@tokenoftrust/storefront-runner 2.2.37 → 2.2.38

package/apps/storefront/astro.config.mjs

@@ -86,6 +86,11 @@ export default defineConfig({
   // inline-style allowance for elements — every stylesheet is a 'self' <link>.
   // Small first-paint tradeoff, offset by cross-page caching (see LIMITATIONS).
   build: { inlineStylesheets: "never" },
+  // The cross-site form check runs in the front door (src/middleware/index.ts,
+  // lib/cdnForward.ts `crossSiteFormRefusal`) with the same rule, against the
+  // origin the viewer used. Astro's own check compares with the request URL, which
+  // for a CloudFront-forwarded Tier 3 request is this Worker's host, not the viewer's.
+  security: { checkOrigin: false },
   adapter: cloudflare({
     // Local image/asset placeholders are served from /public; real product
     // images get rehosted to R2 in Phase 1 ETL (see DECISIONS.md).

package/apps/storefront/src/lib/cdnForward.ts

@@ -0,0 +1,85 @@
+/**
+ * Requests a tenant's CloudFront distribution forwards to this Worker on its
+ * path-scoped Tier 3 behaviors (ADR 0013: sign-in, the commerce and compliance
+ * APIs, search, the dashboard). The public static path never reaches here.
+ *
+ * CloudFront supplies three headers a viewer cannot set: the tenant id and an
+ * HMAC over it are origin custom headers (CloudFront replaces any viewer-sent
+ * header of the same name), and the viewer's Host is copied by the behavior's
+ * viewer-request function, which overwrites any viewer-sent value. The HMAC is
+ * the only trust anchor: without a valid one none of the three is read and the
+ * request is routed by its own Host like any other.
+ *
+ * The node-side mirror that computes the header value for a distribution is
+ * scripts/publish/lib/worker-tier3.mjs `cdnOriginAuthValue`; both are pinned to
+ * one test vector.
+ */
+import { timingSafeEqual } from "@/lib/activity/ingestAuth";
+
+export const CDN_TENANT_HEADER = "x-tot-cdn-tenant";
+export const CDN_AUTH_HEADER = "x-tot-cdn-origin-auth";
+export const CDN_VIEWER_HOST_HEADER = "x-tot-viewer-host";
+const AUTH_VERSION = "v1";
+
+export interface CdnForward {
+  tenantId: string;
+  /** The Host the viewer addressed — the public origin the request belongs to. */
+  viewerHost: string;
+}
+
+const HOST_SHAPE = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::\d{1,5})?$/i;
+const TENANT_SHAPE = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/i;
+
+/** `v1.<hex HMAC-SHA256(secret, "cdn-origin:v1:" + tenantId)>`. */
+export async function cdnOriginAuthValue(secret: string, tenantId: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const mac = await crypto.subtle.sign("HMAC", key, encoder.encode(`cdn-origin:${AUTH_VERSION}:${tenantId}`));
+  const hex = [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `${AUTH_VERSION}.${hex}`;
+}
+
+/** The authenticated CDN forward this request carries, or null. Never throws. */
+export async function verifyCdnForward(
+  headers: Headers,
+  secret: string | undefined,
+): Promise<CdnForward | null> {
+  if (!secret) return null;
+  const tenantId = headers.get(CDN_TENANT_HEADER)?.trim().toLowerCase() ?? "";
+  const presented = headers.get(CDN_AUTH_HEADER)?.trim() ?? "";
+  const viewerHost = headers.get(CDN_VIEWER_HOST_HEADER)?.trim().toLowerCase() ?? "";
+  if (!tenantId || !presented || !TENANT_SHAPE.test(tenantId) || !HOST_SHAPE.test(viewerHost)) return null;
+  try {
+    if (!timingSafeEqual(presented, await cdnOriginAuthValue(secret, tenantId))) return null;
+  } catch {
+    return null;
+  }
+  return { tenantId, viewerHost };
+}
+
+const FORM_CONTENT_TYPES = ["application/x-www-form-urlencoded", "multipart/form-data", "text/plain"];
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
+/**
+ * Astro's cross-site form check, against the origin the viewer actually used.
+ * Astro compares `Origin` with the request URL, which for a CDN-forwarded request
+ * is this Worker's own host, so the front door runs this instead with the viewer's
+ * origin (astro.config.mjs turns the built-in check off). Same rule otherwise: an
+ * unsafe method with a form-like or absent content type must come from `expectedOrigin`.
+ */
+export function crossSiteFormRefusal(request: Request, expectedOrigin: string): Response | null {
+  if (SAFE_METHODS.has(request.method)) return null;
+  if (request.headers.get("origin") === expectedOrigin) return null;
+  const contentType = request.headers.get("content-type");
+  if (contentType !== null) {
+    const lower = contentType.toLowerCase();
+    if (!FORM_CONTENT_TYPES.some((type) => lower.includes(type))) return null;
+  }
+  return new Response(`Cross-site ${request.method} form submissions are forbidden`, { status: 403 });
+}

package/apps/storefront/src/lib/tenantRouting.ts

@@ -54,6 +54,23 @@ function normalizePath(path: string): string {
   return trimmed === "" ? "/" : trimmed;
 }
 
+/**
+ * Routing for an authenticated CDN forward (lib/cdnForward.ts). The forward names
+ * its tenant outright and renders at the apex, as the tenant's own host would.
+ * Only a tenant served from CloudFront static storage (`serving.provider:
+ * "s3-overwrite"`) has a distribution that forwards here; any other resolves to
+ * no tenant, which refuses the request.
+ */
+export async function resolveCdnForwardRouting(
+  forward: { tenantId: string },
+  pathname: string,
+  resolver: TenantResolver,
+): Promise<TenantRouting> {
+  const tenant = await resolver.resolveStrict(forward.tenantId);
+  const served = tenant && tenant.tenant_id === forward.tenantId && tenant.serving?.provider === "s3-overwrite";
+  return { tenant: served ? tenant : null, basePath: "", renderPath: normalizePath(pathname) };
+}
+
 export async function resolveTenantRouting(
   host: string,
   pathname: string,

package/apps/storefront/src/middleware/index.ts

@@ -22,7 +22,8 @@
 import { defineMiddleware } from "astro:middleware";
 import { getTenantResolver } from "@/config/resolver";
 import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
-import { resolveTenantRouting } from "@/lib/tenantRouting";
+import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/tenantRouting";
+import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/cdnForward";
 import { compileRouteTierIndexV1, type RouteTierIndexV1 } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
@@ -67,7 +68,7 @@ function routeTierIndexFor(tenant: TenantConfig): RouteTierIndexV1 {
 export const onRequest = defineMiddleware(async (context, next) => {
   const { request, locals } = context;
   const url = new URL(request.url);
-  const host =
+  let host =
     request.headers.get("host") ?? url.host ?? "localhost";
 
   // ---- Activity telemetry kill switch -----------------------------
@@ -102,6 +103,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
     return maintenanceResponse();
   }
 
+  // ---- CDN-forwarded Tier 3 request (ADR 0013) ------------------------------
+  // A static tenant's CloudFront distribution routes its Tier 3 prefixes here.
+  // The authenticated forward names the tenant and the viewer's Host; every
+  // host-keyed decision below (gates, canonical base, the origin check) then sees
+  // the host the viewer addressed, never this Worker's own.
+  const cdn = await verifyCdnForward(request.headers, await readEnv("CDN_ORIGIN_SECRET"));
+  if (cdn) host = cdn.viewerHost;
+  const origin = cdn ? `https://${cdn.viewerHost}` : url.origin;
+  const crossSite = crossSiteFormRefusal(request, origin);
+  if (crossSite) return crossSite;
+
   // Demo access gate for named hosts (DEMO_GATE_HOSTS). Two modes, switched by
   // DEMO_GATE_MODE:
   //   "password" (default) — interim Basic-Auth gate, enforced HERE (host-level,
@@ -124,11 +136,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
   // selects one (DNS-free tenant selection on localhost/preview). The resolver
   // is KV-backed in prod (many-tenant) and static in plain dev.
   const resolver = await getTenantResolver();
-  const { tenant, basePath, renderPath } = await resolveTenantRouting(
-    host,
-    url.pathname,
-    resolver,
-  );
+  const { tenant, basePath, renderPath } = cdn
+    ? await resolveCdnForwardRouting(cdn, url.pathname, resolver)
+    : await resolveTenantRouting(host, url.pathname, resolver);
   if (!tenant) {
     return new Response("Unknown host", { status: 404 });
   }
@@ -153,7 +163,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
       status: 308,
       headers: {
         location: publicationRedirectLocationV1({
-          origin: url.origin,
+          origin,
           basePath,
           plan: publication,
           search: url.search,
@@ -193,7 +203,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
         status: 308,
         headers: {
           location: publicationRedirectLocationV1({
-            origin: url.origin,
+            origin,
             basePath,
             plan: publication,
             search: url.search,
@@ -268,7 +278,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     });
     if (bundled) return bundled;
     const rootLocation = platformStaticRootLocationV1({
-      origin: url.origin,
+      origin,
       basePath,
       renderPath,
       search: url.search,

package/apps/storefront/src/pages/api/newsletter/unsubscribe.ts

@@ -14,8 +14,8 @@
  * (re-unsubscribing is a no-op success) and NON-LEAKING: an unknown token gets the exact
  * same response as a real one, so an observer can't probe which tokens exist.
  *
- * NOTE (integration): Astro's global `security.checkOrigin` (default-on for a server
- * build) 403s a cross-origin form-encoded POST before it reaches this handler, which
+ * NOTE (integration): The front door.s cross-site form check (lib/cdnForward.ts `crossSiteFormRefusal`,
+ * the rule Astro.s `security.checkOrigin` applies) 403s a cross-origin form-encoded POST before it reaches this handler, which
  * would break the RFC 8058 one-click POST from a mailbox provider. See the unit report.
  */
 import type { APIContext } from "astro";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.37",
+  "version": "2.2.38",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",