@tokenoftrust/storefront-runner 2.4.41 → 2.4.43

package/apps/storefront/package.json

@@ -14,7 +14,7 @@
     "preview": "wrangler dev",
     "typecheck": "astro check && tsc --noEmit",
     "astro": "astro",
-    "test": "NODE_OPTIONS=--experimental-sqlite vitest run && pnpm run test:pipeline && pnpm run test:pipeline-faults"
+    "test": "NODE_OPTIONS=--experimental-sqlite vitest run --exclude src/lib/apps/v84CleanCloneReplay.test.ts --exclude src/lib/apps/v84NonportableRouteDogfood.test.ts --exclude src/lib/apps/v84CloneLifecycleEvidence.test.ts && NODE_OPTIONS=--experimental-sqlite vitest run src/lib/apps/v84CleanCloneReplay.test.ts src/lib/apps/v84NonportableRouteDogfood.test.ts src/lib/apps/v84CloneLifecycleEvidence.test.ts --fileParallelism=false && pnpm run test:pipeline && pnpm run test:pipeline-faults"
   },
   "dependencies": {
     "@astrojs/cloudflare": "^14.0.1",

package/apps/storefront/src/middleware/index.ts

@@ -25,7 +25,7 @@ import { getTenantResolver } from "@/config/resolver";
 import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
 import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/tenantRouting";
 import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/cdnForward";
-import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 } from "@tot/public-runtime";
+import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
 import { applySecurityHeaders } from "@/lib/securityHeaders";
@@ -165,7 +165,16 @@ async function serveRequest(
   }
 
   // ---- The one route classification -----------------------------------------
-  const hostLoginGated = gateMode === "login" && hostInGateList(host, demoGateHosts);
+  // An EXPLICITLY unpaid store is never fully public: the ONLY way to reach its
+  // hosted URL is to sign in, regardless of the demo-gate host list or mode —
+  // a billing-state boundary, not a demo feature. storefrontModeRequiresSignIn
+  // NEVER fires on a merely-ABSENT storefront.mode (every real tenant today has
+  // it absent, same as a fixture/tenant that never engaged the concept) — only
+  // on an explicit non-"enabled" value, set deliberately via
+  // scripts/tenant/set-storefront-mode.mjs.
+  const hostLoginGated =
+    (gateMode === "login" && hostInGateList(host, demoGateHosts)) ||
+    storefrontModeRequiresSignIn(tenant.storefront?.mode);
   const { branch, route, publication } = resolveMiddlewareBranchV1({
     index: routeTierIndexFor(tenant),
     renderPath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.41",
+  "version": "2.4.43",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/tenant.ts

@@ -401,6 +401,19 @@ export function storefrontModeAllowsGoLive(mode: string | undefined | null): boo
   return mode === STOREFRONT_MODE_ENABLED;
 }
 
+/**
+ * PURE sign-in-gate predicate: must a visitor sign in before this tenant's hosted URL is
+ * reachable, on billing grounds alone? True iff the mode is EXPLICITLY set to something other
+ * than "enabled" — never on absence. Absence means the storefront-commerce concept has never
+ * been provisioned for this tenant at all (a non-commerce tenant, a test fixture, a tenant
+ * pre-dating this field), which must behave exactly as it always has; conflating that with a
+ * deliberate "not yet paid" is the bug this predicate exists to make impossible to write by hand.
+ * Turn this on for a real tenant with scripts/tenant/set-storefront-mode.mjs --mode=disabled.
+ */
+export function storefrontModeRequiresSignIn(mode: string | undefined | null): boolean {
+  return mode != null && mode !== STOREFRONT_MODE_ENABLED;
+}
+
 /**
  * Per-tenant capability switches. These gate whole surfaces so the same
  * component library renders both a store and a marketing site without any