@tokenoftrust/storefront-runner 2.2.119 → 2.2.121

package/apps/storefront/src/lib/auth/loginGate.ts

@@ -331,6 +331,8 @@ export interface LoginGateInput {
    * cockpit, /api) still require a real session.
    */
   previewTokenValid?: boolean;
+  /** A verified, tenant-bound candidate content pin admits public content only. */
+  candidatePinValid?: boolean;
 }
 
 /**
@@ -355,10 +357,12 @@ export function evaluateLoginGate(input: LoginGateInput): LoginGateDecision {
   // public content only. NEVER for admin/cockpit/api — that guard lives here (not
   // just in middleware) so /admin stays gated even if the flag is set upstream.
   if (input.qaBypass && !isBypassPrivilegedPath(input.pathname)) return { action: "pass" };
-  // Customization preview: a signed, tenant-bound preview token admits a viewer to
-  // that tenant's public content on any tenant. Same privileged-path exclusion as
-  // the QA bypass — admin/cockpit/api are never reachable on a token alone.
-  if (input.previewTokenValid && !isBypassPrivilegedPath(input.pathname)) {
+  // Signed, tenant-bound preview grants admit public content only. Admin,
+  // cockpit, and API routes still require a session.
+  if (
+    (input.previewTokenValid || input.candidatePinValid) &&
+    !isBypassPrivilegedPath(input.pathname)
+  ) {
     return { action: "pass" };
   }
   if (input.hasValidSession) return { action: "pass" };

package/apps/storefront/src/middleware/controlPlane.ts

@@ -35,6 +35,7 @@ import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
 import { gatedHoldingResponse } from "@/lib/auth/gatePage";
 import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
 import { runRenderChain } from "./renderChain.js";
+import { resolveCandidateContentPin } from "./candidatePin.js";
 import type { InternalContentGrant } from "@/lib/auth/internalContentAuthority";
 
 export interface ControlPlaneInput {
@@ -63,6 +64,11 @@ export interface ControlPlaneInput {
 export async function serveControlPlane(input: ControlPlaneInput): Promise<Response> {
   const { context, next, host, url, tenant, basePath, renderPath, cache, kv } = input;
   const { request, locals } = context;
+  // A pinned route rewrite arrives here without the outer preview route's
+  // session. Verify its tenant-bound grant before the host login gate runs.
+  const candidatePin = input.hostLoginGated
+    ? await resolveCandidateContentPin(url, tenant.tenant_id)
+    : null;
 
   // Login-gate enforcement (DEMO_GATE_MODE="login"): runs before the render so a
   // gated page is never served to an unauthenticated viewer. A tenant that
@@ -170,6 +176,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
       tenantExempt,
       qaBypass,
       previewTokenValid,
+      candidatePinValid: !!candidatePin,
     });
     if (decision.action === "redirect") {
       // Admin and the cockpit hard-redirect to sign-in rather than rendering the
@@ -261,6 +268,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
     publicationRequestPath: input.publicationRequestPath,
     publicationRoute: input.publicationRoute,
     publicationBucket: input.publicationBucket,
+    verifiedCandidatePin: candidatePin ?? undefined,
     managedIntegrationDeclarations,
     readTenantConsentSnapshot: () => readSavedConsentSnapshot(tenant.tenant_id),
     // The D1 catalog serving projection, for a tenant that declares

package/apps/storefront/src/middleware/renderChain.ts

@@ -14,7 +14,7 @@ import { mergeTheme, themeToCssVars } from "@/themes/schema";
 import { createToTClient } from "@/lib/tot/ToTClient";
 import { readEnv, readR2 } from "@/lib/runtimeEnv";
 import { tryServeStaticBundle } from "./staticBundle.js";
-import { resolveCandidateContentPin } from "./candidatePin.js";
+import { resolveCandidateContentPin, type CandidateContentPin } from "./candidatePin.js";
 import { createContentProvider, DevDraftContentProvider } from "@/lib/storyblok/provider";
 import { bindPublicationSpaceContentProviderV1 } from "@/lib/publication/contentProvider.js";
 import { resolvePublicationRuntimeSourceV1 } from "@/lib/publication/runtimeSource.js";
@@ -144,6 +144,8 @@ export interface RenderChainInput {
   readCatalogD1: (() => Promise<Parameters<typeof createToTClient>[1]>) | null;
   /** Exact per-request grant for an F2-selected internal publication space. */
   internalContentGrant?: InternalContentGrant;
+  /** Pin already verified for this tenant by the control-plane login gate. */
+  verifiedCandidatePin?: CandidateContentPin;
 }
 
 /** Materialize-only response header: the tenant's declared origins, comma-separated. */
@@ -180,7 +182,8 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // pin can only ever name its own version; a mismatched/expired/absent token
   // falls through to the normal channel-resolved read below, same fail-closed
   // posture as the `__preview` token.
-  const candidatePin = await resolveCandidateContentPin(url, tenantRecord.tenant_id);
+  const candidatePin = input.verifiedCandidatePin ??
+    await resolveCandidateContentPin(url, tenantRecord.tenant_id);
   // Per-developer AI-edit draft: the signed
   // tot_dev_draft cookie's mere PRESENCE opts the request out of the shared page
   // cache below (a draft view must never be cached publicly); it's verified —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.119",
+  "version": "2.2.121",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",