@tokenoftrust/storefront-runner 2.2.77 → 2.2.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.2.77",
+  "version": "2.2.78",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/integration/consent-broker.ts

@@ -492,7 +492,7 @@ export type ViewerAnalyticsConsentDecision = "granted" | "denied";
 export interface ViewerAnalyticsConsentState {
   schemaVersion: 1;
   decision: ViewerAnalyticsConsentDecision;
-  source: "tenant-default" | "default-deny" | "stored" | "global-privacy-control";
+  source: "tenant-default" | "default-deny" | "stored" | "stored-invalid" | "global-privacy-control";
   canGrant: boolean;
   expiresAt: number | null;
   retentionDays: typeof VIEWER_ANALYTICS_CONSENT_RETENTION_DAYS;
@@ -596,51 +596,68 @@ export function applyEarlyViewerAnalyticsConsent(
   const globalPrivacyControl = win.navigator?.globalPrivacyControl === true;
 
   let stored: { decision: ViewerAnalyticsConsentDecision; expiresAt: number } | null = null;
+  // A stored record that is present but unreadable may have been a denial, so it denies
+  // rather than falling through to a granting tenant default. Only a well-formed record
+  // past its retention lapses to the default.
+  let storedInvalid = false;
   if (override) {
     stored = { decision: override, expiresAt: now + retentionMs };
   } else {
+    let raw: string | null | undefined;
     try {
-      const raw = win.localStorage?.getItem(scopedStorageKey);
-      if (raw) {
-        const parsed = JSON.parse(raw) as Record<string, unknown>;
-        const keys = Object.keys(parsed).sort();
-        const decidedAt = parsed["decidedAt"];
-        const expiresAt = parsed["expiresAt"];
-        const decision = parsed["decision"];
-        if (
-          keys.join(",") === "decidedAt,decision,environment,expiresAt,schemaVersion,siteSurface,tenantPublicId" &&
-          parsed["schemaVersion"] === 1 &&
-          parsed["tenantPublicId"] === tenantPublicId &&
-          parsed["environment"] === environment &&
-          parsed["siteSurface"] === siteSurface &&
-          (decision === "granted" || decision === "denied") &&
-          typeof decidedAt === "number" &&
-          Number.isFinite(decidedAt) &&
-          typeof expiresAt === "number" &&
-          Number.isFinite(expiresAt) &&
-          decidedAt <= now &&
-          expiresAt > now &&
-          expiresAt - decidedAt === retentionMs
-        ) {
-          stored = { decision, expiresAt };
-        }
-      }
+      raw = win.localStorage?.getItem(scopedStorageKey);
     } catch {
-      // Storage denial, malformed data, and hostile access all fail closed.
+      // Storage denial leaves no viewer decision to read.
+    }
+    if (raw) {
+      let parsed: unknown = null;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        // Malformed data is handled as an invalid record below.
+      }
+      const record = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+        ? parsed as Record<string, unknown>
+        : null;
+      const decidedAt = record?.["decidedAt"];
+      const expiresAt = record?.["expiresAt"];
+      const decision = record?.["decision"];
+      if (
+        record !== null &&
+        Object.keys(record).sort().join(",") ===
+          "decidedAt,decision,environment,expiresAt,schemaVersion,siteSurface,tenantPublicId" &&
+        record["schemaVersion"] === 1 &&
+        record["tenantPublicId"] === tenantPublicId &&
+        record["environment"] === environment &&
+        record["siteSurface"] === siteSurface &&
+        (decision === "granted" || decision === "denied") &&
+        typeof decidedAt === "number" &&
+        Number.isFinite(decidedAt) &&
+        typeof expiresAt === "number" &&
+        Number.isFinite(expiresAt) &&
+        decidedAt <= now &&
+        expiresAt - decidedAt === retentionMs
+      ) {
+        if (expiresAt > now) stored = { decision, expiresAt };
+      } else {
+        storedInvalid = true;
+      }
     }
   }
 
   const decision: ViewerAnalyticsConsentDecision =
-    globalPrivacyControl || !tenantApprovedAnalytics
+    globalPrivacyControl || !tenantApprovedAnalytics || (!stored && storedInvalid)
       ? "denied"
       : stored?.decision ?? (tenantDefaultAnalytics ? "granted" : "denied");
   const source: ViewerAnalyticsConsentState["source"] = globalPrivacyControl
     ? "global-privacy-control"
     : stored
       ? "stored"
-      : tenantDefaultAnalytics
-        ? "tenant-default"
-        : "default-deny";
+      : storedInvalid
+        ? "stored-invalid"
+        : tenantDefaultAnalytics
+          ? "tenant-default"
+          : "default-deny";
 
   const eligible = canonicalPurposes.filter(
     (purpose) =>