@faststore/api 1.12.50 → 1.12.52

package/dist/api.cjs.development.js

@@ -22,7 +22,7 @@ var api = require('@opentelemetry/api');
 var apiLogs = require('@opentelemetry/api-logs');
 
 var name = "@faststore/api";
-var version = "1.12.49";
+var version = "1.12.51";
 var license = "MIT";
 var main = "dist/index.js";
 var typings = "dist/index.d.ts";
@@ -91,8 +91,39 @@ var packageJson = {
 	peerDependencies: peerDependencies
 };
 
-const USER_AGENT = `${packageJson.name}@${packageJson.version}`;
-const fetchAPI = async (info, init) => {
+const USER_AGENT = `${packageJson.name}@${packageJson.version}`; // Headers that may carry credentials: store API keys (`X-VTEX-API-AppKey`,
+// `X-VTEX-API-AppToken`), shopper cookies (`Cookie`, `Set-Cookie`,
+// `VtexIdclientAutCookie_*`), `Authorization`, and generic token, secret or
+// API key headers. They are replaced before a failed request and its response
+// are logged. Matched by substring so new credential headers are covered too.
+
+const SENSITIVE_HEADER = /authorization|cookie|token|secret|api-?key|appkey/i;
+const REDACTED = '[redacted]';
+const redactHeaders = headers => {
+  if (!headers) {
+    return undefined;
+  }
+
+  const redacted = {};
+
+  const add = (name, value) => {
+    redacted[name] = SENSITIVE_HEADER.test(name) ? REDACTED : value;
+  };
+
+  if (Array.isArray(headers)) {
+    headers.forEach(([name, value]) => add(name, value));
+  } else if (typeof headers.forEach === 'function') {
+    // Matches both the global `Headers` and the polyfill returned by
+    // `isomorphic-unfetch` on Node, which isn't an instance of the global one.
+    const headerList = headers;
+    headerList.forEach((value, name) => add(name, value));
+  } else {
+    Object.entries(headers).forEach(([name, value]) => add(name, value));
+  }
+
+  return redacted;
+};
+const fetchAPI = async (info, init, options) => {
   const response = await fetch(info, { ...init,
     headers: { ...(init == null ? void 0 : init.headers),
       'User-Agent': USER_AGENT
@@ -100,25 +131,200 @@ const fetchAPI = async (info, init) => {
   });
 
   if (response.ok) {
+    if (options != null && options.storeCookies) {
+      options.storeCookies(response.headers);
+    }
+
     return response.status !== 204 ? response.json() : undefined;
-  }
+  } // Log a summary instead of the raw Response, whose headers may include
+  // `Set-Cookie` with shopper credentials. The request body is omitted because
+  // it can carry personal data (e.g. the newsletter email and name).
+
 
-  console.error(info, init, response);
+  console.error( // Only the URL: a `Request` instance could carry unredacted headers.
+  typeof info === 'string' ? info : info.url, init && { ...init,
+    headers: redactHeaders(init.headers),
+    body: init.body ? REDACTED : undefined
+  }, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: redactHeaders(response.headers)
+  });
   const text = await response.text();
   throw new Error(text);
 };
 
+const MATCH_FIRST_SET_COOKIE_KEY_VALUE = /^([^=]+)=([^;]*)/;
+/**
+ * Splits a combined `set-cookie` header value (cookies joined by `, `) into
+ * individual cookies. Commas inside `expires=...` dates are kept.
+ */
+
+const splitSetCookieHeader = value => value.split(/,(?=\s*[^;,=\s]+=)/).map(setCookie => setCookie.trim());
+/**
+ * Returns every `set-cookie` value of a fetch response.
+ *
+ * `Headers.getSetCookie()` only exists on Node >= 18.14 (undici). FastStore v1
+ * stores may still run on Node 16, where isomorphic-unfetch falls back to
+ * node-fetch v2, which exposes repeated headers through `raw()` instead.
+ */
+
+
+const getSetCookies = headers => {
+  const maybeHeaders = headers;
+
+  if (typeof maybeHeaders.getSetCookie === 'function') {
+    return maybeHeaders.getSetCookie();
+  }
+
+  if (typeof maybeHeaders.raw === 'function') {
+    var _maybeHeaders$raw$set;
+
+    return (_maybeHeaders$raw$set = maybeHeaders.raw()['set-cookie']) != null ? _maybeHeaders$raw$set : [];
+  }
+
+  const setCookie = headers.get('set-cookie');
+  return setCookie ? splitSetCookieHeader(setCookie) : [];
+};
+/**
+ * This function updates the ctx.storage.cookies, that is used in each request.
+ *
+ * ctx.storage.cookies is a Map<string[1], Record<string, string>[2]> where,
+ * [1] cookie key
+ * [2] {
+ *       value: cookie value,
+ *       setCookie: setCookie used in browser response
+ *     }
+ */
+
+const updatesContextStorageCookies = (ctx, setCookieValue) => {
+  const matchCookie = setCookieValue.match(MATCH_FIRST_SET_COOKIE_KEY_VALUE);
+
+  if (matchCookie) {
+    const cookieKey = matchCookie[1];
+    const cookieValue = matchCookie[2];
+    ctx.storage.cookies.set(cookieKey, {
+      value: cookieValue,
+      setCookie: setCookieValue
+    });
+  }
+};
+const setCookie = (ctx, headers) => {
+  getSetCookies(headers).forEach(setCookieValue => updatesContextStorageCookies(ctx, setCookieValue));
+};
+const getStoreCookie = ctx => headers => setCookie(ctx, headers);
+/**
+ * This function returns a modified copy of the original cookie header (ctx.headers.cookie from the first request)
+ * with the cookie values that comes in each request (ctx.storage.cookies).
+ * If there is no cookies in storage, the ctx.headers?.cookie is used
+ *
+ * ctx.storage.cookies is a Map<string[1], Record<string, string>[2]> where,
+ * [1] cookie key
+ * [2] {
+ *       value: cookie value,
+ *       setCookie: setCookie used in browser response
+ *     }
+ */
+
+const getUpdatedCookie = ctx => {
+  var _ctx$headers;
+
+  if (!((_ctx$headers = ctx.headers) != null && _ctx$headers.cookie)) {
+    return null;
+  }
+
+  const contextStorageCookies = Array.from(ctx.storage.cookies.entries());
+
+  if (contextStorageCookies.length === 0) {
+    return ctx.headers.cookie;
+  }
+
+  return contextStorageCookies.reduce((existingCookies, [storageCookieKey, {
+    value: storageCookieValue
+  }]) => updatesCookieValueByKey(existingCookies, storageCookieKey, storageCookieValue), ctx.headers.cookie);
+};
+const getWithCookie = ctx => function withCookie(headers) {
+  const updatedCookie = getUpdatedCookie(ctx);
+
+  if (!updatedCookie) {
+    return headers;
+  }
+
+  return { ...headers,
+    cookie: updatedCookie
+  };
+};
+/**
+ * This function updates the cookie value based on its key
+ *
+ * const existingCookies = 'key=value1; key2=; key3=value3';
+ * const storageCookieKey = 'key2';
+ * const storageCookieValue = 'value2'
+ *
+ * updatesCookieValueByKey(existingCookies, storageCookieKey, storageCookieValue) returns 'key=value1; key2=value2; key3=value3';
+ */
+
+const updatesCookieValueByKey = (existingCookies, storageCookieKey, storageCookieValue) => {
+  const MATCH_COOKIE_KEY_VALUE = new RegExp(`(${storageCookieKey})=([^;]*)`);
+  const cookieParts = existingCookies.match(MATCH_COOKIE_KEY_VALUE); // replaces original cookie with the one coming from storage
+
+  if (cookieParts) {
+    return existingCookies.replace(cookieParts[0], `${cookieParts[1]}=${storageCookieValue}`);
+  } // add new storage cookie to the original list of cookies
+
+
+  return `${existingCookies};${storageCookieKey}=${storageCookieValue}`;
+};
+
 const BASE_INIT = {
   method: 'POST',
   headers: {
     'content-type': 'application/json'
   }
+}; // Accounts already warned that they rely on public `NL` fields. The commerce
+// client is created per request, so the warning is kept once per account
+// instead of per instance, to avoid flooding the logs. The account comes from
+// the store's API options, not from the request, so the set holds at most one
+// entry per account the process is configured for (usually one). It's still
+// capped, so it can't grow without bound if that ever changes.
+
+const MAX_WARNED_NEWSLETTER_ACCOUNTS = 100;
+const accountsWarnedAboutAnonymousNewsletter = /*#__PURE__*/new Set();
+
+const getHeader = (headers, name) => {
+  const value = headers == null ? void 0 : headers[name];
+  return Array.isArray(value) ? value[0] : value;
 };
+/**
+ * Host the Checkout API uses as the domain of the cookies it sets. Checkout
+ * only honors it for hosts registered in the account, so a forged value is
+ * ignored there.
+ */
+
+
+const getForwardedHost = headers => {
+  var _getHeader;
+
+  // Proxies may append values: "client, proxy". Only the first one is the store host.
+  const host = ((_getHeader = getHeader(headers, 'x-forwarded-host')) == null ? void 0 : _getHeader.split(',')[0].trim()) || getHeader(headers, 'host') || '';
+  return host.trim().replace(/^www\./, '');
+};
+
 const VtexCommerce = ({
   account,
   environment
 }, ctx) => {
   const base = `https://${account}.${environment}.com.br`;
+  const storeCookies = getStoreCookie(ctx);
+  const withCookie = getWithCookie(ctx);
+  const forwardedHost = getForwardedHost(ctx.headers); // Checkout calls forward the shopper cookies and keep the cookies Checkout
+  // sets (e.g. CheckoutOrderFormOwnership) so they can reach the browser.
+
+  const checkoutHeaders = () => withCookie({
+    'content-type': 'application/json',
+    'X-FORWARDED-HOST': forwardedHost
+  });
+
   return {
     catalog: {
       salesChannel: sc => fetchAPI(`${base}/api/catalog_system/pub/saleschannel/${sc}`),
@@ -169,7 +375,10 @@ const VtexCommerce = ({
         }
 
         return fetchAPI(`${base}/api/checkout/pub/orderForm/${id}/attachments/shippingData`, { ...BASE_INIT,
+          headers: checkoutHeaders(),
           body: JSON.stringify(body)
+        }, {
+          storeCookies
         });
       },
       orderForm: ({
@@ -184,7 +393,11 @@ const VtexCommerce = ({
           refreshOutdatedData: refreshOutdatedData.toString(),
           sc: salesChannel
         });
-        return fetchAPI(`${base}/api/checkout/pub/orderForm/${id}?${params.toString()}`, BASE_INIT);
+        return fetchAPI(`${base}/api/checkout/pub/orderForm/${id}?${params.toString()}`, { ...BASE_INIT,
+          headers: checkoutHeaders()
+        }, {
+          storeCookies
+        });
       },
       updateOrderFormItems: ({
         id,
@@ -198,11 +411,14 @@ const VtexCommerce = ({
           sc: salesChannel
         });
         return fetchAPI(`${base}/api/checkout/pub/orderForm/${id}/items?${params}`, { ...BASE_INIT,
+          headers: checkoutHeaders(),
           body: JSON.stringify({
             orderItems,
             noSplitItem: !shouldSplitItem
           }),
           method: 'PATCH'
+        }, {
+          storeCookies
         });
       },
       setCustomData: ({
@@ -212,10 +428,13 @@ const VtexCommerce = ({
         value
       }) => {
         return fetchAPI(`${base}/api/checkout/pub/orderForm/${id}/customData/${appId}/${key}`, { ...BASE_INIT,
+          headers: checkoutHeaders(),
           body: JSON.stringify({
             value
           }),
           method: 'PUT'
+        }, {
+          storeCookies
         });
       },
       region: async ({
@@ -244,11 +463,58 @@ const VtexCommerce = ({
         body: '{}'
       });
     },
-    subscribeToNewsletter: data => {
+
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({
+      name,
+      email
+    }) => {
+      const body = JSON.stringify({ ...(name ? {
+          name
+        } : {}),
+        email,
+        isNewsletterOptIn: true
+      });
+      const appKey = process.env.FS_NEWSLETTER_APP_KEY;
+      const appToken = process.env.FS_NEWSLETTER_APP_TOKEN;
+
+      if (appKey && appToken) {
+        return fetchAPI(`${base}/api/dataentities/NL/documents`, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            accept: 'application/json',
+            'X-VTEX-API-AppKey': appKey,
+            'X-VTEX-API-AppToken': appToken
+          },
+          body
+        });
+      }
+
+      if (!accountsWarnedAboutAnonymousNewsletter.has(account)) {
+        if (accountsWarnedAboutAnonymousNewsletter.size >= MAX_WARNED_NEWSLETTER_ACCOUNTS) {
+          accountsWarnedAboutAnonymousNewsletter.clear();
+        }
+
+        accountsWarnedAboutAnonymousNewsletter.add(account); // Name only the missing variables, so a partial setup is easy to spot.
+
+        const missing = [!appKey && 'FS_NEWSLETTER_APP_KEY', !appToken && 'FS_NEWSLETTER_APP_TOKEN'].filter(Boolean);
+        console.warn(`[subscribeToNewsletter] ${missing.join(' and ')} ${missing.length > 1 ? 'are' : 'is'} not set. Falling back to an anonymous Master Data request, which requires public fields in the NL entity. Configure both credentials and make the NL fields private.`);
+      }
+
       return fetchAPI(`${base}/api/dataentities/NL/documents/`, { ...BASE_INIT,
-        body: JSON.stringify({ ...data,
-          isNewsletterOptIn: true
-        }),
+        body,
         method: 'PATCH'
       });
     }
@@ -1040,6 +1306,11 @@ const StoreFacetValueBoolean = {
   }) => quantity
 };
 
+const EMAIL_MAX_LENGTH = 254;
+const NAME_MAX_LENGTH = 100; // Character classes exclude `.`, so each domain label is matched once and the
+// pattern stays linear on long inputs.
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/;
 const subscribeToNewsletter = async (_, {
   data
 }, {
@@ -1047,7 +1318,25 @@ const subscribeToNewsletter = async (_, {
     commerce
   }
 }) => {
-  const response = await commerce.subscribeToNewsletter(data);
+  var _data$email$trim$toLo, _data$email, _data$name$trim, _data$name;
+
+  // The subscription is written with a store credential, so only validated
+  // values reach Master Data.
+  const email = (_data$email$trim$toLo = (_data$email = data.email) == null ? void 0 : _data$email.trim().toLowerCase()) != null ? _data$email$trim$toLo : '';
+  const name = (_data$name$trim = (_data$name = data.name) == null ? void 0 : _data$name.trim()) != null ? _data$name$trim : '';
+
+  if (email.length > EMAIL_MAX_LENGTH || !EMAIL_PATTERN.test(email)) {
+    throw new BadRequestError('Invalid email');
+  }
+
+  if (name.length > NAME_MAX_LENGTH) {
+    throw new BadRequestError(`Invalid name: must have at most ${NAME_MAX_LENGTH} characters`);
+  }
+
+  const response = await commerce.subscribeToNewsletter({
+    email,
+    name: name || undefined
+  });
   return {
     id: response == null ? void 0 : response.Id
   };
@@ -2468,7 +2757,8 @@ const getContextFactory = options => ctx => {
   ctx.storage = {
     channel: ChannelMarshal.parse(options.channel),
     flags: (_options$flags = options.flags) != null ? _options$flags : {},
-    locale: options.locale
+    locale: options.locale,
+    cookies: new Map()
   };
   ctx.clients = getClients(options, ctx);
   ctx.loaders = getLoaders(options, ctx);