@tokenoftrust/storefront-runner 2.2.1 → 2.2.3

package/apps/storefront/src/lib/auth/internalContentAuthority.ts

@@ -117,12 +117,14 @@ export async function authorizeInternalContentRequest(
   }
   if (!contexts) return { allowed: false, reason: "unavailable" };
 
-  const matching = contexts.filter((context) => context.appDomain === input.route.tenant);
-  if (matching.length !== 1) return { allowed: false, reason: "denied" };
-  const audience = matching[0]!.audience;
-  if (audience !== "owner" && audience !== "developer") {
-    return { allowed: false, reason: "denied" };
-  }
+  // The broker sends one context per (store, kind). Only a direct membership (owner or
+  // developer) authorizes internal content; staff, operator and unknown kinds carry nothing
+  // here and displace nothing. Two memberships on one store are ambiguous and refused.
+  const memberships = contexts.filter((context) =>
+    context.appDomain === input.route.tenant &&
+    (context.audience === "owner" || context.audience === "developer"));
+  if (memberships.length !== 1) return { allowed: false, reason: "denied" };
+  const audience = memberships[0]!.audience as "owner" | "developer";
   return {
     allowed: true,
     tenant: input.route.tenant,

package/apps/storefront/src/themes/reference.ts

@@ -62,7 +62,11 @@ export const referenceTheme: ThemeTokens = {
     logoLight: "/brand/northwind-logo-light.svg",
     logoDark: "/brand/northwind-logo-dark.svg",
     favicon: "/favicon.svg",
-    ogImage: "/brand/northwind-og.svg",
+    // No ogImage default: this object is the merge BASE for every tenant
+    // (schema.ts mergeTheme(referenceTheme, tenant.theme_tokens)), not just the
+    // reference/demo tenant's own theme. A hardcoded default here silently
+    // became every tenant's og:image unless they declared their own -- the
+    // northwind-og.svg placeholder shipped live on tokenoftrust.com this way.
     motion: "full",
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/tenant.ts

@@ -139,7 +139,8 @@ export interface ThemeBrandTokens {
   logoLight: string;
   logoDark: string;
   favicon: string;
-  ogImage: string;
+  /** No platform default: a tenant with no declared og:image gets no og:image tag, never a shared placeholder. */
+  ogImage?: string;
   /** "full" | "reduced" — tenant-level default motion preference. */
   motion: "full" | "reduced";
   /**