@tokenoftrust/storefront-runner 4.13.0 → 4.13.1

package/apps/storefront/src/config/kvTenantResolver.ts

@@ -17,9 +17,10 @@
  */
 import type { TenantConfig, TenantResolver } from "@tot/public-runtime";
 import { withPlatformPolicy } from "@/config/tenants";
+import { TENANT_RECORD_PREFIX } from "@/config/storedTenantRecord";
 
 const DOMAIN_PREFIX = "domain:";
-const TENANT_PREFIX = "tenant:";
+const TENANT_PREFIX = TENANT_RECORD_PREFIX;
 const DEFAULT_KEY = "config:default_tenant";
 // Edge-cache KV reads briefly; tenant config changes are rare and propagate
 // within this window. Bump down if you need faster propagation after a write.

package/apps/storefront/src/config/storedTenantRecord.ts

@@ -0,0 +1,27 @@
+/**
+ * The `tenant:<id>` KV record exactly as stored, for an in-place edit of one field (the admin
+ * add-ons switch). Separate from kvTenantResolver so lib/pages can use it without importing the
+ * concrete resolver (depcruise `tenancy-resolver-fence`); the resolver takes its key prefix from here.
+ */
+export const TENANT_RECORD_PREFIX = "tenant:";
+
+/**
+ * Read with no edge cache (`cacheTtl`) and no platform-policy overlay. A read-modify-write must
+ * start here, never from `resolveStrict`, which can return a copy up to its cache TTL old and
+ * carries platform fields the record itself does not hold.
+ */
+export async function getStoredTenantRecord(kv: KVNamespace, tenantId: string): Promise<string | null> {
+  return kv.get(TENANT_RECORD_PREFIX + tenantId);
+}
+
+/**
+ * Write ONLY the `tenant:<id>` record key. Unlike putTenant it never touches the domain index or
+ * the default-tenant key, so an in-place edit of one field cannot re-point a hostname.
+ */
+export async function putStoredTenantRecord(
+  kv: KVNamespace,
+  tenantId: string,
+  record: Record<string, unknown>,
+): Promise<void> {
+  await kv.put(TENANT_RECORD_PREFIX + tenantId, JSON.stringify(record));
+}

package/apps/storefront/src/lib/assets/addons/addonsClient.ts

@@ -0,0 +1,59 @@
+/**
+ * Client island for `/admin/addons` (ADR 0013): each add-on card's button POSTs the mode it names to
+ * `/api/admin/addons` and redraws the card from the confirmed state the API returns. A no-op when
+ * the page rendered no cards (unauthorized viewer).
+ */
+export function initAddOnsPage(apiPath: string): void {
+  for (const button of document.querySelectorAll<HTMLButtonElement>("[data-addon-toggle]")) {
+    button.addEventListener("click", () => void toggle(apiPath, button));
+  }
+}
+
+async function toggle(apiPath: string, button: HTMLButtonElement): Promise<void> {
+  const card = button.closest<HTMLElement>("[data-addon-id]");
+  const id = card?.dataset.addonId;
+  const mode = button.dataset.addonNextMode;
+  const status = card?.querySelector<HTMLElement>("[data-addon-status]");
+  if (!card || !id || !mode) return;
+
+  button.disabled = true;
+  if (status) {
+    status.textContent = "Saving…";
+    status.dataset.tone = "";
+  }
+  try {
+    const res = await fetch(apiPath, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ id, mode }),
+    });
+    let body: { ok?: boolean; state?: { mode?: string }; status?: string };
+    try {
+      body = (await res.json()) as typeof body;
+    } catch {
+      throw new Error(`HTTP ${res.status}`);
+    }
+    if (!res.ok || !body.ok || !body.state?.mode) throw new Error(body.status || `HTTP ${res.status}`);
+    render(card, button, body.state.mode);
+    if (status) {
+      status.textContent = body.state.mode === "enabled" ? "Enabled." : "Disabled.";
+      status.dataset.tone = "ok";
+    }
+  } catch (error) {
+    if (status) {
+      status.textContent = `Could not save (${error instanceof Error ? error.message : "error"}).`;
+      status.dataset.tone = "error";
+    }
+  } finally {
+    button.disabled = false;
+  }
+}
+
+function render(card: HTMLElement, button: HTMLButtonElement, mode: string): void {
+  const enabled = mode === "enabled";
+  card.dataset.addonMode = mode;
+  const chip = card.querySelector<HTMLElement>("[data-addon-chip]");
+  if (chip) chip.textContent = enabled ? "Enabled" : "Off";
+  button.dataset.addonNextMode = enabled ? "disabled" : "enabled";
+  button.textContent = enabled ? "Turn off" : "Turn on";
+}

package/apps/storefront/src/lib/assets/addons/catalog.ts

@@ -0,0 +1,47 @@
+/**
+ * The add-ons a store owner can turn on or off from `/admin/addons`. Static on purpose: an add-on
+ * id or mode a request names is valid only if it appears here, so the API refuses anything else.
+ *
+ * State lives only in the tenant record (`addOns.<id>.mode`); nothing here reads the environment.
+ * High Fidelity / Large Images is read back by `resolveImageTier`, which treats every value but
+ * `"enabled"` as the standard tier.
+ */
+import { IMAGE_TIERS, LARGE_IMAGES_ADDON_NAME } from "@tot/public-runtime/image-limits";
+
+export const ADDON_MODES = ["enabled", "disabled"] as const;
+export type AddOnMode = (typeof ADDON_MODES)[number];
+
+export const ADDON_IDS = ["largeImages"] as const;
+export type AddOnId = (typeof ADDON_IDS)[number];
+
+export interface AddOnDefinition {
+  id: AddOnId;
+  name: string;
+  description: string;
+  modes: readonly AddOnMode[];
+}
+
+const MiB = 1024 * 1024;
+const mb = (bytes: number) => `${Math.round((bytes / MiB) * 10) / 10} MB`;
+const mp = (pixels: number) => `${Math.round((pixels / 1_000_000) * 10) / 10} MP`;
+const limits = (tier: { maxEncodedBytes: number; maxPixels: number; maxDimension: number }) =>
+  `${mb(tier.maxEncodedBytes)}, ${mp(tier.maxPixels)}, ${tier.maxDimension}px on a side`;
+
+export const ADDONS: readonly AddOnDefinition[] = Object.freeze([
+  {
+    id: "largeImages",
+    name: LARGE_IMAGES_ADDON_NAME,
+    description:
+      `Raises this store's image limit from the standard ${limits(IMAGE_TIERS.standard)} ` +
+      `to ${limits(IMAGE_TIERS.large)}. Takes effect on the next capture or upload.`,
+    modes: ADDON_MODES,
+  },
+]);
+
+export function isAddOnId(value: unknown): value is AddOnId {
+  return typeof value === "string" && (ADDON_IDS as readonly string[]).includes(value);
+}
+
+export function isAddOnMode(value: unknown): value is AddOnMode {
+  return typeof value === "string" && (ADDON_MODES as readonly string[]).includes(value);
+}

package/apps/storefront/src/lib/assets/addons/tenantAddOns.ts

@@ -0,0 +1,89 @@
+/**
+ * Read and write a tenant's add-on state (`addOns.<id>` on its KV record).
+ *
+ * The write is a read-modify-write of the RAW stored record: read `tenant:<id>` with no edge cache
+ * and no platform-policy overlay, change only `addOns.<id>`, and write back only that key. A cached
+ * read (`resolveStrict` caches 300 s) would clobber a field written since, and an overlaid read would
+ * persist platform policy into the record. A missing record is refused, never created: a tenant
+ * served from the static fallback has no record to edit.
+ *
+ * KV read-modify-write is not atomic; two simultaneous toggles can lose one. Acceptable for an
+ * owner switch, and no other field is at risk because both writers spread the same fresh read.
+ */
+import { getStoredTenantRecord, putStoredTenantRecord } from "@/config/storedTenantRecord";
+import { ADDONS, isAddOnId, isAddOnMode, type AddOnId, type AddOnMode } from "./catalog";
+
+export interface AddOnState {
+  mode: AddOnMode;
+  updatedAt?: string;
+  updatedBy?: string;
+}
+
+export type AddOnsState = Record<AddOnId, AddOnState>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Every catalog add-on's state on `record`. Anything but `mode: "enabled"` reads as disabled. */
+export function readAddOns(record: unknown): AddOnsState {
+  const stored = isRecord(record) && isRecord(record.addOns) ? record.addOns : {};
+  const state = {} as AddOnsState;
+  for (const addOn of ADDONS) {
+    const entry = stored[addOn.id];
+    const out: AddOnState = { mode: isRecord(entry) && entry.mode === "enabled" ? "enabled" : "disabled" };
+    if (isRecord(entry) && typeof entry.updatedAt === "string") out.updatedAt = entry.updatedAt;
+    if (isRecord(entry) && typeof entry.updatedBy === "string") out.updatedBy = entry.updatedBy;
+    state[addOn.id] = out;
+  }
+  return state;
+}
+
+function parseStored(raw: string | null): Record<string, unknown> | null | "unreadable" {
+  if (raw === null) return null;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return isRecord(parsed) ? parsed : "unreadable";
+  } catch {
+    return "unreadable";
+  }
+}
+
+/** The stored record's add-on state, or null when the tenant has no readable KV record. */
+export async function readStoredAddOns(kv: KVNamespace, tenantId: string): Promise<AddOnsState | null> {
+  const record = parseStored(await getStoredTenantRecord(kv, tenantId));
+  return record && record !== "unreadable" ? readAddOns(record) : null;
+}
+
+export type SetAddOnResult =
+  | { ok: true; state: AddOnState }
+  | { ok: false; status: 400; reason: "unknown_addon" | "unknown_mode" }
+  | { ok: false; status: 404; reason: "no_tenant_record" }
+  | { ok: false; status: 409; reason: "tenant_record_unreadable" }
+  | { ok: false; status: 503; reason: "write_not_confirmed" };
+
+export async function setAddOn(
+  kv: KVNamespace,
+  tenantId: string,
+  id: unknown,
+  mode: unknown,
+  actor: string,
+  now: Date,
+): Promise<SetAddOnResult> {
+  if (!isAddOnId(id)) return { ok: false, status: 400, reason: "unknown_addon" };
+  if (!isAddOnMode(mode)) return { ok: false, status: 400, reason: "unknown_mode" };
+
+  const record = parseStored(await getStoredTenantRecord(kv, tenantId));
+  if (record === null) return { ok: false, status: 404, reason: "no_tenant_record" };
+  if (record === "unreadable") return { ok: false, status: 409, reason: "tenant_record_unreadable" };
+
+  const addOns = isRecord(record.addOns) ? record.addOns : {};
+  const entry: AddOnState = { mode, updatedAt: now.toISOString(), updatedBy: actor };
+  await putStoredTenantRecord(kv, tenantId, { ...record, addOns: { ...addOns, [id]: entry } });
+
+  const confirmed = parseStored(await getStoredTenantRecord(kv, tenantId));
+  if (!confirmed || confirmed === "unreadable") return { ok: false, status: 503, reason: "write_not_confirmed" };
+  const state = readAddOns(confirmed)[id];
+  if (state.mode !== mode) return { ok: false, status: 503, reason: "write_not_confirmed" };
+  return { ok: true, state };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.13.0",
+  "version": "4.13.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",