@akinon/next 2.0.102-beta.0 → 2.0.102

package/CHANGELOG.md

@@ -1,10 +1,12 @@
 # @akinon/next
 
-## 2.0.102-beta.0
+## 2.0.102
 
 ### Patch Changes
 
-- cbbbfd757: ZERO-4376: Bootstrap beta cycle (next-main pre-release motor)
+- 52a5928: ZERO-5041: Keep the anonymous session on login so the guest basket merges
+
+  The login flow cleared the anonymous osessionid whenever getCurrentUser returned no pk, but the commerce currentUser endpoint returns 401 for a valid anonymous session too, so every guest's session (and its basket) was discarded before the login request reached the backend. Forward the anonymous session instead, and recover from a genuinely stale cookie by retrying the login once without it (ZERO-4247), scoped to password login and skipping OTP challenges (ZERO-4550) and throttled responses.
 
 ## 2.0.101
 

package/api/auth.ts

@@ -203,60 +203,73 @@ const getDefaultAuthConfig = () => {
               if (sessionCookie) {
                 reqHeaders.set('cookie', sessionCookie);
               }
-            } else if (credentials.formType === 'login') {
-              // Stale session cookie — only clear it before a fresh password
-              // login (ZERO-4247). Register and OTP flows are still anonymous at
-              // this point (no pk yet), but their session carries the pending OTP
-              // challenge; clearing it here makes the backend lose the challenge
-              // and re-issue the code on every verify (ZERO-4550).
-              // remove from headers and clear in browser
-              const currentCookies = reqHeaders.get('cookie') || '';
-              const cleanedCookies = currentCookies
-                .split(';')
-                .filter((c) => !c.trim().startsWith('osessionid='))
-                .join(';')
-                .trim();
-              reqHeaders.set('cookie', cleanedCookies);
-
-              const { localeUrlStrategy } = Settings.localization;
-              const fallbackHost =
-                headerStore.get('x-forwarded-host') ||
-                headerStore.get('host');
-              const hostname =
-                process.env.NEXT_PUBLIC_URL || `https://${fallbackHost}`;
-              const rootHostname =
-                localeUrlStrategy === LocaleUrlStrategy.Subdomain
-                  ? getRootHostname(hostname)
-                  : null;
-              const expireOptions = {
-                path: '/',
-                maxAge: 0,
-                ...(rootHostname ? { domain: rootHostname } : {})
-              };
-              cookieStore.set('osessionid', '', expireOptions);
-              cookieStore.set('sessionid', '', expireOptions);
             }
+            // A guest's anonymous session (no pk yet) is deliberately NOT
+            // stripped here. It must be forwarded on the login request so the
+            // backend can merge the guest basket into the account on sign-in
+            // (ZERO-5041). getCurrentUser cannot tell a valid anonymous session
+            // apart from a truly stale one — the commerce currentUser endpoint
+            // returns 401 for both — so pre-emptively clearing on "no pk" also
+            // discarded every legitimate guest session. The ZERO-4247
+            // stale-cookie recovery is handled below instead, as a one-time
+            // retry without the session cookie after a login actually fails.
           }
 
-          const apiRequest = await fetch(
-            `${Settings.commerceUrl}${user[credentials.formType]}`,
-            {
-              method: 'POST',
-              headers: reqHeaders,
-              body: JSON.stringify(credentials)
+          const performAuthRequest = async (headers: HeadersInit) => {
+            const request = await fetch(
+              `${Settings.commerceUrl}${user[credentials.formType]}`,
+              {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(credentials)
+              }
+            );
+
+            const body = (await request.json()) as {
+              key: string;
+              non_field_errors: string[];
+              redirect_url: string;
+            };
+
+            return { request, body };
+          };
+
+          let { request: apiRequest, body: response } =
+            await performAuthRequest(reqHeaders);
+
+          // ZERO-4247 recovery: the anonymous session was forwarded so the guest
+          // basket can merge (ZERO-5041). If a session cookie was present and the
+          // login still failed, the session may be genuinely stale, so retry once
+          // without it. Scoped to password login; OTP challenges (202,
+          // ZERO-4550) and throttled requests (429) are left untouched. On a
+          // successful retry the sessionId block below overwrites the browser
+          // cookies with the freshly issued session.
+          if (
+            !response.key &&
+            credentials.formType === 'login' &&
+            existingSessionId &&
+            apiRequest.status !== 202 &&
+            apiRequest.status !== 429
+          ) {
+            const retryHeaders = new Headers(reqHeaders);
+            const cleanedCookies = (retryHeaders.get('cookie') || '')
+              .split(';')
+              .filter((c) => !c.trim().startsWith('osessionid='))
+              .join(';')
+              .trim();
+            retryHeaders.set('cookie', cleanedCookies);
+
+            const retry = await performAuthRequest(retryHeaders);
+            if (retry.body.key) {
+              apiRequest = retry.request;
+              response = retry.body;
             }
-          );
+          }
 
           logger.info(`Login/Register request result: ${apiRequest.status}`, {
             userIp
           });
 
-          const response = (await apiRequest.json()) as {
-            key: string;
-            non_field_errors: string[];
-            redirect_url: string;
-          };
-
           logger.debug(`Login/Register response: ${JSON.stringify(response)}`);
 
           let sessionId = '';
@@ -496,60 +509,73 @@ const defaultNextAuthOptionsV4 = (req: any, res: any) => {
               if (sessionCookie) {
                 reqHeaders.set('cookie', sessionCookie);
               }
-            } else if (credentials.formType === 'login') {
-              // Stale session cookie — only clear it before a fresh password
-              // login (ZERO-4247). Register and OTP flows are still anonymous at
-              // this point (no pk yet), but their session carries the pending OTP
-              // challenge; clearing it here makes the backend lose the challenge
-              // and re-issue the code on every verify (ZERO-4550).
-              // remove from headers and clear in browser
-              const currentCookies = reqHeaders.get('cookie') || '';
-              const cleanedCookies = currentCookies
-                .split(';')
-                .filter((c) => !c.trim().startsWith('osessionid='))
-                .join(';')
-                .trim();
-              reqHeaders.set('cookie', cleanedCookies);
-
-              const { localeUrlStrategy } = Settings.localization;
-              const fallbackHost =
-                req.headers['x-forwarded-host']?.toString() ||
-                req.headers.host?.toString();
-              const hostname =
-                process.env.NEXT_PUBLIC_URL || `https://${fallbackHost}`;
-              const rootHostname =
-                localeUrlStrategy === LocaleUrlStrategy.Subdomain
-                  ? getRootHostname(hostname)
-                  : null;
-              const domainOption = rootHostname
-                ? ` Domain=${rootHostname};`
-                : '';
-              res.setHeader('Set-Cookie', [
-                `osessionid=; Path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT;${domainOption}`,
-                `sessionid=; Path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT;${domainOption}`
-              ]);
             }
+            // A guest's anonymous session (no pk yet) is deliberately NOT
+            // stripped here. It must be forwarded on the login request so the
+            // backend can merge the guest basket into the account on sign-in
+            // (ZERO-5041). getCurrentUser cannot tell a valid anonymous session
+            // apart from a truly stale one — the commerce currentUser endpoint
+            // returns 401 for both — so pre-emptively clearing on "no pk" also
+            // discarded every legitimate guest session. The ZERO-4247
+            // stale-cookie recovery is handled below instead, as a one-time
+            // retry without the session cookie after a login actually fails.
           }
 
-          const apiRequest = await fetch(
-            `${Settings.commerceUrl}${user[credentials.formType]}`,
-            {
-              method: 'POST',
-              headers: reqHeaders,
-              body: JSON.stringify(credentials)
+          const performAuthRequest = async (headers: HeadersInit) => {
+            const request = await fetch(
+              `${Settings.commerceUrl}${user[credentials.formType]}`,
+              {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(credentials)
+              }
+            );
+
+            const body = (await request.json()) as {
+              key: string;
+              non_field_errors: string[];
+              redirect_url: string;
+            };
+
+            return { request, body };
+          };
+
+          let { request: apiRequest, body: response } =
+            await performAuthRequest(reqHeaders);
+
+          // ZERO-4247 recovery: the anonymous session was forwarded so the guest
+          // basket can merge (ZERO-5041). If a session cookie was present and the
+          // login still failed, the session may be genuinely stale, so retry once
+          // without it. Scoped to password login; OTP challenges (202,
+          // ZERO-4550) and throttled requests (429) are left untouched. On a
+          // successful retry the sessionId block below overwrites the browser
+          // cookies with the freshly issued session.
+          if (
+            !response.key &&
+            credentials.formType === 'login' &&
+            req.cookies['osessionid'] &&
+            apiRequest.status !== 202 &&
+            apiRequest.status !== 429
+          ) {
+            const retryHeaders = new Headers(reqHeaders);
+            const cleanedCookies = (retryHeaders.get('cookie') || '')
+              .split(';')
+              .filter((c) => !c.trim().startsWith('osessionid='))
+              .join(';')
+              .trim();
+            retryHeaders.set('cookie', cleanedCookies);
+
+            const retry = await performAuthRequest(retryHeaders);
+            if (retry.body.key) {
+              apiRequest = retry.request;
+              response = retry.body;
             }
-          );
+          }
 
           logger.info(`Login/Register request result: ${apiRequest.status}`, {
             userIp
           });
 
-          const response = (await apiRequest.json()) as {
-            key: string;
-            non_field_errors: string[];
-            redirect_url: string;
-          };
-
           logger.debug(`Login/Register response: ${JSON.stringify(response)}`);
 
           let sessionId = '';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@akinon/next",
   "description": "Core package for Project Zero Next",
-  "version": "2.0.102-beta.0",
+  "version": "2.0.102",
   "private": false,
   "license": "MIT",
   "bin": {
@@ -36,7 +36,7 @@
     "set-cookie-parser": "2.6.0"
   },
   "devDependencies": {
-    "@akinon/eslint-plugin-projectzero": "2.0.102-beta.0",
+    "@akinon/eslint-plugin-projectzero": "2.0.102",
     "@babel/core": "7.26.10",
     "@babel/preset-env": "7.26.9",
     "@babel/preset-typescript": "7.27.0",