@decocms/tanstack 7.77.5 → 7.77.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/tanstack",
-  "version": "7.77.5",
+  "version": "7.77.6",
   "type": "module",
   "description": "Deco framework binding for TanStack Start + Cloudflare Workers",
   "repository": {
@@ -27,9 +27,9 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.77.5",
-    "@decocms/blocks-admin": "7.77.5",
-    "@decocms/blocks-cli": "7.77.5",
+    "@decocms/blocks": "7.77.6",
+    "@decocms/blocks-admin": "7.77.6",
+    "@decocms/blocks-cli": "7.77.6",
     "@deco-cx/warp-node": "^0.3.16",
     "fast-json-patch": "^3.1.0",
     "ws": "^8.18.0"

package/src/sdk/workerEntry.test.ts

@@ -15,6 +15,7 @@ import {
   DEFAULT_SECURITY_HEADERS,
   detectLocationMatcher,
   injectGeoCookies,
+  setCookieIdentity,
 } from "./workerEntry";
 
 const EMPTY_ENV = {};
@@ -1031,3 +1032,53 @@ describe("fast-deploy hydration ordering", () => {
     }
   });
 });
+
+describe("Set-Cookie deduplication keys on name + Domain + Path", () => {
+  it("setCookieIdentity: same name, different scope → different identities", () => {
+    expect(setCookieIdentity("a=1; Path=/")).not.toBe(
+      setCookieIdentity("a=1; Path=/; Domain=example.com"),
+    );
+    expect(setCookieIdentity("a=1; Path=/; Domain=www.example.com")).not.toBe(
+      setCookieIdentity("a=1; Path=/; Domain=example.com"),
+    );
+    expect(setCookieIdentity("a=1; Path=/")).not.toBe(setCookieIdentity("a=1; Path=/account"));
+  });
+
+  it("setCookieIdentity: Domain is case-insensitive, a leading dot is ignored, value is not part of the key", () => {
+    expect(setCookieIdentity("a=1; Path=/; Domain=Example.COM")).toBe(
+      setCookieIdentity("a=2; path=/; domain=.example.com; Secure"),
+    );
+  });
+
+  it("keeps every scope of a multi-scope clear (sign-out) and still collapses true duplicates", async () => {
+    setBlocks({});
+    const clears = [
+      "VtexIdclientAutCookie=; Path=/; Max-Age=0",
+      "VtexIdclientAutCookie=; Path=/; Max-Age=0; Domain=www.example.com",
+      "VtexIdclientAutCookie=; Path=/; Max-Age=0; Domain=example.com",
+    ];
+    const entry = {
+      fetch: async () => {
+        const headers = new Headers({ "content-type": "text/plain" });
+        // A true duplicate (same name, same scope): only the last one survives.
+        headers.append("set-cookie", "checkout.vtex.com=__ofid=old; Path=/");
+        for (const sc of clears) headers.append("set-cookie", sc);
+        headers.append("set-cookie", "checkout.vtex.com=__ofid=new; Path=/");
+        return new Response("ok", { status: 200, headers });
+      },
+    };
+    const worker = createDecoWorkerEntry(entry, { observability: false });
+    const res = await worker.fetch(
+      new Request("https://www.example.com/telesales/sign-out"),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    const out = (res.headers as unknown as { getSetCookie: () => string[] }).getSetCookie();
+    // Order is not part of the contract; the set of surviving headers is.
+    expect(out).toHaveLength(4);
+    expect(out).toEqual(
+      expect.arrayContaining([...clears, "checkout.vtex.com=__ofid=new; Path=/"]),
+    );
+    expect(out).not.toContain("checkout.vtex.com=__ofid=old; Path=/");
+  });
+});

package/src/sdk/workerEntry.ts

@@ -930,20 +930,45 @@ function stripSafeCookiesForCache(response: Response, safeCookieSet: Set<string>
 }
 
 /**
- * Deduplicate Set-Cookie headers — keep only the LAST occurrence of
- * each cookie name. Multiple layers (VTEX middleware, invoke handlers,
- * etc.) may independently append the same cookie.
+ * Identity of a `Set-Cookie` header for deduplication: the browser keys its
+ * cookie jar by name + Domain + Path (RFC 6265 §5.3 step 11), so two headers
+ * that differ in scope address two different cookies — a clear for the
+ * host-only cookie does not touch the `Domain=example.com` one. The domain is
+ * case-insensitive and a leading dot is ignored (§5.2.3); the path is
+ * compared as sent.
+ */
+export function setCookieIdentity(setCookie: string): string {
+  const [nameValue = "", ...attrs] = setCookie.split(";");
+  const eqIdx = nameValue.indexOf("=");
+  const name = eqIdx > 0 ? nameValue.slice(0, eqIdx).trim() : nameValue.trim();
+  let domain = "";
+  let path = "";
+  for (const attr of attrs) {
+    const sep = attr.indexOf("=");
+    const key = (sep >= 0 ? attr.slice(0, sep) : attr).trim().toLowerCase();
+    const value = sep >= 0 ? attr.slice(sep + 1).trim() : "";
+    if (key === "domain") domain = value.replace(/^\./, "").toLowerCase();
+    else if (key === "path") path = value;
+  }
+  return `${name}\u0000${domain}\u0000${path}`;
+}
+
+/**
+ * Deduplicate Set-Cookie headers — keep only the LAST occurrence of each
+ * cookie identity (name + Domain + Path, see {@link setCookieIdentity}).
+ * Multiple layers (VTEX middleware, invoke handlers, etc.) may independently
+ * append the same cookie. Keying by name alone collapsed deliberate clears of
+ * the same cookie under different scopes (host-only / `Domain=host` /
+ * `Domain=parent`) into whichever came last, leaving the other scopes alive.
  */
 function deduplicateSetCookies(response: Response): void {
   const setCookies = (response.headers as any).getSetCookie?.() as string[] | undefined;
   if (!setCookies || setCookies.length <= 1) return;
 
-  // Build map: cookie name → last Set-Cookie value
+  // Build map: cookie identity → last Set-Cookie value
   const seen = new Map<string, string>();
   for (const sc of setCookies) {
-    const eqIdx = sc.indexOf("=");
-    const name = eqIdx > 0 ? sc.slice(0, eqIdx).trim() : sc;
-    seen.set(name, sc);
+    seen.set(setCookieIdentity(sc), sc);
   }
 
   // If no duplicates, nothing to do