@decocms/blocks-admin 7.77.5 → 7.77.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks-admin",
-  "version": "7.77.5",
+  "version": "7.77.7",
   "type": "module",
   "description": "Deco admin protocol: /live/_meta, /.decofile, /deco/invoke, /deco/render, plus admin-facing site setup and commerce-app auto-configuration",
   "repository": {
@@ -25,7 +25,7 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.77.5"
+    "@decocms/blocks": "7.77.7"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/admin/invoke.test.ts

@@ -14,14 +14,10 @@
  * Set-Cookie headers (readable via `response.headers.getSetCookie()`).
  */
 
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { clearDraftCache, loadBlocks, setBlocks } from "@decocms/blocks/cms";
 import { RequestContext } from "@decocms/blocks/sdk/requestContext";
-import {
-  clearInvokeHandlers,
-  handleInvoke,
-  registerInvokeHandlers,
-} from "./invoke";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { clearInvokeHandlers, handleInvoke, registerInvokeHandlers } from "./invoke";
 
 const COOKIE_A = "checkout.vtex.com__orderFormId=of-123; Path=/; HttpOnly";
 const COOKIE_B = "segment=eyJjYW1wYWlnbnMiOiJ4In0=; Path=/; HttpOnly";
@@ -58,9 +54,7 @@ describe("handleInvoke — Set-Cookie propagation (single)", () => {
     });
 
     const request = makeInvokeRequest("vtex/actions/addItemsToCart");
-    const response = await RequestContext.run(request, () =>
-      handleInvoke(request),
-    );
+    const response = await RequestContext.run(request, () => handleInvoke(request));
 
     const cookies = response.headers.getSetCookie();
     expect(cookies).toHaveLength(3);
@@ -79,9 +73,7 @@ describe("handleInvoke — Set-Cookie propagation (single)", () => {
     });
 
     const request = makeInvokeRequest("vtex/actions/foo");
-    const response = await RequestContext.run(request, () =>
-      handleInvoke(request),
-    );
+    const response = await RequestContext.run(request, () => handleInvoke(request));
 
     // The regressed bug appended a single comma-joined string, so
     // `getSetCookie()` returned a 1-element array. The fix appends each
@@ -98,9 +90,7 @@ describe("handleInvoke — Set-Cookie propagation (single)", () => {
     });
 
     const request = makeInvokeRequest("vtex/actions/withHeader");
-    const response = await RequestContext.run(request, () =>
-      handleInvoke(request),
-    );
+    const response = await RequestContext.run(request, () => handleInvoke(request));
     expect(response.headers.get("x-vtex-trace-id")).toBe("abc-123");
   });
 
@@ -110,9 +100,7 @@ describe("handleInvoke — Set-Cookie propagation (single)", () => {
     });
 
     const request = makeInvokeRequest("vtex/loaders/productList");
-    const response = await RequestContext.run(request, () =>
-      handleInvoke(request),
-    );
+    const response = await RequestContext.run(request, () => handleInvoke(request));
     expect(response.headers.getSetCookie()).toEqual([]);
   });
 });
@@ -139,9 +127,7 @@ describe("handleInvoke — Set-Cookie propagation (batch)", () => {
       "vtex/actions/addItemsToCart": { orderFormId: "x" },
       "vtex/loaders/productList": {},
     });
-    const response = await RequestContext.run(request, () =>
-      handleInvoke(request),
-    );
+    const response = await RequestContext.run(request, () => handleInvoke(request));
 
     const cookies = response.headers.getSetCookie();
     expect(cookies).toHaveLength(3);
@@ -165,8 +151,7 @@ describe("handleInvoke — draft binding", () => {
     clearDraftCache();
     setBlocks({ "site/x": { value: "published" } });
     registerInvokeHandlers({
-      "site/loaders/x.ts": async () =>
-        (loadBlocks() as Record<string, any>)["site/x"],
+      "site/loaders/x.ts": async () => (loadBlocks() as Record<string, any>)["site/x"],
     });
   });
   afterEach(() => {
@@ -177,14 +162,11 @@ describe("handleInvoke — draft binding", () => {
   });
 
   function invokeReq(headers: Record<string, string>): Request {
-    return new Request(
-      "https://preview.example/deco/invoke/site/loaders/x.ts",
-      {
-        method: "POST",
-        headers: { "content-type": "application/json", ...headers },
-        body: "{}",
-      },
-    );
+    return new Request("https://preview.example/deco/invoke/site/loaders/x.ts", {
+      method: "POST",
+      headers: { "content-type": "application/json", ...headers },
+      body: "{}",
+    });
   }
 
   it("resolves loaders against the DRAFT when the request carries an allowed draft cookie", async () => {
@@ -197,8 +179,7 @@ describe("handleInvoke — draft binding", () => {
     const res = await handleInvoke(
       invokeReq({
         "x-forwarded-host": "preview.example",
-        cookie:
-          "__deco_draft=studio.decocms.com/api/o/decofile/m/main%3Ftoken%3Dt@vX",
+        cookie: "__deco_draft=studio.decocms.com/api/o/decofile/m/main%3Ftoken%3Dt@vX",
       }),
     );
     expect(await res.json()).toEqual({ value: "draft" });
@@ -212,9 +193,7 @@ describe("handleInvoke — draft binding", () => {
       return new Response("{}");
     }) as unknown as typeof fetch;
 
-    const res = await handleInvoke(
-      invokeReq({ "x-forwarded-host": "preview.example" }),
-    );
+    const res = await handleInvoke(invokeReq({ "x-forwarded-host": "preview.example" }));
     expect(await res.json()).toEqual({ value: "published" });
     expect(called).toBe(false);
   });
@@ -229,10 +208,49 @@ describe("handleInvoke — draft binding", () => {
     const res = await handleInvoke(
       invokeReq({
         "x-forwarded-host": "prod.example",
-        cookie:
-          "__deco_draft=studio.decocms.com/api/o/decofile/m/main%3Ftoken%3Dt@vX",
+        cookie: "__deco_draft=studio.decocms.com/api/o/decofile/m/main%3Ftoken%3Dt@vX",
       }),
     );
     expect(await res.json()).toEqual({ value: "published" });
   });
 });
+
+describe("handleInvoke — malformed JSON body", () => {
+  const seen: unknown[] = [];
+  beforeEach(() => {
+    seen.length = 0;
+    clearInvokeHandlers();
+    registerInvokeHandlers({
+      "site/loaders/echo.ts": async (props: unknown) => {
+        seen.push(props);
+        return { ok: true };
+      },
+    });
+  });
+
+  const post = (body: string, headers: Record<string, string>) =>
+    new Request("http://localhost/deco/invoke/site/loaders/echo.ts", {
+      method: "POST",
+      headers,
+      body,
+    });
+
+  it("answers 400 Invalid JSON for a declared-JSON body that does not parse, without running the handler", async () => {
+    const res = await handleInvoke(post("{not json", { "content-type": "application/json" }));
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({ error: "Invalid JSON" });
+    expect(seen).toEqual([]);
+  });
+
+  it("treats an empty declared-JSON body as no props", async () => {
+    const res = await handleInvoke(post("", { "content-type": "application/json" }));
+    expect(res.status).toBe(200);
+    expect(seen).toEqual([{}]);
+  });
+
+  it("stays lenient without a JSON content-type (try-json: {} on failure)", async () => {
+    const res = await handleInvoke(post("{not json", {}));
+    expect(res.status).toBe(200);
+    expect(seen).toEqual([{}]);
+  });
+});

package/src/admin/invoke.ts

@@ -95,13 +95,11 @@ function forwardCtxHeadersTo(response: Response): void {
 }
 
 const isDev =
-  typeof globalThis.process !== "undefined" &&
-  globalThis.process.env?.NODE_ENV === "development";
+  typeof globalThis.process !== "undefined" && globalThis.process.env?.NODE_ENV === "development";
 
 function selectFields(data: unknown, select?: string[]): unknown {
   if (!select?.length || !data || typeof data !== "object") return data;
-  if (Array.isArray(data))
-    return data.map((item) => selectFields(item, select));
+  if (Array.isArray(data)) return data.map((item) => selectFields(item, select));
   const result: Record<string, unknown> = {};
   for (const key of select) {
     if (key in (data as Record<string, unknown>)) {
@@ -133,9 +131,7 @@ async function parseBody(request: Request): Promise<any> {
       for (const [key, value] of formData.entries()) {
         if (obj[key] !== undefined) {
           // Multiple values → array
-          const existing = Array.isArray(obj[key])
-            ? (obj[key] as unknown[])
-            : [obj[key]];
+          const existing = Array.isArray(obj[key]) ? (obj[key] as unknown[]) : [obj[key]];
           existing.push(value);
           obj[key] = existing;
         } else {
@@ -162,14 +158,30 @@ async function parseBody(request: Request): Promise<any> {
     return {};
   }
 
-  // JSON (default for POST)
+  // JSON (default for POST). An empty body is `{}` (a bodiless POST is a
+  // legitimate "no props" call). A body that DECLARES itself JSON but does
+  // not parse is a client bug, not "no props": running the handler with `{}`
+  // would silently execute an action without its input. Mirrors
+  // deco-runtime's `json` parsing strategy, which throws on invalid JSON
+  // instead of swallowing it. Without an explicit JSON content-type the
+  // lenient `try-json` behavior stays (`{}` on failure).
+  const text = await request.text();
+  if (text.trim() === "") return {};
   try {
-    return await request.json();
+    return JSON.parse(text);
   } catch {
+    if (contentType.includes("application/json")) throw new InvalidJsonBody();
     return {};
   }
 }
 
+/** Thrown by `parseBody` for a declared-JSON body that does not parse → 400. */
+class InvalidJsonBody extends Error {
+  constructor() {
+    super("Invalid JSON");
+  }
+}
+
 function findHandler(
   key: string,
 ): { handler: InvokeLoader | InvokeAction; type: "loader" | "action" } | null {
@@ -244,7 +256,13 @@ async function dispatchInvoke(request: Request): Promise<Response> {
   const invokeKey = pathParts[1] || "";
   const select = url.searchParams.get("select")?.split(",").filter(Boolean);
 
-  const body = await parseBody(request);
+  let body: any;
+  try {
+    body = await parseBody(request);
+  } catch (error) {
+    if (error instanceof InvalidJsonBody) return errorResponse(error.message, 400);
+    throw error;
+  }
 
   // Single invoke by key
   if (invokeKey) {
@@ -274,12 +292,7 @@ async function dispatchInvoke(request: Request): Promise<Response> {
   }
 
   // Batch invoke
-  if (
-    request.method === "POST" &&
-    body &&
-    typeof body === "object" &&
-    !Array.isArray(body)
-  ) {
+  if (request.method === "POST" && body && typeof body === "object" && !Array.isArray(body)) {
     const results: Record<string, unknown> = {};
 
     const entries = Object.entries(body as Record<string, unknown>);