@decocms/tanstack 7.20.10 → 7.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/tanstack",
-  "version": "7.20.10",
+  "version": "7.21.0",
   "type": "module",
   "description": "Deco framework binding for TanStack Start + Cloudflare Workers",
   "repository": {
@@ -24,9 +24,9 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.20.10",
-    "@decocms/blocks-admin": "7.20.10",
-    "@decocms/blocks-cli": "7.20.10",
+    "@decocms/blocks": "7.21.0",
+    "@decocms/blocks-admin": "7.21.0",
+    "@decocms/blocks-cli": "7.21.0",
     "@deco-cx/warp-node": "^0.3.16",
     "fast-json-patch": "^3.1.0",
     "ws": "^8.18.0"

package/src/sdk/workerEntry.test.ts

@@ -385,3 +385,48 @@ describe("security headers — frame-ancestors default", () => {
     expect(res.headers.get("X-Content-Type-Options")).toBeNull();
   });
 });
+
+describe("POST /_cache/purge-loaders", () => {
+  afterEach(() => {
+    __resetKvHydrationStateForTests();
+    setBlocks({});
+  });
+
+  const purge = (env: Record<string, unknown>, headers: Record<string, string> = {}) => {
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, { observability: false });
+    return worker.fetch(
+      new Request("https://example.com/_cache/purge-loaders", { method: "POST", headers }),
+      env,
+      MOCK_CTX,
+    );
+  };
+
+  it("401s without a valid Bearer token", async () => {
+    const res = await purge({ PURGE_TOKEN: "secret" });
+    expect(res.status).toBe(401);
+  });
+
+  it("401s with the wrong token", async () => {
+    const res = await purge({ PURGE_TOKEN: "secret" }, { Authorization: "Bearer nope" });
+    expect(res.status).toBe(401);
+  });
+
+  it("clears the loader cache with a valid token", async () => {
+    const res = await purge({ PURGE_TOKEN: "secret" }, { Authorization: "Bearer secret" });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ cleared: true, scope: "isolate" });
+  });
+
+  it("404s when purge is disabled (purgeTokenEnv: false)", async () => {
+    const worker = createDecoWorkerEntry(MOCK_SERVER_ENTRY, {
+      observability: false,
+      purgeTokenEnv: false,
+    });
+    const res = await worker.fetch(
+      new Request("https://example.com/_cache/purge-loaders", { method: "POST" }),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(res.status).toBe(404);
+  });
+});

package/src/sdk/workerEntry.ts

@@ -38,6 +38,7 @@ import {
   runSingleSectionLoader,
 } from "@decocms/blocks/cms";
 import { DECO_MATCHERS_OVERRIDE_PARAM } from "@decocms/blocks/matchers/override";
+import { clearLoaderCache } from "@decocms/blocks/sdk/cachedLoader";
 import { loadRedirects, matchRedirect, type RedirectMap } from "@decocms/blocks/sdk/redirects";
 import {
   type CacheProfileName,
@@ -1152,15 +1153,33 @@ export function createDecoWorkerEntry(
     return segments;
   }
 
-  async function handlePurge(request: Request, env: Record<string, unknown>): Promise<Response> {
+  // Constant-time string compare — avoids a byte-wise timing side-channel on the
+  // purge token. Length is not secret here, so a fast length-mismatch reject is fine.
+  function timingSafeEqualStr(a: string, b: string): boolean {
+    if (a.length !== b.length) return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+  }
+
+  // Shared auth for the cache purge endpoints. Returns a Response when the request
+  // is unauthorized or purge is disabled, or null when authorized. Single source
+  // of truth so /_cache/purge and /_cache/purge-loaders can't drift.
+  function authorizePurge(request: Request, env: Record<string, unknown>): Response | null {
     if (purgeTokenEnv === false) {
       return new Response("Purge disabled", { status: 404 });
     }
-
     const token = (env[purgeTokenEnv] as string) || "";
-    if (!token || request.headers.get("Authorization") !== `Bearer ${token}`) {
+    const auth = request.headers.get("Authorization") ?? "";
+    if (!token || !timingSafeEqualStr(auth, `Bearer ${token}`)) {
       return new Response("Unauthorized", { status: 401 });
     }
+    return null;
+  }
+
+  async function handlePurge(request: Request, env: Record<string, unknown>): Promise<Response> {
+    const denied = authorizePurge(request, env);
+    if (denied) return denied;
 
     let body: PurgeRequestBody;
     try {
@@ -1268,6 +1287,21 @@ export function createDecoWorkerEntry(
     return Response.json({ purged, total: purged.length });
   }
 
+  // Purge the in-memory loader/commerce cache for THIS isolate. Same auth as
+  // handlePurge (Bearer `purgeTokenEnv`). Per-isolate by nature — the isolate
+  // that serves this request clears its cache; other live isolates keep theirs
+  // until they're recycled or hit too. For a guaranteed global flush, redeploy
+  // (loader cache keys are build-hash versioned).
+  async function handlePurgeLoaders(
+    request: Request,
+    env: Record<string, unknown>,
+  ): Promise<Response> {
+    const denied = authorizePurge(request, env);
+    if (denied) return denied;
+    clearLoaderCache();
+    return Response.json({ cleared: true, scope: "isolate" });
+  }
+
   // -- Admin route handler ---------------------------------------------------
 
   const ADMIN_NO_CACHE: Record<string, string> = {
@@ -1593,6 +1627,14 @@ export function createDecoWorkerEntry(
       return handlePurge(request, env);
     }
 
+    // Loader/commerce cache purge (in-memory, this isolate only). Escape hatch
+    // to invalidate loader results immediately after an out-of-band upstream
+    // change (e.g. a Magento catalog sync) without waiting out the TTL. A
+    // redeploy is the global lever — loader cache keys are build-hash versioned.
+    if (url.pathname === "/_cache/purge-loaders" && request.method === "POST") {
+      return handlePurgeLoaders(request, env);
+    }
+
     // CMS redirects (website/loaders/redirect.ts blocks) — checked before
     // ?asJson and commerce proxy so every request path respects redirects.
     // Revision-keyed so cross-bundle setBlocks() calls are detected even when