@tokenoftrust/storefront-runner 2.4.67 → 2.4.68

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -152,14 +152,17 @@ function destinationOf(value: unknown): { region: string; country: string } | nu
   return { region: region.toUpperCase(), country: country === "" ? "US" : country.toUpperCase() };
 }
 
-async function catalogOffers(sku: string): Promise<boolean> {
+async function catalogAvailableFor(skus: readonly string[]): Promise<boolean> {
+  if (skus.length === 0) return false;
   const database = await readD1("CATALOG_DB");
   if (!database) return false;
+  const wanted = new Set(skus);
   try {
     const products = await listAllActiveProducts(fromD1(database));
     for (const product of products) {
       for (const variant of product.variants) {
-        if (variant.sku === sku && variant.inventory.available === true) return true;
+        if (variant.sku === undefined) continue;
+        if (wanted.has(variant.sku) && variant.inventory.available === true) return true;
       }
     }
   } catch {
@@ -216,24 +219,7 @@ export async function POST(context: APIContext): Promise<Response> {
     return deny("malformed-request", 409);
   }
 
-  if (body.scheme === "shared-secret") {
-    const decision = await evaluateFinalCart({
-      now: new Date().toISOString(),
-      routedTenantId: appDomain,
-      quoted: readCart(body.quoted) ?? emptyCart(appDomain),
-      presented: readCart(body.presented) ?? emptyCart(appDomain),
-      evidence: readEvidence(body.evidence),
-      seam: { status: "clear" },
-      catalogAvailable: false,
-      browserConfirmed: body.browserConfirmed === true,
-      token: { scheme: "shared-secret" },
-      trustedIssuers: [],
-      expectedAudience: "",
-      activeKids: [],
-      authorities: [],
-    });
-    return deny(decision.ok ? "shared-secret" : decision.finding, statusFor(decision.ok ? "shared-secret" : decision.finding), decision.ok ? undefined : decision.owner);
-  }
+  if (body.scheme === "shared-secret") return deny("shared-secret", statusFor("shared-secret"));
 
   const quoted = readCart(body.quoted);
   const presented = readCart(body.presented);
@@ -263,12 +249,7 @@ export async function POST(context: APIContext): Promise<Response> {
       const exp = typeof decoded.exp === "number" ? new Date(decoded.exp * 1000).toISOString() : "";
       const audienceClaim = typeof decoded.aud === "string" ? decoded.aud : Array.isArray(decoded.aud) ? decoded.aud[0] ?? "" : "";
       const stageClaim = claimString(decoded, "stage");
-      const stage: CommerceStage =
-        stageClaim === "preview" || stageClaim === "publication"
-          ? stageClaim
-          : presented.stage === "preview"
-            ? "publication"
-            : "preview";
+      if (stageClaim !== "preview" && stageClaim !== "publication") return deny("stage", statusFor("stage"));
       token = {
         scheme: "asymmetric-jwks",
         signatureValid,
@@ -278,7 +259,7 @@ export async function POST(context: APIContext): Promise<Response> {
         expiresAt: exp,
         jti: claimString(decoded, "jti"),
         tenantId: claimString(decoded, "tenantId"),
-        stage,
+        stage: stageClaim,
       };
     } catch {
       token = null;
@@ -301,10 +282,7 @@ export async function POST(context: APIContext): Promise<Response> {
       );
     }
   }
-  let catalogAvailable = false;
-  for (const line of presented.lines) {
-    if (await catalogOffers(line.sku)) catalogAvailable = true;
-  }
+  const catalogAvailable = await catalogAvailableFor(presented.lines.map((line) => line.sku));
 
   const decision = await evaluateFinalCart({
     now,
@@ -353,14 +331,3 @@ export async function POST(context: APIContext): Promise<Response> {
   });
 }
 
-function emptyCart(tenantId: string): FinalCartBinding {
-  return {
-    tenantId,
-    stage: "preview",
-    currency: "USD",
-    lines: [{ sku: "sku-1", quantity: 1, unitMinor: 0 }],
-    destinationDigest: "dest-synthetic",
-    verificationExpiresAt: "1970-01-01T00:00:00.000Z",
-    taxExpiresAt: "1970-01-01T00:00:00.000Z",
-  };
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.67",
+  "version": "2.4.68",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",