@faststore/api 1.12.51 → 1.12.52

package/dist/platforms/vtex/clients/commerce/index.d.ts

@@ -14,6 +14,8 @@ import { MasterDataResponse } from './types/Newsletter';
 import type { Address, AddressInput } from './types/Address';
 import { ShippingDataBody } from './types/ShippingData';
 declare type ValueOf<T> = T extends Record<string, infer K> ? K : never;
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export declare const resetAnonymousNewsletterWarnings: () => void;
 export declare const VtexCommerce: ({ account, environment }: Options, ctx: Context) => {
     catalog: {
         salesChannel: (sc: string) => Promise<SalesChannel>;
@@ -62,8 +64,20 @@ export declare const VtexCommerce: ({ account, environment }: Options, ctx: Cont
         address: ({ postalCode, country, }: AddressInput) => Promise<Address>;
     };
     session: (search: string) => Promise<Session>;
-    subscribeToNewsletter: (data: {
-        name: string;
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({ name, email, }: {
+        name?: string | undefined;
         email: string;
     }) => Promise<MasterDataResponse>;
 };

package/dist/platforms/vtex/clients/fetch.d.ts

@@ -1,3 +1,4 @@
+export declare const redactHeaders: (headers?: Headers | string[][] | Record<string, string> | undefined) => Record<string, string> | undefined;
 interface FetchAPIOptions {
     storeCookies?: (headers: Headers) => void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/api",
-  "version": "1.12.51",
+  "version": "1.12.52",
   "license": "MIT",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
@@ -53,5 +53,5 @@
     "@envelop/core": "^1 || ^2",
     "graphql": "^15.6.0"
   },
-  "gitHead": "6f9ba2786d82b074125318339deac2ea456fb3d9"
+  "gitHead": "f3dba5bfc0d3516fec52145565dae375263d511e"
 }

package/src/platforms/vtex/clients/commerce/index.ts

@@ -30,6 +30,19 @@ const BASE_INIT = {
   },
 }
 
+// Accounts already warned that they rely on public `NL` fields. The commerce
+// client is created per request, so the warning is kept once per account
+// instead of per instance, to avoid flooding the logs. The account comes from
+// the store's API options, not from the request, so the set holds at most one
+// entry per account the process is configured for (usually one). It's still
+// capped, so it can't grow without bound if that ever changes.
+const MAX_WARNED_NEWSLETTER_ACCOUNTS = 100
+const accountsWarnedAboutAnonymousNewsletter = new Set<string>()
+
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export const resetAnonymousNewsletterWarnings = () =>
+  accountsWarnedAboutAnonymousNewsletter.clear()
+
 const getHeader = (headers: Context['headers'] | undefined, name: string) => {
   const value: string | string[] | undefined = (headers as any)?.[name]
 
@@ -260,13 +273,71 @@ export const VtexCommerce = (
         body: '{}',
       })
     },
-    subscribeToNewsletter: (data: {
-      name: string
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({
+      name,
+      email,
+    }: {
+      name?: string
       email: string
     }): Promise<MasterDataResponse> => {
+      const body = JSON.stringify({
+        ...(name ? { name } : {}),
+        email,
+        isNewsletterOptIn: true,
+      })
+      const appKey = process.env.FS_NEWSLETTER_APP_KEY
+      const appToken = process.env.FS_NEWSLETTER_APP_TOKEN
+
+      if (appKey && appToken) {
+        return fetchAPI(`${base}/api/dataentities/NL/documents`, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            accept: 'application/json',
+            'X-VTEX-API-AppKey': appKey,
+            'X-VTEX-API-AppToken': appToken,
+          },
+          body,
+        })
+      }
+
+      if (!accountsWarnedAboutAnonymousNewsletter.has(account)) {
+        if (
+          accountsWarnedAboutAnonymousNewsletter.size >=
+          MAX_WARNED_NEWSLETTER_ACCOUNTS
+        ) {
+          accountsWarnedAboutAnonymousNewsletter.clear()
+        }
+        accountsWarnedAboutAnonymousNewsletter.add(account)
+
+        // Name only the missing variables, so a partial setup is easy to spot.
+        const missing = [
+          !appKey && 'FS_NEWSLETTER_APP_KEY',
+          !appToken && 'FS_NEWSLETTER_APP_TOKEN',
+        ].filter(Boolean)
+
+        console.warn(
+          `[subscribeToNewsletter] ${missing.join(' and ')} ${
+            missing.length > 1 ? 'are' : 'is'
+          } not set. Falling back to an anonymous Master Data request, which requires public fields in the NL entity. Configure both credentials and make the NL fields private.`
+        )
+      }
+
       return fetchAPI(`${base}/api/dataentities/NL/documents/`, {
         ...BASE_INIT,
-        body: JSON.stringify({ ...data, isNewsletterOptIn: true }),
+        body,
         method: 'PATCH',
       })
     },

package/src/platforms/vtex/clients/fetch.ts

@@ -3,6 +3,41 @@ import packageJson from '../../../../package.json'
 
 const USER_AGENT = `${packageJson.name}@${packageJson.version}`
 
+// Headers that may carry credentials: store API keys (`X-VTEX-API-AppKey`,
+// `X-VTEX-API-AppToken`), shopper cookies (`Cookie`, `Set-Cookie`,
+// `VtexIdclientAutCookie_*`), `Authorization`, and generic token, secret or
+// API key headers. They are replaced before a failed request and its response
+// are logged. Matched by substring so new credential headers are covered too.
+const SENSITIVE_HEADER = /authorization|cookie|token|secret|api-?key|appkey/i
+
+const REDACTED = '[redacted]'
+
+export const redactHeaders = (
+  headers?: HeadersInit
+): Record<string, string> | undefined => {
+  if (!headers) {
+    return undefined
+  }
+
+  const redacted: Record<string, string> = {}
+  const add = (name: string, value: string) => {
+    redacted[name] = SENSITIVE_HEADER.test(name) ? REDACTED : value
+  }
+
+  if (Array.isArray(headers)) {
+    headers.forEach(([name, value]) => add(name, value))
+  } else if (typeof (headers as Headers).forEach === 'function') {
+    // Matches both the global `Headers` and the polyfill returned by
+    // `isomorphic-unfetch` on Node, which isn't an instance of the global one.
+    const headerList = headers as Headers
+    headerList.forEach((value, name) => add(name, value))
+  } else {
+    Object.entries(headers).forEach(([name, value]) => add(name, value))
+  }
+
+  return redacted
+}
+
 interface FetchAPIOptions {
   storeCookies?: (headers: Headers) => void
 }
@@ -28,7 +63,23 @@ export const fetchAPI = async (
     return response.status !== 204 ? response.json() : undefined
   }
 
-  console.error(info, init, response)
+  // Log a summary instead of the raw Response, whose headers may include
+  // `Set-Cookie` with shopper credentials. The request body is omitted because
+  // it can carry personal data (e.g. the newsletter email and name).
+  console.error(
+    // Only the URL: a `Request` instance could carry unredacted headers.
+    typeof info === 'string' ? info : info.url,
+    init && {
+      ...init,
+      headers: redactHeaders(init.headers),
+      body: init.body ? REDACTED : undefined,
+    },
+    {
+      status: response.status,
+      statusText: response.statusText,
+      headers: redactHeaders(response.headers),
+    }
+  )
   const text = await response.text()
 
   throw new Error(text)

package/src/platforms/vtex/resolvers/subscribeToNewsletter.ts

@@ -3,12 +3,38 @@ import type {
   MutationSubscribeToNewsletterArgs,
   PersonNewsletter,
 } from '../../../__generated__/schema'
+import { BadRequestError } from '../../errors'
+
+const EMAIL_MAX_LENGTH = 254
+const NAME_MAX_LENGTH = 100
+// Character classes exclude `.`, so each domain label is matched once and the
+// pattern stays linear on long inputs.
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/
 
 export const subscribeToNewsletter = async (
   _: any,
   { data }: MutationSubscribeToNewsletterArgs,
   { clients: { commerce } }: Context
 ): Promise<PersonNewsletter | null> => {
-  const response = await commerce.subscribeToNewsletter(data)
+  // The subscription is written with a store credential, so only validated
+  // values reach Master Data.
+  const email = data.email?.trim().toLowerCase() ?? ''
+  const name = data.name?.trim() ?? ''
+
+  if (email.length > EMAIL_MAX_LENGTH || !EMAIL_PATTERN.test(email)) {
+    throw new BadRequestError('Invalid email')
+  }
+
+  if (name.length > NAME_MAX_LENGTH) {
+    throw new BadRequestError(
+      `Invalid name: must have at most ${NAME_MAX_LENGTH} characters`
+    )
+  }
+
+  const response = await commerce.subscribeToNewsletter({
+    email,
+    name: name || undefined,
+  })
+
   return { id: response?.Id }
 }