@tokenoftrust/storefront-runner 2.0.25 → 2.0.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.0.25",
+  "version": "2.0.26",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/customization-preview.ts

@@ -273,18 +273,34 @@ export function isPreviewDispatcherPath(pathname: string): boolean {
 }
 
 /**
- * Decide which customization environment to serve. Production hosts always get
- * `live` and never consult a token. Preview hosts are auth-gated: a valid,
- * unexpired, tenant-matching token yields `test` (noindex); anything else is
- * rejected. The one exception is the token-dispenser path itself (see
+ * Decide which customization environment to serve. A valid, unexpired,
+ * tenant-matching `__preview`/`tot_preview` token grants `test` (noindex) on
+ * ANY host — the token is checked before the host is, so a signed preview
+ * link keeps working even when opened on the tenant's normal (non-`preview.*`)
+ * host. Without such a token, production hosts always get `live`; preview
+ * hosts are auth-gated and reject a missing/invalid/cross-tenant token. The
+ * one exception is the token-dispenser path itself (see
  * {@link isPreviewDispatcherPath}) — it renders the dispatcher's own minimal
- * page, never tenant content, so it's let through as `live`/no-token rather
- * than 401ing on the very request that would otherwise fetch it a token.
+ * page, never tenant content, so it's always `live`/no-token regardless of
+ * host or token, rather than 401ing on the very request that would otherwise
+ * fetch a token.
  */
 export async function resolveCustomizationEnv(
   input: EnvResolutionInput,
 ): Promise<EnvResolution> {
-  if (!input.isPreviewHost || isPreviewDispatcherPath(input.pathname ?? "")) {
+  if (isPreviewDispatcherPath(input.pathname ?? "")) {
+    return { env: "live", noindex: false };
+  }
+
+  const tokenResult =
+    input.secret && input.token
+      ? await verifyPreviewToken(input.secret, input.token, input.nowSeconds)
+      : null;
+  if (tokenResult?.ok && tokenResult.claims.tenantId === input.tenantId) {
+    return { env: "test", noindex: true };
+  }
+
+  if (!input.isPreviewHost) {
     return { env: "live", noindex: false };
   }
   if (!input.secret) {
@@ -301,20 +317,16 @@ export async function resolveCustomizationEnv(
       reject: { status: 401, message: "Preview token required." },
     };
   }
-  const result = await verifyPreviewToken(input.secret, input.token, input.nowSeconds);
-  if (!result.ok) {
+  if (!tokenResult!.ok) {
     return {
       env: "live",
       noindex: true,
-      reject: { status: 401, message: `Invalid preview token (${result.reason}).` },
+      reject: { status: 401, message: `Invalid preview token (${tokenResult!.reason}).` },
     };
   }
-  if (result.claims.tenantId !== input.tenantId) {
-    return {
-      env: "live",
-      noindex: true,
-      reject: { status: 403, message: "Preview token is for a different tenant." },
-    };
-  }
-  return { env: "test", noindex: true };
+  return {
+    env: "live",
+    noindex: true,
+    reject: { status: 403, message: "Preview token is for a different tenant." },
+  };
 }