payment-kit 1.29.7 → 1.29.9

package/cloudflare/worker.ts

@@ -10,6 +10,11 @@ import { Client as PgClient } from 'pg';
 import postgres from 'postgres';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
+import { getCookie } from 'hono/cookie';
+// Worker-safe CSRF crypto (the SAME module the csrf middleware verifies with —
+// util/csrf passes through to the real package in the CF bundle, see build.ts).
+// eslint-disable-next-line import/no-extraneous-dependencies
+import { sign as signCsrf, getCsrfSecret } from '@blocklet/sdk/lib/util/csrf';
 import { setDB } from './shims/sequelize-d1/model';
 import { initialize } from '../api/src/store/models';
 import { Sequelize } from './shims/sequelize-d1/sequelize-class';
@@ -386,6 +391,20 @@ function buildApp(env: Env): Hono<HonoEnv> {
     // Flag: HTTP request context. createEvent uses waitUntil (non-blocking).
     // In queue consumer/cron, this flag is absent — createEvent uses __cfPendingJobs__ (blocking).
     (globalThis as any).__cfHttpContext__ = true;
+    // The @blocklet/sdk CSRF util reads its signing secret DIRECTLY from
+    // process.env (`BLOCKLET_APP_ASK || BLOCKLET_APP_SK`), not the config slot. The
+    // Phase-12a removal of the per-request process.env mirror left it undefined, so
+    // every CSRF-signed response hit `createHmac(<undefined key>)` → 500 (e.g.
+    // GET /api/settings). Restore just that one var from the APP_SK binding (the
+    // standalone worker's app secret key). Idempotent within the isolate.
+    if (c.env.APP_SK && !process.env.BLOCKLET_APP_SK) {
+      process.env.BLOCKLET_APP_SK = c.env.APP_SK;
+    }
+    // Test/staging escape hatch: forward PAYMENT_DISABLE_CSRF to the config boundary
+    // so the csrf middleware (readConfig) can honor it. Default-absent → CSRF stays on.
+    if ((c.env as any).PAYMENT_DISABLE_CSRF && !process.env.PAYMENT_DISABLE_CSRF) {
+      process.env.PAYMENT_DISABLE_CSRF = (c.env as any).PAYMENT_DISABLE_CSRF;
+    }
     setDB(withD1Retry(c.env.DB.withSession('first-primary')));
     ensureModelsInit();
 
@@ -496,6 +515,28 @@ function buildApp(env: Env): Hono<HonoEnv> {
   // Health check
   app.get('/health', (c) => c.json({ status: 'ok' }));
 
+  // did/csrfToken — the @blocklet/js-sdk axios adapter fetches its CSRF header from
+  // THIS endpoint (getCSRFTokenByLoginToken), not from the cookie. The shared
+  // blocklet-service (AUTH_SERVICE) only implements it on newer versions, so the
+  // catch-all proxy below 404s on older AUTH_SERVICE — leaving the SDK with no CSRF
+  // header and every mutating request 403'ing ("csrf token mismatch"). Sign it
+  // LOCALLY with the SAME secret + algorithm the payment csrf middleware verifies
+  // with (util/csrf sign over login_token), so token == cookie == what verify()
+  // expects. Must be registered BEFORE the /.well-known/service/* catch-all. This
+  // also makes the embedded arc-node CF runtime self-sufficient (no AUTH_SERVICE
+  // csrfToken endpoint required).
+  app.get('/.well-known/service/api/did/csrfToken', (c) => {
+    const loginToken = getCookie(c, 'login_token');
+    if (!loginToken) return c.json({ loginToken: null, csrfToken: null });
+    // Same secret resolution as the csrf middleware's csrfSecret() (PAYMENT_CSRF_SECRET
+    // override else the app secret key). Read APP_SK from the binding directly so we
+    // do not depend on the process.env.BLOCKLET_APP_SK mirror timing; getCsrfSecret()
+    // is the final fallback.
+    const secret = (c.env as any).PAYMENT_CSRF_SECRET || c.env.APP_SK || getCsrfSecret();
+    if (!secret) return c.json({ loginToken, csrfToken: null });
+    return c.json({ loginToken, csrfToken: signCsrf(secret, loginToken) });
+  });
+
   // user-session under /.well-known/service — proxy to blocklet-service session API
   // Returns full session data including connectedAccounts (needed by @arcblock/ux SessionUser)
   app.get('/.well-known/service/api/user-session', async (c) => {
@@ -691,7 +732,6 @@ function buildApp(env: Env): Hono<HonoEnv> {
       startsWithZ: sk.startsWith('z'),
     });
   });
-
   // === DID Auth Login routes ===
   // Only proxy login-related /api/did/* paths to blocklet-service.
   // Other /api/did/* paths (subscription, pay, collect, etc.) are Payment Kit's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.7",
+  "version": "1.29.9",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -48,7 +48,7 @@
   "dependencies": {
     "@abtnode/cron": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/did": "^1.30.24",
-    "@arcblock/did-connect-js": "^4.0.7",
+    "@arcblock/did-connect-js": "^4.1.2",
     "@arcblock/did-connect-react": "^3.5.4",
     "@arcblock/did-connect-storage-nedb": "^1.8.0",
     "@arcblock/did-util": "^1.30.24",
@@ -60,13 +60,13 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.7",
-    "@blocklet/payment-react": "1.29.7",
-    "@blocklet/payment-vendor": "1.29.7",
+    "@blocklet/payment-broker-client": "1.29.9",
+    "@blocklet/payment-react": "1.29.9",
+    "@blocklet/payment-vendor": "1.29.9",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
-    "@blocklet/uploader": "^0.3.20",
-    "@blocklet/xss": "^0.3.16",
+    "@blocklet/uploader": "^0.15.4",
+    "@blocklet/xss": "^0.15.4",
     "@hono/node-server": "2.0.4",
     "@mui/icons-material": "^7.1.2",
     "@mui/lab": "7.0.0-beta.14",
@@ -133,7 +133,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.7",
+    "@blocklet/payment-types": "1.29.9",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -180,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "e1999aecfa9ce64bfd56da14bf47b255a19ef394"
+  "gitHead": "249bd9bf3c6cc54f77c260edb4b4d3c0be60f126"
 }

package/src/components/layout/user.tsx

@@ -34,7 +34,13 @@ export default function UserLayout(props: any) {
     return (
       <PaymentProvider session={session} connect={connectApi}>
         <UserCenter
-          currentTab={`${window.blocklet.prefix}customer`}
+          // Must match the userCenter nav link declared in blocklet.yml (`link: /customer`).
+          // UserCenter resolves both this prop and the nav link via `new URL(x, origin).pathname`,
+          // which strips any mount prefix — so the nav tab always resolves to the bare `/customer`.
+          // Prefixing here (e.g. `${prefix}customer`) makes the active tab fail to match, which
+          // triggers UserCenter's auto-redirect to the bare nav link and 404s the embedded mount
+          // (#1394). The bare path also works in the non-embedded form, where prefix is `/`.
+          currentTab="/customer"
           hideFooter
           embed={embed === '1'}
           notLoginContent="undefined">

package/vite.arc.config.ts

@@ -29,6 +29,25 @@ export default defineConfig({
   root: coreDir,
   base: `${UI_PREFIX}/`,
   plugins: [
+    // Inject the Buffer polyfill at the top of the entry — the did-connect
+    // SessionProvider.refresh path serializes request bodies with Buffer, which is
+    // undefined in the browser, so without this the arc-embedded payment SPA throws
+    // "ReferenceError: Buffer is not defined" on session refresh and never renders.
+    // The standalone cloudflare/vite.config.ts already does this (cf-buffer-polyfill);
+    // the arc build was missing it. Reuses the same shim.
+    {
+      name: 'arc-buffer-polyfill',
+      enforce: 'pre' as const,
+      transform(code: string, id: string) {
+        if (id.endsWith('/src/index.tsx')) {
+          const shim = path
+            .resolve(coreDir, 'cloudflare/frontend-shims/buffer-polyfill.ts')
+            .replace(/\\/g, '/');
+          return `import '${shim}';\n` + code;
+        }
+        return undefined;
+      },
+    },
     tsconfigPaths({ root: coreDir }),
     react(),
     // Build-time window.blocklet bootstrap (P2 helper, single source). The