@tokenoftrust/storefront-runner 6.1.0 → 6.1.2

package/apps/storefront/migrations-apps/0024_order_contact_erasure_state.sql

@@ -0,0 +1,22 @@
+-- Erasure group bits: identity=1, email=2, phone=4, ship=8, bill=16.
+ALTER TABLE `order_contact_markers`
+  ADD COLUMN `erased_groups` integer NOT NULL DEFAULT 0 CHECK (`erased_groups` BETWEEN 0 AND 31);
+--> statement-breakpoint
+UPDATE `order_contact_markers` AS m SET `erased_groups` = COALESCE((
+  SELECT MAX(CASE WHEN instr(',' || a.groups || ',', ',identity,') > 0 THEN 1 ELSE 0 END)
+       + MAX(CASE WHEN instr(',' || a.groups || ',', ',email,') > 0 THEN 2 ELSE 0 END)
+       + MAX(CASE WHEN instr(',' || a.groups || ',', ',phone,') > 0 THEN 4 ELSE 0 END)
+       + MAX(CASE WHEN instr(',' || a.groups || ',', ',ship,') > 0 THEN 8 ELSE 0 END)
+       + MAX(CASE WHEN instr(',' || a.groups || ',', ',bill,') > 0 THEN 16 ELSE 0 END)
+  FROM `contact_access_audit` AS a
+  WHERE a.tenant_id = m.tenant_id AND a.stage = m.stage AND a.record_id = m.order_id
+    AND a.record_kind = 'order-contact' AND a.action = 'erase' AND a.outcome = 'admitted'
+), 0);
+--> statement-breakpoint
+CREATE TRIGGER `order_contact_markers_erasure_monotonic`
+BEFORE UPDATE ON `order_contact_markers`
+WHEN NEW.tenant_id != OLD.tenant_id OR NEW.stage != OLD.stage OR NEW.order_id != OLD.order_id
+  OR (NEW.erased_groups | OLD.erased_groups) != NEW.erased_groups
+BEGIN
+  SELECT RAISE(ABORT, 'erasure-monotonic');
+END;

package/apps/storefront/src/lib/fulfillment/fulfillmentService.ts

@@ -801,7 +801,11 @@ export class FulfillmentService {
       if (state.shipment.labelPurchaseState === mapped.shipment && state.labelOutcome?.adultSignature === input.adultSignature) {
         return { type: "done", view: state.view };
       }
-      if(input.outcome==="purchased"&&state.sourceHolds.length)return {type:"refuse",code:state.sourceHolds[0]!,holds:state.sourceHolds};
+      if (input.outcome === "purchased") {
+        if (state.sourceHolds.length) return { type: "refuse", code: state.sourceHolds[0]!, holds: state.sourceHolds };
+        const contactHolds = releaseHolds(this.readiness(state)).filter((hold) => hold.startsWith("ship-to-"));
+        if (contactHolds.length) return { type: "refuse", code: contactHolds[0]!, holds: contactHolds };
+      }
       const version = state.order.eventVersion + 1;
       return {
         type: "write",

package/apps/storefront/src/lib/orders/admin/orderClient.ts

@@ -14,16 +14,21 @@
  */
 import type {
   CheckoutOrderDetail,
-  CheckoutOrderDetailResponse,
+  CheckoutOrderSummary,
   CheckoutOrderListFilters,
   CheckoutOrderListResponse,
   CommerceActor,
   CommerceRole,
   CommerceScope,
   CommerceStage,
+  CheckoutOrderCustomer,
+  OrderContactAvailability,
+  OrderContactState,
 } from "@tot/public-runtime";
-import { readOwnerAddress } from "@tot/public-runtime";
+import { actorMayCommand, readOwnerAddress } from "@tot/public-runtime";
 import type { CustomizationEnv } from "@tot/public-runtime";
+import { contactReaderAuthority } from "@/lib/access/auth/contactReaderAuthority";
+import type { SessionRecord } from "@/lib/access/auth/session";
 
 /** Fetch shape we depend on — the platform `fetch`, injectable for tests. */
 export type FetchLike = (
@@ -107,26 +112,83 @@ export function commerceStageForCustomization(env: CustomizationEnv): CommerceSt
   return env === "live" ? "publication" : "preview";
 }
 
-/** Owner reads private order fields. An admitted member is a caller. Everyone else is denied. */
+/** Private ownership comes from tenant membership, independently of staff operational capability. */
 export function commerceActorForAdmin(input: {
   tenantId: string;
   stage: CommerceStage;
-  owner: boolean;
+  record: SessionRecord | null | undefined;
+  nowSeconds: number;
   admitted: boolean;
 }): CommerceActor {
-  const role: CommerceRole = !input.admitted ? "denied" : input.owner ? "owner" : "caller";
+  const privateOwner = contactReaderAuthority(input.record, input.tenantId, input.nowSeconds).kind === "owner";
+  const role: CommerceRole = !input.admitted ? "denied" : privateOwner ? "owner" : "caller";
   return { role, tenantId: input.tenantId, stage: input.stage };
 }
 
 /** Drop the address unless this actor may read it for this tenant and stage. */
-export function projectCheckoutOrder<T extends { shippingAddress?: unknown }>(
+export function projectCheckoutOrder<T extends { shippingAddress?: unknown; customer?: CheckoutOrderCustomer; contactAvailability?: OrderContactAvailability }>(
   order: T,
   actor: CommerceActor,
   resource: CommerceScope,
 ): T {
+  const unknown: OrderContactAvailability = { identity: "unreadable", email: "unreadable", shipTo: "unreadable" };
+  const availability = order.contactAvailability ?? {
+    ...unknown,
+    shipTo: Object.hasOwn(order, "shippingAddress") ? addressAvailability(order.shippingAddress) : "unreadable",
+  };
   const read = readOwnerAddress(actor, resource, () => order.shippingAddress ?? null);
-  if (read.ok) return order;
-  return { ...order, shippingAddress: null };
+  if (read.ok) return { ...order, contactAvailability: availability };
+  const restricted = (state: OrderContactState): OrderContactState => state === "present" ? "restricted" : state;
+  const projected: Record<string, unknown> = { ...order };
+  for (const key of ["customerName", "customerEmail", "email", "phone", "name", "line1", "line2", "postalCode"]) delete projected[key];
+  return {
+    ...projected,
+    shippingAddress: null,
+    ...(order.customer ? { customer: { id: null, name: "Checkout customer" } } : {}),
+    contactAvailability: actorMayCommand(actor, resource) ? {
+      identity: restricted(availability.identity), email: restricted(availability.email), shipTo: restricted(availability.shipTo),
+    } : unknown,
+  } as T;
+}
+
+function addressAvailability(value: unknown): OrderContactState {
+  if (value === null) return "absent";
+  if (!isRecord(value)) return "unreadable";
+  return ["line1", "city", "country"].every((key) => typeof value[key] === "string" && value[key].trim() !== "") ? "present" : "unreadable";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+const SUMMARY_FIELDS = ["id", "placedAt", "currency", "customer", "contactAvailability", "itemsSummary", "itemCount", "total", "payment", "fulfillment", "blocker", "verification"];
+const DETAIL_FIELDS = [...SUMMARY_FIELDS, "lineItems", "totals", "shippingAddress", "verificationDetail"];
+
+/** Refuse an unsupported upstream body before any raw contact aliases reach an admin response. */
+function frozenOrder(value: unknown, detail: true): value is CheckoutOrderDetail;
+function frozenOrder(value: unknown, detail: false): value is CheckoutOrderSummary;
+function frozenOrder(value: unknown, detail: boolean): boolean {
+  if (!isRecord(value) || Object.keys(value).some((key) => !(detail ? DETAIL_FIELDS : SUMMARY_FIELDS).includes(key))) return false;
+  if (!["id", "placedAt", "currency", "itemsSummary"].every((key) => typeof value[key] === "string")) return false;
+  if (!isRecord(value.customer) || typeof value.customer.name !== "string" ||
+    !(value.customer.id === null || typeof value.customer.id === "string") ||
+    Object.keys(value.customer).some((key) => key !== "id" && key !== "name")) return false;
+  if (typeof value.total !== "number" || !Number.isFinite(value.total) || !Number.isInteger(value.itemCount)) return false;
+  if (!["authorized", "captured", "refunded"].includes(String(value.payment)) ||
+    !["unfulfilled", "ready_to_ship", "hold_review_required", "completed"].includes(String(value.fulfillment))) return false;
+  if (value.blocker !== null && typeof value.blocker !== "string") return false;
+  if (value.verification !== null && !isRecord(value.verification)) return false;
+  const availability = value.contactAvailability;
+  if (availability !== undefined && (!isRecord(availability) ||
+    !["identity", "email", "shipTo"].every((key) => typeof availability[key] === "string" &&
+      ["present", "restricted", "absent", "expired", "erased", "unreadable"].includes(availability[key])) ||
+    Object.keys(availability).some((key) => !["identity", "email", "shipTo"].includes(key)))) return false;
+  return !detail || (Array.isArray(value.lineItems) && isRecord(value.totals) && isRecord(value.verificationDetail) &&
+    (value.shippingAddress === null || isRecord(value.shippingAddress)));
+}
+
+function unsupportedBody(): OrderApiError {
+  return new OrderApiError("bad_gateway", 502);
 }
 
 /** Build the list querystring: appDomain (required) + any provided filters. */
@@ -151,12 +213,12 @@ export function createCheckoutOrderClient(
   const base = config.baseUrl.replace(/\/+$/, "");
   const headers = { authorization: `Bearer ${config.bearer}` };
 
-  async function getJson<T>(url: string): Promise<T> {
+  async function getJson(url: string): Promise<unknown> {
     const res = await doFetch(url, { method: "GET", headers });
     const body = await res.text();
     if (!res.ok) throw toError(res.status, body);
     try {
-      return JSON.parse(body) as T;
+      return JSON.parse(body) as unknown;
     } catch {
       throw new OrderApiError("unexpected", res.status, "malformed JSON");
     }
@@ -165,14 +227,22 @@ export function createCheckoutOrderClient(
   return {
     async listOrders(filters) {
       const qs = listQuery(config.appDomain, filters);
-      return getJson<CheckoutOrderListResponse>(`${base}/commerce/orders?${qs}`);
+      const body = await getJson(`${base}/commerce/orders?${qs}`);
+      if (!isRecord(body) || !Array.isArray(body.orders) || !body.orders.every((order): order is CheckoutOrderSummary => frozenOrder(order, false)) ||
+        !isRecord(body.page) || Object.keys(body).some((key) => key !== "orders" && key !== "page")) throw unsupportedBody();
+      const page = body.page;
+      if (typeof page.limit !== "number" || !(page.cursor === null || typeof page.cursor === "string") ||
+        !(page.nextCursor === null || typeof page.nextCursor === "string") || !(page.total === null || typeof page.total === "number") ||
+        Object.keys(page).some((key) => !["limit", "cursor", "nextCursor", "total"].includes(key))) throw unsupportedBody();
+      return { orders: body.orders, page: { limit: page.limit, cursor: page.cursor, nextCursor: page.nextCursor, total: page.total } };
     },
     async getOrder(orderId) {
       const qs = new URLSearchParams({ appDomain: config.appDomain }).toString();
-      const { order } = await getJson<CheckoutOrderDetailResponse>(
+      const body = await getJson(
         `${base}/commerce/orders/${encodeURIComponent(orderId)}?${qs}`,
       );
-      return order;
+      if (!isRecord(body) || !frozenOrder(body.order, true) || Object.keys(body).some((key) => key !== "order")) throw unsupportedBody();
+      return body.order;
     },
   };
 }

package/apps/storefront/src/lib/orders/admin/services/orders.ts

@@ -28,6 +28,7 @@ import type {
   TenantConfig,
   OrderContactState,
 } from "@tot/public-runtime";
+import { projectCheckoutOrder } from "../orderClient";
 import {
   actorMayCommand,
   decideCommerceCommand,
@@ -644,6 +645,7 @@ export function emptyOrdersViewModel(targetTenant: string, timeZone: string = DE
 }
 
 export interface GetOrdersViewModelOptions {
+  actor?: CommerceActor;
   targetTenant: string;
   scope: CommerceScope;
   client: CheckoutOrderClient;
@@ -719,12 +721,15 @@ async function readOrdersToday(client: CheckoutOrderClient, now: Date, timeZone:
 
 export async function getOrdersViewModelResult(opts: GetOrdersViewModelOptions): Promise<OrdersLoadResult> {
   try {
-    const { orders, page } = await opts.client.listOrders(opts.filters);
+    const listed = await opts.client.listOrders(opts.filters);
+    const actor = opts.actor ?? { ...opts.scope, role: "caller" as const };
+    const orders = listed.orders.map((order) => projectCheckoutOrder(order, actor, opts.scope));
+    const page = listed.page;
     const details: Record<string, CheckoutOrderDetail> = {};
     await Promise.all(
       orders.map(async (o) => {
         try {
-          details[o.id] = await opts.client.getOrder(o.id);
+          details[o.id] = projectCheckoutOrder(await opts.client.getOrder(o.id), actor, opts.scope);
         } catch {
           /* detail unavailable — row still renders from its summary */
         }

package/apps/storefront/src/lib/orders/vault/orderContactVault.ts

@@ -71,6 +71,8 @@ const LAYOUT: Readonly<Record<Group, GroupLayout>> = {
   bill: { sealed: ["bill_name_ct", "bill_company_ct", "bill_line1_ct", "bill_line2_ct"], bidx: null, plain: ["bill_city", "bill_postal_code"] },
 };
 
+const ERASURE_BITS: Readonly<Record<Group, number>> = { identity: 1, email: 2, phone: 4, ship: 8, bill: 16 };
+
 function groupColumns(group: Group): string[] {
   const layout = LAYOUT[group];
   return [...layout.sealed, ...(layout.bidx ? [layout.bidx] : []), ...layout.plain];
@@ -624,7 +626,9 @@ function completeGroupSql(group: typeof AVAILABILITY_GROUPS[number]): string {
 
 const AVAILABILITY_SELECT = `SELECT o.order_id, o.placed_at AS order_placed_at,
     o.fulfillment_state AS order_fulfillment_state, (${correlatedTerminalSql("o")}) AS order_terminal_at,
-    v.order_id IS NOT NULL AS vault_present, v.erased_at IS NOT NULL AS erased,
+    v.order_id IS NOT NULL AS vault_present,
+    COALESCE((SELECT m.erased_groups FROM order_contact_markers m
+      WHERE m.tenant_id = o.tenant_id AND m.stage = o.stage AND m.order_id = o.order_id), 0) AS erased_groups,
     EXISTS (SELECT 1 FROM order_contact_markers m
       WHERE m.tenant_id = o.tenant_id AND m.stage = o.stage AND m.order_id = o.order_id) AS marked,
     EXISTS (SELECT 1 FROM contact_vault_data_keys k
@@ -648,13 +652,17 @@ function uniformAvailability(state: OrderContactState): OrderContactAvailability
 function contactAvailability(row: VaultRow, input: {
   tenantId: string; stage: VaultStage; now: Date; policy: RetentionPolicy;
 }): OrderContactAvailability {
-  if (Number(row.vault_present) !== 1) return uniformAvailability(Number(row.marked) === 1 ? "expired" : "absent");
+  const erased = (group: Group): boolean => (Number(row.erased_groups) & ERASURE_BITS[group]) !== 0;
+  if (Number(row.vault_present) !== 1) {
+    const missing = (group: Group): OrderContactState => erased(group) ? "erased" : Number(row.marked) === 1 ? "expired" : "absent";
+    return { identity: missing("identity"), email: missing("email"), shipTo: missing("ship") };
+  }
   const times = orderTimes(row.order_placed_at, row.order_fulfillment_state, row.order_terminal_at);
   if (times === "order-time-unreadable" || !Number.isFinite(input.now.getTime())) return uniformAvailability("unreadable");
   const states = groupStates(row, input.tenantId, input.stage, times, input.now, input.policy);
   const state = (group: typeof AVAILABILITY_GROUPS[number]): OrderContactState => {
     const current = states[group];
-    if (!current.sealed && Number(row.erased) === 1) return "erased";
+    if (!current.sealed && erased(group)) return "erased";
     if (!current.expiresAt) return "unreadable";
     if (!isGroupReadable(input.now, current.expiresAt, text(row, `${group}_ceiling`)) ||
       (input.stage === "preview" && input.now.getTime() >= Date.parse(previewDeleteAt(times.placedAt, input.policy)))) return "expired";
@@ -949,6 +957,10 @@ export async function eraseOrderContact(
   });
   const statements: QueryStatement[] = [
     batchAuditStatement(audit),
+    {
+      sql: `UPDATE order_contact_markers SET erased_groups = erased_groups | ? WHERE ${scope}`,
+      params: [targets.reduce((mask, group) => mask | ERASURE_BITS[group], 0), ...scopeParams],
+    },
     { sql: `UPDATE order_contact_vault SET ${clearSql(targets)}, erased_at = ? WHERE ${scope}`, params: [now.toISOString(), ...scopeParams] },
     ...normalizeStatements(scope, scopeParams),
   ];

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -7,6 +7,7 @@
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
+import { readViewerSession } from "@/lib/access/auth/route";
 import { commerceActorForAdmin, OrderApiError, projectCheckoutOrder } from "@/lib/orders/admin/orderClient";
 import { resolveOrderSource, workerOrderSourceDeps } from "@/lib/orders/admin/orderSource";
 import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
@@ -47,7 +48,8 @@ export async function GET(context: APIContext): Promise<Response> {
     const actor = commerceActorForAdmin({
       tenantId: scope.tenantId,
       stage: scope.stage,
-      owner: access.entry.isOwnerViewer,
+      record: await readViewerSession(context),
+      nowSeconds: Math.floor(Date.now() / 1000),
       admitted: access.entry.admitted,
     });
     const order = projectCheckoutOrder(await source.client.getOrder(orderId), actor, scope);

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -11,7 +11,8 @@
  */
 import type { APIContext } from "astro";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
-import { OrderApiError } from "@/lib/orders/admin/orderClient";
+import { readViewerSession } from "@/lib/access/auth/route";
+import { commerceActorForAdmin, OrderApiError, projectCheckoutOrder } from "@/lib/orders/admin/orderClient";
 import { resolveOrderSource, workerOrderSourceDeps } from "@/lib/orders/admin/orderSource";
 import { admitSharedStoreTenant } from "@/lib/checkout/commerce/sharedStoreAdmission";
 import { assessCheckoutOrder, parseOrderFilters } from "@/lib/orders/admin/services/orders";
@@ -51,10 +52,11 @@ export async function GET(context: APIContext): Promise<Response> {
 
   try {
     const data = await source.client.listOrders(filters);
-    const orders = data.orders.map((order) => ({
-      ...order,
-      readiness: assessCheckoutOrder(order, source.scope),
-    }));
+    const actor = commerceActorForAdmin({ ...source.scope, record: await readViewerSession(context), nowSeconds: Math.floor(Date.now() / 1000), admitted: access.entry.admitted });
+    const orders = data.orders.map((raw) => {
+      const order = projectCheckoutOrder(raw, actor, source.scope);
+      return { ...order, readiness: assessCheckoutOrder(order, source.scope) };
+    });
     return new Response(JSON.stringify({ ...data, orders }), { headers: JSON_HEADERS });
   } catch (err) {
     if (err instanceof OrderApiError) return jsonError(err.code, err.status);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.1.0",
+  "version": "6.1.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",