@faststore/core 3.100.2 → 3.100.3

package/test/server/{authentication-service.test.ts → password-protection-service.test.ts}

@@ -2,9 +2,9 @@ import { decodeJwt, errors, importSPKI, jwtVerify } from 'jose'
 import { NextRequest } from 'next/server'
 
 import {
-  AuthenticationService,
+  PasswordProtectionService,
   resetPasswordProtectionPublicKeyCacheForTests,
-} from '../../src/server/authentication-service'
+} from '../../src/server/password-protection-service'
 
 function setNodeEnv(value: string | undefined): void {
   const env = process.env as Record<string, string | undefined>
@@ -62,7 +62,7 @@ function previewRequest(
   })
 }
 
-describe('AuthenticationService', () => {
+describe('PasswordProtectionService', () => {
   const originalNodeEnv = process.env.NODE_ENV
   const originalCustomDomains = process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED
 
@@ -83,8 +83,10 @@ describe('AuthenticationService', () => {
   it('skips protection in development', async () => {
     setNodeEnv('development')
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(previewRequest('/p'))
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
+      previewRequest('/p')
+    )
 
     expect(response.status).toBe(200)
     expect(global.fetch).not.toHaveBeenCalled()
@@ -99,13 +101,13 @@ describe('AuthenticationService', () => {
       }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/products')
     )
 
     expect(response.status).toBe(200)
-    expect(response.cookies.get('__fs_auth_token')?.value).toBe(
+    expect(response.cookies.get('__fs_password_protection')?.value).toBe(
       'neg-cache-token'
     )
     expect(global.fetch).toHaveBeenCalledWith(
@@ -118,7 +120,7 @@ describe('AuthenticationService', () => {
     )
   })
 
-  it('redirects to login when protected and host matches DEFAULT_DOMAINS scope', async () => {
+  it('redirects to unlock page when protected and host matches DEFAULT_DOMAINS scope', async () => {
     ;(global.fetch as jest.Mock).mockResolvedValue({
       ok: true,
       json: async () => ({
@@ -128,14 +130,14 @@ describe('AuthenticationService', () => {
       }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/secret')
     )
 
     expect(response.status).toBe(307)
     const location = response.headers.get('location') ?? ''
-    expect(location).toContain('/fs-auth-login')
+    expect(location).toContain('/password-protection')
     expect(location).toContain('returnTo=%2Fsecret')
   })
 
@@ -148,13 +150,15 @@ describe('AuthenticationService', () => {
       }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(previewRequest('/p'))
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
+      previewRequest('/p')
+    )
 
     expect(response.status).toBe(200)
   })
 
-  it('redirects to login when protected for ALL_DOMAINS on custom host', async () => {
+  it('redirects to unlock page when protected for ALL_DOMAINS on custom host', async () => {
     process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED = 'true'
     ;(global.fetch as jest.Mock).mockResolvedValue({
       ok: true,
@@ -164,8 +168,8 @@ describe('AuthenticationService', () => {
       }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       new NextRequest('https://shop.example.com/checkout', {
         headers: { host: 'shop.example.com' },
       })
@@ -190,10 +194,10 @@ describe('AuthenticationService', () => {
       protectedHeader: { alg: 'RS256' },
     } as unknown as Awaited<ReturnType<typeof jwtVerify>>)
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/account', {
-        headers: { cookie: '__fs_auth_token=valid' },
+        headers: { cookie: '__fs_password_protection=valid' },
       })
     )
 
@@ -220,12 +224,12 @@ describe('AuthenticationService', () => {
       protectedHeader: { alg: 'RS256' },
     } as unknown as Awaited<ReturnType<typeof jwtVerify>>)
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/p', {
         headers: {
           host: 'preview.vtex.app',
-          cookie: '__fs_auth_token=abc',
+          cookie: '__fs_password_protection=abc',
         },
       })
     )
@@ -254,11 +258,11 @@ describe('AuthenticationService', () => {
       }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/x', {
         headers: {
-          cookie: '__fs_auth_token=bad',
+          cookie: '__fs_password_protection=bad',
         },
       })
     )
@@ -280,15 +284,17 @@ describe('AuthenticationService', () => {
       }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/p', {
-        headers: { cookie: '__fs_auth_token=garbage' },
+        headers: { cookie: '__fs_password_protection=garbage' },
       })
     )
 
     expect(response.status).toBe(200)
-    expect(response.cookies.get('__fs_auth_token')?.value).toBe('after-bad-jwt')
+    expect(response.cookies.get('__fs_password_protection')?.value).toBe(
+      'after-bad-jwt'
+    )
     expect(jwtVerifyMock).toHaveBeenCalled()
     expect(global.fetch).toHaveBeenCalledTimes(2)
   })
@@ -316,18 +322,20 @@ describe('AuthenticationService', () => {
       }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/p', {
-        headers: { cookie: '__fs_auth_token=old' },
+        headers: { cookie: '__fs_password_protection=old' },
       })
     )
 
     expect(response.status).toBe(200)
-    expect(response.cookies.get('__fs_auth_token')?.value).toBe('renewed-token')
+    expect(response.cookies.get('__fs_password_protection')?.value).toBe(
+      'renewed-token'
+    )
   })
 
-  it('redirects to login when JWT is expired and renew response is not ok', async () => {
+  it('redirects to unlock page when JWT is expired and renew response is not ok', async () => {
     ;(global.fetch as jest.Mock).mockResolvedValueOnce({
       ok: true,
       json: async () => ({ publicKey: 'test-pem' }),
@@ -345,17 +353,17 @@ describe('AuthenticationService', () => {
       status: 502,
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/p', {
-        headers: { cookie: '__fs_auth_token=expired' },
+        headers: { cookie: '__fs_password_protection=expired' },
       })
     )
 
     expect(response.status).toBe(307)
   })
 
-  it('redirects to login when JWT is expired and renew body is not valid', async () => {
+  it('redirects to unlock page when JWT is expired and renew body is not valid', async () => {
     ;(global.fetch as jest.Mock).mockResolvedValueOnce({
       ok: true,
       json: async () => ({ publicKey: 'test-pem' }),
@@ -373,10 +381,10 @@ describe('AuthenticationService', () => {
       json: async () => ({ valid: false }),
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/p', {
-        headers: { cookie: '__fs_auth_token=expired' },
+        headers: { cookie: '__fs_password_protection=expired' },
       })
     )
 
@@ -398,61 +406,65 @@ describe('AuthenticationService', () => {
     } as ReturnType<typeof decodeJwt>)
     ;(global.fetch as jest.Mock).mockRejectedValueOnce(new Error('renew down'))
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
       previewRequest('/p', {
-        headers: { cookie: '__fs_auth_token=old' },
+        headers: { cookie: '__fs_password_protection=old' },
       })
     )
 
     expect(response.status).toBe(200)
   })
 
-  it('fail-closes to login on default domain when status request fails', async () => {
+  it('fail-closes to unlock page on default domain when status request fails', async () => {
     ;(global.fetch as jest.Mock).mockRejectedValue(new Error('network'))
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(previewRequest('/p'))
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
+      previewRequest('/p')
+    )
 
     expect(response.status).toBe(307)
-    expect(response.headers.get('location')).toContain('/fs-auth-login')
+    expect(response.headers.get('location')).toContain('/password-protection')
   })
 
-  it('fail-closes to login when status endpoint returns a non-ok HTTP status', async () => {
+  it('fail-closes to unlock page when status endpoint returns a non-ok HTTP status', async () => {
     ;(global.fetch as jest.Mock).mockResolvedValue({
       ok: false,
       status: 503,
     })
 
-    const service = new AuthenticationService()
-    const { response } = await service.authenticateRequest(previewRequest('/p'))
+    const service = new PasswordProtectionService()
+    const { response } = await service.checkStoreProtection(
+      previewRequest('/p')
+    )
 
     expect(response.status).toBe(307)
-    expect(response.headers.get('location')).toContain('/fs-auth-login')
+    expect(response.headers.get('location')).toContain('/password-protection')
   })
 
-  it('fail-closes to login on custom domain when status request fails', async () => {
+  it('fail-closes to unlock page on custom domain when status request fails', async () => {
     process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED = 'true'
     ;(global.fetch as jest.Mock).mockRejectedValue(new Error('network'))
 
-    const service = new AuthenticationService()
+    const service = new PasswordProtectionService()
     const request = new NextRequest('https://shop.example.com/page', {
       headers: { host: 'shop.example.com' },
     })
 
-    const { response } = await service.authenticateRequest(request)
+    const { response } = await service.checkStoreProtection(request)
 
     expect(response.status).toBe(307)
-    expect(response.headers.get('location')).toContain('/fs-auth-login')
+    expect(response.headers.get('location')).toContain('/password-protection')
   })
 
   it('does not enforce protection on custom domain when env gate is off', async () => {
-    const service = new AuthenticationService()
+    const service = new PasswordProtectionService()
     const request = new NextRequest('https://shop.example.com/page', {
       headers: { host: 'shop.example.com' },
     })
 
-    const { response } = await service.authenticateRequest(request)
+    const { response } = await service.checkStoreProtection(request)
 
     expect(response.status).toBe(200)
     expect(global.fetch).not.toHaveBeenCalled()

package/.next/server/pages/api/fs/auth/login.js

@@ -1 +0,0 @@
-"use strict";(()=>{var e={};e.id=1453,e.ids=[1453],e.modules={56330:e=>{e.exports=require("deepmerge")},20145:e=>{e.exports=require("next/dist/compiled/next-server/pages-api.runtime.prod.js")},92824:e=>{e.exports=require("next/server")},99369:e=>{e.exports=import("jose")},87179:(e,t,s)=>{s.a(e,async(e,r)=>{try{s.r(t),s.d(t,{default:()=>l});var a=s(40870),n=s.n(a),o=s(91930),i=s(99391),u=e([i]);i=(u.then?(await u)():u)[0];let isSafeReturnToPath=e=>e.startsWith("/")&&!e.startsWith("//"),isWebOpsSessionPayload=e=>!("object"!=typeof e||null===e||Array.isArray(e))&&"boolean"==typeof e.valid&&(void 0===e.token||"string"==typeof e.token),handler=async(e,t)=>{if("POST"!==e.method){t.status(405).end();return}let s=n().api.storeId;try{let{password:r}=e.body??{};if(!r||"string"!=typeof r){t.status(400).json({success:!1,error:"Password is required"});return}let a=await fetch((0,o.BW)(),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({storeId:s,password:r}),signal:AbortSignal.timeout(o.nn.defaultMs)});if(!a.ok){if(401===a.status||403===a.status){t.status(401).json({success:!1,error:"Invalid password"});return}t.status(503).json({success:!1,error:"Service temporarily unavailable"});return}let n=await a.json();if(!isWebOpsSessionPayload(n)){t.status(500).json({success:!1,error:"Internal server error"});return}if(n.valid&&n.token){let s="string"==typeof e.query.returnTo?e.query.returnTo:"/",r=isSafeReturnToPath(s)?s:"/";t.setHeader("Set-Cookie",[`${i.B$}=${n.token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${i.Ax}`]),t.status(200).json({success:!0,redirectUrl:r})}else t.status(401).json({success:!1,error:"Invalid password"})}catch{t.status(503).json({success:!1,error:"Service temporarily unavailable"})}},l=handler;r()}catch(e){r(e)}})},99391:(e,t,s)=>{s.a(e,async(e,r)=>{try{s.d(t,{Ax:()=>i,B$:()=>o}),s(92824);var a=s(99369),n=e([a]);a=(n.then?(await n)():n)[0];let o="__fs_auth_token",i=600;r()}catch(e){r(e)}})},91930:(e,t,s)=>{function sessionUrl(){return new URL("/api/v1/password-protection/session",function(){let e=process.env.WEBOPS_API_URL?.trim()??"",t=e.replace(/\/+$/,""),s=t.length>0?t:"https://faststore.vtex.com";return/^https?:\/\//i.test(s)?s:`https://${s}`}())}s.d(t,{BW:()=>sessionUrl,nn:()=>r});let r={publicKeyMs:5e3,defaultMs:1e4}},36117:(e,t,s)=>{s.a(e,async(e,r)=>{try{s.r(t),s.d(t,{config:()=>c,default:()=>l,routeModule:()=>d});var a=s(59820),n=s(44708),o=s(64312),i=s(87179),u=e([i]);i=(u.then?(await u)():u)[0];let l=(0,o.l)(i,"default"),c=(0,o.l)(i,"config"),d=new a.PagesAPIRouteModule({definition:{kind:n.x.PAGES_API,page:"/api/fs/auth/login",pathname:"/api/fs/auth/login",bundlePath:"",filename:""},userland:i});r()}catch(e){r(e)}})}};var t=require("../../../../webpack-api-runtime.js");t.C(e);var __webpack_exec__=e=>t(t.s=e),s=t.X(0,[2249,870],()=>__webpack_exec__(36117));module.exports=s})();