@faststore/core 3.99.4 → 3.100.0

package/src/sdk/session/index.ts

@@ -8,6 +8,7 @@ import type {
   ValidateSessionMutationVariables,
 } from '@generated/graphql'
 import deepEqual from 'fast-deep-equal'
+import { isLocalHostBrowser } from 'src/utils/isLocalHost'
 import storeConfig from '../../../discovery.config'
 import {
   isRefreshTokenSuccessful,
@@ -19,11 +20,6 @@ import { createValidationStore, useStore } from '../useStore'
 import { getPostalCode } from '../userLocation/index'
 import { RELOAD_AFTER_LOGOUT_KEY, SESSION_READY_KEY } from './storageKeys'
 
-const isLocalEnvironment = (): boolean =>
-  typeof window !== 'undefined' &&
-  (window.location.hostname === 'localhost' ||
-    window.location.hostname === '127.0.0.1')
-
 const isReloadAfterLogoutPending = (): boolean => {
   try {
     return (
@@ -127,7 +123,7 @@ export const validateSession = async (session: Session) => {
   // On failure (logoutAndClearSession already triggered), bail out.
   // Skipped in local environments where the refresh token infrastructure is unavailable.
   if (
-    !isLocalEnvironment() &&
+    !isLocalHostBrowser() &&
     storeConfig.experimental?.refreshToken &&
     isRefreshAfterExpired(session)
   ) {
@@ -180,7 +176,7 @@ export const validateSession = async (session: Session) => {
     return data.validateSession
   } catch (error) {
     const shouldRefreshToken =
-      !isLocalEnvironment() &&
+      !isLocalHostBrowser() &&
       error?.status === 401 &&
       storeConfig.experimental?.refreshToken
 

package/src/server/authentication-service.ts

@@ -0,0 +1,270 @@
+import { NextResponse } from 'next/server'
+import type { NextRequest } from 'next/server'
+import { jwtVerify, decodeJwt, importSPKI, errors } from 'jose'
+import type { CryptoKey } from 'jose'
+
+import storeConfig from '../../discovery.config'
+
+import {
+  publicKeyUrl,
+  renewUrl,
+  protectionStatusUrl,
+  passwordProtectionTimeouts,
+} from './password-protection/webops-api'
+
+export const COOKIE_NAME = '__fs_auth_token'
+export const TOKEN_TTL_SECONDS = 10 * 60
+/** How long to reuse the RSA public key fetched from WebOps */
+const PUBLIC_KEY_CACHE_MS = 60 * 60 * 1000
+
+interface TokenPayload {
+  storeId: string
+  protected: boolean
+  passwordVersion?: string
+  scope?: string
+  exp?: number
+}
+
+interface AuthResult {
+  response: NextResponse
+}
+
+let publicKeyCache: {
+  pem: string
+  key: CryptoKey
+  fetchedAt: number
+} | null = null
+
+async function fetchPublicKeyPemFromWebOps(): Promise<string> {
+  const res = await fetch(publicKeyUrl(), {
+    signal: AbortSignal.timeout(passwordProtectionTimeouts.publicKeyMs),
+  })
+
+  if (!res.ok) {
+    throw new Error(`WebOps public-key returned ${res.status}`)
+  }
+
+  const body = (await res.json()) as { publicKey?: string }
+  const pem = body.publicKey?.trim()
+
+  if (!pem) {
+    throw new Error('WebOps public-key response missing publicKey')
+  }
+
+  return pem
+}
+
+async function getPublicVerificationKey(): Promise<CryptoKey> {
+  const now = Date.now()
+
+  if (publicKeyCache && now - publicKeyCache.fetchedAt < PUBLIC_KEY_CACHE_MS) {
+    return publicKeyCache.key
+  }
+
+  const pem = await fetchPublicKeyPemFromWebOps()
+  const key = await importSPKI(pem, 'RS256')
+  publicKeyCache = { pem, key, fetchedAt: now }
+
+  return key
+}
+
+/** Clears the cached WebOps public key (for unit tests only). */
+export function resetPasswordProtectionPublicKeyCacheForTests(): void {
+  publicKeyCache = null
+}
+
+export class AuthenticationService {
+  private readonly storeId: string
+
+  constructor() {
+    this.storeId = storeConfig.api.storeId
+  }
+
+  private getNormalizedHost(request: NextRequest): string {
+    const host = request.headers.get('host') || ''
+    return host.split(':')[0].toLowerCase()
+  }
+
+  async authenticateRequest(request: NextRequest): Promise<AuthResult> {
+    if (!this.shouldCheckProtection(request)) {
+      return { response: NextResponse.next() }
+    }
+
+    const token = request.cookies.get(COOKIE_NAME)?.value
+
+    if (token) {
+      const verification = await this.verifyToken(token)
+
+      if (verification.valid && verification.payload) {
+        return { response: NextResponse.next() }
+      }
+
+      if (verification.expired && verification.payload) {
+        return await this.tryRenewSession(request, token, verification.payload)
+      }
+    }
+
+    return await this.handleNoAuth(request)
+  }
+
+  private shouldCheckProtection(request: NextRequest): boolean {
+    if (process.env.NODE_ENV === 'development') {
+      return false
+    }
+
+    const hostname = this.getNormalizedHost(request)
+    const isDefaultDomain = hostname.endsWith('.vtex.app')
+
+    if (isDefaultDomain) {
+      return true
+    }
+
+    return process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED === 'true'
+  }
+
+  private shouldProtectDomain(request: NextRequest, scope?: string): boolean {
+    const hostname = this.getNormalizedHost(request)
+    const isDefaultDomain = hostname.endsWith('.vtex.app')
+
+    return (
+      scope === 'ALL_DOMAINS' ||
+      (scope === 'DEFAULT_DOMAINS' && isDefaultDomain) ||
+      (scope === 'CUSTOM_DOMAINS' && !isDefaultDomain)
+    )
+  }
+
+  private payloadMatchesStore(payload: TokenPayload): boolean {
+    return payload.storeId === this.storeId
+  }
+
+  private isJwtExpiredError(error: unknown): boolean {
+    return (
+      error instanceof errors.JWTExpired ||
+      (error instanceof Error && error.name === 'JWTExpired')
+    )
+  }
+
+  private async verifyToken(token: string): Promise<{
+    valid: boolean
+    expired: boolean
+    payload?: TokenPayload
+  }> {
+    try {
+      const key = await getPublicVerificationKey()
+      const { payload } = await jwtVerify(token, key)
+      const p = payload as unknown as TokenPayload
+
+      if (!this.payloadMatchesStore(p)) {
+        return { valid: false, expired: false }
+      }
+
+      return {
+        valid: true,
+        expired: false,
+        payload: p,
+      }
+    } catch (error) {
+      if (this.isJwtExpiredError(error)) {
+        const payload = decodeJwt(token) as unknown as TokenPayload
+
+        if (!this.payloadMatchesStore(payload)) {
+          return { valid: false, expired: false }
+        }
+
+        return { valid: false, expired: true, payload }
+      }
+
+      return { valid: false, expired: false }
+    }
+  }
+
+  private async tryRenewSession(
+    request: NextRequest,
+    expiredToken: string,
+    payload: TokenPayload
+  ): Promise<AuthResult> {
+    try {
+      const res = await fetch(renewUrl(), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          storeId: this.storeId,
+          expiredToken,
+        }),
+        signal: AbortSignal.timeout(passwordProtectionTimeouts.defaultMs),
+      })
+
+      if (res.ok) {
+        const data = await res.json()
+
+        if (data.valid && data.token) {
+          const response = NextResponse.next()
+          this.setAuthCookie(response, data.token)
+
+          return { response }
+        }
+      }
+    } catch {
+      // Fall through to redirect or fail-open below
+    }
+
+    if (!this.shouldProtectDomain(request, payload.scope)) {
+      return { response: NextResponse.next() }
+    }
+
+    return { response: this.redirectToLogin(request) }
+  }
+
+  private async handleNoAuth(request: NextRequest): Promise<AuthResult> {
+    try {
+      const res = await fetch(protectionStatusUrl(), {
+        signal: AbortSignal.timeout(passwordProtectionTimeouts.defaultMs),
+      })
+
+      if (!res.ok) {
+        return { response: this.redirectToLogin(request) }
+      }
+
+      const status = await res.json()
+
+      if (!status.protected) {
+        const response = NextResponse.next()
+
+        if (status.token) {
+          this.setAuthCookie(response, status.token)
+        }
+
+        return { response }
+      }
+
+      if (!this.shouldProtectDomain(request, status.scope)) {
+        return { response: NextResponse.next() }
+      }
+
+      return { response: this.redirectToLogin(request) }
+    } catch {
+      return { response: this.redirectToLogin(request) }
+    }
+  }
+
+  private setAuthCookie(response: NextResponse, token: string): void {
+    response.cookies.set(COOKIE_NAME, token, {
+      httpOnly: true,
+      secure: true,
+      sameSite: 'lax',
+      path: '/',
+      maxAge: TOKEN_TTL_SECONDS,
+    })
+  }
+
+  private redirectToLogin(request: NextRequest): NextResponse {
+    const loginUrl = new URL('/fs-auth-login', request.url)
+    const returnTo = `${request.nextUrl.pathname}${request.nextUrl.search}`
+    loginUrl.searchParams.set('returnTo', returnTo)
+
+    const response = NextResponse.redirect(loginUrl)
+    response.headers.set('Cache-Control', 'no-store')
+
+    return response
+  }
+}

package/src/server/password-protection/webops-api.ts

@@ -0,0 +1,38 @@
+import discoveryConfig from '../../../discovery.config'
+
+const DEFAULT_WEBOPS_ORIGIN = 'https://faststore.vtex.com'
+
+function getWebopsOrigin(): string {
+  const hostFromEnv = process.env.WEBOPS_API_URL?.trim() ?? ''
+  const hostWithoutTrailingSlash = hostFromEnv.replace(/\/+$/, '')
+  const origin =
+    hostWithoutTrailingSlash.length > 0
+      ? hostWithoutTrailingSlash
+      : DEFAULT_WEBOPS_ORIGIN
+
+  return /^https?:\/\//i.test(origin) ? origin : `https://${origin}`
+}
+
+export function publicKeyUrl(): URL {
+  return new URL('/api/v1/password-protection/public-key', getWebopsOrigin())
+}
+
+export function protectionStatusUrl(): URL {
+  const url = new URL('/api/v1/password-protection/status', getWebopsOrigin())
+  url.searchParams.set('storeId', discoveryConfig.api.storeId)
+  return url
+}
+
+export function sessionUrl(): URL {
+  return new URL('/api/v1/password-protection/session', getWebopsOrigin())
+}
+
+export function renewUrl(): URL {
+  return new URL('/api/v1/password-protection/renew', getWebopsOrigin())
+}
+
+/** Timeouts for WebOps password-protection calls (middleware / API routes). */
+export const passwordProtectionTimeouts = {
+  publicKeyMs: 5_000,
+  defaultMs: 10_000,
+} as const

package/src/utils/isLocalHost.ts

@@ -0,0 +1,33 @@
+/**
+ * Hostnames that represent a local development environment.
+ *
+ * These are the only hosts where the FastStore app skips the refresh-token
+ * flow so developers can drive the app with a manually injected
+ * `VtexIdclientAutCookie_<account>` cookie regardless of feature flags.
+ */
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1'])
+
+/**
+ * Returns `true` when the given hostname corresponds to a local development
+ * environment (`localhost` / `127.0.0.1`).
+ *
+ * Refresh-token and other production-only flows MUST be bypassed on these
+ * hostnames so that developers can test logged-in scenarios with manually
+ * injected cookies, independent of any experimental flag.
+ *
+ * The input MUST be a bare hostname (no port). Callers should strip the port
+ * (e.g. `host.split(':')[0]`) before invoking this helper.
+ */
+export function isLocalHost(hostname: string | null | undefined): boolean {
+  if (!hostname) return false
+  return LOCAL_HOSTNAMES.has(hostname.toLowerCase())
+}
+
+/**
+ * Browser-side wrapper that reads `window.location.hostname`. Returns `false`
+ * when `window` is not available (SSR/Node).
+ */
+export function isLocalHostBrowser(): boolean {
+  if (typeof window === 'undefined') return false
+  return isLocalHost(window.location.hostname)
+}

package/src/utils/loginResponse.ts

@@ -0,0 +1,20 @@
+export interface LoginResponse {
+  success?: boolean
+  redirectUrl?: string
+  error?: string
+}
+
+export const isLoginResponse = (data: unknown): data is LoginResponse => {
+  if (typeof data !== 'object' || data === null || Array.isArray(data)) {
+    return false
+  }
+
+  const payload = data as Record<string, unknown>
+
+  return (
+    (payload.success === undefined || typeof payload.success === 'boolean') &&
+    (payload.redirectUrl === undefined ||
+      typeof payload.redirectUrl === 'string') &&
+    (payload.error === undefined || typeof payload.error === 'string')
+  )
+}