@tokenoftrust/storefront-runner 2.4.91 → 2.5.0

package/apps/storefront/src/pages/api/admin/commerce-readiness.ts

@@ -1,13 +1,9 @@
-/**
- * GET/POST /api/admin/commerce-readiness
- *
- * Phase 1: the client fulfills in their own carrier account. This route reports
- * whether order and payment reconcile has been exercised. It does not read an
- * order row, write a payment, or call a carrier. Postage is not a result.
- *
- * The exercised comparison is scripts/commerce/scrappy-reconcile.mjs. This
- * surface has no ledger, so configured, absent, and unreadable stay unhealthy.
- */
+import { openFulfillment } from "@/lib/fulfillment/fulfillmentService";
+import { readCommerceDurability } from "@/lib/fulfillment/commerceReadback";
+import { readD1 } from "@/lib/publication/shared/env";
+import { fromD1 } from "@/lib/catalog/d1/catalog";
+import { commercePipelineFor } from "@/lib/fulfillment/commerceRuntime";
+/** Owner-only persisted projection health and durable replay. External payment reconciliation remains separate. */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { workerCommit } from "@/lib/activity/workerCommit";
@@ -80,11 +76,10 @@ function replayStage(value: unknown): CommerceStage | null {
   return value === "preview" || value === "publication" ? value : null;
 }
 
-export function admitAdminReplay(input: {
-  tenantId: string;
-  stage: CommerceStage;
-  kind: "order" | "refund";
-}): { admitted: boolean; reason: "admitted" | "denied" | "refused" } {
+export function admitAdminReplay(input: { tenantId: string; stage: CommerceStage; kind: "order" | "refund" }): {
+  admitted: boolean;
+  reason: "admitted" | "denied" | "refused";
+} {
   const actor = { role: "owner" as const, tenantId: input.tenantId, stage: input.stage };
   const resource = { tenantId: input.tenantId, stage: input.stage };
   if (!actorMayCommand(actor, resource)) return { admitted: false, reason: "denied" };
@@ -106,7 +101,20 @@ export function admitAdminReplay(input: {
 export async function GET(context: APIContext): Promise<Response> {
   const access = await requireAdminApiEntry(context, { requireOwner: true });
   if (!access.ok) return json({ ok: false, reason: access.reason }, access.status);
-  return json({ ok: true, report: projectAdminReadiness({ scheduler: COMMERCE_SCHEDULER, deployedSha: workerCommit() }) });
+  const opened = await openFulfillment(context);
+  if (!opened.ok) return opened.response;
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ ok: false, reason: "unavailable" }, 503);
+  return json({
+    ok: true,
+    report: await readCommerceDurability(
+      fromD1(d1),
+      opened.actor.tenantId,
+      opened.actor.stage,
+      new Date().toISOString(),
+      workerCommit(),
+    ),
+  });
 }
 
 export async function POST(context: APIContext): Promise<Response> {
@@ -120,7 +128,8 @@ export async function POST(context: APIContext): Promise<Response> {
   } catch {
     return json({ ok: false, reason: "refused" }, 400);
   }
-  if (body === null || typeof body !== "object" || Array.isArray(body)) return json({ ok: false, reason: "refused" }, 400);
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    return json({ ok: false, reason: "refused" }, 400);
   const record = body as Record<string, unknown>;
   if (Object.keys(record).some((key) => !REPLAY_KEYS.has(key))) return json({ ok: false, reason: "refused" }, 400);
   const stage = replayStage(record.stage);
@@ -128,15 +137,36 @@ export async function POST(context: APIContext): Promise<Response> {
   if (!stage || !kind || typeof record.orderId !== "string" || typeof record.sourceEventId !== "string") {
     return json({ ok: false, reason: "refused" }, 400);
   }
-  if (!OPAQUE.test(record.orderId) || !OPAQUE.test(record.sourceEventId)) return json({ ok: false, reason: "refused" }, 400);
+  if (!OPAQUE.test(record.orderId) || !OPAQUE.test(record.sourceEventId))
+    return json({ ok: false, reason: "refused" }, 400);
   const decision = admitAdminReplay({ tenantId: context.locals.tenant.tenant_id, stage, kind });
   if (!decision.admitted) return json({ ok: false, reason: decision.reason }, 403);
-  return json({
-    ok: true,
-    admitted: true,
-    durableWrite: false,
-    command: "reconcile",
-    reason: decision.reason,
-    report: projectAdminReadiness({ scheduler: COMMERCE_SCHEDULER, deployedSha: workerCommit() }),
-  });
+  const opened = await openFulfillment(context);
+  if (!opened.ok) return opened.response;
+  if (stage !== opened.actor.stage) return json({ ok: false, reason: "denied" }, 403);
+  const d1 = await readD1("STOREFRONT_APPS_DB");
+  if (!d1) return json({ ok: false, reason: "unavailable" }, 503);
+  const db = fromD1(d1);
+  const row = await db.first<{ outbox_id: string }>(
+    `SELECT outbox_id FROM scrappy_commerce_outbox WHERE tenant_id=? AND stage=? AND order_id=? AND source_event_id=?`,
+    opened.actor.tenantId,
+    stage,
+    record.orderId,
+    record.sourceEventId,
+  );
+  if (!row) return json({ ok: false, reason: "not-found" }, 404);
+  const pipeline = await commercePipelineFor(opened.actor.tenantId);
+  if (!pipeline?.commerceReplay) return json({ ok: false, reason: "scheduler-unavailable" }, 503);
+  await pipeline.commerceReplay(opened.actor.tenantId, stage, row.outbox_id);
+  return json(
+    {
+      ok: true,
+      admitted: true,
+      durableWrite: true,
+      command: "reconcile",
+      reason: "queued",
+      report: await readCommerceDurability(db, opened.actor.tenantId, stage, new Date().toISOString(), workerCommit()),
+    },
+    202,
+  );
 }

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -23,10 +23,14 @@ import {
   foxyCartRedirectUrl,
   parseConsentSnapshot,
   defaultConsentSnapshot,
+  buildVariantCartPayload,
+  commerceTenantId,
+  MAX_CART_QUANTITY,
   type CartDenialCode,
 } from "@tot/public-runtime";
 import { resolveCheckoutHandoffCorrelation } from "@/lib/checkout/commerce/checkoutHandoffCorrelation";
 import { resolveCartSigning, shopperCartDenialMessage } from "@/lib/checkout/shared/checkoutCommerce";
+import { readEnv } from "@/lib/publication/shared/runtimeEnv";
 
 export const prerender = false;
 
@@ -97,13 +101,41 @@ async function cartFormPost(context: APIContext): Promise<Response> {
   const form = await context.request.formData();
   const entries: Array<[string, string]> = [];
   for (const [name, value] of form.entries()) {
-    if (typeof value === "string") entries.push([name, value]);
+    if (typeof value !== "string") return cartDenial("signature", "Invalid cart.", 422);
+    entries.push([name, value]);
+  }
+  if (form.has("sample_product") || form.has("sample_variant")) {
+    const sampleTenant = await readEnv("COMMERCE_SAMPLE_TENANT_ID");
+    if (
+      !sampleTenant || sampleTenant !== commerceTenantId(tenant) ||
+      await readEnv("COMMERCE_DEMO_CHECKOUT_TIER") !== "test" || commerce.mode !== "signed"
+    ) return cartDenial("tenant", "Invalid cart.", 422);
+    const allowed = new Set(["sample_product", "sample_variant", "quantity"]);
+    if (entries.length !== 3 || entries.some(([name]) => !allowed.has(name)) ||
+      new Set(entries.map(([name]) => name)).size !== 3) {
+      return cartDenial("signature", "Invalid cart.", 422);
+    }
+    const quantity = form.get("quantity") as string;
+    if (!/^[1-9][0-9]*$/.test(quantity) || !Number.isSafeInteger(Number(quantity)) || Number(quantity) > MAX_CART_QUANTITY) {
+      return cartDenial("quantity", "Invalid quantity.", 422);
+    }
+    const product = await context.locals.tot.getProductByHandle(form.get("sample_product") as string);
+    const variant = product?.variants.find((v) => v.id === form.get("sample_variant"));
+    if (!product || product.status !== "active" || product.visibility === "hidden" || product.visibility === "unlisted" ||
+      !variant || !variant.inventory.available || product.tenant_id !== tenant.tot_data_scope ||
+      variant.tenant_id !== tenant.tot_data_scope) {
+      return cartDenial("signature", "Product is unavailable.", 422);
+    }
+    const payload = await buildVariantCartPayload(product, variant, {
+      mode: "signed", secret: signing.secret, tenantId: commerceTenantId(tenant),
+    });
+    entries.splice(0, entries.length, ...payload.hidden.map((f): [string, string] => [f.name, f.value]), [payload.quantityName, quantity]);
   }
   const result = await enforceCartSubmission({
     entries,
     mode: commerce.mode,
     secret: signing.secret,
-    trustedTenantId: tenant.tenant_id,
+    trustedTenantId: commerceTenantId(tenant),
   });
   if (!result.ok) {
     const status = result.code === "signing-unavailable" ? 503 : 422;