@faststore/api 2.2.80 → 2.2.81

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 VTEX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/cjs/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@faststore/api",
-    "version": "2.2.79",
+    "version": "2.2.80",
     "license": "MIT",
     "main": "dist/cjs/src/index.js",
     "typings": "dist/esm/src/index.d.ts",

package/dist/cjs/src/platforms/vtex/clients/commerce/index.d.ts

@@ -14,6 +14,8 @@ import { MasterDataResponse } from './types/Newsletter';
 import type { Address, AddressInput } from './types/Address';
 import { DeliveryMode, SelectedAddress } from './types/ShippingData';
 type ValueOf<T> = T extends Record<string, infer K> ? K : never;
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export declare const resetAnonymousNewsletterWarnings: () => void;
 export declare const VtexCommerce: ({ account, environment, incrementAddress }: Options, ctx: Context) => {
     catalog: {
         salesChannel: (sc: string) => Promise<SalesChannel>;
@@ -67,8 +69,20 @@ export declare const VtexCommerce: ({ account, environment, incrementAddress }:
         address: ({ postalCode, country, }: AddressInput) => Promise<Address>;
     };
     session: (search: string) => Promise<Session>;
-    subscribeToNewsletter: (data: {
-        name: string;
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({ name, email, }: {
+        name?: string | undefined;
         email: string;
     }) => Promise<MasterDataResponse>;
 };

package/dist/cjs/src/platforms/vtex/clients/commerce/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VtexCommerce = void 0;
+exports.VtexCommerce = exports.resetAnonymousNewsletterWarnings = void 0;
 const fetch_1 = require("../fetch");
 const cookies_1 = require("../../utils/cookies");
 const BASE_INIT = {
@@ -9,6 +9,17 @@ const BASE_INIT = {
         'content-type': 'application/json',
     },
 };
+// Accounts already warned that they rely on public `NL` fields. The commerce
+// client is created per request, so the warning is kept once per account
+// instead of per instance, to avoid flooding the logs. The account comes from
+// the store's API options, not from the request, so the set holds at most one
+// entry per account the process is configured for (usually one). It's still
+// capped, so it can't grow without bound if that ever changes.
+const MAX_WARNED_NEWSLETTER_ACCOUNTS = 100;
+const accountsWarnedAboutAnonymousNewsletter = new Set();
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+const resetAnonymousNewsletterWarnings = () => accountsWarnedAboutAnonymousNewsletter.clear();
+exports.resetAnonymousNewsletterWarnings = resetAnonymousNewsletterWarnings;
 const VtexCommerce = ({ account, environment, incrementAddress }, ctx) => {
     const base = `https://${account}.${environment}.com.br`;
     const storeCookies = (0, cookies_1.getStoreCookie)(ctx);
@@ -177,10 +188,54 @@ const VtexCommerce = ({ account, environment, incrementAddress }, ctx) => {
                 body: '{}',
             }, { storeCookies });
         },
-        subscribeToNewsletter: (data) => {
+        /**
+         * Creates a newsletter subscription in the `NL` Master Data entity.
+         *
+         * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+         * created with a `POST` authenticated by that dedicated key, so `NL` fields
+         * can stay private. The request is create-only: the body is built here from
+         * the validated fields and never carries a document id, so the caller can't
+         * reach an existing record.
+         *
+         * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+         * which only works while `NL` fields are public.
+         */
+        subscribeToNewsletter: ({ name, email, }) => {
+            const body = JSON.stringify({
+                ...(name ? { name } : {}),
+                email,
+                isNewsletterOptIn: true,
+            });
+            const appKey = process.env.FS_NEWSLETTER_APP_KEY;
+            const appToken = process.env.FS_NEWSLETTER_APP_TOKEN;
+            if (appKey && appToken) {
+                return (0, fetch_1.fetchAPI)(`${base}/api/dataentities/NL/documents`, {
+                    method: 'POST',
+                    headers: {
+                        'content-type': 'application/json',
+                        accept: 'application/json',
+                        'X-VTEX-API-AppKey': appKey,
+                        'X-VTEX-API-AppToken': appToken,
+                    },
+                    body,
+                });
+            }
+            if (!accountsWarnedAboutAnonymousNewsletter.has(account)) {
+                if (accountsWarnedAboutAnonymousNewsletter.size >=
+                    MAX_WARNED_NEWSLETTER_ACCOUNTS) {
+                    accountsWarnedAboutAnonymousNewsletter.clear();
+                }
+                accountsWarnedAboutAnonymousNewsletter.add(account);
+                // Name only the missing variables, so a partial setup is easy to spot.
+                const missing = [
+                    !appKey && 'FS_NEWSLETTER_APP_KEY',
+                    !appToken && 'FS_NEWSLETTER_APP_TOKEN',
+                ].filter(Boolean);
+                console.warn(`[subscribeToNewsletter] ${missing.join(' and ')} ${missing.length > 1 ? 'are' : 'is'} not set. Falling back to an anonymous Master Data request, which requires public fields in the NL entity. Configure both credentials and make the NL fields private.`);
+            }
             return (0, fetch_1.fetchAPI)(`${base}/api/dataentities/NL/documents/`, {
                 ...BASE_INIT,
-                body: JSON.stringify({ ...data, isNewsletterOptIn: true }),
+                body,
                 method: 'PATCH',
             }, { storeCookies });
         },

package/dist/cjs/src/platforms/vtex/clients/commerce/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/platforms/vtex/clients/commerce/index.ts"],"names":[],"mappings":";;;AACA,oCAAmC;AAoBnC,iDAAmE;AAInE,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,MAAM;IACd,OAAO,EAAE;QACP,cAAc,EAAE,kBAAkB;KACnC;CACF,CAAA;AAEM,MAAM,YAAY,GAAG,CAC1B,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAW,EACnD,GAAY,EACZ,EAAE;IACF,MAAM,IAAI,GAAG,WAAW,OAAO,IAAI,WAAW,SAAS,CAAA;IACvD,MAAM,YAAY,GAAG,IAAA,wBAAc,EAAC,GAAG,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAA;IACrC,qFAAqF;IACrF,MAAM,aAAa,GAAG,CACpB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChD,GAAG,CAAC,OAAO,EAAE,IAAI;QACjB,EAAE,CACH,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAErB,OAAO;QACL,OAAO,EAAE;YACP,YAAY,EAAE,CAAC,EAAU,EAAyB,EAAE,CAClD,IAAA,gBAAQ,EACN,GAAG,IAAI,wCAAwC,EAAE,EAAE,EACnD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;YACH,KAAK,EAAE;gBACL,IAAI,EAAE,GAAqB,EAAE,CAC3B,IAAA,gBAAQ,EAAC,GAAG,IAAI,oCAAoC,EAAE,SAAS,EAAE;oBAC/D,YAAY;iBACb,CAAC;aACL;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,EAA2B,EAAE,CAC3C,IAAA,gBAAQ,EACN,GAAG,IAAI,yCAAyC,KAAK,EAAE,EACvD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,CAAC,IAAY,EAA2B,EAAE,CAClD,IAAA,gBAAQ,EACN,GAAG,IAAI,2CAA2C,IAAI,EAAE,EACxD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,QAAQ,EAAE;gBACR,YAAY,EAAE,CAAC,EACb,IAAI,EACJ,SAAS,EACT,cAAc,GAAG,IAAI,GAKtB,EAA4B,EAAE;oBAC7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;wBACjC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;wBACpC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;qBAC1C,CAAC,CAAA;oBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iDAAiD,IAAI,IAAI,SAAS,IAAI,MAAM,EAAE,EACrF,SAAS,EACT,EAAE,YAAY,EAAE,CACjB,CAAA;gBACH,CAAC;aACF;SACF;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,CACV,IAAoB,EACpB,EAAE,YAAY,KAAwB,GAAG,CAAC,OAAO,CAAC,OAAO,EACpC,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,2CAA2C,MAAM,CAAC,QAAQ,EAAE,EAAE,EACrE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,YAAY,EAAE,CACZ,EACE,EAAE,EACF,KAAK,EACL,YAAY,EACZ,iBAAiB,GAMlB,EACD,iBAA2B,EACP,EAAE;gBACtB,MAAM,cAAc,GAAG,iBAAiB;oBACtC,CAAC,CAAC;wBACE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS;wBACrD,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO;qBAClD;oBACH,CAAC,CAAC,IAAI,CAAA;gBAER,MAAM,UAAU,GAAG;oBACjB,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC9D,SAAS;wBACT,uBAAuB,EAAE,YAAY,EAAE,eAAe,IAAI,IAAI;wBAC9D,WAAW,EAAE,YAAY,EAAE,cAAc,IAAI,IAAI;wBACjD,cAAc,EAAE,cAAc;qBAC/B,CAAC,CAAC;oBACH,iBAAiB,EAAE,iBAAiB;oBACpC,gCAAgC,EAAE,gBAAgB;iBACnD,CAAA;gBAED,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,2BAA2B,EACnE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;iBACjC,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,SAAS,EAAE,CAAC,EACV,EAAE,EACF,mBAAmB,GAAG,IAAI,EAC1B,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,GAK9B,EAAsB,EAAE;gBACvB,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;gBAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,mBAAmB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;oBACnD,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC/D;oBACE,GAAG,SAAS;oBACZ,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,sBAAsB,EAAE,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE;gBACjD,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,iBAAiB,EACzD;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI;iBACX,CACF,CAAA;YACH,CAAC;YACD,oBAAoB,EAAE,CAAC,EACrB,EAAE,EACF,UAAU,EACV,iBAAiB,GAAG,aAAa,EACjC,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAC/C,eAAe,GAAG,IAAI,GAOvB,EAAsB,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,iBAAiB;oBACjB,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,UAAU,MAAM,EAAE,EAC1D;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,UAAU;wBACV,WAAW,EAAE,CAAC,eAAe;qBAC9B,CAAC;oBACF,MAAM,EAAE,OAAO;iBAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,aAAa,EAAE,CAAC,EACd,EAAE,EACF,KAAK,EACL,GAAG,EACH,KAAK,GAMN,EAAsB,EAAE;gBACvB,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,eAAe,KAAK,IAAI,GAAG,EAAE,EACrE;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;oBAC/B,MAAM,EAAE,KAAK;iBACd,CACF,CAAA;YACH,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EACb,UAAU,EACV,cAAc,EACd,OAAO,EACP,YAAY,GACA,EAAqB,EAAE;gBACnC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,YAAY,IAAI,EAAE;iBACvB,CAAC,CAAA;gBAEF,UAAU;oBACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;oBACzC,CAAC,CAAC,MAAM,CAAC,MAAM,CACX,gBAAgB,EAChB,GAAG,cAAc,EAAE,SAAS,IAAI,cAAc,EAAE,QAAQ,EAAE,CAC3D,CAAA;gBAEL,MAAM,GAAG,GAAG,GAAG,IAAI,8BAA8B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;gBACpE,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,EACH;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,EACd,UAAU,EACV,OAAO,GACM,EAAoB,EAAE;gBACnC,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iCAAiC,OAAO,IAAI,UAAU,EAAE,EAC/D;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;SACF;QACD,OAAO,EAAE,CAAC,MAAc,EAAoB,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;YAE1C,MAAM,CAAC,GAAG,CACR,OAAO,EACP,uJAAuJ,CACxJ,CAAA;YAED,MAAM,OAAO,GAAgB,UAAU,CAAC;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC,CAAA;YAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC3C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI;aACX,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;QACD,qBAAqB,EAAE,CAAC,IAGvB,EAA+B,EAAE;YAChC,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iCAAiC,EACxC;gBACE,GAAG,SAAS;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;gBAC1D,MAAM,EAAE,OAAO;aAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AA1UY,QAAA,YAAY,gBA0UxB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/platforms/vtex/clients/commerce/index.ts"],"names":[],"mappings":";;;AACA,oCAAmC;AAoBnC,iDAAmE;AAInE,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,MAAM;IACd,OAAO,EAAE;QACP,cAAc,EAAE,kBAAkB;KACnC;CACF,CAAA;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,+DAA+D;AAC/D,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAC1C,MAAM,sCAAsC,GAAG,IAAI,GAAG,EAAU,CAAA;AAEhE,iFAAiF;AAC1E,MAAM,gCAAgC,GAAG,GAAG,EAAE,CACnD,sCAAsC,CAAC,KAAK,EAAE,CAAA;AADnC,QAAA,gCAAgC,oCACG;AAEzC,MAAM,YAAY,GAAG,CAC1B,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAW,EACnD,GAAY,EACZ,EAAE;IACF,MAAM,IAAI,GAAG,WAAW,OAAO,IAAI,WAAW,SAAS,CAAA;IACvD,MAAM,YAAY,GAAG,IAAA,wBAAc,EAAC,GAAG,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAA;IACrC,qFAAqF;IACrF,MAAM,aAAa,GAAG,CACpB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChD,GAAG,CAAC,OAAO,EAAE,IAAI;QACjB,EAAE,CACH,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAErB,OAAO;QACL,OAAO,EAAE;YACP,YAAY,EAAE,CAAC,EAAU,EAAyB,EAAE,CAClD,IAAA,gBAAQ,EACN,GAAG,IAAI,wCAAwC,EAAE,EAAE,EACnD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;YACH,KAAK,EAAE;gBACL,IAAI,EAAE,GAAqB,EAAE,CAC3B,IAAA,gBAAQ,EAAC,GAAG,IAAI,oCAAoC,EAAE,SAAS,EAAE;oBAC/D,YAAY;iBACb,CAAC;aACL;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,EAA2B,EAAE,CAC3C,IAAA,gBAAQ,EACN,GAAG,IAAI,yCAAyC,KAAK,EAAE,EACvD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,CAAC,IAAY,EAA2B,EAAE,CAClD,IAAA,gBAAQ,EACN,GAAG,IAAI,2CAA2C,IAAI,EAAE,EACxD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,QAAQ,EAAE;gBACR,YAAY,EAAE,CAAC,EACb,IAAI,EACJ,SAAS,EACT,cAAc,GAAG,IAAI,GAKtB,EAA4B,EAAE;oBAC7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;wBACjC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;wBACpC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;qBAC1C,CAAC,CAAA;oBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iDAAiD,IAAI,IAAI,SAAS,IAAI,MAAM,EAAE,EACrF,SAAS,EACT,EAAE,YAAY,EAAE,CACjB,CAAA;gBACH,CAAC;aACF;SACF;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,CACV,IAAoB,EACpB,EAAE,YAAY,KAAwB,GAAG,CAAC,OAAO,CAAC,OAAO,EACpC,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,2CAA2C,MAAM,CAAC,QAAQ,EAAE,EAAE,EACrE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,YAAY,EAAE,CACZ,EACE,EAAE,EACF,KAAK,EACL,YAAY,EACZ,iBAAiB,GAMlB,EACD,iBAA2B,EACP,EAAE;gBACtB,MAAM,cAAc,GAAG,iBAAiB;oBACtC,CAAC,CAAC;wBACE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS;wBACrD,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO;qBAClD;oBACH,CAAC,CAAC,IAAI,CAAA;gBAER,MAAM,UAAU,GAAG;oBACjB,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC9D,SAAS;wBACT,uBAAuB,EAAE,YAAY,EAAE,eAAe,IAAI,IAAI;wBAC9D,WAAW,EAAE,YAAY,EAAE,cAAc,IAAI,IAAI;wBACjD,cAAc,EAAE,cAAc;qBAC/B,CAAC,CAAC;oBACH,iBAAiB,EAAE,iBAAiB;oBACpC,gCAAgC,EAAE,gBAAgB;iBACnD,CAAA;gBAED,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,2BAA2B,EACnE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;iBACjC,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,SAAS,EAAE,CAAC,EACV,EAAE,EACF,mBAAmB,GAAG,IAAI,EAC1B,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,GAK9B,EAAsB,EAAE;gBACvB,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;gBAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,mBAAmB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;oBACnD,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC/D;oBACE,GAAG,SAAS;oBACZ,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,sBAAsB,EAAE,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE;gBACjD,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,iBAAiB,EACzD;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI;iBACX,CACF,CAAA;YACH,CAAC;YACD,oBAAoB,EAAE,CAAC,EACrB,EAAE,EACF,UAAU,EACV,iBAAiB,GAAG,aAAa,EACjC,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAC/C,eAAe,GAAG,IAAI,GAOvB,EAAsB,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,iBAAiB;oBACjB,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,UAAU,MAAM,EAAE,EAC1D;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,UAAU;wBACV,WAAW,EAAE,CAAC,eAAe;qBAC9B,CAAC;oBACF,MAAM,EAAE,OAAO;iBAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,aAAa,EAAE,CAAC,EACd,EAAE,EACF,KAAK,EACL,GAAG,EACH,KAAK,GAMN,EAAsB,EAAE;gBACvB,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,+BAA+B,EAAE,eAAe,KAAK,IAAI,GAAG,EAAE,EACrE;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;oBAC/B,MAAM,EAAE,KAAK;iBACd,CACF,CAAA;YACH,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EACb,UAAU,EACV,cAAc,EACd,OAAO,EACP,YAAY,GACA,EAAqB,EAAE;gBACnC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,YAAY,IAAI,EAAE;iBACvB,CAAC,CAAA;gBAEF,UAAU;oBACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;oBACzC,CAAC,CAAC,MAAM,CAAC,MAAM,CACX,gBAAgB,EAChB,GAAG,cAAc,EAAE,SAAS,IAAI,cAAc,EAAE,QAAQ,EAAE,CAC3D,CAAA;gBAEL,MAAM,GAAG,GAAG,GAAG,IAAI,8BAA8B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;gBACpE,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,EACH;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,EACd,UAAU,EACV,OAAO,GACM,EAAoB,EAAE;gBACnC,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iCAAiC,OAAO,IAAI,UAAU,EAAE,EAC/D;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;SACF;QACD,OAAO,EAAE,CAAC,MAAc,EAAoB,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;YAE1C,MAAM,CAAC,GAAG,CACR,OAAO,EACP,uJAAuJ,CACxJ,CAAA;YAED,MAAM,OAAO,GAAgB,UAAU,CAAC;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC,CAAA;YAEF,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC3C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI;aACX,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;QACD;;;;;;;;;;;WAWG;QACH,qBAAqB,EAAE,CAAC,EACtB,IAAI,EACJ,KAAK,GAIN,EAA+B,EAAE;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,KAAK;gBACL,iBAAiB,EAAE,IAAI;aACxB,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;YAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;YAEpD,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;gBACvB,OAAO,IAAA,gBAAQ,EAAC,GAAG,IAAI,gCAAgC,EAAE;oBACvD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,MAAM,EAAE,kBAAkB;wBAC1B,mBAAmB,EAAE,MAAM;wBAC3B,qBAAqB,EAAE,QAAQ;qBAChC;oBACD,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,IACE,sCAAsC,CAAC,IAAI;oBAC3C,8BAA8B,EAC9B,CAAC;oBACD,sCAAsC,CAAC,KAAK,EAAE,CAAA;gBAChD,CAAC;gBACD,sCAAsC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAEnD,uEAAuE;gBACvE,MAAM,OAAO,GAAG;oBACd,CAAC,MAAM,IAAI,uBAAuB;oBAClC,CAAC,QAAQ,IAAI,yBAAyB;iBACvC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAEjB,OAAO,CAAC,IAAI,CACV,2BAA2B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAC/B,uKAAuK,CACxK,CAAA;YACH,CAAC;YAED,OAAO,IAAA,gBAAQ,EACb,GAAG,IAAI,iCAAiC,EACxC;gBACE,GAAG,SAAS;gBACZ,IAAI;gBACJ,MAAM,EAAE,OAAO;aAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AApYY,QAAA,YAAY,gBAoYxB"}

package/dist/cjs/src/platforms/vtex/clients/fetch.d.ts

@@ -1,5 +1,6 @@
 interface FetchAPIOptions {
     storeCookies?: (headers: Headers) => void;
 }
+export declare const redactHeaders: (headers?: HeadersInit) => Record<string, string> | undefined;
 export declare const fetchAPI: (info: RequestInfo, init?: RequestInit, options?: FetchAPIOptions) => Promise<any>;
 export {};

package/dist/cjs/src/platforms/vtex/clients/fetch.js

@@ -1,10 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchAPI = void 0;
+exports.fetchAPI = exports.redactHeaders = void 0;
 const tslib_1 = require("tslib");
 const isomorphic_unfetch_1 = tslib_1.__importDefault(require("isomorphic-unfetch"));
 const package_json_1 = tslib_1.__importDefault(require("../../../../package.json"));
 const USER_AGENT = `${package_json_1.default.name}@${package_json_1.default.version}`;
+// Headers that may carry credentials: store API keys (`X-VTEX-API-AppKey`,
+// `X-VTEX-API-AppToken`), shopper cookies (`Cookie`, `Set-Cookie`,
+// `VtexIdclientAutCookie_*`), `Authorization`, and generic token, secret or
+// API key headers. They are replaced before a failed request and its response
+// are logged. Matched by substring so new credential headers are covered too.
+const SENSITIVE_HEADER = /authorization|cookie|token|secret|api-?key|appkey/i;
+const REDACTED = '[redacted]';
+const redactHeaders = (headers) => {
+    if (!headers) {
+        return undefined;
+    }
+    const redacted = {};
+    const add = (name, value) => {
+        redacted[name] = SENSITIVE_HEADER.test(name) ? REDACTED : value;
+    };
+    if (Array.isArray(headers)) {
+        headers.forEach(([name, value]) => add(name, value));
+    }
+    else if (typeof headers.forEach === 'function') {
+        // Matches both the global `Headers` and the polyfill returned by
+        // `isomorphic-unfetch` on Node, which isn't an instance of the global one.
+        const headerList = headers;
+        headerList.forEach((value, name) => add(name, value));
+    }
+    else {
+        Object.entries(headers).forEach(([name, value]) => add(name, value));
+    }
+    return redacted;
+};
+exports.redactHeaders = redactHeaders;
 const fetchAPI = async (info, init, options) => {
     const response = await (0, isomorphic_unfetch_1.default)(info, {
         ...init,
@@ -19,7 +49,20 @@ const fetchAPI = async (info, init, options) => {
         }
         return response.status !== 204 ? response.json() : undefined;
     }
-    console.error(info, init, response);
+    // Log a summary instead of the raw Response, whose headers may include
+    // `Set-Cookie` with shopper credentials. The request body is omitted because
+    // it can carry personal data (e.g. the newsletter email and name).
+    console.error(
+    // Only the URL: a `Request` instance could carry unredacted headers.
+    typeof info === 'string' ? info : info.url, init && {
+        ...init,
+        headers: (0, exports.redactHeaders)(init.headers),
+        body: init.body ? REDACTED : undefined,
+    }, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: (0, exports.redactHeaders)(response.headers),
+    });
     const text = await response.text();
     throw new Error(text);
 };

package/dist/cjs/src/platforms/vtex/clients/fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/clients/fetch.ts"],"names":[],"mappings":";;;;AAAA,oFAAsC;AACtC,oFAAkD;AAElD,MAAM,UAAU,GAAG,GAAG,sBAAW,CAAC,IAAI,IAAI,sBAAW,CAAC,OAAO,EAAE,CAAA;AAMxD,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAiB,EACjB,IAAkB,EAClB,OAAyB,EACzB,EAAE;IACF,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAK,EAAC,IAAI,EAAE;QACjC,GAAG,IAAI;QACP,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;YACxB,YAAY,EAAE,UAAU;SACzB;KACF,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAElC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC,CAAA;AAzBY,QAAA,QAAQ,YAyBpB"}
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/clients/fetch.ts"],"names":[],"mappings":";;;;AAAA,oFAAsC;AACtC,oFAAkD;AAElD,MAAM,UAAU,GAAG,GAAG,sBAAW,CAAC,IAAI,IAAI,sBAAW,CAAC,OAAO,EAAE,CAAA;AAM/D,2EAA2E;AAC3E,mEAAmE;AACnE,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,oDAAoD,CAAA;AAE7E,MAAM,QAAQ,GAAG,YAAY,CAAA;AAEtB,MAAM,aAAa,GAAG,CAC3B,OAAqB,EACe,EAAE;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;IACjE,CAAC,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,OAAQ,OAAmB,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9D,iEAAiE;QACjE,2EAA2E;QAC3E,MAAM,UAAU,GAAG,OAAkB,CAAA;QACrC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAxBY,QAAA,aAAa,iBAwBzB;AAEM,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAiB,EACjB,IAAkB,EAClB,OAAyB,EACzB,EAAE;IACF,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAK,EAAC,IAAI,EAAE;QACjC,GAAG,IAAI;QACP,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;YACxB,YAAY,EAAE,UAAU;SACzB;KACF,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC;IAED,uEAAuE;IACvE,6EAA6E;IAC7E,mEAAmE;IACnE,OAAO,CAAC,KAAK;IACX,qEAAqE;IACrE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAC1C,IAAI,IAAI;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAA,qBAAa,EAAC,IAAI,CAAC,OAAO,CAAC;QACpC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACvC,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAA,qBAAa,EAAC,QAAQ,CAAC,OAAO,CAAC;KACzC,CACF,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAElC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC,CAAA;AAzCY,QAAA,QAAQ,YAyCpB"}

package/dist/cjs/src/platforms/vtex/clients/index.d.ts

@@ -60,8 +60,8 @@ export declare const getClients: (options: Options, ctx: Context) => {
             address: ({ postalCode, country, }: import("./commerce/types/Address").AddressInput) => Promise<import("./commerce/types/Address").Address>;
         };
         session: (search: string) => Promise<import("./commerce/types/Session").Session>;
-        subscribeToNewsletter: (data: {
-            name: string;
+        subscribeToNewsletter: ({ name, email, }: {
+            name?: string | undefined;
             email: string;
         }) => Promise<import("./commerce/types/Newsletter").MasterDataResponse>;
     };

package/dist/cjs/src/platforms/vtex/resolvers/subscribeToNewsletter.js

@@ -1,8 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.subscribeToNewsletter = void 0;
+const errors_1 = require("../../errors");
+const EMAIL_MAX_LENGTH = 254;
+const NAME_MAX_LENGTH = 100;
+// Character classes exclude `.`, so each domain label is matched once and the
+// pattern stays linear on long inputs.
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/;
 const subscribeToNewsletter = async (_, { data }, { clients: { commerce } }) => {
-    const response = await commerce.subscribeToNewsletter(data);
+    // The subscription is written with a store credential, so only validated
+    // values reach Master Data.
+    const email = data.email?.trim().toLowerCase() ?? '';
+    const name = data.name?.trim() ?? '';
+    if (email.length > EMAIL_MAX_LENGTH || !EMAIL_PATTERN.test(email)) {
+        throw new errors_1.BadRequestError('Invalid email');
+    }
+    if (name.length > NAME_MAX_LENGTH) {
+        throw new errors_1.BadRequestError(`Invalid name: must have at most ${NAME_MAX_LENGTH} characters`);
+    }
+    const response = await commerce.subscribeToNewsletter({
+        email,
+        name: name || undefined,
+    });
     return { id: response?.Id };
 };
 exports.subscribeToNewsletter = subscribeToNewsletter;

package/dist/cjs/src/platforms/vtex/resolvers/subscribeToNewsletter.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscribeToNewsletter.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/resolvers/subscribeToNewsletter.ts"],"names":[],"mappings":";;;AAMO,MAAM,qBAAqB,GAAG,KAAK,EACxC,CAAM,EACN,EAAE,IAAI,EAAqC,EAC3C,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAW,EACA,EAAE;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAC3D,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC,CAAA;AAPY,QAAA,qBAAqB,yBAOjC"}
+{"version":3,"file":"subscribeToNewsletter.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/resolvers/subscribeToNewsletter.ts"],"names":[],"mappings":";;;AAKA,yCAA8C;AAE9C,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAA;AAC3B,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,aAAa,GAAG,iCAAiC,CAAA;AAEhD,MAAM,qBAAqB,GAAG,KAAK,EACxC,CAAM,EACN,EAAE,IAAI,EAAqC,EAC3C,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAW,EACA,EAAE;IACpC,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAEpC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,wBAAe,CAAC,eAAe,CAAC,CAAA;IAC5C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,wBAAe,CACvB,mCAAmC,eAAe,aAAa,CAChE,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC;QACpD,KAAK;QACL,IAAI,EAAE,IAAI,IAAI,SAAS;KACxB,CAAC,CAAA;IAEF,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC,CAAA;AA1BY,QAAA,qBAAqB,yBA0BjC"}

package/dist/esm/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@faststore/api",
-    "version": "2.2.79",
+    "version": "2.2.80",
     "license": "MIT",
     "main": "dist/cjs/src/index.js",
     "typings": "dist/esm/src/index.d.ts",

package/dist/esm/src/platforms/vtex/clients/commerce/index.d.ts

@@ -14,6 +14,8 @@ import { MasterDataResponse } from './types/Newsletter';
 import type { Address, AddressInput } from './types/Address';
 import { DeliveryMode, SelectedAddress } from './types/ShippingData';
 type ValueOf<T> = T extends Record<string, infer K> ? K : never;
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export declare const resetAnonymousNewsletterWarnings: () => void;
 export declare const VtexCommerce: ({ account, environment, incrementAddress }: Options, ctx: Context) => {
     catalog: {
         salesChannel: (sc: string) => Promise<SalesChannel>;
@@ -67,8 +69,20 @@ export declare const VtexCommerce: ({ account, environment, incrementAddress }:
         address: ({ postalCode, country, }: AddressInput) => Promise<Address>;
     };
     session: (search: string) => Promise<Session>;
-    subscribeToNewsletter: (data: {
-        name: string;
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({ name, email, }: {
+        name?: string | undefined;
         email: string;
     }) => Promise<MasterDataResponse>;
 };

package/dist/esm/src/platforms/vtex/clients/commerce/index.js

@@ -6,6 +6,16 @@ const BASE_INIT = {
         'content-type': 'application/json',
     },
 };
+// Accounts already warned that they rely on public `NL` fields. The commerce
+// client is created per request, so the warning is kept once per account
+// instead of per instance, to avoid flooding the logs. The account comes from
+// the store's API options, not from the request, so the set holds at most one
+// entry per account the process is configured for (usually one). It's still
+// capped, so it can't grow without bound if that ever changes.
+const MAX_WARNED_NEWSLETTER_ACCOUNTS = 100;
+const accountsWarnedAboutAnonymousNewsletter = new Set();
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export const resetAnonymousNewsletterWarnings = () => accountsWarnedAboutAnonymousNewsletter.clear();
 export const VtexCommerce = ({ account, environment, incrementAddress }, ctx) => {
     const base = `https://${account}.${environment}.com.br`;
     const storeCookies = getStoreCookie(ctx);
@@ -174,10 +184,54 @@ export const VtexCommerce = ({ account, environment, incrementAddress }, ctx) =>
                 body: '{}',
             }, { storeCookies });
         },
-        subscribeToNewsletter: (data) => {
+        /**
+         * Creates a newsletter subscription in the `NL` Master Data entity.
+         *
+         * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+         * created with a `POST` authenticated by that dedicated key, so `NL` fields
+         * can stay private. The request is create-only: the body is built here from
+         * the validated fields and never carries a document id, so the caller can't
+         * reach an existing record.
+         *
+         * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+         * which only works while `NL` fields are public.
+         */
+        subscribeToNewsletter: ({ name, email, }) => {
+            const body = JSON.stringify({
+                ...(name ? { name } : {}),
+                email,
+                isNewsletterOptIn: true,
+            });
+            const appKey = process.env.FS_NEWSLETTER_APP_KEY;
+            const appToken = process.env.FS_NEWSLETTER_APP_TOKEN;
+            if (appKey && appToken) {
+                return fetchAPI(`${base}/api/dataentities/NL/documents`, {
+                    method: 'POST',
+                    headers: {
+                        'content-type': 'application/json',
+                        accept: 'application/json',
+                        'X-VTEX-API-AppKey': appKey,
+                        'X-VTEX-API-AppToken': appToken,
+                    },
+                    body,
+                });
+            }
+            if (!accountsWarnedAboutAnonymousNewsletter.has(account)) {
+                if (accountsWarnedAboutAnonymousNewsletter.size >=
+                    MAX_WARNED_NEWSLETTER_ACCOUNTS) {
+                    accountsWarnedAboutAnonymousNewsletter.clear();
+                }
+                accountsWarnedAboutAnonymousNewsletter.add(account);
+                // Name only the missing variables, so a partial setup is easy to spot.
+                const missing = [
+                    !appKey && 'FS_NEWSLETTER_APP_KEY',
+                    !appToken && 'FS_NEWSLETTER_APP_TOKEN',
+                ].filter(Boolean);
+                console.warn(`[subscribeToNewsletter] ${missing.join(' and ')} ${missing.length > 1 ? 'are' : 'is'} not set. Falling back to an anonymous Master Data request, which requires public fields in the NL entity. Configure both credentials and make the NL fields private.`);
+            }
             return fetchAPI(`${base}/api/dataentities/NL/documents/`, {
                 ...BASE_INIT,
-                body: JSON.stringify({ ...data, isNewsletterOptIn: true }),
+                body,
                 method: 'PATCH',
             }, { storeCookies });
         },

package/dist/esm/src/platforms/vtex/clients/commerce/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/platforms/vtex/clients/commerce/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAoBnC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAInE,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,MAAM;IACd,OAAO,EAAE;QACP,cAAc,EAAE,kBAAkB;KACnC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAW,EACnD,GAAY,EACZ,EAAE;IACF,MAAM,IAAI,GAAG,WAAW,OAAO,IAAI,WAAW,SAAS,CAAA;IACvD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACrC,qFAAqF;IACrF,MAAM,aAAa,GAAG,CACpB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChD,GAAG,CAAC,OAAO,EAAE,IAAI;QACjB,EAAE,CACH,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAErB,OAAO;QACL,OAAO,EAAE;YACP,YAAY,EAAE,CAAC,EAAU,EAAyB,EAAE,CAClD,QAAQ,CACN,GAAG,IAAI,wCAAwC,EAAE,EAAE,EACnD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;YACH,KAAK,EAAE;gBACL,IAAI,EAAE,GAAqB,EAAE,CAC3B,QAAQ,CAAC,GAAG,IAAI,oCAAoC,EAAE,SAAS,EAAE;oBAC/D,YAAY;iBACb,CAAC;aACL;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,EAA2B,EAAE,CAC3C,QAAQ,CACN,GAAG,IAAI,yCAAyC,KAAK,EAAE,EACvD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,CAAC,IAAY,EAA2B,EAAE,CAClD,QAAQ,CACN,GAAG,IAAI,2CAA2C,IAAI,EAAE,EACxD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,QAAQ,EAAE;gBACR,YAAY,EAAE,CAAC,EACb,IAAI,EACJ,SAAS,EACT,cAAc,GAAG,IAAI,GAKtB,EAA4B,EAAE;oBAC7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;wBACjC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;wBACpC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;qBAC1C,CAAC,CAAA;oBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,iDAAiD,IAAI,IAAI,SAAS,IAAI,MAAM,EAAE,EACrF,SAAS,EACT,EAAE,YAAY,EAAE,CACjB,CAAA;gBACH,CAAC;aACF;SACF;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,CACV,IAAoB,EACpB,EAAE,YAAY,KAAwB,GAAG,CAAC,OAAO,CAAC,OAAO,EACpC,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,2CAA2C,MAAM,CAAC,QAAQ,EAAE,EAAE,EACrE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,YAAY,EAAE,CACZ,EACE,EAAE,EACF,KAAK,EACL,YAAY,EACZ,iBAAiB,GAMlB,EACD,iBAA2B,EACP,EAAE;gBACtB,MAAM,cAAc,GAAG,iBAAiB;oBACtC,CAAC,CAAC;wBACE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS;wBACrD,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO;qBAClD;oBACH,CAAC,CAAC,IAAI,CAAA;gBAER,MAAM,UAAU,GAAG;oBACjB,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC9D,SAAS;wBACT,uBAAuB,EAAE,YAAY,EAAE,eAAe,IAAI,IAAI;wBAC9D,WAAW,EAAE,YAAY,EAAE,cAAc,IAAI,IAAI;wBACjD,cAAc,EAAE,cAAc;qBAC/B,CAAC,CAAC;oBACH,iBAAiB,EAAE,iBAAiB;oBACpC,gCAAgC,EAAE,gBAAgB;iBACnD,CAAA;gBAED,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,2BAA2B,EACnE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;iBACjC,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,SAAS,EAAE,CAAC,EACV,EAAE,EACF,mBAAmB,GAAG,IAAI,EAC1B,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,GAK9B,EAAsB,EAAE;gBACvB,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;gBAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,mBAAmB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;oBACnD,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC/D;oBACE,GAAG,SAAS;oBACZ,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,sBAAsB,EAAE,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE;gBACjD,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,iBAAiB,EACzD;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI;iBACX,CACF,CAAA;YACH,CAAC;YACD,oBAAoB,EAAE,CAAC,EACrB,EAAE,EACF,UAAU,EACV,iBAAiB,GAAG,aAAa,EACjC,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAC/C,eAAe,GAAG,IAAI,GAOvB,EAAsB,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,iBAAiB;oBACjB,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,UAAU,MAAM,EAAE,EAC1D;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,UAAU;wBACV,WAAW,EAAE,CAAC,eAAe;qBAC9B,CAAC;oBACF,MAAM,EAAE,OAAO;iBAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,aAAa,EAAE,CAAC,EACd,EAAE,EACF,KAAK,EACL,GAAG,EACH,KAAK,GAMN,EAAsB,EAAE;gBACvB,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,eAAe,KAAK,IAAI,GAAG,EAAE,EACrE;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;oBAC/B,MAAM,EAAE,KAAK;iBACd,CACF,CAAA;YACH,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EACb,UAAU,EACV,cAAc,EACd,OAAO,EACP,YAAY,GACA,EAAqB,EAAE;gBACnC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,YAAY,IAAI,EAAE;iBACvB,CAAC,CAAA;gBAEF,UAAU;oBACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;oBACzC,CAAC,CAAC,MAAM,CAAC,MAAM,CACX,gBAAgB,EAChB,GAAG,cAAc,EAAE,SAAS,IAAI,cAAc,EAAE,QAAQ,EAAE,CAC3D,CAAA;gBAEL,MAAM,GAAG,GAAG,GAAG,IAAI,8BAA8B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;gBACpE,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,EACH;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,EACd,UAAU,EACV,OAAO,GACM,EAAoB,EAAE;gBACnC,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,iCAAiC,OAAO,IAAI,UAAU,EAAE,EAC/D;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;SACF;QACD,OAAO,EAAE,CAAC,MAAc,EAAoB,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;YAE1C,MAAM,CAAC,GAAG,CACR,OAAO,EACP,uJAAuJ,CACxJ,CAAA;YAED,MAAM,OAAO,GAAgB,UAAU,CAAC;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC,CAAA;YAEF,OAAO,QAAQ,CACb,GAAG,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC3C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI;aACX,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;QACD,qBAAqB,EAAE,CAAC,IAGvB,EAA+B,EAAE;YAChC,OAAO,QAAQ,CACb,GAAG,IAAI,iCAAiC,EACxC;gBACE,GAAG,SAAS;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;gBAC1D,MAAM,EAAE,OAAO;aAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/platforms/vtex/clients/commerce/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAoBnC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAInE,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,MAAM;IACd,OAAO,EAAE;QACP,cAAc,EAAE,kBAAkB;KACnC;CACF,CAAA;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,+DAA+D;AAC/D,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAC1C,MAAM,sCAAsC,GAAG,IAAI,GAAG,EAAU,CAAA;AAEhE,iFAAiF;AACjF,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,EAAE,CACnD,sCAAsC,CAAC,KAAK,EAAE,CAAA;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAW,EACnD,GAAY,EACZ,EAAE;IACF,MAAM,IAAI,GAAG,WAAW,OAAO,IAAI,WAAW,SAAS,CAAA;IACvD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACrC,qFAAqF;IACrF,MAAM,aAAa,GAAG,CACpB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAChD,GAAG,CAAC,OAAO,EAAE,IAAI;QACjB,EAAE,CACH,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAErB,OAAO;QACL,OAAO,EAAE;YACP,YAAY,EAAE,CAAC,EAAU,EAAyB,EAAE,CAClD,QAAQ,CACN,GAAG,IAAI,wCAAwC,EAAE,EAAE,EACnD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;YACH,KAAK,EAAE;gBACL,IAAI,EAAE,GAAqB,EAAE,CAC3B,QAAQ,CAAC,GAAG,IAAI,oCAAoC,EAAE,SAAS,EAAE;oBAC/D,YAAY;iBACb,CAAC;aACL;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,EAA2B,EAAE,CAC3C,QAAQ,CACN,GAAG,IAAI,yCAAyC,KAAK,EAAE,EACvD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,CAAC,IAAY,EAA2B,EAAE,CAClD,QAAQ,CACN,GAAG,IAAI,2CAA2C,IAAI,EAAE,EACxD,SAAS,EACT,EAAE,YAAY,EAAE,CACjB;aACJ;YACD,QAAQ,EAAE;gBACR,YAAY,EAAE,CAAC,EACb,IAAI,EACJ,SAAS,EACT,cAAc,GAAG,IAAI,GAKtB,EAA4B,EAAE;oBAC7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;wBACjC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;wBACpC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;qBAC1C,CAAC,CAAA;oBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,iDAAiD,IAAI,IAAI,SAAS,IAAI,MAAM,EAAE,EACrF,SAAS,EACT,EAAE,YAAY,EAAE,CACjB,CAAA;gBACH,CAAC;aACF;SACF;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,CACV,IAAoB,EACpB,EAAE,YAAY,KAAwB,GAAG,CAAC,OAAO,CAAC,OAAO,EACpC,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,2CAA2C,MAAM,CAAC,QAAQ,EAAE,EAAE,EACrE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,YAAY,EAAE,CACZ,EACE,EAAE,EACF,KAAK,EACL,YAAY,EACZ,iBAAiB,GAMlB,EACD,iBAA2B,EACP,EAAE;gBACtB,MAAM,cAAc,GAAG,iBAAiB;oBACtC,CAAC,CAAC;wBACE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS;wBACrD,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO;qBAClD;oBACH,CAAC,CAAC,IAAI,CAAA;gBAER,MAAM,UAAU,GAAG;oBACjB,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;wBAC9D,SAAS;wBACT,uBAAuB,EAAE,YAAY,EAAE,eAAe,IAAI,IAAI;wBAC9D,WAAW,EAAE,YAAY,EAAE,cAAc,IAAI,IAAI;wBACjD,cAAc,EAAE,cAAc;qBAC/B,CAAC,CAAC;oBACH,iBAAiB,EAAE,iBAAiB;oBACpC,gCAAgC,EAAE,gBAAgB;iBACnD,CAAA;gBAED,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,2BAA2B,EACnE;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;iBACjC,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,SAAS,EAAE,CAAC,EACV,EAAE,EACF,mBAAmB,GAAG,IAAI,EAC1B,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,GAK9B,EAAsB,EAAE;gBACvB,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;gBAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,mBAAmB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;oBACnD,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC/D;oBACE,GAAG,SAAS;oBACZ,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,sBAAsB,EAAE,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE;gBACjD,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,iBAAiB,EACzD;oBACE,GAAG,SAAS;oBACZ,OAAO;oBACP,IAAI,EAAE,IAAI;iBACX,CACF,CAAA;YACH,CAAC;YACD,oBAAoB,EAAE,CAAC,EACrB,EAAE,EACF,UAAU,EACV,iBAAiB,GAAG,aAAa,EACjC,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAC/C,eAAe,GAAG,IAAI,GAOvB,EAAsB,EAAE;gBACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,iBAAiB;oBACjB,EAAE,EAAE,YAAY;iBACjB,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,UAAU,MAAM,EAAE,EAC1D;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,UAAU;wBACV,WAAW,EAAE,CAAC,eAAe;qBAC9B,CAAC;oBACF,MAAM,EAAE,OAAO;iBAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,aAAa,EAAE,CAAC,EACd,EAAE,EACF,KAAK,EACL,GAAG,EACH,KAAK,GAMN,EAAsB,EAAE;gBACvB,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,+BAA+B,EAAE,eAAe,KAAK,IAAI,GAAG,EAAE,EACrE;oBACE,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;oBAC/B,MAAM,EAAE,KAAK;iBACd,CACF,CAAA;YACH,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,EACb,UAAU,EACV,cAAc,EACd,OAAO,EACP,YAAY,GACA,EAAqB,EAAE;gBACnC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;oBACjC,OAAO,EAAE,OAAO;oBAChB,EAAE,EAAE,YAAY,IAAI,EAAE;iBACvB,CAAC,CAAA;gBAEF,UAAU;oBACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;oBACzC,CAAC,CAAC,MAAM,CAAC,MAAM,CACX,gBAAgB,EAChB,GAAG,cAAc,EAAE,SAAS,IAAI,cAAc,EAAE,QAAQ,EAAE,CAC3D,CAAA;gBAEL,MAAM,GAAG,GAAG,GAAG,IAAI,8BAA8B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;gBACpE,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,EACH;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,EACd,UAAU,EACV,OAAO,GACM,EAAoB,EAAE;gBACnC,MAAM,OAAO,GAAgB,UAAU,CAAC;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,aAAa;iBAClC,CAAC,CAAA;gBAEF,OAAO,QAAQ,CACb,GAAG,IAAI,iCAAiC,OAAO,IAAI,UAAU,EAAE,EAC/D;oBACE,OAAO;iBACR,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;YACH,CAAC;SACF;QACD,OAAO,EAAE,CAAC,MAAc,EAAoB,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;YAE1C,MAAM,CAAC,GAAG,CACR,OAAO,EACP,uJAAuJ,CACxJ,CAAA;YAED,MAAM,OAAO,GAAgB,UAAU,CAAC;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC,CAAA;YAEF,OAAO,QAAQ,CACb,GAAG,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC3C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI;aACX,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;QACD;;;;;;;;;;;WAWG;QACH,qBAAqB,EAAE,CAAC,EACtB,IAAI,EACJ,KAAK,GAIN,EAA+B,EAAE;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,KAAK;gBACL,iBAAiB,EAAE,IAAI;aACxB,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAA;YAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;YAEpD,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;gBACvB,OAAO,QAAQ,CAAC,GAAG,IAAI,gCAAgC,EAAE;oBACvD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,MAAM,EAAE,kBAAkB;wBAC1B,mBAAmB,EAAE,MAAM;wBAC3B,qBAAqB,EAAE,QAAQ;qBAChC;oBACD,IAAI;iBACL,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,IACE,sCAAsC,CAAC,IAAI;oBAC3C,8BAA8B,EAC9B,CAAC;oBACD,sCAAsC,CAAC,KAAK,EAAE,CAAA;gBAChD,CAAC;gBACD,sCAAsC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAEnD,uEAAuE;gBACvE,MAAM,OAAO,GAAG;oBACd,CAAC,MAAM,IAAI,uBAAuB;oBAClC,CAAC,QAAQ,IAAI,yBAAyB;iBACvC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAEjB,OAAO,CAAC,IAAI,CACV,2BAA2B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAC/B,uKAAuK,CACxK,CAAA;YACH,CAAC;YAED,OAAO,QAAQ,CACb,GAAG,IAAI,iCAAiC,EACxC;gBACE,GAAG,SAAS;gBACZ,IAAI;gBACJ,MAAM,EAAE,OAAO;aAChB,EACD,EAAE,YAAY,EAAE,CACjB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/esm/src/platforms/vtex/clients/fetch.d.ts

@@ -1,5 +1,6 @@
 interface FetchAPIOptions {
     storeCookies?: (headers: Headers) => void;
 }
+export declare const redactHeaders: (headers?: HeadersInit) => Record<string, string> | undefined;
 export declare const fetchAPI: (info: RequestInfo, init?: RequestInit, options?: FetchAPIOptions) => Promise<any>;
 export {};

package/dist/esm/src/platforms/vtex/clients/fetch.js

@@ -1,6 +1,35 @@
 import fetch from 'isomorphic-unfetch';
 import packageJson from '../../../../package.json';
 const USER_AGENT = `${packageJson.name}@${packageJson.version}`;
+// Headers that may carry credentials: store API keys (`X-VTEX-API-AppKey`,
+// `X-VTEX-API-AppToken`), shopper cookies (`Cookie`, `Set-Cookie`,
+// `VtexIdclientAutCookie_*`), `Authorization`, and generic token, secret or
+// API key headers. They are replaced before a failed request and its response
+// are logged. Matched by substring so new credential headers are covered too.
+const SENSITIVE_HEADER = /authorization|cookie|token|secret|api-?key|appkey/i;
+const REDACTED = '[redacted]';
+export const redactHeaders = (headers) => {
+    if (!headers) {
+        return undefined;
+    }
+    const redacted = {};
+    const add = (name, value) => {
+        redacted[name] = SENSITIVE_HEADER.test(name) ? REDACTED : value;
+    };
+    if (Array.isArray(headers)) {
+        headers.forEach(([name, value]) => add(name, value));
+    }
+    else if (typeof headers.forEach === 'function') {
+        // Matches both the global `Headers` and the polyfill returned by
+        // `isomorphic-unfetch` on Node, which isn't an instance of the global one.
+        const headerList = headers;
+        headerList.forEach((value, name) => add(name, value));
+    }
+    else {
+        Object.entries(headers).forEach(([name, value]) => add(name, value));
+    }
+    return redacted;
+};
 export const fetchAPI = async (info, init, options) => {
     const response = await fetch(info, {
         ...init,
@@ -15,7 +44,20 @@ export const fetchAPI = async (info, init, options) => {
         }
         return response.status !== 204 ? response.json() : undefined;
     }
-    console.error(info, init, response);
+    // Log a summary instead of the raw Response, whose headers may include
+    // `Set-Cookie` with shopper credentials. The request body is omitted because
+    // it can carry personal data (e.g. the newsletter email and name).
+    console.error(
+    // Only the URL: a `Request` instance could carry unredacted headers.
+    typeof info === 'string' ? info : info.url, init && {
+        ...init,
+        headers: redactHeaders(init.headers),
+        body: init.body ? REDACTED : undefined,
+    }, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: redactHeaders(response.headers),
+    });
     const text = await response.text();
     throw new Error(text);
 };

package/dist/esm/src/platforms/vtex/clients/fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/clients/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,oBAAoB,CAAA;AACtC,OAAO,WAAW,MAAM,0BAA0B,CAAA;AAElD,MAAM,UAAU,GAAG,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,CAAA;AAM/D,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAiB,EACjB,IAAkB,EAClB,OAAyB,EACzB,EAAE;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;QACjC,GAAG,IAAI;QACP,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;YACxB,YAAY,EAAE,UAAU;SACzB;KACF,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAElC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC,CAAA"}
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/clients/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,oBAAoB,CAAA;AACtC,OAAO,WAAW,MAAM,0BAA0B,CAAA;AAElD,MAAM,UAAU,GAAG,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,CAAA;AAM/D,2EAA2E;AAC3E,mEAAmE;AACnE,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,oDAAoD,CAAA;AAE7E,MAAM,QAAQ,GAAG,YAAY,CAAA;AAE7B,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAAqB,EACe,EAAE;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;IACjE,CAAC,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACtD,CAAC;SAAM,IAAI,OAAQ,OAAmB,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9D,iEAAiE;QACjE,2EAA2E;QAC3E,MAAM,UAAU,GAAG,OAAkB,CAAA;QACrC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACtE,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAiB,EACjB,IAAkB,EAClB,OAAyB,EACzB,EAAE;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;QACjC,GAAG,IAAI;QACP,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;YACxB,YAAY,EAAE,UAAU;SACzB;KACF,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC;IAED,uEAAuE;IACvE,6EAA6E;IAC7E,mEAAmE;IACnE,OAAO,CAAC,KAAK;IACX,qEAAqE;IACrE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAC1C,IAAI,IAAI;QACN,GAAG,IAAI;QACP,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACvC,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;KACzC,CACF,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAElC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC,CAAA"}

package/dist/esm/src/platforms/vtex/clients/index.d.ts

@@ -60,8 +60,8 @@ export declare const getClients: (options: Options, ctx: Context) => {
             address: ({ postalCode, country, }: import("./commerce/types/Address").AddressInput) => Promise<import("./commerce/types/Address").Address>;
         };
         session: (search: string) => Promise<import("./commerce/types/Session").Session>;
-        subscribeToNewsletter: (data: {
-            name: string;
+        subscribeToNewsletter: ({ name, email, }: {
+            name?: string | undefined;
             email: string;
         }) => Promise<import("./commerce/types/Newsletter").MasterDataResponse>;
     };

package/dist/esm/src/platforms/vtex/resolvers/subscribeToNewsletter.js

@@ -1,5 +1,24 @@
+import { BadRequestError } from '../../errors';
+const EMAIL_MAX_LENGTH = 254;
+const NAME_MAX_LENGTH = 100;
+// Character classes exclude `.`, so each domain label is matched once and the
+// pattern stays linear on long inputs.
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/;
 export const subscribeToNewsletter = async (_, { data }, { clients: { commerce } }) => {
-    const response = await commerce.subscribeToNewsletter(data);
+    // The subscription is written with a store credential, so only validated
+    // values reach Master Data.
+    const email = data.email?.trim().toLowerCase() ?? '';
+    const name = data.name?.trim() ?? '';
+    if (email.length > EMAIL_MAX_LENGTH || !EMAIL_PATTERN.test(email)) {
+        throw new BadRequestError('Invalid email');
+    }
+    if (name.length > NAME_MAX_LENGTH) {
+        throw new BadRequestError(`Invalid name: must have at most ${NAME_MAX_LENGTH} characters`);
+    }
+    const response = await commerce.subscribeToNewsletter({
+        email,
+        name: name || undefined,
+    });
     return { id: response?.Id };
 };
 //# sourceMappingURL=subscribeToNewsletter.js.map

package/dist/esm/src/platforms/vtex/resolvers/subscribeToNewsletter.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscribeToNewsletter.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/resolvers/subscribeToNewsletter.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,CAAM,EACN,EAAE,IAAI,EAAqC,EAC3C,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAW,EACA,EAAE;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;IAC3D,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC,CAAA"}
+{"version":3,"file":"subscribeToNewsletter.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/resolvers/subscribeToNewsletter.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAA;AAC3B,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,aAAa,GAAG,iCAAiC,CAAA;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,CAAM,EACN,EAAE,IAAI,EAAqC,EAC3C,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAW,EACA,EAAE;IACpC,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAEpC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAA;IAC5C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,mCAAmC,eAAe,aAAa,CAChE,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC;QACpD,KAAK;QACL,IAAI,EAAE,IAAI,IAAI,SAAS;KACxB,CAAC,CAAA;IAEF,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/api",
-  "version": "2.2.80",
+  "version": "2.2.81",
   "license": "MIT",
   "main": "dist/cjs/src/index.js",
   "typings": "dist/esm/src/index.d.ts",
@@ -76,5 +76,6 @@
   },
   "volta": {
     "extends": "../../package.json"
-  }
+  },
+  "gitHead": "95176e8e91454bbcc717225bab8ec132729da983"
 }

package/src/platforms/vtex/clients/commerce/index.ts

@@ -30,6 +30,19 @@ const BASE_INIT = {
   },
 }
 
+// Accounts already warned that they rely on public `NL` fields. The commerce
+// client is created per request, so the warning is kept once per account
+// instead of per instance, to avoid flooding the logs. The account comes from
+// the store's API options, not from the request, so the set holds at most one
+// entry per account the process is configured for (usually one). It's still
+// capped, so it can't grow without bound if that ever changes.
+const MAX_WARNED_NEWSLETTER_ACCOUNTS = 100
+const accountsWarnedAboutAnonymousNewsletter = new Set<string>()
+
+/** Test-only: forget which accounts were warned about the anonymous fallback. */
+export const resetAnonymousNewsletterWarnings = () =>
+  accountsWarnedAboutAnonymousNewsletter.clear()
+
 export const VtexCommerce = (
   { account, environment, incrementAddress }: Options,
   ctx: Context
@@ -345,15 +358,73 @@ export const VtexCommerce = (
         { storeCookies }
       )
     },
-    subscribeToNewsletter: (data: {
-      name: string
+    /**
+     * Creates a newsletter subscription in the `NL` Master Data entity.
+     *
+     * With `FS_NEWSLETTER_APP_KEY`/`FS_NEWSLETTER_APP_TOKEN` set, the document is
+     * created with a `POST` authenticated by that dedicated key, so `NL` fields
+     * can stay private. The request is create-only: the body is built here from
+     * the validated fields and never carries a document id, so the caller can't
+     * reach an existing record.
+     *
+     * Without the credentials, it falls back to the legacy anonymous `PATCH`,
+     * which only works while `NL` fields are public.
+     */
+    subscribeToNewsletter: ({
+      name,
+      email,
+    }: {
+      name?: string
       email: string
     }): Promise<MasterDataResponse> => {
+      const body = JSON.stringify({
+        ...(name ? { name } : {}),
+        email,
+        isNewsletterOptIn: true,
+      })
+      const appKey = process.env.FS_NEWSLETTER_APP_KEY
+      const appToken = process.env.FS_NEWSLETTER_APP_TOKEN
+
+      if (appKey && appToken) {
+        return fetchAPI(`${base}/api/dataentities/NL/documents`, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            accept: 'application/json',
+            'X-VTEX-API-AppKey': appKey,
+            'X-VTEX-API-AppToken': appToken,
+          },
+          body,
+        })
+      }
+
+      if (!accountsWarnedAboutAnonymousNewsletter.has(account)) {
+        if (
+          accountsWarnedAboutAnonymousNewsletter.size >=
+          MAX_WARNED_NEWSLETTER_ACCOUNTS
+        ) {
+          accountsWarnedAboutAnonymousNewsletter.clear()
+        }
+        accountsWarnedAboutAnonymousNewsletter.add(account)
+
+        // Name only the missing variables, so a partial setup is easy to spot.
+        const missing = [
+          !appKey && 'FS_NEWSLETTER_APP_KEY',
+          !appToken && 'FS_NEWSLETTER_APP_TOKEN',
+        ].filter(Boolean)
+
+        console.warn(
+          `[subscribeToNewsletter] ${missing.join(' and ')} ${
+            missing.length > 1 ? 'are' : 'is'
+          } not set. Falling back to an anonymous Master Data request, which requires public fields in the NL entity. Configure both credentials and make the NL fields private.`
+        )
+      }
+
       return fetchAPI(
         `${base}/api/dataentities/NL/documents/`,
         {
           ...BASE_INIT,
-          body: JSON.stringify({ ...data, isNewsletterOptIn: true }),
+          body,
           method: 'PATCH',
         },
         { storeCookies }

package/src/platforms/vtex/clients/fetch.ts

@@ -7,6 +7,41 @@ interface FetchAPIOptions {
   storeCookies?: (headers: Headers) => void
 }
 
+// Headers that may carry credentials: store API keys (`X-VTEX-API-AppKey`,
+// `X-VTEX-API-AppToken`), shopper cookies (`Cookie`, `Set-Cookie`,
+// `VtexIdclientAutCookie_*`), `Authorization`, and generic token, secret or
+// API key headers. They are replaced before a failed request and its response
+// are logged. Matched by substring so new credential headers are covered too.
+const SENSITIVE_HEADER = /authorization|cookie|token|secret|api-?key|appkey/i
+
+const REDACTED = '[redacted]'
+
+export const redactHeaders = (
+  headers?: HeadersInit
+): Record<string, string> | undefined => {
+  if (!headers) {
+    return undefined
+  }
+
+  const redacted: Record<string, string> = {}
+  const add = (name: string, value: string) => {
+    redacted[name] = SENSITIVE_HEADER.test(name) ? REDACTED : value
+  }
+
+  if (Array.isArray(headers)) {
+    headers.forEach(([name, value]) => add(name, value))
+  } else if (typeof (headers as Headers).forEach === 'function') {
+    // Matches both the global `Headers` and the polyfill returned by
+    // `isomorphic-unfetch` on Node, which isn't an instance of the global one.
+    const headerList = headers as Headers
+    headerList.forEach((value, name) => add(name, value))
+  } else {
+    Object.entries(headers).forEach(([name, value]) => add(name, value))
+  }
+
+  return redacted
+}
+
 export const fetchAPI = async (
   info: RequestInfo,
   init?: RequestInit,
@@ -28,7 +63,23 @@ export const fetchAPI = async (
     return response.status !== 204 ? response.json() : undefined
   }
 
-  console.error(info, init, response)
+  // Log a summary instead of the raw Response, whose headers may include
+  // `Set-Cookie` with shopper credentials. The request body is omitted because
+  // it can carry personal data (e.g. the newsletter email and name).
+  console.error(
+    // Only the URL: a `Request` instance could carry unredacted headers.
+    typeof info === 'string' ? info : info.url,
+    init && {
+      ...init,
+      headers: redactHeaders(init.headers),
+      body: init.body ? REDACTED : undefined,
+    },
+    {
+      status: response.status,
+      statusText: response.statusText,
+      headers: redactHeaders(response.headers),
+    }
+  )
   const text = await response.text()
 
   throw new Error(text)

package/src/platforms/vtex/resolvers/subscribeToNewsletter.ts

@@ -3,12 +3,38 @@ import type {
   MutationSubscribeToNewsletterArgs,
   PersonNewsletter,
 } from '../../../__generated__/schema'
+import { BadRequestError } from '../../errors'
+
+const EMAIL_MAX_LENGTH = 254
+const NAME_MAX_LENGTH = 100
+// Character classes exclude `.`, so each domain label is matched once and the
+// pattern stays linear on long inputs.
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/
 
 export const subscribeToNewsletter = async (
   _: any,
   { data }: MutationSubscribeToNewsletterArgs,
   { clients: { commerce } }: Context
 ): Promise<PersonNewsletter | null> => {
-  const response = await commerce.subscribeToNewsletter(data)
+  // The subscription is written with a store credential, so only validated
+  // values reach Master Data.
+  const email = data.email?.trim().toLowerCase() ?? ''
+  const name = data.name?.trim() ?? ''
+
+  if (email.length > EMAIL_MAX_LENGTH || !EMAIL_PATTERN.test(email)) {
+    throw new BadRequestError('Invalid email')
+  }
+
+  if (name.length > NAME_MAX_LENGTH) {
+    throw new BadRequestError(
+      `Invalid name: must have at most ${NAME_MAX_LENGTH} characters`
+    )
+  }
+
+  const response = await commerce.subscribeToNewsletter({
+    email,
+    name: name || undefined,
+  })
+
   return { id: response?.Id }
 }

package/dist/cjs/src/platforms/vtex/utils/taxes.d.ts

@@ -1 +0,0 @@
-export declare const withTax: (price: number, tax?: number, unitMultiplier?: number) => number;

package/dist/cjs/src/platforms/vtex/utils/taxes.js

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.withTax = void 0;
-const withTax = (price, tax = 0, unitMultiplier = 1) => {
-    const unitTax = tax / unitMultiplier;
-    return Math.round((price + unitTax) * 100) / 100;
-};
-exports.withTax = withTax;
-//# sourceMappingURL=taxes.js.map

package/dist/cjs/src/platforms/vtex/utils/taxes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"taxes.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/utils/taxes.ts"],"names":[],"mappings":";;;AAAO,MAAM,OAAO,GAAG,CACrB,KAAa,EACb,MAAc,CAAC,EACf,iBAAyB,CAAC,EAC1B,EAAE;IACF,MAAM,OAAO,GAAG,GAAG,GAAG,cAAc,CAAA;IAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAA;AAClD,CAAC,CAAA;AARY,QAAA,OAAO,WAQnB"}

package/dist/esm/src/platforms/vtex/utils/taxes.d.ts

@@ -1 +0,0 @@
-export declare const withTax: (price: number, tax?: number, unitMultiplier?: number) => number;

package/dist/esm/src/platforms/vtex/utils/taxes.js

@@ -1,5 +0,0 @@
-export const withTax = (price, tax = 0, unitMultiplier = 1) => {
-    const unitTax = tax / unitMultiplier;
-    return Math.round((price + unitTax) * 100) / 100;
-};
-//# sourceMappingURL=taxes.js.map

package/dist/esm/src/platforms/vtex/utils/taxes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"taxes.js","sourceRoot":"","sources":["../../../../../../src/platforms/vtex/utils/taxes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,KAAa,EACb,MAAc,CAAC,EACf,iBAAyB,CAAC,EAC1B,EAAE;IACF,MAAM,OAAO,GAAG,GAAG,GAAG,cAAc,CAAA;IAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAA;AAClD,CAAC,CAAA"}