@tokenoftrust/storefront-runner 3.0.0 → 3.0.1

package/agency-kit/tools/lib/public-binaries.mjs

@@ -5,10 +5,13 @@
  * catalog images, and the source store is never shut down before that check passes. This decides,
  * from a listing of the store's `public/` tree, whether the repo is carrying binaries it must not.
  *
- * Three findings, each naming its remedy:
+ * Findings, each naming its remedy:
  *
- *   - `catalog-images-in-repo` — any file under `public/catalog-images/`, the directory a catalog
- *     image download writes. Decided from paths alone, so a caller without sizes still refuses it.
+ *   - one per entry of {@link FORBIDDEN_PUBLIC_DIRS}: any file under a directory a media download
+ *     writes (`public/catalog-images/` is `catalog-images-in-repo`, `public/blog/wp-content/uploads/`
+ *     is `blog-media-in-repo`). Decided from paths alone, so a caller without sizes still refuses
+ *     it. This list is the one source the validators and the reconcile read; the Gitea
+ *     pre-receive size guard names the same directories.
  *   - `public-binary-oversized` — one raster or media file over {@link PUBLIC_BINARY_LIMITS}
  *     `maxFileBytes`.
  *   - `public-tree-over-budget` — the whole `public/` tree over `maxTotalBytes`.
@@ -28,13 +31,25 @@ export const PUBLIC_BINARY_LIMITS = Object.freeze({
   maxTotalBytes: 32 * 1024 * 1024,
 });
 
-/** The directory under `public/` a catalog image download writes. */
-export const CATALOG_IMAGES_DIR = "catalog-images/";
+/**
+ * The directories under `public/` a media download writes. No file under one may be committed.
+ *
+ * @type {ReadonlyArray<Readonly<{ dir: string, code: string, noun: string }>>}
+ */
+export const FORBIDDEN_PUBLIC_DIRS = Object.freeze([
+  Object.freeze({ dir: "catalog-images/", code: "catalog-images-in-repo", noun: "catalog image" }),
+  Object.freeze({ dir: "blog/wp-content/uploads/", code: "blog-media-in-repo", noun: "blog media" }),
+]);
 
-/** The finding code for files under {@link CATALOG_IMAGES_DIR}. */
-export const CATALOG_IMAGES_FINDING_CODE = "catalog-images-in-repo";
+/** The finding codes decided from paths alone. */
+export const PATH_DECIDED_FINDING_CODES = Object.freeze(new Set(FORBIDDEN_PUBLIC_DIRS.map((d) => d.code)));
+
+/** True for a path (relative to `public/`, `/` separators) under a forbidden directory. */
+export function isForbiddenPublicPath(rel) {
+  return FORBIDDEN_PUBLIC_DIRS.some((d) => rel.startsWith(d.dir));
+}
 
-/** The kit command that moves rehosted catalog image references back to their source URLs. */
+/** The kit command that moves downloaded catalog images and blog media back to their source URLs. */
 export const UNHOST_IMAGES_COMMAND = "node agency-kit/tools/import-catalog.mjs --store <checkout> --unhost-images --write";
 
 const RASTER_OR_MEDIA = /\.(?:jpe?g|png|gif|webp|avif|bmp|tiff?|heic|heif|ico|jxl|mp4|m4v|mov|webm|mkv|avi|mpe?g|mp3|wav|ogg|oga|m4a|aac|flac|opus)$/i;
@@ -51,19 +66,20 @@ export function publicBinaryFindings(entries, limits = {}) {
   const maxFileBytes = limits.maxFileBytes ?? PUBLIC_BINARY_LIMITS.maxFileBytes;
   const maxTotalBytes = limits.maxTotalBytes ?? PUBLIC_BINARY_LIMITS.maxTotalBytes;
   const findings = [];
-  const catalogImages = entries.filter((e) => e.rel.startsWith(CATALOG_IMAGES_DIR));
-  if (catalogImages.length > 0) {
-    const bytes = catalogImages.reduce((n, e) => n + (e.bytes ?? 0), 0);
+  for (const { dir, code, noun } of FORBIDDEN_PUBLIC_DIRS) {
+    const files = entries.filter((e) => e.rel.startsWith(dir));
+    if (files.length === 0) continue;
+    const bytes = files.reduce((n, e) => n + (e.bytes ?? 0), 0);
     findings.push({
-      code: CATALOG_IMAGES_FINDING_CODE,
-      path: `public/${CATALOG_IMAGES_DIR}`,
-      message: `${catalogImages.length} catalog image file(s)${bytes ? ` (${mb(bytes)})` : ""} are committed to the store repo; ` +
+      code,
+      path: `public/${dir}`,
+      message: `${files.length} ${noun} file(s)${bytes ? ` (${mb(bytes)})` : ""} are committed to the store repo; ` +
         "images belong in the platform pool, not the repo; until platform capture owns them, keep each image at its source URL",
       remedy: UNHOST_IMAGES_COMMAND,
     });
   }
   for (const e of entries) {
-    if (e.rel.startsWith(CATALOG_IMAGES_DIR) || e.bytes === undefined) continue;
+    if (isForbiddenPublicPath(e.rel) || e.bytes === undefined) continue;
     if (e.bytes > maxFileBytes && RASTER_OR_MEDIA.test(e.rel)) {
       findings.push({
         code: "public-binary-oversized",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/scripts/tenant/validate.mjs

@@ -45,7 +45,7 @@ import {
   parseMappingTarget,
   workspacePathForTenantRelative,
 } from "../../agency-kit/tools/lib/tot-repo-mappings.mjs";
-import { CATALOG_IMAGES_DIR, publicBinaryFindings } from "../../agency-kit/tools/lib/public-binaries.mjs";
+import { isForbiddenPublicPath, publicBinaryFindings } from "../../agency-kit/tools/lib/public-binaries.mjs";
 import { validateVisualParityClosure } from "../../packages/cli/src/visual-parity.mjs";
 import { declaredObligations, isRegulatedCompliance, validateDeclaredConfig } from "../../packages/cli/src/declared-config.mjs";
 
@@ -1367,8 +1367,8 @@ function checkAsset(src, file, publicDir, tenantId) {
 function findLargePublicAssets(publicDir, rel) {
   const out = [];
   for (const p of walk(publicDir, () => true)) {
-    // public/catalog-images/ is already an error (catalog-images-in-repo); one line, not thousands.
-    if (relative(publicDir, p).split("\\").join("/").startsWith(CATALOG_IMAGES_DIR)) continue;
+    // a forbidden media directory is already an error (catalog-images-in-repo, blog-media-in-repo); one line, not thousands.
+    if (isForbiddenPublicPath(relative(publicDir, p).split("\\").join("/"))) continue;
     const size = statSync(p).size;
     if (size >= LARGE_PUBLIC_ASSET_BYTES) {
       out.push(mk(WARN, "large-public-asset", rel(p), `${(size / 1024).toFixed(0)}KB`));