@decocms/tanstack 7.77.5 → 7.77.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/tanstack",
-  "version": "7.77.5",
+  "version": "7.77.7",
   "type": "module",
   "description": "Deco framework binding for TanStack Start + Cloudflare Workers",
   "repository": {
@@ -27,9 +27,9 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.77.5",
-    "@decocms/blocks-admin": "7.77.5",
-    "@decocms/blocks-cli": "7.77.5",
+    "@decocms/blocks": "7.77.7",
+    "@decocms/blocks-admin": "7.77.7",
+    "@decocms/blocks-cli": "7.77.7",
     "@deco-cx/warp-node": "^0.3.16",
     "fast-json-patch": "^3.1.0",
     "ws": "^8.18.0"

package/src/sdk/workerEntry.test.ts

@@ -7,6 +7,7 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { segmentToken } from "./cdnSegment";
 import { __resetKvHydrationStateForTests } from "./kvHydration";
 import {
+  aliasLiveInvoke,
   buildEnforcedCsp,
   buildGeoCacheParam,
   createDecoWorkerEntry,
@@ -15,6 +16,7 @@ import {
   DEFAULT_SECURITY_HEADERS,
   detectLocationMatcher,
   injectGeoCookies,
+  setCookieIdentity,
 } from "./workerEntry";
 
 const EMPTY_ENV = {};
@@ -1031,3 +1033,105 @@ describe("fast-deploy hydration ordering", () => {
     }
   });
 });
+
+describe("Set-Cookie deduplication keys on name + Domain + Path", () => {
+  it("setCookieIdentity: same name, different scope → different identities", () => {
+    expect(setCookieIdentity("a=1; Path=/")).not.toBe(
+      setCookieIdentity("a=1; Path=/; Domain=example.com"),
+    );
+    expect(setCookieIdentity("a=1; Path=/; Domain=www.example.com")).not.toBe(
+      setCookieIdentity("a=1; Path=/; Domain=example.com"),
+    );
+    expect(setCookieIdentity("a=1; Path=/")).not.toBe(setCookieIdentity("a=1; Path=/account"));
+  });
+
+  it("setCookieIdentity: Domain is case-insensitive, a leading dot is ignored, value is not part of the key", () => {
+    expect(setCookieIdentity("a=1; Path=/; Domain=Example.COM")).toBe(
+      setCookieIdentity("a=2; path=/; domain=.example.com; Secure"),
+    );
+  });
+
+  it("keeps every scope of a multi-scope clear (sign-out) and still collapses true duplicates", async () => {
+    setBlocks({});
+    const clears = [
+      "VtexIdclientAutCookie=; Path=/; Max-Age=0",
+      "VtexIdclientAutCookie=; Path=/; Max-Age=0; Domain=www.example.com",
+      "VtexIdclientAutCookie=; Path=/; Max-Age=0; Domain=example.com",
+    ];
+    const entry = {
+      fetch: async () => {
+        const headers = new Headers({ "content-type": "text/plain" });
+        // A true duplicate (same name, same scope): only the last one survives.
+        headers.append("set-cookie", "checkout.vtex.com=__ofid=old; Path=/");
+        for (const sc of clears) headers.append("set-cookie", sc);
+        headers.append("set-cookie", "checkout.vtex.com=__ofid=new; Path=/");
+        return new Response("ok", { status: 200, headers });
+      },
+    };
+    const worker = createDecoWorkerEntry(entry, { observability: false });
+    const res = await worker.fetch(
+      new Request("https://www.example.com/telesales/sign-out"),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    const out = (res.headers as unknown as { getSetCookie: () => string[] }).getSetCookie();
+    // Order is not part of the contract; the set of surviving headers is.
+    expect(out).toHaveLength(4);
+    expect(out).toEqual(
+      expect.arrayContaining([...clears, "checkout.vtex.com=__ofid=new; Path=/"]),
+    );
+    expect(out).not.toContain("checkout.vtex.com=__ofid=old; Path=/");
+  });
+});
+
+describe("/live/invoke alias (Fresh compat)", () => {
+  it("leaves every other path untouched (same Request reference)", () => {
+    for (const path of ["/", "/deco/invoke/site/loaders/x.ts", "/live/_meta", "/live/invoke-not"]) {
+      const req = new Request(`https://example.com${path}`);
+      expect(aliasLiveInvoke(req)).toBe(req);
+    }
+  });
+
+  it("rewrites /live/invoke and /live/invoke/* to /deco/invoke[/*], keeping query, method, headers, body and cf", async () => {
+    const req = new Request("https://example.com/live/invoke/site/loaders/x.ts?select=a,b", {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-custom": "1" },
+      body: JSON.stringify({ id: 1 }),
+    });
+    Object.defineProperty(req, "cf", { value: { colo: "GRU" }, configurable: true });
+
+    const out = aliasLiveInvoke(req);
+    expect(out.url).toBe("https://example.com/deco/invoke/site/loaders/x.ts?select=a,b");
+    expect(out.method).toBe("POST");
+    expect(out.headers.get("x-custom")).toBe("1");
+    expect(await out.json()).toEqual({ id: 1 });
+    expect((out as unknown as { cf?: unknown }).cf).toEqual({ colo: "GRU" });
+
+    expect(aliasLiveInvoke(new Request("https://example.com/live/invoke")).url).toBe(
+      "https://example.com/deco/invoke",
+    );
+  });
+
+  it("end-to-end: the server entry receives the /deco/invoke URL", async () => {
+    setBlocks({});
+    const urls: string[] = [];
+    const entry = {
+      fetch: async (req: Request) => {
+        urls.push(req.url);
+        return Response.json({ ok: true });
+      },
+    };
+    const worker = createDecoWorkerEntry(entry, { observability: false });
+    const res = await worker.fetch(
+      new Request("https://example.com/live/invoke/site/loaders/x.ts", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+      EMPTY_ENV,
+      MOCK_CTX,
+    );
+    expect(res.status).toBe(200);
+    expect(urls).toEqual(["https://example.com/deco/invoke/site/loaders/x.ts"]);
+  });
+});

package/src/sdk/workerEntry.ts

@@ -930,20 +930,45 @@ function stripSafeCookiesForCache(response: Response, safeCookieSet: Set<string>
 }
 
 /**
- * Deduplicate Set-Cookie headers — keep only the LAST occurrence of
- * each cookie name. Multiple layers (VTEX middleware, invoke handlers,
- * etc.) may independently append the same cookie.
+ * Identity of a `Set-Cookie` header for deduplication: the browser keys its
+ * cookie jar by name + Domain + Path (RFC 6265 §5.3 step 11), so two headers
+ * that differ in scope address two different cookies — a clear for the
+ * host-only cookie does not touch the `Domain=example.com` one. The domain is
+ * case-insensitive and a leading dot is ignored (§5.2.3); the path is
+ * compared as sent.
+ */
+export function setCookieIdentity(setCookie: string): string {
+  const [nameValue = "", ...attrs] = setCookie.split(";");
+  const eqIdx = nameValue.indexOf("=");
+  const name = eqIdx > 0 ? nameValue.slice(0, eqIdx).trim() : nameValue.trim();
+  let domain = "";
+  let path = "";
+  for (const attr of attrs) {
+    const sep = attr.indexOf("=");
+    const key = (sep >= 0 ? attr.slice(0, sep) : attr).trim().toLowerCase();
+    const value = sep >= 0 ? attr.slice(sep + 1).trim() : "";
+    if (key === "domain") domain = value.replace(/^\./, "").toLowerCase();
+    else if (key === "path") path = value;
+  }
+  return `${name}\u0000${domain}\u0000${path}`;
+}
+
+/**
+ * Deduplicate Set-Cookie headers — keep only the LAST occurrence of each
+ * cookie identity (name + Domain + Path, see {@link setCookieIdentity}).
+ * Multiple layers (VTEX middleware, invoke handlers, etc.) may independently
+ * append the same cookie. Keying by name alone collapsed deliberate clears of
+ * the same cookie under different scopes (host-only / `Domain=host` /
+ * `Domain=parent`) into whichever came last, leaving the other scopes alive.
  */
 function deduplicateSetCookies(response: Response): void {
   const setCookies = (response.headers as any).getSetCookie?.() as string[] | undefined;
   if (!setCookies || setCookies.length <= 1) return;
 
-  // Build map: cookie name → last Set-Cookie value
+  // Build map: cookie identity → last Set-Cookie value
   const seen = new Map<string, string>();
   for (const sc of setCookies) {
-    const eqIdx = sc.indexOf("=");
-    const name = eqIdx > 0 ? sc.slice(0, eqIdx).trim() : sc;
-    seen.set(name, sc);
+    seen.set(setCookieIdentity(sc), sc);
   }
 
   // If no duplicates, nothing to do
@@ -957,6 +982,46 @@ function deduplicateSetCookies(response: Response): void {
 
 const FINGERPRINTED_ASSET_RE = /(?:\/_build)?\/assets\/.*-[a-zA-Z0-9_-]{8,}\.\w+$/;
 
+const LIVE_INVOKE_PREFIX = "/live/invoke";
+
+/**
+ * Fresh-compat alias: serve `/live/invoke` and `/live/invoke/*` as
+ * `/deco/invoke[/*]`. deco-runtime registered both prefixes for the same
+ * handler (`runtime/handler.tsx`: `paths: ["/live/invoke", "/deco/invoke"]`),
+ * and clients built against a Fresh site — the mobile app, partner
+ * integrations — still call `/live/invoke/...`. Here that path fell through
+ * to the CMS router and answered a 404 HTML page.
+ *
+ * Returns the same Request when the path is not a `/live/invoke` one, so the
+ * common path allocates nothing. The rewritten Request keeps method, headers,
+ * body and `cf` (the `new Request(url, request)` form does not reliably carry
+ * `cf` across runtimes — see `revalidationRequest`).
+ */
+export function aliasLiveInvoke(request: Request): Request {
+  const url = new URL(request.url);
+  const { pathname } = url;
+  if (pathname !== LIVE_INVOKE_PREFIX && !pathname.startsWith(`${LIVE_INVOKE_PREFIX}/`)) {
+    return request;
+  }
+  url.pathname = `/deco/invoke${pathname.slice(LIVE_INVOKE_PREFIX.length)}`;
+  const hasBody = request.method !== "GET" && request.method !== "HEAD";
+  const cf = (request as unknown as { cf?: unknown }).cf;
+  const aliased = new Request(url.toString(), {
+    method: request.method,
+    headers: request.headers,
+    redirect: request.redirect,
+    signal: request.signal,
+    ...(hasBody ? { body: request.body, duplex: "half" } : {}),
+    ...(cf ? { cf } : {}),
+  } as RequestInit);
+  // Runtimes other than workerd ignore the `cf` init field; re-attach it so a
+  // location matcher downstream never reads a dropped `cf`.
+  if (cf !== undefined && (aliased as unknown as { cf?: unknown }).cf === undefined) {
+    Object.defineProperty(aliased, "cf", { value: cf, configurable: true });
+  }
+  return aliased;
+}
+
 // ---------------------------------------------------------------------------
 // Auto geo-key detection (module-level singleton)
 // ---------------------------------------------------------------------------
@@ -2174,10 +2239,13 @@ export function createDecoWorkerEntry(
     : instrumentWorker(handler, (observabilityOpt as OtelOptions | undefined) ?? {});
 
   async function handleRequest(
-    request: Request,
+    incomingRequest: Request,
     env: Record<string, unknown>,
     ctx: WorkerExecutionContext,
   ): Promise<Response> {
+    // Fresh-compat `/live/invoke` → `/deco/invoke`, before anything reads
+    // the path (admin routes, bypass paths, the site's `/deco/invoke/$` route).
+    const request = aliasLiveInvoke(incomingRequest);
     const url = new URL(request.url);
 
     // NOTE: fast-deploy hydration does NOT run here. It must happen before