@tokenoftrust/storefront-runner 4.11.11 → 4.11.12

package/apps/storefront/public/js/dashboard-delegate.js

@@ -58,7 +58,9 @@
     for (const g of grants) {
       const tr = document.createElement("tr");
       const dev = document.createElement("td");
-      dev.textContent = (g.principal && g.principal.email) || "";
+      // tot20 names the grantee by an opaque id in this list, never the email.
+      dev.textContent = (g.principal && g.principal.email) || "Not shown (one grant per person)";
+      if (!(g.principal && g.principal.email)) dev.className = "muted";
       const cap = document.createElement("td");
       cap.textContent = LABELS[g.capability] || g.capability || "";
       const exp = document.createElement("td");

package/apps/storefront/src/lib/access/shared/principalGrants.ts

@@ -82,6 +82,25 @@
  */
 import { readEnv } from "@/lib/publication/shared/env";
 import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/access/auth/brokerAssertion";
+import { resolveContactReadGrant } from "@/lib/access/auth/contactReaderAuthority";
+import { resolveViewerShipCapability } from "@/lib/access/shared/viewerGrant";
+
+/** The live principal grant a person holds on a store, as far as the grant reads can tell. */
+export type HeldPrincipalGrant = "customer-contact-read" | "ship-on-behalf" | null;
+
+/**
+ * The live principal grant `email` already holds on `tenant`, read through the per-person
+ * subject-capability seam (keyed by email). tot20 keeps ONE principal grant per person per store
+ * (`addPrincipalGrant` writes `principalGrants[principalKey]`, capability included), so a new grant
+ * to someone who holds one REPLACES it; callers refuse instead. tot20's grant LIST cannot answer
+ * this: its rows name the principal by an opaque id, never the email. Both reads fail closed to
+ * "none" on a seam fault, so a fault lets the grant through rather than blocking it.
+ */
+export async function heldPrincipalGrant(email: string, tenant: string): Promise<HeldPrincipalGrant> {
+  if (await resolveContactReadGrant(email, tenant)) return "customer-contact-read";
+  if ((await resolveViewerShipCapability(email, tenant)) === "ship-on-behalf") return "ship-on-behalf";
+  return null;
+}
 
 /** A human grantee — the only principal type this HTTP surface accepts. */
 export interface UserPrincipal {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.11",
+  "version": "4.11.12",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",