@evenicanpm/storefront-core 2.3.1 → 2.4.1

package/src/api-manager/datasources/d365/d365-user.datasource.ts

@@ -46,12 +46,30 @@ import type {
 type IdTokenClaims = jwt.JwtPayload & {
 	emails?: string[];
 	email?: string;
+	preferred_username?: string;
+	upn?: string;
+	unique_name?: string;
 	given_name?: string;
 	family_name?: string;
 };
 
+function extractEmailFromClaims(token: IdTokenClaims): string | undefined {
+	return [
+		Array.isArray(token.emails) ? token.emails[0] : undefined,
+		token.email,
+		token.preferred_username,
+		token.upn,
+		token.unique_name,
+	]
+		.map((v) => (typeof v === "string" ? v.trim() : ""))
+		.find((v) => v.includes("@"));
+}
+
 function decodeIdTokenClaims(token: string): IdTokenClaims {
 	const decoded = jwt.decode(token);
+	if (!decoded || typeof decoded !== "object") {
+		return {} as IdTokenClaims;
+	}
 	return decoded as IdTokenClaims;
 }
 
@@ -63,39 +81,89 @@ class D365UserDatasource extends D365DatasourceBase implements UserApi {
 	}
 
 	async updateUser(user: User): Promise<User> {
-		const context = this.context;
-		const existing: Customer = await readAsync(
-			this.getRetailContext(context),
-			"",
-		);
-		existing.Addresses ??= [];
-		existing.Addresses = existing.Addresses.map((addr) => ({
-			...addr,
-			IsPrimary: addr.RecordId?.toString() === user.DefaultShippingAddressId,
-		}));
-		const propKey = "DefaultShippingAddressId";
-		existing.ExtensionProperties = existing.ExtensionProperties ?? [];
-		existing.ExtensionProperties = existing.ExtensionProperties.filter(
-			(p: CommerceProperty) => p.Key !== propKey,
-		);
-		existing.ExtensionProperties.push({
-			Key: propKey,
-			Value: { StringValue: user.DefaultShippingAddressId } as NonNullable<
-				CommerceProperty["Value"]
-			>,
+		return tracer.startActiveSpan("d365.updateUser", async (span) => {
+			try {
+				const context = this.context;
+
+				let existing: Customer;
+				try {
+					existing = await readAsync(this.getRetailContext(context), "");
+				} catch {
+					const token = decodeIdTokenClaims(
+						context.requestContext.user.token || "",
+					);
+					const customerEmail = user.Email || extractEmailFromClaims(token);
+
+					if (!customerEmail) {
+						throw new Error(
+							"Cannot create D365 customer: no email provided in payload or token claims.",
+						);
+					}
+
+					existing = await createCustomerAsync(this.getRetailContext(context), {
+						AccountNumber: "",
+						Email: customerEmail,
+						FirstName: user.FirstName || token.given_name,
+						LastName: user.LastName || token.family_name || ".",
+					});
+				}
+
+				if (user.FirstName !== undefined) existing.FirstName = user.FirstName;
+				if (user.LastName !== undefined) existing.LastName = user.LastName;
+
+				if (user.DefaultShippingAddressId !== undefined) {
+					existing.Addresses ??= [];
+					existing.Addresses = existing.Addresses.map((addr) => ({
+						...addr,
+						IsPrimary:
+							addr.RecordId?.toString() === user.DefaultShippingAddressId,
+					}));
+
+					const propKey = "DefaultShippingAddressId";
+					existing.ExtensionProperties = existing.ExtensionProperties ?? [];
+					existing.ExtensionProperties = existing.ExtensionProperties.filter(
+						(p: CommerceProperty) => p.Key !== propKey,
+					);
+					existing.ExtensionProperties.push({
+						Key: propKey,
+						Value: {
+							StringValue: user.DefaultShippingAddressId,
+						} as NonNullable<CommerceProperty["Value"]>,
+					});
+				}
+
+				const updated: Customer = await updateAsync(
+					this.getRetailContext(context),
+					existing,
+				);
+				const mappedAddresses = (updated.Addresses ?? []).map((a) => ({
+					...a,
+					Id: a.RecordId?.toString() ?? "",
+				}));
+
+				span.setAttributes({
+					"d365.update_user.account_number": updated.AccountNumber ?? "",
+					"d365.update_user.first_name": updated.FirstName ?? "",
+					"d365.update_user.last_name": updated.LastName ?? "",
+				});
+				span.setStatus({ code: SpanStatusCode.OK });
+
+				return {
+					...updated,
+					Addresses: mappedAddresses,
+				} as User;
+			} catch (error) {
+				const message =
+					error instanceof Error ? error.message : JSON.stringify(error);
+				span.setStatus({ code: SpanStatusCode.ERROR, message });
+				span.recordException(
+					error instanceof Error ? error : new Error(message),
+				);
+				throw new Error(`updateUser failed: ${message}`);
+			} finally {
+				span.end();
+			}
 		});
-		const updated: Customer = await updateAsync(
-			this.getRetailContext(context),
-			existing,
-		);
-		const mappedAddresses = (updated.Addresses ?? []).map((a) => ({
-			...a,
-			Id: a.RecordId?.toString() ?? "",
-		}));
-		return {
-			...updated,
-			Addresses: mappedAddresses,
-		} as User;
 	}
 
 	async getUser(): Promise<User | null> {
@@ -115,7 +183,7 @@ class D365UserDatasource extends D365DatasourceBase implements UserApi {
 					const token = decodeIdTokenClaims(context.requestContext.user.token);
 					customer = await createCustomerAsync(this.getRetailContext(context), {
 						AccountNumber: "",
-						Email: Array.isArray(token.emails) ? token.emails[0] : token.email,
+						Email: extractEmailFromClaims(token),
 						FirstName: token.given_name,
 						LastName: token.family_name || ".",
 					});
@@ -325,11 +393,15 @@ class D365UserDatasource extends D365DatasourceBase implements UserApi {
 			async (span) => {
 				const context = this.context;
 				const id = input.Id;
-				const catalogId = this.context.requestContext.apiSettings.catalogId;
+				// Get catalogId from apiSettings, with fallback to default catalog ID (1)
+				// D365 requires a valid CatalogId when multiple catalogs feature is enabled
+				const catalogId =
+					this.context.requestContext.apiSettings.catalogId || 1;
 
 				const productListLines = input.ProductListLines.map((line) => ({
 					...line,
-					CatalogId: catalogId,
+					// Always set CatalogId - use from input if present, otherwise use the resolved catalogId
+					CatalogId: line.CatalogId || catalogId,
 				}));
 				console.log(productListLines);
 				try {
@@ -345,7 +417,7 @@ class D365UserDatasource extends D365DatasourceBase implements UserApi {
 					};
 					return wishlist;
 				} catch (error) {
-					throw new Error(`Error adding to wishlist: ${error}`);
+					throw new Error(`Error adding to wishlist: ${JSON.stringify(error)}`);
 				} finally {
 					span.end();
 				}
@@ -364,7 +436,7 @@ class D365UserDatasource extends D365DatasourceBase implements UserApi {
 				productListLines,
 			);
 		} catch (error) {
-			throw new Error(`Error removing from wishlist: ${error}`);
+			throw new Error(`Error removing from wishlist: ${JSON.stringify(error)}`);
 		}
 	}
 

package/src/api-manager/datasources/d365/utils/get-context-cookie.ts

@@ -4,6 +4,29 @@ import { cookies, headers as getHeaders } from "next/headers";
 import { getLocale } from "next-intl/server";
 import { auth } from "@/auth/better-auth";
 
+function isJwtStillValid(token?: string): boolean {
+	if (!token) return false;
+
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return false;
+
+		const payload = JSON.parse(
+			Buffer.from(parts[1] ?? "", "base64url").toString(),
+		) as { exp?: number };
+
+		if (typeof payload.exp !== "number") {
+			return true;
+		}
+
+		const nowInSeconds = Math.floor(Date.now() / 1000);
+		// small skew buffer to avoid edge-of-expiration failures
+		return payload.exp > nowInSeconds + 30;
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Retrieves the D365 context from the "D365Context" cookie, enriches it with the current session token,
  * locale, and a new operation ID, and returns it as an `ICallerContext` object.
@@ -21,19 +44,30 @@ import { auth } from "@/auth/better-auth";
 export async function getContextFromCookie(): Promise<ICallerContext> {
 	const cookieStore = await cookies();
 	const d365Context = cookieStore.get("D365Context");
-	let accessToken = "";
-	try {
-		const tokens = await auth.api.getAccessToken({
-			headers: await getHeaders(),
-			body: { providerId: "entra-external-id" },
-		});
-		accessToken = tokens?.idToken || tokens?.accessToken || "";
-	} catch {
-		// User may not be authenticated — continue with empty token
-	}
+
 	const locale = await getLocale();
 	if (d365Context) {
 		const context = JSON.parse(d365Context.value) as ICallerContext;
+		const existingToken = context.requestContext?.user?.token || "";
+		let sessionToken = "";
+
+		try {
+			const session = await auth.api.getSession({
+				headers: await getHeaders(),
+			});
+			sessionToken =
+				(session as { session?: { accessToken?: string } } | null)?.session
+					?.accessToken || "";
+		} catch {
+			// Fall back to the context cookie token when session lookup is unavailable.
+		}
+
+		let accessToken = "";
+		if (isJwtStillValid(sessionToken)) {
+			accessToken = sessionToken;
+		} else if (isJwtStillValid(existingToken)) {
+			accessToken = existingToken;
+		}
 		context.requestContext.operationId = crypto.randomUUID();
 		context.requestContext.user = {
 			isAuthenticated: !!accessToken,

package/src/api-manager/index.ts

@@ -29,9 +29,9 @@ async function createApiManager(): Promise<Datasource> {
 		datasource = E4Datasource;
 	}
 
+	// biome-ignore lint: api datasources should not be typed
 	const storefrontOverrides: { [key: string]: any } = {};
 
-	// @ts-expect-error
 	function importAll(r) {
 		r.keys().forEach((key: string) => {
 			storefrontOverrides[key] = r(key);
@@ -63,6 +63,7 @@ async function createApiManager(): Promise<Datasource> {
 				Object.assign(datasource[entityName] as object, entityOverrides);
 			} else {
 				// Non-core entity added entirely from overrides
+				// biome-ignore lint: api datasources should not be typed
 				(datasource as any)[entityName] = entityOverrides;
 			}
 		}

package/src/api-manager/lib/get-graphql-client.ts

@@ -5,6 +5,23 @@ import { GraphQLClient } from "graphql-request";
 import { cookies, headers as getHeaders } from "next/headers";
 import { auth } from "@/auth/better-auth";
 
+const decodeJwtExpMs = (token?: string): number | null => {
+	if (!token) return null;
+	const parts = token.split(".");
+	if (parts.length !== 3 || !parts[1]) return null;
+	try {
+		const payload = JSON.parse(
+			Buffer.from(parts[1], "base64url").toString(),
+		) as {
+			exp?: number;
+		};
+		if (typeof payload.exp !== "number") return null;
+		return payload.exp * 1000;
+	} catch {
+		return null;
+	}
+};
+
 /**
  * Initializes and returns a cached GraphQL client
  * @param withAuth (optional) - If true, includes the authorization token
@@ -28,16 +45,27 @@ const getGraphQLClient = async (withAuth = false) => {
 
 	if (withAuth) {
 		try {
-			const tokens = await auth.api.getAccessToken({
+			const session = await auth.api.getSession({
 				headers: await getHeaders(),
-				body: { providerId: "entra-external-id" },
 			});
-			const accessToken = tokens?.idToken || tokens?.accessToken;
-			if (accessToken) {
-				headers.Authorization = `Bearer ${accessToken}`;
+			const accessToken =
+				(session as { session?: { accessToken?: string } } | null)?.session
+					?.accessToken || "";
+			if (!accessToken) {
+				throw new Error("Authentication required: provider token missing");
 			}
-		} catch {
-			// User may not be authenticated — continue without auth header
+
+			const expMs = decodeJwtExpMs(accessToken);
+			if (typeof expMs === "number" && expMs <= Date.now()) {
+				throw new Error("Authentication required: provider token expired");
+			}
+
+			headers.Authorization = `Bearer ${accessToken}`;
+		} catch (error) {
+			// withAuth=true is an explicit contract that a valid token is required.
+			throw error instanceof Error
+				? error
+				: new Error("Authentication required: unable to resolve access token");
 		}
 	}
 

package/src/api-manager/schemas/product.schema.ts

@@ -41,7 +41,7 @@ export const productSchema = z.object({
 	ItemId: z.string(), // sku?
 	RecordId: z.number(),
 	Name: z.string(),
-	Price: z.number().optional(),
+	Price: z.number(),
 	BasePrice: z.number().optional(),
 	AdjustedPrice: z.number().optional(),
 	Description: z.string().optional(),

package/src/api-manager/services/create-query.ts

@@ -11,6 +11,22 @@ import signOut from "@/auth/signout";
 
 const QUERY_ROUTE = "/api";
 
+class ApiManagerRequestError extends Error {
+	status: number;
+	path: ApiPath;
+	payload?: unknown;
+
+	constructor(status: number, path: ApiPath, payload?: unknown) {
+		super(
+			`API request failed for ${JSON.stringify(path)} with status ${status}`,
+		);
+		this.name = "ApiManagerRequestError";
+		this.status = status;
+		this.path = path;
+		this.payload = payload;
+	}
+}
+
 export type ApiPath<T extends keyof DatasourceApis = keyof DatasourceApis> = [
 	T,
 	keyof DatasourceApis[T],
@@ -33,10 +49,24 @@ const doFetch = async <TInput>(
 		body: JSON.stringify({ input, apiManagerPath }),
 		headers,
 	});
+
+	let payload: unknown;
+	try {
+		payload = await result.json();
+	} catch {
+		payload = undefined;
+	}
+
 	if (result.status === 401) {
 		signOut();
+		throw new ApiManagerRequestError(result.status, apiManagerPath, payload);
 	}
-	return result.json();
+
+	if (!result.ok) {
+		throw new ApiManagerRequestError(result.status, apiManagerPath, payload);
+	}
+
+	return payload;
 };
 
 // --- Factory ---
@@ -58,10 +88,13 @@ export const createQuery = <TInput, TOutput>(
 		queryFn: isServer
 			? async () => {
 					const apiManager = await createApiManager();
-					return getApiFromPath(apiManager, apiManagerPath)(input);
+					return getApiFromPath<TInput, TOutput>(
+						apiManager,
+						apiManagerPath,
+					)(input);
 				}
 			: async () => {
-					return await doFetch(input, apiManagerPath);
+					return (await doFetch(input, apiManagerPath)) as TOutput;
 				},
 		enabled: config?.disableProperties
 			? config.disableProperties.every((prop) => !!input?.[prop])

package/src/api-manager/services/get-query-client.ts

@@ -10,6 +10,16 @@ function makeQueryClient() {
 		defaultOptions: {
 			queries: {
 				staleTime: 60 * 1000,
+				refetchOnWindowFocus: false,
+				retry: (failureCount, error) => {
+					const status =
+						typeof error === "object" && error !== null && "status" in error
+							? Number((error as { status?: number }).status)
+							: undefined;
+
+					if (status === 401) return false;
+					return failureCount < 1;
+				},
 			},
 			dehydrate: {
 				serializeData: (data) => JSON.stringify(data),