@tokenoftrust/storefront-runner 4.7.9 → 4.7.10

package/apps/storefront/src/lib/checkout/shared/lazyCheckoutLoader.ts

@@ -35,6 +35,9 @@
  * carries only the reason, the cause, elapsed ms, whether the action was held,
  * whether `FC.client` existed, Foxy's own full-page and bypass decisions, the
  * document ready state and viewport/screen/body widths — never a URL or session.
+ * A CSP refusal raised by the drawer's own scripts is the cause when nothing else
+ * failed (`csp-eval`, `csp-inline`, `csp-resource`): the page policy admits no
+ * eval, so a store template that carries an inline script breaks the drawer.
  *
  * Every cart open waits for this store's Foxy session. The id comes from the
  * same-origin session endpoint (an HttpOnly cookie the browser cannot read) and
@@ -271,6 +274,20 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
     failure = cause;
     runHeld();
   }
+  // A drawer can report ready and still fail to render: the page CSP has no
+  // 'unsafe-eval', so a store template carrying an inline <script> (which the
+  // drawer's jQuery runs through eval) throws inside cart.render. A refusal raised
+  // by the drawer's own scripts is kept as the cause of a later fall-through.
+  var drawerOrigins = [cartOrigin];
+  try { drawerOrigins.push(new URL(src, document.baseURI).origin); } catch (e) {}
+  var cspRefusal = null;
+  document.addEventListener('securitypolicyviolation', function (event) {
+    var from = null;
+    try { from = new URL(event.sourceFile).origin; } catch (e) {}
+    if (!from || drawerOrigins.indexOf(from) === -1) return;
+    var blocked = event.blockedURI;
+    cspRefusal = 'csp-' + (blocked === 'eval' || blocked === 'inline' ? blocked : 'resource');
+  });
   // A cart action reaching the window unhandled after the drawer settled navigates
   // to the full cart page. Record why, with no URL or session in the record.
   function fallthrough(kind, el) {
@@ -284,9 +301,10 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
       return !!(node && node.classList && (node.classList.contains('fc-sidecart--bypass') || node.hasAttribute('data-fc-sidecart-bypass')));
     }
     var reason = state === 'ready' ? 'drawer-declined' : 'drawer-unavailable';
+    var cause = failure || cspRefusal;
     var detail = {
       reason: reason,
-      cause: failure,
+      cause: cause,
       kind: kind,
       held: replaying === el,
       elapsedMs: armedAt ? Date.now() - armedAt : null,
@@ -298,7 +316,7 @@ export function lazyCheckoutLoaderJs(options: LazyCheckoutLoaderOptions): string
       screenWidth: window.screen ? window.screen.availWidth : null,
       bodyWidth: body ? body.clientWidth : null
     };
-    document.documentElement.setAttribute('data-cart-fallthrough', reason + (failure ? ':' + failure : ''));
+    document.documentElement.setAttribute('data-cart-fallthrough', reason + (cause ? ':' + cause : ''));
     try { console.warn('[tot-cart] cart fell through to the cart page', detail); } catch (e) {}
     try { window.dispatchEvent(new window.CustomEvent('tot:cart-fallthrough', { detail: detail })); } catch (e) {}
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "4.7.9",
+  "version": "4.7.10",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",