@tokenoftrust/storefront-runner 2.0.2 → 2.0.4

package/apps/storefront/src/lib/apps/tenantIntegrationMaterialization.ts

@@ -1,170 +0,0 @@
-/**
- * Control-plane materialization of a tenant's OWN (`tenant-local`) integration
- * declarations for the admin seams (ext-kernel-09).
- *
- * The middleware materializes these same declarations on the render hot path; this
- * module materializes them for the ADMIN plane — the ext-admin-02 read model and the
- * ext-admin-07 lifecycle route — so a declared integration shows its REAL effective
- * state (its resolved plan, compiled CSP, consent needs) instead of a null /
- * `not_materialized` placeholder. Resolution runs through the SAME interim marketing
- * bridge the render path uses, so a regulated tenant is refused identically (no
- * effective plan → the declaration surfaces honestly as unmaterialized) and an
- * eligible unregulated one resolves the exact plan it serves.
- *
- * A tenant-local declaration is a live-by-config integration (on-by-default), not a
- * candidate under review: its effective state is what the read model shows and what
- * the lifecycle route loads. It has no separate promotion gate — publishing an
- * on-by-default declaration would change nothing — so the lifecycle route surfaces
- * its live state and refuses a preview/publish with no candidate rather than
- * fabricating one.
- */
-import { loadTenantIntegrationDeclarations } from "@/lib/integration/tenantDeclarations";
-import {
-  resolveInterimBridgePlan,
-  compileIntegrationCspFromPlan,
-  collectDeclaredCspProfiles,
-  buildCandidateEvidence,
-  defaultConsentSnapshot,
-  ENVIRONMENT_SCHEMA_VERSION,
-  type TenantConfig,
-  type BrowserEnvironment,
-  type IntegrationEnvironment,
-  type IntegrationSiteSurface,
-  type EffectivePlan,
-  type CompiledIntegrationCsp,
-  type ConsentSnapshot,
-  type AssetVerificationResult,
-} from "@tot/public-runtime";
-import type { IntegrationReadModelInputItem } from "@/lib/apps/integrationReadModel.js";
-import {
-  facetsFromEvidence,
-  initialLifecycleState,
-  type TenantIntegrationLifecycleState,
-} from "@/lib/apps/integrationLifecycle.js";
-
-/** Stable, synthetic install id for a tenant-local declaration (no registry install backs it). */
-export function tenantLocalInstallId(appId: string): string {
-  return `tenant-local:${appId}`;
-}
-
-/** A same-origin (public/-committed) entry declares no R2 app assets — a clean zero verify. */
-const NO_R2_APP_ASSETS: AssetVerificationResult = { expected: 0, verified: 0, missing: [] };
-
-/** The admin-plane browser environment for a lifecycle stage — the `admin` surface. */
-function adminEnvironment(tenant: TenantConfig, stage: IntegrationEnvironment): BrowserEnvironment {
-  const surface: IntegrationSiteSurface = "admin";
-  return {
-    schemaVersion: ENVIRONMENT_SCHEMA_VERSION,
-    siteSurface: surface,
-    environment: stage,
-    canonicalHost: tenant.canonicalDomain || tenant.tenant_id,
-    revision: `admin-${stage}`,
-  };
-}
-
-/** The resolved plan + compiled CSP + consent snapshot for a tenant's tenant-local declarations. */
-export interface MaterializedTenantLocalPlan {
-  plan: EffectivePlan;
-  compiledCsp: CompiledIntegrationCsp;
-  consentSnapshot: ConsentSnapshot;
-}
-
-/**
- * Resolve a tenant's tenant-local declarations into the effective plan + compiled CSP
- * for `stage`, through the interim bridge. Null when the tenant declares none, the
- * bridge refuses (regulated), or the plan/CSP fail closed — every "no effective state"
- * case an honest null, never a partial plan.
- */
-export function materializeTenantLocalPlan(
-  tenant: TenantConfig,
-  stage: IntegrationEnvironment,
-): MaterializedTenantLocalPlan | null {
-  const declarations = loadTenantIntegrationDeclarations(tenant);
-  if (declarations.length === 0) return null;
-  const bridge = resolveInterimBridgePlan({
-    tenantPublicId: tenant.tenant_id,
-    tenant,
-    environment: adminEnvironment(tenant, stage),
-    declarations,
-  });
-  if (!bridge.ok) return null;
-  const compiled = compileIntegrationCspFromPlan(
-    bridge.plan,
-    collectDeclaredCspProfiles(declarations),
-  );
-  if (!compiled.ok) return null;
-  return { plan: bridge.plan, compiledCsp: compiled.value, consentSnapshot: defaultConsentSnapshot() };
-}
-
-/**
- * Build the ext-admin-02 read-model input items for a tenant's tenant-local
- * declarations. Each carries the resolved effective plan + compiled CSP so the
- * assembler surfaces REAL effective state; a refused/failed resolution yields a null
- * effective plan, so the declaration surfaces as honestly unmaterialized (never a
- * fabricated live state).
- */
-export function tenantLocalReadModelItems(
-  tenant: TenantConfig,
-  stage: IntegrationEnvironment,
-): IntegrationReadModelInputItem[] {
-  const declarations = loadTenantIntegrationDeclarations(tenant);
-  if (declarations.length === 0) return [];
-  const materialized = materializeTenantLocalPlan(tenant, stage);
-  return declarations.map((decl) => {
-    const { app } = decl.manifest;
-    return {
-      install: {
-        installId: tenantLocalInstallId(app.id),
-        appId: app.id,
-        appVersion: app.version,
-        tenantId: tenant.tenant_id,
-        status: "active",
-      },
-      purpose: app.name,
-      desiredConfig: decl.publicConfig,
-      effectivePlan: materialized?.plan ?? null,
-      effectiveCsp: materialized?.compiledCsp ?? null,
-      consentSnapshot: materialized?.consentSnapshot ?? null,
-    };
-  });
-}
-
-/**
- * Load the real lifecycle state for a tenant-local declared install — a live-by-config
- * integration whose effective plan occupies the resolved stage slot. Null when the
- * install id names no materialized tenant-local declaration for the tenant (so the
- * lifecycle route answers a fail-closed 409, never a fabricated state).
- */
-export function loadTenantLocalLifecycleState(
-  tenant: TenantConfig,
-  installId: string,
-  stage: IntegrationEnvironment,
-): TenantIntegrationLifecycleState | null {
-  const declarations = loadTenantIntegrationDeclarations(tenant);
-  const decl = declarations.find((d) => tenantLocalInstallId(d.manifest.app.id) === installId);
-  if (!decl) return null;
-  const materialized = materializeTenantLocalPlan(tenant, stage);
-  if (!materialized) return null;
-
-  const appId = decl.manifest.app.id;
-  const evidence = buildCandidateEvidence({
-    plan: materialized.plan,
-    compiledCsp: materialized.compiledCsp,
-    assets: NO_R2_APP_ASSETS,
-  });
-  if (!evidence.ok) return null;
-  const facets = facetsFromEvidence(evidence.value, appId);
-
-  const state = initialLifecycleState({
-    tenantPublicId: tenant.tenant_id,
-    installId,
-    appId,
-  });
-  // A tenant-local declaration is live-by-config: its resolved plan IS the serving
-  // (live) facet, and it is its own known-good rollback target.
-  return {
-    ...state,
-    stages: { ...state.stages, live: facets },
-    knownGood: [facets],
-  };
-}

package/apps/storefront/src/lib/apps/tokenIssuer.ts

@@ -1,121 +0,0 @@
-/**
- * OAuth2 client-credentials token issuer — the Storefront App Gateway's
- * `POST /oauth/token` grant. Mints the
- * short-lived RS256 JWT a private app presents as a bearer token to the
- * scoped APIs.
- *
- * `tenant` and `env` are supplied by the CALLER (the route, from
- * host-resolved context — never from the request body) and checked against
- * the install's own `tenantId`/`env`: a credential minted for one
- * tenant/env can't be replayed against another, even if the secret leaked.
- *
- * Fails closed on every rejected path; `TokenError.code` uses the RFC 6749
- * §5.2 / §4.1.2.1 error vocabulary so the route can pass it straight through
- * as the OAuth2 `error` field. `invalid_client` deliberately covers "unknown
- * client_id", "wrong secret", AND "tenant/env mismatch" identically — none of
- * those should be distinguishable to a caller (no enumeration oracle).
- */
-import { SignJWT } from "jose";
-import type { AppRegistryService } from "./registryService.js";
-import {
-  loadGatewaySigningConfig,
-  GatewayKeyError,
-  APP_GATEWAY_ALG,
-  APP_TOKEN_TTL_SECONDS,
-  type GatewayKeyOverrides,
-} from "./gatewayKeys.js";
-
-export type TokenErrorCode = "invalid_client" | "invalid_grant" | "temporarily_unavailable";
-
-export class TokenError extends Error {
-  constructor(
-    message: string,
-    readonly code: TokenErrorCode,
-  ) {
-    super(message);
-    this.name = "TokenError";
-  }
-}
-
-/** The narrow secret-verification seam `AppTokenIssuer` depends on (`D1CredentialStore` satisfies it). */
-export interface SecretVerifier {
-  verifySecret(clientId: string, presentedSecret: string): Promise<string | null>;
-}
-
-export interface IssueTokenRequest {
-  clientId: string;
-  secret: string;
-  /** This request's host-resolved tenant (never client-supplied). */
-  tenant: string;
-  /** This deploy's own env tier (never client-supplied). */
-  env: string;
-}
-
-export interface IssuedToken {
-  accessToken: string;
-  tokenType: "Bearer";
-  expiresIn: number;
-  scope: string;
-}
-
-export class AppTokenIssuer {
-  constructor(
-    private readonly registry: AppRegistryService,
-    private readonly credentials: SecretVerifier,
-    private readonly keyOverrides: GatewayKeyOverrides = {},
-    private readonly now: () => number = () => Math.floor(Date.now() / 1000),
-  ) {}
-
-  async issueToken(req: IssueTokenRequest): Promise<IssuedToken> {
-    const installId = await this.credentials.verifySecret(req.clientId, req.secret);
-    if (!installId) {
-      throw new TokenError("invalid client_id or client_secret", "invalid_client");
-    }
-
-    const install = await this.registry.get(installId);
-    // An install row can't outlive its credential row (uninstall clears both),
-    // but never let a lookup miss here leak any more detail than a bad secret.
-    if (!install || install.tenantId !== req.tenant || install.env !== req.env) {
-      throw new TokenError("invalid client_id or client_secret", "invalid_client");
-    }
-    if (install.status !== "active") {
-      throw new TokenError(`install is ${install.status}; token issuance refused`, "invalid_grant");
-    }
-
-    let signing;
-    try {
-      signing = await loadGatewaySigningConfig(this.keyOverrides);
-    } catch (cause) {
-      if (cause instanceof GatewayKeyError) {
-        throw new TokenError(cause.message, "temporarily_unavailable");
-      }
-      throw cause;
-    }
-
-    const nowSeconds = this.now();
-    const accessToken = await new SignJWT({
-      tenant: install.tenantId,
-      env: install.env,
-      scopes: install.scopes,
-      // Discriminates this bearer token from a widget launch token so the two
-      // can never be replayed for each other even though both
-      // are RS256 JWTs signed by the same gateway key — see tokenVerifier.ts.
-      token_use: "access",
-    })
-      .setProtectedHeader({ alg: APP_GATEWAY_ALG, kid: signing.kid, typ: "JWT" })
-      .setIssuer(signing.issuer)
-      .setSubject(install.installId)
-      .setAudience(install.tenantId)
-      .setJti(crypto.randomUUID())
-      .setIssuedAt(nowSeconds)
-      .setExpirationTime(nowSeconds + APP_TOKEN_TTL_SECONDS)
-      .sign(signing.key);
-
-    return {
-      accessToken,
-      tokenType: "Bearer",
-      expiresIn: APP_TOKEN_TTL_SECONDS,
-      scope: install.scopes.join(" "),
-    };
-  }
-}

package/apps/storefront/src/lib/apps/tokenVerifier.ts

@@ -1,148 +0,0 @@
-/**
- * Offline verification of the Storefront App Gateway's own OAuth2
- * client-credentials JWT — this is what the scoped-API boundary
- * imports to authorize an app's request.
- *
- * Modeled directly on `../auth/identityToken.ts`'s `IdentityAssertionVerifier`
- * (same `jwtVerify` + JWKS-by-`kid` shape, `aud`/`iss` pinning, alg allowlist),
- * but LOCAL only: this Worker signs its own tokens, so there's no remote host
- * to fetch a JWKS from — the public JWKS is derived in-process by
- * `gatewayKeys.ts` from the very key that signs, via `createLocalJWKSet`.
- */
-import {
-  jwtVerify,
-  createLocalJWKSet,
-  decodeProtectedHeader,
-  type JWTVerifyGetKey,
-} from "jose";
-import {
-  loadGatewayJwks,
-  GatewayKeyError,
-  APP_GATEWAY_ALG,
-  DEFAULT_APP_GATEWAY_ISSUER,
-  APP_GATEWAY_ISSUER_ENV,
-  type GatewayKeyOverrides,
-} from "./gatewayKeys.js";
-import { readEnv } from "@/lib/env";
-
-/** The verified app-token claims (the scoped API's authorization input). */
-export interface AppTokenClaims {
-  iss: string;
-  sub: string; // install id
-  aud: string; // tenant
-  tenant: string;
-  env: string;
-  scopes: string[];
-  iat: number;
-  exp: number;
-  jti: string;
-}
-
-/** Normalize a jose JWT payload into typed {@link AppTokenClaims}, throwing on any missing claim. */
-function toAppTokenClaims(payload: Record<string, unknown>): AppTokenClaims {
-  // The security-critical discriminator: a widget launch token
-  // (`token_use: "widget_launch"`) is signed by this SAME gateway key, so
-  // signature/aud/iss/exp checks alone can't tell it apart from a bearer
-  // token. Requiring `token_use === "access"` here is what stops a launch
-  // token — minted for a sandboxed iframe, short-TTL, no scopes checked —
-  // from ever being replayed as an API bearer token.
-  if (payload.token_use !== "access") {
-    throw new Error("app token has the wrong `token_use`; expected an access token");
-  }
-  const tenant = payload.tenant;
-  if (typeof tenant !== "string" || !tenant) {
-    throw new Error("app token missing `tenant` claim");
-  }
-  const env = payload.env;
-  if (typeof env !== "string" || !env) {
-    throw new Error("app token missing `env` claim");
-  }
-  const jti = payload.jti;
-  if (typeof jti !== "string" || !jti) {
-    throw new Error("app token missing `jti` claim");
-  }
-  if (!Array.isArray(payload.scopes)) {
-    throw new Error("app token missing `scopes` claim");
-  }
-  const scopes = payload.scopes.filter((s): s is string => typeof s === "string");
-
-  return {
-    iss: String(payload.iss ?? ""),
-    sub: String(payload.sub ?? ""),
-    aud: String(payload.aud ?? ""),
-    tenant,
-    env,
-    scopes,
-    iat: Number(payload.iat ?? 0),
-    exp: Number(payload.exp ?? 0),
-    jti,
-  };
-}
-
-export interface AppTokenVerifierConfig {
-  /** This request's tenant — pinned as the required `aud` (per-tenant, mirrors identityToken.ts). */
-  tenant: string;
-  issuer?: string;
-  keys: JWTVerifyGetKey;
-}
-
-/**
- * Verifies app-gateway tokens offline against the LOCAL JWKS. One instance
- * per tenant (its `aud` pin is fixed).
- */
-export class AppTokenVerifier {
-  private readonly tenant: string;
-  private readonly issuer: string;
-  private readonly keys: JWTVerifyGetKey;
-
-  constructor(config: AppTokenVerifierConfig) {
-    if (!config.tenant) {
-      throw new Error("AppTokenVerifier requires a `tenant` (this request's resource)");
-    }
-    this.tenant = config.tenant;
-    this.issuer = config.issuer ?? DEFAULT_APP_GATEWAY_ISSUER;
-    this.keys = config.keys;
-  }
-
-  /**
-   * Verify a compact JWS and return typed claims. Rejects (throws) on: any
-   * `alg` other than RS256 (blocks `alg:none` and every HS*), bad signature,
-   * wrong/absent `aud`, unlisted `iss`, or expired/not-yet-valid `exp`/`iat`.
-   */
-  async verify(token: string): Promise<AppTokenClaims> {
-    const header = decodeProtectedHeader(token);
-    if (header.alg !== APP_GATEWAY_ALG) {
-      throw new Error(`unexpected JWT alg ${String(header.alg)}; only ${APP_GATEWAY_ALG} is accepted`);
-    }
-
-    const { payload } = await jwtVerify(token, this.keys, {
-      issuer: this.issuer,
-      audience: this.tenant,
-      algorithms: [APP_GATEWAY_ALG],
-    });
-
-    return toAppTokenClaims(payload as Record<string, unknown>);
-  }
-}
-
-/**
- * Get (or build) the verifier for one tenant, from the gateway's own
- * locally-derived JWKS. Returns `null` when the signing key isn't configured
- * — callers (the scoped-API routes) fail closed with 503, mirroring `getIdentityVerifier`.
- * Not cached across calls (unlike `identityToken.ts`'s remote-fetch verifier):
- * deriving the local JWKS is cheap (`gatewayKeys.ts` caches the export itself).
- */
-export async function getAppTokenVerifier(
-  tenant: string,
-  overrides: GatewayKeyOverrides = {},
-): Promise<AppTokenVerifier | null> {
-  let jwks;
-  try {
-    jwks = await loadGatewayJwks(overrides);
-  } catch (cause) {
-    if (cause instanceof GatewayKeyError) return null;
-    throw cause;
-  }
-  const issuer = overrides.issuer ?? (await readEnv(APP_GATEWAY_ISSUER_ENV)) ?? DEFAULT_APP_GATEWAY_ISSUER;
-  return new AppTokenVerifier({ tenant, issuer, keys: createLocalJWKSet(jwks) });
-}

package/apps/storefront/src/lib/apps/v84CleanCloneReplayContext.ts

@@ -1,16 +0,0 @@
-/** Shared fake/local state contract for one composed v84 clean-clone pass. */
-export const V84_REPLAY_SESSION_ID = "offline-v84-shared-clone-session" as const;
-export const V84_REPLAY_CLONE_TENANT = "tokenoftrust.com~clone~gtm-migration-v84" as const;
-
-export interface V84CleanCloneReplayContext {
-  readonly sessionId: typeof V84_REPLAY_SESSION_ID;
-  readonly cloneTenant: typeof V84_REPLAY_CLONE_TENANT;
-  read<T>(key: string): T | undefined;
-  write(key: string, value: unknown): void;
-  delete(key: string): void;
-  keys(prefix?: string): readonly string[];
-}
-
-export function sameV84ReplayValue(left: unknown, right: unknown): boolean {
-  return JSON.stringify(left) === JSON.stringify(right);
-}

package/apps/storefront/src/lib/apps/v84CloneLifecycleCacheEvidence.ts

@@ -1,105 +0,0 @@
-/** Clone-only cold/warm cache evidence over local managed-install state. */
-import { getCachedPage, pageCacheKey, putCachedPage } from "../edgeCache.js";
-import type { V84DisabledInstallMaterializationResult } from "./v84CloneLifecycleMaterialization.js";
-import {
-  V84_NATIVE_CLONE_TENANT,
-  V84_NATIVE_SOURCE_TENANT,
-} from "./v84CloneNativeInstallEvidence.js";
-import type { V84CleanCloneReplayContext } from "./v84CleanCloneReplayContext.js";
-
-const CACHE_BODY = "<!-- offline v84 lifecycle cache artifact; no integration markup -->";
-const INTEGRATION_MARKUP = /<script|dataLayer|googletagmanager|GTM-|\beval\s*\(/i;
-
-function fakeCache(replayContext?: V84CleanCloneReplayContext) {
-  const store = new Map<string, Response>();
-  const reads: string[] = [];
-  const writes: string[] = [];
-  const cache = {
-    async match(request: Request) {
-      reads.push(request.url);
-      if (replayContext) {
-        const found = replayContext.read<{
-          body: string;
-          headers: Record<string, string>;
-          status: number;
-        }>(`stage/lifecycle/cache/${encodeURIComponent(request.url)}`);
-        return found ? new Response(found.body, { headers: found.headers, status: found.status }) : undefined;
-      }
-      return store.get(request.url)?.clone();
-    },
-    async put(request: Request, response: Response) {
-      writes.push(request.url);
-      if (replayContext) {
-        replayContext.write(`stage/lifecycle/cache/${encodeURIComponent(request.url)}`, {
-          body: await response.clone().text(),
-          headers: Object.fromEntries(response.headers.entries()),
-          status: response.status,
-        });
-        return;
-      }
-      store.set(request.url, response.clone());
-    },
-  } as unknown as Cache;
-  return { cache, reads, writes };
-}
-
-/** Exercise a true cold miss and warm clone-only hit without touching source keys. */
-export async function buildV84CloneCacheEvidence(
-  materialization: V84DisabledInstallMaterializationResult,
-  replayContext?: V84CleanCloneReplayContext,
-) {
-  const memory = fakeCache(replayContext);
-  const disabledCacheKeyBefore = pageCacheKey(
-    V84_NATIVE_CLONE_TENANT,
-    "/v84-lifecycle",
-    "",
-    1,
-    materialization.candidatePlanBefore.planRevision,
-  );
-  const cloneCacheKey = pageCacheKey(
-    V84_NATIVE_CLONE_TENANT,
-    "/v84-lifecycle",
-    "",
-    1,
-    materialization.candidatePlanAfter.planRevision,
-  );
-  const sourceCacheKey = pageCacheKey(V84_NATIVE_SOURCE_TENANT, "/v84-lifecycle", "", 1);
-  const cold = await getCachedPage(memory.cache, cloneCacheKey);
-  await putCachedPage(memory.cache, cloneCacheKey, new Response(CACHE_BODY, {
-    status: 200,
-    headers: { "content-type": "text/html; charset=utf-8" },
-  }));
-  const warm = await getCachedPage(memory.cache, cloneCacheKey);
-  const warmBody = warm ? await warm.text() : "";
-  if (
-    cold !== null ||
-    !warm ||
-    warmBody !== CACHE_BODY ||
-    warm.headers.get("x-tot-cache") !== "hit" ||
-    disabledCacheKeyBefore.url !== cloneCacheKey.url ||
-    INTEGRATION_MARKUP.test(warmBody)
-  ) {
-    throw new Error("The clone-local warm-cache proof failed.");
-  }
-  if (memory.reads.includes(sourceCacheKey.url) || memory.writes.includes(sourceCacheKey.url)) {
-    throw new Error("The warm-cache proof touched the source namespace.");
-  }
-
-  return {
-    warmCache: {
-      tenant: V84_NATIVE_CLONE_TENANT,
-      coldMiss: true,
-      warmHit: true,
-      cloneWriteCount: memory.writes.length,
-      sourceReadCount: memory.reads.filter((url) => url === sourceCacheKey.url).length,
-      sourceWriteCount: memory.writes.filter((url) => url === sourceCacheKey.url).length,
-      managedInstallStateChanged: materialization.managedInstallStateChanged,
-      effectivePlanChanged:
-        materialization.candidatePlanBefore.planRevision !== materialization.candidatePlanAfter.planRevision,
-      disabledDraftsChangedCacheKey: disabledCacheKeyBefore.url !== cloneCacheKey.url,
-      artifactContainsIntegrationMarkup: INTEGRATION_MARKUP.test(warmBody),
-    },
-    cloneCacheReads: memory.reads.length,
-    cloneCacheWrites: memory.writes.length,
-  };
-}