@tokenoftrust/storefront-runner 2.2.1 → 2.2.2

package/apps/storefront/src/lib/auth/internalContentAuthority.ts

@@ -117,12 +117,14 @@ export async function authorizeInternalContentRequest(
   }
   if (!contexts) return { allowed: false, reason: "unavailable" };
 
-  const matching = contexts.filter((context) => context.appDomain === input.route.tenant);
-  if (matching.length !== 1) return { allowed: false, reason: "denied" };
-  const audience = matching[0]!.audience;
-  if (audience !== "owner" && audience !== "developer") {
-    return { allowed: false, reason: "denied" };
-  }
+  // The broker sends one context per (store, kind). Only a direct membership (owner or
+  // developer) authorizes internal content; staff, operator and unknown kinds carry nothing
+  // here and displace nothing. Two memberships on one store are ambiguous and refused.
+  const memberships = contexts.filter((context) =>
+    context.appDomain === input.route.tenant &&
+    (context.audience === "owner" || context.audience === "developer"));
+  if (memberships.length !== 1) return { allowed: false, reason: "denied" };
+  const audience = memberships[0]!.audience as "owner" | "developer";
   return {
     allowed: true,
     tenant: input.route.tenant,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",