@tokenoftrust/storefront-runner 6.1.2 → 6.1.3

package/apps/storefront/src/lib/publication/shared/routedApiParam.ts

@@ -1,6 +1,7 @@
 import type { APIContext } from "astro";
 
 const ROUTES = {
+  "checkout-order": { path: /^\/api\/admin\/orders\/([A-Za-z0-9._:-]{1,128})\/?$/, param: "id" },
   "pipeline-job": { path: /^\/api\/pipeline\/jobs\/([A-Za-z0-9._:-]{1,128})\/?$/, param: "jobId" },
   "fulfillment-order": { path: /^\/api\/admin\/fulfillment\/orders\/([A-Za-z0-9._:-]{1,128})\/?$/, param: "id" },
   "fulfillment-address": { path: /^\/api\/admin\/fulfillment\/orders\/([A-Za-z0-9._:-]{1,128})\/address\/?$/, param: "id" },
@@ -21,7 +22,11 @@ export function routedApiParam(context: APIContext, kind: RoutedApiKind): string
   let pathname: string;
   try { pathname = new URL(context.request.url).pathname; } catch { return undefined; }
   if (prefix && !pathname.startsWith(`${prefix}/`)) return undefined;
-  const relative = pathname.slice(prefix.length);
+  let relative: string;
+  try { relative = decodeURIComponent(pathname.slice(prefix.length)); } catch (error) {
+    if (error instanceof URIError) return undefined;
+    throw error;
+  }
   const route = ROUTES[kind];
   const id = route.path.exec(relative)?.[1];
   if (!id || id === "." || id === "..") return undefined;

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -6,6 +6,7 @@
  * Readiness is assessed, not inferred. Read-only.
  */
 import type { APIContext } from "astro";
+import { routedApiParam } from "@/lib/publication/shared/routedApiParam";
 import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { readViewerSession } from "@/lib/access/auth/route";
 import { commerceActorForAdmin, OrderApiError, projectCheckoutOrder } from "@/lib/orders/admin/orderClient";
@@ -34,7 +35,7 @@ export async function GET(context: APIContext): Promise<Response> {
   const access = await requireAdminApiEntry(context);
   if (!access.ok) return jsonError(access.reason, access.status);
 
-  const orderId = context.params.id;
+  const orderId = routedApiParam(context, "checkout-order");
   if (!orderId) return jsonError("order_not_found", 404);
 
   const source = await resolveOrderSource(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.1.2",
+  "version": "6.1.3",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",