@tokenoftrust/storefront-runner 4.11.15 → 4.11.16

package/apps/storefront/src/lib/access/auth/session.ts

@@ -204,6 +204,18 @@ export async function updateSession(
   return next;
 }
 
+/** Persist an authenticated record under a fresh id without extending its lifetime. */
+export async function rotateSession(
+  store: SessionStore,
+  record: SessionRecord,
+  nowSeconds: number,
+): Promise<{ id: string; record: SessionRecord } | null> {
+  if (record.exp <= nowSeconds) return null;
+  const id = newSessionId();
+  await store.put(id, JSON.stringify(record), record.exp - nowSeconds);
+  return { id, record };
+}
+
 /** Revoke a session (logout / admin kill). Idempotent. */
 export async function revokeSession(
   store: SessionStore,

package/apps/storefront/src/lib/access/dashboard/staffStoreEntry.ts

@@ -10,15 +10,15 @@
  *      minted from the VERIFIED session email (no plaintext email on the wire);
  *   2. tot20 re-checks staff scope, scopes the capability, and writes the AUDIT row —
  *      it is the authority, and nothing is admitted without its ok;
- *   3. stamp the short-lived {@link StaffSelection} on the session (never a `tenants[]`
- *      entry), so re-entering after it lapses re-audits;
+ *   3. persist the short-lived {@link StaffSelection} under a fresh session id (never a
+ *      `tenants[]` entry), preserving the original expiry; re-entry re-audits;
  *   4. hand every exit's outcome to the caller's `emit`, which records it as
  *      `dashboard.vendor_entered` against its opaque admin actor id (the email is
  *      never stored).
  */
 import type { SessionRecord, SessionStore, StaffSelection } from "@/lib/access/auth/session";
-import { updateSession } from "@/lib/access/auth/session";
-import { isStaffSession, buildStaffSelection } from "./staffAdmission";
+import { readSession, rotateSession } from "@/lib/access/auth/session";
+import { isStaffSession, buildStaffSelection, STAFF_SELECTION_TTL_SECONDS } from "./staffAdmission";
 import {
   createStaffVendorAccessClient,
   staffAccessFailureMessage,
@@ -41,18 +41,19 @@ export interface StaffStoreEntryInput {
   /** Records each entry outcome; the route binds it to its opaque admin actor. */
   emit: (event: StaffEntryEvent) => void;
   /** The persisted session to stamp the selection on; null when there is no store. */
-  sessionHandle: () => Promise<{ store: SessionStore; id: string } | null>;
+  /** A null id is a freshly verified, not-yet-persisted sign-in record. */
+  sessionHandle: () => Promise<{ store: SessionStore; id: string | null } | null>;
 }
 
 export type StaffStoreEntryResult =
-  | { ok: true; selection: StaffSelection; capability: string }
+  | { ok: true; selection: StaffSelection; capability: string; sessionId: string; expiresIn: number }
   | {
       ok: false;
       status: number;
       body: { error: string; reason?: string; code?: string };
     };
 
-/** Enter `vendorAppDomain` as ToT staff: audit with tot20, then persist the selection. */
+/** Audit with tot20, then persist the selection under a fresh, expiry-preserving id. */
 export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<StaffStoreEntryResult> {
   const { session, emit } = input;
   const vendorAppDomain = input.vendorAppDomain.trim();
@@ -99,6 +100,7 @@ export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<St
     resource: vendorAppDomain,
     capability: result.capability,
     nowSeconds,
+    ttlSeconds: Math.max(1, Math.min(STAFF_SELECTION_TTL_SECONDS, session.exp - nowSeconds)),
   });
   const handle = await input.sessionHandle();
   if (!handle) {
@@ -111,12 +113,25 @@ export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<St
     });
     return { ok: false, status: 503, body: { error: "session store unavailable; cannot persist admission" } };
   }
-  const updated = await updateSession(
-    handle.store,
-    handle.id,
-    (rec) => ({ ...rec, staffSelection: selection }),
-    nowSeconds,
-  );
+  let updated;
+  try {
+    const current = handle.id ? await readSession(handle.store, handle.id, nowSeconds) : session;
+    updated = current && current.email === session.email && current.subject === session.subject && isStaffSession(current) && current.exp > nowSeconds
+      ? await rotateSession(handle.store, {
+          ...current,
+          createdAt: session.createdAt,
+          exp: Math.min(current.exp, session.exp),
+          staffSelection: { ...selection, exp: Math.min(selection.exp, current.exp, session.exp) },
+        }, nowSeconds)
+      : null;
+  } catch {
+    emit({
+      outcome: { status: "failed", errorClass: "session_store_unavailable" },
+      scope: { tenantId: vendorAppDomain },
+      payload: { args: { resource: vendorAppDomain, capability: result.capability } },
+    });
+    return { ok: false, status: 503, body: { error: "session store unavailable; cannot persist admission" } };
+  }
   if (!updated) {
     emit({
       outcome: { status: "failed", errorClass: "session_expired" },
@@ -131,5 +146,5 @@ export async function enterStoreAsStaff(input: StaffStoreEntryInput): Promise<St
     scope: { tenantId: vendorAppDomain },
     payload: { args: { resource: vendorAppDomain, capability: result.capability } },
   });
-  return { ok: true, selection, capability: result.capability };
+  return { ok: true, selection, capability: result.capability, sessionId: updated.id, expiresIn: updated.record.exp - nowSeconds };
 }

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -49,6 +49,7 @@ import type {
 } from "@tot/public-runtime";
 import type { ActionKey } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/access/auth/route";
+import type { SessionRecord } from "@/lib/access/auth/session";
 import { sessionHostCapability } from "@/lib/access/auth/loginGate";
 import { isStaffSession } from "@/lib/access/dashboard/staffAdmission";
 import { readEnv } from "@/lib/publication/shared/env";
@@ -85,6 +86,8 @@ export function classifyActorKind(
 }
 
 export interface ResolveUiActorInput {
+  /** An already verified record for sign-in paths that do not yet have a cookie. */
+  session?: SessionRecord;
   /**
    * Fallback acting identity for the HEADLESS path (no signed-in viewer) — typically
    * the resolved tenant owner (`auth.owner`). Only used to seed the opaque id when
@@ -107,12 +110,12 @@ export async function resolveUiActor(
 ): Promise<ActivityActor> {
   // The host-bound `locals.viewer` chrome omits `staff[]`, so read the full session
   // to tell a ToT-staff (admin) actor from a store owner (merchant). Best-effort.
-  const session = await readViewerSession(context).catch(() => null);
+  const session = input.session ?? await readViewerSession(context).catch(() => null);
   // The signed-in identity is the host gate's `locals.viewer`, else the raw session (a
   // route that never went through that gate, e.g. the /dev cockpit's rendezvous
   // approval). Ownership is the session's standing on the ROUTED tenant only — a
   // session that owns another store is not this store's merchant.
-  const email = context.locals?.viewer?.email ?? session?.email;
+  const email = input.session ? input.session.email : context.locals?.viewer?.email ?? session?.email;
   const viewer: ViewerLike | undefined = email
     ? { email, capability: sessionHostCapability(session, context.locals?.tenant?.appDomain ?? "") }
     : undefined;

package/apps/storefront/src/lib/developer-experience/http/fetchTransport.ts

@@ -52,6 +52,7 @@ export class FetchHttpTransport implements HttpTransport, HttpGetTransport {
       // body). A per-call or per-transport header of the same name still wins.
       headers: { "content-type": "application/json", ...this.defaultHeaders, ...headers },
       body: JSON.stringify(body),
+      redirect: "manual",
       signal: this.signal(),
     });
     return { status: res.status, json: () => res.json() };
@@ -60,6 +61,7 @@ export class FetchHttpTransport implements HttpTransport, HttpGetTransport {
   async get(url: string, headers: Record<string, string>): Promise<HttpResponseLike> {
     const res = await fetch(url, {
       method: "GET",
+      redirect: "manual",
       headers: { ...this.defaultHeaders, ...headers },
       signal: this.signal(),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.15",
+  "version": "4.11.16",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",