@decocms/blocks 7.55.1 → 7.56.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.55.1",
+  "version": "7.56.0",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/sdk/cacheHeaders.test.ts

@@ -2,7 +2,11 @@ import { describe, expect, it } from "vitest";
 import {
   canonicalizeServerFnPayloadForCacheKey,
   detectCacheProfile,
+  getCacheProfile,
+  registerCachePattern,
+  registerPrivatePaths,
   serverFnPagePath,
+  setCacheProfile,
 } from "./cacheHeaders";
 
 const sfn = (payload: unknown): URL => {
@@ -113,3 +117,89 @@ describe("canonicalizeServerFnPayloadForCacheKey — variant-param cache key", (
     expect(canonicalizeServerFnPayloadForCacheKey("{not json")).toBe("{not json");
   });
 });
+
+describe("detectCacheProfile — private areas", () => {
+  it.each([
+    "/checkout",
+    "/checkout/cart",
+    "/cart",
+    "/carrinho",
+    "/minha-conta",
+    "/meus-pedidos",
+    "/login",
+    "/myaccount",
+  ])("keeps the existing private route %s private", (path) => {
+    expect(detectCacheProfile(path)).toBe("private");
+  });
+
+  it.each([
+    // Every one of these used to fall through to the cacheable `listing`
+    // default. `/listadedesejos` is the one that bit a live store.
+    "/listadedesejos",
+    "/lista-de-desejos",
+    "/wishlist",
+    "/favoritos",
+    "/orders",
+    "/order-placed",
+    "/profile",
+    "/perfil",
+    "/logout",
+    "/sair",
+    "/cadastro",
+    "/signup",
+    "/register",
+    "/assinaturas",
+    "/trocas",
+    "/devolucao",
+  ])("treats %s as private", (path) => {
+    expect(detectCacheProfile(path)).toBe("private");
+  });
+
+  it("matches case-insensitively", () => {
+    expect(detectCacheProfile("/Checkout")).toBe("private");
+    expect(detectCacheProfile("/MINHA-CONTA")).toBe("private");
+  });
+
+  it("matches behind a locale prefix", () => {
+    expect(detectCacheProfile("/pt/checkout")).toBe("private");
+    expect(detectCacheProfile("/pt-br/minha-conta")).toBe("private");
+  });
+
+  it("does not swallow public routes that merely start with two letters", () => {
+    expect(detectCacheProfile("/pt/tenis")).toBe("listing");
+    expect(detectCacheProfile("/carteiras")).toBe("listing");
+    expect(detectCacheProfile("/cartoes-presente")).toBe("listing");
+  });
+
+  it("registerPrivatePaths adds site-specific private routes", () => {
+    expect(detectCacheProfile("/clube-vip")).toBe("listing");
+    registerPrivatePaths(["/clube-vip", "sem-barra"]);
+    expect(detectCacheProfile("/clube-vip")).toBe("private");
+    expect(detectCacheProfile("/clube-vip/beneficios")).toBe("private");
+    expect(detectCacheProfile("/sem-barra")).toBe("private");
+    // prefix match must respect segment boundaries
+    expect(detectCacheProfile("/clube-vip-publico")).toBe("listing");
+  });
+});
+
+describe("cache configuration can tighten, not loosen", () => {
+  it("refuses to make a non-public profile public", () => {
+    setCacheProfile("private", { isPublic: true });
+    expect(getCacheProfile("private").isPublic).toBe(false);
+  });
+
+  it("still allows ordinary tuning of a private profile", () => {
+    setCacheProfile("private", { loader: { fresh: 1_000 } });
+    expect(getCacheProfile("private").loader.fresh).toBe(1_000);
+    expect(getCacheProfile("private").isPublic).toBe(false);
+  });
+
+  it("a custom pattern cannot make a private path public", () => {
+    // A catch-all site pattern used to win over the built-in private check,
+    // because custom patterns are evaluated first.
+    registerCachePattern({ test: () => true, profile: "static" });
+    expect(detectCacheProfile("/checkout")).toBe("private");
+    // ...but it still applies everywhere else.
+    expect(detectCacheProfile("/tenis")).toBe("static");
+  });
+});

package/src/sdk/cacheHeaders.ts

@@ -149,15 +149,45 @@ export function setCacheProfile(
   overrides: CacheProfileOverrides,
 ): void {
   const current = PROFILES[profile];
+
+  // `private`/`cart`/`none` are the profiles that keep authenticated pages off
+  // the shared edge (and, once CDN caching is on, off the CDN). Flipping one to
+  // public is how a checkout page ends up served to another visitor, so it
+  // takes more than an `isPublic: true` in a props bag — see
+  // `allowPublicPrivateProfile`.
+  let isPublic = overrides.isPublic ?? current.isPublic;
+  if (isPublic && !current.isPublic && !publicPrivateProfilesAllowed) {
+    console.warn(
+      `[deco] setCacheProfile("${profile}", { isPublic: true }) ignored: making a ` +
+        `non-public profile public would let authenticated pages be shared between ` +
+        `visitors. Call allowPublicPrivateProfile() first if this is deliberate.`,
+    );
+    isPublic = current.isPublic;
+  }
+
   PROFILES[profile] = {
     edge: { ...current.edge, ...overrides.edge },
     browser: { ...current.browser, ...overrides.browser },
     loader: { ...current.loader, ...overrides.loader },
     client: { ...current.client, ...overrides.client },
-    isPublic: overrides.isPublic ?? current.isPublic,
+    isPublic,
   };
 }
 
+let publicPrivateProfilesAllowed = false;
+
+/**
+ * Opt out of the guard in `setCacheProfile` that refuses to turn a non-public
+ * profile (`private`, `cart`, `none`) public.
+ *
+ * There is no legitimate storefront reason to call this. It exists so the
+ * escape hatch has a name you have to type, rather than being a silent side
+ * effect of passing `isPublic: true`.
+ */
+export function allowPublicPrivateProfile(): void {
+  publicPrivateProfilesAllowed = true;
+}
+
 // ---------------------------------------------------------------------------
 // Derivation: Cache-Control headers (browser layer)
 // ---------------------------------------------------------------------------
@@ -262,16 +292,95 @@ interface CachePattern {
   profile: CacheProfileName;
 }
 
-// Authenticated / per-user areas that must never be edge-cached. Includes the
-// hyphenless `myaccount` (VTEX My Account wrapper path) and common pt-BR routes
-// (`minha-conta`, `meus-pedidos`, `pedidos`) — omitting these let account pages
-// fall through to the cacheable `listing` default (see decocms/blocks#412).
-const PRIVATE_PREFIX_RE =
-  /^\/(cart|checkout|account|myaccount|my-account|minha-conta|meus-pedidos|pedidos|login)(\/|$)/;
+// Authenticated / per-user areas that must never be edge-cached. Anything not
+// matched here falls through to the cacheable `listing` default, so a missing
+// entry is a live content leak, not a missed optimization (see
+// decocms/blocks#412, which added the hyphenless `myaccount` VTEX wrapper path
+// and the pt-BR account routes).
+//
+// Three properties this regex must keep, each of which was a real hole:
+//   - case-insensitive: `/Checkout` used to fall through to `listing`.
+//   - optional locale prefix: `/pt/checkout`, `/br/minha-conta` likewise. Only
+//     matches when followed by a private segment, so a legitimate two-letter
+//     route can't be swallowed by it.
+//   - wishlist / profile / signup / returns: absent until the CDN work, which
+//     is what served a live store's `/listadedesejos` from the shared entry.
+const PRIVATE_SEGMENTS = [
+  "cart",
+  "carrinho",
+  "checkout",
+  "account",
+  "myaccount",
+  "my-account",
+  "minha-conta",
+  "meus-pedidos",
+  "pedidos",
+  "orders",
+  "order-placed",
+  "login",
+  "logout",
+  "sair",
+  "cadastro",
+  "signup",
+  "register",
+  "profile",
+  "perfil",
+  "wishlist",
+  "favoritos",
+  "listadedesejos",
+  "lista-de-desejos",
+  "minha-lista",
+  "assinaturas",
+  "subscriptions",
+  "troca",
+  "trocas",
+  "devolucao",
+  "devolucoes",
+];
+
+const LOCALE_PREFIX = "(?:\\/[a-z]{2}(?:-[a-z]{2})?)?";
+
+const PRIVATE_PREFIX_RE = new RegExp(
+  `^${LOCALE_PREFIX}\\/(?:${PRIVATE_SEGMENTS.join("|")})(?:\\/|$)`,
+  "i",
+);
+
+// Site-registered private prefixes (see `registerPrivatePaths`). Kept separate
+// from `PRIVATE_SEGMENTS` so a site can only ever ADD to the private set.
+const extraPrivatePaths: string[] = [];
+
+/**
+ * Mark additional path prefixes as private — never edge-cached, never served
+ * from the CDN.
+ *
+ * This is the safe half of cache configuration: it can only restrict, never
+ * relax. Prefer it over `registerCachePattern` (which can also make things
+ * public, and is evaluated before the built-in private check).
+ *
+ * @example
+ * ```ts
+ * registerPrivatePaths(["/listadedesejos", "/trocas"]);
+ * ```
+ */
+export function registerPrivatePaths(paths: string[]): void {
+  for (const path of paths) {
+    const normalized = path.startsWith("/") ? path : `/${path}`;
+    if (!extraPrivatePaths.includes(normalized)) extraPrivatePaths.push(normalized);
+  }
+}
+
+function isPrivatePath(pathname: string): boolean {
+  if (PRIVATE_PREFIX_RE.test(pathname)) return true;
+  const lower = pathname.toLowerCase();
+  return extraPrivatePaths.some((prefix) => {
+    const p = prefix.toLowerCase();
+    return lower === p || lower.startsWith(`${p}/`);
+  });
+}
 
 const builtinPatterns: CachePattern[] = [
   {
-    test: (p) => PRIVATE_PREFIX_RE.test(p),
+    test: (p) => isPrivatePath(p),
     profile: "private",
   },
   {
@@ -299,7 +408,13 @@ const customPatterns: CachePattern[] = [];
 
 /**
  * Register additional URL-to-profile patterns. Custom patterns are evaluated
- * before built-in ones, so they can override defaults.
+ * before built-in ones, so they can override defaults — with one exception:
+ * a custom pattern resolving to a PUBLIC profile cannot override the built-in
+ * private check (see `detectCacheProfile`). A broad site pattern would
+ * otherwise silently capture `/checkout` and make it cacheable.
+ *
+ * To mark routes as private, prefer {@link registerPrivatePaths} — it can only
+ * restrict, and isn't subject to ordering rules.
  */
 export function registerCachePattern(pattern: CachePattern): void {
   customPatterns.push(pattern);
@@ -324,8 +439,15 @@ export function detectCacheProfile(pathnameOrUrl: string | URL): CacheProfileNam
     searchParams = url.searchParams;
   }
 
+  // A private path can never be talked into a public profile by a site pattern.
+  // Custom patterns still win for anything non-public (a site can always make a
+  // route MORE restricted), and for public-vs-public overrides on other paths.
+  const privatePath = isPrivatePath(pathname);
+
   for (const pattern of customPatterns) {
-    if (pattern.test(pathname, searchParams)) return pattern.profile;
+    if (!pattern.test(pathname, searchParams)) continue;
+    if (privatePath && PROFILES[pattern.profile].isPublic) return "private";
+    return pattern.profile;
   }
   for (const pattern of builtinPatterns) {
     if (pattern.test(pathname, searchParams)) return pattern.profile;