number,
-): { ok: boolean; line: string } {
-  const ok = isStreamResultOk(result);
-  const stamp = `[${formatElapsed(elapsedMs)}]`;
-  return {
-    ok,
-    line: ok ? `${stamp} ✓ Done.` : `${stamp} ✗ Stopped — ${streamResultReason(result)}`,
-  };
-}

package/apps/storefront/src/lib/publish/versionNumber.ts

@@ -1,52 +0,0 @@
-/**
- * The merchant-facing version counter — a monotonic, human "v1, v2, …" label for
- * the tenant's published versions, DERIVED from the live-promotion history so it is
- * never fabricated and never the raw SHA (which is meaningless to a merchant).
- *
- * A version's number is its rank by FIRST promotion to `live`: the earliest-ever
- * promoted sha is v1, the next distinct sha is v2, and so on. This has the two
- * properties merchants expect:
- *   - monotonic increasing — a newer publish always gets a higher number; and
- *   - stable for a given sha — a rollback re-points `live` at a prior version (per
- *     `PromotionEvent`'s contract a plain rollback is not even recorded, and a
- *     re-promote keeps the sha's ORIGINAL first-promotion rank), so "rolled back to
- *     v3" reads honestly and a subsequent fresh publish becomes v(N+1), never
- *     reusing a retired number.
- *
- * Pure (no I/O) so it unit-tests without a Worker/KV, and shared by both the
- * live-version resolver (the "Live version" metric) and the versions-panel view so
- * the two surfaces always agree on a version's number.
- */
-import type { PromotionEvent } from "@tot/public-runtime";
-
-/**
- * Map each promoted versionId → its 1-based version number, ranked by earliest
- * promotion time. Input order is irrelevant (the rank is computed from the `at`
- * timestamps), so it accepts the newest-first list `listPromotions` returns as-is.
- * A tie on `at` between two distinct shas is broken by versionId for determinism.
- */
-export function assignVersionNumbers(promotions: PromotionEvent[]): Map<string, number> {
-  const earliest = new Map<string, string>();
-  for (const p of promotions) {
-    const seen = earliest.get(p.versionId);
-    if (seen == null || p.at < seen) earliest.set(p.versionId, p.at);
-  }
-  const ordered = [...earliest.entries()].sort((a, b) =>
-    a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0,
-  );
-  const numbers = new Map<string, number>();
-  ordered.forEach(([versionId], i) => numbers.set(versionId, i + 1));
-  return numbers;
-}
-
-/**
- * The version number for one versionId, or `null` when nothing in the promotion
- * history matches (an unpromoted/unknown sha — the label falls back to the raw SHA).
- */
-export function versionNumberFor(
-  promotions: PromotionEvent[],
-  versionId: string | null | undefined,
-): number | null {
-  if (!versionId) return null;
-  return assignVersionNumbers(promotions).get(versionId) ?? null;
-}