@tokenoftrust/storefront-runner 2.0.2 → 2.0.3

package/apps/storefront/src/pages/api/dashboard/vendor-search.ts

@@ -1,120 +0,0 @@
-/**
- * GET|POST /api/dashboard/vendor-search?q=<prefix> — the ToT-STAFF vendor search
- * proxy (#8425 staff access). Phase 1 of two-phase staff admission: a staff viewer
- * finds a vendor by prefix; there is no silent access to every host.
- *
- * AUTHORIZATION — two independent axes:
- *   NEAR (this endpoint): a valid `tot_session` that carries ToT-STAFF scope
- *     (`staff[]` non-empty). No session → 401; a session without staff scope →
- *     403 (a plain member has nothing to search across — they use their picker).
- *   FAR (tot20): storefront calls `/clients/vendorSearch` as its OWN operator
- *     identity, presenting a storefront-signed staff broker assertion in the
- *     `X-ToT-Broker-Assertion` header (minted from the verified session email);
- *     tot20 verifies it, derives the staff actor from its `sub`, and scopes results
- *     to that user's staffRoles. No spoofable plaintext email crosses the wire.
- *
- * GET reads `q` (+ optional `limit`) from the query; POST reads them from a JSON
- * body — the autocomplete client uses GET, but POST is accepted so a no-JS/form
- * path works too. Returns `{ vendors: [{ appDomain, displayName }] }`.
- */
-import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { isStaffSession } from "@/lib/dashboard/staffAdmission";
-import {
-  createStaffVendorAccessClient,
-  staffAccessHttpStatus,
-  StaffVendorAccessClientError,
-} from "@/lib/dashboard/staffVendorAccess";
-import { mintBrokerAssertion, BrokerAssertionError } from "@/lib/auth/brokerAssertion";
-import {
-  parseVendorQuery,
-  ANCHORED_FETCH_LIMIT,
-  ANCHORED_DISPLAY_LIMIT,
-} from "@/lib/dashboard/vendorQuery";
-
-export const prerender = false;
-
-/** JSON response with no-store (staff access state must never be edge-cached). */
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json", "cache-control": "no-store" },
-  });
-}
-
-async function handle(context: APIContext, q: string, limit: number | undefined): Promise<Response> {
-  const session = await readViewerSession(context);
-  if (!session) return json({ error: "not signed in" }, 401);
-  if (!isStaffSession(session)) {
-    return json({ error: "staff access required", reason: "notStaff" }, 403);
-  }
-
-  let client;
-  try {
-    client = await createStaffVendorAccessClient();
-  } catch (err) {
-    if (err instanceof StaffVendorAccessClientError) {
-      return json({ error: "staff-access integration not configured" }, 503);
-    }
-    throw err;
-  }
-
-  // #8453 `staff-invite-proof-via-broker`: prove the staff actor with a fresh
-  // storefront-signed assertion minted from the VERIFIED session email — tot20
-  // derives the actor + scopes results from it. Fail closed (503) if unconfigured.
-  let brokerAssertion: string;
-  try {
-    brokerAssertion = await mintBrokerAssertion(session.email);
-  } catch (err) {
-    if (err instanceof BrokerAssertionError) {
-      return json({ error: "staff-proof signing not configured" }, 503);
-    }
-    throw err;
-  }
-
-  // Anchor syntax (^prefix / suffix$ / ^exact$) narrows tot20's substring search.
-  // Send the anchor-stripped CORE term upstream (with a widened cap so the exact hit
-  // is in the set), then post-filter by the anchor against appDomain. A plain query
-  // is unchanged: sent as-is, no post-filter. See @/lib/dashboard/vendorQuery.
-  const parsed = parseVendorQuery(q);
-  const upstreamQuery = parsed.anchored ? parsed.core : q;
-  const upstreamLimit = parsed.anchored ? ANCHORED_FETCH_LIMIT : limit;
-
-  const result = await client.searchVendors(brokerAssertion, upstreamQuery, upstreamLimit);
-  if (!result.ok) {
-    return json(
-      { error: result.message, reason: result.reason, code: result.code },
-      staffAccessHttpStatus(result.reason, result.status),
-    );
-  }
-  const vendors = parsed.anchored
-    ? result.vendors
-        .filter((v) => parsed.matches(v.appDomain))
-        .slice(0, limit && limit > 0 ? limit : ANCHORED_DISPLAY_LIMIT)
-    : result.vendors;
-  return json({ vendors });
-}
-
-function parseLimit(raw: string | null | undefined): number | undefined {
-  if (raw == null || raw === "") return undefined;
-  const n = Number(raw);
-  return Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
-}
-
-export async function GET(context: APIContext): Promise<Response> {
-  const url = new URL(context.request.url);
-  const q = (url.searchParams.get("q") ?? "").trim();
-  return handle(context, q, parseLimit(url.searchParams.get("limit")));
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  let body: { q?: unknown; limit?: unknown };
-  try {
-    body = (await context.request.json()) as typeof body;
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-  const q = typeof body.q === "string" ? body.q.trim() : "";
-  const limit = typeof body.limit === "number" ? body.limit : undefined;
-  return handle(context, q, limit);
-}

package/apps/storefront/src/pages/api/integrations/v1/[operation].ts

@@ -1,108 +0,0 @@
-/** Published managed analytics v1 RPC transport: basePath + client method name. */
-import type { APIContext } from "astro";
-import { resolveOperatorSession } from "@/lib/apps/adminSession.js";
-import { getManagedAnalyticsService, json, requireManageRole } from "@/lib/apps/adminService.js";
-import {
-  validateCreateIntegrationInstallRequest, validateCreateMigrationDraftRequest,
-  validateDeleteIntegrationInstallRequest, validateDeleteMigrationDraftRequest,
-  validateGetAdapterDefinitionRequest, validateGetIntegrationInstallRequest,
-  validateGetIntegrationRevisionRequest, validateGetMigrationDraftRequest,
-  validateListAdapterDefinitionsRequest, validateListIntegrationInstallsRequest,
-  validateListIntegrationRevisionsRequest, validateReviseIntegrationInstallRequest,
-  validateSetIntegrationInstallStatusRequest, validateUpdateMigrationDraftRequest,
-  type CreateIntegrationInstallRequest, type CreateMigrationDraftRequest,
-  type DeleteIntegrationInstallRequest, type DeleteMigrationDraftRequest,
-  type GetAdapterDefinitionRequest, type GetIntegrationInstallRequest,
-  type GetIntegrationRevisionRequest, type GetMigrationDraftRequest,
-  type ListAdapterDefinitionsRequest, type ListIntegrationInstallsRequest,
-  type ListIntegrationRevisionsRequest, type ReviseIntegrationInstallRequest,
-  type SetIntegrationInstallStatusRequest, type UpdateMigrationDraftRequest,
-} from "@tot/public-runtime";
-import { MANAGED_ANALYTICS_READ_OPERATIONS, managedAnalyticsOpaqueId, sanitizeManagedAnalyticsOutbound, type ManagedAnalyticsOperation } from "@/lib/apps/managedAnalyticsService.js";
-
-export const prerender = false;
-type Validator = (input: unknown) => { ok: true; value: unknown } | { ok: false; violations: Array<{ path: string; code: string; message: string }> };
-
-// Null-prototype + own-property lookup: `constructor`/prototype names can never
-// enter dispatch, even if a runtime supplies them as a dynamic path segment.
-const VALIDATORS: Readonly<Record<string, Validator>> = Object.assign(Object.create(null) as Record<string, Validator>, {
-  listAdapterDefinitions: validateListAdapterDefinitionsRequest,
-  getAdapterDefinition: validateGetAdapterDefinitionRequest,
-  listIntegrationInstalls: validateListIntegrationInstallsRequest,
-  getIntegrationInstall: validateGetIntegrationInstallRequest,
-  listIntegrationRevisions: validateListIntegrationRevisionsRequest,
-  getIntegrationRevision: validateGetIntegrationRevisionRequest,
-  getMigrationDraft: validateGetMigrationDraftRequest,
-  createMigrationDraft: validateCreateMigrationDraftRequest,
-  updateMigrationDraft: validateUpdateMigrationDraftRequest,
-  deleteMigrationDraft: validateDeleteMigrationDraftRequest,
-  createIntegrationInstall: validateCreateIntegrationInstallRequest,
-  reviseIntegrationInstall: validateReviseIntegrationInstallRequest,
-  setIntegrationInstallStatus: validateSetIntegrationInstallStatusRequest,
-  deleteIntegrationInstall: validateDeleteIntegrationInstallRequest,
-});
-
-const STATUS: Record<string, number> = {
-  invalid_request: 400, unauthorized: 401, forbidden: 403, not_found: 404,
-  validation_failed: 422, unsupported_version: 400, stale_revision: 409,
-  idempotency_conflict: 409, adapter_deprecated: 409, conflict: 409,
-  internal_error: 500,
-};
-function response(body: unknown): Response {
-  const code = body && typeof body === "object" && "error" in body
-    ? (body as { error?: { code?: string } }).error?.code : undefined;
-  return json(body, code ? STATUS[code] ?? 500 : 200);
-}
-function routeError(code: string, message: string, details?: Array<{ path: string; code: string; message: string }>): Response {
-  return response({ apiVersion: "v1", requestId: managedAnalyticsOpaqueId("req"), error: { code, message, ...(details?.length ? { details } : {}) } });
-}
-function operationResponse(operation: ManagedAnalyticsOperation, body: unknown): Response {
-  const safe = sanitizeManagedAnalyticsOutbound(operation, body);
-  return safe === null ? routeError("internal_error", "The integration service could not complete the request.") : response(safe);
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  try {
-    const operation = context.params.operation;
-    if (!operation || !Object.prototype.hasOwnProperty.call(VALIDATORS, operation)) {
-      return routeError("invalid_request", "Unknown managed analytics v1 operation.");
-    }
-    const op = operation as ManagedAnalyticsOperation;
-    const url = new URL(context.request.url);
-    const auth = await resolveOperatorSession(context, url.searchParams.get("tenant"));
-    if (!auth.ok) return routeError(auth.status === 401 ? "unauthorized" : "forbidden", "The request is not authorized.");
-    if (!MANAGED_ANALYTICS_READ_OPERATIONS.has(op) && requireManageRole(auth)) {
-      return routeError("forbidden", "The request is not authorized.");
-    }
-    let raw: unknown;
-    try { raw = await context.request.json(); }
-    catch { return routeError("invalid_request", "The request body must be valid JSON."); }
-    const parsed = VALIDATORS[operation]!(raw);
-    if (!parsed.ok) {
-      const unsupportedVersion = parsed.violations.some(({ path, code }) => path === "apiVersion" && code === "unsupported_value");
-      return routeError(unsupportedVersion ? "unsupported_version" : "invalid_request", unsupportedVersion ? "The API version is not supported." : "The request failed validation.", parsed.violations);
-    }
-    const service = await getManagedAnalyticsService();
-    if (service instanceof Response) return routeError("internal_error", "The integration service is unavailable.");
-    const ctx = { tenantId: auth.tenantId, actor: auth.actor };
-    const request = parsed.value;
-    switch (op) {
-      case "listAdapterDefinitions": return operationResponse(op, service.listAdapterDefinitions(request as ListAdapterDefinitionsRequest));
-      case "getAdapterDefinition": return operationResponse(op, service.getAdapterDefinition((request as GetAdapterDefinitionRequest).query.adapterId));
-      case "listIntegrationInstalls": return operationResponse(op, await service.listIntegrationInstalls(ctx, request as ListIntegrationInstallsRequest));
-      case "getIntegrationInstall": return operationResponse(op, await service.getIntegrationInstall(ctx, (request as GetIntegrationInstallRequest).query.installId));
-      case "listIntegrationRevisions": { const value = request as ListIntegrationRevisionsRequest; return operationResponse(op, await service.listIntegrationRevisions(ctx, value.query.installId, value.query)); }
-      case "getIntegrationRevision": { const value = request as GetIntegrationRevisionRequest; return operationResponse(op, await service.getIntegrationRevision(ctx, value.query.installId, value.query.revisionId)); }
-      case "getMigrationDraft": return operationResponse(op, await service.getMigrationDraft(ctx, (request as GetMigrationDraftRequest).query.draftId));
-      case "createMigrationDraft": return operationResponse(op, await service.createMigrationDraft(ctx, request as CreateMigrationDraftRequest));
-      case "updateMigrationDraft": return operationResponse(op, await service.updateMigrationDraft(ctx, request as UpdateMigrationDraftRequest));
-      case "deleteMigrationDraft": return operationResponse(op, await service.deleteMigrationDraft(ctx, request as DeleteMigrationDraftRequest));
-      case "createIntegrationInstall": return operationResponse(op, await service.createIntegrationInstall(ctx, request as CreateIntegrationInstallRequest));
-      case "reviseIntegrationInstall": return operationResponse(op, await service.reviseIntegrationInstall(ctx, request as ReviseIntegrationInstallRequest));
-      case "setIntegrationInstallStatus": return operationResponse(op, await service.setIntegrationInstallStatus(ctx, request as SetIntegrationInstallStatusRequest));
-      case "deleteIntegrationInstall": return operationResponse(op, await service.deleteIntegrationInstall(ctx, request as DeleteIntegrationInstallRequest));
-    }
-  } catch {
-    return routeError("internal_error", "The integration service could not complete the request.");
-  }
-}

package/apps/storefront/src/pages/api/publish/stage-bundle.ts

@@ -1,70 +0,0 @@
-/**
- * PUT/HEAD /api/publish/stage-bundle?key=versions/<digest>/<rel> — the
- * authenticated Worker staging surface that writes bundle objects into the
- * `STATIC_BUNDLES` R2 binding, so CI stages digests WITHOUT a static R2
- * S3-compatible key pair. Auth (a CI `private_key_jwt` assertion, RFC 7523/8707,
- * one-time `jti`) + the write logic live in `@/lib/publish/stageBundleUpload`;
- * this route only resolves the runtime bindings/config.
- *
- * Fails CLOSED (503 "not configured") until a human wires the CI client's public
- * JWKS (`STATIC_BUNDLE_UPLOAD_JWKS`) + the endpoint's own audience
- * (`STATIC_BUNDLE_UPLOAD_AUDIENCE`) — the same "needs provisioning" gate the R2
- * buckets themselves sit behind. It is EXEMPT from the demo login gate
- * (loginGate.ts `isStaticBundleUploadPath`): it carries its own, stricter auth,
- * so it must answer server-to-server rather than being masked by a "Coming soon"
- * holding page.
- */
-import type { APIContext } from "astro";
-import { readEnv, readKv, readR2 } from "@/lib/env";
-import {
-  handleStageBundleUpload,
-  kvJtiReplayStore,
-  DEFAULT_STAGE_BUNDLE_UPLOAD_ISSUER,
-  type StageBundleUploadBucket,
-  type StageBundleUploadConfig,
-  type JtiKvLike,
-} from "@/lib/publish/stageBundleUpload";
-
-export const prerender = false;
-
-async function handle(context: APIContext): Promise<Response> {
-  const bucket = (await readR2("STATIC_BUNDLES")) as StageBundleUploadBucket | undefined;
-  if (!bucket) {
-    return new Response(JSON.stringify({ error: "no_bundle_store" }), {
-      status: 503,
-      headers: { "content-type": "application/json" },
-    });
-  }
-
-  const jwksRaw = await readEnv("STATIC_BUNDLE_UPLOAD_JWKS");
-  const audience = await readEnv("STATIC_BUNDLE_UPLOAD_AUDIENCE");
-  if (!jwksRaw || !audience) {
-    return new Response(JSON.stringify({ error: "upload_not_configured" }), {
-      status: 503,
-      headers: { "content-type": "application/json" },
-    });
-  }
-  let jwks: StageBundleUploadConfig["jwks"];
-  try {
-    jwks = JSON.parse(jwksRaw) as StageBundleUploadConfig["jwks"];
-  } catch {
-    return new Response(JSON.stringify({ error: "upload_not_configured" }), {
-      status: 503,
-      headers: { "content-type": "application/json" },
-    });
-  }
-  const issuer =
-    (await readEnv("STATIC_BUNDLE_UPLOAD_ISSUER")) ?? DEFAULT_STAGE_BUNDLE_UPLOAD_ISSUER;
-
-  const kv = (await readKv("TENANT_CACHE")) as JtiKvLike | undefined;
-
-  return handleStageBundleUpload({
-    request: context.request,
-    bucket,
-    config: { jwks, issuer, audience },
-    ...(kv ? { jtiStore: kvJtiReplayStore(kv) } : {}),
-  });
-}
-
-export const PUT = handle;
-export const HEAD = handle;

package/apps/storefront/src/pages/api/test/dev-session.ts

@@ -1,133 +0,0 @@
-/**
- * POST /api/test/dev-session — E2E-ONLY hands-off sign-in for automated tests.
- *
- * WHY THIS EXISTS
- * ---------------
- * The hosted /cockpit `hostedActivity` flow can only be driven by a signed-in,
- * store-LINKED developer session, and the real sign-in paths (`/api/auth/verify`
- * OTP code, `/auth/magic` token) deliver their secret ONLY by email — so an
- * automated regression test can never bootstrap itself without a human relaying a
- * code/link out of an inbox. This endpoint mints that session directly for a test
- * developer + tenant so `e2e/cockpit-signal-rail.spec.ts` can run unattended.
- *
- * IT DOES NOT WEAKEN THE REAL AUTH FLOW. It is a SEPARATE, secret-gated door used
- * only as a test PRECONDITION — auth-flow fidelity (does invite→email→magic→session
- * actually work?) is a different concern and must still be tested against the real
- * path with a real/test inbox. See e2e/README.md §"Why a mint endpoint, not a flag".
- *
- * SAFETY — fail CLOSED, three independent gates (a env-detection bug alone can't open it):
- *   1. `E2E_TEST_SECRET` must be provisioned. Unset → 404 (route behaves as if it
- *      does not exist). PROVISION IT ONLY IN THE TEST/PREVIEW TIER, NEVER PROD.
- *   2. `NODE_ENV === "production"` → 404 regardless of anything else (defense in depth;
- *      preview/qa run NODE_ENV=test, so this permits them and blocks prod).
- *   3. The `x-e2e-secret` header must match `E2E_TEST_SECRET` (constant-time compare).
- * Blast radius is further bounded: the tenant must resolve via resolvePreviewTenant
- * (a known store), and the minted session/token are the ordinary revocable KV
- * artifacts (deleting the KV entry revokes them) — nothing new or long-lived.
- *
- * This mirrors the existing shared-secret seam the storefront already uses for
- * cli-signin-code (lib/dev/cliSignInCode.ts → MCP `MCP_SERVICE_SHARED_SECRET`): a
- * capability-gated internal door, not an ambient env-mode branch.
- */
-import type { APIContext } from "astro";
-import { getSessionStore, setSessionCookie } from "@/lib/auth/route";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
-import { readEnv, readKv } from "@/lib/env";
-import { mintActivityIngestToken } from "@/lib/dev/activityIngestToken";
-import { resolvePreviewTenant } from "@/config/previewTenantLookup";
-
-export const prerender = false;
-
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json", "cache-control": "no-store" },
-  });
-}
-
-/** Length-independent constant-time string compare (avoids leaking the secret by timing). */
-function timingSafeEqual(a: string, b: string): boolean {
-  // XOR the SHA-equalised inputs isn't necessary here; compare fixed-work over the
-  // longer length so mismatched lengths still take constant time relative to input.
-  const len = Math.max(a.length, b.length);
-  let diff = a.length ^ b.length;
-  for (let i = 0; i < len; i++) {
-    diff |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
-  }
-  return diff === 0;
-}
-
-export async function POST(context: APIContext): Promise<Response> {
-  // GATE 1 — secret must be provisioned; absent ⇒ pretend the route doesn't exist.
-  const secret = await readEnv("E2E_TEST_SECRET");
-  if (!secret) return json({ error: "not found" }, 404);
-
-  // GATE 2 — never in the production tier, even if a secret leaked into it.
-  const nodeEnv = ((await readEnv("NODE_ENV")) ?? "").toLowerCase();
-  if (nodeEnv === "production") return json({ error: "not found" }, 404);
-
-  // GATE 3 — present the secret.
-  const presented = context.request.headers.get("x-e2e-secret") ?? "";
-  if (!timingSafeEqual(presented, secret)) return json({ error: "forbidden" }, 403);
-
-  let body: { email?: unknown; tenant?: unknown };
-  try {
-    body = (await context.request.json()) as typeof body;
-  } catch {
-    return json({ error: "invalid JSON body" }, 400);
-  }
-  const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-  const tenantId = typeof body.tenant === "string" ? body.tenant.trim().toLowerCase() : "";
-  if (!email || !tenantId) return json({ error: "email and tenant are required" }, 400);
-
-  // Bound to a KNOWN store — never mints against an arbitrary/unknown tenant.
-  const tenant = await resolvePreviewTenant(tenantId);
-  if (!tenant) return json({ error: "unknown tenant" }, 404);
-
-  const store = await getSessionStore();
-  if (!store) return json({ error: "session store unavailable" }, 503);
-
-  // Mint a store-LINKED developer session (tenants[0].resource is what the
-  // /api/dev/activity poll resolves — see api/dev/activity.ts GET).
-  const now = Math.floor(Date.now() / 1000);
-  const resource = tenant.appDomain;
-  const { id } = await createSession(
-    store,
-    {
-      email,
-      resource,
-      roles: ["developer"],
-      capability: "developer",
-      tenants: [{ resource, role: "developer" }],
-      staff: [],
-    },
-    DEFAULT_SESSION_TTL_SECONDS,
-    now,
-  );
-  setSessionCookie(context, id, DEFAULT_SESSION_TTL_SECONDS);
-
-  // Also hand back an activity-ingest token so the test can POST heartbeat / save /
-  // obstacle events the way the local `tot dev` loop would (bearer-authed, not cookie).
-  const kv = await readKv("SESSION");
-  let activityToken: string | null = null;
-  let activityExpiresAt: string | null = null;
-  if (kv) {
-    const minted = await mintActivityIngestToken(kv, {
-      email,
-      tenant: tenant.tenant_id,
-      capability: "developer",
-    });
-    activityToken = minted.token;
-    activityExpiresAt = minted.expiresAt;
-  }
-
-  return json({
-    ok: true,
-    email,
-    tenant: tenant.tenant_id,
-    resource,
-    activityToken,
-    activityExpiresAt,
-    activityUrl: new URL(context.request.url).origin,
-  });
-}