@tokenoftrust/storefront-runner 4.2.3 → 4.2.4

package/apps/storefront/src/lib/checkout/shared/lazyCheckoutLoader.ts

@@ -90,12 +90,17 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     try { return new URL(url, document.baseURI).origin === cartOrigin; } catch (e) { return false; }
   }
   // Foxy copies the Referer onto cart_cancel_and_continue_link and ignores a
-  // continue parameter. The document policy stays strict-origin. A cart script
-  // snapshots the Referer while its src is assigned, so that assignment uses the
-  // store-home URL and restores the page before the turn ends. A cart navigation
-  // sends the full document URL through the element's referrerPolicy. That URL
-  // already includes the store origin and tenant path, and the history entry
-  // stays the page that opened the cart.
+  // continue parameter. The document policy is strict-origin-when-cross-origin,
+  // so a cross-origin request drops the tenant path. A cart script snapshots the
+  // Referer while its src is assigned: that assignment uses the store-home URL
+  // (origin plus cookie path) and restores the page before the turn ends. A cart
+  // navigation uses that same URL, then puts the shopper's URL back when the page
+  // hides or is restored from the back-forward cache, so Back returns to the page
+  // that opened the cart. A form has no referrerPolicy, so a cart submit also sets
+  // a referrer meta for that navigation and puts the document policy back after it.
+  var pendingReturn = null;
+  var referrerMeta = null;
+  var documentReferrerPolicy = "strict-origin-when-cross-origin";
   function storeHome() {
     return location.origin + cookiePath;
   }
@@ -107,6 +112,41 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
   function restoreHref(current) {
     if (location.href !== current) window.history.replaceState(window.history.state, "", current);
   }
+  function revealForNavigation() {
+    var current = location.href;
+    if (current === storeHome()) return;
+    pendingReturn = current;
+    revealStoreHome();
+  }
+  function restorePendingReturn() {
+    if (!pendingReturn) return;
+    var back = pendingReturn;
+    restoreHref(back);
+    if (location.href === back) pendingReturn = null;
+  }
+  function loosenReferrer() {
+    if (!referrerMeta) {
+      referrerMeta = document.createElement("meta");
+      referrerMeta.setAttribute("name", "referrer");
+      (document.head || document.documentElement).appendChild(referrerMeta);
+    }
+    referrerMeta.setAttribute("content", referrerPolicy);
+  }
+  function tightenReferrer() {
+    if (!referrerMeta) return;
+    referrerMeta.setAttribute("content", documentReferrerPolicy);
+  }
+  function endCartNavigation() {
+    restorePendingReturn();
+    tightenReferrer();
+  }
+  document.addEventListener("visibilitychange", function () {
+    if (document.visibilityState === "hidden") endCartNavigation();
+  });
+  window.addEventListener("pagehide", endCartNavigation);
+  window.addEventListener("pageshow", function (event) {
+    if (event.persisted) endCartNavigation();
+  });
   var origCreate = document.createElement;
   document.createElement = function (name) {
     var el = origCreate.apply(document, arguments);
@@ -254,6 +294,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     anchor.referrerPolicy = referrerPolicy;
     if (state === 'ready') {
       stampAnchor(anchor);
+      if (!event.defaultPrevented) revealForNavigation();
       return;
     }
     if (event.defaultPrevented) return;
@@ -314,6 +355,11 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
       if (!cartForm || state === 'ready') {
         if (!event.defaultPrevented && state === 'ready') {
           form.referrerPolicy = referrerPolicy;
+          if (cartForm) {
+            form.setAttribute("referrerpolicy", referrerPolicy);
+            loosenReferrer();
+            revealForNavigation();
+          }
         }
         return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.2.3",
+  "version": "4.2.4",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",