@tokenoftrust/storefront-runner 4.2.4 → 4.3.0

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -2,7 +2,7 @@
 import type { APIContext } from "astro";
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify, type JSONWebKeySet } from "jose";
 import {
-  commerceTenantId, totalsMatch, canonicalJson, shippingMinorFor, isContentVersionId, providerCartDigestMaterial,
+  commerceTenantId, totalsMatch, shippingMinorFor, isContentVersionId, catalogPinDigestFinding,
   type CallerToken, type CatalogProduct, type CommerceEvidence, type CommerceEvidenceProvenance,
   type CommerceProviderCartSnapshot, type FinalCartBinding, type TenantConfig,
 } from "@tot/public-runtime";
@@ -183,7 +183,8 @@ async function authorize(context: APIContext): Promise<Response> {
     : createContentProvider(tenant, { get: kvGet, env: contentEnv });
   const tot = await createToTClient(tenant, await readD1("CATALOG_DB"), content);
   const authorityContext = { ...context, locals: { ...context.locals, tenant, tot, content } } as APIContext;
-  if (snapshot.providerCartDigest !== await digest(canonicalJson(providerCartDigestMaterial(snapshot)))) return deny("provider-cart-digest");
+  const catalogPin = await catalogPinDigestFinding(snapshot);
+  if (catalogPin) return deny(catalogPin);
   let listing: CatalogProduct[];
   try { listing = await tot.getAllActiveProducts(); } catch { return deny("catalog-unavailable", 503); }
   if (!Array.isArray(listing)) return deny("catalog-unavailable", 503);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.2.4",
+  "version": "4.3.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout-orders.ts

@@ -401,6 +401,29 @@ export function providerCartDigestMaterial(snapshot: {
   return snapshot.contentVersionId === undefined ? material : { ...material, contentVersionId: snapshot.contentVersionId };
 }
 
+/** Finding when the provider-cart digest was not computed over the rendered content pin. */
+export const PROVIDER_CART_DIGEST_FINDING = "provider-cart-digest";
+
+/**
+ * The provider-cart digest check the final-cart authority applies. Returns
+ * `provider-cart-digest` when `providerCartDigest` is not the digest of
+ * `providerCartDigestMaterial` (the content pin is inside that material when
+ * the snapshot names one). Returns null when the digest matches.
+ */
+export async function catalogPinDigestFinding(snapshot: {
+  providerCartDigest: string;
+  tenantId: string;
+  stage: string;
+  currency: string;
+  lines: readonly FinalCartLine[];
+  totals: MinorTotals;
+  destinationDigest: string;
+  contentVersionId?: string;
+}): Promise<typeof PROVIDER_CART_DIGEST_FINDING | null> {
+  const expected = await sha256Hex(canonicalJson(providerCartDigestMaterial(snapshot)));
+  return snapshot.providerCartDigest === expected ? null : PROVIDER_CART_DIGEST_FINDING;
+}
+
 /** Safe source references explaining each server-owned authority decision. */
 export interface CommerceAuthoritySource {
   requirement: "required" | "not-required";