@controleonline/ui-common 1.2.101 → 1.2.103

package/src/react/utils/fileUrl.js

@@ -1,4 +1,5 @@
 import {env as APP_ENV} from '@env';
+import {filterApiHeaders} from '../../utils/trustedApiUrl';
 import {buildAssetUrl} from '@controleonline/../../src/styles/branding';
 import {
   resolveAppDomain,
@@ -88,6 +89,60 @@ const resolveDownloadHost = ({company = null, appDomain = ''} = {}) => {
  * Keep app-domain header only; do not path-inject environment hosts.
  * app-community#432
  */
+const resolveApiEntrypointHost = () => {
+  const entry = normalizeText(APP_ENV?.API_ENTRYPOINT);
+  if (!entry) {
+    return '';
+  }
+
+  try {
+    const withProtocol = /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(entry)
+      ? entry
+      : `https://${entry}`;
+    return new URL(withProtocol).host.toLowerCase();
+  } catch (error) {
+    return entry
+      .replace(/^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//, '')
+      .replace(/\/.*$/, '')
+      .toLowerCase();
+  }
+};
+
+/**
+ * API host must never be used as /{host}/files/{id}/download segment.
+ * Backend File.domain often stores the API host (api.controleonline.com);
+ * using it produces broken URLs like:
+ *   https://api.controleonline.com/api.controleonline.com/files/8408/download
+ * Tenant white-labels need:
+ *   https://api.controleonline.com/erp.jaguncos.com.br/files/8408/download
+ * app-community#1160
+ */
+const isApiEntrypointHost = host => {
+  const normalized = normalizeText(host).toLowerCase();
+  if (!normalized) {
+    return false;
+  }
+
+  const apiHost = resolveApiEntrypointHost();
+  if (apiHost && normalized === apiHost) {
+    return true;
+  }
+
+  if (
+    normalized === 'api.controleonline.com' ||
+    normalized === 'api.controleonline.com.br'
+  ) {
+    return true;
+  }
+
+  // Generic api.* hosts are infrastructure, not tenant app-domains.
+  if (/^api\./i.test(normalized)) {
+    return true;
+  }
+
+  return false;
+};
+
 const isEnvironmentLikeHost = host => {
   const normalized = normalizeText(host).toLowerCase();
   if (!normalized) return false;
@@ -119,6 +174,29 @@ const isEnvironmentLikeHost = host => {
   return false;
 };
 
+/**
+ * Prefer File.domain only when it is a real tenant host.
+ * Ignore API entrypoint and environment/platform hosts (app-community#1160).
+ */
+const pickDownloadHost = (fileDomain, fallbackHost) => {
+  const candidate = normalizeText(fileDomain);
+  if (
+    candidate &&
+    !isApiEntrypointHost(candidate) &&
+    !isEnvironmentLikeHost(candidate)
+  ) {
+    return candidate;
+  }
+
+  const fallback = normalizeText(fallbackHost);
+  if (fallback && !isApiEntrypointHost(fallback)) {
+    return fallback;
+  }
+
+  // Last resort: runtime host (web multi-tenant) or configured DOMAIN.
+  return resolveAppDomain(APP_ENV?.DOMAIN) || fallback;
+};
+
 const buildBackendDownloadUrl = (fileId, options = {}) => {
   const normalizedId = String(fileId || '').trim();
   if (!normalizedId) {
@@ -138,13 +216,11 @@ const buildTenantDownloadUrl = (url, host) => {
     return absoluteUrl;
   }
 
-  // File download ops are registered as /{appDomain}/files/{id}/download.
-  // Skipping path inject for environment hosts left SPA on /files/{id}/download
-  // which 404s until/unless a non-prefixed route is deployed (app-community#796).
-  const isFileDownloadPath = /\/files\/[^/?#]+\/download/i.test(absoluteUrl);
-
-  // Do not inject environment hosts into non-download paths (app-community#432).
-  if (isEnvironmentLikeHost(normalizedHost) && !isFileDownloadPath) {
+  // Do not path-inject environment/platform hosts (app-community#432).
+  // Bare /files/{id}/download remains for staging/manager/dev; tenant hosts
+  // (erp.jaguncos.com.br, loja..., etc.) still get /{appDomain}/files/... .
+  // Never path-inject the API entrypoint host (app-community#1160).
+  if (isEnvironmentLikeHost(normalizedHost) || isApiEntrypointHost(normalizedHost)) {
     return absoluteUrl;
   }
 
@@ -227,7 +303,7 @@ export const extractFileId = file => {
   return null;
 };
 
-export const resolveDefaultFileSource = (
+const resolveFileSource = (
   file,
   {company = null, appDomain = '', headers = {}} = {},
 ) => {
@@ -309,9 +385,9 @@ export const resolveDefaultFileSource = (
       return null;
     }
 
-    // Prefer FileService domain (companies/my icon/logo payload) for path inject.
-    const fileDomain = normalizeText(normalizedFile?.domain);
-    const downloadHost = fileDomain || host;
+    // Prefer FileService domain only when it is a tenant host, never the API host.
+    // file.domain often comes as api.controleonline.com (app-community#1160).
+    const downloadHost = pickDownloadHost(normalizedFile?.domain, host);
 
     const uri = isBackendDownload
       ? buildTenantDownloadUrl(uriBase, downloadHost)
@@ -329,6 +405,11 @@ export const resolveDefaultFileSource = (
   return null;
 };
 
+export const resolveDefaultFileSource = (file, options = {}) => {
+  const source = resolveFileSource(file, options);
+  return source ? {...source, headers: filterApiHeaders(source.uri, source.headers, APP_ENV?.API_ENTRYPOINT)} : null;
+};
+
 export const resolveDefaultFileUrl = (file, options = {}) =>
   resolveDefaultFileSource(file, options)?.uri || '';
 

package/src/react/utils/productCatalogCacheRevision.js

@@ -0,0 +1,13 @@
+import eventBus from '../components/EventBus';
+
+const key = 'product-catalog-cache-revision';
+let revision = '0';
+let sequence = 0;
+export const getProductCatalogCacheRevision = () => {
+  try { return localStorage.getItem(key) || revision; } catch { return revision; }
+};
+export const invalidateProductCatalogCache = () => {
+  revision = `${Date.now()}:${++sequence}`;
+  try { localStorage.setItem(key, revision); } catch { /* In-memory invalidation still applies. */ }
+  eventBus.emit('product-catalog-cache:cleared');
+};

package/src/tests/react/components/UserAvatar.test.js

@@ -12,6 +12,8 @@ jest.mock('react-native', () => ({
   View: props => React.createElement('View', props, props.children),
 }));
 
+jest.mock('@env', () => ({env: {API_ENTRYPOINT: 'https://api.controleonline.com', DOMAIN: 'manager.controleonline.com'}}));
+
 const UserAvatar = require('../../../react/components/UserAvatar').default;
 
 const {describe, expect, it} = global;
@@ -54,3 +56,31 @@ describe('UserAvatar', () => {
     expect(image.props.source.uri).toContain('d=404');
   });
 });
+
+
+describe('avatar credential boundary', () => {
+  it('does not authenticate an external download-shaped image on web', async () => {
+    const {Platform} = require('react-native');
+    const previousStorage = global.localStorage;
+    const previousFetch = global.fetch;
+    Platform.OS = 'web';
+    global.localStorage = {getItem: () => JSON.stringify({token: 'session-secret'})};
+    global.fetch = jest.fn();
+    let tree;
+    try {
+      await renderer.act(async () => { tree = renderer.create(React.createElement(UserAvatar, {imageUrl: 'https://images.example.test/files/1/download', useGravatar: false})); });
+      expect(global.fetch).not.toHaveBeenCalled();
+      expect(tree.root.findByType('Image').props.source.uri).toBe('https://images.example.test/files/1/download');
+    } finally {
+      if (tree) await renderer.act(async () => tree.unmount());
+      Platform.OS = 'ios'; global.localStorage = previousStorage; global.fetch = previousFetch;
+    }
+  });
+  it('removes session headers from external native avatars', async () => {
+    let tree;
+    try {
+      await renderer.act(async () => { tree = renderer.create(React.createElement(UserAvatar, {imageUrl: 'https://images.example.test/avatar.png', imageHeaders: {'API-TOKEN': 'session-secret', Accept: 'image/*'}, useGravatar: false})); });
+      expect(tree.root.findByType('Image').props.source.headers).toEqual({Accept: 'image/*'});
+    } finally { if (tree) await renderer.act(async () => tree.unmount()); }
+  });
+});

package/src/tests/react/utils/fileUrl.test.js

@@ -60,7 +60,7 @@ describe('fileUrl helpers', () => {
     });
   });
 
-  it('does not path-inject environment hosts like staging (app-community#432)', () => {
+  it('keeps the explicit environment domain on the registered download route', () => {
     const source = resolveDefaultFileSource(
       {
         id: 8444,
@@ -77,24 +77,100 @@ describe('fileUrl helpers', () => {
     );
 
     expect(source).toEqual({
-      uri: 'https://api.controleonline.com/files/8444/download',
+      uri: 'https://api.controleonline.com/staging.controleonline.com/files/8444/download',
       headers: {
         Authorization: 'Bearer token',
         'app-domain': 'staging.controleonline.com',
       },
     });
-    expect(source.uri).not.toContain('staging.controleonline.com/files');
+    expect(source.uri).toContain('staging.controleonline.com/files');
   });
 
-  it('does not path-inject when fallback DOMAIN is manager platform host', () => {
+  it('uses the configured platform domain on the registered download route', () => {
     // DOMAIN mock is manager.controleonline.com; no company → environment-like
     const source = resolveDefaultFileSource(
       {id: 9, url: '/files/9/download'},
       {headers: {Authorization: 'Bearer t'}},
     );
 
-    expect(source.uri).toBe('https://api.controleonline.com/files/9/download');
+    expect(source.uri).toBe('https://api.controleonline.com/manager.controleonline.com/files/9/download');
     expect(source.headers['app-domain']).toBe('manager.controleonline.com');
-    expect(source.uri).not.toMatch(/manager\.controleonline\.com\/files/);
+    expect(source.uri).toMatch(/manager\.controleonline\.com\/files/);
+  });
+});
+
+
+describe('file authentication origin boundary', () => {
+  it('removes ERP credentials from external images and download-shaped URLs', () => {
+    for (const uri of ['https://images.example.test/image.png', 'https://images.example.test/files/1/download', '//images.example.test/image.png']) {
+      const source = resolveDefaultFileSource(uri, {headers: {'API-TOKEN': 'session-secret', Authorization: 'Bearer session-secret', 'App-Domain': 'tenant.test', Accept: 'image/*'}});
+      expect(source.headers).not.toHaveProperty('API-TOKEN');
+      expect(source.headers).not.toHaveProperty('Authorization');
+      expect(source.headers).not.toHaveProperty('App-Domain');
+      expect(source.headers.Accept).toBe('image/*');
+    }
+  });
+  it('preserves authentication on the configured API download', () => {
+    const source = resolveDefaultFileSource(1, {headers: {'API-TOKEN': 'session-secret'}});
+    expect(source.headers['API-TOKEN']).toBe('session-secret');
+  });
+
+  it('ignores file.domain when it is the API host and uses tenant app-domain (app-community#1160)', () => {
+    const company = {domain: 'loja.jaguncos.com.br'};
+
+    const source = resolveDefaultFileSource(
+      {
+        id: 8408,
+        domain: 'api.controleonline.com',
+        url: '/api.controleonline.com/files/8408/download',
+      },
+      {
+        company,
+        headers: {Authorization: 'Bearer token'},
+      },
+    );
+
+    expect(source.uri).toBe(
+      'https://api.controleonline.com/loja.jaguncos.com.br/files/8408/download',
+    );
+    expect(source.uri).not.toMatch(/api\.controleonline\.com\/files/);
+    expect(source.headers['app-domain']).toBe('loja.jaguncos.com.br');
+  });
+
+  it('ignores API host as company domain and falls back to explicit appDomain', () => {
+    const source = resolveDefaultFileSource(
+      {
+        id: 8408,
+        domain: 'api.controleonline.com',
+      },
+      {
+        company: {domain: 'api.controleonline.com'},
+        appDomain: 'erp.jaguncos.com.br',
+        headers: {},
+      },
+    );
+
+    expect(source.uri).toBe(
+      'https://api.controleonline.com/erp.jaguncos.com.br/files/8408/download',
+    );
+    expect(source.headers['app-domain']).toBe('erp.jaguncos.com.br');
+  });
+
+  it('still prefers a real tenant file.domain over company when not API host', () => {
+    const source = resolveDefaultFileSource(
+      {
+        id: 12,
+        domain: 'cardapio.jaguncos.com.br',
+        url: '/files/12/download',
+      },
+      {
+        company: {domain: 'erp.jaguncos.com.br'},
+      },
+    );
+
+    expect(source.uri).toBe(
+      'https://api.controleonline.com/cardapio.jaguncos.com.br/files/12/download',
+    );
+    expect(source.headers['app-domain']).toBe('cardapio.jaguncos.com.br');
   });
 });