@decocms/start 6.3.1 → 6.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/start",
-  "version": "6.3.1",
+  "version": "6.4.1",
   "type": "module",
   "description": "Deco framework for TanStack Start - CMS bridge, admin protocol, hooks, schema generation",
   "main": "./src/index.ts",

package/src/cms/loader.test.ts

@@ -0,0 +1,164 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { findPageByPath, matchPath, setBlocks } from "./loader";
+
+// Mirrors the behavior of the original deco-cx/deco Fresh framework
+// (runtime/features/render.tsx), which uses native `URLPattern` directly
+// and returns `result.pathname.groups`. Splats become numbered groups
+// ("0", "1", …) — there is no `_splat` rename.
+
+describe("matchPath", () => {
+  describe("literal segments", () => {
+    it("matches the root path", () => {
+      expect(matchPath("/", "/")).toEqual({});
+    });
+
+    it("matches exact literal paths", () => {
+      expect(matchPath("/foo/bar", "/foo/bar")).toEqual({});
+    });
+
+    it("returns null when literals differ", () => {
+      expect(matchPath("/foo/bar", "/foo/baz")).toBeNull();
+    });
+
+    it("returns null when literal-only pattern does not span the whole URL", () => {
+      expect(matchPath("/foo", "/foo/bar")).toBeNull();
+    });
+  });
+
+  describe("named params (:slug)", () => {
+    it("captures a single param", () => {
+      expect(matchPath("/foo/:slug", "/foo/sabonete")).toEqual({ slug: "sabonete" });
+    });
+
+    it("captures a param sandwiched between literals (VTEX PDP)", () => {
+      expect(matchPath("/produto/:slug/p", "/produto/sabonete/p")).toEqual({
+        slug: "sabonete",
+      });
+    });
+
+    it("returns null when the URL is shorter than the pattern", () => {
+      expect(matchPath("/foo/:slug", "/foo")).toBeNull();
+    });
+  });
+
+  describe("trailing splat (*)", () => {
+    it("captures the rest as group '0'", () => {
+      expect(matchPath("/*", "/foo/bar")).toEqual({ "0": "foo/bar" });
+    });
+
+    it("matches root with empty splat", () => {
+      expect(matchPath("/*", "/")).toEqual({ "0": "" });
+    });
+
+    it("captures the remainder under a prefix", () => {
+      expect(matchPath("/foo/*", "/foo/bar/baz")).toEqual({ "0": "bar/baz" });
+    });
+
+    // Intentional bug fix: the previous custom matchPath accidentally matched
+    // `/foo` against `/foo/*` due to its naive split("/") logic, which also
+    // mis-handled trailing slashes. Native URLPattern (and the Fresh original)
+    // require at least one segment after `/foo/`.
+    it("does NOT match the bare prefix without a trailing segment", () => {
+      expect(matchPath("/foo/*", "/foo")).toBeNull();
+    });
+  });
+
+  describe("URLPattern optional groups ({...}?)", () => {
+    // Patterns emitted by the deco-cx admin / present in production CMS data.
+    // These are the cases that issue #213 documents as broken.
+
+    it("matches with the optional group present", () => {
+      expect(matchPath("/{granado/}?*", "/granado/perfumaria")).toEqual({
+        "0": "perfumaria",
+      });
+    });
+
+    it("matches with the optional group absent", () => {
+      expect(matchPath("/{granado/}?*", "/perfumaria")).toEqual({ "0": "perfumaria" });
+    });
+
+    it("matches root when optional prefix and splat collapse to empty", () => {
+      expect(matchPath("/{granado/}?*", "/")).toEqual({ "0": "" });
+    });
+
+    it("matches with an optional prefix before a literal segment", () => {
+      expect(
+        matchPath("/{granado/}?campanhas/*", "/granado/campanhas/destaques-2023"),
+      ).toEqual({ "0": "destaques-2023" });
+      expect(
+        matchPath("/{granado/}?campanhas/*", "/campanhas/destaques-2023"),
+      ).toEqual({ "0": "destaques-2023" });
+    });
+
+    it("matches an optional suffix group present and absent", () => {
+      expect(matchPath("/black-friday{/70-off}?", "/black-friday")).toEqual({});
+      expect(matchPath("/black-friday{/70-off}?", "/black-friday/70-off")).toEqual({});
+    });
+  });
+
+  describe("error tolerance", () => {
+    it("returns null for malformed patterns instead of throwing", () => {
+      expect(() => matchPath("/[invalid", "/anything")).not.toThrow();
+      expect(matchPath("/[invalid", "/anything")).toBeNull();
+    });
+  });
+});
+
+describe("findPageByPath specificity", () => {
+  beforeEach(() => {
+    setBlocks({
+      "pages-bf": {
+        name: "Black Friday",
+        path: "/black-friday",
+        sections: [],
+      },
+      "pages-bf-splat": {
+        name: "Black Friday with optional suffix",
+        path: "/black-friday{/70-off}?",
+        sections: [],
+      },
+      "pages-pdp-plp": {
+        name: "PDP & PLP",
+        path: "/{granado/}?*",
+        sections: [],
+      },
+      "pages-product": {
+        name: "Product",
+        path: "/produto/:slug/p",
+        sections: [],
+      },
+    });
+  });
+
+  afterEach(() => {
+    setBlocks({});
+  });
+
+  it("prefers an exact literal over an optional-group splat", () => {
+    const match = findPageByPath("/black-friday");
+    expect(match?.blockKey).toBe("pages-bf");
+  });
+
+  it("falls back to the splat page for unknown URLs", () => {
+    const match = findPageByPath("/perfumaria");
+    expect(match?.blockKey).toBe("pages-pdp-plp");
+    expect(match?.params).toEqual({ "0": "perfumaria" });
+  });
+
+  it("matches the param-bearing route ahead of the splat catch-all", () => {
+    const match = findPageByPath("/produto/sabonete/p");
+    expect(match?.blockKey).toBe("pages-product");
+    expect(match?.params).toEqual({ slug: "sabonete" });
+  });
+
+  it("returns null when no page matches", () => {
+    setBlocks({
+      "pages-only-bf": {
+        name: "Black Friday",
+        path: "/black-friday",
+        sections: [],
+      },
+    });
+    expect(findPageByPath("/nope")).toBeNull();
+  });
+});

package/src/cms/loader.ts

@@ -130,14 +130,23 @@ export function withBlocksOverride<T>(override: Record<string, unknown>, fn: ()
 // Higher key wins. Compared lexicographically:
 //   [literalSegments, paramSegments, hasNoSplat]
 // So `/foo/bar` > `/foo/:x` > `/foo/*` > `/*`, and `/my-account/*` > `/*`.
+//
+// URLPattern syntax (`{group}?`, `:slug([\w-]+)`, trailing `*`) is supported:
+// any segment containing `{`, `}`, or `?` counts as a param, and a segment
+// containing `*` flips the splat bit. This keeps optional-group patterns
+// (e.g. `/{granado/}?*`) from out-ranking real literal pages.
 function pathSpecificityKey(path: string): [number, number, number] {
   const parts = path.split("/").filter(Boolean);
   let literals = 0;
   let params = 0;
   let hasSplat = false;
   for (const part of parts) {
-    if (part === "*") hasSplat = true;
-    else if (part.startsWith(":") || part.startsWith("$")) params++;
+    if (part.includes("*")) hasSplat = true;
+    else if (
+      part.startsWith(":") ||
+      part.startsWith("$") ||
+      /[{}?]/.test(part)
+    ) params++;
     else literals++;
   }
   return [literals, params, hasSplat ? 0 : 1];
@@ -166,33 +175,37 @@ export function getAllPages(): Array<{ key: string; page: DecoPage }> {
     .map(({ key, page }) => ({ key, page }));
 }
 
-function matchPath(pattern: string, urlPath: string): Record<string, string> | null {
-  if (pattern === "/*") return { _splat: urlPath };
-
-  const patternParts = pattern.split("/").filter(Boolean);
-  const urlParts = urlPath.split("/").filter(Boolean);
-
-  // Trailing `*` means "match this prefix and any remaining segments".
-  const hasSplat = patternParts[patternParts.length - 1] === "*";
-  const fixedLen = hasSplat ? patternParts.length - 1 : patternParts.length;
-
-  if (hasSplat) {
-    if (urlParts.length < fixedLen) return null;
-  } else if (urlParts.length !== fixedLen) {
+/**
+ * Match a CMS page path pattern against a URL path.
+ *
+ * Mirrors the original deco-cx/deco Fresh framework
+ * (`runtime/features/render.tsx`) by delegating to the platform's native
+ * `URLPattern`. Supports the full URLPattern syntax that the admin emits:
+ * `:slug`, `:slug([\w-]+)`, optional groups `{...}?`, and trailing `*`
+ * splats. Splats are exposed as the standard numbered groups (`"0"`, `"1"`,
+ * …), matching the Fresh shape.
+ *
+ * Malformed patterns return `null` instead of throwing — bad CMS data must
+ * never take down the worker.
+ */
+export function matchPath(
+  pattern: string,
+  urlPath: string,
+): Record<string, string> | null {
+  let result: URLPatternResult | null;
+  try {
+    result = new URLPattern({ pathname: pattern }).exec({ pathname: urlPath });
+  } catch {
     return null;
   }
+  if (!result) return null;
 
-  const params: Record<string, string> = {};
-  for (let i = 0; i < fixedLen; i++) {
-    const pp = patternParts[i];
-    const up = urlParts[i];
-    if (pp.startsWith(":")) params[pp.slice(1)] = up;
-    else if (pp !== up) return null;
+  const groups = result.pathname.groups as Record<string, string | undefined>;
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(groups)) {
+    if (v !== undefined) out[k] = v;
   }
-
-  if (hasSplat) params._splat = urlParts.slice(fixedLen).join("/");
-
-  return params;
+  return out;
 }
 
 /**

package/src/sdk/workerEntry.ts

@@ -662,7 +662,7 @@ export function createDecoWorkerEntry(
     admin,
     detectProfile: customDetect,
     deviceSpecificKeys = true,
-    buildSegment,
+    buildSegment: rawBuildSegment,
     purgeTokenEnv = "PURGE_TOKEN",
     bypassPaths,
     extraBypassPaths = [],
@@ -678,6 +678,31 @@ export function createDecoWorkerEntry(
     cdnCacheControl: cdnCacheControlOpt = "no-store",
   } = options;
 
+  // Backfill `regionId` from Cloudflare geo when the consumer's buildSegment
+  // doesn't set one. Without this, sites using website/matchers/location.ts
+  // get a single cached response per device that leaks across regions: the
+  // first visitor's resolved variant gets served to everyone. With this,
+  // existing sites get region-segmented cache "for free" on bump — no
+  // worker-entry.ts edit required.
+  function readRegionFromRequest(request: Request): string | undefined {
+    // Trust the Cloudflare-injected `request.cf` first — it can't be spoofed
+    // by clients. Fall back to the `cf-region-code` header for environments
+    // that surface geo only via headers (e.g. tests, non-CF proxies).
+    const cf = (request as unknown as { cf?: { regionCode?: string } }).cf;
+    if (cf?.regionCode) return cf.regionCode;
+    const fromHeader = request.headers.get("cf-region-code");
+    return fromHeader || undefined;
+  }
+
+  const buildSegment = rawBuildSegment
+    ? (request: Request): SegmentKey => {
+        const seg = rawBuildSegment(request);
+        if (seg.regionId) return seg;
+        const region = readRegionFromRequest(request);
+        return region ? { ...seg, regionId: region } : seg;
+      }
+    : undefined;
+
   const safeCookieSet = new Set(safeCookiesOpt);
 
   // Build the final security headers map (merged defaults + custom + CSP)