@tokenoftrust/storefront-runner 2.4.42 → 2.4.44

package/apps/storefront/src/middleware/index.ts

@@ -25,7 +25,7 @@ import { getTenantResolver } from "@/config/resolver";
 import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
 import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/tenantRouting";
 import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/cdnForward";
-import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 } from "@tot/public-runtime";
+import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
 import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
 import { applySecurityHeaders } from "@/lib/securityHeaders";
@@ -165,7 +165,16 @@ async function serveRequest(
   }
 
   // ---- The one route classification -----------------------------------------
-  const hostLoginGated = gateMode === "login" && hostInGateList(host, demoGateHosts);
+  // An EXPLICITLY unpaid store is never fully public: the ONLY way to reach its
+  // hosted URL is to sign in, regardless of the demo-gate host list or mode —
+  // a billing-state boundary, not a demo feature. storefrontModeRequiresSignIn
+  // NEVER fires on a merely-ABSENT storefront.mode (every real tenant today has
+  // it absent, same as a fixture/tenant that never engaged the concept) — only
+  // on an explicit non-"enabled" value, set deliberately via
+  // scripts/tenant/set-storefront-mode.mjs.
+  const hostLoginGated =
+    (gateMode === "login" && hostInGateList(host, demoGateHosts)) ||
+    storefrontModeRequiresSignIn(tenant.storefront?.mode);
   const { branch, route, publication } = resolveMiddlewareBranchV1({
     index: routeTierIndexFor(tenant),
     renderPath,

package/apps/storefront/src/middleware/renderChain.ts

@@ -752,11 +752,6 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
   // store below so cached copies carry them too.
   applySecurityHeaders(response.headers);
 
-  // Preview (test) output must never be indexed.
-  if (customization.noindex) {
-    response.headers.set("X-Robots-Tag", "noindex, nofollow");
-  }
-
   // Strict CSP — now ENFORCED in every environment (Epic S2). The report-only
   // rollout is complete: platform output is CSP-clean — inline styles are
   // externalized (`inlineStylesheets: "never"`), Astro's static inline scripts +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.42",
+  "version": "2.4.44",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/customization-preview.ts

@@ -15,8 +15,6 @@
  *   - **Tokens are tenant-bound.** A token minted for tenant A cannot preview
  *     tenant B (no cross-tenant leakage).
  *   - **Tokens expire.** `exp` is checked against the caller-supplied clock.
- *   - **Test is never indexable.** The resolution carries `noindex: true` so the
- *     middleware can set `X-Robots-Tag: noindex`.
  */
 
 /** Claims carried by a preview token. */
@@ -251,8 +249,6 @@ export interface EnvResolutionInput {
 
 export interface EnvResolution {
   env: CustomizationEnv;
-  /** Set `X-Robots-Tag: noindex` when true (test is never indexable). */
-  noindex: boolean;
   /** When set, the middleware should short-circuit with this status. */
   reject?: { status: number; message: string };
 }
@@ -277,12 +273,12 @@ export function isPreviewDispatcherPath(pathname: string): boolean {
 
 /**
  * Decide which customization environment to serve. A valid, unexpired,
- * tenant-matching `__preview`/`tot_preview` token grants `test` (noindex) on
- * ANY host — the token is checked before the host is, so a signed preview
- * link keeps working even when opened on the tenant's normal (non-`preview.*`)
- * host. Without such a token, production hosts always get `live`; preview
- * hosts are auth-gated and reject a missing/invalid/cross-tenant token. The
- * one exception is the token-dispenser path itself (see
+ * tenant-matching `__preview`/`tot_preview` token grants `test` on ANY host —
+ * the token is checked before the host is, so a signed preview link keeps
+ * working even when opened on the tenant's normal (non-`preview.*`) host.
+ * Without such a token, production hosts always get `live`; preview hosts
+ * are auth-gated and reject a missing/invalid/cross-tenant token. The one
+ * exception is the token-dispenser path itself (see
  * {@link isPreviewDispatcherPath}) — it renders the dispatcher's own minimal
  * page, never tenant content, so it's always `live`/no-token regardless of
  * host or token, rather than 401ing on the very request that would otherwise
@@ -292,7 +288,7 @@ export async function resolveCustomizationEnv(
   input: EnvResolutionInput,
 ): Promise<EnvResolution> {
   if (isPreviewDispatcherPath(input.pathname ?? "")) {
-    return { env: "live", noindex: false };
+    return { env: "live" };
   }
 
   const tokenResult =
@@ -300,36 +296,32 @@ export async function resolveCustomizationEnv(
       ? await verifyPreviewToken(input.secret, input.token, input.nowSeconds)
       : null;
   if (tokenResult?.ok && tokenResult.claims.tenantId === input.tenantId) {
-    return { env: "test", noindex: true };
+    return { env: "test" };
   }
 
   if (!input.isPreviewHost) {
-    return { env: "live", noindex: false };
+    return { env: "live" };
   }
   if (!input.secret) {
     return {
       env: "live",
-      noindex: true,
       reject: { status: 503, message: "Preview is not configured." },
     };
   }
   if (!input.token) {
     return {
       env: "live",
-      noindex: true,
       reject: { status: 401, message: "Preview token required." },
     };
   }
   if (!tokenResult!.ok) {
     return {
       env: "live",
-      noindex: true,
       reject: { status: 401, message: `Invalid preview token (${tokenResult!.reason}).` },
     };
   }
   return {
     env: "live",
-    noindex: true,
     reject: { status: 403, message: "Preview token is for a different tenant." },
   };
 }

package/packages/public-runtime/src/tenant.ts

@@ -401,6 +401,19 @@ export function storefrontModeAllowsGoLive(mode: string | undefined | null): boo
   return mode === STOREFRONT_MODE_ENABLED;
 }
 
+/**
+ * PURE sign-in-gate predicate: must a visitor sign in before this tenant's hosted URL is
+ * reachable, on billing grounds alone? True iff the mode is EXPLICITLY set to something other
+ * than "enabled" — never on absence. Absence means the storefront-commerce concept has never
+ * been provisioned for this tenant at all (a non-commerce tenant, a test fixture, a tenant
+ * pre-dating this field), which must behave exactly as it always has; conflating that with a
+ * deliberate "not yet paid" is the bug this predicate exists to make impossible to write by hand.
+ * Turn this on for a real tenant with scripts/tenant/set-storefront-mode.mjs --mode=disabled.
+ */
+export function storefrontModeRequiresSignIn(mode: string | undefined | null): boolean {
+  return mode != null && mode !== STOREFRONT_MODE_ENABLED;
+}
+
 /**
  * Per-tenant capability switches. These gate whole surfaces so the same
  * component library renders both a store and a marketing site without any