@tokenoftrust/storefront-runner 2.0.2 → 2.0.4

package/apps/storefront/src/lib/content-edit/client.ts

@@ -1,286 +0,0 @@
-/**
- * JsonRpcContentEditClient — the storefront's server-to-server caller for
- * tot-mcp's `content_edit` tool (the inline-AI edit loop, WS5 G1). Mirrors
- * {@link JsonRpcChangeClient} exactly (same transport, same session-validation,
- * same tool-result unwrap, same typed errors) — reusing the forge seam's
- * exported transport + error types so there is ONE wire contract, not two.
- *
- * AUTH SHAPE (Option A, `content-edit-machine-identity` — mirrors change/B3):
- * the storefront backend calls `content_edit` with the SAME machine-identity
- * APP token the change/forge clients use — a `client_credentials` +
- * `private_key_jwt` token minted against the MCP's OAuth token endpoint via
- * {@link AppTokenProvider}, attached as Bearer at `initialize` and on every
- * request by {@link FetchTransport} — NOT the retired `credential_validate`
- * handshake and NOT a human `TOT_ACCESS_TOKEN`. Developer-level authorization
- * is, and remains, the caller's job: `/dev`'s own `readViewerSession()` +
- * capability check (BEFORE this client is ever constructed) derives the
- * tenant from the signed-in developer's OWN session, never from a
- * caller-supplied value — tenant isolation is enforced there, unaffected by
- * this change. This client only proves "a legitimate storefront backend
- * (machine identity) is asking", the same trust boundary
- * `/api/changes/accept` already relies on post-B3.
- */
-import {
-  FetchTransport,
-  ForgeAuthError,
-  ForgeConfigError,
-  ForgeTransportError,
-  SESSION_HEADER,
-  AppTokenProvider,
-  deriveMcpOauthEndpoints,
-  type McpTransport,
-  type JsonRpcRequest,
-  type TotCredentials,
-  type TransportResponse,
-  type BearerProvider,
-} from "@/lib/forge";
-import { mapForgeError } from "@/lib/forge/errors.js";
-import { readEnv } from "@/lib/env";
-import type { ContentEditFile, ContentEditResult } from "./types.js";
-
-export const CONTENT_EDIT_TOOL = {
-  /**
-   * Session-validation tool for the NON-OAuth (api-key/secret) construction —
-   * kept ONLY for backward-compatible test-transport injection (no
-   * bearerProvider). The deployed path never calls this — see the module
-   * header.
-   */
-  validate: "credential_validate",
-  edit: "content_edit",
-} as const;
-
-export { SESSION_HEADER } from "@/lib/forge";
-
-// --- MCP tool-result envelope (mirrors the change client) -------------------
-
-interface McpToolResult {
-  content?: Array<{ type?: string; text?: string }>;
-  structuredContent?: unknown;
-  isError?: boolean;
-}
-
-function parseTextContent(content: McpToolResult["content"]): unknown {
-  const text = content?.find((c) => c.type === "text" || c.text != null)?.text;
-  if (text == null) return undefined;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-}
-
-function unwrapToolResult<T>(result: unknown): T {
-  const env = (result ?? {}) as McpToolResult;
-  const payload =
-    env.structuredContent !== undefined
-      ? env.structuredContent
-      : parseTextContent(env.content);
-
-  if (env.isError) {
-    const p = (payload ?? {}) as Record<string, unknown>;
-    throw mapForgeError({
-      code: typeof p.code === "number" ? p.code : undefined,
-      message: typeof p.message === "string" ? p.message : "content_edit tool error",
-      data: (p.data as Record<string, unknown>) ?? p,
-    });
-  }
-  return payload as T;
-}
-
-// --- Config -------------------------------------------------------------
-
-export interface JsonRpcContentEditClientConfig {
-  /** MCP base URL (the `POST /mcp` endpoint). */
-  baseUrl: string;
-  /** Storefront's ToT credentials for the legacy `credential_validate` path. */
-  credentials: TotCredentials;
-  /** Transport override (defaults to fetch). Injected by tests. */
-  transport?: McpTransport;
-  /**
-   * Machine-identity app-token source (mirrors forge's B2 / change's B3,
-   * binding `c0-forge-auth-supersede`). When present, the client
-   * authenticates PURELY via a `client_credentials` + `private_key_jwt` app
-   * token — attached as Bearer at `initialize` and on every request by
-   * {@link FetchTransport}, re-minted on expiry/401 — and NEVER calls the
-   * retired `credential_validate` handshake. Built by
-   * {@link createContentEditClient} from `MCP_BASE_URL`; tests may inject
-   * their own {@link BearerProvider}.
-   */
-  bearerProvider?: BearerProvider;
-}
-
-// --- The client -----------------------------------------------------------
-
-export class JsonRpcContentEditClient {
-  private readonly baseUrl: string;
-  private readonly credentials: TotCredentials;
-  private readonly transport: McpTransport;
-  private nextId = 1;
-  /** Cached session validation — validate once, reuse (lazily). */
-  private sessionPromise?: Promise<string | undefined>;
-  /** True when a machine-identity app token authenticates the session (mirrors forge B2 / change B3). */
-  private readonly usesServiceAuth: boolean;
-
-  constructor(config: JsonRpcContentEditClientConfig) {
-    if (!config.baseUrl) {
-      throw new ForgeConfigError("content-edit: MCP_BASE_URL is not configured");
-    }
-    if (!config.credentials?.apiKey) {
-      throw new ForgeConfigError(
-        "content-edit: storefront ToT credentials are not configured",
-      );
-    }
-    this.baseUrl = config.baseUrl;
-    this.credentials = config.credentials;
-    this.usesServiceAuth = config.bearerProvider != null;
-    this.transport =
-      config.transport ?? new FetchTransport(config.baseUrl, config.bearerProvider);
-  }
-
-  async editContent(
-    prompt: string,
-    files: readonly ContentEditFile[],
-  ): Promise<ContentEditResult> {
-    const sessionId = await this.ensureSession();
-    const result = await this.rpc(
-      "tools/call",
-      { name: CONTENT_EDIT_TOOL.edit, arguments: { prompt, files } },
-      sessionId,
-    );
-    return unwrapToolResult<ContentEditResult>(result);
-  }
-
-  // --- internals (mirror JsonRpcChangeClient) --------------------------------
-
-  private ensureSession(): Promise<string | undefined> {
-    // Service-auth (mirrors forge B2 / change B3 / binding
-    // `c0-forge-auth-supersede`): the app token is attached as Bearer at the
-    // transport layer (initialize + every request), so the legacy
-    // `credential_validate` round-trip is skipped entirely — it was retired
-    // MCP-side and would now be rejected. FetchTransport still threads the
-    // real `Mcp-Session-Id` the Bearer-authed handshake minted, so a session
-    // id is never needed from here. Without a bearerProvider (e.g. an
-    // injected mock transport in unit tests) the legacy validate path is kept.
-    this.sessionPromise ??= this.usesServiceAuth
-      ? Promise.resolve(undefined)
-      : this.validateSession();
-    return this.sessionPromise;
-  }
-
-  private async validateSession(): Promise<string | undefined> {
-    const args = this.credentialArgs();
-    let res: TransportResponse;
-    try {
-      res = await this.rpcRaw(
-        "tools/call",
-        { name: CONTENT_EDIT_TOOL.validate, arguments: args },
-        undefined,
-      );
-    } catch (err) {
-      this.sessionPromise = undefined; // let a later call retry
-      throw err;
-    }
-    if (res.body.error) {
-      this.sessionPromise = undefined;
-      throw new ForgeAuthError(
-        res.body.error.message ?? "content-edit: credential validation failed",
-      );
-    }
-    try {
-      const validated = unwrapToolResult<{ session?: string; sessionId?: string }>(
-        res.body.result,
-      );
-      return (
-        res.sessionId ?? validated?.session ?? validated?.sessionId ?? undefined
-      );
-    } catch (err) {
-      this.sessionPromise = undefined;
-      throw err instanceof ForgeAuthError
-        ? err
-        : new ForgeAuthError("content-edit: credential validation was rejected", {
-            cause: err,
-          });
-    }
-  }
-
-  /** Build the credential payload; omits absent secrets. Never logged. */
-  private credentialArgs(): Record<string, unknown> {
-    const c = this.credentials;
-    const out: Record<string, unknown> = { apiKey: c.apiKey };
-    if (c.secretKey) out.secretKey = c.secretKey;
-    if (c.accessToken) out.accessToken = c.accessToken;
-    return out;
-  }
-
-  private async rpc(
-    method: string,
-    params: unknown,
-    sessionId: string | undefined,
-  ): Promise<unknown> {
-    const res = await this.rpcRaw(method, params, sessionId);
-    if (res.body.error) throw mapForgeError(res.body.error);
-    return res.body.result;
-  }
-
-  private async rpcRaw(
-    method: string,
-    params: unknown,
-    sessionId: string | undefined,
-  ): Promise<TransportResponse> {
-    const headers: Record<string, string> = {};
-    if (sessionId) headers[SESSION_HEADER] = sessionId;
-    const body: JsonRpcRequest = {
-      jsonrpc: "2.0",
-      id: this.nextId++,
-      method,
-      params,
-    };
-    try {
-      return await this.transport.post({ body, headers });
-    } catch (err) {
-      if (err instanceof ForgeTransportError) throw err;
-      throw new ForgeTransportError(
-        `content-edit: transport failure calling ${method}`,
-        { cause: err },
-      );
-    }
-  }
-}
-
-// --- Factory ----------------------------------------------------------------
-
-/**
- * Build a {@link JsonRpcContentEditClient} from the runtime env — the SAME env
- * the change client reads:
- *   - `MCP_BASE_URL`  — the `POST /mcp` endpoint (its ORIGIN also hosts the OAuth
- *     token endpoint + resource the app token binds to; already `…/storefront`
- *     per B4, so the app token's resource + this RPC endpoint match).
- *   - `TOT_API_KEY` (+ optional `TOT_SECRET_KEY`) — storefront's OWN ToT
- *     credentials (retained for legacy/local paths; the deployed content-edit
- *     session no longer uses them for auth).
- *
- * Machine identity (mirrors forge B2 / change B3 / binding
- * `c0-forge-auth-supersede`): the content-edit session authenticates with a
- * `client_credentials` + `private_key_jwt` APP token minted against the MCP's
- * OAuth token endpoint via {@link AppTokenProvider} — NOT a human
- * `TOT_ACCESS_TOKEN` and NOT a shared secret. `TOT_ACCESS_TOKEN` is
- * deliberately NOT read here.
- *
- * Throws {@link ForgeConfigError} when the base URL or api key is missing.
- * Secrets are read via {@link readEnv} and never logged.
- */
-export async function createContentEditClient(
-  overrides: Partial<JsonRpcContentEditClientConfig> = {},
-): Promise<JsonRpcContentEditClient> {
-  const baseUrl = overrides.baseUrl ?? (await readEnv("MCP_BASE_URL")) ?? "";
-  const credentials =
-    overrides.credentials ??
-    ({
-      apiKey: (await readEnv("TOT_API_KEY")) ?? "",
-      secretKey: await readEnv("TOT_SECRET_KEY"),
-    } satisfies TotCredentials);
-  const bearerProvider =
-    overrides.bearerProvider ??
-    (baseUrl ? new AppTokenProvider(deriveMcpOauthEndpoints(baseUrl)) : undefined);
-  return new JsonRpcContentEditClient({ ...overrides, baseUrl, credentials, bearerProvider });
-}

package/apps/storefront/src/lib/content-edit/index.ts

@@ -1,14 +0,0 @@
-/**
- * content_edit integration — public barrel. Import the typed client and its
- * route helper from here (`@/lib/content-edit`) so call sites never reach into
- * individual files.
- */
-export type { ContentEditFile, ContentEditFileDiff, ContentEditResult } from "./types.js";
-export {
-  JsonRpcContentEditClient,
-  createContentEditClient,
-  CONTENT_EDIT_TOOL,
-  SESSION_HEADER,
-} from "./client.js";
-export type { JsonRpcContentEditClientConfig } from "./client.js";
-export { getContentEditClient } from "./route.js";

package/apps/storefront/src/lib/content-edit/route.ts

@@ -1,25 +0,0 @@
-/**
- * Route helper for `/api/content-edit/ai-edit` — mirrors `@/lib/change/route/route.ts`'s
- * `getChangeClient`: build the env-configured client, or a 503 Response when
- * the MCP integration isn't configured (missing `MCP_BASE_URL`/credentials).
- */
-import { ForgeError } from "@/lib/forge";
-import { createContentEditClient } from "./client.js";
-import { json } from "@/lib/grants/route.js";
-
-/**
- * Build a content-edit client over the real MCP from env, or return a 503
- * Response when the integration is not configured. Never leaks secret values.
- */
-export async function getContentEditClient(): Promise<
-  Awaited<ReturnType<typeof createContentEditClient>> | Response
-> {
-  try {
-    return await createContentEditClient();
-  } catch (err) {
-    if (err instanceof ForgeError && err.kind === "config") {
-      return json({ error: "content_edit integration not configured" }, 503);
-    }
-    throw err;
-  }
-}

package/apps/storefront/src/lib/content-edit/types.ts

@@ -1,19 +0,0 @@
-/** Wire shape for tot-mcp's `content_edit` tool — mirrors tot-mcp's own
- * ContentFile/ContentFileDiff/ContentEditResult (src/services/content-editor.ts). */
-
-export interface ContentEditFile {
-  /** e.g. "content/home.html" or "theme.json" — content_edit's own allowlist. */
-  path: string;
-  content: string;
-}
-
-export interface ContentEditFileDiff {
-  path: string;
-  /** Unified diff (`--- a/<path>` / `+++ b/<path>`) against the given content. */
-  diff: string;
-}
-
-export interface ContentEditResult {
-  diffs: ContentEditFileDiff[];
-  summary: string;
-}

package/apps/storefront/src/lib/dev/cockpitStore.ts

@@ -1,57 +0,0 @@
-/**
- * "Which store is this cockpit request about?" — the ONE resolver the hosted
- * cockpit page, its /api/dev/* routes, and the CLI sign-in-code mint all share, so
- * they never disagree about the developer's store.
- *
- * Rule: the URL wins WHEN THE VIEWER CAN ACCESS IT. The middleware has already
- * resolved the request's host/path to `locals.tenant` (the trusted, authenticated
- * store seam — never client body input), so when that is a SPECIFIC store (not the
- * public marketing home) and the signed-in developer holds a membership for it (or a
- * live staff admission), that store is authoritative. Otherwise we fall back to the
- * session's own first store (the generic-host `/cockpit` case), and for an
- * anonymous viewer to the path store's branding, else the caller-supplied `?tenant=`.
- *
- * Access is gated with the SAME primitive (`viewerCanAccess`) the vendor dashboard
- * uses, so a developer can never steer the mint at a store they don't belong to; a
- * store they can't access simply falls through to their own.
- */
-import type { APIContext } from "astro";
-import type { SessionRecord } from "@/lib/auth/session";
-import { PUBLIC_HOME_TENANT_ID } from "@/lib/auth/loginGate";
-import { viewerCanAccess, type StaffAdmission } from "@/lib/dashboard/tenantSelection";
-
-/** The request's host/path-resolved store resource, or "" when it's the marketing home. */
-function pathStoreResource(context: Pick<APIContext, "locals">): string {
-  const t = context.locals?.tenant;
-  if (!t || t.tenant_id === PUBLIC_HOME_TENANT_ID) return "";
-  return (t.appDomain || t.tenant_id || "").toLowerCase();
-}
-
-/**
- * Resolve the store this cockpit request is scoped to, as a lowercased resource
- * (appDomain/tenant_id). Empty string when nothing resolves (e.g. anonymous on the
- * generic host with no `?tenant=`).
- */
-export function resolveCockpitStoreResource(
-  context: Pick<APIContext, "locals" | "url">,
-  session: SessionRecord | null,
-): string {
-  const pathStore = pathStoreResource(context);
-
-  if (session) {
-    // The URL wins when the signed-in developer can actually access that store.
-    if (pathStore) {
-      const staff: StaffAdmission | undefined = session.staffSelection
-        ? { selection: session.staffSelection, nowSeconds: Math.floor(Date.now() / 1000) }
-        : undefined;
-      if (viewerCanAccess(session.tenants, pathStore, staff)) return pathStore;
-    }
-    // Generic host, or a store the viewer doesn't belong to: their own first store.
-    return (session.tenants?.[0]?.resource ?? session.resource ?? "").toLowerCase();
-  }
-
-  // Anonymous: the path store is just branding (no privileged mint happens), else the
-  // caller-supplied preview hint. Never overrides a signed-in developer (handled above).
-  if (pathStore) return pathStore;
-  return (context.url?.searchParams.get("tenant") ?? "").toLowerCase();
-}