@faststore/api 1.12.51 → 1.12.52

package/dist/api.esm.js

@@ -18,7 +18,7 @@ import { trace, context, SpanKind } from '@opentelemetry/api';
 import { SeverityNumber } from '@opentelemetry/api-logs';
 
 var name = "@faststore/api";
-var version = "1.12.50";
+var version = "1.12.51";
 var license = "MIT";
 var main = "dist/index.js";
 var typings = "dist/index.d.ts";
@@ -87,7 +87,38 @@ var packageJson = {
 	peerDependencies: peerDependencies
 };
 
-const USER_AGENT = `${packageJson.name}@${packageJson.version}`;
+const USER_AGENT = `${packageJson.name}@${packageJson.version}`; // Headers that may carry credentials: store API keys (`X-VTEX-API-AppKey`,
+// `X-VTEX-API-AppToken`), shopper cookies (`Cookie`, `Set-Cookie`,
+// `VtexIdclientAutCookie_*`), `Authorization`, and generic token, secret or
+// API key headers. They are replaced before a failed request and its response
+// are logged. Matched by substring so new credential headers are covered too.
+
+const SENSITIVE_HEADER = /authorization|cookie|token|secret|api-?key|appkey/i;
+const REDACTED = '[redacted]';
+const redactHeaders = headers => {
+  if (!headers) {
+    return undefined;
+  }
+
+  const redacted = {};
+
+  const add = (name, value) => {
+    redacted[name] = SENSITIVE_HEADER.test(name) ? REDACTED : value;
+  };
+
+  if (Array.isArray(headers)) {
+    headers.forEach(([name, value]) => add(name, value));
+  } else if (typeof headers.forEach === 'function') {
+    // Matches both the global `Headers` and the polyfill returned by
+    // `isomorphic-unfetch` on Node, which isn't an instance of the global one.
+    const headerList = headers;
+    headerList.forEach((value, name) => add(name, value));
+  } else {
+    Object.entries(headers).forEach(([name, value]) => add(name, value));
+  }
+
+  return redacted;
+};
 const fetchAPI = async (info, init, options) => {
   const response = await fetch(info, { ...init,
     headers: { ...(init == null ? void 0 : init.headers),
@@ -101,9 +132,20 @@ const fetchAPI = async (info, init, options) => {
     }
 
     return response.status !== 204 ? response.json() : undefined;
-  }
+  } // Log a summary instead of the raw Response, whose headers may include
+  // `Set-Cookie` with shopper credentials. The request body is omitted because
+  // it can carry personal data (e.g. the newsletter email and name).
 
-  console.error(info, init, response);
+
+  console.error( // Only the URL: a `Request` instance could carry unredacted headers.
+  typeof info === 'string' ? info : info.url, init && { ...init,
+    headers: redactHeaders(init.headers),
+    body: init.body ? REDACTED : undefined
+  }, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: redactHeaders(response.headers)
+  });
   const text = await response.text();
   throw new Error(text);
 };
@@ -235,7 +277,15 @@ const BASE_INIT = {
   headers: {
     'content-type': 'application/json'
   }
-};
+}; // Accounts already warned that they rely on public `NL` fields. The commerce
+// client is created per request, so the warning is kept once per account
+// instead of per instance, to avoid flooding the logs. The account comes from
+// the store's API options, not from the request, so the set holds at most one
+// entry per account the process is configured for (usually one). It's still
+// capped, so it can't grow without bound if that ever changes.
+
+const MAX_WARNED_NEWSLETTER_ACCOUNTS = 100;
+const accountsWarnedAboutAnonymousNewsletter = /*#__PURE__*/new Set();
 
 const getHeader = (headers, name) => {
   const value = headers == null ? void 0 : headers[name];
@@ -409,11 +459,58 @@ const VtexCommerce = ({
         body: '{}'
       });
     },
-    subscribeToNewsletter: data => {
+
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({
+      name,
+      email
+    }) => {
+      const body = JSON.stringify({ ...(name ? {
+          name
+        } : {}),
+        email,
+        isNewsletterOptIn: true
+      });
+      const appKey = process.env.FS_NEWSLETTER_APP_KEY;
+      const appToken = process.env.FS_NEWSLETTER_APP_TOKEN;
+
+      if (appKey && appToken) {
+        return fetchAPI(`${base}/api/dataentities/NL/documents`, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            accept: 'application/json',
+            'X-VTEX-API-AppKey': appKey,
+            'X-VTEX-API-AppToken': appToken
+          },
+          body
+        });
+      }
+
+      if (!accountsWarnedAboutAnonymousNewsletter.has(account)) {
+        if (accountsWarnedAboutAnonymousNewsletter.size >= MAX_WARNED_NEWSLETTER_ACCOUNTS) {
+          accountsWarnedAboutAnonymousNewsletter.clear();
+        }
+
+        accountsWarnedAboutAnonymousNewsletter.add(account); // Name only the missing variables, so a partial setup is easy to spot.
+
+        const missing = [!appKey && 'FS_NEWSLETTER_APP_KEY', !appToken && 'FS_NEWSLETTER_APP_TOKEN'].filter(Boolean);
+        console.warn(`[subscribeToNewsletter] ${missing.join(' and ')} ${missing.length > 1 ? 'are' : 'is'} not set. Falling back to an anonymous Master Data request, which requires public fields in the NL entity. Configure both credentials and make the NL fields private.`);
+      }
+
       return fetchAPI(`${base}/api/dataentities/NL/documents/`, { ...BASE_INIT,
-        body: JSON.stringify({ ...data,
-          isNewsletterOptIn: true
-        }),
+        body,
         method: 'PATCH'
       });
     }
@@ -1205,6 +1302,11 @@ const StoreFacetValueBoolean = {
   }) => quantity
 };
 
+const EMAIL_MAX_LENGTH = 254;
+const NAME_MAX_LENGTH = 100; // Character classes exclude `.`, so each domain label is matched once and the
+// pattern stays linear on long inputs.
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/;
 const subscribeToNewsletter = async (_, {
   data
 }, {
@@ -1212,7 +1314,25 @@ const subscribeToNewsletter = async (_, {
     commerce
   }
 }) => {
-  const response = await commerce.subscribeToNewsletter(data);
+  var _data$email$trim$toLo, _data$email, _data$name$trim, _data$name;
+
+  // The subscription is written with a store credential, so only validated
+  // values reach Master Data.
+  const email = (_data$email$trim$toLo = (_data$email = data.email) == null ? void 0 : _data$email.trim().toLowerCase()) != null ? _data$email$trim$toLo : '';
+  const name = (_data$name$trim = (_data$name = data.name) == null ? void 0 : _data$name.trim()) != null ? _data$name$trim : '';
+
+  if (email.length > EMAIL_MAX_LENGTH || !EMAIL_PATTERN.test(email)) {
+    throw new BadRequestError('Invalid email');
+  }
+
+  if (name.length > NAME_MAX_LENGTH) {
+    throw new BadRequestError(`Invalid name: must have at most ${NAME_MAX_LENGTH} characters`);
+  }
+
+  const response = await commerce.subscribeToNewsletter({
+    email,
+    name: name || undefined
+  });
   return {
     id: response == null ? void 0 : response.Id
   };