@evenicanpm/storefront-core 2.4.0 → 2.4.2

package/src/api-manager/datasources/d365/utils/get-context-cookie.ts

@@ -4,6 +4,29 @@ import { cookies, headers as getHeaders } from "next/headers";
 import { getLocale } from "next-intl/server";
 import { auth } from "@/auth/better-auth";
 
+function isJwtStillValid(token?: string): boolean {
+	if (!token) return false;
+
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return false;
+
+		const payload = JSON.parse(
+			Buffer.from(parts[1] ?? "", "base64url").toString(),
+		) as { exp?: number };
+
+		if (typeof payload.exp !== "number") {
+			return true;
+		}
+
+		const nowInSeconds = Math.floor(Date.now() / 1000);
+		// small skew buffer to avoid edge-of-expiration failures
+		return payload.exp > nowInSeconds + 30;
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Retrieves the D365 context from the "D365Context" cookie, enriches it with the current session token,
  * locale, and a new operation ID, and returns it as an `ICallerContext` object.
@@ -21,19 +44,30 @@ import { auth } from "@/auth/better-auth";
 export async function getContextFromCookie(): Promise<ICallerContext> {
 	const cookieStore = await cookies();
 	const d365Context = cookieStore.get("D365Context");
-	let accessToken = "";
-	try {
-		const tokens = await auth.api.getAccessToken({
-			headers: await getHeaders(),
-			body: { providerId: "entra-external-id" },
-		});
-		accessToken = tokens?.idToken || tokens?.accessToken || "";
-	} catch {
-		// User may not be authenticated — continue with empty token
-	}
+
 	const locale = await getLocale();
 	if (d365Context) {
 		const context = JSON.parse(d365Context.value) as ICallerContext;
+		const existingToken = context.requestContext?.user?.token || "";
+		let sessionToken = "";
+
+		try {
+			const session = await auth.api.getSession({
+				headers: await getHeaders(),
+			});
+			sessionToken =
+				(session as { session?: { accessToken?: string } } | null)?.session
+					?.accessToken || "";
+		} catch {
+			// Fall back to the context cookie token when session lookup is unavailable.
+		}
+
+		let accessToken = "";
+		if (isJwtStillValid(sessionToken)) {
+			accessToken = sessionToken;
+		} else if (isJwtStillValid(existingToken)) {
+			accessToken = existingToken;
+		}
 		context.requestContext.operationId = crypto.randomUUID();
 		context.requestContext.user = {
 			isAuthenticated: !!accessToken,

package/src/api-manager/lib/get-graphql-client.ts

@@ -5,6 +5,23 @@ import { GraphQLClient } from "graphql-request";
 import { cookies, headers as getHeaders } from "next/headers";
 import { auth } from "@/auth/better-auth";
 
+const decodeJwtExpMs = (token?: string): number | null => {
+	if (!token) return null;
+	const parts = token.split(".");
+	if (parts.length !== 3 || !parts[1]) return null;
+	try {
+		const payload = JSON.parse(
+			Buffer.from(parts[1], "base64url").toString(),
+		) as {
+			exp?: number;
+		};
+		if (typeof payload.exp !== "number") return null;
+		return payload.exp * 1000;
+	} catch {
+		return null;
+	}
+};
+
 /**
  * Initializes and returns a cached GraphQL client
  * @param withAuth (optional) - If true, includes the authorization token
@@ -28,16 +45,27 @@ const getGraphQLClient = async (withAuth = false) => {
 
 	if (withAuth) {
 		try {
-			const tokens = await auth.api.getAccessToken({
+			const session = await auth.api.getSession({
 				headers: await getHeaders(),
-				body: { providerId: "entra-external-id" },
 			});
-			const accessToken = tokens?.idToken || tokens?.accessToken;
-			if (accessToken) {
-				headers.Authorization = `Bearer ${accessToken}`;
+			const accessToken =
+				(session as { session?: { accessToken?: string } } | null)?.session
+					?.accessToken || "";
+			if (!accessToken) {
+				throw new Error("Authentication required: provider token missing");
 			}
-		} catch {
-			// User may not be authenticated — continue without auth header
+
+			const expMs = decodeJwtExpMs(accessToken);
+			if (typeof expMs === "number" && expMs <= Date.now()) {
+				throw new Error("Authentication required: provider token expired");
+			}
+
+			headers.Authorization = `Bearer ${accessToken}`;
+		} catch (error) {
+			// withAuth=true is an explicit contract that a valid token is required.
+			throw error instanceof Error
+				? error
+				: new Error("Authentication required: unable to resolve access token");
 		}
 	}
 

package/src/api-manager/services/create-query.ts

@@ -11,6 +11,22 @@ import signOut from "@/auth/signout";
 
 const QUERY_ROUTE = "/api";
 
+class ApiManagerRequestError extends Error {
+	status: number;
+	path: ApiPath;
+	payload?: unknown;
+
+	constructor(status: number, path: ApiPath, payload?: unknown) {
+		super(
+			`API request failed for ${JSON.stringify(path)} with status ${status}`,
+		);
+		this.name = "ApiManagerRequestError";
+		this.status = status;
+		this.path = path;
+		this.payload = payload;
+	}
+}
+
 export type ApiPath<T extends keyof DatasourceApis = keyof DatasourceApis> = [
 	T,
 	keyof DatasourceApis[T],
@@ -33,10 +49,24 @@ const doFetch = async <TInput>(
 		body: JSON.stringify({ input, apiManagerPath }),
 		headers,
 	});
+
+	let payload: unknown;
+	try {
+		payload = await result.json();
+	} catch {
+		payload = undefined;
+	}
+
 	if (result.status === 401) {
 		signOut();
+		throw new ApiManagerRequestError(result.status, apiManagerPath, payload);
 	}
-	return result.json();
+
+	if (!result.ok) {
+		throw new ApiManagerRequestError(result.status, apiManagerPath, payload);
+	}
+
+	return payload;
 };
 
 // --- Factory ---
@@ -58,10 +88,13 @@ export const createQuery = <TInput, TOutput>(
 		queryFn: isServer
 			? async () => {
 					const apiManager = await createApiManager();
-					return getApiFromPath(apiManager, apiManagerPath)(input);
+					return getApiFromPath<TInput, TOutput>(
+						apiManager,
+						apiManagerPath,
+					)(input);
 				}
 			: async () => {
-					return await doFetch(input, apiManagerPath);
+					return (await doFetch(input, apiManagerPath)) as TOutput;
 				},
 		enabled: config?.disableProperties
 			? config.disableProperties.every((prop) => !!input?.[prop])

package/src/api-manager/services/get-query-client.ts

@@ -10,6 +10,16 @@ function makeQueryClient() {
 		defaultOptions: {
 			queries: {
 				staleTime: 60 * 1000,
+				refetchOnWindowFocus: false,
+				retry: (failureCount, error) => {
+					const status =
+						typeof error === "object" && error !== null && "status" in error
+							? Number((error as { status?: number }).status)
+							: undefined;
+
+					if (status === 401) return false;
+					return failureCount < 1;
+				},
 			},
 			dehydrate: {
 				serializeData: (data) => JSON.stringify(data),

package/src/auth/better-auth.ts

@@ -1,19 +1,231 @@
+import type { Auth, BetterAuthOptions } from "better-auth";
 import { betterAuth } from "better-auth";
 import { nextCookies } from "better-auth/next-js";
+import { decryptOAuthToken, setTokenUtil } from "better-auth/oauth2";
 import { customSession, genericOAuth } from "better-auth/plugins";
+import { Pool } from "pg";
+
+function toValidDate(dateLike: unknown): Date | null {
+	if (dateLike instanceof Date) {
+		return Number.isNaN(dateLike.getTime()) ? null : dateLike;
+	}
+
+	if (typeof dateLike === "string" || typeof dateLike === "number") {
+		const date = new Date(dateLike);
+		return Number.isNaN(date.getTime()) ? null : date;
+	}
+
+	return null;
+}
+
+/**
+ * Check if a date/timestamp has already passed (expired).
+ */
+function isPast(dateLike: unknown): boolean {
+	if (!dateLike) return false;
+	const date = toValidDate(dateLike);
+	if (!date) return false;
+	return date.getTime() <= Date.now();
+}
+
+/**
+ * Check if a date/timestamp is within a specified number of milliseconds from now.
+ * Useful for detecting tokens approaching expiry.
+ */
+function isWithinMs(dateLike: unknown, windowMs: number): boolean {
+	if (!dateLike) return false;
+	const date = toValidDate(dateLike);
+	if (!date) return false;
+	return date.getTime() - Date.now() <= windowMs;
+}
+
+/**
+ * Proactive refresh window: refresh access tokens 5 minutes before expiry.
+ * Prevents users from being signed out when their token expires.
+ * Better Auth's default is only ~5 seconds, which is too late.
+ */
+const ACCESS_TOKEN_REFRESH_WINDOW_MS = 5 * 60 * 1000;
+
+type EntraAccount = {
+	id?: string;
+	providerId?: string;
+	idToken?: string | null;
+	accessToken?: string | null;
+	refreshToken?: string | null;
+	accessTokenExpiresAt?: Date | null;
+	refreshTokenExpiresAt?: Date | null;
+	scope?: string | null;
+};
+
+async function decryptStoredOAuthToken(
+	token: string | null | undefined,
+	context: Parameters<typeof decryptOAuthToken>[1],
+): Promise<string> {
+	if (!token) return "";
+
+	try {
+		return await decryptOAuthToken(token, context);
+	} catch {
+		return "";
+	}
+}
+
+async function resolveEntraRefreshProvider(
+	socialProvidersSource: unknown,
+): Promise<{
+	id?: string;
+	refreshAccessToken?: (token: string) => Promise<{
+		accessToken?: string;
+		refreshToken?: string;
+		accessTokenExpiresAt?: Date | null;
+		refreshTokenExpiresAt?: Date | null;
+		idToken?: string;
+		scopes?: string[];
+	} | null>;
+} | null> {
+	const socialProviders =
+		typeof socialProvidersSource === "function"
+			? await socialProvidersSource()
+			: await Promise.resolve(socialProvidersSource);
+
+	if (Array.isArray(socialProviders)) {
+		return (
+			socialProviders.find(
+				(provider: { id?: string }) => provider?.id === "entra-external-id",
+			) || null
+		);
+	}
+
+	if (socialProviders && typeof socialProviders === "object") {
+		return (
+			(
+				socialProviders as Record<
+					string,
+					{
+						id?: string;
+						refreshAccessToken?: (token: string) => Promise<{
+							accessToken?: string;
+							refreshToken?: string;
+							accessTokenExpiresAt?: Date | null;
+							refreshTokenExpiresAt?: Date | null;
+							idToken?: string;
+							scopes?: string[];
+						} | null>;
+					}
+				>
+			)["entra-external-id"] || null
+		);
+	}
+
+	return null;
+}
+
+async function updateStoredEntraTokens(
+	account: EntraAccount,
+	refreshed: {
+		accessToken?: string;
+		refreshToken?: string;
+		accessTokenExpiresAt?: Date | null;
+		refreshTokenExpiresAt?: Date | null;
+		idToken?: string;
+		scopes?: string[];
+	} | null,
+	context: Parameters<typeof decryptOAuthToken>[1] & {
+		internalAdapter: {
+			updateAccount: (
+				accountId: string,
+				data: Record<string, unknown>,
+			) => Promise<unknown>;
+		};
+	},
+): Promise<void> {
+	if (!account.id || !refreshed) return;
+
+	const updatedAccessToken = refreshed.accessToken
+		? await setTokenUtil(refreshed.accessToken, context)
+		: account.accessToken;
+	const updatedRefreshToken = refreshed.refreshToken
+		? await setTokenUtil(refreshed.refreshToken, context)
+		: account.refreshToken;
+
+	await context.internalAdapter.updateAccount(account.id, {
+		accessToken: updatedAccessToken,
+		refreshToken: updatedRefreshToken,
+		accessTokenExpiresAt:
+			refreshed.accessTokenExpiresAt || account.accessTokenExpiresAt,
+		refreshTokenExpiresAt:
+			refreshed.refreshTokenExpiresAt || account.refreshTokenExpiresAt,
+		idToken: refreshed.idToken || account.idToken,
+		scope: refreshed.scopes?.join(",") || account.scope,
+	});
+}
+
+async function refreshEntraTokens(
+	account: EntraAccount,
+	context: Parameters<typeof decryptOAuthToken>[1] & {
+		socialProviders: unknown;
+		internalAdapter: {
+			updateAccount: (
+				accountId: string,
+				data: Record<string, unknown>,
+			) => Promise<unknown>;
+		};
+	},
+): Promise<{
+	accessToken?: string;
+	refreshToken?: string;
+	accessTokenExpiresAt?: Date | null;
+	refreshTokenExpiresAt?: Date | null;
+	idToken?: string;
+	scopes?: string[];
+} | null> {
+	const provider = await resolveEntraRefreshProvider(context.socialProviders);
+	if (!provider?.refreshAccessToken) {
+		console.warn(
+			"[better-auth] proactive refresh skipped: provider not resolvable",
+		);
+		return null;
+	}
+
+	const refreshToken = await decryptOAuthToken(
+		account.refreshToken || "",
+		context,
+	);
+	const refreshed = await provider.refreshAccessToken(refreshToken);
+	await updateStoredEntraTokens(account, refreshed, context);
+	return refreshed;
+}
 
 const tenantName = process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_TENANT_NAME || "";
 const loginAuthority = `https://${tenantName}.ciamlogin.com/${tenantName}.onmicrosoft.com`;
 
-export const auth = betterAuth({
+const globalForAuthDb = globalThis as typeof globalThis & {
+	storefrontAuthDbPool?: Pool;
+};
+
+const authDbPool =
+	globalForAuthDb.storefrontAuthDbPool ||
+	new Pool({
+		connectionString: process.env.AUTH_DB_URL,
+	});
+
+if (process.env.NODE_ENV !== "production") {
+	globalForAuthDb.storefrontAuthDbPool = authDbPool;
+}
+
+const authConfig = {
 	secret: process.env.BETTER_AUTH_SECRET,
-	baseURL: process.env.BETTER_AUTH_URL || process.env.NEXTAUTH_URL,
+	baseURL: process.env.BETTER_AUTH_URL,
+	database: authDbPool,
+	// Required for native screen login: Entra ROPC validates the password,
+	// Better Auth uses email/password internally only to create a session.
+	// The entra-external-id account with real OAuth tokens is upserted separately.
+	emailAndPassword: {
+		enabled: true,
+	},
 	session: {
 		cookieCache: {
-			enabled: true,
-			maxAge: 60 * 60, // 1 hour
-			strategy: "jwe",
-			refreshCache: true,
+			enabled: false,
 		},
 	},
 	account: {
@@ -24,10 +236,10 @@ export const auth = betterAuth({
 		genericOAuth({
 			config: [
 				{
+					// Entra External ID is configured as public client.
+					// No client secret is sent during refresh (Entra rejects it).
 					providerId: "entra-external-id",
 					clientId: process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_ID || "",
-					clientSecret:
-						process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CLIENT_SECRET || "",
 					discoveryUrl: `${loginAuthority}/v2.0/.well-known/openid-configuration`,
 					scopes: (
 						process.env.NEXT_PUBLIC_ENTRA_EXTERNAL_ID_CUSTOM_SCOPES ||
@@ -60,30 +272,85 @@ export const auth = betterAuth({
 				},
 			],
 		}),
+		// Custom session plugin that:
+		// 1. Reads Entra account tokens from public.account table
+		// 2. Attempts proactive refresh 5 minutes before expiry
+		// 3. Prevents unexpected signout by keeping current token until truly expired
 		customSession(async ({ user, session }, ctx) => {
 			let accessToken = "";
+			let graphAccessToken = "";
 			try {
-				const accounts = await ctx.context.internalAdapter.findAccounts(
+				const accounts = (await ctx.context.internalAdapter.findAccounts(
 					user.id,
-				);
+				)) as EntraAccount[] | undefined;
 				const account = accounts?.find(
-					(a) => a.providerId === "entra-external-id",
+					(storedAccount) => storedAccount.providerId === "entra-external-id",
 				);
-				// For Entra External ID, use id_token as the access token
-				accessToken = account?.idToken || account?.accessToken || "";
+				if (!account) {
+					return {
+						user,
+						session: {
+							...session,
+							accessToken,
+							graphAccessToken,
+						},
+					};
+				}
+
+				const tokenExpired = isPast(account.accessTokenExpiresAt);
+				const shouldRefreshUpfront = isWithinMs(
+					account.accessTokenExpiresAt,
+					ACCESS_TOKEN_REFRESH_WINDOW_MS,
+				);
+				const currentIdToken = account.idToken || "";
+				const currentGraphToken = await decryptStoredOAuthToken(
+					account.accessToken,
+					ctx.context,
+				);
+
+				// Keep ID token for D365 and access token for Graph while valid.
+				accessToken = tokenExpired ? "" : currentIdToken;
+				graphAccessToken = tokenExpired ? "" : currentGraphToken;
+
+				// Attempt proactive refresh if token is within 5-minute window and a refresh token exists.
+				// This ensures users stay signed in without waiting until token expires.
+				if (account.refreshToken && shouldRefreshUpfront) {
+					try {
+						const refreshed = await refreshEntraTokens(account, ctx.context);
+						if (refreshed) {
+							// Keep ID token for D365 and access token for Graph APIs.
+							accessToken = refreshed.idToken || account.idToken || accessToken;
+							graphAccessToken = refreshed.accessToken || graphAccessToken;
+						}
+					} catch (error) {
+						// Preserve the current token and avoid signing out early on refresh failures.
+						console.warn(
+							"[better-auth] proactive refresh failed for entra-external-id",
+							error,
+						);
+					}
+				}
 			} catch {
-				// Account data may not be accessible in all modes
+				// Account data may not be accessible in all modes.
+				// Keep existing empty default if we cannot read account data.
 			}
 			return {
 				user,
 				session: {
 					...session,
 					accessToken,
+					graphAccessToken,
 				},
 			};
 		}),
 		nextCookies(), // must be last plugin
 	],
-});
+} satisfies Parameters<typeof betterAuth>[0];
+
+const auth: Auth<BetterAuthOptions> = betterAuth(
+	authConfig as BetterAuthOptions,
+);
+
+export { auth };
 
 export type Session = typeof auth.$Infer.Session;

package/src/cms/blocks/components/product-section-fullwidth/index.tsx

@@ -31,7 +31,9 @@ export default async function ProductSectionFullWidth(
 
 	const skus = data?.ProductWrapper?.map((element) => element?.product?.sku);
 
-	const e4Products = await getProductByIds.fetchData(queryClient, { id: skus });
+	const e4Products = (await getProductByIds.fetchData(queryClient, {
+		id: skus,
+	})) as SimpleProduct[] | undefined;
 
 	if (!e4Products?.length) {
 		return null;

package/src/components/categories/category-list/category-list.tsx

@@ -40,7 +40,12 @@ const CategoryList = ({
 	children,
 }: RootProps) => {
 	const { data: fetchedCategories } = getCategories.useSuspenseData();
-	const cats = categories ?? fetchedCategories ?? [];
+	let cats: typeof categories = [];
+	if (Array.isArray(categories)) {
+		cats = categories;
+	} else if (Array.isArray(fetchedCategories)) {
+		cats = fetchedCategories;
+	}
 
 	const megaMenuRenderers: Record<
 		MegaMenuType,
@@ -69,7 +74,8 @@ CategoryList.Item = ({ category }: ItemProps) => {
 	if (!ctx) return null;
 	const { megaMenuRenderers } = ctx;
 	const { RecordId, Name, Url, Children } = category;
-	const hasChildren = !!Children?.length;
+	const childCategories = Array.isArray(Children) ? Children : [];
+	const hasChildren = childCategories.length > 0;
 
 	// Sub menu can also be "categories/mega-menu/mega-menu-1" or "mega-menu-2",
 	// Mega menus have submenu items listed in columns and also have option to show banners(offers).
@@ -83,9 +89,7 @@ CategoryList.Item = ({ category }: ItemProps) => {
 			title={Name ?? ""}
 			caret={hasChildren}
 			render={
-				Children && Children.length > 0
-					? megaMenuRenderers[menuType]?.(Children)
-					: null
+				hasChildren ? megaMenuRenderers[menuType]?.(childCategories) : null
 			}
 		/>
 	);