@tokenoftrust/storefront-runner 6.1.0 → 6.1.1

package/apps/storefront/src/lib/orders/admin/orderClient.ts

@@ -14,16 +14,21 @@
  */
 import type {
   CheckoutOrderDetail,
-  CheckoutOrderDetailResponse,
+  CheckoutOrderSummary,
   CheckoutOrderListFilters,
   CheckoutOrderListResponse,
   CommerceActor,
   CommerceRole,
   CommerceScope,
   CommerceStage,
+  CheckoutOrderCustomer,
+  OrderContactAvailability,
+  OrderContactState,
 } from "@tot/public-runtime";
-import { readOwnerAddress } from "@tot/public-runtime";
+import { actorMayCommand, readOwnerAddress } from "@tot/public-runtime";
 import type { CustomizationEnv } from "@tot/public-runtime";
+import { contactReaderAuthority } from "@/lib/access/auth/contactReaderAuthority";
+import type { SessionRecord } from "@/lib/access/auth/session";
 
 /** Fetch shape we depend on — the platform `fetch`, injectable for tests. */
 export type FetchLike = (
@@ -107,26 +112,83 @@ export function commerceStageForCustomization(env: CustomizationEnv): CommerceSt
   return env === "live" ? "publication" : "preview";
 }
 
-/** Owner reads private order fields. An admitted member is a caller. Everyone else is denied. */
+/** Private ownership comes from tenant membership, independently of staff operational capability. */
 export function commerceActorForAdmin(input: {
   tenantId: string;
   stage: CommerceStage;
-  owner: boolean;
+  record: SessionRecord | null | undefined;
+  nowSeconds: number;
   admitted: boolean;
 }): CommerceActor {
-  const role: CommerceRole = !input.admitted ? "denied" : input.owner ? "owner" : "caller";
+  const privateOwner = contactReaderAuthority(input.record, input.tenantId, input.nowSeconds).kind === "owner";
+  const role: CommerceRole = !input.admitted ? "denied" : privateOwner ? "owner" : "caller";
   return { role, tenantId: input.tenantId, stage: input.stage };
 }
 
 /** Drop the address unless this actor may read it for this tenant and stage. */
-export function projectCheckoutOrder<T extends { shippingAddress?: unknown }>(
+export function projectCheckoutOrder<T extends { shippingAddress?: unknown; customer?: CheckoutOrderCustomer; contactAvailability?: OrderContactAvailability }>(
   order: T,
   actor: CommerceActor,
   resource: CommerceScope,
 ): T {
+  const unknown: OrderContactAvailability = { identity: "unreadable", email: "unreadable", shipTo: "unreadable" };
+  const availability = order.contactAvailability ?? {
+    ...unknown,
+    shipTo: Object.hasOwn(order, "shippingAddress") ? addressAvailability(order.shippingAddress) : "unreadable",
+  };
   const read = readOwnerAddress(actor, resource, () => order.shippingAddress ?? null);
-  if (read.ok) return order;
-  return { ...order, shippingAddress: null };
+  if (read.ok) return { ...order, contactAvailability: availability };
+  const restricted = (state: OrderContactState): OrderContactState => state === "present" ? "restricted" : state;
+  const projected: Record<string, unknown> = { ...order };
+  for (const key of ["customerName", "customerEmail", "email", "phone", "name", "line1", "line2", "postalCode"]) delete projected[key];
+  return {
+    ...projected,
+    shippingAddress: null,
+    ...(order.customer ? { customer: { id: null, name: "Checkout customer" } } : {}),
+    contactAvailability: actorMayCommand(actor, resource) ? {
+      identity: restricted(availability.identity), email: restricted(availability.email), shipTo: restricted(availability.shipTo),
+    } : unknown,
+  } as T;
+}
+
+function addressAvailability(value: unknown): OrderContactState {
+  if (value === null) return "absent";
+  if (!isRecord(value)) return "unreadable";
+  return ["line1", "city", "country"].every((key) => typeof value[key] === "string" && value[key].trim() !== "") ? "present" : "unreadable";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+const SUMMARY_FIELDS = ["id", "placedAt", "currency", "customer", "contactAvailability", "itemsSummary", "itemCount", "total", "payment", "fulfillment", "blocker", "verification"];
+const DETAIL_FIELDS = [...SUMMARY_FIELDS, "lineItems", "totals", "shippingAddress", "verificationDetail"];
+
+/** Refuse an unsupported upstream body before any raw contact aliases reach an admin response. */
+function frozenOrder(value: unknown, detail: true): value is CheckoutOrderDetail;
+function frozenOrder(value: unknown, detail: false): value is CheckoutOrderSummary;
+function frozenOrder(value: unknown, detail: boolean): boolean {
+  if (!isRecord(value) || Object.keys(value).some((key) => !(detail ? DETAIL_FIELDS : SUMMARY_FIELDS).includes(key))) return false;
+  if (!["id", "placedAt", "currency", "itemsSummary"].every((key) => typeof value[key] === "string")) return false;
+  if (!isRecord(value.customer) || typeof value.customer.name !== "string" ||
+    !(value.customer.id === null || typeof value.customer.id === "string") ||
+    Object.keys(value.customer).some((key) => key !== "id" && key !== "name")) return false;
+  if (typeof value.total !== "number" || !Number.isFinite(value.total) || !Number.isInteger(value.itemCount)) return false;
+  if (!["authorized", "captured", "refunded"].includes(String(value.payment)) ||
+    !["unfulfilled", "ready_to_ship", "hold_review_required", "completed"].includes(String(value.fulfillment))) return false;
+  if (value.blocker !== null && typeof value.blocker !== "string") return false;
+  if (value.verification !== null && !isRecord(value.verification)) return false;
+  const availability = value.contactAvailability;
+  if (availability !== undefined && (!isRecord(availability) ||
+    !["identity", "email", "shipTo"].every((key) => typeof availability[key] === "string" &&
+      ["present", "restricted", "absent", "expired", "erased", "unreadable"].includes(availability[key])) ||
+    Object.keys(availability).some((key) => !["identity", "email", "shipTo"].includes(key)))) return false;
+  return !detail || (Array.isArray(value.lineItems) && isRecord(value.totals) && isRecord(value.verificationDetail) &&
+    (value.shippingAddress === null || isRecord(value.shippingAddress)));
+}
+
+function unsupportedBody(): OrderApiError {
+  return new OrderApiError("bad_gateway", 502);
 }
 
 /** Build the list querystring: appDomain (required) + any provided filters. */
@@ -151,12 +213,12 @@ export function createCheckoutOrderClient(
   const base = config.baseUrl.replace(/\/+$/, "");
   const headers = { authorization: `Bearer ${config.bearer}` };
 
-  async function getJson<T>(url: string): Promise<T> {
+  async function getJson(url: string): Promise<unknown> {
     const res = await doFetch(url, { method: "GET", headers });
     const body = await res.text();
     if (!res.ok) throw toError(res.status, body);
     try {
-      return JSON.parse(body) as T;
+      return JSON.parse(body) as unknown;
     } catch {
       throw new OrderApiError("unexpected", res.status, "malformed JSON");
     }
@@ -165,14 +227,22 @@ export function createCheckoutOrderClient(
   return {
     async listOrders(filters) {
       const qs = listQuery(config.appDomain, filters);
-      return getJson<CheckoutOrderListResponse>(`${base}/commerce/orders?${qs}`);
+      const body = await getJson(`${base}/commerce/orders?${qs}`);
+      if (!isRecord(body) || !Array.isArray(body.orders) || !body.orders.every((order): order is CheckoutOrderSummary => frozenOrder(order, false)) ||
+        !isRecord(body.page) || Object.keys(body).some((key) => key !== "orders" && key !== "page")) throw unsupportedBody();
+      const page = body.page;
+      if (typeof page.limit !== "number" || !(page.cursor === null || typeof page.cursor === "string") ||
+        !(page.nextCursor === null || typeof page.nextCursor === "string") || !(page.total === null || typeof page.total === "number") ||
+        Object.keys(page).some((key) => !["limit", "cursor", "nextCursor", "total"].includes(key))) throw unsupportedBody();
+      return { orders: body.orders, page: { limit: page.limit, cursor: page.cursor, nextCursor: page.nextCursor, total: page.total } };
     },
     async getOrder(orderId) {
       const qs = new URLSearchParams({ appDomain: config.appDomain }).toString();
-      const { order } = await getJson<CheckoutOrderDetailResponse>(
+      const body = await getJson(
         `${base}/commerce/orders/${encodeURIComponent(orderId)}?${qs}`,
       );
-      return order;
+      if (!isRecord(body) || !frozenOrder(body.order, true) || Object.keys(body).some((key) => key !== "order")) throw unsupportedBody();
+      return body.order;
     },
   };
 }

package/apps/storefront/src/lib/orders/admin/services/orders.ts

@@ -28,6 +28,7 @@ import type {
   TenantConfig,
   OrderContactState,
 } from "@tot/public-runtime";
+import { projectCheckoutOrder } from "../orderClient";
 import {
   actorMayCommand,
   decideCommerceCommand,
@@ -644,6 +645,7 @@ export function emptyOrdersViewModel(targetTenant: string, timeZone: string = DE
 }
 
 export interface GetOrdersViewModelOptions {
+  actor?: CommerceActor;
   targetTenant: string;
   scope: CommerceScope;
   client: CheckoutOrderClient;
@@ -719,12 +721,15 @@ async function readOrdersToday(client: CheckoutOrderClient, now: Date, timeZone:
 
 export async function getOrdersViewModelResult(opts: GetOrdersViewModelOptions): Promise<OrdersLoadResult> {
   try {
-    const { orders, page } = await opts.client.listOrders(opts.filters);
+    const listed = await opts.client.listOrders(opts.filters);
+    const actor = opts.actor ?? { ...opts.scope, role: "caller" as const };
+    const orders = listed.orders.map((order) => projectCheckoutOrder(order, actor, opts.scope));
+    const page = listed.page;
     const details: Record<string, CheckoutOrderDetail> = {};
     await Promise.all(
       orders.map(async (o) => {
         try {
-          details[o.id] = await opts.client.getOrder(o.id);
+          details[o.id] = projectCheckoutOrder(await opts.client.getOrder(o.id), actor, opts.scope);
         } catch {
           /* detail unavailable — row still renders from its summary */
         }

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -7,6 +7,7 @@
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
+import { readViewerSession } from "@/lib/access/auth/route";
 import { commerceActorForAdmin, OrderApiError, projectCheckoutOrder } from "@/lib/orders/admin/orderClient";
 import { resolveOrderSource, workerOrderSourceDeps } from "@/lib/orders/admin/orderSource";
 import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
@@ -47,7 +48,8 @@ export async function GET(context: APIContext): Promise<Response> {
     const actor = commerceActorForAdmin({
       tenantId: scope.tenantId,
       stage: scope.stage,
-      owner: access.entry.isOwnerViewer,
+      record: await readViewerSession(context),
+      nowSeconds: Math.floor(Date.now() / 1000),
       admitted: access.entry.admitted,
     });
     const order = projectCheckoutOrder(await source.client.getOrder(orderId), actor, scope);

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -11,7 +11,8 @@
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
-import { OrderApiError } from "@/lib/orders/admin/orderClient";
+import { readViewerSession } from "@/lib/access/auth/route";
+import { commerceActorForAdmin, OrderApiError, projectCheckoutOrder } from "@/lib/orders/admin/orderClient";
 import { resolveOrderSource, workerOrderSourceDeps } from "@/lib/orders/admin/orderSource";
 import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { assessCheckoutOrder, parseOrderFilters } from "@/lib/orders/admin/services/orders";
@@ -51,10 +52,11 @@ export async function GET(context: APIContext): Promise<Response> {
 
   try {
     const data = await source.client.listOrders(filters);
-    const orders = data.orders.map((order) => ({
-      ...order,
-      readiness: assessCheckoutOrder(order, source.scope),
-    }));
+    const actor = commerceActorForAdmin({ ...source.scope, record: await readViewerSession(context), nowSeconds: Math.floor(Date.now() / 1000), admitted: access.entry.admitted });
+    const orders = data.orders.map((raw) => {
+      const order = projectCheckoutOrder(raw, actor, source.scope);
+      return { ...order, readiness: assessCheckoutOrder(order, source.scope) };
+    });
     return new Response(JSON.stringify({ ...data, orders }), { headers: JSON_HEADERS });
   } catch (err) {
     if (err instanceof OrderApiError) return jsonError(err.code, err.status);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.1.0",
+  "version": "6.1.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",