@tokenoftrust/storefront-runner 4.12.1 → 4.12.2

package/apps/storefront/src/lib/access/auth/internalContentAuthority.ts

@@ -98,6 +98,7 @@ export async function authorizeInternalContentRequest(
   try {
     response = await (input.fetchImpl ?? fetch)(`${coreUrl}/api/broker/appDomains`, {
       method: "GET",
+      redirect: "manual",
       headers: {
         accept: "application/json",
         "X-ToT-Broker-Assertion": assertion,

package/apps/storefront/src/lib/access/auth/totAccessClient.ts

@@ -298,6 +298,7 @@ export class HttpTotAccessClient implements TotAccessClient {
     } catch {
       return { ok: false, reason: "error" };
     }
+    if (res.status >= 300 && res.status < 400) return { ok: false, reason: "error" };
     let body: unknown;
     try {
       body = await res.json();
@@ -329,6 +330,7 @@ export class HttpTotAccessClient implements TotAccessClient {
       }
       return { ok: false, reason: "error" };
     }
+    if (res.status >= 300 && res.status < 400) return { ok: false, reason: "error" };
     let body: unknown = "(unread)";
     try {
       body = await res.json();

package/apps/storefront/src/lib/access/dashboard/staffVendorAccess.ts

@@ -98,13 +98,14 @@ export interface HttpTransport {
 /** Default transport: JSON `fetch` GET/POST. */
 export class FetchHttpTransport implements HttpTransport {
   async get(url: string, headers: Record<string, string>) {
-    return fetch(url, { method: "GET", headers: { accept: "application/json", ...headers } });
+    return fetch(url, { method: "GET", headers: { accept: "application/json", ...headers }, redirect: "manual" });
   }
   async post(url: string, headers: Record<string, string>, body: unknown) {
     return fetch(url, {
       method: "POST",
       headers: { "content-type": "application/json", accept: "application/json", ...headers },
       body: JSON.stringify(body),
+      redirect: "manual",
     });
   }
 }
@@ -191,6 +192,9 @@ export class HttpStaffVendorAccessClient implements StaffVendorAccessClient {
         message: "staffVendorAccess: transport failure searching vendors",
       };
     }
+    if (res.status >= 300 && res.status < 400) {
+      return { ok: false, status: res.status, reason: "error", message: "staffVendorAccess: redirects are not accepted" };
+    }
     let parsed: unknown;
     try {
       parsed = await res.json();
@@ -229,6 +233,9 @@ export class HttpStaffVendorAccessClient implements StaffVendorAccessClient {
         message: "staffVendorAccess: transport failure granting access",
       };
     }
+    if (res.status >= 300 && res.status < 400) {
+      return { ok: false, status: res.status, reason: "error", message: "staffVendorAccess: redirects are not accepted" };
+    }
     let parsed: unknown;
     try {
       parsed = await res.json();

package/apps/storefront/src/lib/access/shared/accessExplain.ts

@@ -161,10 +161,12 @@ export class FetchExplainTransport implements ExplainTransport {
     try {
       const res = await fetch(url, {
         method: "POST",
+        redirect: "manual",
         headers: { "content-type": "application/json", ...headers },
         body: JSON.stringify(body),
         signal: ctrl.signal,
       });
+      if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
       return { status: res.status, json: () => res.json() };
     } finally {
       clearTimeout(timer);

package/apps/storefront/src/lib/access/shared/developerInvites.ts

@@ -318,8 +318,9 @@ export interface HttpTransport {
 /** Default transport: JSON `fetch` POST/GET/DELETE. */
 export class FetchHttpTransport implements HttpTransport {
   async post(url: string, headers: Record<string, string>, body: unknown) {
-    return fetch(url, {
+    const res = await fetch(url, {
       method: "POST",
+      redirect: "manual",
       headers: {
         "content-type": "application/json",
         accept: "application/json",
@@ -327,18 +328,26 @@ export class FetchHttpTransport implements HttpTransport {
       },
       body: JSON.stringify(body),
     });
+    if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
+    return res;
   }
   async get(url: string, headers: Record<string, string>) {
-    return fetch(url, {
+    const res = await fetch(url, {
       method: "GET",
+      redirect: "manual",
       headers: { accept: "application/json", ...headers },
     });
+    if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
+    return res;
   }
   async delete(url: string, headers: Record<string, string>) {
-    return fetch(url, {
+    const res = await fetch(url, {
       method: "DELETE",
+      redirect: "manual",
       headers: { accept: "application/json", ...headers },
     });
+    if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
+    return res;
   }
 }
 

package/apps/storefront/src/lib/access/shared/invitePreflight.ts

@@ -41,7 +41,8 @@ export class FetchPreflightTransport implements PreflightTransport {
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), PREFLIGHT_TIMEOUT_MS);
     try {
-      const res = await fetch(url, { method: "GET", headers, signal: ctrl.signal });
+      const res = await fetch(url, { method: "GET", headers, signal: ctrl.signal, redirect: "manual" });
+      if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
       return { status: res.status, json: () => res.json() };
     } finally {
       clearTimeout(timer);

package/apps/storefront/src/lib/access/shared/principalGrants.ts

@@ -287,17 +287,24 @@ export interface HttpTransport {
 
 export class FetchHttpTransport implements HttpTransport {
   async post(url: string, headers: Record<string, string>, body: unknown) {
-    return fetch(url, {
+    const res = await fetch(url, {
       method: "POST",
+      redirect: "manual",
       headers: { "content-type": "application/json", accept: "application/json", ...headers },
       body: JSON.stringify(body),
     });
+    if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
+    return res;
   }
   async get(url: string, headers: Record<string, string>) {
-    return fetch(url, { method: "GET", headers: { accept: "application/json", ...headers } });
+    const res = await fetch(url, { method: "GET", headers: { accept: "application/json", ...headers }, redirect: "manual" });
+    if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
+    return res;
   }
   async delete(url: string, headers: Record<string, string>) {
-    return fetch(url, { method: "DELETE", headers: { accept: "application/json", ...headers } });
+    const res = await fetch(url, { method: "DELETE", headers: { accept: "application/json", ...headers }, redirect: "manual" });
+    if (res.status >= 300 && res.status < 400) throw new Error("authenticated transport refused redirect");
+    return res;
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.12.1",
+  "version": "4.12.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",