@tokenoftrust/storefront-runner 2.2.44 → 2.2.46

package/apps/storefront/src/lib/tenantOrigins.ts

@@ -0,0 +1,14 @@
+import type { TenantConfig } from "@tot/public-runtime";
+
+/**
+ * The tenant's own public origins: `https://<host>` for every declared domain and the canonical
+ * domain, deduped and sorted. The one derivation every image scan uses — the Worker's capture and
+ * review scans read it directly, and the static publish scan reads it from the bundle manifest
+ * (the render reports it to the materializer) — so an absolute reference to the tenant's own site
+ * is classified by path everywhere, never as a third-party hotlink in one place only.
+ */
+export function declaredTenantOrigins(tenant: Pick<TenantConfig, "domains" | "canonicalDomain">): string[] {
+  const hosts = [...(tenant.domains ?? []), tenant.canonicalDomain]
+    .filter((host): host is string => typeof host === "string" && host.length > 0);
+  return [...new Set(hosts.map((host) => `https://${host.toLowerCase()}`))].sort();
+}

package/apps/storefront/src/middleware/renderChain.ts

@@ -96,6 +96,7 @@ import {
 } from "@/lib/integration/renderIntegrationState";
 import { recordActivity } from "@/lib/activity/recordActivity";
 import { middlewareRewriteTargetV1 } from "./routeBranch.js";
+import { declaredTenantOrigins } from "@/lib/tenantOrigins";
 import {
   applyInternalContentResponsePolicy,
   internalContentGrantMatchesPlan,
@@ -142,6 +143,9 @@ export interface RenderChainInput {
   internalContentGrant?: InternalContentGrant;
 }
 
+/** Materialize-only response header: the tenant's declared origins, comma-separated. */
+export const TENANT_ORIGINS_CAPTURE_HEADER = "x-tot-tenant-origins";
+
 export async function runRenderChain(input: RenderChainInput): Promise<Response> {
   const { context, next, host, url, tenant, basePath, renderPath, cache, kv } = input;
   const { request, locals } = context;
@@ -817,6 +821,11 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
       HTML_CACHE_POLICY_CAPTURE_HEADER,
       formatHtmlCacheControl(locals.tenant?.serving?.htmlCachePolicy),
     );
+    // The tenant's declared origins — the same `domains` the Worker's own image scans use. The
+    // materializer ships images a page references absolutely on them (og:image is always
+    // absolute), and the publish scan classifies such references by path instead of as
+    // third-party hotlinks.
+    response.headers.set(TENANT_ORIGINS_CAPTURE_HEADER, declaredTenantOrigins(tenant).join(","));
   }
   if (isInternalPublication) applyInternalContentResponsePolicy(response.headers);
   // Stamp a fresh per-response nonce into this cold response's body + CSP header

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.44",
+  "version": "2.2.46",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",