@tokenoftrust/storefront-runner 2.4.62 → 2.4.64

package/apps/storefront/src/lib/checkoutCommerce.ts

@@ -87,10 +87,30 @@ export async function readCartSecret(
  *     but the secret is missing, so NO cart may be built. The caller must render
  *     no buy form (never a tamperable / broken one).
  */
+/** Shopper copy when checkout cannot be signed. No operator setup detail. */
+export const CHECKOUT_UNAVAILABLE_SHOPPER_MESSAGE = "Checkout is unavailable.";
+
+/** Product-page alert. The cart signing env var name stays in the server log. */
+export function shopperCheckoutUnavailableHtml(): string {
+  return (
+    `<p class="mb-3 text-sm text-[var(--color-text)]" role="alert" data-cart-operator-error>` +
+    `${CHECKOUT_UNAVAILABLE_SHOPPER_MESSAGE}</p>`
+  );
+}
+
+/**
+ * Message safe to put in an HTTP body. `signing-unavailable` carries operator
+ * setup text from the cart runtime; shoppers get the neutral message instead.
+ */
+export function shopperCartDenialMessage(code: string, message: string): string {
+  if (code === "signing-unavailable") return CHECKOUT_UNAVAILABLE_SHOPPER_MESSAGE;
+  return message;
+}
+
 export interface CartSigningResolution {
   enabled: boolean;
   secret?: string;
-  /** Set when signed mode has no secret. Actionable for the operator. No secret value. */
+  /** Operator setup detail. Do not write this into shopper HTML or an HTTP body. */
   operatorError?: string;
 }
 

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -26,7 +26,7 @@ import {
   type CartDenialCode,
 } from "@tot/public-runtime";
 import { resolveCheckoutHandoffCorrelation } from "@/lib/commerce/checkoutHandoffCorrelation";
-import { resolveCartSigning } from "@/lib/checkoutCommerce";
+import { resolveCartSigning, shopperCartDenialMessage } from "@/lib/checkoutCommerce";
 
 export const prerender = false;
 
@@ -88,7 +88,11 @@ async function cartFormPost(context: APIContext): Promise<Response> {
   }
   const signing = await resolveCartSigning(commerce);
   if (!signing.enabled) {
-    return cartDenial("signing-unavailable", signing.operatorError ?? "Signed checkout is unavailable.", 503);
+    return cartDenial(
+      "signing-unavailable",
+      shopperCartDenialMessage("signing-unavailable", signing.operatorError ?? ""),
+      503,
+    );
   }
   const form = await context.request.formData();
   const entries: Array<[string, string]> = [];
@@ -103,7 +107,7 @@ async function cartFormPost(context: APIContext): Promise<Response> {
   });
   if (!result.ok) {
     const status = result.code === "signing-unavailable" ? 503 : 422;
-    return cartDenial(result.code, result.message, status);
+    return cartDenial(result.code, shopperCartDenialMessage(result.code, result.message), status);
   }
   return new Response(null, {
     status: 303,

package/apps/storefront/src/pages/products/[handle].astro

@@ -37,7 +37,7 @@ import type {
   MembershipStackingPolicy,
   PurchaseOptionPricingContext,
 } from "@tot/public-runtime";
-import { resolveCartSigning } from "@/lib/checkoutCommerce";
+import { resolveCartSigning, shopperCheckoutUnavailableHtml } from "@/lib/checkoutCommerce";
 import { isRegulatedTenant } from "@/lib/compliance/enforcement";
 import { resolveMemberContext } from "@/lib/membership/eligibility";
 import { truncate } from "@/lib/format";
@@ -223,14 +223,14 @@ let checkoutCart:
       byVariantId: Record<string, Record<string, VariantCartPayload>>;
     }
   | undefined;
-let cartOperatorError: string | undefined;
+let checkoutUnavailable = false;
 if (commerce) {
   // Fail closed for production signed checkout: a signed tenant with no
   // cart-validation secret builds NO cart (never a tamperable form). See
   // resolveCartSigning — it also logs the misconfiguration loudly.
   const signing = await resolveCartSigning(commerce);
   if (!signing.enabled) {
-    cartOperatorError = signing.operatorError;
+    checkoutUnavailable = true;
   } else {
     try {
       const purchaseOptions = visiblePurchaseOptions(
@@ -265,10 +265,9 @@ if (commerce) {
         byVariantId: Object.fromEntries(entries),
       };
     } catch (err) {
-      cartOperatorError =
-        err instanceof Error && err.name === "CartSigningUnavailableError"
-          ? err.message
-          : undefined;
+      if (err instanceof Error && err.name === "CartSigningUnavailableError") {
+        checkoutUnavailable = true;
+      }
       console.warn(
         `[storefront] Invalid checkout purchase options for ${product.handle}; cart disabled for this product.`,
       );
@@ -386,11 +385,7 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
           The form action is the worker cart route, so a native submit reaches
           the server check. A clear browser preflight is not payment authority. */}
       <div class="mt-7" data-payment-authority="none">
-        {cartOperatorError && (
-          <p class="mb-3 text-sm text-[var(--color-text)]" role="alert" data-cart-operator-error>
-            {cartOperatorError}
-          </p>
-        )}
+        {checkoutUnavailable && <Fragment set:html={shopperCheckoutUnavailableHtml()} />}
         <VariantSelector
           client:load
           variants={publicSelectorVariants(product.variants)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.62",
+  "version": "2.4.64",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -424,6 +424,18 @@ async function hmacHex(secret: string, message: string): Promise<string> {
     .join("");
 }
 
+function constantTimeHexEqual(expected: string, presented: string): boolean {
+  const enc = new TextEncoder();
+  const left = enc.encode(expected);
+  const right = enc.encode(presented);
+  const length = Math.max(left.length, right.length);
+  let acc = left.length ^ right.length;
+  for (let i = 0; i < length; i++) {
+    acc |= (left[i] ?? 0) ^ (right[i] ?? 0);
+  }
+  return acc === 0;
+}
+
 /**
  * Sign one field for product `code`. Editable fields hash the sentinel
  * `--OPEN--` and gain the `||open` suffix so checkout accepts a user-entered value.
@@ -596,7 +608,7 @@ export async function enforceCartSubmission(input: {
     if (!field.hash) return false;
     const valueToHash = field.open ? "--OPEN--" : field.value;
     const expected = await hmacHex(secret, codeField.value + field.baseName + valueToHash);
-    return expected === field.hash;
+    return constantTimeHexEqual(expected, field.hash);
   };
 
   if (signed) {