@tokenoftrust/storefront-runner 2.3.2 → 2.4.1

package/apps/storefront/env.d.ts

@@ -206,14 +206,17 @@ declare global {
        * gate once a valid, resource-bound `tot_session` cookie is present). Carries
        * the opaque subject, email + role(s)/capability tot20 resolved on this tenant, so chrome
        * can show "signed in as … — owner/developer/staff". Absent on open or
-       * password-gated hosts.
+       * password-gated hosts. Chrome only: authorization reads the session record for the
+       * routed tenant (lib/pipeline/admission-request), never this.
        */
       viewer?: {
         /** Opaque identity-provider subject from the verified session assertion. */
         subject?: string;
         email: string;
+        /** The viewer's standing on THIS host's tenant, as a one-element list; empty when none. */
         roles: string[];
-        capability: string;
+        /** The viewer's standing on THIS host's tenant; null when the session holds none here. */
+        capability: string | null;
       };
       /** Cloudflare runtime (env bindings) — provided by the adapter on Workers. */
       runtime?: { env: CloudflareEnv };

package/apps/storefront/src/components/auth/AuthBadge.astro

@@ -17,7 +17,8 @@ const CAP_LABEL: Record<string, string> = {
   inviter: "Inviter",
   staff: "ToT Staff",
 };
-const label = viewer ? (CAP_LABEL[viewer.capability] ?? viewer.capability) : "";
+// The capability is the viewer's standing on THIS store only; null = none here.
+const label = viewer?.capability ? (CAP_LABEL[viewer.capability] ?? viewer.capability) : "";
 ---
 
 {viewer && (
@@ -29,9 +30,11 @@ const label = viewer ? (CAP_LABEL[viewer.capability] ?? viewer.capability) : "";
     <span aria-hidden="true">🔓</span>
     <span class="text-[var(--color-muted)]">Signed in as</span>
     <span class="font-semibold">{viewer.email}</span>
-    <span class="rounded-full bg-[var(--color-primary)] px-2 py-0.5 font-semibold text-[var(--color-primary-contrast)]">
-      {label}
-    </span>
+    {label && (
+      <span class="rounded-full bg-[var(--color-primary)] px-2 py-0.5 font-semibold text-[var(--color-primary-contrast)]">
+        {label}
+      </span>
+    )}
     <form method="post" action="/api/auth/logout" class="contents">
       <button
         type="submit"

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -49,6 +49,7 @@ import type {
 } from "@tot/public-runtime";
 import type { ActionKey } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/auth/route";
+import { sessionHostCapability } from "@/lib/auth/loginGate";
 import { isStaffSession } from "@/lib/dashboard/staffAdmission";
 import { readEnv } from "@/lib/env";
 import { isOwnerCapability } from "@/lib/shared/capability";
@@ -57,7 +58,7 @@ import { hashActorId, recordActivity } from "./recordActivity";
 /** The minimal viewer chrome the middleware stamps on `locals.viewer`. */
 interface ViewerLike {
   email?: string;
-  capability?: string;
+  capability?: string | null;
 }
 
 /**
@@ -107,14 +108,14 @@ export async function resolveUiActor(
   // The host-bound `locals.viewer` chrome omits `staff[]`, so read the full session
   // to tell a ToT-staff (admin) actor from a store owner (merchant). Best-effort.
   const session = await readViewerSession(context).catch(() => null);
-  // Prefer the host-scoped `locals.viewer` (set by middleware for tenant-gated
-  // surfaces — the ship/grants routes); fall back to the raw session's
-  // email/capability for a route that never went through that host gate (e.g. the
-  // /dev cockpit's rendezvous-approval endpoint) but still has a real signed-in
-  // viewer. Both describe the SAME signed-in-or-not shape.
-  const viewer: ViewerLike | undefined =
-    (context.locals?.viewer as ViewerLike | undefined) ??
-    (session ? { email: session.email, capability: session.capability } : undefined);
+  // The signed-in identity is the host gate's `locals.viewer`, else the raw session (a
+  // route that never went through that gate, e.g. the /dev cockpit's rendezvous
+  // approval). Ownership is the session's standing on the ROUTED tenant only — a
+  // session that owns another store is not this store's merchant.
+  const email = context.locals?.viewer?.email ?? session?.email;
+  const viewer: ViewerLike | undefined = email
+    ? { email, capability: sessionHostCapability(session, context.locals?.tenant?.appDomain ?? "") }
+    : undefined;
   const kind = classifyActorKind(viewer, session);
   const identifier = viewer?.email ?? input.owner ?? "system";
   const id = await hashActorId(identifier, await readEnv("ACTIVITY_ACTOR_SALT"));

package/apps/storefront/src/lib/auth/adminApiGuard.ts

@@ -10,7 +10,8 @@
  *
  *   no session                        → 401 sign_in_required
  *   session, but no standing for THIS tenant → 403 not_authorized
- *   member/owner (or staff) of THIS tenant   → allowed, entry returned
+ *     (ToT staff without a live vendor selection for THIS tenant included)
+ *   member/owner of THIS tenant, or staff holding a live selection for it → allowed
  *
  * The decision core is PURE (unit-testable); `requireAdminApiEntry` is the thin
  * Astro/I-O wrapper the routes call.
@@ -28,9 +29,9 @@ export type AdminApiAccess =
  * PURE fail-closed decision for a tenant-scoped admin API caller.
  *
  * @param requireOwner when true, only an owner/admin viewer OR a ToT-staff viewer
- *   passes (a plain team member is refused) — for routes that mutate/expose
- *   owner-level operational surfaces. Default (false) admits any member/owner/staff
- *   of the tenant, matching who reaches the admin shell.
+ *   holding a live, audited selection for THIS tenant passes (a plain team member is
+ *   refused) — for routes that mutate/expose owner-level operational surfaces.
+ *   Default (false) admits anyone with standing on the tenant.
  */
 export function decideAdminApiAccess(input: {
   record: SessionRecord | null | undefined;
@@ -42,9 +43,8 @@ export function decideAdminApiAccess(input: {
   if (!record) return { ok: false, status: 401, reason: "sign_in_required" };
 
   const entry = resolveAdminEntry({ record, hostResource, nowSeconds });
-  const staffScope = Array.isArray(record.staff) && record.staff.length > 0;
   const authorized = requireOwner
-    ? entry.isOwnerViewer || staffScope
+    ? entry.isOwnerViewer || entry.staffSelected
     : entry.admitted;
   if (!authorized) return { ok: false, status: 403, reason: "not_authorized" };
 

package/apps/storefront/src/lib/auth/adminEntry.ts

@@ -23,13 +23,15 @@
  *     owner is the ONLY source of `shipOnBehalf`/`apexCutover` here.
  *
  * The distinguishing logic: `admitted`
- * separates an authenticated OWNER/member (a host-bound capability, or ToT-staff
- * scope) — who must NEVER see the "Coming soon" holding page at their own admin —
- * from an authenticated NON-member and an anonymous visitor, who legitimately do
- * not enter. `principal` labels which of those four cases this is.
+ * separates an authenticated OWNER/member (a host-bound capability, which for ToT
+ * staff means a LIVE, audited vendor selection for THIS host) from an authenticated
+ * NON-member, staff without a selection for this store, and an anonymous visitor —
+ * none of whom act on this store's admin. Staff scope alone is a browsing
+ * admission at the login gate, never an admin one. `principal` labels the case.
  */
 import type { SessionRecord } from "./session.js";
 import { sessionHostCapability } from "./loginGate.js";
+import { staffAdmits } from "@/lib/dashboard/tenantSelection";
 import {
   decideIsOwner,
   isOwnerCapability,
@@ -49,11 +51,13 @@ export type AdminEntryPrincipal =
 
 export interface AdminEntryDecision {
   /**
-   * True when the viewer is an owner/member of this tenant (host-bound capability)
-   * or a ToT-staff viewer — i.e. reaches the admin context, never the gate. False
-   * for an authenticated non-member and an anonymous visitor (the legit gate).
+   * True when the viewer holds standing on this tenant (membership, a session scoped
+   * to it, or a live staff selection for it). False for an authenticated non-member,
+   * staff without a selection for this store, and an anonymous visitor.
    */
   admitted: boolean;
+  /** A ToT-staff viewer holding a LIVE, audited vendor selection for THIS host. */
+  staffSelected: boolean;
   /** The owner/admin/member standing bound to this host, or null. */
   hostCapability: string | null;
   /** The acting viewer IS the tenant owner/admin (superset of ship-on-behalf). */
@@ -88,7 +92,10 @@ export function resolveAdminEntry(input: {
   const { record, hostResource, nowSeconds, shipGrant } = input;
   const hostCapability = sessionHostCapability(record ?? null, hostResource, nowSeconds);
   const staffScope = Array.isArray(record?.staff) && record!.staff.length > 0;
-  const admitted = hostCapability !== null || staffScope;
+  const staffSelected =
+    staffScope && staffAdmits({ selection: record?.staffSelection, nowSeconds }, (hostResource ?? "").trim());
+  // Standing on THIS host only; a staff selection for this host is part of it.
+  const admitted = hostCapability !== null;
 
   // Owner resolution — the OWNER VIEWER, not the bearer console: authorized
   // (a member/staff viewer of THIS tenant) AND holding an owner/admin capability.
@@ -115,5 +122,5 @@ export function resolveAdminEntry(input: {
         ? "staff"
         : "authenticated-non-member";
 
-  return { admitted, hostCapability, isOwnerViewer, shipCapabilities, principal };
+  return { admitted, staffSelected, hostCapability, isOwnerViewer, shipCapabilities, principal };
 }

package/apps/storefront/src/lib/auth/operatorSession.ts

@@ -10,6 +10,8 @@
  * viewer that lacks that capability is treated.
  */
 import type { APIContext } from "astro";
+import { readViewerSession } from "./route.js";
+import { sessionHostCapability } from "./loginGate.js";
 
 /** The host-bound viewer chrome the middleware sets on `locals.viewer`. */
 type Viewer = NonNullable<APIContext["locals"]["viewer"]>;
@@ -89,9 +91,12 @@ export interface HostBoundSessionConfig<T> {
 }
 
 /**
- * Two-path host-bound operator session: a signed-in `locals.viewer` on the
+ * Two-path host-bound operator session: a signed-in viewer on the
  * middleware-resolved `locals.tenant` (path 1), else the Bearer gate (path 2).
- * The tenant is ALWAYS the resolved host `appDomain` — never the request body.
+ * The tenant is ALWAYS the resolved host `appDomain` — never the request body —
+ * and the viewer's standing is read from the session record FOR THAT TENANT
+ * (`sessionHostCapability`), never from the `locals.viewer` chrome, so standing the
+ * session holds on another store never authorizes here.
  * When no viewer/tenant pair is present, or a present viewer is insufficient
  * under a `fallThrough` policy, path 2 decides.
  */
@@ -102,7 +107,9 @@ export async function resolveHostBoundSession<T>(
   const viewer = context.locals?.viewer;
   const tenant = context.locals?.tenant?.appDomain;
   if (viewer && tenant) {
-    if (config.capabilities.has(viewer.capability)) {
+    const session = await readViewerSession(context).catch(() => null);
+    const standing = sessionHostCapability(session, tenant);
+    if (standing !== null && config.capabilities.has(standing)) {
       return config.resolveViewer(viewer, tenant);
     }
     if (config.onInsufficientCapability.mode === "failClosed") {

package/apps/storefront/src/middleware/controlPlane.ts

@@ -196,12 +196,13 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
     }
     if (admitted && viewerRecord) {
       // Surface the viewer's standing FOR THIS host's tenant as chrome, BOUND to
-      // the host so a capability the session holds for another tenant never leaks
-      // in: a member sees their tenants[] role; the owner of their own tenant sees
-      // the resource-scoped session's capability; a ToT-staff viewer admitted via
-      // an explicit vendor selection sees the staffRoles-scoped capability. The
-      // ship gates (decideIsOwner/resolveShipPrincipal) read this capability,
-      // so binding it here keeps owner-resolution server-side + tenant-correct.
+      // the host: a member sees their tenants[] role; the owner of their own tenant
+      // sees the resource-scoped session's capability; a ToT-staff viewer admitted
+      // via an explicit vendor selection sees the selection's capability. A viewer
+      // with no standing here (staff browsing without a selection) carries none —
+      // the session's standing on any other store never appears on this host.
+      // Authorization never reads this chrome: admission resolves standing from the
+      // session record for the routed tenant (lib/pipeline/admission-request).
       //
       // On an admin path, "the host" a staff viewer is really acting on is the
       // ?asTenant= impersonation target (mirrors admin.astro/AdminPublishTab.astro's
@@ -221,8 +222,8 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
       locals.viewer = {
         ...(viewerRecord.subject ? { subject: viewerRecord.subject } : {}),
         email: viewerRecord.email,
-        roles: hostCapability ? [hostCapability] : viewerRecord.roles,
-        capability: hostCapability ?? viewerRecord.capability,
+        roles: hostCapability ? [hostCapability] : [],
+        capability: hostCapability,
       };
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.3.2",
+  "version": "2.4.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",