@tokenoftrust/storefront-runner 2.4.50 → 2.4.52

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -2,18 +2,22 @@
  * `GET /api/admin/orders/:id` — one order's full detail for the Orders tab.
  *
  * Server-side proxy to checkout `GET /commerce/orders/:orderId` for the
- * resolved tenant + env. Bearer stays server-side; response is the CheckoutOrderDetail
- * DTO. `verificationDetail` is currently empty — consumers tolerate that.
- * Read-only (scope-locks).
+ * resolved tenant + env. Bearer stays server-side. Address is included only
+ * for an owner of this tenant and stage. Readiness is assessed, not inferred.
+ * Read-only.
  */
 import type { APIContext } from "astro";
 import { readEnv } from "@/lib/env";
 import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
 import {
+  commerceActorForAdmin,
+  commerceStageForCustomization,
   createCheckoutOrderClient,
   orderApiBaseUrl,
   OrderApiError,
+  projectCheckoutOrder,
 } from "@/lib/admin/orderClient";
+import { assessCheckoutOrder } from "@/lib/admin/services/orders";
 
 export const prerender = false;
 
@@ -49,8 +53,19 @@ export async function GET(context: APIContext): Promise<Response> {
   });
 
   try {
-    const order = await client.getOrder(orderId);
-    return new Response(JSON.stringify({ order }), { headers: JSON_HEADERS });
+    const stage = commerceStageForCustomization(customizationEnv);
+    const actor = commerceActorForAdmin({
+      tenantId: tenant.appDomain,
+      stage,
+      owner: access.entry.isOwnerViewer,
+      admitted: access.entry.admitted,
+    });
+    const order = projectCheckoutOrder(await client.getOrder(orderId), actor, {
+      tenantId: tenant.appDomain,
+      stage,
+    });
+    const readiness = assessCheckoutOrder(order);
+    return new Response(JSON.stringify({ order, readiness }), { headers: JSON_HEADERS });
   } catch (err) {
     if (err instanceof OrderApiError) return jsonError(err.code, err.status);
     return jsonError("unexpected", 500);

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -10,7 +10,6 @@
  * host/approver layer) — same posture as `api/evidence.json.ts`; no new gate here.
  */
 import type { APIContext } from "astro";
-import type { CheckoutOrderListFilters } from "@tot/public-runtime";
 import { readEnv } from "@/lib/env";
 import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
 import {
@@ -18,6 +17,7 @@ import {
   orderApiBaseUrl,
   OrderApiError,
 } from "@/lib/admin/orderClient";
+import { assessCheckoutOrder, parseOrderFilters } from "@/lib/admin/services/orders";
 
 export const prerender = false;
 
@@ -50,16 +50,8 @@ export async function GET(context: APIContext): Promise<Response> {
   }
 
   const url = new URL(context.request.url);
-  const q = url.searchParams;
-  const limitRaw = q.get("limit");
-  const filters: CheckoutOrderListFilters = {
-    queue: q.get("queue") ?? undefined,
-    status: q.get("status") ?? undefined,
-    from: q.get("from") ?? undefined,
-    to: q.get("to") ?? undefined,
-    limit: limitRaw != null ? Number(limitRaw) : undefined,
-    cursor: q.get("cursor") ?? undefined,
-  };
+  // Tenant comes from the host, never from a query parameter.
+  const filters = parseOrderFilters(url.searchParams);
 
   const client = createCheckoutOrderClient({
     baseUrl: orderApiBaseUrl(customizationEnv),
@@ -69,7 +61,11 @@ export async function GET(context: APIContext): Promise<Response> {
 
   try {
     const data = await client.listOrders(filters);
-    return new Response(JSON.stringify(data), { headers: JSON_HEADERS });
+    const orders = data.orders.map((order) => ({
+      ...order,
+      readiness: assessCheckoutOrder(order),
+    }));
+    return new Response(JSON.stringify({ ...data, orders }), { headers: JSON_HEADERS });
   } catch (err) {
     if (err instanceof OrderApiError) return jsonError(err.code, err.status);
     return jsonError("unexpected", 500);

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -0,0 +1,366 @@
+/**
+ * POST /api/commerce/final-cart-authorization — time-limited final-cart admission.
+ * Caller-owned asymmetric tokens only. Catalog availability, a browser confirmation,
+ * and missing verification evidence do not authorize payment.
+ */
+import type { APIContext } from "astro";
+import { createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify, type JSONWebKeySet, type JWTPayload } from "jose";
+import type { TenantConfig } from "@tot/public-runtime";
+import {
+  type CallerToken,
+  type CommerceEvidence,
+  type CommerceStage,
+  type EvidenceState,
+  type FinalCartBinding,
+  type FulfillmentState,
+  type LabelState,
+  type PaymentState,
+  type StockState,
+} from "@tot/public-runtime";
+import { fromD1, listAllActiveProducts } from "@/lib/d1/catalog.js";
+import { readD1, readEnv } from "@/lib/env";
+import { evaluateFinalCart, type SeamView } from "@/lib/commerce/finalCartAuthorization.js";
+import { d1CommerceRunner, mirrorOnHand, reserveAllocation } from "@/lib/inventory/allocations.js";
+import { POST as compliancePreflight } from "../compliance/preflight.js";
+
+export const prerender = false;
+
+const EVIDENCE_STATES = new Set(["fresh", "UNKNOWN", "stale", "unreadable", "absent"]);
+const STAGES = new Set(["preview", "publication"]);
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" },
+  });
+}
+
+function deny(finding: string, status: number, owner?: string): Response {
+  return json(owner ? { ok: false, finding, owner } : { ok: false, finding }, status);
+}
+
+function statusFor(finding: string): number {
+  if (finding === "store-unconfigured" || finding === "caller-unconfigured") return 503;
+  if (
+    finding === "browser-not-authority" ||
+    finding === "tenant-unbound" ||
+    finding === "shared-secret" ||
+    finding === "signature" ||
+    finding === "kid" ||
+    finding === "issuer" ||
+    finding === "audience" ||
+    finding === "expired" ||
+    finding === "lifetime" ||
+    finding === "jti" ||
+    finding === "tenant" ||
+    finding === "stage"
+  ) {
+    return 401;
+  }
+  return 409;
+}
+
+function claimString(payload: JWTPayload, key: string): string {
+  const value = payload[key];
+  return typeof value === "string" ? value : "";
+}
+
+function parseList(value: string | undefined): string[] | null {
+  if (!value || value.trim() === "") return null;
+  const trimmed = value.trim();
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed) as unknown;
+      if (!Array.isArray(parsed) || parsed.some((item) => typeof item !== "string" || item.trim() === "")) return null;
+      return parsed as string[];
+    } catch {
+      return null;
+    }
+  }
+  const parts = trimmed.split(",").map((part) => part.trim()).filter(Boolean);
+  return parts.length > 0 ? parts : null;
+}
+
+function publicJwks(value: string | undefined): JSONWebKeySet | null {
+  if (!value) return null;
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (!parsed || typeof parsed !== "object" || !Array.isArray((parsed as { keys?: unknown }).keys)) return null;
+    const keys = (parsed as { keys: unknown[] }).keys;
+    if (keys.length < 1) return null;
+    for (const key of keys) {
+      if (!key || typeof key !== "object") return null;
+      const record = key as Record<string, unknown>;
+      if (typeof record.d === "string" || record.kty === "oct" || typeof record.k === "string") return null;
+    }
+    return parsed as JSONWebKeySet;
+  } catch {
+    return null;
+  }
+}
+
+function readCart(value: unknown): FinalCartBinding | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  if (typeof record.tenantId !== "string" || typeof record.currency !== "string" || typeof record.destinationDigest !== "string") {
+    return null;
+  }
+  if (typeof record.stage !== "string" || !STAGES.has(record.stage)) return null;
+  if (typeof record.verificationExpiresAt !== "string" || typeof record.taxExpiresAt !== "string") return null;
+  if (!Array.isArray(record.lines) || record.lines.length > 50) return null;
+  const lines = [];
+  for (const line of record.lines) {
+    if (!line || typeof line !== "object") return null;
+    const row = line as Record<string, unknown>;
+    if (typeof row.sku !== "string" || typeof row.quantity !== "number" || typeof row.unitMinor !== "number") return null;
+    lines.push({ sku: row.sku, quantity: row.quantity, unitMinor: row.unitMinor });
+  }
+  return {
+    tenantId: record.tenantId,
+    stage: record.stage as CommerceStage,
+    currency: record.currency,
+    lines,
+    destinationDigest: record.destinationDigest,
+    verificationExpiresAt: record.verificationExpiresAt,
+    taxExpiresAt: record.taxExpiresAt,
+  };
+}
+
+function readEvidence(value: unknown): CommerceEvidence | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  const evidence = {} as CommerceEvidence;
+  for (const field of ["verification", "tax", "risk", "stock"] as const) {
+    const state = record[field];
+    if (typeof state !== "string" || !EVIDENCE_STATES.has(state)) return null;
+    evidence[field] = state as EvidenceState;
+  }
+  return evidence;
+}
+
+function readState<T extends string>(value: unknown, allowed: readonly T[]): T | undefined {
+  return typeof value === "string" && (allowed as readonly string[]).includes(value) ? (value as T) : undefined;
+}
+
+function destinationOf(value: unknown): { region: string; country: string } | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  const region = typeof record.region === "string" ? record.region.trim() : "";
+  const country = typeof record.country === "string" ? record.country.trim() : "";
+  if (!/^[A-Za-z]{2}$/.test(region)) return null;
+  if (country !== "" && !/^[A-Za-z]{2}$/.test(country)) return null;
+  return { region: region.toUpperCase(), country: country === "" ? "US" : country.toUpperCase() };
+}
+
+async function catalogOffers(sku: string): Promise<boolean> {
+  const database = await readD1("CATALOG_DB");
+  if (!database) return false;
+  try {
+    const products = await listAllActiveProducts(fromD1(database));
+    for (const product of products) {
+      for (const variant of product.variants) {
+        if (variant.sku === sku && variant.inventory.available === true) return true;
+      }
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
+
+async function verificationSeam(
+  context: APIContext,
+  cart: FinalCartBinding,
+  destination: { region: string; country: string } | null,
+): Promise<SeamView> {
+  const tot = (context.locals as { tot?: { getProductByHandle: (handle: string) => Promise<unknown> } }).tot ?? {
+    getProductByHandle: async () => null,
+  };
+  const response = await compliancePreflight({
+    request: new Request("https://synthetic-tenant.invalid/api/compliance/preflight", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        lines: cart.lines.map((line) => ({ handle: line.sku, sku: line.sku, quantity: line.quantity })),
+        ...(destination ? { destination: { region: destination.region, country: destination.country } } : {}),
+      }),
+    }),
+    locals: { tenant: context.locals.tenant, tot },
+  } as APIContext);
+  let body: unknown;
+  try {
+    body = await response.json();
+  } catch {
+    return { status: "absent" };
+  }
+  const decision = body && typeof body === "object" ? (body as { decision?: { status?: unknown; failedClosed?: unknown; blocks?: unknown } }).decision : undefined;
+  if (!decision || decision.status === "clear") return { status: decision ? "clear" : "absent" };
+  const blocks = Array.isArray(decision.blocks) ? decision.blocks : [];
+  const codes = blocks
+    .map((block) => (block && typeof block === "object" ? (block as { code?: unknown }).code : undefined))
+    .filter((code): code is string => typeof code === "string");
+  return { status: "blocked", failedClosed: decision.failedClosed === true, codes };
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  const tenant = context.locals.tenant as TenantConfig | undefined;
+  const appDomain = tenant?.appDomain ?? "";
+  if (!tenant || appDomain === "") return deny("tenant-unbound", 401);
+
+  let body: Record<string, unknown>;
+  try {
+    const parsed = await context.request.json();
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return deny("malformed-request", 409);
+    body = parsed as Record<string, unknown>;
+  } catch {
+    return deny("malformed-request", 409);
+  }
+
+  if (body.scheme === "shared-secret") {
+    const decision = await evaluateFinalCart({
+      now: new Date().toISOString(),
+      routedTenantId: appDomain,
+      quoted: readCart(body.quoted) ?? emptyCart(appDomain),
+      presented: readCart(body.presented) ?? emptyCart(appDomain),
+      evidence: readEvidence(body.evidence),
+      seam: { status: "clear" },
+      catalogAvailable: false,
+      browserConfirmed: body.browserConfirmed === true,
+      token: { scheme: "shared-secret" },
+      trustedIssuers: [],
+      expectedAudience: "",
+      activeKids: [],
+      authorities: [],
+    });
+    return deny(decision.ok ? "shared-secret" : decision.finding, statusFor(decision.ok ? "shared-secret" : decision.finding), decision.ok ? undefined : decision.owner);
+  }
+
+  const quoted = readCart(body.quoted);
+  const presented = readCart(body.presented);
+  if (!quoted || !presented) return deny("malformed-request", 409);
+
+  const jwks = publicJwks(await readEnv("SCRAPPY_CALLER_JWKS"));
+  const issuers = parseList(await readEnv("SCRAPPY_CALLER_ISSUERS"));
+  const audience = await readEnv("SCRAPPY_CALLER_AUDIENCE");
+  const activeKids = parseList(await readEnv("SCRAPPY_CALLER_ACTIVE_KIDS"));
+  if (!jwks || !issuers || !audience || !activeKids) return deny("caller-unconfigured", 503);
+
+  const header = context.request.headers.get("authorization") ?? "";
+  const bearer = header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : "";
+  let token: CallerToken | null = null;
+  if (bearer !== "") {
+    try {
+      const decoded = decodeJwt(bearer);
+      const protectedHeader = decodeProtectedHeader(bearer);
+      let signatureValid = false;
+      try {
+        await jwtVerify(bearer, createLocalJWKSet(jwks), { algorithms: ["EdDSA"] });
+        signatureValid = true;
+      } catch (error) {
+        const code = error && typeof error === "object" && "code" in error ? String((error as { code: unknown }).code) : "";
+        signatureValid = code === "ERR_JWT_EXPIRED" || code === "ERR_JWT_CLAIM_VALIDATION_FAILED";
+      }
+      const exp = typeof decoded.exp === "number" ? new Date(decoded.exp * 1000).toISOString() : "";
+      const audienceClaim = typeof decoded.aud === "string" ? decoded.aud : Array.isArray(decoded.aud) ? decoded.aud[0] ?? "" : "";
+      const stageClaim = claimString(decoded, "stage");
+      const stage: CommerceStage =
+        stageClaim === "preview" || stageClaim === "publication"
+          ? stageClaim
+          : presented.stage === "preview"
+            ? "publication"
+            : "preview";
+      token = {
+        scheme: "asymmetric-jwks",
+        signatureValid,
+        kid: typeof protectedHeader.kid === "string" ? protectedHeader.kid : "",
+        issuer: typeof decoded.iss === "string" ? decoded.iss : "",
+        audience: audienceClaim,
+        expiresAt: exp,
+        jti: claimString(decoded, "jti"),
+        tenantId: claimString(decoded, "tenantId"),
+        stage,
+      };
+    } catch {
+      token = null;
+    }
+  }
+
+  const provider = tenant.inventory?.provider ?? "mirror";
+  const authorities: unknown[] = [];
+  const now = new Date().toISOString();
+  if (provider !== "mirror") {
+    authorities.push({ provider, sku: presented.lines[0]?.sku });
+  } else {
+    const skus = [...new Set(presented.lines.map((line) => line.sku))];
+    for (const sku of skus) {
+      const onHand = mirrorOnHand(sku, "unspecified");
+      authorities.push(
+        onHand == null
+          ? null
+          : { provider: "mirror", readable: true, locationId: "unspecified", sku, onHand, asOf: now },
+      );
+    }
+  }
+  let catalogAvailable = false;
+  for (const line of presented.lines) {
+    if (await catalogOffers(line.sku)) catalogAvailable = true;
+  }
+
+  const decision = await evaluateFinalCart({
+    now,
+    routedTenantId: appDomain,
+    quoted,
+    presented,
+    evidence: readEvidence(body.evidence),
+    seam: await verificationSeam(context, presented, destinationOf(body.destination)),
+    catalogAvailable,
+    browserConfirmed: body.browserConfirmed === true,
+    token,
+    trustedIssuers: issuers,
+    expectedAudience: audience,
+    activeKids,
+    authorities,
+    payment: readState<PaymentState>(body.payment, ["UNKNOWN", "pending", "authorized", "captured", "capture_unknown", "voided", "refund_requested", "refunded", "refund_unknown"]),
+    stock: readState<StockState>(body.stock, ["UNKNOWN", "unallocated", "reserved", "confirmed", "released", "expired"]),
+    fulfillment: readState<FulfillmentState>(body.fulfillment, ["UNKNOWN", "held", "ready", "handed_off", "cancelled"]),
+    label: readState<LabelState>(body.label, ["UNKNOWN", "none", "intent", "purchased", "printed", "void_requested", "voided"]),
+  });
+  if (!decision.ok) return deny(decision.finding, statusFor(decision.finding), decision.owner);
+
+  const database = await readD1("STOREFRONT_APPS_DB");
+  if (!database || typeof database.prepare !== "function") return deny("store-unconfigured", 503);
+  const reserved = await reserveAllocation(d1CommerceRunner(database), {
+    tenantId: decision.tenantId,
+    stage: decision.stage,
+    orderId: `a${crypto.randomUUID()}`,
+    cartDigest: decision.digest,
+    expiresAt: decision.expiresAt,
+    now,
+    currency: presented.currency,
+    amountMinor: decision.amountMinor,
+    issuer: decision.issuer,
+    jti: decision.jti,
+    holds: decision.holds,
+  });
+  if (!reserved.ok) return deny(reserved.finding, statusFor(reserved.finding));
+  return json({
+    ok: true,
+    authorizationId: reserved.authorizationId,
+    cartDigest: decision.digest,
+    expiresAt: reserved.expiresAt,
+    repeated: reserved.repeated,
+    stage: decision.stage,
+  });
+}
+
+function emptyCart(tenantId: string): FinalCartBinding {
+  return {
+    tenantId,
+    stage: "preview",
+    currency: "USD",
+    lines: [{ sku: "sku-1", quantity: 1, unitMinor: 0 }],
+    destinationDigest: "dest-synthetic",
+    verificationExpiresAt: "1970-01-01T00:00:00.000Z",
+    taxExpiresAt: "1970-01-01T00:00:00.000Z",
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.50",
+  "version": "2.4.52",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",