@decocms/blocks 7.62.1 → 7.62.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.62.1",
+  "version": "7.62.2",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/cms/resolve.test.ts

@@ -239,6 +239,50 @@ describe("commerce loader auto-injects URL search params as props", () => {
     });
   });
 
+  it("strips tracking params from __pageUrl and never injects them as props", async () => {
+    const calls: Array<Record<string, unknown>> = [];
+    registerCommerceLoader(KEY, async (props: Record<string, unknown>) => {
+      calls.push({ ...props });
+      return null;
+    });
+
+    await resolveValue({ __resolveType: KEY, slug: "sabonete" }, undefined, {
+      url: "https://store.com/produto/sabonete/p?skuId=12345&utm_source=google&gclid=abc&srsltid=xyz",
+      path: "/produto/sabonete/p",
+    });
+
+    expect(calls[0]).toMatchObject({
+      slug: "sabonete",
+      skuId: "12345",
+      __pageUrl: "https://store.com/produto/sabonete/p?skuId=12345",
+    });
+    expect(calls[0]).not.toHaveProperty("utm_source");
+    expect(calls[0]).not.toHaveProperty("gclid");
+    expect(calls[0]).not.toHaveProperty("srsltid");
+  });
+
+  // The point of the strip: `createCachedLoader`'s default keyFn is
+  // JSON.stringify(props), so identical props mean a shared cache entry. A
+  // campaign tail used to mint a fresh one on every paid landing.
+  it("gives a paid-traffic landing the same props as the clean URL", async () => {
+    const calls: Array<Record<string, unknown>> = [];
+    registerCommerceLoader(KEY, async (props: Record<string, unknown>) => {
+      calls.push({ ...props });
+      return null;
+    });
+
+    const at = (url: string) =>
+      resolveValue({ __resolveType: KEY, slug: "sabonete" }, undefined, {
+        url,
+        path: "/produto/sabonete/p",
+      });
+
+    await at("https://store.com/produto/sabonete/p");
+    await at("https://store.com/produto/sabonete/p?utm_source=google&gclid=abc&fbclid=d");
+
+    expect(JSON.stringify(calls[1])).toBe(JSON.stringify(calls[0]));
+  });
+
   it("does NOT override a CMS-configured prop with a URL param of the same name", async () => {
     const calls: Array<Record<string, unknown>> = [];
     registerCommerceLoader(KEY, async (props: Record<string, unknown>) => {

package/src/cms/resolve.ts

@@ -5,6 +5,7 @@ import { stickyDecide } from "../sdk/experiments";
 import { parseSegmentCookie, SEGMENT_COOKIE, type StoredFlag, trafficToPct } from "../sdk/flags";
 import { withInflightTimeout } from "../sdk/inflightTimeout";
 import { normalizeUrlsInObject } from "../sdk/normalizeUrls";
+import { stripTrackingParams } from "../sdk/urlUtils";
 import { findPageByPath, loadBlocks } from "./loader";
 import { getOnBeforeResolveProps, getSection, registerOnBeforeResolveProps } from "./registry";
 import {
@@ -956,21 +957,35 @@ async function internalResolve(value: unknown, rctx: ResolveContext): Promise<un
       resolvedProps.__pagePath = rctx.matcherCtx.path;
     }
     if (rctx.matcherCtx.url) {
-      resolvedProps.__pageUrl = rctx.matcherCtx.url;
+      // Strip tracking params before anything here reaches props.
+      //
+      // The comment this replaces claimed the enrichment was "safe re: cache
+      // fragmentation" because commerce loaders run without a framework-level
+      // cache. That was wrong — `getCommerceLoader()` returns the
+      // `createCachedLoader`-wrapped functions, whose default keyFn hashes
+      // exactly these props — so a `?utm_source`/`gclid`/`srsltid` minted a
+      // fresh cache entry and made every paid-traffic landing a permanent cold
+      // miss. Measured on a production storefront: 0.2–1.5% hit rate on the
+      // default keyFn vs 73.5% on a loader that hand-rolled a key excluding it.
+      //
+      // Stripping here rather than in the keyFn covers `__pageUrl` and the
+      // param spread below in one place, and matches how the edge cache key is
+      // already normalized in workerEntry. No loader reads tracking params.
+      //
+      // Deliberately does NOT drop `__pageUrl`/`__pagePath` themselves: on a
+      // PDP the path IS the product identity (the CMS block leaves `slug`
+      // null) and on a PLP the query carries the facets. Dropping them would
+      // merge distinct results onto one entry and serve wrong content.
+      const pageUrl = stripTrackingParams(rctx.matcherCtx.url);
+      resolvedProps.__pageUrl = pageUrl;
       // Auto-inject URL search params as top-level props so loaders that
       // expect `props.skuId` / `props.q` / `props.page` (the apps-start
       // canonical shape) get them populated on direct entry (Google
       // Shopping deep links, paid ads, email campaigns). Existing values
       // from the CMS block win — URL params are a fallback, not an
       // override.
-      //
-      // Safe re: cache fragmentation: commerce loaders run through this
-      // path without a framework-level cache (the section/page cache
-      // layer hashes section.props BEFORE this enrichment in
-      // sectionLoaders.ts), so adding query params here does not
-      // fragment any cache key.
-      if (URL.canParse(rctx.matcherCtx.url)) {
-        const url = new URL(rctx.matcherCtx.url);
+      if (URL.canParse(pageUrl)) {
+        const url = new URL(pageUrl);
         for (const [k, v] of url.searchParams.entries()) {
           if (resolvedProps[k] !== undefined) continue;
           // `page` is skipped on purpose (#391): loaders that read `page`
@@ -994,7 +1009,7 @@ async function internalResolve(value: unknown, rctx: ResolveContext): Promise<un
         // upstream is wrong — surface it so the caller can fix it.
         console.warn(
           `[CMS] malformed matcherCtx.url for "${resolveType}"; ` +
-            `skipping query-param injection: ${rctx.matcherCtx.url}`,
+            `skipping query-param injection: ${pageUrl}`,
         );
       }
     }