@akinon/next 2.0.102-rc.0 → 2.0.103-beta.0

package/CHANGELOG.md

@@ -1,36 +1,18 @@
 # @akinon/next
 
-## 2.0.102-rc.0
+## 2.0.103-beta.0
 
 ### Patch Changes
 
-- 86187b1c: ZERO-4879: Repair sync-merge corruption in default middleware and server data loaders — remove a duplicated block that left an unbalanced brace, and restore the awaited `result` binding the payload optimization reads
-- 0cf9ea239: BRDG-16491: Prevent redirect when iframe payment is active
-- 324f97d55: ZERO-4219: replace masterpass-rest-complete with masterpass-rest-callback
-- 51ea06888: ZERO-4377: Fix checkout card type state being cleared after valid bin number responses.
-- ZERO-4160: Enhance oauth-login middleware with improved request handling and logging
-- 2fea41430: ZERO-4620: Add runtime access to `NEXT_PUBLIC_*` environment variables from Client Components
-- b55acb768: ZERO-2577: Fix pagination bug and update usePagination hook and ensure pagination controls rendering correctly
-- 760258c1c: ZERO-4160: Enhance oauth-login middleware to handle fetch errors and improve response handling
-- 143be2b9d: ZERO-3457: Crop styles are customizable and logic improved for rendering similar products modal
-- 7889b08fe: ZERO-4276: Enhance route generation by adding .env loading and custom skip segments support
-- 9f8cd3bc5: ZERO-3449: AI Search Active Filters & Crop Style changes have been implemented
-- bfafa3f49: ZERO-4160: Refactor oauth-login middleware to use fetchCommerce for API calls and improve cookie handling
-- 57d7eb305: ZERO-4276: Refactor route generation logic by removing environment loading and simplifying skip segments handling
-- d99a6a7d5: ZERO-3457_1: Fixed the settings prop and made sure everything is customizable.
-- 9db81a714: ZERO-4365: Remove brand `@theme/*` alias imports from library packages
-- 591e345e1: ZERO-3855: Enhance credit card payment handling in checkout middlewares
-- 4de5303c5: ZERO-2504: add cookie filter to api client request
-- 95b139dc1: ZERO-3795: Remove duplicate entry for SavedCard in PluginComponents map
-- 1d00f2d06: BRDG-16664: Set secure flag for CSRF token cookies in useCaptcha and default middleware
-- 4ac7b2a1e: ZERO-4219: fix masterpass-rest callback route format and double-encoded error cookie
-- e9598c71d: ZERO-4622: Images remotePatterns for improved readability
-- 4998a9631: ZERO-4168: Add server-side payload optimization
-- 804d2bd6c: ZERO-4536: Add akinon.net domain to CSP frame-ancestors directive
-- 3909d3224: Edit the duplicate Plugin.SimilarProducts in the plugin-module.
-- 6a3d8a631: ZERO-4541: Fix URL query string formatting in getOrders and getOldOrders functions
-- e18836b20: ZERO-4160: Restore scope in Sentry addon configuration in akinon.json
-- b1111d7b: ZERO-4841: Guard `withPrettyUrl` against calling `String.prototype.replace` with an `undefined` locale prefix on projects without a URL locale prefix (e.g. `HideDefaultLocale`) — previously this coerced to the literal string `"undefined"` and silently stripped a trailing `/undefined` segment from the path before the pretty-url lookup, causing bogus URLs like `/{product-slug}/undefined` to resolve and rewrite to the real product page (200) instead of 404
+- cbbbfd757: ZERO-4376: Bootstrap beta cycle (next-main pre-release motor)
+
+## 2.0.102
+
+### Patch Changes
+
+- 52a5928: ZERO-5041: Keep the anonymous session on login so the guest basket merges
+
+  The login flow cleared the anonymous osessionid whenever getCurrentUser returned no pk, but the commerce currentUser endpoint returns 401 for a valid anonymous session too, so every guest's session (and its basket) was discarded before the login request reached the backend. Forward the anonymous session instead, and recover from a genuinely stale cookie by retrying the login once without it (ZERO-4247), scoped to password login and skipping OTP challenges (ZERO-4550) and throttled responses.
 
 ## 2.0.101
 

package/api/auth.ts

@@ -203,60 +203,73 @@ const getDefaultAuthConfig = () => {
               if (sessionCookie) {
                 reqHeaders.set('cookie', sessionCookie);
               }
-            } else if (credentials.formType === 'login') {
-              // Stale session cookie — only clear it before a fresh password
-              // login (ZERO-4247). Register and OTP flows are still anonymous at
-              // this point (no pk yet), but their session carries the pending OTP
-              // challenge; clearing it here makes the backend lose the challenge
-              // and re-issue the code on every verify (ZERO-4550).
-              // remove from headers and clear in browser
-              const currentCookies = reqHeaders.get('cookie') || '';
-              const cleanedCookies = currentCookies
-                .split(';')
-                .filter((c) => !c.trim().startsWith('osessionid='))
-                .join(';')
-                .trim();
-              reqHeaders.set('cookie', cleanedCookies);
-
-              const { localeUrlStrategy } = Settings.localization;
-              const fallbackHost =
-                headerStore.get('x-forwarded-host') ||
-                headerStore.get('host');
-              const hostname =
-                process.env.NEXT_PUBLIC_URL || `https://${fallbackHost}`;
-              const rootHostname =
-                localeUrlStrategy === LocaleUrlStrategy.Subdomain
-                  ? getRootHostname(hostname)
-                  : null;
-              const expireOptions = {
-                path: '/',
-                maxAge: 0,
-                ...(rootHostname ? { domain: rootHostname } : {})
-              };
-              cookieStore.set('osessionid', '', expireOptions);
-              cookieStore.set('sessionid', '', expireOptions);
             }
+            // A guest's anonymous session (no pk yet) is deliberately NOT
+            // stripped here. It must be forwarded on the login request so the
+            // backend can merge the guest basket into the account on sign-in
+            // (ZERO-5041). getCurrentUser cannot tell a valid anonymous session
+            // apart from a truly stale one — the commerce currentUser endpoint
+            // returns 401 for both — so pre-emptively clearing on "no pk" also
+            // discarded every legitimate guest session. The ZERO-4247
+            // stale-cookie recovery is handled below instead, as a one-time
+            // retry without the session cookie after a login actually fails.
           }
 
-          const apiRequest = await fetch(
-            `${Settings.commerceUrl}${user[credentials.formType]}`,
-            {
-              method: 'POST',
-              headers: reqHeaders,
-              body: JSON.stringify(credentials)
+          const performAuthRequest = async (headers: HeadersInit) => {
+            const request = await fetch(
+              `${Settings.commerceUrl}${user[credentials.formType]}`,
+              {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(credentials)
+              }
+            );
+
+            const body = (await request.json()) as {
+              key: string;
+              non_field_errors: string[];
+              redirect_url: string;
+            };
+
+            return { request, body };
+          };
+
+          let { request: apiRequest, body: response } =
+            await performAuthRequest(reqHeaders);
+
+          // ZERO-4247 recovery: the anonymous session was forwarded so the guest
+          // basket can merge (ZERO-5041). If a session cookie was present and the
+          // login still failed, the session may be genuinely stale, so retry once
+          // without it. Scoped to password login; OTP challenges (202,
+          // ZERO-4550) and throttled requests (429) are left untouched. On a
+          // successful retry the sessionId block below overwrites the browser
+          // cookies with the freshly issued session.
+          if (
+            !response.key &&
+            credentials.formType === 'login' &&
+            existingSessionId &&
+            apiRequest.status !== 202 &&
+            apiRequest.status !== 429
+          ) {
+            const retryHeaders = new Headers(reqHeaders);
+            const cleanedCookies = (retryHeaders.get('cookie') || '')
+              .split(';')
+              .filter((c) => !c.trim().startsWith('osessionid='))
+              .join(';')
+              .trim();
+            retryHeaders.set('cookie', cleanedCookies);
+
+            const retry = await performAuthRequest(retryHeaders);
+            if (retry.body.key) {
+              apiRequest = retry.request;
+              response = retry.body;
             }
-          );
+          }
 
           logger.info(`Login/Register request result: ${apiRequest.status}`, {
             userIp
           });
 
-          const response = (await apiRequest.json()) as {
-            key: string;
-            non_field_errors: string[];
-            redirect_url: string;
-          };
-
           logger.debug(`Login/Register response: ${JSON.stringify(response)}`);
 
           let sessionId = '';
@@ -496,60 +509,73 @@ const defaultNextAuthOptionsV4 = (req: any, res: any) => {
               if (sessionCookie) {
                 reqHeaders.set('cookie', sessionCookie);
               }
-            } else if (credentials.formType === 'login') {
-              // Stale session cookie — only clear it before a fresh password
-              // login (ZERO-4247). Register and OTP flows are still anonymous at
-              // this point (no pk yet), but their session carries the pending OTP
-              // challenge; clearing it here makes the backend lose the challenge
-              // and re-issue the code on every verify (ZERO-4550).
-              // remove from headers and clear in browser
-              const currentCookies = reqHeaders.get('cookie') || '';
-              const cleanedCookies = currentCookies
-                .split(';')
-                .filter((c) => !c.trim().startsWith('osessionid='))
-                .join(';')
-                .trim();
-              reqHeaders.set('cookie', cleanedCookies);
-
-              const { localeUrlStrategy } = Settings.localization;
-              const fallbackHost =
-                req.headers['x-forwarded-host']?.toString() ||
-                req.headers.host?.toString();
-              const hostname =
-                process.env.NEXT_PUBLIC_URL || `https://${fallbackHost}`;
-              const rootHostname =
-                localeUrlStrategy === LocaleUrlStrategy.Subdomain
-                  ? getRootHostname(hostname)
-                  : null;
-              const domainOption = rootHostname
-                ? ` Domain=${rootHostname};`
-                : '';
-              res.setHeader('Set-Cookie', [
-                `osessionid=; Path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT;${domainOption}`,
-                `sessionid=; Path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT;${domainOption}`
-              ]);
             }
+            // A guest's anonymous session (no pk yet) is deliberately NOT
+            // stripped here. It must be forwarded on the login request so the
+            // backend can merge the guest basket into the account on sign-in
+            // (ZERO-5041). getCurrentUser cannot tell a valid anonymous session
+            // apart from a truly stale one — the commerce currentUser endpoint
+            // returns 401 for both — so pre-emptively clearing on "no pk" also
+            // discarded every legitimate guest session. The ZERO-4247
+            // stale-cookie recovery is handled below instead, as a one-time
+            // retry without the session cookie after a login actually fails.
           }
 
-          const apiRequest = await fetch(
-            `${Settings.commerceUrl}${user[credentials.formType]}`,
-            {
-              method: 'POST',
-              headers: reqHeaders,
-              body: JSON.stringify(credentials)
+          const performAuthRequest = async (headers: HeadersInit) => {
+            const request = await fetch(
+              `${Settings.commerceUrl}${user[credentials.formType]}`,
+              {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(credentials)
+              }
+            );
+
+            const body = (await request.json()) as {
+              key: string;
+              non_field_errors: string[];
+              redirect_url: string;
+            };
+
+            return { request, body };
+          };
+
+          let { request: apiRequest, body: response } =
+            await performAuthRequest(reqHeaders);
+
+          // ZERO-4247 recovery: the anonymous session was forwarded so the guest
+          // basket can merge (ZERO-5041). If a session cookie was present and the
+          // login still failed, the session may be genuinely stale, so retry once
+          // without it. Scoped to password login; OTP challenges (202,
+          // ZERO-4550) and throttled requests (429) are left untouched. On a
+          // successful retry the sessionId block below overwrites the browser
+          // cookies with the freshly issued session.
+          if (
+            !response.key &&
+            credentials.formType === 'login' &&
+            req.cookies['osessionid'] &&
+            apiRequest.status !== 202 &&
+            apiRequest.status !== 429
+          ) {
+            const retryHeaders = new Headers(reqHeaders);
+            const cleanedCookies = (retryHeaders.get('cookie') || '')
+              .split(';')
+              .filter((c) => !c.trim().startsWith('osessionid='))
+              .join(';')
+              .trim();
+            retryHeaders.set('cookie', cleanedCookies);
+
+            const retry = await performAuthRequest(retryHeaders);
+            if (retry.body.key) {
+              apiRequest = retry.request;
+              response = retry.body;
             }
-          );
+          }
 
           logger.info(`Login/Register request result: ${apiRequest.status}`, {
             userIp
           });
 
-          const response = (await apiRequest.json()) as {
-            key: string;
-            non_field_errors: string[];
-            redirect_url: string;
-          };
-
           logger.debug(`Login/Register response: ${JSON.stringify(response)}`);
 
           let sessionId = '';

package/bin/pz-generate-routes.js

@@ -6,7 +6,6 @@ const findBaseDir = require('../utils/find-base-dir');
 
 const generateRoutes = () => {
   const baseDir = findBaseDir();
-
   const srcDir = path.join(baseDir, 'src');
   const appDir = path.join(srcDir, 'app');
 
@@ -35,10 +34,8 @@ const generateRoutes = () => {
     '[segment]',
     '[url]',
     '[theme]',
-    '[member_type]',
-    '[clienttype]'
+    '[member_type]'
   ];
-
   const skipCatchAllRoutes = ['[...prettyurl]', '[...not_found]'];
 
   const walkDirectory = (dir, basePath = '') => {

package/components/plugin-module.tsx

@@ -116,6 +116,7 @@ const PluginComponents = new Map([
     ]
   ],
   [Plugin.SavedCard, [Component.SavedCard, Component.IyzicoSavedCard]],
+  [Plugin.SavedCard, [Component.SavedCard]],
   [Plugin.FlowPayment, [Component.FlowPayment]],
   [
     Plugin.VirtualTryOn,

package/data/client/checkout.ts

@@ -718,6 +718,7 @@ export const checkoutApi = api.injectEndpoints({
       },
       async onQueryStarted(arg, { dispatch, queryFulfilled }) {
         dispatch(setPaymentStepBusy(true));
+        dispatch(setCardType(arg));
         await queryFulfilled;
         dispatch(setPaymentStepBusy(false));
       }

package/data/client/wishlist.ts

@@ -26,19 +26,6 @@ interface GetFavoritesResponse {
   results: FavoriteItem[];
 }
 
-export interface FavouriteProductIdItem {
-  product_id: number;
-  favourite_id: number;
-}
-
-export interface GetFavouriteProductIdsResponse {
-  favourite_products: FavouriteProductIdItem[];
-}
-
-interface GetFavouriteProductIdsParams {
-  productIds: Array<number | string>;
-}
-
 interface AddFavoriteResponse {
   pk: number;
   product: number;
@@ -96,14 +83,6 @@ export const wishlistApi = api.injectEndpoints({
         buildClientRequestUrl(wishlist.getFavorites({ page, limit })),
       providesTags: ['Favorite']
     }),
-    getFavouriteProductIds: build.query<
-      GetFavouriteProductIdsResponse,
-      GetFavouriteProductIdsParams
-    >({
-      query: ({ productIds }) =>
-        buildClientRequestUrl(wishlist.getFavouriteProductIds(productIds)),
-      providesTags: ['Favorite']
-    }),
     addFavorite: build.mutation<AddFavoriteResponse, number>({
       query: (productPk: number) => ({
         url: buildClientRequestUrl(wishlist.addFavorite, {
@@ -217,7 +196,6 @@ export const wishlistApi = api.injectEndpoints({
 
 export const {
   useGetFavoritesQuery,
-  useGetFavouriteProductIdsQuery,
   useAddFavoriteMutation,
   useRemoveFavoriteMutation,
   useAddStockAlertMutation,

package/data/server/category.ts

@@ -8,8 +8,6 @@ import { parse } from 'lossless-json';
 import logger from '../../utils/log';
 import { headers as nHeaders } from 'next/headers';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeCategoryResponse } from '../../utils/payload-optimizer';
-import settings from 'settings';
 
 function getCategoryDataHandler(
   pk: number,
@@ -83,7 +81,7 @@ function getCategoryDataHandler(
   };
 }
 
-export const getCategoryData = async ({
+export const getCategoryData = ({
   pk,
   searchParams,
   headers,
@@ -98,7 +96,7 @@ export const getCategoryData = async ({
 }) => {
   searchParams = normalizeSearchParams(searchParams);
 
-  const result = await Cache.wrap(
+  return Cache.wrap(
     CacheKey.Category(pk, searchParams, headers),
     locale,
     getCategoryDataHandler(pk, locale, currency, searchParams, headers),
@@ -107,16 +105,6 @@ export const getCategoryData = async ({
       compressed: true
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result?.data) {
-    try {
-      return { ...result, data: optimizeCategoryResponse(result.data, settings.payloadOptimization) };
-    } catch (e) {
-      logger.error('Payload optimization failed for category', { pk, error: (e as Error).message });
-    }
-  }
-
-  return result;
 };
 
 function getCategoryBySlugDataHandler(

package/data/server/list.ts

@@ -7,8 +7,6 @@ import appFetch, { FetchResponseType } from '../../utils/app-fetch';
 import { parse } from 'lossless-json';
 import logger from '../../utils/log';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeCategoryResponse } from '../../utils/payload-optimizer';
-import settings from 'settings';
 
 const getListDataHandler = (
   locale,
@@ -71,7 +69,7 @@ export const getListData = async ({
 }) => {
   searchParams = normalizeSearchParams(searchParams);
 
-  const result = await Cache.wrap(
+  return Cache.wrap(
     CacheKey.List(searchParams, headers),
     locale,
     getListDataHandler(locale, currency, searchParams, headers),
@@ -80,14 +78,4 @@ export const getListData = async ({
       compressed: true
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result) {
-    try {
-      return optimizeCategoryResponse(result, settings.payloadOptimization);
-    } catch (e) {
-      logger.error('Payload optimization failed for list', { error: (e as Error).message });
-    }
-  }
-
-  return result;
 };

package/data/server/product.ts

@@ -5,8 +5,6 @@ import appFetch from '../../utils/app-fetch';
 import { normalizeSearchParams } from '../../utils/normalize-search-params';
 import { ServerVariables } from '../../utils/server-variables';
 import logger from '../../utils/log';
-import { optimizeProductResponse } from '../../utils/payload-optimizer';
-import settings from 'settings';
 
 type GetProduct = {
   pk: number | string;
@@ -168,13 +166,5 @@ export const getProductData = async ({
     throw error;
   }
 
-  if (settings.payloadOptimization?.enabled && result?.data) {
-    try {
-      return { ...result, data: optimizeProductResponse(result.data, settings.payloadOptimization) };
-    } catch (e) {
-      logger.error('Payload optimization failed for product', { pk, error: (e as Error).message });
-    }
-  }
-
   return result;
 };

package/data/server/special-page.ts

@@ -5,9 +5,6 @@ import { generateCommerceSearchParams } from '../../utils';
 import { normalizeSearchParams } from '../../utils/normalize-search-params';
 import appFetch from '../../utils/app-fetch';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeCategoryResponse } from '../../utils/payload-optimizer';
-import logger from '../../utils/log';
-import settings from 'settings';
 
 const getSpecialPageDataHandler = (
   pk: number,
@@ -51,7 +48,7 @@ export const getSpecialPageData = async ({
 }) => {
   searchParams = normalizeSearchParams(searchParams);
 
-  const result = await Cache.wrap(
+  return Cache.wrap(
     CacheKey.SpecialPage(pk, searchParams, headers),
     locale,
     getSpecialPageDataHandler(pk, locale, currency, searchParams, headers),
@@ -60,14 +57,4 @@ export const getSpecialPageData = async ({
       compressed: true
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result) {
-    try {
-      return optimizeCategoryResponse(result, settings.payloadOptimization);
-    } catch (e) {
-      logger.error('Payload optimization failed for special-page', { pk, error: (e as Error).message });
-    }
-  }
-
-  return result;
 };

package/data/server/widget.ts

@@ -286,16 +286,6 @@ export const getWidgetData = async <T>({
       ...cacheOptions
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result) {
-    try {
-      return optimizeWidgetResponse(result, settings.payloadOptimization) as WidgetResultType<T>;
-    } catch (e) {
-      logger.error('Payload optimization failed for widget', { slug, error: (e as Error).message });
-    }
-  }
-
-  return result as WidgetResultType<T>;
 };
 
 const getCollectionWidgetDataHandler =

package/data/urls.ts

@@ -40,11 +40,10 @@ export const account = {
       shipping_option_slug
         ? `&shipping_option_slug${shipping_option_operator}${shipping_option_slug}`
         : ''
-    }${currency ? `&currency=${currency}` : ''}${
-      filterType && filterValue ? `&${filterType}=${filterValue}` : ''
-    }`,
+    }${currency ? `&currency=${currency}` : ''}
+    ${filterType && filterValue ? `&${filterType}=${filterValue}` : ''}`,
   getOldOrders: ({ page, limit }: { page?: number; limit?: number }) =>
-    `/users/old-orders/?page=${page || 1}&limit=${limit || 12}`,
+    `/users/old-orders/?page=${page || 1}&limit=${limit || 12}}`,
   getQuotations: (page?: number, status?: string, limit?: number) =>
     `/b2b/my-quotations/?page=${page || 1}` +
     (status ? `&status=${status}` : '') +
@@ -184,20 +183,12 @@ export const product = {
   breadcrumbUrl: (menuitemmodel: string) =>
     `/menus/generate_breadcrumb/?item=${menuitemmodel}&generator_name=menu_item`,
   bundleProduct: (productPk: string, queryString: string) =>
-    `/bundle-product/${productPk}/?${queryString}`,
-  similarProducts: (params?: string) =>
-    `/similar-products${params ? `?${params}` : ''}`,
-  similarProductsList: (params?: string) =>
-    `/similar-product-list${params ? `?${params}` : ''}`
+    `/bundle-product/${productPk}/?${queryString}`
 };
 
 export const wishlist = {
   getFavorites: ({ page, limit }: { page?: number; limit?: number }) =>
     `/wishlists/favourite-products/?limit=${limit || 12}&page=${page || 1}`,
-  getFavouriteProductIds: (productIds: Array<number | string>) =>
-    `/wishlists/favourite-product-ids/?${productIds
-      .map((id) => `product_id=${id}`)
-      .join('&')}`,
   addFavorite: '/wishlists/favourite-products/',
   removeFavorite: (favPk: number) => `/wishlists/favourite-products/${favPk}/`,
   addStockAlert: '/wishlists/product-alerts/',

package/hooks/index.ts

@@ -15,4 +15,3 @@ export * from './use-logger-context';
 export * from './use-sentry-uncaught-errors';
 export * from './use-pz-params';
 export * from './use-toast';
-export * from './use-client-env';

package/hooks/use-captcha.tsx

@@ -39,7 +39,7 @@ export const useCaptcha = () => {
   };
 
   if (csrfToken) {
-    setCookie('csrftoken', csrfToken, { secure: true });
+    setCookie('csrftoken', csrfToken);
   }
 
   const onCaptchaChange = useCallback(async (response) => {