@tokenoftrust/storefront-runner 2.1.1 → 2.1.3

package/apps/storefront/src/lib/auth/loginGate.ts

@@ -273,6 +273,24 @@ export function isBypassPrivilegedPath(pathname: string): boolean {
   return false;
 }
 
+/**
+ * Control surfaces a withheld visitor is sent straight to sign-in for, instead of the
+ * "Coming soon" holding page: admin and the cockpit (with its `/dev` alias), in both the
+ * bare and the tenant-prefixed form. The holding page's audience is a public browser of
+ * a gated STOREFRONT; a developer or merchant heading for a control surface needs the
+ * sign-in prompt, not an ambiguous 200 that reads as "this store isn't ready." `/api/`
+ * is excluded — API callers need a status, not a redirect.
+ */
+export function isSignInRedirectPath(pathname: string): boolean {
+  // Bare `/api/...` would otherwise read as tenant `api` + `/dev`.
+  if (pathname === "/api" || pathname.startsWith("/api/")) return false;
+  if (isAdminPath(pathname)) return true;
+  if (pathname === "/cockpit" || pathname.startsWith("/cockpit/")) return true;
+  if (/^\/[^/]+\/cockpit(?:\/|$)/.test(pathname)) return true;
+  if (pathname === "/dev" || pathname.startsWith("/dev/")) return true;
+  return /^\/[^/]+\/dev(?:\/|$)/.test(pathname);
+}
+
 export type LoginGateDecision =
   | { action: "pass" }
   | { action: "redirect"; location: string };

package/apps/storefront/src/middleware/controlPlane.ts

@@ -25,6 +25,7 @@ import {
   evaluateLoginGate,
   isAuthPath,
   isAdminPath,
+  isSignInRedirectPath,
   sessionAdmitsHost,
   sessionHostCapability,
   type GateMode,
@@ -171,15 +172,16 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
       previewTokenValid,
     });
     if (decision.action === "redirect") {
-      // ADMIN (and any privileged surface) hard-redirects to sign-in rather than
-      // rendering the merchant-facing "Coming soon" holding page: an unauthenticated
-      // admin visitor must land on the sign-in prompt, never an ambiguous 200 that
+      // Admin and the cockpit hard-redirect to sign-in rather than rendering the
+      // merchant-facing "Coming soon" holding page: an unauthenticated visitor to a
+      // control surface must land on the sign-in prompt, never an ambiguous 200 that
       // reads as "this store isn't ready." The holding page's whole audience is a
-      // public browser of a gated STOREFRONT; it is the wrong signal for /admin. The
-      // gate already decided to withhold — this only changes HOW (303 vs holding
-      // page); it never weakens the gate. `decision.location` already carries
-      // `?next=` so the admin returns to exactly where they were headed.
-      if (isAdminPath(url.pathname)) {
+      // public browser of a gated STOREFRONT; it is the wrong signal for /admin and
+      // `/<tenant>/cockpit`. The gate already decided to withhold — this only changes
+      // HOW (303 vs holding page); it never weakens the gate. `decision.location`
+      // already carries `?next=` so the visitor returns to exactly where they were
+      // headed.
+      if (isSignInRedirectPath(url.pathname)) {
         return context.redirect(decision.location, 303);
       }
       // Withhold content but offer sign-in (carrying the intended destination).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",