@faststore/api 1.12.50 → 1.12.52

package/dist/platforms/vtex/clients/commerce/index.d.ts

@@ -14,6 +14,8 @@ import { MasterDataResponse } from './types/Newsletter';
 import type { Address, AddressInput } from './types/Address';
 import { ShippingDataBody } from './types/ShippingData';
 declare type ValueOf<T> = T extends Record<string, infer K> ? K : never;
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export declare const resetAnonymousNewsletterWarnings: () => void;
 export declare const VtexCommerce: ({ account, environment }: Options, ctx: Context) => {
     catalog: {
         salesChannel: (sc: string) => Promise<SalesChannel>;
@@ -62,8 +64,20 @@ export declare const VtexCommerce: ({ account, environment }: Options, ctx: Cont
         address: ({ postalCode, country, }: AddressInput) => Promise<Address>;
     };
     session: (search: string) => Promise<Session>;
-    subscribeToNewsletter: (data: {
-        name: string;
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({ name, email, }: {
+        name?: string | undefined;
         email: string;
     }) => Promise<MasterDataResponse>;
 };

package/dist/platforms/vtex/clients/fetch.d.ts

@@ -1 +1,6 @@
-export declare const fetchAPI: (info: RequestInfo, init?: RequestInit | undefined) => Promise<any>;
+export declare const redactHeaders: (headers?: Headers | string[][] | Record<string, string> | undefined) => Record<string, string> | undefined;
+interface FetchAPIOptions {
+    storeCookies?: (headers: Headers) => void;
+}
+export declare const fetchAPI: (info: RequestInfo, init?: RequestInit | undefined, options?: FetchAPIOptions | undefined) => Promise<any>;
+export {};

package/dist/platforms/vtex/index.d.ts

@@ -28,6 +28,11 @@ export interface Context {
         locale: string;
         flags: FeatureFlags;
         searchArgs?: Omit<SearchArgs, 'type'>;
+        /**
+         * Checkout cookies received while resolving this request, keyed by cookie
+         * name. The GraphQL handler forwards `setCookie` values to the browser.
+         */
+        cookies: Map<string, Record<string, string>>;
     };
     headers: Record<string, string>;
 }

package/dist/platforms/vtex/utils/cookies.d.ts

@@ -0,0 +1,52 @@
+import type { Context } from '../index';
+export interface ContextForCookies {
+    headers: Context['headers'];
+    storage: Pick<Context['storage'], 'cookies'>;
+}
+/**
+ * Returns every `set-cookie` value of a fetch response.
+ *
+ * `Headers.getSetCookie()` only exists on Node >= 18.14 (undici). FastStore v1
+ * stores may still run on Node 16, where isomorphic-unfetch falls back to
+ * node-fetch v2, which exposes repeated headers through `raw()` instead.
+ */
+export declare const getSetCookies: (headers: Headers) => string[];
+/**
+ * This function updates the ctx.storage.cookies, that is used in each request.
+ *
+ * ctx.storage.cookies is a Map<string[1], Record<string, string>[2]> where,
+ * [1] cookie key
+ * [2] {
+ *       value: cookie value,
+ *       setCookie: setCookie used in browser response
+ *     }
+ */
+export declare const updatesContextStorageCookies: (ctx: Pick<Context, 'storage'>, setCookieValue: string) => void;
+export declare const setCookie: (ctx: Pick<Context, 'storage'>, headers: Headers) => void;
+export declare const getStoreCookie: (ctx: Pick<Context, 'storage'>) => (headers: Headers) => void;
+/**
+ * This function returns a modified copy of the original cookie header (ctx.headers.cookie from the first request)
+ * with the cookie values that comes in each request (ctx.storage.cookies).
+ * If there is no cookies in storage, the ctx.headers?.cookie is used
+ *
+ * ctx.storage.cookies is a Map<string[1], Record<string, string>[2]> where,
+ * [1] cookie key
+ * [2] {
+ *       value: cookie value,
+ *       setCookie: setCookie used in browser response
+ *     }
+ */
+export declare const getUpdatedCookie: (ctx: ContextForCookies) => string | null;
+export declare const getWithCookie: (ctx: ContextForCookies) => <T extends Record<string, any>>(headers: T) => T | (T & {
+    cookie: string;
+});
+/**
+ * This function updates the cookie value based on its key
+ *
+ * const existingCookies = 'key=value1; key2=; key3=value3';
+ * const storageCookieKey = 'key2';
+ * const storageCookieValue = 'value2'
+ *
+ * updatesCookieValueByKey(existingCookies, storageCookieKey, storageCookieValue) returns 'key=value1; key2=value2; key3=value3';
+ */
+export declare const updatesCookieValueByKey: (existingCookies: string, storageCookieKey: string, storageCookieValue: string) => string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/api",
-  "version": "1.12.50",
+  "version": "1.12.52",
   "license": "MIT",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
@@ -53,5 +53,5 @@
     "@envelop/core": "^1 || ^2",
     "graphql": "^15.6.0"
   },
-  "gitHead": "6a034d875598025c79f2c6ff6b7801bf0c955aef"
+  "gitHead": "f3dba5bfc0d3516fec52145565dae375263d511e"
 }

package/src/platforms/vtex/clients/commerce/index.ts

@@ -19,6 +19,7 @@ import type { SalesChannel } from './types/SalesChannel'
 import { MasterDataResponse } from './types/Newsletter'
 import type { Address, AddressInput } from './types/Address'
 import { ShippingDataBody } from './types/ShippingData'
+import { getStoreCookie, getWithCookie } from '../../utils/cookies'
 
 type ValueOf<T> = T extends Record<string, infer K> ? K : never
 
@@ -29,11 +30,56 @@ const BASE_INIT = {
   },
 }
 
+// Accounts already warned that they rely on public `NL` fields. The commerce
+// client is created per request, so the warning is kept once per account
+// instead of per instance, to avoid flooding the logs. The account comes from
+// the store's API options, not from the request, so the set holds at most one
+// entry per account the process is configured for (usually one). It's still
+// capped, so it can't grow without bound if that ever changes.
+const MAX_WARNED_NEWSLETTER_ACCOUNTS = 100
+const accountsWarnedAboutAnonymousNewsletter = new Set<string>()
+
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export const resetAnonymousNewsletterWarnings = () =>
+  accountsWarnedAboutAnonymousNewsletter.clear()
+
+const getHeader = (headers: Context['headers'] | undefined, name: string) => {
+  const value: string | string[] | undefined = (headers as any)?.[name]
+
+  return Array.isArray(value) ? value[0] : value
+}
+
+/**
+ * Host the Checkout API uses as the domain of the cookies it sets. Checkout
+ * only honors it for hosts registered in the account, so a forged value is
+ * ignored there.
+ */
+const getForwardedHost = (headers: Context['headers'] | undefined) => {
+  // Proxies may append values: "client, proxy". Only the first one is the store host.
+  const host =
+    getHeader(headers, 'x-forwarded-host')?.split(',')[0].trim() ||
+    getHeader(headers, 'host') ||
+    ''
+
+  return host.trim().replace(/^www\./, '')
+}
+
 export const VtexCommerce = (
   { account, environment }: Options,
   ctx: Context
 ) => {
   const base = `https://${account}.${environment}.com.br`
+  const storeCookies = getStoreCookie(ctx)
+  const withCookie = getWithCookie(ctx)
+  const forwardedHost = getForwardedHost(ctx.headers)
+
+  // Checkout calls forward the shopper cookies and keep the cookies Checkout
+  // sets (e.g. CheckoutOrderFormOwnership) so they can reach the browser.
+  const checkoutHeaders = () =>
+    withCookie({
+      'content-type': 'application/json',
+      'X-FORWARDED-HOST': forwardedHost,
+    })
 
   return {
     catalog: {
@@ -107,8 +153,10 @@ export const VtexCommerce = (
           `${base}/api/checkout/pub/orderForm/${id}/attachments/shippingData`,
           {
             ...BASE_INIT,
+            headers: checkoutHeaders(),
             body: JSON.stringify(body),
-          }
+          },
+          { storeCookies }
         )
       },
       orderForm: ({
@@ -128,7 +176,11 @@ export const VtexCommerce = (
 
         return fetchAPI(
           `${base}/api/checkout/pub/orderForm/${id}?${params.toString()}`,
-          BASE_INIT
+          {
+            ...BASE_INIT,
+            headers: checkoutHeaders(),
+          },
+          { storeCookies }
         )
       },
       updateOrderFormItems: ({
@@ -153,12 +205,14 @@ export const VtexCommerce = (
           `${base}/api/checkout/pub/orderForm/${id}/items?${params}`,
           {
             ...BASE_INIT,
+            headers: checkoutHeaders(),
             body: JSON.stringify({
               orderItems,
               noSplitItem: !shouldSplitItem,
             }),
             method: 'PATCH',
-          }
+          },
+          { storeCookies }
         )
       },
       setCustomData: ({
@@ -176,9 +230,11 @@ export const VtexCommerce = (
           `${base}/api/checkout/pub/orderForm/${id}/customData/${appId}/${key}`,
           {
             ...BASE_INIT,
+            headers: checkoutHeaders(),
             body: JSON.stringify({ value }),
             method: 'PUT',
-          }
+          },
+          { storeCookies }
         )
       },
       region: async ({
@@ -217,13 +273,71 @@ export const VtexCommerce = (
         body: '{}',
       })
     },
-    subscribeToNewsletter: (data: {
-      name: string
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({
+      name,
+      email,
+    }: {
+      name?: string
       email: string
     }): Promise<MasterDataResponse> => {
+      const body = JSON.stringify({
+        ...(name ? { name } : {}),
+        email,
+        isNewsletterOptIn: true,
+      })
+      const appKey = process.env.FS_NEWSLETTER_APP_KEY
+      const appToken = process.env.FS_NEWSLETTER_APP_TOKEN
+
+      if (appKey && appToken) {
+        return fetchAPI(`${base}/api/dataentities/NL/documents`, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            accept: 'application/json',
+            'X-VTEX-API-AppKey': appKey,
+            'X-VTEX-API-AppToken': appToken,
+          },
+          body,
+        })
+      }
+
+      if (!accountsWarnedAboutAnonymousNewsletter.has(account)) {
+        if (
+          accountsWarnedAboutAnonymousNewsletter.size >=
+          MAX_WARNED_NEWSLETTER_ACCOUNTS
+        ) {
+          accountsWarnedAboutAnonymousNewsletter.clear()
+        }
+        accountsWarnedAboutAnonymousNewsletter.add(account)
+
+        // Name only the missing variables, so a partial setup is easy to spot.
+        const missing = [
+          !appKey && 'FS_NEWSLETTER_APP_KEY',
+          !appToken && 'FS_NEWSLETTER_APP_TOKEN',
+        ].filter(Boolean)
+
+        console.warn(
+          `[subscribeToNewsletter] ${missing.join(' and ')} ${
+            missing.length > 1 ? 'are' : 'is'
+          } not set. Falling back to an anonymous Master Data request, which requires public fields in the NL entity. Configure both credentials and make the NL fields private.`
+        )
+      }
+
       return fetchAPI(`${base}/api/dataentities/NL/documents/`, {
         ...BASE_INIT,
-        body: JSON.stringify({ ...data, isNewsletterOptIn: true }),
+        body,
         method: 'PATCH',
       })
     },

package/src/platforms/vtex/clients/fetch.ts

@@ -3,7 +3,50 @@ import packageJson from '../../../../package.json'
 
 const USER_AGENT = `${packageJson.name}@${packageJson.version}`
 
-export const fetchAPI = async (info: RequestInfo, init?: RequestInit) => {
+// Headers that may carry credentials: store API keys (`X-VTEX-API-AppKey`,
+// `X-VTEX-API-AppToken`), shopper cookies (`Cookie`, `Set-Cookie`,
+// `VtexIdclientAutCookie_*`), `Authorization`, and generic token, secret or
+// API key headers. They are replaced before a failed request and its response
+// are logged. Matched by substring so new credential headers are covered too.
+const SENSITIVE_HEADER = /authorization|cookie|token|secret|api-?key|appkey/i
+
+const REDACTED = '[redacted]'
+
+export const redactHeaders = (
+  headers?: HeadersInit
+): Record<string, string> | undefined => {
+  if (!headers) {
+    return undefined
+  }
+
+  const redacted: Record<string, string> = {}
+  const add = (name: string, value: string) => {
+    redacted[name] = SENSITIVE_HEADER.test(name) ? REDACTED : value
+  }
+
+  if (Array.isArray(headers)) {
+    headers.forEach(([name, value]) => add(name, value))
+  } else if (typeof (headers as Headers).forEach === 'function') {
+    // Matches both the global `Headers` and the polyfill returned by
+    // `isomorphic-unfetch` on Node, which isn't an instance of the global one.
+    const headerList = headers as Headers
+    headerList.forEach((value, name) => add(name, value))
+  } else {
+    Object.entries(headers).forEach(([name, value]) => add(name, value))
+  }
+
+  return redacted
+}
+
+interface FetchAPIOptions {
+  storeCookies?: (headers: Headers) => void
+}
+
+export const fetchAPI = async (
+  info: RequestInfo,
+  init?: RequestInit,
+  options?: FetchAPIOptions
+) => {
   const response = await fetch(info, {
     ...init,
     headers: {
@@ -13,10 +56,30 @@ export const fetchAPI = async (info: RequestInfo, init?: RequestInit) => {
   })
 
   if (response.ok) {
+    if (options?.storeCookies) {
+      options.storeCookies(response.headers)
+    }
+
     return response.status !== 204 ? response.json() : undefined
   }
 
-  console.error(info, init, response)
+  // Log a summary instead of the raw Response, whose headers may include
+  // `Set-Cookie` with shopper credentials. The request body is omitted because
+  // it can carry personal data (e.g. the newsletter email and name).
+  console.error(
+    // Only the URL: a `Request` instance could carry unredacted headers.
+    typeof info === 'string' ? info : info.url,
+    init && {
+      ...init,
+      headers: redactHeaders(init.headers),
+      body: init.body ? REDACTED : undefined,
+    },
+    {
+      status: response.status,
+      statusText: response.statusText,
+      headers: redactHeaders(response.headers),
+    }
+  )
   const text = await response.text()
 
   throw new Error(text)

package/src/platforms/vtex/index.ts

@@ -56,6 +56,11 @@ export interface Context {
     locale: string
     flags: FeatureFlags
     searchArgs?: Omit<SearchArgs, 'type'>
+    /**
+     * Checkout cookies received while resolving this request, keyed by cookie
+     * name. The GraphQL handler forwards `setCookie` values to the browser.
+     */
+    cookies: Map<string, Record<string, string>>
   }
   headers: Record<string, string>
 }
@@ -96,6 +101,7 @@ export const getContextFactory =
       channel: ChannelMarshal.parse(options.channel),
       flags: options.flags ?? {},
       locale: options.locale,
+      cookies: new Map<string, Record<string, string>>(),
     }
     ctx.clients = getClients(options, ctx)
     ctx.loaders = getLoaders(options, ctx)

package/src/platforms/vtex/resolvers/subscribeToNewsletter.ts

@@ -3,12 +3,38 @@ import type {
   MutationSubscribeToNewsletterArgs,
   PersonNewsletter,
 } from '../../../__generated__/schema'
+import { BadRequestError } from '../../errors'
+
+const EMAIL_MAX_LENGTH = 254
+const NAME_MAX_LENGTH = 100
+// Character classes exclude `.`, so each domain label is matched once and the
+// pattern stays linear on long inputs.
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/
 
 export const subscribeToNewsletter = async (
   _: any,
   { data }: MutationSubscribeToNewsletterArgs,
   { clients: { commerce } }: Context
 ): Promise<PersonNewsletter | null> => {
-  const response = await commerce.subscribeToNewsletter(data)
+  // The subscription is written with a store credential, so only validated
+  // values reach Master Data.
+  const email = data.email?.trim().toLowerCase() ?? ''
+  const name = data.name?.trim() ?? ''
+
+  if (email.length > EMAIL_MAX_LENGTH || !EMAIL_PATTERN.test(email)) {
+    throw new BadRequestError('Invalid email')
+  }
+
+  if (name.length > NAME_MAX_LENGTH) {
+    throw new BadRequestError(
+      `Invalid name: must have at most ${NAME_MAX_LENGTH} characters`
+    )
+  }
+
+  const response = await commerce.subscribeToNewsletter({
+    email,
+    name: name || undefined,
+  })
+
   return { id: response?.Id }
 }

package/src/platforms/vtex/utils/cookies.ts

@@ -0,0 +1,157 @@
+import type { Context } from '../index'
+
+export interface ContextForCookies {
+  headers: Context['headers']
+  storage: Pick<Context['storage'], 'cookies'>
+}
+
+const MATCH_FIRST_SET_COOKIE_KEY_VALUE = /^([^=]+)=([^;]*)/
+
+/**
+ * Splits a combined `set-cookie` header value (cookies joined by `, `) into
+ * individual cookies. Commas inside `expires=...` dates are kept.
+ */
+const splitSetCookieHeader = (value: string) =>
+  value.split(/,(?=\s*[^;,=\s]+=)/).map((setCookie) => setCookie.trim())
+
+/**
+ * Returns every `set-cookie` value of a fetch response.
+ *
+ * `Headers.getSetCookie()` only exists on Node >= 18.14 (undici). FastStore v1
+ * stores may still run on Node 16, where isomorphic-unfetch falls back to
+ * node-fetch v2, which exposes repeated headers through `raw()` instead.
+ */
+export const getSetCookies = (headers: Headers): string[] => {
+  const maybeHeaders = headers as Headers & {
+    getSetCookie?: () => string[]
+    raw?: () => Record<string, string[]>
+  }
+
+  if (typeof maybeHeaders.getSetCookie === 'function') {
+    return maybeHeaders.getSetCookie()
+  }
+
+  if (typeof maybeHeaders.raw === 'function') {
+    return maybeHeaders.raw()['set-cookie'] ?? []
+  }
+
+  const setCookie = headers.get('set-cookie')
+
+  return setCookie ? splitSetCookieHeader(setCookie) : []
+}
+
+/**
+ * This function updates the ctx.storage.cookies, that is used in each request.
+ *
+ * ctx.storage.cookies is a Map<string[1], Record<string, string>[2]> where,
+ * [1] cookie key
+ * [2] {
+ *       value: cookie value,
+ *       setCookie: setCookie used in browser response
+ *     }
+ */
+export const updatesContextStorageCookies = (
+  ctx: Pick<Context, 'storage'>,
+  setCookieValue: string
+) => {
+  const matchCookie = setCookieValue.match(MATCH_FIRST_SET_COOKIE_KEY_VALUE)
+
+  if (matchCookie) {
+    const cookieKey = matchCookie[1]
+    const cookieValue = matchCookie[2]
+
+    ctx.storage.cookies.set(cookieKey, {
+      value: cookieValue,
+      setCookie: setCookieValue,
+    })
+  }
+}
+
+export const setCookie = (ctx: Pick<Context, 'storage'>, headers: Headers) => {
+  getSetCookies(headers).forEach((setCookieValue) =>
+    updatesContextStorageCookies(ctx, setCookieValue)
+  )
+}
+
+export const getStoreCookie =
+  (ctx: Pick<Context, 'storage'>) => (headers: Headers) =>
+    setCookie(ctx, headers)
+
+/**
+ * This function returns a modified copy of the original cookie header (ctx.headers.cookie from the first request)
+ * with the cookie values that comes in each request (ctx.storage.cookies).
+ * If there is no cookies in storage, the ctx.headers?.cookie is used
+ *
+ * ctx.storage.cookies is a Map<string[1], Record<string, string>[2]> where,
+ * [1] cookie key
+ * [2] {
+ *       value: cookie value,
+ *       setCookie: setCookie used in browser response
+ *     }
+ */
+export const getUpdatedCookie = (ctx: ContextForCookies) => {
+  if (!ctx.headers?.cookie) {
+    return null
+  }
+
+  const contextStorageCookies = Array.from(ctx.storage.cookies.entries())
+
+  if (contextStorageCookies.length === 0) {
+    return ctx.headers.cookie
+  }
+
+  return contextStorageCookies.reduce(
+    (existingCookies, [storageCookieKey, { value: storageCookieValue }]) =>
+      updatesCookieValueByKey(
+        existingCookies,
+        storageCookieKey,
+        storageCookieValue
+      ),
+    ctx.headers.cookie
+  )
+}
+
+export const getWithCookie = (ctx: ContextForCookies) =>
+  function withCookie<T extends Record<string, any>>(
+    headers: T
+  ): T | (T & { cookie: string }) {
+    const updatedCookie = getUpdatedCookie(ctx)
+
+    if (!updatedCookie) {
+      return headers
+    }
+
+    return {
+      ...headers,
+      cookie: updatedCookie,
+    }
+  }
+
+/**
+ * This function updates the cookie value based on its key
+ *
+ * const existingCookies = 'key=value1; key2=; key3=value3';
+ * const storageCookieKey = 'key2';
+ * const storageCookieValue = 'value2'
+ *
+ * updatesCookieValueByKey(existingCookies, storageCookieKey, storageCookieValue) returns 'key=value1; key2=value2; key3=value3';
+ */
+export const updatesCookieValueByKey = (
+  existingCookies: string,
+  storageCookieKey: string,
+  storageCookieValue: string
+) => {
+  const MATCH_COOKIE_KEY_VALUE = new RegExp(`(${storageCookieKey})=([^;]*)`)
+  const cookieParts = existingCookies.match(MATCH_COOKIE_KEY_VALUE)
+
+  // replaces original cookie with the one coming from storage
+  if (cookieParts) {
+    return existingCookies.replace(
+      cookieParts[0],
+      `${cookieParts[1]}=${storageCookieValue}`
+    )
+  }
+
+  // add new storage cookie to the original list of cookies
+  return `${existingCookies};${storageCookieKey}=${storageCookieValue}`
+}