@decocms/apps-wake 7.66.0

package/src/utils/graphql.ts

@@ -0,0 +1,88 @@
+import { type FetchFn, withFetchTimeout } from "@decocms/blocks/sdk/fetchTimeout";
+import type { InstrumentedFetchInit } from "@decocms/blocks/sdk/instrumentedFetch";
+import { extractGraphqlOperationName } from "./graphqlOperationName";
+
+/**
+ * Tagged-template helper that composes a GraphQL document string.
+ * Kept identical to the Deno `gql` so the ported `graphql/queries.ts`
+ * (which defines `{ fragments, query }` objects) works verbatim.
+ */
+export function gql(strings: TemplateStringsArray, ...values: unknown[]): string {
+  return strings.reduce((acc, str, i) => acc + str + (values[i] ?? ""), "");
+}
+
+export interface QueryDefinition {
+  fragments?: string[];
+  query: string;
+}
+
+export function buildQuery(def: QueryDefinition): string {
+  const fragments = def.fragments?.join("\n") ?? "";
+  return fragments ? `${fragments}\n${def.query}` : def.query;
+}
+
+export interface GraphQLClient {
+  /**
+   * Run a GraphQL operation. `extraHeaders` is merged over the client's
+   * base headers for the single call — Wake loaders use it to forward the
+   * client IP (`X-Forwarded-For`) via `parseHeaders(...)`.
+   */
+  query<T>(
+    query: string | QueryDefinition,
+    variables?: Record<string, unknown>,
+    extraHeaders?: Record<string, string>,
+  ): Promise<T>;
+}
+
+export function createGraphqlClient(
+  endpoint: string,
+  headers: Record<string, string>,
+  fetchFn?: FetchFn,
+): GraphQLClient {
+  const _fetch = fetchFn ?? withFetchTimeout();
+  return {
+    async query<T>(
+      queryOrDef: string | QueryDefinition,
+      variables?: Record<string, unknown>,
+      extraHeaders?: Record<string, string>,
+    ): Promise<T> {
+      const query = typeof queryOrDef === "string" ? queryOrDef : buildQuery(queryOrDef);
+
+      // Stamp the GraphQL operation as init.operation so the framework's
+      // span name becomes `wake.<OperationName>` instead of the generic
+      // `wake.storefront.graphql` from the URL router. The extra field is
+      // silently dropped by plain `fetch` and read by any `InstrumentedFetch`
+      // configured via `setWakeFetch`.
+      const operation = extractGraphqlOperationName(query);
+      const init: InstrumentedFetchInit = {
+        method: "POST",
+        headers: {
+          // Per-call `extraHeaders` (e.g. forwarded client IP) come first so
+          // they can never override the app's auth token or Content-Type.
+          ...extraHeaders,
+          "Content-Type": "application/json",
+          ...headers,
+        },
+        body: JSON.stringify({ query, variables }),
+        ...(operation ? { operation } : {}),
+      };
+      const response = await _fetch(endpoint, init);
+
+      if (!response.ok) {
+        throw new Error(`Wake GraphQL error: ${response.status} ${response.statusText}`);
+      }
+
+      const json = (await response.json()) as { data?: T; errors?: Array<{ message: string }> };
+
+      if (json.errors?.length) {
+        throw new Error(`Wake GraphQL errors: ${json.errors.map((e) => e.message).join(", ")}`);
+      }
+
+      if (json.data === undefined) {
+        throw new Error("Wake GraphQL response missing data");
+      }
+
+      return json.data;
+    },
+  };
+}

package/src/utils/graphqlOperationName.ts

@@ -0,0 +1,67 @@
+/**
+ * Extract a semantic operation name from a GraphQL document.
+ *
+ * Used at the Shopify GraphQL client layer to stamp `init.operation`
+ * on the outbound fetch. The framework then suffixes the integration
+ * name (`shopify.<operation>`) onto the span and uses the same string
+ * as the `fetch.operation` attribute + histogram label.
+ *
+ * Resolution order:
+ *
+ *   1. An explicit `operationName` argument (e.g. when the client
+ *      received one alongside a multi-operation document) wins.
+ *   2. If the document has exactly one named operation, that name
+ *      is used.
+ *   3. If the document has zero or many anonymous operations, we
+ *      return `undefined` so the caller can fall back (typically to
+ *      the URL-derived `storefront.graphql` / `admin.graphql`).
+ *
+ * The parser is deliberately a small regex pass, not a full GraphQL
+ * tokenizer:
+ *
+ *   - GraphQL operation definitions live at the top level of the
+ *     document, never nested inside other operations, fragments, or
+ *     selection sets, so positional context isn't required to find
+ *     them — only to not match the literal words `query` /
+ *     `mutation` / `subscription` inside string values.
+ *   - We strip block strings (`""" … """`), string literals
+ *     (`"…"`), and `# …` comments before matching, which is enough
+ *     to make false-positive matches inside comments / docs vanish.
+ *
+ * If a Shopify operation is ever sufficiently mis-named to break
+ * this (unlikely, since the storefront SDK names them deliberately),
+ * the caller can always set `init.operation` explicitly.
+ */
+
+const OPERATION_RE = /\b(?:query|mutation|subscription)\s+([A-Za-z_][A-Za-z0-9_]*)/g;
+
+const stripCommentsAndStrings = (doc: string): string =>
+  doc
+    .replace(/"""[\s\S]*?"""/g, '""')
+    .replace(/"(?:\\.|[^"\\])*"/g, '""')
+    .replace(/#[^\n]*/g, "");
+
+export function extractGraphqlOperationName(
+  document: string,
+  explicit?: string,
+): string | undefined {
+  if (explicit) return explicit;
+  if (!document) return undefined;
+
+  const stripped = stripCommentsAndStrings(document);
+  const names: string[] = [];
+
+  OPERATION_RE.lastIndex = 0;
+  for (
+    let match = OPERATION_RE.exec(stripped);
+    match !== null;
+    match = OPERATION_RE.exec(stripped)
+  ) {
+    const [, name] = match;
+    if (name) names.push(name);
+    if (names.length > 1) break;
+  }
+
+  if (names.length === 1) return names[0];
+  return undefined;
+}

package/src/utils/httpError.ts

@@ -0,0 +1,15 @@
+/**
+ * Minimal HTTP error carrying a status code.
+ *
+ * The Deno Wake app threw `HttpError` from `deco/utils/http.ts`; in this
+ * architecture actions just throw `Error`, so this local class preserves the
+ * `.status` field that some callers/handlers inspect.
+ */
+export class HttpError extends Error {
+  status: number;
+  constructor(status: number, message?: string) {
+    super(message ?? `HTTP ${status}`);
+    this.name = "HttpError";
+    this.status = status;
+  }
+}

package/src/utils/instrumentedFetch.ts

@@ -0,0 +1,46 @@
+/**
+ * Pre-wired instrumented fetch factory for Wake. Mirrors
+ * `apps-shopify/utils/instrumentedFetch.ts`.
+ *
+ * Bundles `createInstrumentedFetch` (spans, traceparent, URL redaction), the
+ * `wakeOperationRouter` URL fallback, and an `onComplete` that records the
+ * canonical `http.client.request.duration` histogram with `provider: "wake"`.
+ *
+ * Sites do:
+ * ```ts
+ * import { setWakeFetch, createWakeFetch } from "@decocms/apps-wake";
+ * setWakeFetch(createWakeFetch());
+ * ```
+ */
+
+import type { FetchFn } from "@decocms/blocks/sdk/fetchTimeout";
+import {
+  createInstrumentedFetch,
+  type InstrumentedFetch,
+} from "@decocms/blocks/sdk/instrumentedFetch";
+import { recordCommerceMetric } from "@decocms/blocks/sdk/observability";
+import { wakeOperationRouter } from "./operationRouter";
+
+export interface CreateWakeFetchOptions {
+  baseFetch?: FetchFn;
+  disableHistogram?: boolean;
+}
+
+export function createWakeFetch(options: CreateWakeFetchOptions = {}): InstrumentedFetch {
+  const { baseFetch, disableHistogram = false } = options;
+  return createInstrumentedFetch({
+    name: "wake",
+    baseFetch,
+    resolveOperation: wakeOperationRouter,
+    onComplete: disableHistogram
+      ? undefined
+      : ({ operation, status, durationMs, cached }) => {
+          recordCommerceMetric(durationMs, {
+            provider: "wake",
+            operation,
+            status_class: `${Math.floor(status / 100)}xx`,
+            cached,
+          });
+        },
+  });
+}

package/src/utils/operationRouter.ts

@@ -0,0 +1,51 @@
+/**
+ * URL-derived operation name router for Wake API calls.
+ *
+ * Plugged into `@decocms/blocks`'s `createInstrumentedFetch` via the
+ * `resolveOperation(url, method)` option. Wake's API surface here is the
+ * GraphQL storefront (`/graphql`) plus a couple of checkout REST endpoints.
+ * The semantic GraphQL operation name is extracted from the document itself
+ * (see `./graphqlOperationName.ts`) and stamped as `init.operation`, which
+ * always wins over this router; this router is the fallback.
+ */
+
+type OperationResolver = string | ((match: RegExpMatchArray, method: string) => string);
+
+interface Matcher {
+  pattern: RegExp;
+  operation: OperationResolver;
+}
+
+const m = (pattern: RegExp, operation: OperationResolver): Matcher => ({ pattern, operation });
+
+const MATCHERS: ReadonlyArray<Matcher> = [
+  m(/^\/graphql/, "storefront.graphql"),
+  m(/^\/api\/Login\/Get/, "checkout.login"),
+  m(/^\/api\/carrinho/, "checkout.cart"),
+  m(/^\/api\//, "checkout.api"),
+  m(/^\/Sitemap\.xml/i, "sitemap"),
+];
+
+/**
+ * Resolve an operation name for a Wake URL. Returns `undefined` if no matcher
+ * fires, which causes the framework to fall back to `wake.fetch`.
+ */
+export function wakeOperationRouter(url: string, method: string): string | undefined {
+  let pathname: string;
+  try {
+    pathname = new URL(url).pathname;
+  } catch {
+    const qs = url.indexOf("?");
+    const hash = url.indexOf("#");
+    const end = [qs, hash].filter((i) => i >= 0).sort((a, b) => a - b)[0];
+    pathname = end === undefined ? url : url.slice(0, end);
+  }
+
+  const upperMethod = method.toUpperCase();
+  for (const { pattern, operation } of MATCHERS) {
+    const match = pathname.match(pattern);
+    if (!match) continue;
+    return typeof operation === "function" ? operation(match, upperMethod) : operation;
+  }
+  return undefined;
+}

package/src/utils/parseHeaders.ts

@@ -0,0 +1,19 @@
+export const getClientIP = (headers: Headers) => {
+  const cfConnectingIp = headers.get("cf-connecting-ip");
+  const xForwardedFor = headers.get("x-forwarded-for");
+
+  if (cfConnectingIp) return cfConnectingIp;
+
+  return xForwardedFor;
+};
+
+/**
+ * Build a headers bag that forwards the originating client IP to Wake.
+ * Passed per-call into the storefront GraphQL client.
+ */
+export const parseHeaders = (headers: Headers): Record<string, string> => {
+  const clientIP = getClientIP(headers);
+  const out: Record<string, string> = {};
+  if (clientIP) out["X-Forwarded-For"] = clientIP;
+  return out;
+};

package/src/utils/partner.ts

@@ -0,0 +1,34 @@
+import { getCookies, setCookie } from "./cookies";
+import { isSecureRequest } from "./requestCtx";
+
+const PARTNER_COOKIE = "partner-token";
+
+const TEN_DAYS_MS = 10 * 24 * 3600 * 1_000;
+
+export const getPartnerCookie = (headers: Headers): string | undefined => {
+  const cookies = getCookies(headers);
+
+  return cookies[PARTNER_COOKIE];
+};
+
+export const setPartnerCookie = (headers: Headers, partnerToken: string) =>
+  setCookie(headers, {
+    name: PARTNER_COOKIE,
+    value: partnerToken,
+    path: "/",
+    expires: new Date(Date.now() + TEN_DAYS_MS),
+    // Server-only token — nothing client-side reads it.
+    httpOnly: true,
+    // Secure only on HTTPS — a Secure cookie is dropped over http:// (localhost dev).
+    secure: isSecureRequest(),
+    sameSite: "Lax",
+  });
+
+export const deletePartnerCookie = (headers: Headers) =>
+  setCookie(headers, {
+    name: PARTNER_COOKIE,
+    value: "",
+    path: "/",
+    expires: new Date(0),
+    maxAge: 0,
+  });

package/src/utils/requestCtx.ts

@@ -0,0 +1,41 @@
+import { RequestContext } from "@decocms/blocks/sdk/requestContext";
+import { parseHeaders } from "./parseHeaders";
+
+/**
+ * Request-scoped helpers bridging the Deno `(req, ctx)` convention to this
+ * architecture's `RequestContext` singleton. Loaders/actions read the active
+ * request's URL/cookies and write Set-Cookie via these.
+ */
+
+export const currentRequest = (): Request | null => RequestContext.current?.request ?? null;
+
+export const currentUrl = (): URL => new URL(currentRequest()?.url ?? "https://localhost");
+
+export const currentRequestHeaders = (): Headers => currentRequest()?.headers ?? new Headers();
+
+export const currentResponseHeaders = (): Headers =>
+  RequestContext.current?.responseHeaders ?? new Headers();
+
+/** Client-IP forwarding headers for the storefront GraphQL call. */
+export const forwardedHeaders = (): Record<string, string> => {
+  const req = currentRequest();
+  return req ? parseHeaders(req.headers) : {};
+};
+
+/**
+ * Whether the active request is HTTPS — drives the `Secure` cookie flag.
+ * A `Secure` cookie is rejected by browsers over plain HTTP (e.g. localhost
+ * dev), so cookies must only be marked Secure on real HTTPS requests. Defaults
+ * to `true` when the request is unknown (prod-safety).
+ */
+export const isSecureRequest = (): boolean => {
+  const req = currentRequest();
+  if (!req) return true;
+  try {
+    const proto = req.headers.get("x-forwarded-proto");
+    if (proto) return proto.split(",")[0].trim() === "https";
+    return new URL(req.url).protocol === "https:";
+  } catch {
+    return true;
+  }
+};