@decocms/apps-vtex 8.0.0 → 8.1.0-next.1

package/src/utils/accountLoaders.ts

@@ -1,203 +0,0 @@
-/**
- * Pre-built section loaders for VTEX account pages.
- *
- * Every VTEX site with account pages repeats the same pattern:
- * 1. Extract VTEX cookies from request
- * 2. Call the VTEX user/profile/address/payment API
- * 3. Return enriched props with { device, logged, ...data }
- * 4. Catch errors gracefully (return logged: false)
- *
- * These factories encapsulate that boilerplate.
- *
- * @example
- * ```ts
- * import { vtexAccountLoaders } from "@decocms/apps/vtex/utils/accountLoaders";
- *
- * registerSectionLoaders({
- *   "site/sections/Account/PersonalData.tsx": vtexAccountLoaders.personalData(),
- *   "site/sections/Account/MyOrders.tsx":     vtexAccountLoaders.orders(),
- *   "site/sections/Account/Cards.tsx":        vtexAccountLoaders.cards(),
- *   "site/sections/Account/Addresses.tsx":    vtexAccountLoaders.addresses(),
- *   "site/sections/Account/Auth.tsx":         vtexAccountLoaders.authentication(),
- *   "site/sections/Account/Other.tsx":        vtexAccountLoaders.loggedIn(),
- * });
- * ```
- */
-
-import { detectDevice } from "@decocms/blocks/sdk/useDevice";
-import { getUserAddresses, type VtexAddress } from "../loaders/address";
-import { getUserPayments, type Payment } from "../loaders/payment";
-import { getCurrentProfile, type Profile } from "../loaders/profile";
-import { getUser } from "../loaders/user";
-import { getVtexCookies } from "./cookies";
-
-type Device = "mobile" | "tablet" | "desktop";
-
-type SectionLoaderFn = (
-	props: Record<string, unknown>,
-	req: Request,
-) => Promise<Record<string, unknown>> | Record<string, unknown>;
-
-function getDevice(req: Request): Device {
-	return detectDevice(req.headers.get("user-agent") ?? "");
-}
-
-// ---------------------------------------------------------------------------
-// personalData — fetches full VTEX profile for personal data sections
-// ---------------------------------------------------------------------------
-
-export interface PersonalDataOptions {
-	/** Extra custom profile fields to request beyond the standard set. */
-	extraProfileFields?: string[];
-
-	/**
-	 * Transform the raw VTEX Profile into the shape your component expects.
-	 * When omitted, the raw Profile object is returned as `profile`.
-	 *
-	 * @example
-	 * ```ts
-	 * vtexAccountLoaders.personalData({
-	 *   mapProfile: (p) => ({
-	 *     "@id": p.userId ?? p.id,
-	 *     email: p.email,
-	 *     givenName: p.firstName ?? null,
-	 *     familyName: p.lastName ?? null,
-	 *     taxID: p.document,
-	 *   }),
-	 * })
-	 * ```
-	 */
-	mapProfile?: (profile: Profile) => Record<string, unknown>;
-}
-
-function personalData(options?: PersonalDataOptions): SectionLoaderFn {
-	const { extraProfileFields, mapProfile } = options ?? {};
-	return async (props, req) => {
-		const cookie = getVtexCookies(req);
-		try {
-			const profile = await getCurrentProfile(cookie, extraProfileFields);
-			const data = mapProfile ? mapProfile(profile) : profile;
-			return {
-				...props,
-				device: getDevice(req),
-				logged: !!profile,
-				loading: false,
-				userData: data,
-			};
-		} catch (error) {
-			console.error("[accountLoaders.personalData]", error);
-			return { ...props, device: getDevice(req), logged: false, loading: false, userData: null };
-		}
-	};
-}
-
-// ---------------------------------------------------------------------------
-// orders — checks login status for order listing sections
-// ---------------------------------------------------------------------------
-
-function orders(): SectionLoaderFn {
-	return async (props, req) => {
-		const cookie = getVtexCookies(req);
-		try {
-			const userData = await getUser(cookie);
-			return { ...props, device: getDevice(req), logged: !!userData };
-		} catch {
-			return { ...props, device: getDevice(req), logged: false };
-		}
-	};
-}
-
-// ---------------------------------------------------------------------------
-// cards — fetches saved payment tokens for card management sections
-// ---------------------------------------------------------------------------
-
-function cards(): SectionLoaderFn {
-	return async (props, req) => {
-		const cookie = getVtexCookies(req);
-		try {
-			const user = await getUser(cookie);
-			const logged = !!user;
-			let payments: Payment[] = [];
-			if (logged) {
-				try {
-					payments = (await getUserPayments(cookie)) ?? [];
-				} catch {
-					payments = [];
-				}
-			}
-			return { ...props, logged, payments };
-		} catch {
-			return { ...props, logged: false, payments: [] };
-		}
-	};
-}
-
-// ---------------------------------------------------------------------------
-// addresses — fetches address list for address management sections
-// ---------------------------------------------------------------------------
-
-function addresses(): SectionLoaderFn {
-	return async (props, req) => {
-		const cookie = getVtexCookies(req);
-		try {
-			const userData = await getUser(cookie);
-			const logged = !!userData;
-			let userAddressData: VtexAddress[] | null = null;
-			if (logged) {
-				try {
-					userAddressData = await getUserAddresses(cookie);
-				} catch {
-					userAddressData = null;
-				}
-			}
-			return { ...props, device: getDevice(req), logged, userAddressData };
-		} catch {
-			return { ...props, device: getDevice(req), logged: false, userAddressData: null };
-		}
-	};
-}
-
-// ---------------------------------------------------------------------------
-// authentication — checks login + returns user data for auth pages
-// ---------------------------------------------------------------------------
-
-function authentication(): SectionLoaderFn {
-	return async (props, req) => {
-		const cookie = getVtexCookies(req);
-		try {
-			const userData = await getUser(cookie);
-			return { ...props, device: getDevice(req), logged: !!userData, userData };
-		} catch {
-			return { ...props, device: getDevice(req), logged: false, userData: null };
-		}
-	};
-}
-
-// ---------------------------------------------------------------------------
-// loggedIn — generic "is the user logged in?" loader
-// ---------------------------------------------------------------------------
-
-function loggedIn(): SectionLoaderFn {
-	return async (props, req) => {
-		const cookie = getVtexCookies(req);
-		try {
-			const userData = await getUser(cookie);
-			return { ...props, device: getDevice(req), logged: !!userData };
-		} catch {
-			return { ...props, device: getDevice(req), logged: false };
-		}
-	};
-}
-
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
-export const vtexAccountLoaders = {
-	personalData,
-	orders,
-	cards,
-	addresses,
-	authentication,
-	loggedIn,
-} as const;

package/src/utils/authHelpers.ts

@@ -1,85 +0,0 @@
-/**
- * VTEX auth helpers — pure functions for cookie extraction, JWT parsing,
- * Set-Cookie forwarding, and logout.
- *
- * These are consumed by site-level createServerFn wrappers in invoke.ts.
- * createServerFn itself must live in site source (not node_modules) because
- * TanStack Start's Vite plugin only transforms source files.
- */
-import { getVtexConfig, getVtexFetch } from "../client";
-import { extractVtexCookies } from "./cookieSanitizer";
-
-const DOMAIN_RE = /;\s*domain=[^;]*/gi;
-
-/**
- * Extract VTEX-relevant cookies from a raw Cookie header string.
- *
- * Strict allowlist: drops any cookie not on `VTEX_COOKIE_PREFIXES`, plus
- * any cookie whose value contains non-ASCII bytes (which would otherwise
- * make VTEX's janus gateway return 503 Service Unavailable). Both filters
- * live in `./cookieSanitizer` — this is a thin compatibility wrapper.
- */
-export function extractVtexCookiesFromHeader(raw: string): string {
-	return extractVtexCookies(raw);
-}
-
-/**
- * Strip Domain= from Set-Cookie headers so cookies are associated
- * with the storefront domain instead of the VTEX domain.
- */
-export function stripCookieDomain(cookies: string[]): string[] {
-	return cookies.map((c) => c.replace(DOMAIN_RE, ""));
-}
-
-/** Standard VTEX cookies to expire on logout. */
-export const VTEX_LOGOUT_COOKIES = [
-	"checkout.vtex.com=; Path=/; Max-Age=0; Secure; HttpOnly; SameSite=Lax",
-	"CheckoutOrderFormOwnership=; Path=/; Max-Age=0; Secure; HttpOnly; SameSite=Lax",
-	"checkout.vtex.com__orderFormId=; Path=/; Max-Age=0",
-	"vtex_session=; Path=/; Max-Age=0",
-	"vtex_segment=; Path=/; Max-Age=0",
-];
-
-/**
- * Perform VTEX logout — calls the VTEX ID logout endpoint and returns
- * the Set-Cookie headers (with domain stripped) to expire auth cookies.
- */
-export async function performVtexLogout(cookies: string): Promise<{ setCookies: string[] }> {
-	const config = getVtexConfig();
-	const domain = config.domain ?? "com.br";
-	const logoutUrl = `https://${config.account}.vtexcommercestable.${domain}/api/vtexid/pub/logout?scope=${config.account}&returnUrl=/`;
-
-	const res = await getVtexFetch()(logoutUrl, {
-		method: "GET",
-		headers: { cookie: cookies },
-		redirect: "manual",
-		operation: "vtexid.logout",
-	});
-
-	const upstreamCookies = res.headers.getSetCookie?.() ?? [];
-
-	return {
-		setCookies: [...stripCookieDomain(upstreamCookies), ...VTEX_LOGOUT_COOKIES],
-	};
-}
-
-/**
- * Parse VTEX auth JWT to extract email and userId.
- * Reads the VtexIdclientAutCookie_* cookie from a raw Cookie header.
- */
-export function parseVtexAuthJwt(rawCookies: string): { email: string; userId: string } | null {
-	try {
-		const match = rawCookies.match(/VtexIdclientAutCookie_[^=]+=([^;]+)/);
-		if (!match) return null;
-		const token = match[1];
-		const parts = token.split(".");
-		if (parts.length < 2) return null;
-		const payload = JSON.parse(
-			Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf-8"),
-		);
-		if (!payload.sub) return null;
-		return { email: payload.sub, userId: payload.userId ?? "" };
-	} catch {
-		return null;
-	}
-}

package/src/utils/batch.ts

@@ -1,18 +0,0 @@
-export const batch = <T>(iterable: IterableIterator<T> | T[], size: number): T[][] => {
-	const batches: T[][] = [];
-
-	let current = 0;
-	for (const item of iterable) {
-		if (batches[current]?.length === size) {
-			current++;
-		}
-
-		if (!batches[current]) {
-			batches[current] = [];
-		}
-
-		batches[current].push(item);
-	}
-
-	return batches;
-};

package/src/utils/cartProjection.ts

@@ -1,96 +0,0 @@
-/**
- * Project a VTEX OrderForm down to a requested `CartProjection`.
- *
- * The VTEX checkout API always returns the whole OrderForm from mutation
- * endpoints (bounded only by `expectedOrderFormSections`) — there is no
- * delta/patch response. So "return the minimum" is enforced **server-side**:
- * we take whatever VTEX gave us and shape it into `none` / `summary` /
- * `summary+items` / `minicart` / `raw` before it reaches the browser.
- *
- * Pure function — no I/O, fully unit-testable. All monetary values in the
- * projected output are in major units (VTEX is cents).
- *
- * @see `@decocms/apps-commerce/types/cart` for the agnostic contract.
- */
-
-import type {
-  CartItemSlim,
-  CartOk,
-  CartProjection,
-  CartSummary,
-  CartSummaryWithItems,
-  Minicart,
-} from "@decocms/apps-commerce/types";
-import type { OrderForm, OrderFormItem } from "../types";
-import { type VtexOrderFormToMinicartOptions, vtexOrderFormToMinicart } from "./minicart";
-
-const CENTS_PER_MAJOR = 100;
-
-function fromCents(cents: number | undefined | null): number {
-  if (cents == null || !Number.isFinite(cents)) return 0;
-  return cents / CENTS_PER_MAJOR;
-}
-
-/** Sum of line quantities. */
-function countItems(orderForm: OrderForm): number {
-  return (orderForm.items ?? []).reduce((sum, i) => sum + (i.quantity ?? 0), 0);
-}
-
-function toSummary(orderForm: OrderForm): CartSummary {
-  return {
-    orderFormId: orderForm.orderFormId ?? null,
-    totalItems: countItems(orderForm),
-    total: fromCents(orderForm.value),
-  };
-}
-
-/** Map a VTEX line to the slim, analytics-compatible `CartItemSlim`. */
-function toSlimItem(item: OrderFormItem): CartItemSlim {
-  return {
-    item_id: item.id,
-    item_name: item.name ?? item.skuName ?? "",
-    item_variant: item.skuName,
-    image: item.imageUrl?.replace(/^http:/, "https:") ?? "",
-    price: fromCents(item.sellingPrice ?? item.price),
-    quantity: item.quantity,
-  };
-}
-
-export type ProjectOrderFormOptions = VtexOrderFormToMinicartOptions;
-
-/** The projected result type, with VTEX-concrete `minicart`/`raw` payloads. */
-export type VtexCartProjectionResult =
-  | CartOk
-  | CartSummary
-  | CartSummaryWithItems
-  | Minicart<OrderForm>
-  | OrderForm;
-
-/**
- * Shape a VTEX OrderForm into the requested projection.
- *
- * @param orderForm - Raw OrderForm from a VTEX checkout call.
- * @param projection - Desired client-facing shape.
- * @param opts - Storefront overrides forwarded to the `minicart` projection.
- */
-export function projectOrderForm(
-  orderForm: OrderForm,
-  projection: CartProjection,
-  opts: ProjectOrderFormOptions = {},
-): VtexCartProjectionResult {
-  switch (projection) {
-    case "none":
-      return { ok: true };
-    case "summary":
-      return toSummary(orderForm);
-    case "summary+items":
-      return {
-        ...toSummary(orderForm),
-        items: (orderForm.items ?? []).map(toSlimItem),
-      };
-    case "minicart":
-      return vtexOrderFormToMinicart(orderForm, opts);
-    case "raw":
-      return orderForm;
-  }
-}

package/src/utils/cookies.ts

@@ -1,167 +0,0 @@
-interface Cookie {
-	name: string;
-	value: string;
-	domain?: string;
-	path?: string;
-	expires?: Date;
-	maxAge?: number;
-	secure?: boolean;
-	httpOnly?: boolean;
-	sameSite?: "Strict" | "Lax" | "None";
-}
-
-function parseSingleSetCookie(raw: string): Cookie | null {
-	const parts = raw.split(";").map((p) => p.trim());
-	const [nameValue, ...attrs] = parts;
-	const eqIdx = nameValue.indexOf("=");
-	if (eqIdx < 0) return null;
-	const cookie: Cookie = {
-		name: nameValue.slice(0, eqIdx),
-		value: nameValue.slice(eqIdx + 1),
-	};
-	for (const attr of attrs) {
-		const eqi = attr.indexOf("=");
-		const k = (eqi >= 0 ? attr.slice(0, eqi) : attr).trim();
-		const v = eqi >= 0 ? attr.slice(eqi + 1).trim() : "";
-		const lower = k.toLowerCase();
-		if (lower === "domain") cookie.domain = v;
-		else if (lower === "path") cookie.path = v;
-		else if (lower === "secure") cookie.secure = true;
-		else if (lower === "httponly") cookie.httpOnly = true;
-		else if (lower === "samesite") cookie.sameSite = v as Cookie["sameSite"];
-		else if (lower === "max-age") {
-			const n = Number(v);
-			if (!Number.isNaN(n)) cookie.maxAge = n;
-		} else if (lower === "expires") {
-			const d = new Date(v);
-			if (!Number.isNaN(d.getTime())) cookie.expires = d;
-		}
-	}
-	return cookie;
-}
-
-/**
- * Extract individual Set-Cookie values from a Headers object.
- *
- * Uses Headers.getSetCookie() (available in Cloudflare Workers and Node 18+)
- * which returns each Set-Cookie as a separate string — unlike Headers.get()
- * or Headers.forEach() which join multiple values with ", " and corrupt
- * cookie strings that contain commas in Expires dates.
- */
-function getSetCookies(headers: Headers): Cookie[] {
-	const rawCookies: string[] =
-		typeof headers.getSetCookie === "function"
-			? headers.getSetCookie()
-			: getRawSetCookiesFallback(headers);
-
-	const cookies: Cookie[] = [];
-	for (const raw of rawCookies) {
-		const cookie = parseSingleSetCookie(raw);
-		if (cookie) cookies.push(cookie);
-	}
-	return cookies;
-}
-
-/**
- * Fallback for runtimes without Headers.getSetCookie().
- * Splits the comma-joined string heuristically — not perfect for cookies
- * with Expires containing commas, but better than the old approach.
- */
-function getRawSetCookiesFallback(headers: Headers): string[] {
-	const joined = headers.get("set-cookie");
-	if (!joined) return [];
-	const results: string[] = [];
-	let current = "";
-	for (const segment of joined.split(",")) {
-		const trimmed = segment.trimStart();
-		const looksLikeNewCookie = /^[^=;]+=[^;]/.test(trimmed) && current.length > 0;
-		if (looksLikeNewCookie) {
-			results.push(current.trim());
-			current = trimmed;
-		} else {
-			current += (current ? "," : "") + segment;
-		}
-	}
-	if (current.trim()) results.push(current.trim());
-	return results;
-}
-
-function setCookie(headers: Headers, cookie: Cookie): void {
-	let str = `${cookie.name}=${cookie.value}`;
-	if (cookie.domain) str += `; Domain=${cookie.domain}`;
-	if (cookie.path) str += `; Path=${cookie.path}`;
-	if (cookie.secure) str += "; Secure";
-	if (cookie.httpOnly) str += "; HttpOnly";
-	if (cookie.sameSite) str += `; SameSite=${cookie.sameSite}`;
-	if (cookie.maxAge != null) str += `; Max-Age=${cookie.maxAge}`;
-	if (cookie.expires) str += `; Expires=${cookie.expires.toUTCString()}`;
-	headers.append("Set-Cookie", str);
-}
-
-export const stringify = (cookies: Record<string, string>) =>
-	Object.entries(cookies)
-		.map(([key, value]) => `${key}=${value}`)
-		.join("; ");
-
-export const proxySetCookie = (from: Headers, to: Headers, toDomain?: URL | string) => {
-	const newDomain = toDomain && new URL(toDomain);
-
-	for (const cookie of getSetCookies(from)) {
-		const newCookie = newDomain
-			? {
-					...cookie,
-					domain: newDomain.hostname,
-				}
-			: cookie;
-
-		setCookie(to, newCookie);
-	}
-};
-
-export const CHECKOUT_DATA_ACCESS_COOKIE = "CheckoutDataAccess";
-export const VTEX_CHKO_AUTH = "Vtex_CHKO_Auth";
-
-// Re-export the canonical allowlist from cookieSanitizer so consumers that
-// previously imported it from this module keep working. The single source
-// of truth lives in cookieSanitizer.ts.
-export { VTEX_COOKIE_PREFIXES } from "./cookieSanitizer";
-
-import { extractVtexCookies } from "./cookieSanitizer";
-
-/**
- * Filter a request's cookies to only VTEX-relevant ones.
- *
- * Strict allowlist: drops any cookie not on `VTEX_COOKIE_PREFIXES` plus any
- * cookie whose value contains non-ASCII bytes (which would make VTEX's
- * janus gateway return 503).
- */
-export function getVtexCookies(request: Request): string {
-	return extractVtexCookies(request.headers.get("cookie") ?? "");
-}
-
-/**
- * Ensure the unsuffixed VtexIdclientAutCookie is present alongside the
- * account-suffixed variant (e.g. VtexIdclientAutCookie_myaccount).
- *
- * VTEX GraphQL requires both the suffixed AND unsuffixed cookie for
- * authenticated mutations. The browser only stores the suffixed variant,
- * so server-side code must synthesize the unsuffixed one.
- */
-export function ensureUnsuffixedAuthCookie(cookieStr: string): string {
-	if (!cookieStr) return cookieStr;
-	const cookies = cookieStr.split(";").map((c) => c.trim());
-	let hasUnsuffixed = false;
-	let suffixedToken: string | null = null;
-	for (const c of cookies) {
-		const [name, ...rest] = c.split("=");
-		if (name === "VtexIdclientAutCookie") {
-			hasUnsuffixed = true;
-		} else if (name?.startsWith("VtexIdclientAutCookie_") && !suffixedToken) {
-			suffixedToken = rest.join("=");
-		}
-	}
-	if (!hasUnsuffixed && suffixedToken) {
-		return `VtexIdclientAutCookie=${suffixedToken}; ${cookieStr}`;
-	}
-	return cookieStr;
-}