@tokenoftrust/storefront-runner 4.11.3 → 4.11.4

package/apps/storefront/src/lib/access/shared/viewerGrant.ts

@@ -26,9 +26,11 @@
  * it keeps its OWN small transport rather than importing another cluster's copy so
  * the two stay decoupled (the same reason previewStatus duplicates its transport).
  *
- * The MCP HOST is the ORIGIN of `MCP_APP_BINDING_URL` — the same tier the invite
- * app-binding WRITE (`recordDeveloperAppBinding`) targets, so this READ and that
- * WRITE always agree on which subject-capability store they speak to.
+ * The ship and contribute reads go to the ORIGIN of `MCP_APP_BINDING_URL` — the same tier
+ * the invite app-binding WRITE (`recordDeveloperAppBinding`) targets, so those READs and
+ * that WRITE always agree on which subject-capability store they speak to. A named grant
+ * (`resolveNamedSubjectGrant`) always goes to the code-owned grant authority,
+ * `MCP_GRANT_AUTHORITY_URL`, with no fallback to the app binding.
  */
 import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 import type { Capability } from "./capability.js";
@@ -48,7 +50,14 @@ export class FetchShipGrantTransport implements ViewerShipGrantGetTransport {
     // every admin tab), so an unbounded hang stalls the whole document stream. A
     // timeout aborts to the documented deny-default (the resolver maps any transport/
     // timeout fault to `preview-access`) — never a render-blocking wait on a slow MCP.
-    const res = await fetch(url, { method: "GET", headers, signal: AbortSignal.timeout(2500) });
+    // `redirect: "error"`: a redirect would carry the service-secret header to another origin,
+    // so it rejects (a transport fault, so a deny) and nothing is sent to the redirect target.
+    const res = await fetch(url, {
+      method: "GET",
+      headers,
+      redirect: "error",
+      signal: AbortSignal.timeout(2500),
+    });
     return { status: res.status, json: () => res.json() };
   }
 }
@@ -110,9 +119,10 @@ async function resolveRawViewerCapability(
 
 /**
  * Whether `email` holds a LIVE owner-consented grant of exactly `capability` over `appDomain`,
- * asked of the same subject-capability seam with the capability named. True only on an explicit
- * `200 { capability: <capability> }`; unconfigured, any non-2xx, a timeout, an unparseable body or
- * any other answer is false. No cache: a revoke takes effect on the next call. Never throws.
+ * asked of the grant authority's subject-capability seam with the capability named. True only on
+ * an explicit `200 { capability: <capability> }`; an unconfigured or malformed grant authority,
+ * any non-2xx, a redirect, a timeout, an unparseable body or any other answer is false. No cache:
+ * a revoke takes effect on the next call. Never throws.
  */
 export async function resolveNamedSubjectGrant(
   email: string | null | undefined,
@@ -128,6 +138,7 @@ export async function resolveNamedSubjectGrant(
       method: "GET",
       path: "/internal/dev-access/subject-capability",
       query: { subject, tenant, app: "storefront", capability },
+      authority: "grant",
       transport: deps.transport ?? new FetchShipGrantTransport(),
     });
     if (outcome.kind !== "ok") return false;

package/apps/storefront/src/lib/developer-experience/http/mcpServiceCall.ts

@@ -1,8 +1,16 @@
 /**
  * The one transport for storefront → tot-mcp service calls (`/internal/*`, keyless
- * `x-mcp-service-secret` seam). Every caller builds its URL here from the ORIGIN of
- * `MCP_APP_BINDING_URL` plus a literal contract path, so the paths and capabilities a caller
- * sends are pinned by `contracts/tot-mcp-service-seam.json` (see `mcpServiceSeam.test.ts`).
+ * `x-mcp-service-secret` seam). Every caller builds its URL here from a code-owned authority
+ * origin plus a literal contract path, so the paths and capabilities a caller sends are pinned
+ * by `contracts/tot-mcp-service-seam.json` (see `mcpServiceSeam.test.ts`).
+ *
+ * The authority is chosen by the caller's code, never by a request:
+ *   - omitted → the ORIGIN of `MCP_APP_BINDING_URL` (the registry/identity tier).
+ *   - `"grant"` → `MCP_GRANT_AUTHORITY_URL`, which must be a bare HTTPS origin. Missing is
+ *     `not-configured` and malformed is `bad-url`; neither falls back to the app binding.
+ *
+ * A thrown transport failure comes back as one fixed diagnostic, never the thrown value: a
+ * fetch error can carry the request URL (and so its subject query) to every downstream sink.
  *
  * A 401 or 404 from a seam route is misconfiguration, never a business answer: tot-mcp's
  * routes answer 200 for every absent/unknown case, so 401 means the secret or URL is wrong
@@ -37,26 +45,54 @@ export interface McpServiceRequest {
   path: string;
   query?: Record<string, string>;
   body?: unknown;
+  /** `"grant"` selects `MCP_GRANT_AUTHORITY_URL`; omitted selects `MCP_APP_BINDING_URL`. */
+  authority?: "grant";
   transport: McpServiceTransport;
 }
 
-function misconfigurationReason(status: 401 | 404): string {
+/** The only diagnostic a thrown transport failure produces. */
+export const MCP_SERVICE_TRANSPORT_FAILURE = "tot-mcp service request failed";
+
+const AUTHORITY_ENV = {
+  binding: "MCP_APP_BINDING_URL",
+  grant: "MCP_GRANT_AUTHORITY_URL",
+} as const;
+
+/**
+ * The grant authority's origin, or null unless `raw` is exactly a bare HTTPS origin (an optional
+ * trailing `/` allowed): no credentials, port spelling, path, query or fragment.
+ */
+export function grantAuthorityOrigin(raw: string): string | null {
+  if (!URL.canParse(raw)) return null;
+  const parsed = new URL(raw);
+  if (parsed.protocol !== "https:") return null;
+  return raw === parsed.origin || raw === `${parsed.origin}/` ? parsed.origin : null;
+}
+
+function misconfigurationReason(status: 401 | 404, urlEnv: string): string {
   return status === 401
-    ? "tot-mcp rejected the service secret, or MCP_APP_BINDING_URL points at a session-guarded surface"
+    ? `tot-mcp rejected the service secret, or ${urlEnv} points at a session-guarded surface`
     : "tot-mcp does not serve this path; storefront and tot-mcp disagree on the service-seam contract";
 }
 
 export async function callMcpService(req: McpServiceRequest): Promise<McpServiceOutcome> {
-  const bindingUrl = await readEnv("MCP_APP_BINDING_URL");
+  const urlEnv = AUTHORITY_ENV[req.authority ?? "binding"];
+  const authorityUrl = await readEnv(urlEnv);
   const secret = await readEnv("MCP_SERVICE_SHARED_SECRET");
-  if (!bindingUrl || !secret) return { kind: "not-configured" };
+  if (!authorityUrl || !secret) return { kind: "not-configured" };
 
-  let url: string;
-  try {
-    url = `${new URL(bindingUrl).origin}${req.path}`;
-  } catch {
-    return { kind: "bad-url" };
+  let origin: string | null;
+  if (req.authority === "grant") {
+    origin = grantAuthorityOrigin(authorityUrl);
+  } else {
+    try {
+      origin = new URL(authorityUrl).origin;
+    } catch {
+      origin = null;
+    }
   }
+  if (!origin) return { kind: "bad-url" };
+  let url = `${origin}${req.path}`;
   if (req.query) url += `?${new URLSearchParams(req.query).toString()}`;
 
   const headers = { "x-mcp-service-secret": secret };
@@ -69,12 +105,12 @@ export async function callMcpService(req: McpServiceRequest): Promise<McpService
       if (!req.transport.post) throw new Error("transport has no post()");
       res = await req.transport.post(url, headers, req.body);
     }
-  } catch (cause) {
-    return { kind: "transport-error", message: cause instanceof Error ? cause.message : String(cause) };
+  } catch {
+    return { kind: "transport-error", message: MCP_SERVICE_TRANSPORT_FAILURE };
   }
 
   if (res.status === 401 || res.status === 404) {
-    const reason = misconfigurationReason(res.status);
+    const reason = misconfigurationReason(res.status, urlEnv);
     console.error(
       `[mcp-service-seam] ${req.method} ${req.path} answered ${res.status}: ${reason}`,
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.3",
+  "version": "4.11.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",