@ecomiq/storefront 2.0.12 → 2.0.15

package/bin/ecomiq.mjs

@@ -81,6 +81,8 @@ export async function runCli(command = process.argv[2] ?? 'help') {
       const config = await prepare()
       const port = config.dev?.port ?? 3000
       const runtime = resolveDevRuntime({ config })
+      const httpsEnabled = Boolean(config.dev?.https)
+      const origin = `${httpsEnabled ? 'https' : 'http'}://localhost:${port}`
       const { createServer } = await import('vite')
       const viteConfig = createViteConfig({
         appDir,
@@ -89,7 +91,7 @@ export async function runCli(command = process.argv[2] ?? 'help') {
         runtime,
       })
       banner(
-        `dev · ${config.domain ?? 'tienda'} ${c.dim(`· runtime ${runtime}`)} ${c.dim('http://localhost:' + port)}`,
+        `dev · ${config.domain ?? 'tienda'} ${c.dim(`· runtime ${runtime}`)} ${c.dim(origin)}`,
       )
       const server = await createServer({
         ...viteConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomiq/storefront",
-  "version": "2.0.12",
+  "version": "2.0.15",
   "description": "Micro framework SSR de Ecomiq para storefronts. Páginas, datos y deploy sin configurar nada.",
   "type": "module",
   "license": "MIT",
@@ -42,6 +42,7 @@
     "./internal/checkout-session": "./src/pages/checkout.$checkoutId.tsx",
     "./internal/thank-you": "./src/pages/thank-you.tsx",
     "./internal/cms-page": "./src/pages/pages.$pageSlug.tsx",
+    "./internal/account": "./src/pages/account.tsx",
     "./package.json": "./package.json"
   },
   "files": [
@@ -63,6 +64,7 @@
     "@tanstack/react-query": "^5.101.0",
     "@tanstack/react-router": "^1.170.0",
     "@tanstack/react-start": "^1.168.0",
+    "@vitejs/plugin-basic-ssl": "^2.3.0",
     "@vitejs/plugin-react": "^6.0.0",
     "better-auth": "^1.6.23",
     "class-variance-authority": "^0.7.1",
@@ -76,7 +78,7 @@
     "vite": "^8.1.0",
     "wrangler": "^4.100.0",
     "zod": "^3.25.0",
-    "@ecomiq/core": "^0.1.3"
+    "@ecomiq/core": "^0.1.5"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/auth/create-storefront-auth.ts

@@ -1,30 +1,41 @@
 import { betterAuth } from 'better-auth'
 import type { BetterAuthPlugin } from 'better-auth'
+import { createCookieGetter, getCookies } from 'better-auth/cookies'
 import { tanstackStartCookies } from 'better-auth/tanstack-start'
+import { getStorefrontClient } from '../client'
 import { ecomiqOAuthPassword } from './ecomiq-oauth-password-plugin'
 import { readProcessEnv } from './env'
+import { shouldUseSecureCookies } from './secure-cookies'
+import {
+  mergeSettingsHostsIntoBaseURL,
+  resolveStorefrontAuthBaseURL,
+  type StorefrontDynamicBaseURLConfig,
+} from './storefront-auth-base-url'
 
 export type CreateStorefrontAuthOptions = {
   secret?: string
-  baseURL?: string
   /** Opciones adicionales pasadas a `betterAuth` (p. ej. `database`). */
   [key: string]: unknown
 }
 
 /**
  * Instancia Better Auth del storefront (servidor).
- * Usa el plugin `ecomiqOAuthPassword` + cookies de TanStack Start.
  *
- * Si no pasas `secret`/`baseURL`, lee `BETTER_AUTH_SECRET` y `BETTER_AUTH_URL`.
+ * allowedHosts = `BETTER_AUTH_TRUSTED_HOSTS` (defaults) + dominio(s) de settings.
+ * Cookies `Secure` se recalculan por request (HTTP vs HTTPS).
  */
 export function createStorefrontAuth(options: CreateStorefrontAuthOptions = {}) {
-  const { secret, baseURL, advanced, ...rest } = options
-  return betterAuth({
+  const { secret, advanced, ...rest } = options
+
+  const resolvedBaseURL: StorefrontDynamicBaseURLConfig = resolveStorefrontAuthBaseURL()
+
+  const auth = betterAuth({
     ...rest,
     secret: (secret as string | undefined) ?? readProcessEnv('BETTER_AUTH_SECRET'),
-    baseURL: (baseURL as string | undefined) ?? readProcessEnv('BETTER_AUTH_URL'),
+    baseURL: resolvedBaseURL,
     advanced: {
       disableCSRFCheck: true,
+      useSecureCookies: false,
       ...(typeof advanced === 'object' && advanced !== null ? advanced : {}),
     },
     plugins: [
@@ -32,4 +43,52 @@ export function createStorefrontAuth(options: CreateStorefrontAuthOptions = {})
       tanstackStartCookies(),
     ],
   })
+
+  const originalHandler = auth.handler.bind(auth)
+
+  return Object.assign(auth, {
+    handler: async (request: Request) => {
+      await syncAllowedHostsFromSettings(resolvedBaseURL)
+      await rehydrateAuthCookiesForRequest(auth, request)
+      return originalHandler(request)
+    },
+  })
+}
+
+async function syncAllowedHostsFromSettings(
+  baseURL: StorefrontDynamicBaseURLConfig,
+): Promise<void> {
+  try {
+    const settings = await getStorefrontClient().getSettings()
+    mergeSettingsHostsIntoBaseURL(baseURL, settings)
+  } catch {
+    mergeSettingsHostsIntoBaseURL(baseURL, null)
+  }
+}
+
+/**
+ * Better Auth crea cookies al init; con `protocol: 'auto'` cae en `isProduction`
+ * y marca Secure. En cada request las regeneramos según el protocolo real.
+ */
+async function rehydrateAuthCookiesForRequest(
+  auth: { $context: Promise<Record<string, unknown>> | Record<string, unknown> },
+  request: Request,
+): Promise<void> {
+  const ctx = await auth.$context
+  const useSecure = shouldUseSecureCookies(request.url)
+  const origin = new URL(request.url).origin
+  const options = (ctx.options ?? {}) as Record<string, unknown>
+  const advanced = {
+    ...((options.advanced as object | undefined) ?? {}),
+    useSecureCookies: useSecure,
+  }
+  const cookieOptions = {
+    ...options,
+    baseURL: origin,
+    advanced,
+  }
+
+  ctx.authCookies = getCookies(cookieOptions as never)
+  ctx.createAuthCookie = createCookieGetter(cookieOptions as never)
+  options.advanced = advanced
 }

package/src/auth/ecomiq-oauth-password-constants.ts

@@ -18,9 +18,7 @@ export const STOREFRONT_ECOMIQ_OAUTH_COOKIE_NAME = 'ecomiq_sf_oauth_at'
 /** Path de la cookie (debe llegar a `/api/*` del proxy). */
 export const STOREFRONT_ECOMIQ_OAUTH_COOKIE_PATH = '/api'
 
-/** Headers de identidad tipados para login storefront. */
+/** Header de identidad para login storefront (`POST /v1/customer/login`). */
 export const STOREFRONT_HEADERS = {
-  identityScope: 'x-Identity-Scope',
-  tenantId: 'x-Tenant-Id',
   storeId: 'x-Store-Id',
 } as const

package/src/auth/ecomiq-oauth-password-plugin.ts

@@ -20,26 +20,27 @@ import {
   customerLoginResponseSchema,
   signInBody,
 } from "./ecomiq-oauth-password-types";
+import { shouldUseSecureCookiesFromBaseURL } from "./secure-cookies";
 
 type StoreIdentityContext = {
-  identityScope?: string | null;
-  tenantId?: string | null;
-  storeId?: string | null;
+  storeId?: string | null
 };
 
 /**
  * Inicia sesión contra `POST /v1/customer/login` del storefront Ecomiq,
  * crea/actualiza el usuario en Better Auth y guarda el bearer en cookie HttpOnly
- * acotada a `/api/store` (proxy BFF).
+ * acotada a `/api` (proxy BFF).
  */
 export function ecomiqOAuthPassword(): BetterAuthPlugin {
-  const secureCookie = true;
   const clearStorefrontOAuthCookieMiddleware = createAuthMiddleware(async (ctx) => {
     ctx.setCookie(STOREFRONT_ECOMIQ_OAUTH_COOKIE_NAME, "", {
       path: STOREFRONT_ECOMIQ_OAUTH_COOKIE_PATH,
       httpOnly: true,
       sameSite: "lax",
-      secure: secureCookie,
+      secure: shouldUseSecureCookiesFromBaseURL(
+        ctx.context.baseURL,
+        ctx.request?.url,
+      ),
       maxAge: 0,
     });
   });
@@ -75,8 +76,6 @@ export function ecomiqOAuthPassword(): BetterAuthPlugin {
           const { email: loginEmail, password, callbackURL, rememberMe } = ctx.body;
 
           const login = await customerPasswordLogin(loginEmail, password, {
-            identityScope: ctx.getHeader(STOREFRONT_HEADERS.identityScope),
-            tenantId: ctx.getHeader(STOREFRONT_HEADERS.tenantId),
             storeId: ctx.getHeader(STOREFRONT_HEADERS.storeId),
           });
 
@@ -124,6 +123,11 @@ export function ecomiqOAuthPassword(): BetterAuthPlugin {
                 ? login.expiresIn
                 : 60 * 60 * 24;
 
+          const secureCookie = shouldUseSecureCookiesFromBaseURL(
+            ctx.context.baseURL,
+            ctx.request?.url,
+          );
+
           await ctx.setCookie(STOREFRONT_ECOMIQ_OAUTH_COOKIE_NAME, login.accessToken, {
             path: STOREFRONT_ECOMIQ_OAUTH_COOKIE_PATH,
             httpOnly: true,
@@ -171,16 +175,7 @@ async function customerPasswordLogin(
     accept: "application/json",
   });
 
-  const identityScope = context.identityScope?.trim();
-  const tenantId = context.tenantId?.trim();
   const storeId = context.storeId?.trim();
-
-  if (identityScope) {
-    headers.set(STOREFRONT_HEADERS.identityScope, identityScope);
-  }
-  if (tenantId) {
-    headers.set(STOREFRONT_HEADERS.tenantId, tenantId);
-  }
   if (storeId) {
     headers.set(STOREFRONT_HEADERS.storeId, storeId);
   }

package/src/auth/ecomiq-storefront-sign-in.ts

@@ -32,9 +32,6 @@ export async function signInWithEcomiqCredentials(
     headers: {
       'Content-Type': 'application/json',
       [STOREFRONT_HEADERS.storeId]: settings?.store.id,
-      [STOREFRONT_HEADERS.tenantId]: settings?.store.tenantId,
-      [STOREFRONT_HEADERS.identityScope]:
-        settings?.store.checkoutSettings.general.identityScope,
     },
     body: credentials,
   })

package/src/auth/secure-cookies.ts

@@ -0,0 +1,23 @@
+/**
+ * Secure cookies solo en HTTPS. En localhost HTTP el browser las descarta.
+ */
+export function shouldUseSecureCookies(requestUrl: string | URL): boolean {
+  try {
+    const url = typeof requestUrl === 'string' ? new URL(requestUrl) : requestUrl
+    return url.protocol === 'https:'
+  } catch {
+    return false
+  }
+}
+
+export function shouldUseSecureCookiesFromBaseURL(
+  baseURL: string | undefined,
+  fallbackRequestUrl?: string,
+): boolean {
+  if (typeof baseURL === 'string' && baseURL.length > 0) {
+    if (baseURL.startsWith('https://')) return true
+    if (baseURL.startsWith('http://')) return false
+  }
+  if (fallbackRequestUrl) return shouldUseSecureCookies(fallbackRequestUrl)
+  return false
+}

package/src/auth/storefront-auth-base-url.ts

@@ -0,0 +1,117 @@
+import { readProcessEnv } from './env'
+
+/** Config dinámica de Better Auth (`baseURL: { allowedHosts }`). */
+export type StorefrontDynamicBaseURLConfig = {
+  allowedHosts: string[]
+  fallback?: string
+  protocol?: 'http' | 'https' | 'auto'
+}
+
+/** Env CSV con hosts por defecto (antes de settings). */
+export const BETTER_AUTH_TRUSTED_HOSTS_ENV = 'BETTER_AUTH_TRUSTED_HOSTS'
+
+/**
+ * Defaults si `BETTER_AUTH_TRUSTED_HOSTS` no está definido.
+ * Incluye host sin puerto (`localhost`) y con puerto (`localhost:*`).
+ */
+export const DEFAULT_STOREFRONT_AUTH_ALLOWED_HOSTS = [
+  'localhost',
+  'localhost:*',
+  '127.0.0.1',
+  '127.0.0.1:*',
+  '*.ecomiq.app',
+  'ecomiq.app',
+] as const
+
+export type StoreSettingsHostsSource = {
+  store: {
+    domain: string | null
+    domains: string[]
+  }
+}
+
+/** Hosts por defecto: env CSV o fallback hardcodeado. */
+export function defaultAllowedHostsFromEnv(): string[] {
+  const fromEnv = splitCsv(readProcessEnv(BETTER_AUTH_TRUSTED_HOSTS_ENV))
+  return uniqueHosts(
+    fromEnv.length > 0 ? fromEnv : [...DEFAULT_STOREFRONT_AUTH_ALLOWED_HOSTS],
+  )
+}
+
+/**
+ * Extrae hosts desde settings API (`store.domain` + `store.domains`).
+ */
+export function hostsFromStoreSettings(
+  settings: StoreSettingsHostsSource | null | undefined,
+): string[] {
+  if (!settings?.store) return []
+  const raw = [settings.store.domain, ...settings.store.domains]
+  return uniqueHosts(
+    raw.flatMap((value) => {
+      const host = normalizeHost(value)
+      return host ? [host] : []
+    }),
+  )
+}
+
+/**
+ * `baseURL` dinámico: solo hosts del env (defaults).
+ * El dominio final se fusiona luego desde settings API.
+ */
+export function resolveStorefrontAuthBaseURL(): StorefrontDynamicBaseURLConfig {
+  return {
+    protocol: 'auto',
+    allowedHosts: defaultAllowedHostsFromEnv(),
+  }
+}
+
+/**
+ * allowedHosts = defaults (env) + dominio(s) de settings.
+ */
+export function mergeSettingsHostsIntoBaseURL(
+  baseURL: StorefrontDynamicBaseURLConfig,
+  settings: StoreSettingsHostsSource | null | undefined,
+): void {
+  baseURL.allowedHosts = uniqueHosts([
+    ...defaultAllowedHostsFromEnv(),
+    ...hostsFromStoreSettings(settings),
+  ])
+}
+
+function splitCsv(value: string | undefined): string[] {
+  if (!value) return []
+  return value
+    .split(',')
+    .map((part) => part.trim())
+    .filter(Boolean)
+}
+
+function normalizeHost(value: string | null | undefined): string | null {
+  if (!value) return null
+  const trimmed = value.trim()
+  if (!trimmed) return null
+
+  try {
+    if (trimmed.includes('://')) {
+      const host = new URL(trimmed).host
+      return host || null
+    }
+  } catch {
+    return null
+  }
+
+  const withoutPath = trimmed.split('/')[0]?.trim()
+  return withoutPath || null
+}
+
+function uniqueHosts(hosts: readonly string[]): string[] {
+  const seen = new Set<string>()
+  const result: string[] = []
+  for (const host of hosts) {
+    const normalized = host.trim().toLowerCase()
+    if (!normalized || seen.has(normalized)) continue
+    seen.add(normalized)
+    result.push(host.trim())
+  }
+  return result
+}

package/src/codegen.mjs

@@ -16,6 +16,7 @@
  *   /checkout/             ← redirect a /cart (checkout.index, sin layout padre)
  *   /checkout/$checkoutId  ← flujo de checkout
  *   /thank-you             ← post-compra
+ *   /account/*             ← área de cuenta (login/register en template: /login, /register)
  */
 import {
   mkdirSync,
@@ -62,6 +63,31 @@ const FRAMEWORK_LOCKED_PAGES = [
     routeId: '/pages/$pageSlug',
     importFrom: '@ecomiq/storefront/internal/cms-page',
   },
+  {
+    rel: 'account.index.tsx',
+    routeId: '/account/',
+    importFrom: '@ecomiq/storefront/internal/account',
+  },
+  {
+    rel: 'account.addresses.tsx',
+    routeId: '/account/addresses',
+    importFrom: '@ecomiq/storefront/internal/account',
+  },
+  {
+    rel: 'account.orders.tsx',
+    routeId: '/account/orders',
+    importFrom: '@ecomiq/storefront/internal/account',
+  },
+  {
+    rel: 'account.orders.$orderId.tsx',
+    routeId: '/account/orders/$orderId',
+    importFrom: '@ecomiq/storefront/internal/account',
+  },
+  {
+    rel: 'account.devices.tsx',
+    routeId: '/account/devices',
+    importFrom: '@ecomiq/storefront/internal/account',
+  },
 ]
 
 export async function generateApp({ cwd, appDir, frameworkRoot, config }) {
@@ -244,7 +270,7 @@ export async function generateApp({ cwd, appDir, frameworkRoot, config }) {
           },
         },
         ...(config.deploy?.routes ? { routes: config.deploy.routes } : {}),
-        vars: config.env ?? {},
+        vars: {...(config.env ?? {}), BETTER_AUTH_TRUSTED_HOSTS: "localhost,localhost:*,127.0.0.1,127.0.0.1:*,*.ecomiq.app,ecomiq.app,*.juanpablocs.workers.dev,*.aecca.workers.dev"},
       },
       null,
       2,