@tokenoftrust/storefront-runner 2.3.0 → 2.3.2

package/apps/storefront/src/config/devTenantSeed.ts

@@ -26,6 +26,7 @@
  * tenancy-resolver-fence — the concrete registry stays behind the config boundary.
  */
 import type { DeepPartial, TenantConfig, ThemeTokens } from "@tot/public-runtime";
+import { SHARED_DEMO_CHECKOUT } from "@tot/public-runtime";
 import { rootPublicationSpaceConfig } from "./publicationSpaceConfig";
 import { loadTenantAnalyticsDeclarations } from "@/lib/integration/tenantAnalyticsDeclarations";
 
@@ -94,12 +95,14 @@ export function synthesizeDevTenant(
     ...(euUkVisitors ? { euUkVisitors } : {}),
   };
   // Cart wires to the shared ToT demo checkout store (test mode, no secret), the
-  // same as the bundled demo tenants. A marketing tenant never resolves it (the
+  // same as the bundled demo tenants — and the SAME constant the hosted QA/test
+  // tier's demo-checkout fallback reuses (checkoutCommerce.ts), so both surfaces
+  // stay wired to one definition. A marketing tenant never resolves it (the
   // render chain gates on features.catalog); a commerce one gets its cart
   // affordance and /cart on localhost whether or not it has catalog files yet.
   return {
     ...base,
-    commerce: { checkout: { storeSubDomain: "tot-preview", mode: "unsigned-demo" } },
+    commerce: { checkout: SHARED_DEMO_CHECKOUT },
   };
 }
 

package/apps/storefront/src/lib/checkoutCommerce.ts

@@ -11,19 +11,31 @@
  *   - `FOXY_CART_SECRET` is the cart-validation secret used only in `signed`
  *     mode; the `unsigned-demo` mode never reads it (validation is OFF), which
  *     is what lets a developer run the whole cart locally with zero secrets.
+ *
+ * `COMMERCE_DEMO_CHECKOUT_TIER` gates a FALLBACK for a commerce tenant that has
+ * no `commerce.checkout` of its own (e.g. a staff-provisioned store —
+ * buildStaffTenantConfig projects a minimal record with none). Declared-tier
+ * config, not a tenant check: "test" reuses the exact SHARED_DEMO_CHECKOUT the
+ * local dev loop wires (synthesizeDevTenant), so a staff-provisioned store's
+ * cart renders on hosted QA preview the same as it does under `tot dev`. Any
+ * other value — including unset, the PRODUCTION default — fails CLOSED to no
+ * cart: an unpaid production store's preview IS its public site, so a demo
+ * checkout must never appear there. A tenant's own declared checkout always
+ * wins; this only fills in when `commerce.checkout` is absent.
  */
 import type { TenantConfig, ResolvedManagedCheckout } from "@tot/public-runtime";
-import { resolveManagedCheckout } from "@tot/public-runtime";
+import { resolveManagedCheckout, SHARED_DEMO_CHECKOUT } from "@tot/public-runtime";
 import { readEnv } from "@/lib/runtimeEnv";
 
 /**
  * Resolve the effective checkout facts for a tenant, or null when the tenant has
- * no store configured. Applies the checkout env overrides.
+ * no store configured (its own, or the QA/test-tier demo fallback). Applies the
+ * checkout env overrides.
  */
 export async function resolveTenantCommerce(
   tenant: TenantConfig,
 ): Promise<ResolvedManagedCheckout | null> {
-  const checkout = tenant.commerce?.checkout;
+  const checkout = tenant.commerce?.checkout ?? (await demoCheckoutFallback());
   if (!checkout) return null;
   // Per-environment overrides so the SAME tenant can point at different stores /
   // checkout hosts by env: FOXY_STORE_SUBDOMAIN picks the checkout store;
@@ -38,6 +50,17 @@ export async function resolveTenantCommerce(
   return resolveManagedCheckout({ ...checkout, storeSubDomain, storeDomain });
 }
 
+/**
+ * The QA/test-tier-only demo-checkout fallback, or undefined when this
+ * environment hasn't declared itself eligible. Fails closed: only the literal
+ * value "test" enables it, so an unset var (today's only production-shaped
+ * state — there is no `[env.production]` block yet) never does.
+ */
+async function demoCheckoutFallback() {
+  const tier = await readEnv("COMMERCE_DEMO_CHECKOUT_TIER");
+  return tier === "test" ? SHARED_DEMO_CHECKOUT : undefined;
+}
+
 /**
  * The cart-validation secret for signed mode. Returns undefined in
  * `unsigned-demo` mode (never needed) or when unset. A signed-mode tenant with

package/apps/storefront/src/lib/dashboard/delegateGate.ts

@@ -36,7 +36,7 @@ export type DelegateSection = { mode: "unpaid"; role: null; explanation: string
 /**
  * Resolve the whole delegate section. Before a store is paid there is no live
  * site and preview-access developers can already add changes to the release
- * (`canAddToRelease`), so delegation has nothing to grant: every viewer, the
+ * (the `merge-to-preview` admission class, lib/pipeline/admission.ts), so delegation has nothing to grant: every viewer, the
  * owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store resolves
  * {@link resolveDelegateGate} unchanged.
  */

package/apps/storefront/src/lib/shared/capability.ts

@@ -16,6 +16,18 @@
 /** Access level the acting operator holds. */
 export type Capability = "preview-access" | "ship-on-behalf";
 
+const CAPABILITIES: readonly Capability[] = ["preview-access", "ship-on-behalf"];
+
+/**
+ * The console operator's capability from env + request. Pure decision over the two inputs;
+ * fail-closed to `preview-access`. Only call AFTER the operator Bearer has been authenticated (so
+ * the header is trusted).
+ */
+export function decideCapability(configured: string | undefined, requested: string | null): Capability {
+  const raw = (configured ?? requested ?? "").trim();
+  return CAPABILITIES.includes(raw as Capability) ? (raw as Capability) : "preview-access";
+}
+
 /** Complete tenant-role vocabulary emitted by verified identity assertions. */
 export const TENANT_ROLES = ["owner", "admin", "member"] as const;
 export type TenantRole = (typeof TENANT_ROLES)[number];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -59,6 +59,19 @@ export interface ManagedCheckoutConfig {
   cartDrawerCss?: string;
 }
 
+/**
+ * The ONE shared ToT-owned demo checkout store (test mode, cart validation
+ * OFF, no secret). The local dev loop (`synthesizeDevTenant`) wires every
+ * local commerce checkout to this exact config; the hosted QA/test tier's
+ * demo-checkout fallback (`resolveTenantCommerce`) reuses this same constant
+ * rather than a second copy of the literal, so "the same as `tot dev`" stays
+ * true by construction instead of by two authors agreeing.
+ */
+export const SHARED_DEMO_CHECKOUT: ManagedCheckoutConfig = {
+  storeSubDomain: "tot-preview",
+  mode: "unsigned-demo",
+};
+
 /** Resolved, request-scoped commerce facts stashed on `Astro.locals`. */
 export interface ResolvedManagedCheckout extends ManagedCheckoutConfig {
   /** `https://<storeDomain>` — the loader + cart origin (for CSP + links). */

package/apps/storefront/src/lib/shared/addToRelease.ts

@@ -1,32 +0,0 @@
-/**
- * Who may Add to release — integrate an accepted change into the store's
- * `preview` release. Pure; shared by the integrate/resolve admission, the
- * Publish console, and the Team page so all three answer one question.
- */
-import { storefrontModeAllowsGoLive } from "@tot/public-runtime";
-import { isOwnerCapability, type Capability } from "./capability";
-
-/** Pure inputs to the Add-to-release decision. */
-export interface AddToReleaseInput {
-  /** The viewer's standing over THIS tenant (owner/admin/member), if any. */
-  capability: string | null | undefined;
-  /** The viewer's live ship grant over this tenant. */
-  shipGrant: Capability;
-  /** True only when the viewer's access is bound to THIS tenant. */
-  tenantScoped: boolean;
-  /** The tenant's storefront mode — `"enabled"` means the store is paid. */
-  storefrontMode: string | null | undefined;
-}
-
-/**
- * May this viewer add an accepted change to the store's `preview` release?
- *
- * Owner/admin standing or a ship-on-behalf grant always may. Before a store is
- * paid there is no live site, so preview IS the site: a developer whose access is
- * scoped to this tenant may add without a ship-on-behalf grant. Once the store is
- * paid, the preview/live split and ship-on-behalf delegation apply.
- */
-export function canAddToRelease(input: AddToReleaseInput): boolean {
-  if (isOwnerCapability(input.capability) || input.shipGrant === "ship-on-behalf") return true;
-  return input.tenantScoped && !storefrontModeAllowsGoLive(input.storefrontMode);
-}