@tokenoftrust/storefront-runner 2.0.20 → 2.0.22

package/apps/storefront/env.d.ts

@@ -197,11 +197,13 @@ declare global {
       /**
        * Signed-in viewer for a login-gated preview host (set by the demo login
        * gate once a valid, resource-bound `tot_session` cookie is present). Carries
-       * the email + the role(s)/capability tot20 resolved on this tenant, so chrome
+       * the opaque subject, email + role(s)/capability tot20 resolved on this tenant, so chrome
        * can show "signed in as … — owner/developer/staff". Absent on open or
        * password-gated hosts.
        */
       viewer?: {
+        /** Opaque identity-provider subject from the verified session assertion. */
+        subject?: string;
         email: string;
         roles: string[];
         capability: string;

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -51,11 +51,9 @@ import type { ActionKey } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/auth/route";
 import { isStaffSession } from "@/lib/dashboard/staffAdmission";
 import { readEnv } from "@/lib/env";
+import { isOwnerCapability } from "@/lib/shared/capability";
 import { hashActorId, recordActivity } from "./recordActivity";
 
-/** The host-bound capabilities that mark a viewer as the store OWNER (merchant). */
-const OWNER_CAPABILITIES = new Set(["owner", "admin"]);
-
 /** The minimal viewer chrome the middleware stamps on `locals.viewer`. */
 interface ViewerLike {
   email?: string;
@@ -81,7 +79,7 @@ export function classifyActorKind(
 ): ActorKind {
   if (!viewer?.email) return "agent";
   if (isStaffSession(session)) return "admin";
-  if (viewer.capability && OWNER_CAPABILITIES.has(viewer.capability)) return "merchant";
+  if (isOwnerCapability(viewer.capability)) return "merchant";
   return "dev";
 }
 

package/apps/storefront/src/lib/auth/adminEntry.ts

@@ -32,8 +32,8 @@ import type { SessionRecord } from "./session.js";
 import { sessionHostCapability } from "./loginGate.js";
 import {
   decideIsOwner,
+  isOwnerCapability,
   resolveShipCapabilities,
-  OWNER_CAPABILITIES,
   type Capability,
   type ShipCapabilities,
 } from "@/lib/shared/capability";
@@ -108,7 +108,7 @@ export function resolveAdminEntry(input: {
   const principal: AdminEntryPrincipal = !record
     ? "anonymous"
     : hostCapability
-      ? OWNER_CAPABILITIES.has(hostCapability)
+      ? isOwnerCapability(hostCapability)
         ? (hostCapability as "owner" | "admin")
         : "member"
       : staffScope

package/apps/storefront/src/lib/auth/devAuth.ts

@@ -77,7 +77,7 @@ export async function devSessionFields(
   const resource = (await readEnv("STOREFRONT_APP_DOMAIN")) || "storefront";
   const tenants = devTenantResources().map((resource) => ({
     resource,
-    role: "developer",
+    role: "member" as const,
   }));
   return {
     email: email.toLowerCase(),

package/apps/storefront/src/lib/auth/identityToken.ts

@@ -27,6 +27,11 @@ import {
   type JSONWebKeySet,
 } from "jose";
 import { readEnv } from "@/lib/env";
+import {
+  TENANT_ROLES,
+  isTenantRole,
+  type TenantRole,
+} from "@/lib/shared/capability";
 
 /** tot's issuer — consumers pin/allowlist this (`auth.jwt.issuer`). */
 export const TOT_ISSUER = "tokenoftrust-internal-ops";
@@ -45,7 +50,13 @@ export const JWKS_PATH = "/api/.well-known/jwks.json";
  * (`developer`/`inviter`/none → `member`). Org standing only; finer granularity
  * is the storefront's own job to derive locally (Phase-4 PDP work).
  */
-export type CoarseRole = "owner" | "admin" | "member";
+export const COARSE_ROLES = TENANT_ROLES;
+export type CoarseRole = TenantRole;
+
+/** Runtime counterpart to the closed coarse-role type. */
+export function isCoarseRole(value: unknown): value is CoarseRole {
+  return isTenantRole(value);
+}
 
 /** A single tenant membership carried in the assertion. */
 export interface TenantMembership {
@@ -90,7 +101,7 @@ export interface IdentityClaims {
 
 /** Coarse-role collapse guard: anything tot didn't send as owner/admin → member. */
 function coerceRole(role: unknown): CoarseRole {
-  return role === "owner" || role === "admin" ? role : "member";
+  return isCoarseRole(role) ? role : "member";
 }
 
 /**

package/apps/storefront/src/lib/shared/capability.ts

@@ -16,8 +16,22 @@
 /** Access level the acting operator holds. */
 export type Capability = "preview-access" | "ship-on-behalf";
 
+/** Complete tenant-role vocabulary emitted by verified identity assertions. */
+export const TENANT_ROLES = ["owner", "admin", "member"] as const;
+export type TenantRole = (typeof TENANT_ROLES)[number];
+
+export function isTenantRole(value: unknown): value is TenantRole {
+  return typeof value === "string" && (TENANT_ROLES as readonly string[]).includes(value);
+}
+
 /** Capabilities that carry tenant-owner standing (vs. a granted developer). */
-export const OWNER_CAPABILITIES: ReadonlySet<string> = new Set(["owner", "admin"]);
+export const OWNER_CAPABILITY_VALUES = ["owner", "admin"] as const satisfies readonly TenantRole[];
+export type OwnerCapability = (typeof OWNER_CAPABILITY_VALUES)[number];
+export const OWNER_CAPABILITIES: ReadonlySet<string> = new Set(OWNER_CAPABILITY_VALUES);
+
+export function isOwnerCapability(value: unknown): value is OwnerCapability {
+  return typeof value === "string" && OWNER_CAPABILITIES.has(value);
+}
 
 /** Pure inputs to the owner-principal decision (session only, no I/O). */
 export interface OwnerPrincipalInput {
@@ -34,7 +48,7 @@ export interface OwnerPrincipalInput {
  */
 export function decideIsOwner(input: OwnerPrincipalInput): boolean {
   if (!input.authorized) return false;
-  return !!input.viewerCapability && OWNER_CAPABILITIES.has(input.viewerCapability);
+  return isOwnerCapability(input.viewerCapability);
 }
 
 /**

package/apps/storefront/src/middleware/controlPlane.ts

@@ -206,6 +206,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
         : tenant.appDomain;
       const hostCapability = sessionHostCapability(viewerRecord, capabilityHost, nowSeconds);
       locals.viewer = {
+        ...(viewerRecord.subject ? { subject: viewerRecord.subject } : {}),
         email: viewerRecord.email,
         roles: hostCapability ? [hostCapability] : viewerRecord.roles,
         capability: hostCapability ?? viewerRecord.capability,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.20",
+  "version": "2.0.22",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",