@tokenoftrust/storefront-runner 2.4.32 → 2.4.33

package/apps/storefront/src/lib/integration/nonceStamp.ts

@@ -37,6 +37,19 @@ export function stampInlineTagNonces(html: string, nonce: string): string {
   );
 }
 
+/**
+ * True when a CSP header already names a live nonce: a render-chain pass completed
+ * this response, stamping its header and document as one pair. Any further pass must
+ * serve it verbatim — re-stamping replaces the header's nonce but not the document's,
+ * and the browser then blocks every inline style and script on the page.
+ */
+export function carriesLiveNonce(response: Response): boolean {
+  return CSP_HEADERS.some((header) => {
+    const value = response.headers.get(header);
+    return !!value && value.includes("'nonce-") && !value.includes(INTEGRATION_NONCE_PLACEHOLDER);
+  });
+}
+
 /** A fresh, non-guessable per-response nonce. */
 export function freshNonce(): string {
   return crypto.randomUUID();

package/apps/storefront/src/middleware/renderChain.ts

@@ -92,8 +92,7 @@ import {
   deriveSiteSurface,
   cspHeaderName,
 } from "@/lib/integration/browserEnvironment";
-import { freshNonce, stampResponseNonce } from "@/lib/integration/nonceStamp";
-import { takePinnedRouteRewriteResponse } from "@/lib/pinnedRouteRewriteBoundary";
+import { carriesLiveNonce, freshNonce, stampResponseNonce } from "@/lib/integration/nonceStamp";
 import {
   composeIntegrationDeclarations,
   resolveIntegrationRenderState,
@@ -713,13 +712,11 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
     ? await next(rewriteTarget)
     : await next();
 
-  // A pinned generic-route fallback uses `context.rewrite()`, which runs the
-  // rewritten route through this middleware and hands back a fully decorated,
-  // CSP-stamped response. Preserve that inner response verbatim. Running the
-  // outer decoration path again would inject preview helpers twice and replace
-  // the CSP nonce without replacing the already-live nonce in the document.
-  const pinnedRewriteResponse = takePinnedRouteRewriteResponse(response);
-  if (pinnedRewriteResponse) return pinnedRewriteResponse;
+  // A nested pass of this middleware — an in-process `rewrite()`, or Astro re-running
+  // middleware for its error route — already decorated and nonce-stamped the
+  // response. Serve it verbatim: decorating again would inject preview helpers twice
+  // and replace the header's nonce while the document keeps the inner one.
+  if (carriesLiveNonce(response)) return response;
 
   // On-publish auto-refresh: inject the live-reload client into SHARED preview
   // (`test`) HTML pages ONLY — never `live` (keeps live clean + edge-cacheable).

package/apps/storefront/src/pages/[...slug].astro

@@ -14,7 +14,6 @@ import { breadcrumbLd } from "@/lib/jsonld";
 import { truncate } from "@/lib/format";
 import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml";
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
-import { rewriteThroughRenderChain } from "@/lib/pinnedRouteRewriteBoundary";
 import { styleGuideAliasRewrite } from "@/lib/styleGuidePaths";
 
 const { tenant, canonicalBase, content, basePath, capabilities, features } = Astro.locals;
@@ -38,7 +37,7 @@ if (
 // never reskin the live site.
 const styleGuideTarget = styleGuideAliasRewrite(basePath, slug, Astro.url.search);
 if (styleGuideTarget !== undefined) {
-  return rewriteThroughRenderChain(Astro, styleGuideTarget);
+  return Astro.rewrite(styleGuideTarget);
 }
 
 // Raw tenant-authored marketing subpage (vendor-injected HTML) — serve the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.32",
+  "version": "2.4.33",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/apps/storefront/src/lib/pinnedRouteRewriteBoundary.ts

@@ -1,49 +0,0 @@
-/**
- * Private response marker for the in-process route rewrite boundary.
- *
- * `context.rewrite()` runs the rewritten request through middleware and returns
- * a complete response: preview helpers, security headers, CSP, and the live
- * nonce have already been applied. The outer render chain must pass those bytes
- * through instead of decorating and nonce-stamping them a second time — a second
- * stamp replaces the CSP header's nonce while the document keeps the inner one,
- * so the browser blocks every inline style and script on the page.
- *
- * The marker exists only while the inner response unwinds through the outer
- * middleware pass. `takePinnedRouteRewriteResponse` removes it before the
- * response reaches a client.
- *
- * Every in-process rewrite goes through {@link rewriteThroughRenderChain};
- * `pinnedRouteRewriteBoundary.test.ts` refuses a bare `.rewrite(` anywhere else.
- */
-export const PINNED_ROUTE_REWRITE_COMPLETE_HEADER =
-  "x-tot-internal-pinned-route-rewrite-complete";
-
-export function markPinnedRouteRewriteComplete(response: Response): Response {
-  response.headers.set(PINNED_ROUTE_REWRITE_COMPLETE_HEADER, "1");
-  return response;
-}
-
-export function takePinnedRouteRewriteResponse(response: Response): Response | null {
-  if (response.headers.get(PINNED_ROUTE_REWRITE_COMPLETE_HEADER) !== "1") return null;
-
-  const headers = new Headers(response.headers);
-  headers.delete(PINNED_ROUTE_REWRITE_COMPLETE_HEADER);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
-}
-
-/**
- * Rewrite in-process and mark the completed response so the outer middleware pass
- * serves it verbatim. The response a rewrite hands back may be immutable, so it is
- * copied before the marker (and any caller headers) are set.
- */
-export async function rewriteThroughRenderChain(
-  context: { rewrite(path: string): Promise<Response> },
-  path: string,
-): Promise<Response> {
-  const rendered = await context.rewrite(path);
-  return markPinnedRouteRewriteComplete(new Response(rendered.body, rendered));
-}