@tokenoftrust/storefront-runner 2.5.0 → 2.5.1

package/apps/storefront/src/lib/fulfillment/admin/commerceDesk.ts

@@ -1,12 +1,21 @@
 /** Operational browser client. All authority and state changes remain in the authenticated APIs. */
 import type { FulfillmentView } from "../fulfillmentService.js";
+import { parseCommerceDeskApiRoot } from "./commerceDeskRouting.js";
 export function mountCommerceDesk(root: HTMLElement): void {
   const status = root.querySelector<HTMLElement>("[data-desk-status]")!;
   const rows = root.querySelector<HTMLElement>("[data-desk-orders]")!;
   const next = root.querySelector<HTMLButtonElement>("[data-desk-next]")!;
+  const api = parseCommerceDeskApiRoot(root.dataset.commerceApi, root.dataset.targetTenant);
+  if (!api) {
+    rows.replaceChildren();
+    next.hidden = true;
+    root.querySelector<HTMLButtonElement>("[data-desk-refresh]")!.disabled = true;
+    status.textContent = "Open the selected store to view its fulfillment orders.";
+    return;
+  }
   let cursor: string | null = null;
   async function request(url: string, body?: unknown): Promise<unknown> {
-    const response = await fetch(url, {
+    const response = await fetch(`${api}${url}`, {
       credentials: "same-origin",
       cache: "no-store",
       ...(body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : {}),
@@ -45,8 +54,8 @@ export function mountCommerceDesk(root: HTMLElement): void {
         try {
           await request(
             action === "claim"
-              ? "/api/admin/fulfillment/batches"
-              : `/api/admin/fulfillment/orders/${encodeURIComponent(order.orderId)}`,
+              ? "/batches"
+              : `/orders/${encodeURIComponent(order.orderId)}`,
             action === "claim"
               ? { orderIds: [order.orderId], expectedVersions: { [order.orderId]: order.eventVersion } }
               : { action, expectedVersion: order.eventVersion, scope: "whole-order" },
@@ -86,10 +95,11 @@ export function mountCommerceDesk(root: HTMLElement): void {
     status.textContent = "Loading orders…";
     try {
       const page = (await request(
-        `/api/admin/fulfillment/orders?limit=25${after ? `&cursor=${encodeURIComponent(after)}` : ""}`,
+        `/orders?limit=25${after ? `&cursor=${encodeURIComponent(after)}` : ""}`,
       )) as { tenantId: string; orders: FulfillmentView[]; nextCursor: string | null };
       if (page.tenantId !== root.dataset.targetTenant) {
         rows.replaceChildren();
+        cursor = null;
         next.hidden = true;
         status.textContent = "Open the selected store to view its fulfillment orders.";
         return;

package/apps/storefront/src/lib/fulfillment/admin/commerceDeskRouting.ts

@@ -0,0 +1,45 @@
+/** Same-origin navigation only; fulfillment APIs independently authorize the routed tenant. */
+import { withBase } from "../../publication/shared/basePath.js";
+
+const API_ROOT = "/api/admin/fulfillment";
+
+function canonicalHost(value: string): boolean {
+  if (!value || value.length > 253 || value.split(".").some((part) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(part))) {
+    return false;
+  }
+  try {
+    const url = new URL(`https://${value}/`);
+    return url.host === value && url.pathname === "/";
+  } catch {
+    return false;
+  }
+}
+
+/** Explicit server API metadata, never a preview/revision URL or request query. */
+export function commerceDeskApiRoot(input: {
+  routedTenant: { appDomain: string; pathPrefixTenants?: boolean };
+  apiBasePath: string | undefined;
+  targetTenant: string;
+  registeredTarget: { appDomain: string } | null;
+}): string | null {
+  const { routedTenant, apiBasePath, targetTenant, registeredTarget } = input;
+  if (
+    !canonicalHost(routedTenant.appDomain) || !canonicalHost(targetTenant) ||
+    registeredTarget?.appDomain !== targetTenant || typeof apiBasePath !== "string"
+  ) return null;
+  if (apiBasePath && (
+    !apiBasePath.startsWith("/") || !apiBasePath.slice(1).includes(".") ||
+    !canonicalHost(apiBasePath.slice(1))
+  )) return null;
+  if (!apiBasePath && targetTenant === routedTenant.appDomain) return API_ROOT;
+  if (!apiBasePath && !routedTenant.pathPrefixTenants) return null;
+  if (!targetTenant.includes(".")) return null;
+  return withBase(`/${targetTenant}`, API_ROOT);
+}
+
+/** The SSR endpoint must agree with the displayed canonical tenant; malformed metadata stays inert. */
+export function parseCommerceDeskApiRoot(value: string | undefined, targetTenant: string | undefined): string | null {
+  if (!targetTenant || !canonicalHost(targetTenant)) return null;
+  if (value === API_ROOT) return value;
+  return targetTenant.includes(".") && value === withBase(`/${targetTenant}`, API_ROOT) ? value : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",