@tokenoftrust/storefront-runner 4.11.10 → 4.11.12

package/apps/storefront/public/js/dashboard-delegate.js

@@ -58,7 +58,9 @@
     for (const g of grants) {
       const tr = document.createElement("tr");
       const dev = document.createElement("td");
-      dev.textContent = (g.principal && g.principal.email) || "";
+      // tot20 names the grantee by an opaque id in this list, never the email.
+      dev.textContent = (g.principal && g.principal.email) || "Not shown (one grant per person)";
+      if (!(g.principal && g.principal.email)) dev.className = "muted";
       const cap = document.createElement("td");
       cap.textContent = LABELS[g.capability] || g.capability || "";
       const exp = document.createElement("td");

package/apps/storefront/src/lib/access/dashboard/delegateGate.ts

@@ -31,26 +31,31 @@ export const UNPAID_DELEGATION_NOTE =
   "unpaid — no delegation needed. Ship-on-behalf delegation becomes available once the live " +
   "site is activated.";
 
-/** The delegate section: an unpaid store's note, or the paid store's {@link DelegateGate}. */
-export type DelegateSection = { mode: "unpaid"; role: null; explanation: string } | DelegateGate;
+/** A capability the owner's grant form offers. */
+export type OwnerGrantCapability = "ship-on-behalf" | "customer-contact-read";
 
 /**
- * Resolve the whole delegate section. Before a store is paid, an invited developer can
- * already add changes AND publish them (both `merge-to-preview` and `publish-live` admit the
- * "unpaid-store-developer" basis, lib/publication/pipeline/admission.ts), so delegation has nothing to
- * grant: every viewer, the owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store
- * resolves {@link resolveDelegateGate} unchanged.
+ * What the owner's "Grant access" form offers this viewer. Customer contact access is a support
+ * grant unrelated to payment, so a real owner always gets it. Ship-on-behalf is offered only once
+ * the store can go live: before that an invited developer can already add changes AND publish
+ * them (both `merge-to-preview` and `publish-live` admit the "unpaid-store-developer" basis,
+ * lib/publication/pipeline/admission.ts), so the owner sees {@link UNPAID_DELEGATION_NOTE} for it
+ * instead. A non-owner gets no form and the gate's explanation. PURE.
  */
-export function resolveDelegateSection(
+export function resolveOwnerGrantForm(
   storefrontMode: string | null | undefined,
   tenants: readonly TenantMembership[] | undefined,
   resource: string,
   staff?: StaffAdmission,
-): DelegateSection {
-  if (!storefrontModeAllowsGoLive(storefrontMode)) {
-    return { mode: "unpaid", role: null, explanation: UNPAID_DELEGATION_NOTE };
-  }
-  return resolveDelegateGate(tenants, resource, staff);
+): { offers: OwnerGrantCapability[]; note: string | null; gate: DelegateGate } {
+  const gate = resolveDelegateGate(tenants, resource, staff);
+  if (gate.mode !== "owner") return { offers: [], note: gate.explanation, gate };
+  const paid = storefrontModeAllowsGoLive(storefrontMode);
+  return {
+    offers: paid ? ["ship-on-behalf", "customer-contact-read"] : ["customer-contact-read"],
+    note: paid ? null : UNPAID_DELEGATION_NOTE,
+    gate,
+  };
 }
 
 /**

package/apps/storefront/src/lib/access/shared/principalGrants.ts

@@ -82,6 +82,25 @@
  */
 import { readEnv } from "@/lib/publication/shared/env";
 import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/access/auth/brokerAssertion";
+import { resolveContactReadGrant } from "@/lib/access/auth/contactReaderAuthority";
+import { resolveViewerShipCapability } from "@/lib/access/shared/viewerGrant";
+
+/** The live principal grant a person holds on a store, as far as the grant reads can tell. */
+export type HeldPrincipalGrant = "customer-contact-read" | "ship-on-behalf" | null;
+
+/**
+ * The live principal grant `email` already holds on `tenant`, read through the per-person
+ * subject-capability seam (keyed by email). tot20 keeps ONE principal grant per person per store
+ * (`addPrincipalGrant` writes `principalGrants[principalKey]`, capability included), so a new grant
+ * to someone who holds one REPLACES it; callers refuse instead. tot20's grant LIST cannot answer
+ * this: its rows name the principal by an opaque id, never the email. Both reads fail closed to
+ * "none" on a seam fault, so a fault lets the grant through rather than blocking it.
+ */
+export async function heldPrincipalGrant(email: string, tenant: string): Promise<HeldPrincipalGrant> {
+  if (await resolveContactReadGrant(email, tenant)) return "customer-contact-read";
+  if ((await resolveViewerShipCapability(email, tenant)) === "ship-on-behalf") return "ship-on-behalf";
+  return null;
+}
 
 /** A human grantee — the only principal type this HTTP surface accepts. */
 export interface UserPrincipal {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.10",
+  "version": "4.11.12",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",