@akinon/next 2.0.41-rc.0 → 2.0.42-beta.0

package/CHANGELOG.md

@@ -1,34 +1,12 @@
 # @akinon/next
 
-## 2.0.41-rc.0
+## 2.0.42-beta.0
 
 ### Patch Changes
 
-- 0cf9ea23: BRDG-16491: Prevent redirect when iframe payment is active
-- 324f97d5: ZERO-4219: replace masterpass-rest-complete with masterpass-rest-callback
-- 51ea0688: ZERO-4377: Fix checkout card type state being cleared after valid bin number responses.
-- ZERO-4160: Enhance oauth-login middleware with improved request handling and logging
-- 2fea4143: ZERO-4620: Add runtime access to `NEXT_PUBLIC_*` environment variables from Client Components
-- b55acb768: ZERO-2577: Fix pagination bug and update usePagination hook and ensure pagination controls rendering correctly
-- 760258c1: ZERO-4160: Enhance oauth-login middleware to handle fetch errors and improve response handling
-- 143be2b9d: ZERO-3457: Crop styles are customizable and logic improved for rendering similar products modal
-- 7889b08f: ZERO-4276: Enhance route generation by adding .env loading and custom skip segments support
-- 9f8cd3bc5: ZERO-3449: AI Search Active Filters & Crop Style changes have been implemented
-- bfafa3f4: ZERO-4160: Refactor oauth-login middleware to use fetchCommerce for API calls and improve cookie handling
-- 57d7eb30: ZERO-4276: Refactor route generation logic by removing environment loading and simplifying skip segments handling
-- d99a6a7d5: ZERO-3457_1: Fixed the settings prop and made sure everything is customizable.
-- 9db81a71: ZERO-4365: Remove brand `@theme/*` alias imports from library packages
-- 591e345e1: ZERO-3855: Enhance credit card payment handling in checkout middlewares
-- 4de5303c5: ZERO-2504: add cookie filter to api client request
-- 95b139dc1: ZERO-3795: Remove duplicate entry for SavedCard in PluginComponents map
-- 1d00f2d0: BRDG-16664: Set secure flag for CSRF token cookies in useCaptcha and default middleware
-- 4ac7b2a1: ZERO-4219: fix masterpass-rest callback route format and double-encoded error cookie
-- e9598c71: ZERO-4622: Images remotePatterns for improved readability
-- 4998a963: ZERO-4168: Add server-side payload optimization
-- 804d2bd6: ZERO-4536: Add akinon.net domain to CSP frame-ancestors directive
-- 3909d3224: Edit the duplicate Plugin.SimilarProducts in the plugin-module.
-- 6a3d8a63: ZERO-4541: Fix URL query string formatting in getOrders and getOldOrders functions
-- e18836b2: ZERO-4160: Restore scope in Sentry addon configuration in akinon.json
+- cbbbfd75: ZERO-4376: Bootstrap beta cycle (next-main pre-release motor)
+
+## 2.0.41
 
 ## 2.0.40
 

package/api/auth.ts

@@ -10,6 +10,7 @@ import getRootHostname, {
   getRequestRootHostname
 } from '../utils/get-root-hostname';
 import { getCsrfCookieFlags } from '../utils/csrf';
+import { isEditorEmbedEnabled } from '../utils/editor-embed';
 import { LocaleUrlStrategy } from '../localization';
 import { cookies, headers } from 'next/headers';
 
@@ -88,8 +89,37 @@ function buildFieldErrors(response: any) {
 // v5 (App Router / next-auth v5) — named export for new brands
 // ============================================================
 
+/**
+ * Cookie attributes that let the shopper sign in while the storefront runs
+ * inside the theme editor's preview iframe. Auth.js defaults to
+ * SameSite=Lax, and in a cross-site iframe (editor origin vs storefront
+ * origin — or localhost vs 127.0.0.1 in local dev) the browser then drops
+ * the CSRF cookie, so every credentials POST fails with MissingCSRF before
+ * it reaches the provider. SameSite=None requires Secure; browsers accept
+ * Secure cookies from plain-http localhost, so local development is covered
+ * too. Scoped to editor-enabled deployments (and dev) — a storefront without
+ * the editor keeps the stricter Lax default.
+ */
+const getEmbedAwareCookies = () => {
+  if (!isEditorEmbedEnabled()) return undefined;
+
+  const options = {
+    sameSite: 'none' as const,
+    secure: true,
+    path: '/',
+    httpOnly: true
+  };
+
+  return {
+    sessionToken: { options },
+    callbackUrl: { options },
+    csrfToken: { options }
+  };
+};
+
 const getDefaultAuthConfig = () => {
   return {
+    cookies: getEmbedAwareCookies(),
     providers: [
       Credentials({
         id: 'oauth',
@@ -266,6 +296,11 @@ const getDefaultAuthConfig = () => {
               httpOnly: true,
               secure: true,
               maxAge,
+              // Without SameSite the browser defaults to Lax and drops the
+              // commerce session on every request from the theme editor's
+              // cross-site preview iframe — the shopper signs in and the
+              // next authenticated call 401s straight back to the login.
+              ...(isEditorEmbedEnabled() ? { sameSite: 'none' as const } : {}),
               ...(rootHostname ? { domain: rootHostname } : {})
             };
 

package/api/client.ts

@@ -10,6 +10,7 @@ import { LocaleUrlStrategy } from '../localization';
 import { fixtureManager, MockMode } from '../lib/fixture-manager';
 import { user } from '../data/urls';
 import { getCsrfCookieFlags, isCsrfHttpOnly } from '../utils/csrf';
+import { isEditorEmbedEnabled } from '../utils/editor-embed';
 
 const CSRF_TOKEN_SLUG = user.csrfToken.replace(/^\//, '');
 
@@ -168,7 +169,16 @@ async function proxyRequest(...args) {
   // browser can no longer mirror it into the `x-csrftoken` header, so the
   // proxy validates the request origin and injects the header server-side
   // from the cookie that the browser sent with this request.
-  if (isCsrfHttpOnly() && STATE_CHANGING_METHODS.includes(req.method)) {
+  //
+  // The origin check also runs whenever editor embedding is enabled: embed
+  // mode relaxes session cookies to SameSite=None, so the browser attaches
+  // them to cross-site requests and the Lax barrier this check replaces is
+  // gone. `isOriginAllowed` keeps accepting origin-less requests, so
+  // non-browser clients are unaffected.
+  if (
+    (isCsrfHttpOnly() || isEditorEmbedEnabled()) &&
+    STATE_CHANGING_METHODS.includes(req.method)
+  ) {
     if (!isOriginAllowed(req)) {
       logger.warn('Client Proxy Request - Blocked cross-origin request', {
         url: req.url,
@@ -180,9 +190,11 @@ async function proxyRequest(...args) {
       );
     }
 
-    const csrfToken = nextCookies.get('csrftoken')?.value;
-    if (csrfToken) {
-      fetchOptions.headers['x-csrftoken'] = csrfToken;
+    if (isCsrfHttpOnly()) {
+      const csrfToken = nextCookies.get('csrftoken')?.value;
+      if (csrfToken) {
+        fetchOptions.headers['x-csrftoken'] = csrfToken;
+      }
     }
   }
 
@@ -335,6 +347,16 @@ async function proxyRequest(...args) {
               cookie.sameSite = flags.sameSite;
             }
           }
+          // Commerce sends its session cookies without SameSite; forwarded
+          // as-is the browser defaults them to Lax and drops them inside
+          // the theme editor's cross-site preview iframe, killing the
+          // session right after login. Editor-enabled deployments relax
+          // every forwarded cookie the same way the auth cookies already
+          // are.
+          if (isEditorEmbedEnabled()) {
+            cookie.sameSite = 'none';
+            cookie.secure = true;
+          }
           return formatCookieString(cookie);
         })
         .join(', ');

package/bin/pz-generate-routes.js

@@ -6,7 +6,6 @@ const findBaseDir = require('../utils/find-base-dir');
 
 const generateRoutes = () => {
   const baseDir = findBaseDir();
-
   const srcDir = path.join(baseDir, 'src');
   const appDir = path.join(srcDir, 'app');
 
@@ -35,10 +34,8 @@ const generateRoutes = () => {
     '[segment]',
     '[url]',
     '[theme]',
-    '[member_type]',
-    '[clienttype]'
+    '[member_type]'
   ];
-
   const skipCatchAllRoutes = ['[...prettyurl]', '[...not_found]'];
 
   const walkDirectory = (dir, basePath = '') => {

package/components/plugin-module.tsx

@@ -116,6 +116,7 @@ const PluginComponents = new Map([
     ]
   ],
   [Plugin.SavedCard, [Component.SavedCard, Component.IyzicoSavedCard]],
+  [Plugin.SavedCard, [Component.SavedCard]],
   [Plugin.FlowPayment, [Component.FlowPayment]],
   [
     Plugin.VirtualTryOn,

package/data/client/checkout.ts

@@ -738,6 +738,7 @@ export const checkoutApi = api.injectEndpoints({
       },
       async onQueryStarted(arg, { dispatch, queryFulfilled }) {
         dispatch(setPaymentStepBusy(true));
+        dispatch(setCardType(arg));
         await queryFulfilled;
         dispatch(setPaymentStepBusy(false));
       }

package/data/server/category.ts

@@ -8,8 +8,6 @@ import { parse } from 'lossless-json';
 import logger from '../../utils/log';
 import { headers as nHeaders } from 'next/headers';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeCategoryResponse } from '../../utils/payload-optimizer';
-import settings from 'settings';
 
 function getCategoryDataHandler(
   pk: number,
@@ -83,7 +81,7 @@ function getCategoryDataHandler(
   };
 }
 
-export const getCategoryData = async ({
+export const getCategoryData = ({
   pk,
   searchParams,
   headers,
@@ -107,16 +105,6 @@ export const getCategoryData = async ({
       compressed: true
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result?.data) {
-    try {
-      return { ...result, data: optimizeCategoryResponse(result.data, settings.payloadOptimization) };
-    } catch (e) {
-      logger.error('Payload optimization failed for category', { pk, error: (e as Error).message });
-    }
-  }
-
-  return result;
 };
 
 function getCategoryBySlugDataHandler(

package/data/server/list.ts

@@ -7,8 +7,6 @@ import appFetch, { FetchResponseType } from '../../utils/app-fetch';
 import { parse } from 'lossless-json';
 import logger from '../../utils/log';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeCategoryResponse } from '../../utils/payload-optimizer';
-import settings from 'settings';
 
 const getListDataHandler = (
   locale,
@@ -80,14 +78,4 @@ export const getListData = async ({
       compressed: true
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result) {
-    try {
-      return optimizeCategoryResponse(result, settings.payloadOptimization);
-    } catch (e) {
-      logger.error('Payload optimization failed for list', { error: (e as Error).message });
-    }
-  }
-
-  return result;
 };

package/data/server/product.ts

@@ -5,8 +5,6 @@ import appFetch from '../../utils/app-fetch';
 import { normalizeSearchParams } from '../../utils/normalize-search-params';
 import { ServerVariables } from '../../utils/server-variables';
 import logger from '../../utils/log';
-import { optimizeProductResponse } from '../../utils/payload-optimizer';
-import settings from 'settings';
 
 type GetProduct = {
   pk: number | string;
@@ -168,13 +166,5 @@ export const getProductData = async ({
     throw error;
   }
 
-  if (settings.payloadOptimization?.enabled && result?.data) {
-    try {
-      return { ...result, data: optimizeProductResponse(result.data, settings.payloadOptimization) };
-    } catch (e) {
-      logger.error('Payload optimization failed for product', { pk, error: (e as Error).message });
-    }
-  }
-
   return result;
 };

package/data/server/special-page.ts

@@ -5,9 +5,6 @@ import { generateCommerceSearchParams } from '../../utils';
 import { normalizeSearchParams } from '../../utils/normalize-search-params';
 import appFetch from '../../utils/app-fetch';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeCategoryResponse } from '../../utils/payload-optimizer';
-import logger from '../../utils/log';
-import settings from 'settings';
 
 const getSpecialPageDataHandler = (
   pk: number,
@@ -60,14 +57,4 @@ export const getSpecialPageData = async ({
       compressed: true
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result) {
-    try {
-      return optimizeCategoryResponse(result, settings.payloadOptimization);
-    } catch (e) {
-      logger.error('Payload optimization failed for special-page', { pk, error: (e as Error).message });
-    }
-  }
-
-  return result;
 };

package/data/server/widget.ts

@@ -4,9 +4,6 @@ import { CacheOptions, WidgetResultType, WidgetSchemaType } from '../../types';
 import appFetch from '../../utils/app-fetch';
 import { widgets } from '../urls';
 import { ServerVariables } from '../../utils/server-variables';
-import { optimizeWidgetResponse } from '../../utils/payload-optimizer';
-import logger from '../../utils/log';
-import settings from 'settings';
 
 const getWidgetDataHandler =
   (
@@ -56,7 +53,7 @@ export const getWidgetData = async <T>({
   cacheOptions?: CacheOptions;
   headers?: Record<string, string>;
 }): Promise<WidgetResultType<T>> => {
-  const result = await Cache.wrap(
+  return Cache.wrap(
     CacheKey.Widget(slug),
     locale,
     getWidgetDataHandler(slug, locale, currency, headers),
@@ -65,16 +62,6 @@ export const getWidgetData = async <T>({
       ...cacheOptions
     }
   );
-
-  if (settings.payloadOptimization?.enabled && result) {
-    try {
-      return optimizeWidgetResponse(result, settings.payloadOptimization) as WidgetResultType<T>;
-    } catch (e) {
-      logger.error('Payload optimization failed for widget', { slug, error: (e as Error).message });
-    }
-  }
-
-  return result as WidgetResultType<T>;
 };
 
 const getCollectionWidgetDataHandler =

package/data/urls.ts

@@ -40,11 +40,10 @@ export const account = {
       shipping_option_slug
         ? `&shipping_option_slug${shipping_option_operator}${shipping_option_slug}`
         : ''
-    }${currency ? `&currency=${currency}` : ''}${
-      filterType && filterValue ? `&${filterType}=${filterValue}` : ''
-    }`,
+    }${currency ? `&currency=${currency}` : ''}
+    ${filterType && filterValue ? `&${filterType}=${filterValue}` : ''}`,
   getOldOrders: ({ page, limit }: { page?: number; limit?: number }) =>
-    `/users/old-orders/?page=${page || 1}&limit=${limit || 12}`,
+    `/users/old-orders/?page=${page || 1}&limit=${limit || 12}}`,
   getQuotations: (page?: number, status?: string, limit?: number) =>
     `/b2b/my-quotations/?page=${page || 1}` +
     (status ? `&status=${status}` : '') +
@@ -184,11 +183,7 @@ export const product = {
   breadcrumbUrl: (menuitemmodel: string) =>
     `/menus/generate_breadcrumb/?item=${menuitemmodel}&generator_name=menu_item`,
   bundleProduct: (productPk: string, queryString: string) =>
-    `/bundle-product/${productPk}/?${queryString}`,
-  similarProducts: (params?: string) =>
-    `/similar-products${params ? `?${params}` : ''}`,
-  similarProductsList: (params?: string) =>
-    `/similar-product-list${params ? `?${params}` : ''}`
+    `/bundle-product/${productPk}/?${queryString}`
 };
 
 export const wishlist = {

package/hooks/index.ts

@@ -15,4 +15,3 @@ export * from './use-logger-context';
 export * from './use-sentry-uncaught-errors';
 export * from './use-pz-params';
 export * from './use-toast';
-export * from './use-client-env';

package/hooks/use-captcha.tsx

@@ -39,7 +39,7 @@ export const useCaptcha = () => {
   };
 
   if (csrfToken) {
-    setCookie('csrftoken', csrfToken, { secure: true });
+    setCookie('csrftoken', csrfToken);
   }
 
   const onCaptchaChange = useCallback(async (response) => {