@tokenoftrust/storefront-runner 4.2.3 → 4.3.0

package/apps/storefront/src/lib/checkout/shared/lazyCheckoutLoader.ts

@@ -90,12 +90,17 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     try { return new URL(url, document.baseURI).origin === cartOrigin; } catch (e) { return false; }
   }
   // Foxy copies the Referer onto cart_cancel_and_continue_link and ignores a
-  // continue parameter. The document policy stays strict-origin. A cart script
-  // snapshots the Referer while its src is assigned, so that assignment uses the
-  // store-home URL and restores the page before the turn ends. A cart navigation
-  // sends the full document URL through the element's referrerPolicy. That URL
-  // already includes the store origin and tenant path, and the history entry
-  // stays the page that opened the cart.
+  // continue parameter. The document policy is strict-origin-when-cross-origin,
+  // so a cross-origin request drops the tenant path. A cart script snapshots the
+  // Referer while its src is assigned: that assignment uses the store-home URL
+  // (origin plus cookie path) and restores the page before the turn ends. A cart
+  // navigation uses that same URL, then puts the shopper's URL back when the page
+  // hides or is restored from the back-forward cache, so Back returns to the page
+  // that opened the cart. A form has no referrerPolicy, so a cart submit also sets
+  // a referrer meta for that navigation and puts the document policy back after it.
+  var pendingReturn = null;
+  var referrerMeta = null;
+  var documentReferrerPolicy = "strict-origin-when-cross-origin";
   function storeHome() {
     return location.origin + cookiePath;
   }
@@ -107,6 +112,41 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
   function restoreHref(current) {
     if (location.href !== current) window.history.replaceState(window.history.state, "", current);
   }
+  function revealForNavigation() {
+    var current = location.href;
+    if (current === storeHome()) return;
+    pendingReturn = current;
+    revealStoreHome();
+  }
+  function restorePendingReturn() {
+    if (!pendingReturn) return;
+    var back = pendingReturn;
+    restoreHref(back);
+    if (location.href === back) pendingReturn = null;
+  }
+  function loosenReferrer() {
+    if (!referrerMeta) {
+      referrerMeta = document.createElement("meta");
+      referrerMeta.setAttribute("name", "referrer");
+      (document.head || document.documentElement).appendChild(referrerMeta);
+    }
+    referrerMeta.setAttribute("content", referrerPolicy);
+  }
+  function tightenReferrer() {
+    if (!referrerMeta) return;
+    referrerMeta.setAttribute("content", documentReferrerPolicy);
+  }
+  function endCartNavigation() {
+    restorePendingReturn();
+    tightenReferrer();
+  }
+  document.addEventListener("visibilitychange", function () {
+    if (document.visibilityState === "hidden") endCartNavigation();
+  });
+  window.addEventListener("pagehide", endCartNavigation);
+  window.addEventListener("pageshow", function (event) {
+    if (event.persisted) endCartNavigation();
+  });
   var origCreate = document.createElement;
   document.createElement = function (name) {
     var el = origCreate.apply(document, arguments);
@@ -254,6 +294,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     anchor.referrerPolicy = referrerPolicy;
     if (state === 'ready') {
       stampAnchor(anchor);
+      if (!event.defaultPrevented) revealForNavigation();
       return;
     }
     if (event.defaultPrevented) return;
@@ -314,6 +355,11 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
       if (!cartForm || state === 'ready') {
         if (!event.defaultPrevented && state === 'ready') {
           form.referrerPolicy = referrerPolicy;
+          if (cartForm) {
+            form.setAttribute("referrerpolicy", referrerPolicy);
+            loosenReferrer();
+            revealForNavigation();
+          }
         }
         return;
       }

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -2,7 +2,7 @@
 import type { APIContext } from "astro";
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify, type JSONWebKeySet } from "jose";
 import {
-  commerceTenantId, totalsMatch, canonicalJson, shippingMinorFor, isContentVersionId, providerCartDigestMaterial,
+  commerceTenantId, totalsMatch, shippingMinorFor, isContentVersionId, catalogPinDigestFinding,
   type CallerToken, type CatalogProduct, type CommerceEvidence, type CommerceEvidenceProvenance,
   type CommerceProviderCartSnapshot, type FinalCartBinding, type TenantConfig,
 } from "@tot/public-runtime";
@@ -183,7 +183,8 @@ async function authorize(context: APIContext): Promise<Response> {
     : createContentProvider(tenant, { get: kvGet, env: contentEnv });
   const tot = await createToTClient(tenant, await readD1("CATALOG_DB"), content);
   const authorityContext = { ...context, locals: { ...context.locals, tenant, tot, content } } as APIContext;
-  if (snapshot.providerCartDigest !== await digest(canonicalJson(providerCartDigestMaterial(snapshot)))) return deny("provider-cart-digest");
+  const catalogPin = await catalogPinDigestFinding(snapshot);
+  if (catalogPin) return deny(catalogPin);
   let listing: CatalogProduct[];
   try { listing = await tot.getAllActiveProducts(); } catch { return deny("catalog-unavailable", 503); }
   if (!Array.isArray(listing)) return deny("catalog-unavailable", 503);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.2.3",
+  "version": "4.3.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout-orders.ts

@@ -401,6 +401,29 @@ export function providerCartDigestMaterial(snapshot: {
   return snapshot.contentVersionId === undefined ? material : { ...material, contentVersionId: snapshot.contentVersionId };
 }
 
+/** Finding when the provider-cart digest was not computed over the rendered content pin. */
+export const PROVIDER_CART_DIGEST_FINDING = "provider-cart-digest";
+
+/**
+ * The provider-cart digest check the final-cart authority applies. Returns
+ * `provider-cart-digest` when `providerCartDigest` is not the digest of
+ * `providerCartDigestMaterial` (the content pin is inside that material when
+ * the snapshot names one). Returns null when the digest matches.
+ */
+export async function catalogPinDigestFinding(snapshot: {
+  providerCartDigest: string;
+  tenantId: string;
+  stage: string;
+  currency: string;
+  lines: readonly FinalCartLine[];
+  totals: MinorTotals;
+  destinationDigest: string;
+  contentVersionId?: string;
+}): Promise<typeof PROVIDER_CART_DIGEST_FINDING | null> {
+  const expected = await sha256Hex(canonicalJson(providerCartDigestMaterial(snapshot)));
+  return snapshot.providerCartDigest === expected ? null : PROVIDER_CART_DIGEST_FINDING;
+}
+
 /** Safe source references explaining each server-owned authority decision. */
 export interface CommerceAuthoritySource {
   requirement: "required" | "not-required";