uppp

Author: rafiqul4

prisma/dev.db

@@ -0,0 +1,19 @@
+-- CreateTable
+CREATE TABLE "store_domains" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "storeId" TEXT NOT NULL,
+    "domain" TEXT NOT NULL,
+    "isPrimary" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "store_domains_storeId_fkey" FOREIGN KEY ("storeId") REFERENCES "stores" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "store_domains_domain_key" ON "store_domains"("domain");
+
+-- CreateIndex
+CREATE INDEX "store_domains_storeId_idx" ON "store_domains"("storeId");
+
+-- CreateIndex
+CREATE INDEX "store_domains_domain_idx" ON "store_domains"("domain");

prisma/migrations/20251114090919_add_store_domain_model/migration.sql

@@ -285,6 +285,7 @@ model Store {
   webhooks        Webhook[]
   gdprRequests    GdprRequest[]
   consentRecords  ConsentRecord[]
+  domains         StoreDomain[]
 
   @@index([slug])
   @@index([subscriptionPlan])
@@ -295,6 +296,28 @@ model Store {
   @@map("stores")
 }
 
+// ============================================================================
+// STORE DOMAINS (Multi-tenancy)
+// ============================================================================
+
+model StoreDomain {
+  id        String   @id @default(cuid())
+  storeId   String
+  store     Store    @relation(fields: [storeId], references: [id], onDelete: Cascade)
+  
+  // Domain configuration
+  domain    String   @unique // e.g., "shop.example.com" or "example.com"
+  isPrimary Boolean  @default(false) // Canonical domain for redirects
+  
+  // Timestamps
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([storeId])
+  @@index([domain])
+  @@map("store_domains")
+}
+
 // ============================================================================
 // PRODUCTS & CATALOG
 // ============================================================================

prisma/schema.prisma

@@ -84,6 +84,53 @@ async function main() {
 
   console.log(`✓ Created stores: ${demoStore.name}, ${testStore.name}\n`);
 
+  // ============================================================================
+  // 2a. STORE DOMAINS
+  // ============================================================================
+  console.log('Creating store domains...');
+
+  await prisma.storeDomain.upsert({
+    where: { domain: 'demo.stormcom.io' },
+    update: {},
+    create: {
+      storeId: demoStore.id,
+      domain: 'demo.stormcom.io',
+      isPrimary: true,
+    },
+  });
+
+  await prisma.storeDomain.upsert({
+    where: { domain: 'demo-store.localhost' },
+    update: {},
+    create: {
+      storeId: demoStore.id,
+      domain: 'demo-store.localhost',
+      isPrimary: false,
+    },
+  });
+
+  await prisma.storeDomain.upsert({
+    where: { domain: 'test.stormcom.io' },
+    update: {},
+    create: {
+      storeId: testStore.id,
+      domain: 'test.stormcom.io',
+      isPrimary: true,
+    },
+  });
+
+  await prisma.storeDomain.upsert({
+    where: { domain: 'test-store.localhost' },
+    update: {},
+    create: {
+      storeId: testStore.id,
+      domain: 'test-store.localhost',
+      isPrimary: false,
+    },
+  });
+
+  console.log(`✓ Created store domains for: ${demoStore.name}, ${testStore.name}\n`);
+
   // ============================================================================
   // 3. STORE USERS
   // ============================================================================

prisma/seed.ts

@@ -147,19 +147,23 @@ const SECURITY_HEADERS = {
 /**
  * Apply security protections to the request
  * 
- * Handles multi-tenant context, rate limiting, CSRF protection, and security headers.
+ * Handles multi-tenant context preparation, rate limiting, CSRF protection, and security headers.
  * Exported for testing purposes.
  * 
+ * Note: Proxy runs in Edge runtime - cannot use Prisma or AsyncLocalStorage.
+ * Store resolution must happen in API routes/Server Components using resolveStore().
+ * 
  * @param request - NextRequest to protect
  * @returns NextResponse with security headers applied
  */
 export async function applySecurityProtections(request: NextRequest): Promise<NextResponse> {
   const { method, url } = request;
   const { pathname } = new URL(url);
 
-  // 0. Multi-tenant Context (removed in proxy):
-  // Do not attempt to access getServerSession or Prisma in proxy (Edge runtime).
-  // Tenant context is enforced within server routes and Prisma middleware.
+  // 0. Multi-tenant Context Preparation:
+  // Proxy sets X-Forwarded-Host header for API routes/Server Components to resolve storeId.
+  // Actual resolution happens in server context using resolveStore() from @/lib/store/resolve-store
+  // due to Edge runtime limitations (no Prisma, no AsyncLocalStorage).
 
   // 1. Rate Limiting: Check request limits
   const rateLimitResult = checkSimpleRateLimit(request);
@@ -191,6 +195,10 @@ export async function applySecurityProtections(request: NextRequest): Promise<Ne
   // 3. Security Headers: Apply to all responses
   const response = NextResponse.next();
 
+  // Set X-Forwarded-Host for store resolution in API routes
+  const host = request.headers.get('host') || '';
+  response.headers.set('x-forwarded-host', host);
+
   // Apply all security headers
   Object.entries(SECURITY_HEADERS).forEach(([key, value]) => {
     response.headers.set(key, value);
@@ -215,6 +223,12 @@ console.log('[PROXY] Module loaded');
 export default async function proxy(req: NextRequest) {
   const { pathname } = req.nextUrl;
 
+  // 0. Canonical Domain Redirect
+  // Note: Actual canonical redirect happens in storefront Server Components via
+  // checkCanonicalRedirect() from @/lib/store/canonical-redirect
+  // Proxy only sets x-forwarded-host header for server-side resolution
+  // (Edge runtime cannot access Prisma for StoreDomain lookup)
+
   // Import RBAC helpers lazily to keep edge bundle small
   const { canAccess, isPublicRoute, getDefaultRedirect } = await import('./src/lib/auth/permissions');