@tokenoftrust/storefront-runner 2.4.81 → 2.4.83

package/apps/storefront/src/components/islands/CheckoutComplianceGate.tsx

@@ -26,6 +26,7 @@ import { useCallback, useEffect, useRef, useState } from "preact/hooks";
 import type { CartComplianceDecision } from "@tot/public-runtime";
 import {
   clearStoredRef,
+  isStoreNotPublicRefusal,
   parsePreflightResponse,
   pollVerification,
   readStoredRef,
@@ -91,6 +92,10 @@ type DialogPhase = VerificationPhase | "stalled";
 const FAIL_CLOSED_MESSAGE =
   "We couldn't reach our compliance check. For your safety, checkout is paused — please try again.";
 
+/** The store-not-public gate refused the preflight: checkout needs a signed-in session. */
+const STORE_NOT_PUBLIC_MESSAGE =
+  "This store isn't open to the public yet, so checkout is unavailable here. Sign in to the store to test checkout.";
+
 export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props) {
   const [pending, setPending] = useState<PendingLine | null>(null);
   const [region, setRegion] = useState("");
@@ -110,6 +115,8 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
   const [popupBlocked, setPopupBlocked] = useState(false);
   /** Cancellation token for the in-flight poll loop (at most one at a time). */
   const pollToken = useRef<{ cancelled: boolean } | null>(null);
+  /** Set by the last preflight POST when the store-not-public gate answered it. */
+  const gateRefused = useRef(false);
 
   const stopPolling = useCallback(() => {
     if (pollToken.current) pollToken.current.cancelled = true;
@@ -191,6 +198,7 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
       opts: { ref: string | null; includeShopper: boolean },
     ): Promise<PreflightResponse | null> => {
       const trimmedEmail = email.trim();
+      gateRefused.current = false;
       try {
         const res = await fetch(preflightUrl, {
           method: "POST",
@@ -218,6 +226,10 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
               : {}),
           }),
         });
+        if (isStoreNotPublicRefusal(res)) {
+          gateRefused.current = true;
+          return null;
+        }
         return parsePreflightResponse(await res.json());
       } catch {
         return null;
@@ -336,7 +348,7 @@ export default function CheckoutComplianceGate({ preflightUrl, minAge }: Props)
     setLoading(false);
     if (!res) {
       // Fail closed: a regulated tenant never proceeds on an unreadable result.
-      setError(FAIL_CLOSED_MESSAGE);
+      setError(gateRefused.current ? STORE_NOT_PUBLIC_MESSAGE : FAIL_CLOSED_MESSAGE);
       return;
     }
     apply(pending, res);

package/apps/storefront/src/components/islands/checkoutVerificationFlow.ts

@@ -173,6 +173,15 @@ export interface PollDeps {
   timeoutMs?: number;
 }
 
+/**
+ * True when the login gate, not the preflight route, answered: the store is not
+ * public and this viewer holds no session (see `lib/auth/gatePage.ts`). Still fail
+ * closed — the caller only names the reason instead of reporting an outage.
+ */
+export function isStoreNotPublicRefusal(res: Pick<Response, "status" | "headers">): boolean {
+  return res.status === 401 && res.headers.get("x-tot-gate") === "store-not-public";
+}
+
 /**
  * Re-read the server's decision until it resolves. The client NEVER decides the
  * shopper passed — it only relays `decision.status === "clear"`.

package/apps/storefront/src/lib/newsletter/confirmationEmail.ts

@@ -5,8 +5,8 @@
  * delegated over HTTP to tot20, and there is no bulk/marketing sender in-repo
  * (docs/plans/2026-08-22-newsletter-send-spike.md §1). Wiring the real send is
  * the ESP-pipeline's job — it replaces the body of this function with a
- * transactional send (confirm link in the body). Until then we only LOG intent,
- * and never let a send failure fail the subscribe (the pending row + returned
+ * transactional send (confirm link in the body). The stub logs only a static event,
+ * and never lets a send failure fail the subscribe (the pending row and its
  * token are the durable state; the mail is a follow-up).
  */
 
@@ -22,9 +22,6 @@ export interface ConfirmationEmailRequest {
  * Best-effort by contract — callers do not await deliverability, and this never
  * throws.
  */
-export async function sendConfirmationEmail(req: ConfirmationEmailRequest): Promise<void> {
-  console.log(
-    `[newsletter] confirmation email STUB — would send to ${req.email} ` +
-      `(collection: ${req.collection}) confirm: ${req.confirmUrl}`,
-  );
+export async function sendConfirmationEmail(_req: ConfirmationEmailRequest): Promise<void> {
+  console.log("[newsletter] confirmation email delivery is not configured");
 }

package/apps/storefront/src/pages/api/newsletter/[collection]/subscribe.ts

@@ -110,7 +110,7 @@ export const POST: APIRoute = async (context) => {
     if (!d1) {
       // No apps DB binding (local/dev without D1): can't persist. Don't fail the
       // visitor — log and acknowledge so the flow is exercisable in dev.
-      console.log(`[newsletter] subscribe (no D1) ${email} → ${tenantId}/${collection}`);
+      console.log(`[newsletter] subscribe not persisted (no D1) → ${tenantId}/${collection}`);
       return ok(context.request);
     }
 
@@ -133,14 +133,22 @@ export const POST: APIRoute = async (context) => {
     // or unsubscribed address. Best-effort; a stub failure must not fail signup.
     if (result.status === "pending") {
       const origin = new URL(context.request.url).origin;
-      const basePath = context.locals?.basePath ?? "";
-      const confirmUrl = `${origin}${basePath}/api/newsletter/confirm?token=${result.token}`;
-      await sendConfirmationEmail({ email, collection, confirmUrl }).catch(() => {});
+      // The tenant's real routed prefix: a pinned preview's basePath has no API mirror.
+      const apiBasePath = context.locals?.apiBasePath ?? context.locals?.basePath ?? "";
+      const confirmUrl = `${origin}${apiBasePath}/api/newsletter/confirm?token=${result.token}`;
+      await sendConfirmationEmail({ email, collection, confirmUrl }).catch((err: unknown) => {
+        console.error(
+          `[newsletter] confirmation email failed tenant=${tenantId} collection=${collection}: ${err instanceof Error ? err.name : "unknown"}`,
+        );
+      });
     }
 
     return ok(context.request);
-  } catch {
-    // Never 500 on a signup — acknowledge and move on.
+  } catch (err) {
+    // Never 500 on a signup — acknowledge, but never swallow the failure silently.
+    console.error(
+      `[newsletter] subscribe failed collection=${collection}: ${err instanceof Error ? err.name : "unknown"}`,
+    );
     return ok(context.request);
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.81",
+  "version": "2.4.83",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",