@tokenoftrust/storefront-runner 4.11.5 → 4.11.6

package/apps/storefront/src/lib/orders/admin/orderSource.ts

@@ -86,6 +86,22 @@ export function workerOrderSourceDeps(
   };
 }
 
+/**
+ * The stage a tenant's orders are recorded under, shared by every reader of an order (the Orders
+ * tab, the order routes and the contact vault routes): a shared-store tenant's ledger and sealed
+ * contacts carry this Worker's `COMMERCE_STAGE`; an own-store tenant's carry the routed environment's.
+ */
+export async function resolveOrderStage(
+  input: { tenantId: string; customizationEnv: CustomizationEnv | undefined },
+  deps: Pick<OrderSourceDeps, "admitSharedStoreTenant" | "readEnv">,
+): Promise<{ checkout: "shared-test-store" | "own-store"; stage: CommerceStage | null }> {
+  if ((await deps.admitSharedStoreTenant(input.tenantId)).ok) {
+    const stage = await deps.readEnv("COMMERCE_STAGE");
+    return { checkout: "shared-test-store", stage: stage === "preview" || stage === "publication" ? stage : null };
+  }
+  return { checkout: "own-store", stage: commerceStageForEnv(input.customizationEnv) };
+}
+
 export async function resolveOrderSource(
   input: { tenantId: string; customizationEnv: CustomizationEnv | undefined },
   deps: OrderSourceDeps,
@@ -93,19 +109,16 @@ export async function resolveOrderSource(
   const tenantId = input.tenantId.trim();
   if (!tenantId) return { kind: "not-connected", checkout: null, gap: "no-tenant" };
 
-  if ((await deps.admitSharedStoreTenant(tenantId)).ok) {
-    const checkout = "shared-test-store";
-    const stage = await deps.readEnv("COMMERCE_STAGE");
-    if (stage !== "preview" && stage !== "publication") return { kind: "not-connected", checkout, gap: "stage-unknown" };
+  const { checkout, stage } = await resolveOrderStage({ tenantId, customizationEnv: input.customizationEnv }, deps);
+  if (!stage) return { kind: "not-connected", checkout, gap: "stage-unknown" };
+
+  if (checkout === "shared-test-store") {
     const db = await deps.readLedgerDb();
     if (!db) return { kind: "not-connected", checkout, gap: "ledger-unavailable" };
     const book = ledgerOrderBook(new ScrappyOrderLedger(db), { tenantId, stage });
     return { kind: "ledger", checkout, scope: { tenantId, stage }, client: book.client, status: book.status };
   }
 
-  const checkout = "own-store";
-  const stage = commerceStageForEnv(input.customizationEnv);
-  if (!stage) return { kind: "not-connected", checkout, gap: "stage-unknown" };
   const bearer = await deps.readEnv("FOXY_ORDER_API_KEY");
   if (!bearer) return { kind: "not-connected", checkout, gap: "partner-key-missing" };
   return {

package/apps/storefront/src/lib/orders/vault/contactRoutes.ts

@@ -1,16 +1,19 @@
 /**
  * The admission every order-contact admin route runs before it touches the vault: the owner gate,
  * then the owner-or-staff split (contactReaderAuthority), then — for staff — a reason, a ticket and a
- * LIVE owner-consented customer-contact-read grant. The tenant comes from the routed host and the
- * stage from the routed customization environment, never from the request.
+ * LIVE owner-consented customer-contact-read grant. The tenant comes from the routed host, never
+ * from the request. An order contact's stage is the one its order is recorded under
+ * (`resolveOrderStage`, shared with the Orders tab, with the shared-store admission its route
+ * supplies); a message's is the routed customization environment's.
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { readViewerSession } from "@/lib/access/auth/route";
 import { contactReaderAuthority, resolveContactReadGrant } from "@/lib/access/auth/contactReaderAuthority";
-import { readD1 } from "@/lib/publication/shared/env";
+import { readD1, readEnv } from "@/lib/publication/shared/env";
 import { fromD1, type Queryable } from "@/lib/catalog/d1/catalog.js";
 import { commerceStageForEnv } from "@/lib/fulfillment/fulfillmentService";
+import { resolveOrderStage, type OrderSourceDeps } from "@/lib/orders/admin/orderSource";
 import type { KmsClient } from "@/lib/customers/contactVault/kms.js";
 import { loadVaultKms } from "./kmsEnv.js";
 import { type ContactActor, type VaultStage } from "@/lib/customers/contactVault/contactAudit.js";
@@ -54,6 +57,7 @@ export type ContactRoute =
 export async function openContactRoute(
   context: APIContext,
   expect: "owner" | "staff",
+  record: "message" | Pick<OrderSourceDeps, "admitSharedStoreTenant">,
   body?: unknown,
 ): Promise<ContactRoute> {
   const refuse = (error: string, status: number): ContactRoute => ({ ok: false, response: contactJson({ error }, status) });
@@ -79,7 +83,13 @@ export async function openContactRoute(
     actor = { actorId: authority.actorId, role: "staff", ...reason };
   }
 
-  const stage = commerceStageForEnv(context.locals.customizationEnv);
+  const customizationEnv = context.locals.customizationEnv;
+  const stage = record === "message"
+    ? commerceStageForEnv(customizationEnv)
+    : (await resolveOrderStage({ tenantId: host, customizationEnv }, {
+      admitSharedStoreTenant: record.admitSharedStoreTenant,
+      readEnv: async (name) => (await readEnv(name)) ?? undefined,
+    })).stage;
   if (!stage) return refuse("stage-unknown", 409);
   const d1 = await readD1("STOREFRONT_APPS_DB");
   if (!d1) return refuse("unavailable", 503);

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -10,6 +10,7 @@ import { routedApiParam } from "@/lib/publication/shared/routedApiParam";
  */
 import type { APIContext } from "astro";
 import { isOpaqueId } from "@/lib/fulfillment/fulfillmentService";
+import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { contactJson, openContactRoute } from "@/lib/orders/vault/contactRoutes";
 import { eraseOrderContact, readEraseGroups, readOrderContact, type Group } from "@/lib/orders/vault/orderContactVault";
 
@@ -18,7 +19,7 @@ export const prerender = false;
 export async function GET(context: APIContext): Promise<Response> {
   const orderId = routedApiParam(context, "fulfillment-address");
   if (!orderId || !isOpaqueId(orderId)) return contactJson({ error: "not-found" }, 404);
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const read = await readOrderContact(route.db, route.kms, {
     tenantId: route.tenantId, stage: route.stage, orderId, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(),
@@ -48,7 +49,7 @@ async function eraseGroups(request: Request): Promise<Group[] | undefined | null
 export async function DELETE(context: APIContext): Promise<Response> {
   const orderId = routedApiParam(context, "fulfillment-address");
   if (!orderId || !isOpaqueId(orderId)) return contactJson({ error: "not-found" }, 404);
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const groups = await eraseGroups(context.request);
   if (groups === null) return contactJson({ error: "malformed" }, 400);

package/apps/storefront/src/pages/api/admin/fulfillment/orders/contact-search.ts

@@ -6,6 +6,7 @@
  * Staff are refused 403 support-read-required. Nothing here logs the body.
  */
 import type { APIContext } from "astro";
+import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { contactJson, openContactRoute, readRequestJson } from "@/lib/orders/vault/contactRoutes";
 import { readSearchQuery, searchOrderContacts } from "@/lib/orders/vault/orderContactVault";
 
@@ -13,7 +14,7 @@ export const prerender = false;
 
 export async function POST(context: APIContext): Promise<Response> {
   if (new URL(context.request.url).search !== "") return contactJson({ error: "malformed" }, 400);
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const query = readSearchQuery(await readRequestJson(context.request));
   if (!query) return contactJson({ error: "malformed" }, 400);

package/apps/storefront/src/pages/api/admin/fulfillment/orders/contacts.ts

@@ -5,13 +5,14 @@
  * expiries and rule ids. Owner only; staff are refused 403 support-read-required.
  */
 import type { APIContext } from "astro";
+import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { contactJson, openContactRoute } from "@/lib/orders/vault/contactRoutes";
 import { listOrderContacts } from "@/lib/orders/vault/orderContactVault";
 
 export const prerender = false;
 
 export async function GET(context: APIContext): Promise<Response> {
-  const route = await openContactRoute(context, "owner");
+  const route = await openContactRoute(context, "owner", { admitSharedStoreTenant });
   if (!route.ok) return route.response;
   const listed = await listOrderContacts(route.db, route.kms, {
     tenantId: route.tenantId, stage: route.stage, actor: route.actor, auditId: crypto.randomUUID(), now: new Date(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.11.5",
+  "version": "4.11.6",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",