@decocms/apps-vtex 7.55.2 → 7.56.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/apps-vtex",
-  "version": "7.55.2",
+  "version": "7.56.0",
   "type": "module",
   "description": "Deco commerce app: VTEX integration",
   "repository": {
@@ -51,10 +51,10 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.55.2",
-    "@decocms/apps-commerce": "7.55.2",
-    "@decocms/apps-website": "7.55.2",
-    "@decocms/tanstack": "7.55.2"
+    "@decocms/blocks": "7.56.0",
+    "@decocms/apps-commerce": "7.56.0",
+    "@decocms/apps-website": "7.56.0",
+    "@decocms/tanstack": "7.56.0"
   },
   "peerDependencies": {
     "@tanstack/react-query": ">=5.0.0",

package/src/middleware.cacheHeaders.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { vtexMiddleware } from "./mod";
+
+/**
+ * The VTEX app middleware wraps the framework's entire edge-cache layer, so it
+ * is the last writer of Cache-Control on every response — including cache HITs.
+ * These tests pin the two things that made that dangerous.
+ */
+
+// A response as the framework's cache layer would hand it over: public headers
+// resolved from the page's cache profile, plus the CDN header.
+function cachedResponse(): Response {
+  return new Response("page", {
+    headers: {
+      "Cache-Control": "public, max-age=120, s-maxage=900, stale-while-revalidate=1800",
+      "CDN-Cache-Control": "public, max-age=900",
+    },
+  });
+}
+
+const next = async () => cachedResponse();
+
+describe("vtexMiddleware cache headers", () => {
+  it("leaves the cache layer's headers alone for an anonymous request", async () => {
+    const res = await vtexMiddleware(new Request("https://store.com/"), next);
+    // Used to be downgraded to vtexCacheControl's generic `s-maxage=60`,
+    // throwing away the profile the cache layer had resolved.
+    expect(res.headers.get("Cache-Control")).toContain("s-maxage=900");
+  });
+
+  it("forces private headers and clears the CDN header when logged in", async () => {
+    const req = new Request("https://store.com/", {
+      // extractVtexContext treats any VtexIdclientAutCookie* as authenticated.
+      headers: { cookie: "VtexIdclientAutCookie_store=abc123" },
+    });
+    const res = await vtexMiddleware(req, next);
+
+    expect(res.headers.get("Cache-Control")).toContain("no-store");
+    // Cloudflare gives CDN-Cache-Control precedence, so leaving the public
+    // value behind would cache a personalized page at the CDN regardless of
+    // the private Cache-Control next to it.
+    expect(res.headers.get("CDN-Cache-Control")).toBeNull();
+  });
+});

package/src/mod.ts

@@ -96,10 +96,26 @@ export interface VtexState {
 // Middleware
 // -------------------------------------------------------------------------
 
-const vtexMiddleware: AppMiddleware = async (request, next) => {
+export const vtexMiddleware: AppMiddleware = async (request, next) => {
 	const ctx = extractVtexContext(request);
 	const response = await next();
-	response.headers.set("Cache-Control", vtexCacheControl(ctx));
+
+	// This middleware wraps the framework's whole edge-cache layer, so it is the
+	// LAST writer of Cache-Control — including on a cache HIT. It used to
+	// overwrite unconditionally, which downgraded a home page the cache layer had
+	// resolved as `s-maxage=900` to vtexCacheControl's generic `s-maxage=60`.
+	//
+	// Now it only speaks up for the case it actually knows better about: a
+	// personalized request, which must not be cached anywhere. And when it does,
+	// it clears CDN-Cache-Control too — otherwise a response can go out as
+	// `Cache-Control: private, no-store` alongside `CDN-Cache-Control: public,
+	// max-age=300`, and Cloudflare gives the CDN header precedence. Same pairing
+	// the worker's own bypasses use, and utils/proxy.ts's hardenProxyCacheHeaders.
+	if (ctx.isLoggedIn || ctx.hasCustomPricing) {
+		response.headers.set("Cache-Control", vtexCacheControl(ctx));
+		response.headers.delete("CDN-Cache-Control");
+	}
+
 	propagateISCookies(ctx, response);
 	return response;
 };