@tokenoftrust/storefront-runner 2.5.4 → 2.5.5

package/apps/storefront/src/lib/publication/shared/routedApiParam.ts

@@ -0,0 +1,28 @@
+import type { APIContext } from "astro";
+
+const ROUTES = {
+  "pipeline-job": { path: /^\/api\/pipeline\/jobs\/([A-Za-z0-9._:-]{1,128})\/?$/, param: "jobId" },
+  "fulfillment-order": { path: /^\/api\/admin\/fulfillment\/orders\/([A-Za-z0-9._:-]{1,128})\/?$/, param: "id" },
+  "fulfillment-address": { path: /^\/api\/admin\/fulfillment\/orders\/([A-Za-z0-9._:-]{1,128})\/address\/?$/, param: "id" },
+} as const;
+
+export type RoutedApiKind = keyof typeof ROUTES;
+
+/** Resolve an opaque resource inside the server-routed tenant, including rewritten endpoints. */
+export function routedApiParam(context: APIContext, kind: RoutedApiKind): string | undefined {
+  if (!Object.hasOwn(ROUTES, kind)) return undefined;
+  const tenant = context.locals.tenant?.appDomain;
+  const prefix = context.locals.apiBasePath;
+  if (typeof tenant !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,252}$/.test(tenant)) return undefined;
+  if (typeof prefix !== "string" || (prefix !== "" && !/^\/[A-Za-z0-9][A-Za-z0-9.-]{0,252}$/.test(prefix))) return undefined;
+  let pathname: string;
+  try { pathname = new URL(context.request.url).pathname; } catch { return undefined; }
+  if (prefix && !pathname.startsWith(`${prefix}/`)) return undefined;
+  const relative = pathname.slice(prefix.length);
+  const route = ROUTES[kind];
+  const id = route.path.exec(relative)?.[1];
+  if (!id || id === "." || id === "..") return undefined;
+  const param = context.params[route.param];
+  if (param !== undefined && param !== "" && param !== id) return undefined;
+  return id;
+}

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -1,3 +1,4 @@
+import { routedApiParam } from "@/lib/publication/shared/routedApiParam";
 /**
  * Owner-only retrieval of a stored ship-to address.
  * The read runs only after the owner gate admits the caller.
@@ -24,8 +25,8 @@ export async function GET(context: APIContext): Promise<Response> {
       },
     });
   }
-  const orderId = context.params.id ?? "";
-  if (!isOpaqueId(orderId)) return fulfillmentResultResponse({ ok: false, code: "not-found" }, () => ({}));
+  const orderId = routedApiParam(context, "fulfillment-address");
+  if (!orderId || !isOpaqueId(orderId)) return fulfillmentResultResponse({ ok: false, code: "not-found" }, () => ({}));
   const opened = await openFulfillment(context);
   if (!opened.ok) return opened.response;
   return fulfillmentResultResponse(await opened.service.readAddress(opened.actor, orderId), (address) => address);

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id].ts

@@ -1,3 +1,4 @@
+import { routedApiParam } from "@/lib/publication/shared/routedApiParam";
 /**
  * Authenticated owner API for one order's fulfillment commands.
  * The response is state codes and the fulfillment view. It never returns an address.
@@ -53,8 +54,8 @@ function fail(code: string): Response {
 export async function GET(context: APIContext): Promise<Response> {
   const refused = await requireOwner(context);
   if (refused) return refused;
-  const orderId = context.params.id ?? "";
-  if (!isOpaqueId(orderId)) return fail("not-found");
+  const orderId = routedApiParam(context, "fulfillment-order");
+  if (!orderId || !isOpaqueId(orderId)) return fail("not-found");
   const opened = await openFulfillment(context);
   if (!opened.ok) return opened.response;
   return fulfillmentResultResponse(await opened.service.get(opened.actor, orderId), (view) => view);
@@ -63,8 +64,8 @@ export async function GET(context: APIContext): Promise<Response> {
 export async function POST(context: APIContext): Promise<Response> {
   const refused = await requireOwner(context);
   if (refused) return refused;
-  const orderId = context.params.id ?? "";
-  if (!isOpaqueId(orderId)) return fail("not-found");
+  const orderId = routedApiParam(context, "fulfillment-order");
+  if (!orderId || !isOpaqueId(orderId)) return fail("not-found");
   const raw = await readJsonBody(context.request);
   if (!raw.ok) return fulfillmentResultResponse(raw, () => ({}));
   const parsed = parseFulfillmentBody(raw.value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.5.4",
+  "version": "2.5.5",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",