@decocms/apps-vtex 8.1.0-next.0 → 8.1.0-next.1

package/src/schemas.ts

@@ -1,30 +0,0 @@
-/**
- * Registers the real props schemas for VTEX loaders/actions into the CMS
- * schema registry, so `GET /deco/meta` publishes full props forms (enums,
- * titles, required) instead of the `__resolveType`-only stubs that
- * registerCommerceLoaders() auto-registers.
- *
- * The schemas come from `schemas.gen.ts`, generated at build time by
- * @decocms/blocks-cli's generate-app-schemas.ts (`bun run generate:schemas`)
- * — Props are TypeScript types, erased at runtime, so extraction cannot
- * happen in the site.
- *
- * Called from every server entrypoint a site can wire VTEX through
- * (createVtexCommerceLoaders, mod.configure). Idempotent; real schemas also
- * take precedence over stubs inside the registry, so call order relative to
- * registerCommerceLoaders() doesn't matter.
- */
-import { registerAppSchemas } from "@decocms/blocks/cms/client";
-import { actionSchemas, loaderSchemas } from "./schemas.gen";
-
-let registered = false;
-
-export function registerVtexSchemas(): void {
-	if (registered) return;
-	registered = true;
-	registerAppSchemas({
-		namespace: "vtex",
-		loaders: loaderSchemas,
-		actions: actionSchemas,
-	});
-}

package/src/types.ts

@@ -1,248 +0,0 @@
-/**
- * VTEX Checkout / OrderForm types.
- * These mirror the VTEX Checkout API response shapes.
- * Aligned with deco-cx/apps vtex/utils/types.ts
- */
-
-export interface OrderFormItem {
-	id: string;
-	productId: string;
-	productRefId?: string;
-	refId?: string;
-	ean?: string | null;
-	name: string;
-	skuName: string;
-	imageUrl: string;
-	detailUrl: string;
-	price: number;
-	listPrice: number;
-	manualPrice?: number | null;
-	quantity: number;
-	sellingPrice: number;
-	rewardValue?: number;
-	isGift?: boolean;
-	tax?: number;
-	seller: string;
-	sellerChain?: string[];
-	uniqueId: string;
-	parentItemIndex?: number | null;
-	parentAssemblyBinding?: string | null;
-	availability?: string;
-	measurementUnit?: string;
-	unitMultiplier?: number;
-	productCategoryIds?: string;
-	productCategories?: Record<string, string>;
-	additionalInfo?: {
-		brandName?: string;
-		brandId?: string;
-		dimension?: Record<string, string> | null;
-		offeringInfo?: unknown | null;
-		offeringType?: unknown | null;
-		offeringTypeId?: unknown | null;
-	};
-	attachments?: unknown[];
-	attachmentOfferings?: Array<{
-		name: string;
-		required: boolean;
-		schema: Record<string, unknown>;
-	}>;
-	offerings?: Array<{
-		type: string;
-		id: string;
-		name: string;
-		price: number;
-	}>;
-	priceTags?: Array<{
-		name: string;
-		value: number;
-		rawValue: number;
-		isPercentual: boolean;
-		identifier: string | null;
-	}>;
-	components?: unknown[];
-	bundleItems?: unknown[];
-	priceDefinition?: {
-		calculatedSellingPrice: number;
-		total: number;
-		sellingPrices: Array<{
-			value: number;
-			quantity: number;
-		}>;
-	};
-}
-
-export interface Totalizer {
-	id: string;
-	name: string;
-	value: number;
-}
-
-export interface Message {
-	code: string;
-	text: string;
-	status: string;
-	fields?: Record<string, string>;
-}
-
-export interface MarketingData {
-	utmSource?: string;
-	utmMedium?: string;
-	utmCampaign?: string;
-	utmiPage?: string;
-	utmiPart?: string;
-	utmiCampaign?: string;
-	coupon?: string;
-	marketingTags?: string[];
-}
-
-export interface ClientProfileData {
-	email: string;
-	firstName?: string | null;
-	lastName?: string | null;
-	document?: string | null;
-	phone?: string | null;
-	corporateName?: string | null;
-	isCorporate?: boolean;
-}
-
-export interface StorePreferencesData {
-	countryCode: string;
-	saveUserData?: boolean;
-	timeZone?: string;
-	currencyCode: string;
-	currencyLocale?: number;
-	currencySymbol: string;
-	currencyFormatInfo?: {
-		currencyDecimalDigits: number;
-		currencyDecimalSeparator: string;
-		currencyGroupSeparator: string;
-		currencyGroupSize: number;
-		startsWithCurrencySymbol: boolean;
-	};
-}
-
-export interface ClientPreferencesData {
-	locale: string;
-	optinNewsLetter?: boolean;
-}
-
-export interface ShippingData {
-	address?: {
-		postalCode?: string;
-		city?: string;
-		state?: string;
-		country?: string;
-		street?: string;
-		number?: string;
-		neighborhood?: string;
-		complement?: string;
-		reference?: string;
-	} | null;
-	selectedAddresses?: Array<{
-		postalCode?: string;
-		city?: string;
-		state?: string;
-		country?: string;
-	}>;
-	logisticsInfo?: Array<{
-		itemIndex: number;
-		selectedSla?: string;
-		selectedDeliveryChannel?: string;
-		slas?: Sla[];
-	}>;
-}
-
-export interface PaymentData {
-	updateStatus?: string;
-	installmentOptions?: unknown[];
-	paymentSystems?: unknown[];
-	payments?: unknown[];
-	giftCards?: unknown[];
-	availableAccounts?: unknown[];
-}
-
-export interface OrderForm {
-	orderFormId: string;
-	salesChannel: string;
-	loggedIn: boolean;
-	isCheckedIn: boolean;
-	storeId?: unknown | null;
-	checkedInPickupPointId?: unknown | null;
-	allowManualPrice: boolean;
-	canEditData: boolean;
-	userProfileId?: unknown | null;
-	userType?: unknown | null;
-	ignoreProfileData: boolean;
-	value: number;
-	messages: Message[];
-	items: OrderFormItem[];
-	selectableGifts?: unknown[];
-	totalizers: Totalizer[];
-	shippingData: ShippingData | null;
-	clientProfileData: ClientProfileData | null;
-	paymentData: PaymentData | null;
-	marketingData: MarketingData | null;
-	sellers?: Array<{ id: string; name: string; logo?: string }>;
-	clientPreferencesData?: ClientPreferencesData | null;
-	commercialConditionData?: unknown | null;
-	storePreferencesData?: StorePreferencesData | null;
-	giftRegistryData?: unknown | null;
-	openTextField?: unknown | null;
-	invoiceData?: unknown | null;
-	customData?: unknown | null;
-	itemMetadata?: unknown | null;
-	hooksData?: unknown | null;
-	ratesAndBenefitsData?: {
-		rateAndBenefitsIdentifiers?: unknown[];
-		teaser?: unknown[];
-	} | null;
-	subscriptionData?: unknown | null;
-	merchantContextData?: unknown | null;
-	itemsOrdination?: unknown | null;
-}
-
-export interface SimulationOrderForm {
-	items: Array<{
-		id: string;
-		quantity: number;
-		seller: string;
-		price?: number;
-		listPrice?: number;
-		offerings?: any[];
-		priceTags?: any[];
-		availability?: string;
-	}>;
-	logisticsInfo?: Array<{
-		itemIndex: number;
-		slas: Sla[];
-		selectedSla?: string;
-		selectedDeliveryChannel?: string;
-	}>;
-	paymentData?: {
-		installmentOptions?: any[];
-	};
-}
-
-export interface Sla {
-	id: string;
-	name: string;
-	price: number;
-	shippingEstimate: string;
-	deliveryChannel?: string;
-}
-
-export interface SKU {
-	id: string;
-	seller: string;
-	quantity: number;
-}
-
-export interface VtexProduct {
-	productId: string;
-	productName: string;
-	brand: string;
-	categoryId: string;
-	categories: string[];
-	items: any[];
-	[key: string]: any;
-}

package/src/utils/__tests__/cartProjection.test.ts

@@ -1,118 +0,0 @@
-/**
- * Tests for `projectOrderForm` — the server-side fragmentation of a VTEX
- * OrderForm into the requested `CartProjection`. Pure function, no I/O.
- */
-
-import type { Minicart } from "@decocms/apps-commerce/types";
-import { describe, expect, it } from "vitest";
-import type { OrderForm } from "../../types";
-import { projectOrderForm } from "../cartProjection";
-
-function makeOrderForm(overrides: Partial<OrderForm> = {}): OrderForm {
-  return {
-    orderFormId: "of-123",
-    salesChannel: "1",
-    loggedIn: false,
-    isCheckedIn: false,
-    allowManualPrice: false,
-    canEditData: true,
-    ignoreProfileData: false,
-    value: 15000, // R$150.00 in cents
-    messages: [],
-    items: [
-      {
-        id: "sku-1",
-        productId: "prod-1",
-        name: "Camiseta",
-        skuName: "Camiseta P Azul",
-        imageUrl: "http://img.example/x.jpg",
-        detailUrl: "/camiseta/p",
-        price: 10000,
-        listPrice: 12000,
-        sellingPrice: 10000,
-        quantity: 1,
-        seller: "1",
-        uniqueId: "u1",
-      },
-      {
-        id: "sku-2",
-        productId: "prod-2",
-        name: "Boné",
-        skuName: "Boné U Preto",
-        imageUrl: "https://img.example/y.jpg",
-        detailUrl: "/bone/u",
-        price: 5000,
-        listPrice: 5000,
-        sellingPrice: 5000,
-        quantity: 2,
-        seller: "1",
-        uniqueId: "u2",
-      },
-    ],
-    totalizers: [
-      { id: "Items", name: "Items", value: 20000 },
-      { id: "Discounts", name: "Discounts", value: -5000 },
-    ],
-    shippingData: null,
-    clientProfileData: null,
-    paymentData: null,
-    marketingData: null,
-    ...overrides,
-  } as OrderForm;
-}
-
-describe("projectOrderForm", () => {
-  it("none → { ok: true } and discards the payload", () => {
-    expect(projectOrderForm(makeOrderForm(), "none")).toEqual({ ok: true });
-  });
-
-  it("summary → orderFormId, summed quantities, total in major units", () => {
-    const r = projectOrderForm(makeOrderForm(), "summary") as {
-      orderFormId: string;
-      totalItems: number;
-      total: number;
-    };
-    expect(r.orderFormId).toBe("of-123");
-    expect(r.totalItems).toBe(3); // 1 + 2
-    expect(r.total).toBe(150); // 15000 cents → 150
-  });
-
-  it("summary+items → summary plus slim, https-normalized items", () => {
-    const r = projectOrderForm(makeOrderForm(), "summary+items") as {
-      totalItems: number;
-      items: Array<{ item_name: string; image: string; price: number; quantity: number }>;
-    };
-    expect(r.totalItems).toBe(3);
-    expect(r.items).toHaveLength(2);
-    expect(r.items[0]).toMatchObject({
-      item_name: "Camiseta",
-      item_variant: "Camiseta P Azul",
-      image: "https://img.example/x.jpg", // http → https
-      price: 100, // 10000 cents
-      quantity: 1,
-    });
-    // slim projection must NOT leak the full VTEX item fields
-    expect(r.items[0]).not.toHaveProperty("uniqueId");
-  });
-
-  it("minicart → canonical Minicart with major-unit totals", () => {
-    const r = projectOrderForm(makeOrderForm(), "minicart") as Minicart<OrderForm>;
-    expect(r.storefront.items).toHaveLength(2);
-    expect(r.storefront.total).toBe(150);
-    expect(r.original.orderFormId).toBe("of-123");
-  });
-
-  it("raw → the untouched OrderForm", () => {
-    const of = makeOrderForm();
-    expect(projectOrderForm(of, "raw")).toBe(of);
-  });
-
-  it("summary handles an empty cart without NaN", () => {
-    const r = projectOrderForm(
-      makeOrderForm({ items: [], value: 0, totalizers: [] }),
-      "summary",
-    ) as { totalItems: number; total: number };
-    expect(r.totalItems).toBe(0);
-    expect(r.total).toBe(0);
-  });
-});

package/src/utils/__tests__/cookieSanitizer.test.ts

@@ -1,162 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import {
-	_resetCookieWarnDedupForTests,
-	extractVtexCookies,
-	sanitizeOutboundCookieHeader,
-	VTEX_COOKIE_PREFIXES,
-	warnDroppedCookies,
-} from "../cookieSanitizer";
-
-describe("sanitizeOutboundCookieHeader", () => {
-	it("returns empty result for empty input", () => {
-		expect(sanitizeOutboundCookieHeader("")).toEqual({ cookies: "", dropped: [] });
-	});
-
-	it("preserves a clean ASCII cookie header unchanged in content", () => {
-		const raw = "checkout.vtex.com=__ofid=abc; vtex_segment=eyJ0b2tlbiI6IjEyMyJ9";
-		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw);
-		expect(dropped).toEqual([]);
-		expect(cookies).toBe("checkout.vtex.com=__ofid=abc; vtex_segment=eyJ0b2tlbiI6IjEyMyJ9");
-	});
-
-	it("drops a cookie whose value contains non-ASCII bytes — a production VTEX storefront repro", () => {
-		// `á` is the UTF-8 encoding of `á` interpreted as Latin-1 — bytes 0xC3 0xA1.
-		// VTEX's janus gateway returns 503 deterministically when this reaches it.
-		const raw = "checkout.vtex.com=__ofid=abc; category_click=Eletroportáteis; vtex_segment=ok";
-		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw);
-		expect(cookies).toBe("checkout.vtex.com=__ofid=abc; vtex_segment=ok");
-		expect(dropped).toEqual([{ name: "category_click", reason: "non_ascii" }]);
-	});
-
-	it("drops cookies with raw multi-byte UTF-8 characters", () => {
-		const { cookies, dropped } = sanitizeOutboundCookieHeader(
-			"checkout.vtex.com=ok; pref=日本語; analytics=tracked",
-		);
-		expect(cookies).toBe("checkout.vtex.com=ok; analytics=tracked");
-		expect(dropped).toEqual([{ name: "pref", reason: "non_ascii" }]);
-	});
-
-	it("treats malformed pairs (no `=`, blank name) as dropped", () => {
-		const { cookies, dropped } = sanitizeOutboundCookieHeader("justaname; =headless; ok=1; ;");
-		expect(cookies).toBe("ok=1");
-		expect(dropped.map((d) => d.reason)).toEqual(["malformed", "malformed"]);
-	});
-
-	it("preserves URL-encoded values containing `=` signs (JWT-shaped tokens)", () => {
-		const raw =
-			"VtexIdclientAutCookie=eyJhbGciOiJSUzI1NiIs.eyJzdWIiOiJxIn0.signature; CheckoutOrderFormOwnership=Vk1B%3D%3D";
-		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw);
-		expect(dropped).toEqual([]);
-		expect(cookies).toBe(raw);
-	});
-
-	it("rejects cookie names with separators (e.g. spaces) as malformed", () => {
-		const { dropped } = sanitizeOutboundCookieHeader("bad name=v; ok=1");
-		expect(dropped[0]).toEqual({ name: "bad name", reason: "malformed" });
-	});
-
-	it("trims surrounding whitespace between pairs", () => {
-		const { cookies } = sanitizeOutboundCookieHeader("  a=1 ;   b=2 ;c=3  ");
-		expect(cookies).toBe("a=1; b=2; c=3");
-	});
-
-	it("preserves cookie order across the input", () => {
-		const { cookies } = sanitizeOutboundCookieHeader("a=1; b=2; c=3; d=4");
-		expect(cookies).toBe("a=1; b=2; c=3; d=4");
-	});
-
-	it("with allowlist=true keeps only VTEX-prefixed cookies and reports the rest", () => {
-		const raw =
-			"FPID=abc; checkout.vtex.com=__ofid=xyz; _ga=tracking; vtex_segment=eyJ9; CheckoutOrderFormOwnership=token; __cf_bm=cf";
-		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw, { allowlist: true });
-		expect(cookies).toBe(
-			"checkout.vtex.com=__ofid=xyz; vtex_segment=eyJ9; CheckoutOrderFormOwnership=token",
-		);
-		expect(dropped.map((d) => d.name).sort()).toEqual(["FPID", "__cf_bm", "_ga"]);
-		expect(dropped.every((d) => d.reason === "not_in_allowlist")).toBe(true);
-	});
-
-	it("allowlist mode still drops a VTEX-prefixed cookie that has a non-ASCII value", () => {
-		const raw = "vtex_segment=okãvalue; checkout.vtex.com=ok";
-		const { cookies, dropped } = sanitizeOutboundCookieHeader(raw, { allowlist: true });
-		expect(cookies).toBe("checkout.vtex.com=ok");
-		expect(dropped).toEqual([{ name: "vtex_segment", reason: "non_ascii" }]);
-	});
-
-	it("VTEX_COOKIE_PREFIXES covers the cookies VTEX actions actually depend on", () => {
-		// Sanity check — if anyone removes one of these, every action that
-		// depends on it will silently 401/redirect on production.
-		for (const required of [
-			"VtexIdclientAutCookie",
-			"checkout.vtex.com",
-			"CheckoutOrderFormOwnership",
-			"vtex_session",
-			"vtex_segment",
-		]) {
-			expect(VTEX_COOKIE_PREFIXES).toContain(required);
-		}
-	});
-});
-
-describe("extractVtexCookies (allowlist convenience wrapper)", () => {
-	it("matches sanitizeOutboundCookieHeader(_, { allowlist: true })", () => {
-		const raw =
-			"FPID=abc; checkout.vtex.com=__ofid=xyz; category_click=Eletroportáteis; vtex_segment=ok";
-		expect(extractVtexCookies(raw)).toBe(
-			sanitizeOutboundCookieHeader(raw, { allowlist: true }).cookies,
-		);
-	});
-
-	it("returns empty string for empty input", () => {
-		expect(extractVtexCookies("")).toBe("");
-	});
-});
-
-describe("warnDroppedCookies", () => {
-	beforeEach(() => {
-		_resetCookieWarnDedupForTests();
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("emits one console.warn per dropped cookie with structured fields", () => {
-		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
-		warnDroppedCookies(
-			[
-				{ name: "category_click", reason: "non_ascii" },
-				{ name: "_ga", reason: "not_in_allowlist" },
-			],
-			"acct.vtexcommercestable.com.br",
-		);
-		expect(warn).toHaveBeenCalledTimes(2);
-		expect(warn.mock.calls[0]?.[0]).toMatch(
-			/host=acct\.vtexcommercestable\.com\.br name=category_click reason=non_ascii/,
-		);
-		expect(warn.mock.calls[1]?.[0]).toMatch(/name=_ga reason=not_in_allowlist/);
-	});
-
-	it("dedupes repeated drops of the same name+reason+host within the isolate lifetime", () => {
-		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
-		const drop = [{ name: "category_click", reason: "non_ascii" as const }];
-		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
-		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
-		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
-		expect(warn).toHaveBeenCalledTimes(1);
-	});
-
-	it("does not dedupe across different hosts", () => {
-		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
-		const drop = [{ name: "category_click", reason: "non_ascii" as const }];
-		warnDroppedCookies(drop, "acct.vtexcommercestable.com.br");
-		warnDroppedCookies(drop, "secure.example.com.br");
-		expect(warn).toHaveBeenCalledTimes(2);
-	});
-
-	it("is a no-op when nothing was dropped", () => {
-		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
-		warnDroppedCookies([], "any.host");
-		expect(warn).not.toHaveBeenCalled();
-	});
-});

package/src/utils/__tests__/fetch.test.ts

@@ -1,80 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { fetchAPI, fetchSafe, HttpError } from "../fetch";
-
-const realFetch = globalThis.fetch;
-
-function mockResponse(body: unknown, status = 200): Response {
-	return {
-		ok: status >= 200 && status < 300,
-		status,
-		statusText: status === 200 ? "OK" : "Error",
-		url: "https://example.com",
-		json: () => Promise.resolve(body),
-	} as Response;
-}
-
-describe("fetchSafe", () => {
-	beforeEach(() => {
-		globalThis.fetch = vi.fn() as unknown as typeof fetch;
-	});
-
-	afterEach(() => {
-		globalThis.fetch = realFetch;
-	});
-
-	it("returns the response on 2xx", async () => {
-		(globalThis.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(mockResponse({ ok: true }));
-		const res = await fetchSafe("https://example.com/api");
-		expect(res.status).toBe(200);
-	});
-
-	it("throws HttpError on non-2xx", async () => {
-		(globalThis.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(mockResponse({}, 500));
-		await expect(fetchSafe("https://example.com/api")).rejects.toBeInstanceOf(HttpError);
-	});
-
-	it("sanitizes utm_* and map params (drops <, > and non-Latin1)", async () => {
-		const fetchMock = globalThis.fetch as ReturnType<typeof vi.fn>;
-		fetchMock.mockResolvedValue(mockResponse({}));
-
-		await fetchSafe("https://example.com/api?utm_source=<script>café</script>&keep=ok");
-
-		const callArg = fetchMock.mock.calls[0]?.[0] as string;
-		expect(callArg).toContain("utm_source=script");
-		expect(callArg).not.toContain("<");
-		expect(callArg).not.toContain("café");
-		expect(callArg).toContain("keep=ok");
-	});
-
-	it("forwards init options to fetch", async () => {
-		const fetchMock = globalThis.fetch as ReturnType<typeof vi.fn>;
-		fetchMock.mockResolvedValue(mockResponse({}));
-
-		await fetchSafe("https://example.com/api", {
-			method: "POST",
-			headers: { "x-test": "1" },
-		});
-
-		const init = fetchMock.mock.calls[0]?.[1] as RequestInit;
-		expect(init.method).toBe("POST");
-		expect((init.headers as Record<string, string>)["x-test"]).toBe("1");
-	});
-});
-
-describe("fetchAPI", () => {
-	beforeEach(() => {
-		globalThis.fetch = vi.fn() as unknown as typeof fetch;
-	});
-
-	afterEach(() => {
-		globalThis.fetch = realFetch;
-	});
-
-	it("parses JSON on success", async () => {
-		(globalThis.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-			mockResponse({ hello: "world" }),
-		);
-		const data = await fetchAPI<{ hello: string }>("https://example.com/api");
-		expect(data).toEqual({ hello: "world" });
-	});
-});