@tokenoftrust/storefront-runner 6.4.0 → 6.5.0

package/apps/storefront/src/lib/assets/preview-pinned-image-urls.ts

@@ -9,11 +9,37 @@ export async function scopePreviewPinnedImageUrls(response: Response, basePath:
   return new Response(scoped, { status: response.status, statusText: response.statusText, headers });
 }
 
-/** Scope only exact captured-image addresses; platform assets and external URLs retain their host. */
+const CAPTURED_ENTRY = String.raw`\/_a\/([0-9a-f]{64}(?:\.[A-Za-z0-9]+)?)`;
+/** A URL-bearing attribute and its quoted or bare value. Form data (`value=`, `data-*`) never matches. */
+const URL_ATTRIBUTE = /(\s(?:src|srcset|imagesrcset|xlink:href|href|poster)\s*=\s*)("[^"]*"|'[^']*'|[^\s"'=<>`]+)/gi;
+/** A captured address that opens a URL or a srcset candidate inside an attribute value. */
+const ATTRIBUTE_ENTRY = new RegExp(String.raw`(^["']?|[\s,])${CAPTURED_ENTRY}(?=[\s,"'?#]|$)`, "g");
+/** A CSS `url(...)` reference, in a style element or a style attribute. */
+const CSS_URL_ENTRY = new RegExp(String.raw`(url\(\s*["']?)${CAPTURED_ENTRY}(?=["'?#)\s])`, "gi");
+/** A CSS `image-set(...)` / `image(...)` body, whose candidates may be bare quoted strings. */
+const CSS_IMAGE_FUNCTION = /((?<![\w-])(?:-webkit-)?image(?:-set)?\()([^()]*(?:\([^()]*\)[^()]*)*)\)/g;
+/** A quoted captured address inside an image function body. */
+const QUOTED_ENTRY = new RegExp(String.raw`(["'])${CAPTURED_ENTRY}(?=["'?#])`, "g");
+/** A social-image `<meta>` tag (og:image, twitter:image and their URL variants). */
+const IMAGE_META = /<meta\b(?=[^>]*\b(?:property|name)\s*=\s*["']?(?:og|twitter):image(?::url|:secure_url|:src)?["'\s>/])[^>]*>/gi;
+/** The `content` attribute of a tag and its quoted or bare value. */
+const CONTENT_ATTRIBUTE = /(\scontent\s*=\s*)("[^"]*"|'[^']*'|[^\s"'=<>`]+)/i;
+
+/**
+ * Scope only exact captured-image addresses in URL-bearing attributes (src, srcset, href,
+ * xlink:href, poster, a social-image meta `content`) and CSS url() / image-set() / image().
+ * Platform assets, external URLs and every other attribute — signed form values included — are
+ * left byte-for-byte.
+ */
 export function prefixPreviewPinnedImageUrls(html: string, basePath: string): string {
   if (!basePath) return html;
-  return html.replace(/([\s"'(=,])\/_a\/([0-9a-f]{64}(?:\.[A-Za-z0-9]+)?)(?=[\s"'?#),<>]|$)/g,
-    (_match, before: string, entry: string) => `${before}${basePath}/_a/${entry}`);
+  const scope = (_match: string, before: string, entry: string) => `${before}${basePath}/_a/${entry}`;
+  const scopeValue = (_match: string, name: string, value: string) => `${name}${value.replace(ATTRIBUTE_ENTRY, scope)}`;
+  return html
+    .replace(URL_ATTRIBUTE, scopeValue)
+    .replace(IMAGE_META, (tag) => tag.replace(CONTENT_ATTRIBUTE, scopeValue))
+    .replace(CSS_URL_ENTRY, scope)
+    .replace(CSS_IMAGE_FUNCTION, (_match, open: string, body: string) => `${open}${body.replace(QUOTED_ENTRY, scope)})`);
 }
 
 /** Choose asset routing from the resolved request tenant, never a second host-membership check. */

package/apps/storefront/src/lib/checkout/commerce/cardCartForm.ts

@@ -15,6 +15,7 @@ import {
   sampleVariantCartPayload,
   visiblePurchaseOptions,
   isAutopilotEnabled,
+  tenantPublicOrigin,
   workerCartApiPath,
 } from "@tot/public-runtime";
 import { isLocalSampleCheckout } from "@/config/declaredTenantConfig";
@@ -69,6 +70,7 @@ export async function buildCardCartForm(input: {
           tenantId: commerceTenantId(input.tenant),
           currency: input.tenant.currency,
           contentVersionId: input.environment === "live" ? undefined : input.contentVersionId,
+          publicOrigin: tenantPublicOrigin(input.tenant),
         });
     const provider = input.tenant.serving?.provider === "s3-overwrite" ? "s3-overwrite" : "worker-r2-pointer";
     return {

package/apps/storefront/src/lib/checkout/commerce/checkoutHandoffRoute.ts

@@ -32,6 +32,7 @@ import {
   withShippingPolicy,
   withReturnUrl,
   trustedCartReturnUrl,
+  tenantPublicOrigin,
   CHECKOUT_NAVIGATION_REFERRER_POLICY,
   SHIPPING_UNAVAILABLE_CART_MESSAGE,
   ShippingPolicyUnavailableError,
@@ -174,6 +175,19 @@ function submittedFromUrl(request: Request, tenant: TenantConfig): string | null
   return trustedCartReturnUrl(request.headers.get("referer"), hosts);
 }
 
+/**
+ * The operator record of a refused cart: tenant, stage, denial code and the base names of the
+ * signed fields that failed. Never a field value, hash, the secret or any shopper data.
+ */
+function logCartRefusal(context: APIContext, code: CartDenialCode, failedFields: readonly string[]): void {
+  console.warn(`[storefront] checkout-handoff refused ${JSON.stringify({
+    tenant: context.locals.tenant.tenant_id,
+    stage: context.locals.browserEnvironment?.environment ?? "unknown",
+    code,
+    failedFields,
+  })}`);
+}
+
 /** Native cart POST. Browser preflight is not consulted. Payment is never authorized. */
 async function cartFormPost(context: APIContext): Promise<Response> {
   const { tenant, commerce } = context.locals;
@@ -207,6 +221,7 @@ async function cartFormPost(context: APIContext): Promise<Response> {
     trustedTenantId: commerceTenantId(tenant),
   });
   if (!result.ok) {
+    logCartRefusal(context, result.code, result.failedFields);
     const status = result.code === "signing-unavailable" ? 503 : 422;
     return cartDenial(result.code, shopperCartDenialMessage(result.code, result.message), status);
   }
@@ -333,6 +348,7 @@ export async function sampleCartGet(
     if (!signing.enabled) return sampleResponse('{"error":"sample_unavailable"}', 503);
     const payload = await buildVariantCartPayload(product, variant, {
       mode: "signed", secret: signing.secret, tenantId: commerceTenantId(tenant), currency: tenant.currency,
+      publicOrigin: tenantPublicOrigin(tenant),
     });
     const result = await enforceCartSubmission({
       entries: [...payload.hidden.map((f): [string, string] => [f.name, f.value]), [payload.quantityName, quantity]],

package/apps/storefront/src/pages/products/[handle].astro

@@ -33,6 +33,7 @@ import {
   DEFAULT_STACKING_POLICY,
   readReviewAggregate,
   resolveProductDetails,
+  tenantPublicOrigin,
 } from "@tot/public-runtime";
 import type {
   ProductPurchaseOption,
@@ -268,6 +269,7 @@ if (commerce || sampleHandoff) {
                     tenantId: commerceTenantId(tenant),
                     currency: tenant.currency,
                     contentVersionId: Astro.locals.browserEnvironment.environment === "live" ? undefined : Astro.locals.contentVersionId,
+                    publicOrigin: tenantPublicOrigin(tenant),
                   }),
                 ] as const;
               }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "6.4.0",
+  "version": "6.5.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/checkout.ts

@@ -172,6 +172,32 @@ export interface BuildVariantCartPayloadOptions {
    * A publication page and a shared-channel preview omit it. Never taken from the form.
    */
   contentVersionId?: string;
+  /**
+   * The tenant's canonical public origin (`tenantPublicOrigin`), from server-side tenant config.
+   * A root-relative catalog image is signed as an absolute URL on it, so the checkout can load it
+   * and no page rewrite of the relative path can break the signature. Never a request value.
+   */
+  publicOrigin?: string;
+}
+
+/** `https://<canonicalDomain>` from server-side tenant config; undefined when it is not a bare host. */
+export function tenantPublicOrigin(tenant: Pick<TenantConfig, "canonicalDomain">): string | undefined {
+  const host = tenant.canonicalDomain?.trim().toLowerCase();
+  return host && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::\d{1,5})?$/.test(host) ? `https://${host}` : undefined;
+}
+
+/**
+ * A root-relative image resolved against the public origin. Absolute and protocol-relative values,
+ * and any that fail to parse or would resolve onto another origin, are signed as they are.
+ */
+function cartImageUrl(image: string, publicOrigin: string | undefined): string {
+  if (!publicOrigin || !image.startsWith("/") || image.startsWith("//")) return image;
+  try {
+    const resolved = new URL(image, publicOrigin);
+    return resolved.origin === new URL(publicOrigin).origin ? resolved.href : image;
+  } catch {
+    return image;
+  }
 }
 
 /** Declared public serving substrate (ADR 0013 `serving.provider`). */
@@ -527,11 +553,12 @@ export function cartFieldsForVariant(
   product: CatalogProduct,
   variant: CatalogVariant,
   purchaseOption?: ProductPurchaseOption,
-  opts?: { signedPrice?: number; tenantId?: string; currency?: string; contentVersionId?: string },
+  opts?: { signedPrice?: number; tenantId?: string; currency?: string; contentVersionId?: string; publicOrigin?: string },
 ): { code: string; fields: CartField[] } {
   const code = cartLineCode(variant);
-  const image = product.images.find((i) => i.id === variant.image_id)?.url ??
+  const catalogImage = product.images.find((i) => i.id === variant.image_id)?.url ??
     product.images[0]?.url;
+  const image = catalogImage ? cartImageUrl(catalogImage, opts?.publicOrigin) : undefined;
   // The signed price is either the caller's member-adjusted EFFECTIVE price
   // (F11b — the single signed source of truth, computed server-side from the
   // shopper's resolved eligibility) or, absent that, the list/subscription price.
@@ -762,7 +789,10 @@ export async function buildVariantCartPayload(
     product,
     variant,
     opts.purchaseOption,
-    { signedPrice: opts.signedPrice, tenantId: opts.tenantId, currency: opts.currency, contentVersionId: opts.contentVersionId },
+    {
+      signedPrice: opts.signedPrice, tenantId: opts.tenantId, currency: opts.currency,
+      contentVersionId: opts.contentVersionId, publicOrigin: opts.publicOrigin,
+    },
   );
   const signed = opts.mode === "signed";
   if (signed && !opts.secret) {
@@ -796,7 +826,15 @@ export interface CartSubmissionField {
 
 export type CartEnforcement =
   | { ok: true; fields: CartSubmissionField[]; paymentAuthorized: false }
-  | { ok: false; code: CartDenialCode; message: string; paymentAuthorized: false };
+  | {
+    ok: false; code: CartDenialCode; message: string; paymentAuthorized: false;
+    /**
+     * Base names of the signed fields that failed verification or were missing, for the operator
+     * log. Names only, never a value, hash or the secret; a name that is not a plain field name is
+     * reported as `(unrecognized)`.
+     */
+    failedFields: string[];
+  };
 
 interface ParsedCartField {
   rawName: string;
@@ -839,12 +877,26 @@ function parseSubmittedField(rawName: string, value: string): ParsedCartField {
   return { rawName, baseName: rawName, value, open: false, passthrough: false };
 }
 
-function denial(code: CartDenialCode): CartEnforcement {
+const MAX_REPORTED_CART_FIELDS = 20;
+
+/**
+ * A submitted base name safe to log. Native and internal names are reported as-is; any other
+ * (a variant option) only when it is a short letters-only label, so a crafted name can never
+ * carry digits, an address or markup into the log.
+ */
+function reportedFieldName(baseName: string): string {
+  if ((NATIVE_CART_FIELDS as readonly string[]).includes(baseName) ||
+    (INTERNAL_CART_FIELDS as readonly string[]).includes(baseName)) return baseName;
+  return /^[A-Za-z][A-Za-z _.-]{0,63}$/.test(baseName) ? baseName : "(unrecognized)";
+}
+
+function denial(code: CartDenialCode, failedFields: Iterable<string> = []): CartEnforcement {
   return {
     ok: false,
     code,
     message: CART_DENIAL_MESSAGE[code],
     paymentAuthorized: false,
+    failedFields: [...new Set([...failedFields].map(reportedFieldName))].slice(0, MAX_REPORTED_CART_FIELDS),
   };
 }
 
@@ -875,14 +927,15 @@ export async function enforceCartSubmission(input: {
   const byBase = new Map<string, ParsedCartField>();
   for (const field of parsed) {
     if (field.passthrough) continue;
-    if (byBase.has(field.baseName)) return denial("signature");
+    if (byBase.has(field.baseName)) return denial("signature", [field.baseName]);
     byBase.set(field.baseName, field);
   }
 
   const codeField = byBase.get("code");
-  if (!codeField || !codeField.value) return denial("signature");
+  if (!codeField || !codeField.value) return denial("signature", ["code"]);
 
   const failures = new Set<CartDenialCode>();
+  const failedFields = new Set<string>();
   const signed = input.mode === "signed";
   const secret = input.secret ?? "";
 
@@ -894,10 +947,16 @@ export async function enforceCartSubmission(input: {
   };
 
   if (signed) {
-    if (!(await hashOk(codeField))) failures.add("signature");
+    if (!(await hashOk(codeField))) {
+      failures.add("signature");
+      failedFields.add("code");
+    }
     for (const field of byBase.values()) {
       if (field.baseName === "code") continue;
-      if (!(await hashOk(field))) failures.add(specificCode(field.baseName));
+      if (!(await hashOk(field))) {
+        failures.add(specificCode(field.baseName));
+        failedFields.add(field.baseName);
+      }
     }
   }
 
@@ -911,13 +970,16 @@ export async function enforceCartSubmission(input: {
   if (!quantityField || !quantityAllowed(quantityField.value)) failures.add("quantity");
   if (signed) {
     for (const required of ["name", "currency"]) {
-      if (!byBase.get(required)) failures.add("signature");
+      if (!byBase.get(required)) {
+        failures.add("signature");
+        failedFields.add(required);
+      }
     }
   }
 
   const order: CartDenialCode[] = ["tenant", "price", "quantity", "signature"];
   for (const code of order) {
-    if (failures.has(code)) return denial(code);
+    if (failures.has(code)) return denial(code, failedFields);
   }
 
   return {

package/packages/public-runtime/src/membership.ts

@@ -282,6 +282,8 @@ export interface MemberSignedCartPayloadOptions {
   currency?: string;
   /** Candidate content pin the preview page rendered. Omitted for publication and the shared channel. */
   contentVersionId?: string;
+  /** Tenant public origin a relative image is signed on (see {@link BuildVariantCartPayloadOptions.publicOrigin}). */
+  publicOrigin?: string;
 }
 
 /**
@@ -318,6 +320,7 @@ export async function buildMemberSignedCartPayload(
     tenantId: opts.tenantId,
     currency: opts.currency,
     contentVersionId: opts.contentVersionId,
+    publicOrigin: opts.publicOrigin,
   });
 }