@decocms/blocks 7.62.2 → 7.62.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.62.2",
+  "version": "7.62.4",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/sdk/cacheHeaders.test.ts

@@ -88,6 +88,35 @@ describe("canonicalizeServerFnPayloadForCacheKey — variant-param cache key", (
     expect(a).toBe(b);
   });
 
+  it("strips tracking params — paid traffic shares the canonical entry", () => {
+    const paid = canonicalizeServerFnPayloadForCacheKey(
+      envelope("/aneis?filter.color=ouro&utm_source=google&gclid=abc&srsltid=xyz"),
+    );
+    const canonical = canonicalizeServerFnPayloadForCacheKey(
+      envelope("/aneis?filter.color=ouro"),
+    );
+    expect(paid).toBe(canonical);
+  });
+
+  it("canonicalizes absolute URLs too, not just paths", () => {
+    // Sites embed one in the payload (the deferred-section `pageUrl` is built
+    // with `new URL(...)`), and the old guard skipped anything not starting
+    // with "/" — so not even skuId was stripped there.
+    const messy = canonicalizeServerFnPayloadForCacheKey(
+      envelope("https://store.com/mala-preta/p?skuId=148940&utm_source=ads"),
+    );
+    const canonical = canonicalizeServerFnPayloadForCacheKey(
+      envelope("https://store.com/mala-preta/p"),
+    );
+    expect(messy).toBe(canonical);
+  });
+
+  it("leaves non-URL strings alone", () => {
+    const a = canonicalizeServerFnPayloadForCacheKey(envelope("mala preta ?utm_source=x"));
+    expect(a).toBe(canonicalizeServerFnPayloadForCacheKey(envelope("mala preta ?utm_source=x")));
+    expect(a).toContain("utm_source");
+  });
+
   it("keeps PLP filter/search params (they DO change the response)", () => {
     const filtered = canonicalizeServerFnPayloadForCacheKey(
       envelope("/c/shoes?filter.size=40"),

package/src/sdk/cacheHeaders.ts

@@ -17,6 +17,8 @@
  * ```
  */
 
+import { isTrackingParam } from "./urlUtils";
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -520,9 +522,11 @@ export const DEFAULT_SERVERFN_CACHE_IGNORE_PARAMS = ["skuId", "idsku"];
 /**
  * Canonicalize a TanStack GET server-fn `payload` for use in the edge cache
  * key: re-serialize it (so equivalent requests always produce byte-identical
- * keys) and strip the given cache-irrelevant search params from any embedded
- * route path. This makes `/product/p?skuId=148940` and `/product/p` share one
- * cache entry, since `loadCmsPage` resolves both to the same page.
+ * keys) and strip the cache-irrelevant search params — `ignoreParams` plus every
+ * known tracking param — from any embedded route path or absolute URL. This
+ * makes `/product/p?skuId=148940`, `/product/p?utm_source=ads` and `/product/p`
+ * share one cache entry, since `loadCmsPage` resolves all three to the same
+ * page.
  *
  * Returns the original payload unchanged on any parse failure (fail-safe: the
  * caller keeps the raw payload, never worse than before).
@@ -532,13 +536,34 @@ export function canonicalizeServerFnPayloadForCacheKey(
   ignoreParams: string[] = DEFAULT_SERVERFN_CACHE_IGNORE_PARAMS,
 ): string {
   try {
+    const drop = (sp: URLSearchParams): void => {
+      for (const p of ignoreParams) sp.delete(p);
+      // Tracking params never change what the server fn resolves, but they DO
+      // change this key — so a shopper arriving from paid media mints a brand
+      // new entry on every SPA interaction. Measured on a production
+      // storefront: `/_serverFn/:id` at 84% MISS, 1401ms average.
+      for (const k of [...sp.keys()]) if (isTrackingParam(k)) sp.delete(k);
+    };
     const stripQuery = (s: string): string => {
+      // Absolute URL: sites embed one in the payload (the deferred-section
+      // `pageUrl` is built with `new URL(...)`), and it fragments the key
+      // exactly like a relative path does — but the guard below skipped it, so
+      // not even `skuId` was canonicalized there.
+      if (/^https?:\/\//i.test(s)) {
+        try {
+          const u = new URL(s);
+          drop(u.searchParams);
+          return u.toString();
+        } catch {
+          return s;
+        }
+      }
       if (!s.startsWith("/") || s.startsWith("//")) return s;
       const qIdx = s.indexOf("?");
       if (qIdx < 0) return s;
       const path = s.slice(0, qIdx);
       const sp = new URLSearchParams(s.slice(qIdx + 1));
-      for (const p of ignoreParams) sp.delete(p);
+      drop(sp);
       const rest = sp.toString();
       return rest ? `${path}?${rest}` : path;
     };

package/src/sdk/urlUtils.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import { cleanPathForCacheKey, isTrackingParam } from "./urlUtils";
+
+describe("tracking params that used to fragment the cache key", () => {
+  // Each of these was measured missing the edge cache on every route probed on a
+  // production storefront, because it was absent from UTM_PARAMS.
+  const cases = [
+    ["GA4 campaign id", "utm_id"],
+    ["GA4 source platform", "utm_source_platform"],
+    ["Google Ads source", "gad_source"],
+    ["Google Ads iOS click id", "gbraid"],
+    ["Google Ads web-to-app click id", "wbraid"],
+    ["GA cross-domain linker", "_gl"],
+    ["Instagram", "igshid"],
+    ["Pinterest", "epik"],
+    ["Marketo", "mkt_tok"],
+    ["Yandex", "yclid"],
+  ] as const;
+
+  for (const [label, param] of cases) {
+    it(`strips ${label} (${param})`, () => {
+      expect(isTrackingParam(param)).toBe(true);
+      expect(cleanPathForCacheKey(`https://x.com/aneis?color=ouro&${param}=abc`)).toBe(
+        "/aneis?color=ouro",
+      );
+    });
+  }
+
+  it("still keeps functional params", () => {
+    for (const p of ["page", "order", "map", "PS", "filter.color", "skuId", "q"]) {
+      expect(isTrackingParam(p)).toBe(false);
+    }
+  });
+});

package/src/sdk/urlUtils.ts

@@ -25,6 +25,27 @@ const UTM_PARAMS = new Set([
   "mc_eid",
   "ttclid",
   "srsltid",
+  // GA4's newer campaign params. The five classic `utm_*` above predate them,
+  // so a GA4-tagged campaign was still fragmenting the cache key.
+  "utm_id",
+  "utm_source_platform",
+  "utm_creative_format",
+  "utm_marketing_tactic",
+  // Google Ads click ids that replaced bare `gclid` for privacy-restricted
+  // traffic (iOS/Safari), plus the source tag now appended to essentially every
+  // Google Ads click. Measured on a production storefront: each of these missed
+  // the edge cache on 3/3 routes probed, deterministically.
+  "gad_source",
+  "gad_campaignid",
+  "gbraid",
+  "wbraid",
+  // Google Analytics cross-domain linker. Sites already strip this by hand in
+  // client code, which is the tell that it shows up in real URLs.
+  "_gl",
+  "igshid",
+  "epik",
+  "mkt_tok",
+  "yclid",
 ]);
 
 /**
@@ -44,6 +65,17 @@ export function registerTrackingParams(params: string[]): void {
   }
 }
 
+/**
+ * Whether a search param is a known tracking/attribution param.
+ *
+ * Exposed so cache-key builders can filter params in place without having to
+ * round-trip through a `URL` (server-fn payloads carry bare relative paths) and
+ * without keeping a second copy of the list.
+ */
+export function isTrackingParam(param: string): boolean {
+  return UTM_PARAMS.has(param.toLowerCase());
+}
+
 /**
  * Strip UTM and tracking parameters from a URL.
  *