@decocms/apps-vtex 8.1.0-next.0 → 8.1.0-next.1

package/src/utils/vtexId.ts

@@ -1,151 +0,0 @@
-/**
- * VTEX authentication cookie parser.
- *
- * Parses the VtexIdclientAutCookie JWT to detect login state
- * without making API calls. Only decodes the payload (no signature
- * verification -- we only need presence and expiry, not auth).
- */
-
-export interface VtexAuthInfo {
-	isLoggedIn: boolean;
-	email?: string;
-	account?: string;
-	/** Unix timestamp (seconds) when the token expires. */
-	exp?: number;
-	/** Whether the token is expired. */
-	isExpired: boolean;
-}
-
-const VTEX_AUTH_COOKIE = "VtexIdclientAutCookie";
-
-/**
- * Extract the VtexIdclientAutCookie value from a cookie string.
- *
- * Matches BOTH the base cookie `VtexIdclientAutCookie=` and the account-suffixed
- * variant `VtexIdclientAutCookie_{account}=`. VTEX frequently sets ONLY the
- * suffixed variant on the storefront domain — matching just the base name makes
- * genuinely logged-in users look anonymous, which defeats any logged-in cache
- * bypass built on top of this and can leak personalized/cached responses.
- */
-export function extractVtexAuthCookie(cookieHeader: string): string | null {
-	const match = cookieHeader.match(
-		new RegExp(`(?:^|;\\s*)${VTEX_AUTH_COOKIE}(?:_[^=;\\s]+)?=([^;]+)`),
-	);
-	return match?.[1] ?? null;
-}
-
-/**
- * Decode a JWT payload without verification.
- * Only reads the middle segment (claims).
- */
-function decodeJwtPayload(token: string): Record<string, unknown> | null {
-	try {
-		const parts = token.split(".");
-		if (parts.length !== 3) return null;
-		const payload = parts[1];
-		const decoded = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
-		return JSON.parse(decoded);
-	} catch {
-		return null;
-	}
-}
-
-/**
- * Parse a VTEX auth cookie token into structured auth info.
- */
-export function parseVtexAuthToken(token: string): VtexAuthInfo {
-	const payload = decodeJwtPayload(token);
-	if (!payload) {
-		// Opaque (non-JWT) token. VTEX auth cookies are frequently opaque strings
-		// rather than JWTs — we cannot read `exp`, but the mere presence of the
-		// cookie means the user IS authenticated. Treating it as logged-out (the
-		// previous behavior) makes real sessions look anonymous and defeats any
-		// logged-in cache bypass. Fail towards "logged in" (i.e. do-not-cache).
-		return { isLoggedIn: true, isExpired: false };
-	}
-
-	const exp = typeof payload.exp === "number" ? payload.exp : undefined;
-	const isExpired = exp != null ? exp * 1000 < Date.now() : false;
-	const email =
-		typeof payload.sub === "string"
-			? payload.sub
-			: typeof payload.userId === "string"
-				? payload.userId
-				: undefined;
-
-	const account = typeof payload.account === "string" ? payload.account : undefined;
-
-	return {
-		isLoggedIn: !isExpired,
-		email,
-		account,
-		exp,
-		isExpired,
-	};
-}
-
-/**
- * Check if a request has a valid (non-expired) VTEX auth cookie.
- */
-export function isVtexLoggedIn(request: Request): boolean {
-	const cookies = request.headers.get("cookie") ?? "";
-	const token = extractVtexAuthCookie(cookies);
-	if (!token) return false;
-	return parseVtexAuthToken(token).isLoggedIn;
-}
-
-/**
- * Build a complete auth cookie header string from either a raw token
- * or an already-formatted cookie string.
- *
- * VTEX requires both `VtexIdclientAutCookie` and the account-suffixed
- * variant `VtexIdclientAutCookie_{account}` for authenticated GraphQL
- * calls to myvtex.com.
- *
- * If `authCookie` already contains `=` (i.e. it's a full cookie string),
- * it's returned as-is. Otherwise the token is wrapped in both cookie names.
- */
-export function buildAuthCookieHeader(authCookie: string, account: string): string {
-	if (authCookie.includes("=")) return authCookie;
-	return `${VTEX_AUTH_COOKIE}=${authCookie}; ${VTEX_AUTH_COOKIE}_${account}=${authCookie}`;
-}
-
-export interface CookiePayload {
-	sub?: string;
-	account?: string;
-	audience?: string;
-	sess?: string;
-	exp?: number;
-	userId?: string;
-}
-
-/**
- * Parse VTEX auth cookies from request headers.
- *
- * Returns the serialized cookie string (for forwarding) and the decoded
- * JWT payload. Compatible with the legacy deco-cx/apps parseCookie API.
- */
-export function parseCookie(
-	headers: Headers,
-	account: string,
-): { cookie: string; payload: CookiePayload | undefined } {
-	const cookieHeader = headers.get("cookie") ?? "";
-
-	const base = extractVtexAuthCookie(cookieHeader);
-	const suffixedRe = new RegExp(`(?:^|;\\s*)${VTEX_AUTH_COOKIE}_${account}=([^;]+)`);
-	const suffixedMatch = cookieHeader.match(suffixedRe);
-	const suffixed = suffixedMatch?.[1] ?? null;
-
-	const token = base ?? suffixed;
-	const payload = token
-		? ((decodeJwtPayload(token) as CookiePayload | null) ?? undefined)
-		: undefined;
-
-	const parts: string[] = [];
-	if (base) parts.push(`${VTEX_AUTH_COOKIE}=${base}`);
-	if (suffixed) parts.push(`${VTEX_AUTH_COOKIE}_${account}=${suffixed}`);
-
-	return { cookie: parts.join("; "), payload };
-}
-
-export { VTEX_AUTH_COOKIE };

package/src/vtexClient.test.ts

@@ -1,204 +0,0 @@
-// @vitest-environment node
-/**
- * The VTEX upstream client (/next/upstream-clients): typed calls over the
- * framework's instrumented fetch, labeled provider "vtex" with a named
- * operation, retries and a circuit breaker on by default, per-shopper inputs
- * as arguments, and errors that carry no body, URL, token or cookie.
- */
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-const instrumented = vi.hoisted(() => ({
-	options: [] as Record<string, unknown>[],
-	operations: [] as (string | undefined)[],
-}));
-
-vi.mock("@decocms/blocks/fetch", async (importActual) => {
-	const actual = await importActual<typeof import("@decocms/blocks/fetch")>();
-	return {
-		...actual,
-		createInstrumentedFetch: (options: Parameters<typeof actual.createInstrumentedFetch>[0]) => {
-			instrumented.options.push(options as unknown as Record<string, unknown>);
-			const request = actual.createInstrumentedFetch(options);
-			return (input: string | URL | Request, init?: RequestInit & { operation?: string }) => {
-				instrumented.operations.push(init?.operation);
-				return request(input, init);
-			};
-		},
-	};
-});
-
-import { createVtexClient, VtexError } from ".";
-
-type Call = { url: string; init: RequestInit };
-
-/** An upstream answering with `statuses` in order, recording each request. */
-function upstream(statuses: number[] = [], headers: Record<string, string | string[]> = {}) {
-	const calls: Call[] = [];
-	const fetch = vi.fn(async (input: string | URL | Request, init: RequestInit = {}) => {
-		calls.push({ url: String(input), init });
-		const response = new Response('{"secret-body":"token-123"}', { status: statuses.shift() ?? 200 });
-		for (const [name, value] of Object.entries(headers)) {
-			for (const v of Array.isArray(value) ? value : [value]) response.headers.append(name, v);
-		}
-		return response;
-	});
-	return { calls, fetch: fetch as unknown as typeof globalThis.fetch };
-}
-
-const header = (call: Call | undefined, name: string) => new Headers(call?.init.headers).get(name);
-
-afterEach(() => {
-	instrumented.options.length = 0;
-	instrumented.operations.length = 0;
-});
-
-describe("createVtexClient", () => {
-	it("uses the instrumented fetch as provider vtex, with retries and a circuit breaker on", () => {
-		createVtexClient({ account: "store" });
-		expect(instrumented.options[0]).toMatchObject({
-			provider: "vtex",
-			retry: { attempts: 2, backoffMs: 150 },
-			circuitBreaker: { failures: 5, cooldownMs: 5000 },
-		});
-	});
-
-	it("turns retries and the circuit breaker off when asked", () => {
-		createVtexClient({ account: "store", retry: false, circuitBreaker: false });
-		expect(instrumented.options[0]?.retry).toBeUndefined();
-		expect(instrumented.options[0]?.circuitBreaker).toBeUndefined();
-	});
-
-	it("searches Intelligent Search with facets, region, locale and sales channel as arguments", async () => {
-		const { calls, fetch } = upstream();
-		const vtex = createVtexClient({
-			account: "store",
-			appKey: "key",
-			appToken: "token",
-			salesChannel: "2",
-			locale: "pt-BR",
-			fetch,
-		});
-		await vtex.search.products({
-			query: "linen shirt",
-			count: 12,
-			facets: [{ key: "category-1", value: "shirts" }],
-			regionId: "v2.ABC",
-		});
-		const url = new URL(calls[0]!.url);
-		expect(url.origin).toBe("https://store.vtexcommercestable.com.br");
-		expect(url.pathname).toBe("/api/io/_v/api/intelligent-search/product_search/category-1/shirts");
-		expect(Object.fromEntries(url.searchParams)).toEqual({
-			query: "linen shirt",
-			count: "12",
-			locale: "pt-BR",
-			regionId: "v2.ABC",
-			sc: "2",
-		});
-		expect(header(calls[0], "x-vtex-api-appkey")).toBe("key");
-		expect(header(calls[0], "x-vtex-api-apptoken")).toBe("token");
-		expect(header(calls[0], "cookie")).toBeNull();
-		expect(instrumented.operations).toEqual(["intelligent-search.product_search"]);
-	});
-
-	it("names every operation from the VTEX API, never a URL", async () => {
-		const { fetch } = upstream();
-		const vtex = createVtexClient({ account: "store", fetch });
-		await vtex.catalog.pageType("/shirts/linen");
-		await vtex.catalog.products({ fq: ["productId:1", "productId:2"], from: 0, to: 9 });
-		await vtex.checkout.simulation({ items: [{ id: "1", quantity: 1, seller: "1" }] });
-		await vtex.checkout.regions({ postalCode: "01000-000", country: "BRA" });
-		await vtex.sessions.get();
-		expect(instrumented.operations).toEqual([
-			"catalog.pagetype",
-			"catalog.products.search",
-			"checkout.simulation",
-			"checkout.regions",
-			"sessions.get",
-		]);
-	});
-
-	it("retries an idempotent call and fails fast once the breaker opens", async () => {
-		const { calls, fetch } = upstream([503, 200]);
-		const vtex = createVtexClient({ account: "store", fetch, retry: { attempts: 1, backoffMs: 0 } });
-		await expect(vtex.catalog.categoryTree()).resolves.toBeDefined();
-		expect(calls).toHaveLength(2);
-
-		const down = upstream([500, 500, 500]);
-		const failing = createVtexClient({
-			account: "store",
-			fetch: down.fetch,
-			retry: false,
-			circuitBreaker: { failures: 2, cooldownMs: 60_000 },
-		});
-		await expect(failing.catalog.categoryTree()).rejects.toBeInstanceOf(VtexError);
-		await expect(failing.catalog.categoryTree()).rejects.toBeInstanceOf(VtexError);
-		await expect(failing.catalog.categoryTree()).rejects.toThrow(/circuit open/);
-		expect(down.calls).toHaveLength(2);
-	});
-
-	it("never retries a cart write", async () => {
-		const { calls, fetch } = upstream([503, 200]);
-		const vtex = createVtexClient({ account: "store", fetch, retry: { attempts: 3, backoffMs: 0 } });
-		await expect(vtex.checkout.addItems("of1", [{ id: 1, quantity: 1, seller: "1" }])).rejects.toThrow(
-			VtexError,
-		);
-		expect(calls).toHaveLength(1);
-	});
-
-	it("forwards the shopper's cookie, sanitized, and hands back VTEX's Set-Cookie values", async () => {
-		const { calls, fetch } = upstream([], {
-			"set-cookie": ["checkout.vtex.com=__ofid=of1; Domain=store.vtexcommercestable.com.br; Path=/"],
-		});
-		const vtex = createVtexClient({ account: "store", appKey: "key", appToken: "token", fetch });
-		const result = await vtex.checkout.orderForm({
-			cookie: "checkout.vtex.com=__ofid=of1; tag=cateçoria",
-		});
-		expect(header(calls[0], "cookie")).toBe("checkout.vtex.com=__ofid=of1");
-		expect(calls[0]?.init.method).toBe("POST");
-		// Every orderForm section, and no app credentials next to a shopper's cookie.
-		expect(calls[0]?.init.body).toBe("{}");
-		expect(header(calls[0], "x-vtex-api-appkey")).toBeNull();
-		expect(header(calls[0], "x-vtex-api-apptoken")).toBeNull();
-		expect(result.setCookies).toEqual([
-			"checkout.vtex.com=__ofid=of1; Domain=store.vtexcommercestable.com.br; Path=/",
-		]);
-		expect(result.data).toEqual({ "secret-body": "token-123" });
-	});
-
-	it("throws errors that carry the operation and status, never the body, URL or credentials", async () => {
-		const { fetch } = upstream([400]);
-		const vtex = createVtexClient({ account: "store", appKey: "key", appToken: "token-123", fetch });
-		const error = await vtex.search.products({ query: "q" }).catch((e: unknown) => e);
-		expect(error).toBeInstanceOf(VtexError);
-		expect(error).toMatchObject({ operation: "intelligent-search.product_search", status: 400 });
-		expect((error as Error).message).toBe("vtex intelligent-search.product_search failed with HTTP 400");
-	});
-
-	it("narrows the orderForm sections only when asked", async () => {
-		const { calls, fetch } = upstream();
-		const vtex = createVtexClient({ account: "store", fetch });
-		await vtex.checkout.orderForm({ sections: ["items", "totalizers"] });
-		expect(calls[0]?.init.body).toBe('{"expectedOrderFormSections":["items","totalizers"]}');
-	});
-
-	it("keeps caller paths inside their endpoint", async () => {
-		const { calls, fetch } = upstream();
-		const vtex = createVtexClient({ account: "store", appKey: "key", appToken: "token", fetch });
-		for (const path of [
-			"../../api/dataentities/CL/search",
-			"/shirts/%2e%2e/%2E%2E/api/dataentities/CL/search",
-			"shirts/./linen",
-		]) {
-			await expect(vtex.catalog.pageType(path)).rejects.toThrow(/invalid path segment/);
-		}
-		await expect(vtex.catalog.products({ term: "a/../../../api/x" })).rejects.toThrow(
-			/invalid path segment/,
-		);
-		expect(calls).toHaveLength(0);
-
-		await vtex.catalog.pageType("/shirts/linen?_where=x#y");
-		const url = new URL(calls[0]!.url);
-		expect(url.pathname).toBe("/api/catalog_system/pub/portal/pagetype/shirts/linen%3F_where%3Dx%23y");
-		expect(url.search).toBe("");
-	});
-});

package/tsconfig.json

@@ -1,7 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "dist"
-  },
-  "include": ["src/**/*"]
-}