@akinon/next 2.0.79-rc.0 → 2.0.79

package/redux/middlewares/checkout.ts

@@ -26,28 +26,13 @@ import {
 } from '../../redux/reducers/checkout';
 import { RootState, TypedDispatch } from 'redux/store';
 import { checkoutApi } from '../../data/client/checkout';
-import { CheckoutContext, MiddlewareAction, PreOrder } from '../../types';
+import { CheckoutContext, PreOrder } from '../../types';
 import { getCookie } from '../../utils';
 import settings from 'settings';
 import { LocaleUrlStrategy } from '../../localization';
 import { showMobile3dIframe } from '../../utils/mobile-3d-iframe';
 import { showRedirectionIframe } from '../../utils/redirection-iframe';
 
-const IFRAME_REDIRECTION_KEY = 'pz-iframe-redirection-active';
-
-const isIframeRedirectionActive = () =>
-  typeof window !== 'undefined' &&
-  sessionStorage.getItem(IFRAME_REDIRECTION_KEY) === 'true';
-
-const setIframeRedirectionActive = (active: boolean) => {
-  if (typeof window === 'undefined') return;
-  if (active) {
-    sessionStorage.setItem(IFRAME_REDIRECTION_KEY, 'true');
-  } else {
-    sessionStorage.removeItem(IFRAME_REDIRECTION_KEY);
-  }
-};
-
 interface CheckoutResult {
   payload: {
     errors?: Record<string, string[]>;
@@ -84,7 +69,7 @@ export const redirectUrlMiddleware: Middleware = () => {
     const result = next(action) as CheckoutResult;
     const redirectUrl = result?.payload?.redirect_url;
 
-    if (redirectUrl && !isIframeRedirectionActive()) {
+    if (redirectUrl) {
       const currentLocale = getCookie('pz-locale');
 
       let url = redirectUrl;
@@ -114,15 +99,8 @@ export const contextListMiddleware: Middleware = ({
     const { isMobileApp, userPhoneNumber } = getState().root;
     const result = next(action) as CheckoutResult;
     const preOrder = result?.payload?.pre_order;
-    const act = action as MiddlewareAction;
 
     if (result?.payload?.context_list) {
-      const endpointName = act.meta?.arg?.endpointName;
-      const isBinNumberResponse = endpointName === 'setBinNumber';
-      const hasCardTypeInContextList = result.payload.context_list.some(
-        (ctx) => ctx.page_context.card_type
-      );
-
       result.payload.context_list.forEach((context) => {
         const redirectUrl = context.page_context.redirect_url;
         const isIframe = context.page_context.is_iframe ?? false;
@@ -156,7 +134,6 @@ export const contextListMiddleware: Middleware = ({
           if (isMobileDevice && isIframePaymentOptionIncluded) {
             showMobile3dIframe(urlObj.toString());
           } else if (isIframe) {
-            setIframeRedirectionActive(true);
             showRedirectionIframe(urlObj.toString());
           } else {
             window.location.href = urlObj.toString();
@@ -232,34 +209,15 @@ export const contextListMiddleware: Middleware = ({
             (ctx) => ctx.page_name === 'DeliveryOptionSelectionPage'
           )
         ) {
-          const isCreditCardPayment =
-            preOrder?.payment_option?.payment_type === 'credit_card' ||
-            preOrder?.payment_option?.payment_type === 'masterpass';
-
           if (context.page_context.card_type) {
             dispatch(setCardType(context.page_context.card_type));
-          } else if (
-            isCreditCardPayment &&
-            isBinNumberResponse &&
-            !hasCardTypeInContextList
-          ) {
-            dispatch(setCardType(null));
-            dispatch(setInstallmentOptions([]));
           }
 
           if (
             context.page_context.installments &&
             preOrder?.payment_option?.payment_type !== 'masterpass_rest'
           ) {
-            if (
-              !isCreditCardPayment ||
-              context.page_context.card_type ||
-              hasCardTypeInContextList
-            ) {
-              dispatch(
-                setInstallmentOptions(context.page_context.installments)
-              );
-            }
+            dispatch(setInstallmentOptions(context.page_context.installments));
           }
         }
 

package/redux/middlewares/pre-order/installment-option.ts

@@ -14,17 +14,9 @@ export const installmentOptionMiddleware: Middleware = ({
       return result;
     }
 
-    const { installmentOptions, cardType } = getState().checkout;
+    const { installmentOptions } = getState().checkout;
     const { endpoints: apiEndpoints } = checkoutApi;
 
-    const isCreditCardPayment =
-      preOrder?.payment_option?.payment_type === 'credit_card' ||
-      preOrder?.payment_option?.payment_type === 'masterpass';
-
-    if (isCreditCardPayment && !cardType) {
-      return result;
-    }
-
     if (
       !preOrder?.installment &&
       preOrder?.payment_option?.payment_type !== 'saved_card' &&

package/types/index.ts

@@ -85,12 +85,6 @@ export interface Settings {
   };
   usePrettyUrlRoute?: boolean;
   commerceUrl: string;
-  /**
-   * This option allows you to track Sentry events on the client side, in addition to server and edge environments.
-   *
-   * It overrides process.env.NEXT_PUBLIC_SENTRY_DSN and process.env.SENTRY_DSN.
-   */
-  sentryDsn?: string;
   /**
    * CSRF cookie hardening settings.
    *
@@ -242,7 +236,6 @@ export interface Settings {
     separator?: string;
     segments: PzSegmentDefinition[];
   };
-  payloadOptimization?: import('../utils/payload-optimizer').PayloadOptimizationConfig;
 }
 
 export interface CacheOptions {
@@ -302,9 +295,7 @@ export interface PzSegmentsConfig {
 }
 
 // Search params type compatible with both Next.js resolved searchParams and URLSearchParams
-export type SearchParams =
-  | Record<string, string | string[] | undefined>
-  | URLSearchParams;
+export type SearchParams = Record<string, string | string[] | undefined> | URLSearchParams;
 
 // Raw Next 16 server prop shape, used at the middleware/HOC boundary before normalization
 export type RawSearchParams = Record<string, string | string[] | undefined>;
@@ -337,16 +328,14 @@ export interface RootLayoutProps<T = any> extends LayoutProps<T> {
 
 // Async versions for Next.js 16 generateMetadata and internal use
 export interface AsyncPageProps<T = any> {
-  params: Promise<
-    T & {
-      pz?: string;
-      commerce?: string;
-      locale?: string;
-      currency?: string;
-      url?: string;
-      [key: string]: any;
-    }
-  >;
+  params: Promise<T & {
+    pz?: string;
+    commerce?: string;
+    locale?: string;
+    currency?: string;
+    url?: string;
+    [key: string]: any;
+  }>;
   searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
 }
 

package/utils/app-fetch.ts

@@ -76,7 +76,9 @@ const appFetch = async <T>({
       'x-forwarded-for': ip
     };
 
-    init.next = {
+    // Callers may pass their own cache directives (e.g. widget preview
+    // fetches use revalidate: 0); only apply the default when they don't.
+    init.next = init.next ?? {
       revalidate: Settings.usePrettyUrlRoute ? 0 : 60
     };
 

package/utils/csrf.ts

@@ -46,7 +46,7 @@ export function getCsrfCookieFlags(): CsrfCookieFlags {
 
   return {
     httpOnly,
-    secure: process.env.NODE_ENV === 'production',
+    secure: httpOnly && process.env.NODE_ENV === 'production',
     sameSite: 'lax'
   };
 }

package/utils/preview-token.ts

@@ -0,0 +1,111 @@
+import { isValidPreviewId } from './preview';
+
+/**
+ * Signed, expiring preview entry tokens.
+ *
+ * The storefront never hands out its PREVIEW_SECRET: the editor asks
+ * `/api/preview/link` (proving it is an editor user with its Omnitron token)
+ * and receives a token that names ONE preview and dies at `expiresAt`. A leaked
+ * link therefore exposes nothing lasting, and rotating the secret invalidates
+ * every outstanding link at once.
+ *
+ * Format: `v1.<previewId>.<expiresAt unix seconds>.<base64url HMAC-SHA256>`.
+ * Web Crypto only, so the same code runs in Node route handlers and on the
+ * edge.
+ */
+export const PREVIEW_TOKEN_VERSION = 'v1';
+
+/** How long an editor-issued preview link stays valid unless configured. */
+export const DEFAULT_PREVIEW_LINK_TTL_SECONDS = 24 * 60 * 60;
+
+export interface PreviewTokenClaims {
+  previewId: string;
+  /** Unix time in SECONDS. */
+  expiresAt: number;
+}
+
+export type PreviewTokenVerdict =
+  | { ok: true; claims: PreviewTokenClaims }
+  | { ok: false; reason: 'malformed' | 'expired' | 'invalid-signature' };
+
+// Created per call: the module is also imported where TextEncoder only shows
+// up after a polyfill (jsdom), and the cost is negligible.
+const encode = (value: string) => new TextEncoder().encode(value);
+
+const base64url = (bytes: ArrayBuffer): string => {
+  const view = new Uint8Array(bytes);
+  let binary = '';
+  for (let i = 0; i < view.length; i++) {
+    binary += String.fromCharCode(view[i]);
+  }
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+
+const hmac = async (secret: string, payload: string): Promise<string> => {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  );
+  return base64url(await crypto.subtle.sign('HMAC', key, encode(payload)));
+};
+
+/** Constant-time string equality — a signature check must not leak by timing. */
+const timingSafeEqual = (a: string, b: string): boolean => {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+};
+
+const payloadOf = ({ previewId, expiresAt }: PreviewTokenClaims): string =>
+  `${PREVIEW_TOKEN_VERSION}.${previewId}.${expiresAt}`;
+
+export const signPreviewToken = async (
+  claims: PreviewTokenClaims,
+  secret: string
+): Promise<string> => {
+  if (!isValidPreviewId(claims.previewId)) {
+    throw new Error('signPreviewToken: invalid preview id');
+  }
+  if (!Number.isInteger(claims.expiresAt) || claims.expiresAt <= 0) {
+    throw new Error('signPreviewToken: invalid expiry');
+  }
+  const payload = payloadOf(claims);
+  return `${payload}.${await hmac(secret, payload)}`;
+};
+
+export const verifyPreviewToken = async (
+  token: string,
+  secret: string,
+  nowMs: number = Date.now()
+): Promise<PreviewTokenVerdict> => {
+  const parts = typeof token === 'string' ? token.split('.') : [];
+  if (parts.length !== 4 || parts[0] !== PREVIEW_TOKEN_VERSION) {
+    return { ok: false, reason: 'malformed' };
+  }
+  const [, previewId, expiresAtRaw, signature] = parts;
+  const expiresAt = Number(expiresAtRaw);
+  if (
+    !isValidPreviewId(previewId) ||
+    !/^\d+$/.test(expiresAtRaw) ||
+    !Number.isSafeInteger(expiresAt) ||
+    !signature
+  ) {
+    return { ok: false, reason: 'malformed' };
+  }
+  // Signature before expiry: an attacker must not learn which expired tokens
+  // were once valid.
+  const expected = await hmac(secret, payloadOf({ previewId, expiresAt }));
+  if (!timingSafeEqual(signature, expected)) {
+    return { ok: false, reason: 'invalid-signature' };
+  }
+  if (expiresAt * 1000 <= nowMs) {
+    return { ok: false, reason: 'expired' };
+  }
+  return { ok: true, claims: { previewId, expiresAt } };
+};

package/utils/preview.ts

@@ -0,0 +1,83 @@
+/**
+ * Widget preview contract — shared by the middleware/route handler that
+ * enters preview, the pz segment that carries which preview is being viewed,
+ * and the widget fetch layer that resolves the preview copies.
+ *
+ * The theme editor writes the other half of this contract: it creates named
+ * previews and stores each one's pages under `<slug>-preview-<id>`. The two
+ * sides must never drift.
+ */
+
+/** Suffix before the preview id — hyphenated because Omnitron slugifies. */
+export const PREVIEW_SLUG_SUFFIX = '-preview';
+
+/** Remembers which named preview this browser is viewing. */
+export const PREVIEW_ID_COOKIE = 'pz-preview-id';
+
+/** Next.js's own draft-mode cookie — set by `draftMode().enable()`. */
+export const DRAFT_MODE_COOKIE = '__prerender_bypass';
+
+/** Query key on the editor's link, consumed by the /api/preview handler. */
+export const PREVIEW_ID_QUERY_PARAM = 'preview_id';
+
+/**
+ * The pz segment carrying the preview id into the render.
+ *
+ * A cookie cannot be used directly: the pages that render widgets are
+ * `dynamic = 'force-static'`, and Next.js blanks `cookies()`/`headers()`
+ * under that config (draftMode is the exception). Route params always
+ * survive, so the middleware resolves the cookie into this segment and the
+ * server components read it from there. See settings.js `pzSegments`.
+ */
+export const PREVIEW_PZ_SEGMENT = 'preview';
+
+/**
+ * Ids come from a cookie, so they are validated everywhere they are used:
+ * lowercase slug words joined by single hyphens, bounded length — exactly
+ * what the editor produces (see slugifyPreviewId there). No `--` anywhere:
+ * that is the pz segment separator, and an id containing it would make the
+ * segment undecodable.
+ */
+export const isValidPreviewId = (id: unknown): id is string =>
+  typeof id === 'string' &&
+  id.length <= 32 &&
+  /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(id);
+
+/** The slug a widget's copy lives under inside one named preview. */
+export const previewSlug = (slug: string, previewId: string): string =>
+  `${slug}${PREVIEW_SLUG_SUFFIX}-${previewId}`;
+
+/**
+ * True for slugs shaped like a preview copy of something. A HEURISTIC — a
+ * live slug can legitimately end this way (a custom page named
+ * `summer-preview-2026`), so the fetch layer does not use it to decide
+ * whether to overlay; see `isPreviewCopySlug`.
+ */
+export const isPreviewSlug = (slug: string): boolean =>
+  /-preview-[a-z0-9-]+$/.test(slug);
+
+/**
+ * True when `slug` is already the copy of something inside THIS preview —
+ * the exact check the fetch layer needs so preview slugs are never nested,
+ * without misreading live slugs that merely look like one.
+ */
+export const isPreviewCopySlug = (slug: string, previewId: string): boolean =>
+  previewId !== '' && slug.endsWith(previewSlug('', previewId));
+
+/**
+ * Resolves the pz segment value from the request — used by settings.js.
+ * An invalid or absent cookie yields '' (no preview), which the fetch layer
+ * treats as "render live".
+ *
+ * The id only counts alongside Next's draft-mode cookie: without it the
+ * request renders live anyway, and folding an unauthenticated cookie value
+ * into the route segment would let any visitor mint a fresh ISR/Redis cache
+ * key per request.
+ */
+export const resolvePreviewSegment = (req: {
+  cookies: { get: (name: string) => { value: string } | undefined };
+}): string => {
+  if (!req.cookies.get(DRAFT_MODE_COOKIE)?.value) return '';
+  const value = req.cookies.get(PREVIEW_ID_COOKIE)?.value ?? '';
+  return isValidPreviewId(value) ? value : '';
+};

package/utils/pz-segments.ts

@@ -40,15 +40,44 @@ export function encodePzValue(
     .join(config.separator);
 }
 
+/**
+ * Inverse of `encodePzValue`.
+ *
+ * The `url` segment is `encodeURIComponent(fullUrl)`, and that leaves `-`
+ * alone — so a pathname containing the separator (`/collections/summer--sale`)
+ * splits into extra parts. Only `url` can do that (locale, currency and the
+ * custom segments are validated slugs), so the segments before it are read
+ * from the front, the ones after it from the back, and whatever is left in
+ * the middle is the url re-joined. A purely positional read would hand the
+ * url's tail to the segment after it — with a preview segment present that
+ * meant rendering the wrong preview (or live) with a misleading banner.
+ */
 export function decodePzValue(
   pzValue: string,
   config: PzSegmentsConfig
 ): Record<string, string> {
   const parts = pzValue.split(config.separator);
   const result: Record<string, string> = {};
+  const urlIndex = config.segments.findIndex((seg) => seg.name === 'url');
 
+  if (urlIndex === -1 || parts.length <= config.segments.length) {
+    config.segments.forEach((seg, index) => {
+      result[seg.name] = parts[index] ?? '';
+    });
+    return result;
+  }
+
+  const trailing = config.segments.length - urlIndex - 1;
   config.segments.forEach((seg, index) => {
-    result[seg.name] = parts[index] ?? '';
+    if (index < urlIndex) {
+      result[seg.name] = parts[index] ?? '';
+    } else if (index === urlIndex) {
+      result[seg.name] = parts
+        .slice(urlIndex, parts.length - trailing)
+        .join(config.separator);
+    } else {
+      result[seg.name] = parts[parts.length - trailing + (index - urlIndex - 1)] ?? '';
+    }
   });
 
   return result;

package/utils/server-variables.ts

@@ -6,5 +6,12 @@ const { locales, defaultLocaleValue, defaultCurrencyCode } =
 export const ServerVariables = {
   locale: locales.find((l) => l.value === defaultLocaleValue)?.value ?? '',
   currency: defaultCurrencyCode,
-  globalHeaders: {}
+  globalHeaders: {},
+  /**
+   * Which named widget preview the current render belongs to, decoded from
+   * the pz route segment by withSegmentDefaults. Empty for ordinary traffic.
+   * Only ever acted on together with draft mode, so a value left behind by a
+   * concurrent request cannot leak preview content to a normal visitor.
+   */
+  previewId: ''
 };

package/with-pz-config.js

@@ -30,10 +30,6 @@ const defaultConfig = {
       {
         protocol: 'https',
         hostname: '**.akinoncdn.com'
-      },
-      {
-        protocol: 'https',
-        hostname: '**.akinoncloudcdn.com'
       }
     ]
   },
@@ -78,8 +74,7 @@ const defaultConfig = {
         acc[`@akinon/${plugin}`] = false;
         return acc;
       }, {}),
-      translations: false,
-      '@opentelemetry/exporter-jaeger': false
+      translations: false
     };
     // Ensure webpack can resolve deps from the app's node_modules when
     // compiling transpiled packages (e.g. @akinon/next) whose imports

package/api/client-env.ts

@@ -1,78 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-/**
- * Runtime access to public (`NEXT_PUBLIC_*`) environment variables.
- *
- * Next.js inlines `process.env.NEXT_PUBLIC_*` into the bundle at *build* time.
- * On hosting platforms where the build has no access to the environment (e.g.
- * Akinon Cloud Commerce), those references resolve to `undefined` in the
- * browser. This route reads the variables from the *server runtime* instead —
- * `process.env[name]` is a computed lookup, so webpack never statically inlines
- * it — and hands them back to the client.
- *
- * Only `NEXT_PUBLIC_`-prefixed names are resolvable. These values are public by
- * design (they are shipped to the browser anyway), so nothing secret can leak
- * through here; the prefix check is what keeps server-only secrets unreadable.
- *
- * Query: one or more `env` params, repeated (`?env=A&env=B`) and/or comma
- * separated (`?env=A,B`). Names must include the full prefix. Responds with a
- * `{ [name]: value | null }` map (`null` when the variable is not set).
- *
- * The consuming route file must set `export const dynamic = 'force-dynamic'` so
- * Next never statically caches a build-time (empty) response.
- *
- * @see `@akinon/next/hooks` — `useClientEnv` / `getClientEnv` read from here.
- */
-
-const CLIENT_ENV_NAME = /^NEXT_PUBLIC_[A-Za-z0-9_]+$/;
-
-export async function GET(request: NextRequest) {
-  try {
-    const { searchParams } = new URL(request.url);
-
-    const names = Array.from(
-      new Set(
-        searchParams
-          .getAll('env')
-          .flatMap((value) => value.split(','))
-          .map((value) => value.trim())
-          .filter(Boolean)
-      )
-    );
-
-    if (names.length === 0) {
-      return NextResponse.json(
-        { message: 'At least one `env` query parameter is required.' },
-        { status: 400 }
-      );
-    }
-
-    const invalid = names.filter((name) => !CLIENT_ENV_NAME.test(name));
-
-    if (invalid.length > 0) {
-      return NextResponse.json(
-        {
-          message:
-            'Only NEXT_PUBLIC_-prefixed environment variables can be read.',
-          invalid
-        },
-        { status: 400 }
-      );
-    }
-
-    const values = names.reduce<Record<string, string | null>>((acc, name) => {
-      acc[name] = process.env[name] ?? null;
-      return acc;
-    }, {});
-
-    return NextResponse.json(values, {
-      headers: { 'Cache-Control': 'no-store' }
-    });
-  } catch (error) {
-    console.error('Error in client-env API:', error);
-    return NextResponse.json(
-      { message: 'Internal server error' },
-      { status: 500 }
-    );
-  }
-}