@decocms/apps-vtex 7.2.0

package/src/registry.ts

@@ -0,0 +1,9 @@
+import type { AppRegistryEntry } from "@decocms/apps-commerce/registry";
+
+export const VTEX_REGISTRY_ENTRY: AppRegistryEntry = {
+  blockKey: "deco-vtex",
+  module: () => import("./mod"),
+  displayName: "VTEX",
+  category: "commerce",
+  description: "VTEX IO commerce integration",
+};

package/src/types.ts

@@ -0,0 +1,248 @@
+/**
+ * VTEX Checkout / OrderForm types.
+ * These mirror the VTEX Checkout API response shapes.
+ * Aligned with deco-cx/apps vtex/utils/types.ts
+ */
+
+export interface OrderFormItem {
+	id: string;
+	productId: string;
+	productRefId?: string;
+	refId?: string;
+	ean?: string | null;
+	name: string;
+	skuName: string;
+	imageUrl: string;
+	detailUrl: string;
+	price: number;
+	listPrice: number;
+	manualPrice?: number | null;
+	quantity: number;
+	sellingPrice: number;
+	rewardValue?: number;
+	isGift?: boolean;
+	tax?: number;
+	seller: string;
+	sellerChain?: string[];
+	uniqueId: string;
+	parentItemIndex?: number | null;
+	parentAssemblyBinding?: string | null;
+	availability?: string;
+	measurementUnit?: string;
+	unitMultiplier?: number;
+	productCategoryIds?: string;
+	productCategories?: Record<string, string>;
+	additionalInfo?: {
+		brandName?: string;
+		brandId?: string;
+		dimension?: Record<string, string> | null;
+		offeringInfo?: unknown | null;
+		offeringType?: unknown | null;
+		offeringTypeId?: unknown | null;
+	};
+	attachments?: unknown[];
+	attachmentOfferings?: Array<{
+		name: string;
+		required: boolean;
+		schema: Record<string, unknown>;
+	}>;
+	offerings?: Array<{
+		type: string;
+		id: string;
+		name: string;
+		price: number;
+	}>;
+	priceTags?: Array<{
+		name: string;
+		value: number;
+		rawValue: number;
+		isPercentual: boolean;
+		identifier: string | null;
+	}>;
+	components?: unknown[];
+	bundleItems?: unknown[];
+	priceDefinition?: {
+		calculatedSellingPrice: number;
+		total: number;
+		sellingPrices: Array<{
+			value: number;
+			quantity: number;
+		}>;
+	};
+}
+
+export interface Totalizer {
+	id: string;
+	name: string;
+	value: number;
+}
+
+export interface Message {
+	code: string;
+	text: string;
+	status: string;
+	fields?: Record<string, string>;
+}
+
+export interface MarketingData {
+	utmSource?: string;
+	utmMedium?: string;
+	utmCampaign?: string;
+	utmiPage?: string;
+	utmiPart?: string;
+	utmiCampaign?: string;
+	coupon?: string;
+	marketingTags?: string[];
+}
+
+export interface ClientProfileData {
+	email: string;
+	firstName?: string | null;
+	lastName?: string | null;
+	document?: string | null;
+	phone?: string | null;
+	corporateName?: string | null;
+	isCorporate?: boolean;
+}
+
+export interface StorePreferencesData {
+	countryCode: string;
+	saveUserData?: boolean;
+	timeZone?: string;
+	currencyCode: string;
+	currencyLocale?: number;
+	currencySymbol: string;
+	currencyFormatInfo?: {
+		currencyDecimalDigits: number;
+		currencyDecimalSeparator: string;
+		currencyGroupSeparator: string;
+		currencyGroupSize: number;
+		startsWithCurrencySymbol: boolean;
+	};
+}
+
+export interface ClientPreferencesData {
+	locale: string;
+	optinNewsLetter?: boolean;
+}
+
+export interface ShippingData {
+	address?: {
+		postalCode?: string;
+		city?: string;
+		state?: string;
+		country?: string;
+		street?: string;
+		number?: string;
+		neighborhood?: string;
+		complement?: string;
+		reference?: string;
+	} | null;
+	selectedAddresses?: Array<{
+		postalCode?: string;
+		city?: string;
+		state?: string;
+		country?: string;
+	}>;
+	logisticsInfo?: Array<{
+		itemIndex: number;
+		selectedSla?: string;
+		selectedDeliveryChannel?: string;
+		slas?: Sla[];
+	}>;
+}
+
+export interface PaymentData {
+	updateStatus?: string;
+	installmentOptions?: unknown[];
+	paymentSystems?: unknown[];
+	payments?: unknown[];
+	giftCards?: unknown[];
+	availableAccounts?: unknown[];
+}
+
+export interface OrderForm {
+	orderFormId: string;
+	salesChannel: string;
+	loggedIn: boolean;
+	isCheckedIn: boolean;
+	storeId?: unknown | null;
+	checkedInPickupPointId?: unknown | null;
+	allowManualPrice: boolean;
+	canEditData: boolean;
+	userProfileId?: unknown | null;
+	userType?: unknown | null;
+	ignoreProfileData: boolean;
+	value: number;
+	messages: Message[];
+	items: OrderFormItem[];
+	selectableGifts?: unknown[];
+	totalizers: Totalizer[];
+	shippingData: ShippingData | null;
+	clientProfileData: ClientProfileData | null;
+	paymentData: PaymentData | null;
+	marketingData: MarketingData | null;
+	sellers?: Array<{ id: string; name: string; logo?: string }>;
+	clientPreferencesData?: ClientPreferencesData | null;
+	commercialConditionData?: unknown | null;
+	storePreferencesData?: StorePreferencesData | null;
+	giftRegistryData?: unknown | null;
+	openTextField?: unknown | null;
+	invoiceData?: unknown | null;
+	customData?: unknown | null;
+	itemMetadata?: unknown | null;
+	hooksData?: unknown | null;
+	ratesAndBenefitsData?: {
+		rateAndBenefitsIdentifiers?: unknown[];
+		teaser?: unknown[];
+	} | null;
+	subscriptionData?: unknown | null;
+	merchantContextData?: unknown | null;
+	itemsOrdination?: unknown | null;
+}
+
+export interface SimulationOrderForm {
+	items: Array<{
+		id: string;
+		quantity: number;
+		seller: string;
+		price?: number;
+		listPrice?: number;
+		offerings?: any[];
+		priceTags?: any[];
+		availability?: string;
+	}>;
+	logisticsInfo?: Array<{
+		itemIndex: number;
+		slas: Sla[];
+		selectedSla?: string;
+		selectedDeliveryChannel?: string;
+	}>;
+	paymentData?: {
+		installmentOptions?: any[];
+	};
+}
+
+export interface Sla {
+	id: string;
+	name: string;
+	price: number;
+	shippingEstimate: string;
+	deliveryChannel?: string;
+}
+
+export interface SKU {
+	id: string;
+	seller: string;
+	quantity: number;
+}
+
+export interface VtexProduct {
+	productId: string;
+	productName: string;
+	brand: string;
+	categoryId: string;
+	categories: string[];
+	items: any[];
+	[key: string]: any;
+}

package/src/utils/__tests__/cookieSanitizer.test.ts

@@ -0,0 +1,162 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+	_resetCookieWarnDedupForTests,
+	extractVtexCookies,
+	sanitizeOutboundCookieHeader,
+	VTEX_COOKIE_PREFIXES,
+	warnDroppedCookies,
+} from "../cookieSanitizer";
+
+describe("sanitizeOutboundCookieHeader", () => {
+	it("returns empty result for empty input", () => {
+		expect(sanitizeOutboundCookieHeader("")).toEqual({ cookies: "", dropped: [] });
+	});
+
+	it("preserves a clean ASCII cookie header unchanged in content", () => {
+		const raw = "checkout.vtex.com=__ofid=abc; vtex_segment=eyJ0b2tlbiI6IjEyMyJ9";
+		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw);
+		expect(dropped).toEqual([]);
+		expect(cookies).toBe("checkout.vtex.com=__ofid=abc; vtex_segment=eyJ0b2tlbiI6IjEyMyJ9");
+	});
+
+	it("drops a cookie whose value contains non-ASCII bytes — the casaevideo repro", () => {
+		// `á` is the UTF-8 encoding of `á` interpreted as Latin-1 — bytes 0xC3 0xA1.
+		// VTEX's janus gateway returns 503 deterministically when this reaches it.
+		const raw = "checkout.vtex.com=__ofid=abc; category_click=Eletroportáteis; vtex_segment=ok";
+		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw);
+		expect(cookies).toBe("checkout.vtex.com=__ofid=abc; vtex_segment=ok");
+		expect(dropped).toEqual([{ name: "category_click", reason: "non_ascii" }]);
+	});
+
+	it("drops cookies with raw multi-byte UTF-8 characters", () => {
+		const { cookies, dropped } = sanitizeOutboundCookieHeader(
+			"checkout.vtex.com=ok; pref=日本語; analytics=tracked",
+		);
+		expect(cookies).toBe("checkout.vtex.com=ok; analytics=tracked");
+		expect(dropped).toEqual([{ name: "pref", reason: "non_ascii" }]);
+	});
+
+	it("treats malformed pairs (no `=`, blank name) as dropped", () => {
+		const { cookies, dropped } = sanitizeOutboundCookieHeader("justaname; =headless; ok=1; ;");
+		expect(cookies).toBe("ok=1");
+		expect(dropped.map((d) => d.reason)).toEqual(["malformed", "malformed"]);
+	});
+
+	it("preserves URL-encoded values containing `=` signs (JWT-shaped tokens)", () => {
+		const raw =
+			"VtexIdclientAutCookie=eyJhbGciOiJSUzI1NiIs.eyJzdWIiOiJxIn0.signature; CheckoutOrderFormOwnership=Vk1B%3D%3D";
+		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw);
+		expect(dropped).toEqual([]);
+		expect(cookies).toBe(raw);
+	});
+
+	it("rejects cookie names with separators (e.g. spaces) as malformed", () => {
+		const { dropped } = sanitizeOutboundCookieHeader("bad name=v; ok=1");
+		expect(dropped[0]).toEqual({ name: "bad name", reason: "malformed" });
+	});
+
+	it("trims surrounding whitespace between pairs", () => {
+		const { cookies } = sanitizeOutboundCookieHeader("  a=1 ;   b=2 ;c=3  ");
+		expect(cookies).toBe("a=1; b=2; c=3");
+	});
+
+	it("preserves cookie order across the input", () => {
+		const { cookies } = sanitizeOutboundCookieHeader("a=1; b=2; c=3; d=4");
+		expect(cookies).toBe("a=1; b=2; c=3; d=4");
+	});
+
+	it("with allowlist=true keeps only VTEX-prefixed cookies and reports the rest", () => {
+		const raw =
+			"FPID=abc; checkout.vtex.com=__ofid=xyz; _ga=tracking; vtex_segment=eyJ9; CheckoutOrderFormOwnership=token; __cf_bm=cf";
+		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw, { allowlist: true });
+		expect(cookies).toBe(
+			"checkout.vtex.com=__ofid=xyz; vtex_segment=eyJ9; CheckoutOrderFormOwnership=token",
+		);
+		expect(dropped.map((d) => d.name).sort()).toEqual(["FPID", "__cf_bm", "_ga"]);
+		expect(dropped.every((d) => d.reason === "not_in_allowlist")).toBe(true);
+	});
+
+	it("allowlist mode still drops a VTEX-prefixed cookie that has a non-ASCII value", () => {
+		const raw = "vtex_segment=okãvalue; checkout.vtex.com=ok";
+		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw, { allowlist: true });
+		expect(cookies).toBe("checkout.vtex.com=ok");
+		expect(dropped).toEqual([{ name: "vtex_segment", reason: "non_ascii" }]);
+	});
+
+	it("VTEX_COOKIE_PREFIXES covers the cookies VTEX actions actually depend on", () => {
+		// Sanity check — if anyone removes one of these, every action that
+		// depends on it will silently 401/redirect on production.
+		for (const required of [
+			"VtexIdclientAutCookie",
+			"checkout.vtex.com",
+			"CheckoutOrderFormOwnership",
+			"vtex_session",
+			"vtex_segment",
+		]) {
+			expect(VTEX_COOKIE_PREFIXES).toContain(required);
+		}
+	});
+});
+
+describe("extractVtexCookies (allowlist convenience wrapper)", () => {
+	it("matches sanitizeOutboundCookieHeader(_, { allowlist: true })", () => {
+		const raw =
+			"FPID=abc; checkout.vtex.com=__ofid=xyz; category_click=Eletroportáteis; vtex_segment=ok";
+		expect(extractVtexCookies(raw)).toBe(
+			sanitizeOutboundCookieHeader(raw, { allowlist: true }).cookies,
+		);
+	});
+
+	it("returns empty string for empty input", () => {
+		expect(extractVtexCookies("")).toBe("");
+	});
+});
+
+describe("warnDroppedCookies", () => {
+	beforeEach(() => {
+		_resetCookieWarnDedupForTests();
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("emits one console.warn per dropped cookie with structured fields", () => {
+		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		warnDroppedCookies(
+			[
+				{ name: "category_click", reason: "non_ascii" },
+				{ name: "_ga", reason: "not_in_allowlist" },
+			],
+			"acct.vtexcommercestable.com.br",
+		);
+		expect(warn).toHaveBeenCalledTimes(2);
+		expect(warn.mock.calls[0]?.[0]).toMatch(
+			/host=acct\.vtexcommercestable\.com\.br name=category_click reason=non_ascii/,
+		);
+		expect(warn.mock.calls[1]?.[0]).toMatch(/name=_ga reason=not_in_allowlist/);
+	});
+
+	it("dedupes repeated drops of the same name+reason+host within the isolate lifetime", () => {
+		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		const drop = [{ name: "category_click", reason: "non_ascii" as const }];
+		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
+		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
+		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
+		expect(warn).toHaveBeenCalledTimes(1);
+	});
+
+	it("does not dedupe across different hosts", () => {
+		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		const drop = [{ name: "category_click", reason: "non_ascii" as const }];
+		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
+		warnDroppedCookies(drop, "secure.example.com.br");
+		expect(warn).toHaveBeenCalledTimes(2);
+	});
+
+	it("is a no-op when nothing was dropped", () => {
+		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		warnDroppedCookies([], "any.host");
+		expect(warn).not.toHaveBeenCalled();
+	});
+});

package/src/utils/__tests__/fetch.test.ts

@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { fetchAPI, fetchSafe, HttpError } from "../fetch";
+
+const realFetch = globalThis.fetch;
+
+function mockResponse(body: unknown, status = 200): Response {
+	return {
+		ok: status >= 200 && status < 300,
+		status,
+		statusText: status === 200 ? "OK" : "Error",
+		url: "https://example.com",
+		json: () => Promise.resolve(body),
+	} as Response;
+}
+
+describe("fetchSafe", () => {
+	beforeEach(() => {
+		globalThis.fetch = vi.fn() as unknown as typeof fetch;
+	});
+
+	afterEach(() => {
+		globalThis.fetch = realFetch;
+	});
+
+	it("returns the response on 2xx", async () => {
+		(globalThis.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(mockResponse({ ok: true }));
+		const res = await fetchSafe("https://example.com/api");
+		expect(res.status).toBe(200);
+	});
+
+	it("throws HttpError on non-2xx", async () => {
+		(globalThis.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(mockResponse({}, 500));
+		await expect(fetchSafe("https://example.com/api")).rejects.toBeInstanceOf(HttpError);
+	});
+
+	it("sanitizes utm_* and map params (drops <, > and non-Latin1)", async () => {
+		const fetchMock = globalThis.fetch as ReturnType<typeof vi.fn>;
+		fetchMock.mockResolvedValue(mockResponse({}));
+
+		await fetchSafe("https://example.com/api?utm_source=<script>café</script>&keep=ok");
+
+		const callArg = fetchMock.mock.calls[0]?.[0] as string;
+		expect(callArg).toContain("utm_source=script");
+		expect(callArg).not.toContain("<");
+		expect(callArg).not.toContain("café");
+		expect(callArg).toContain("keep=ok");
+	});
+
+	it("forwards init options to fetch", async () => {
+		const fetchMock = globalThis.fetch as ReturnType<typeof vi.fn>;
+		fetchMock.mockResolvedValue(mockResponse({}));
+
+		await fetchSafe("https://example.com/api", {
+			method: "POST",
+			headers: { "x-test": "1" },
+		});
+
+		const init = fetchMock.mock.calls[0]?.[1] as RequestInit;
+		expect(init.method).toBe("POST");
+		expect((init.headers as Record<string, string>)["x-test"]).toBe("1");
+	});
+});
+
+describe("fetchAPI", () => {
+	beforeEach(() => {
+		globalThis.fetch = vi.fn() as unknown as typeof fetch;
+	});
+
+	afterEach(() => {
+		globalThis.fetch = realFetch;
+	});
+
+	it("parses JSON on success", async () => {
+		(globalThis.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+			mockResponse({ hello: "world" }),
+		);
+		const data = await fetchAPI<{ hello: string }>("https://example.com/api");
+		expect(data).toEqual({ hello: "world" });
+	});
+});

package/src/utils/__tests__/fetchCache.test.ts

@@ -0,0 +1,112 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { clearFetchCache, fetchWithCache, getFetchCacheStats } from "../fetchCache";
+
+function mockResponse(body: unknown, status = 200): Response {
+	return {
+		ok: status >= 200 && status < 300,
+		status,
+		statusText: status === 200 ? "OK" : "Error",
+		json: () => Promise.resolve(body),
+	} as Response;
+}
+
+describe("fetchWithCache", () => {
+	beforeEach(() => {
+		clearFetchCache();
+	});
+
+	it("returns fetched data on cache miss", async () => {
+		const data = { id: 1, name: "product" };
+		const doFetch = vi.fn(() => Promise.resolve(mockResponse(data)));
+
+		const result = await fetchWithCache("key1", doFetch);
+		expect(result).toEqual(data);
+		expect(doFetch).toHaveBeenCalledOnce();
+	});
+
+	it("returns cached data on subsequent calls", async () => {
+		const data = { id: 1 };
+		const doFetch = vi.fn(() => Promise.resolve(mockResponse(data)));
+
+		await fetchWithCache("key2", doFetch);
+		const result = await fetchWithCache("key2", doFetch);
+
+		expect(result).toEqual(data);
+		expect(doFetch).toHaveBeenCalledOnce();
+	});
+
+	it("deduplicates in-flight requests", async () => {
+		const data = { id: 1 };
+		const doFetch = vi.fn(
+			() => new Promise<Response>((resolve) => setTimeout(() => resolve(mockResponse(data)), 10)),
+		);
+
+		const [r1, r2] = await Promise.all([
+			fetchWithCache("key3", doFetch),
+			fetchWithCache("key3", doFetch),
+		]);
+
+		expect(r1).toEqual(data);
+		expect(r2).toEqual(data);
+		expect(doFetch).toHaveBeenCalledOnce();
+	});
+
+	it("throws on 5xx responses", async () => {
+		const doFetch = vi.fn(() => Promise.resolve(mockResponse(null, 500)));
+
+		await expect(fetchWithCache("key4", doFetch)).rejects.toThrow("500");
+	});
+
+	it("returns null for 404 responses", async () => {
+		const doFetch = vi.fn(() => Promise.resolve(mockResponse(null, 404)));
+
+		const result = await fetchWithCache("key5", doFetch);
+		expect(result).toBeNull();
+	});
+
+	it("tracks cache stats", async () => {
+		const doFetch = () => Promise.resolve(mockResponse({ ok: true }));
+
+		expect(getFetchCacheStats()).toEqual({ entries: 0, inflight: 0 });
+
+		await fetchWithCache("stats1", doFetch);
+		await fetchWithCache("stats2", doFetch);
+
+		expect(getFetchCacheStats()).toEqual({ entries: 2, inflight: 0 });
+	});
+
+	it("clears cache", async () => {
+		const doFetch = () => Promise.resolve(mockResponse({ ok: true }));
+		await fetchWithCache("clear1", doFetch);
+
+		clearFetchCache();
+		expect(getFetchCacheStats()).toEqual({ entries: 0, inflight: 0 });
+	});
+
+	it("evicts the inflight slot when the fetch never settles", async () => {
+		vi.useFakeTimers();
+		try {
+			// `doFetch` returns a Promise that never resolves — simulates a hung
+			// VTEX subrequest (TCP open, no FIN, no response). Without the
+			// timeout guard, the inflight Map entry would leak forever and
+			// subsequent callers would `await` a zombie Promise — the prod
+			// memory-leak this fix addresses.
+			const doFetch = vi.fn(() => new Promise<Response>(() => {}));
+
+			const pending = fetchWithCache("hung-key", doFetch);
+			// Swallow the eventual rejection so the unhandled rejection doesn't
+			// fail the test runner.
+			pending.catch(() => {});
+
+			expect(getFetchCacheStats().inflight).toBe(1);
+
+			// Fast-forward past the 10s fetch timeout.
+			await vi.advanceTimersByTimeAsync(11_000);
+
+			await expect(pending).rejects.toThrow(/timed out/);
+			expect(getFetchCacheStats().inflight).toBe(0);
+		} finally {
+			vi.useRealTimers();
+		}
+	});
+});