@faststore/core 3.99.6 → 3.100.0

package/.turbo/turbo-build.log

@@ -1,23 +1,23 @@
 
-> @faststore/core@3.99.4 prebuild /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 prebuild /home/runner/work/faststore/faststore/packages/core
 > na run partytown && na run generate
 
 
-> @faststore/core@3.99.4 partytown /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 partytown /home/runner/work/faststore/faststore/packages/core
 > partytown copylib ./public/~partytown
 
 Partytown lib copied to: /home/runner/work/faststore/faststore/packages/core/public/~partytown
 
-> @faststore/core@3.99.4 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 generate /home/runner/work/faststore/faststore/packages/core
 > na run generate:schema && na run generate:codegen && na run format:generated
 
 
-> @faststore/core@3.99.4 generate:schema /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 generate:schema /home/runner/work/faststore/faststore/packages/core
 > tsx src/server/generator/generateGraphQLSchemaFile.ts
 
 Schema GraphQL file generated successfully
 
-> @faststore/core@3.99.4 generate:codegen /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 generate:codegen /home/runner/work/faststore/faststore/packages/core
 > graphql-codegen
 
 [STARTED] Parse Configuration
@@ -37,11 +37,11 @@ Running lifecycle hook "afterStart" scripts...
 [CLI] Loading Documents
 [CLI] Generating output
 
-> @faststore/core@3.99.4 format:generated /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 format:generated /home/runner/work/faststore/faststore/packages/core
 > prettier --write "@generated/**/*.{ts,js,tsx,jsx,json}" --loglevel error
 
 
-> @faststore/core@3.99.4 build /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 build /home/runner/work/faststore/faststore/packages/core
 > next build
 
 ⚠ No build cache found. Please configure build caching for faster rebuilds. Read more: https://nextjs.org/docs/messages/no-cache
@@ -58,7 +58,7 @@ Browserslist: caniuse-lite is outdated. Please run:
    Creating an optimized production build ...
    Disabled SWC as replacement for Babel because of custom Babel configuration ".babelrc.js" https://nextjs.org/docs/messages/swc-disabled
    Using external babel configuration from /home/runner/work/faststore/faststore/packages/core/.babelrc.js
-Browserslist: browsers data (caniuse-lite) is 16 months old. Please run:
+Browserslist: browsers data (caniuse-lite) is 17 months old. Please run:
   npx update-browserslist-db@latest
   Why you should do it regularly: https://github.com/browserslist/update-db#readme
 <w> [webpack.cache.PackFileCacheStrategy] Skipped not serializable cache item 'Compilation/modules|/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/css-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[1]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/postcss-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[2]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/resolve-url-loader/index.js??ruleSet[1].rules[7].oneOf[9].use[3]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/compiled/sass-loader/cjs.js??ruleSet[1].rules[7].oneOf[9].use[4]!/home/runner/work/faststore/faststore/packages/core/src/components/common/Toast/section.module.scss': No serializer registered for Warning
@@ -77,19 +77,39 @@ Import trace for requested module:
 ./src/components/common/Toast/index.ts
 ./src/components/cms/RenderSections.tsx
 
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
+A Node.js API is used (CompressionStream at line: 10) which is not supported in the Edge Runtime.
+Learn more: https://nextjs.org/docs/api-reference/edge-runtime
+
+Import trace for requested module:
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
+./src/server/authentication-service.ts
+
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
+A Node.js API is used (DecompressionStream at line: 25) which is not supported in the Edge Runtime.
+Learn more: https://nextjs.org/docs/api-reference/edge-runtime
+
+Import trace for requested module:
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
+./src/server/authentication-service.ts
+
    Collecting page data ...
-   Generating static pages (0/6) ...
+   Generating static pages (0/8) ...
+
   Generating static pages (2/8) 
 Search not found. Add a new component for this section or remove it from the CMS
+Warning: Dynamic Content not found for the page: home. Refer to the Dynamic Content documentation at https://developers.vtex.com/docs/guides/faststore/dynamic-content-overview for mapping the page and the corresponding data-fetching function.
 Search not found. Add a new component for this section or remove it from the CMS
+
   Generating static pages (4/8) 
 Search not found. Add a new component for this section or remove it from the CMS
-
   Generating static pages (1/6) 
-
   Generating static pages (2/6) 
-Warning: Dynamic Content not found for the page: home. Refer to the Dynamic Content documentation at https://developers.vtex.com/docs/guides/faststore/dynamic-content-overview for mapping the page and the corresponding data-fetching function.
 Search not found. Add a new component for this section or remove it from the CMS
+
   Generating static pages (6/8) 
 Search not found. Add a new component for this section or remove it from the CMS
-
   Generating static pages (4/6) 
 Search not found. Add a new component for this section or remove it from the CMS
-
 ✓ Generating static pages (6/6) 
+
 ✓ Generating static pages (8/8) 
    Finalizing page optimization ...
    Collecting build traces ...
 
@@ -101,14 +121,17 @@ Route (pages)                              Size     First Load JS
 ├ ● /[slug]/p                              97.3 kB         255 kB
 ├   ├ css/1c4983f11b861ea0.css             6.34 kB
 ├   └ css/54cedf4b65e5863f.css             16.7 kB
-├ ○ /404                                   1.58 kB         159 kB
-├ ● /500                                   1.58 kB         159 kB
+├ ○ /404                                   1.58 kB         160 kB
+├ ● /500                                   1.58 kB         160 kB
+├ λ /api/fs/auth/login                     0 B             109 kB
 ├ λ /api/fs/logout                         0 B             109 kB
 ├ λ /api/graphql                           0 B             109 kB
 ├ λ /api/health/live                       0 B             109 kB
 ├ λ /api/health/ready                      0 B             109 kB
 ├ λ /api/preview                           0 B             109 kB
 ├ ● /checkout                              750 B           159 kB
+├ ○ /fs-auth-login                         2.17 kB         111 kB
+├   └ css/3bd4edd425711792.css             3.2 kB
 ├ ● /login                                 1.7 kB          160 kB
 ├ λ /pvt/account                           247 B           109 kB
 ├ ● /pvt/account/[...unknown]              287 B           109 kB
@@ -118,7 +141,7 @@ Route (pages)                              Size     First Load JS
 ├   └ css/ea11d74a2848b093.css             4.89 kB
 ├ λ /pvt/account/orders                    9.89 kB         168 kB
 ├   └ css/14176a4704ff97b2.css             14.4 kB
-├ λ /pvt/account/orders/[id]               13.6 kB         171 kB
+├ λ /pvt/account/orders/[id]               13.6 kB         172 kB
 ├   └ css/82f3cd529b672812.css             14 kB
 ├ λ /pvt/account/profile                   1.99 kB         160 kB
 ├   └ css/a852afa9be31e946.css             4.58 kB
@@ -129,11 +152,13 @@ Route (pages)                              Size     First Load JS
 └ ● /s                                     3.35 kB         176 kB
 + First Load JS shared by all              118 kB
   ├ chunks/framework-d514426edf885c68.js   45.4 kB
-  ├ chunks/main-ec03882c4375091d.js        33.2 kB
+  ├ chunks/main-083a618181bb5fbb.js        33.4 kB
   ├ chunks/pages/_app-35e8dda638ee2672.js  26.6 kB
-  ├ chunks/webpack-65b1de5f075b8367.js     3.89 kB
+  ├ chunks/webpack-ff85816fb58111fa.js     3.9 kB
   └ css/146a8678babc61bf.css               9.2 kB
 
+ƒ Middleware                               44.8 kB
+
 λ  (Server)  server-side renders at runtime (uses getInitialProps or getServerSideProps)
 ○  (Static)  automatically rendered as static HTML (uses no initial props)
 ●  (SSG)     automatically generated as static HTML + JSON (uses getStaticProps)

package/.turbo/turbo-test.log

@@ -1,19 +1,20 @@
 
-> @faststore/core@3.99.4 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.99.6 test /home/runner/work/faststore/faststore/packages/core
 > jest
 
-PASS test/utils/multipleTemplates.test.ts (11.618 s)
-PASS test/utils/clearCookies.test.ts (12.194 s)
-PASS test/utils/cookieCacheBusting.test.ts (13.633 s)
-PASS test/server/cms/global.test.ts
+PASS test/utils/clearCookies.test.ts (11.099 s)
+PASS test/utils/multipleTemplates.test.ts
+PASS test/utils/cookieCacheBusting.test.ts (14.855 s)
+PASS test/server/authentication-service.test.ts (16.605 s)
 PASS test/utils/validateSessionRefreshToken.test.ts
+PASS test/server/cms/global.test.ts
 PASS test/utils/isLocalHost.test.ts
+PASS test/server/cms/index.test.ts
 PASS test/utils/isLocalHost.browser.test.ts
-PASS test/server/cms/index.test.ts (6.005 s)
-PASS test/server/index.test.ts (13.099 s)
+PASS test/server/index.test.ts (10.697 s)
 
-Test Suites: 9 passed, 9 total
-Tests:       68 passed, 68 total
+Test Suites: 10 passed, 10 total
+Tests:       85 passed, 85 total
 Snapshots:   0 total
-Time:        25.905 s
+Time:        27.703 s
 Ran all test suites.

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.100.0](https://github.com/vtex/faststore/compare/v3.99.6...v3.100.0) (2026-06-02)
+
+### Features
+
+- Password Protection (v3) ([#3347](https://github.com/vtex/faststore/issues/3347)) ([e215c72](https://github.com/vtex/faststore/commit/e215c72af5bf49783790a8d5ea7316d7c415ec57))
+
 ## [3.99.6](https://github.com/vtex/faststore/compare/v3.99.5...v3.99.6) (2026-05-19)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "3.99.6",
+  "version": "3.100.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -88,6 +88,7 @@
     "idb-keyval": "^5.1.3",
     "include-media": "^1.4.10",
     "isomorphic-unfetch": "^3.1.0",
+    "jose": "^6.2.3",
     "lexical": "^0.34.0",
     "next": "^13.5.9",
     "next-logger": "^5.0.2",
@@ -126,5 +127,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.3.2"
   },
-  "gitHead": "5636f4f2af5ef09cc522c45364d85d445ca5c716"
+  "gitHead": "0270a50a08d76544dd1c442635265785b12f793e"
 }

package/src/middleware.ts

@@ -0,0 +1,87 @@
+/*
+ * Middleware is always active. It runs:
+ * 1. Password protection (AuthenticationService) — when applicable (default/custom domains per env).
+ * 2. Redirects — only when ENABLE_REDIRECTS_MIDDLEWARE is set at runtime.
+ */
+
+import { NextResponse } from 'next/server'
+import type { NextRequest } from 'next/server'
+import storeConfig from 'discovery.config'
+
+import { AuthenticationService } from './server/authentication-service'
+
+type Redirect = {
+  from: string
+  to: string
+  type: 'permanent' | 'temporary'
+}
+interface RedirectsClient {
+  get(from: string): Promise<Redirect | null>
+}
+
+class DynamoRedirectsClient implements RedirectsClient {
+  async get(_from: string): Promise<Redirect | null> {
+    // TODO: Implement DynamoDB client. Ensure that the cluster has access to DynamoDB first.
+    return null
+  }
+}
+
+const redirectsClient = new DynamoRedirectsClient()
+
+export async function middleware(request: NextRequest) {
+  const path = request.nextUrl.pathname
+
+  let authResult: Awaited<
+    ReturnType<AuthenticationService['authenticateRequest']>
+  >
+
+  try {
+    const authService = new AuthenticationService()
+    authResult = await authService.authenticateRequest(request)
+  } catch {
+    return NextResponse.error()
+  }
+
+  if (authResult.response.status !== 200) {
+    return authResult.response
+  }
+
+  if (process.env.ENABLE_REDIRECTS_MIDDLEWARE === 'true') {
+    const redirect = await redirectsClient.get(path)
+
+    if (redirect) {
+      const redirectUrl = new URL(redirect.to, storeConfig.storeUrl)
+      const redirectStatusCode = redirect.type === 'permanent' ? 301 : 302
+      const response = NextResponse.redirect(redirectUrl, redirectStatusCode)
+
+      for (const cookie of authResult.response.cookies.getAll()) {
+        response.cookies.set(cookie)
+      }
+
+      response.headers.set(
+        'Cache-Control',
+        'public, max-age=300, stale-while-revalidate=31536000'
+      )
+
+      return response
+    }
+  }
+
+  return authResult.response
+}
+
+export const config = {
+  matcher: [
+    /*
+     * Match all paths including `/`
+     * Exclude:
+     * - api (e.g. api/fs/auth/login)
+     * - _next/static, _next/image
+     * - favicon.ico
+     * - fs-auth-login (login page)
+     * - ~partytown (partytown scripts)
+     */
+    '/',
+    '/((?!api|_next/static|_next/image|favicon.ico|fs-auth-login|~partytown).*)',
+  ],
+}

package/src/pages/api/fs/auth/login.ts

@@ -0,0 +1,123 @@
+import type { NextApiHandler, NextApiRequest, NextApiResponse } from 'next'
+
+import storeConfig from 'discovery.config'
+
+import type { LoginResponse } from '../../../../utils/loginResponse'
+import {
+  sessionUrl,
+  passwordProtectionTimeouts,
+} from '../../../../server/password-protection/webops-api'
+import {
+  COOKIE_NAME,
+  TOKEN_TTL_SECONDS,
+} from 'src/server/authentication-service'
+
+interface WebOpsSessionPayload {
+  valid: boolean
+  token?: string
+}
+
+const isSafeReturnToPath = (value: string): boolean => {
+  return value.startsWith('/') && !value.startsWith('//')
+}
+
+const isWebOpsSessionPayload = (
+  data: unknown
+): data is WebOpsSessionPayload => {
+  if (typeof data !== 'object' || data === null || Array.isArray(data)) {
+    return false
+  }
+
+  const payload = data as Record<string, unknown>
+
+  return (
+    typeof payload.valid === 'boolean' &&
+    (payload.token === undefined || typeof payload.token === 'string')
+  )
+}
+
+const handler: NextApiHandler<LoginResponse> = async (
+  request: NextApiRequest,
+  response: NextApiResponse<LoginResponse>
+) => {
+  if (request.method !== 'POST') {
+    response.status(405).end()
+    return
+  }
+
+  const storeId = storeConfig.api.storeId
+
+  try {
+    const { password } = request.body ?? {}
+
+    if (!password || typeof password !== 'string') {
+      response.status(400).json({
+        success: false,
+        error: 'Password is required',
+      })
+      return
+    }
+
+    const webopsResponse = await fetch(sessionUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ storeId, password }),
+      signal: AbortSignal.timeout(passwordProtectionTimeouts.defaultMs),
+    })
+
+    if (!webopsResponse.ok) {
+      if (webopsResponse.status === 401 || webopsResponse.status === 403) {
+        response.status(401).json({
+          success: false,
+          error: 'Invalid password',
+        })
+        return
+      }
+
+      response.status(503).json({
+        success: false,
+        error: 'Service temporarily unavailable',
+      })
+      return
+    }
+
+    const data: unknown = await webopsResponse.json()
+
+    if (!isWebOpsSessionPayload(data)) {
+      response.status(500).json({
+        success: false,
+        error: 'Internal server error',
+      })
+      return
+    }
+
+    if (data.valid && data.token) {
+      const returnTo =
+        typeof request.query.returnTo === 'string'
+          ? request.query.returnTo
+          : '/'
+      const sanitizedReturnTo = isSafeReturnToPath(returnTo) ? returnTo : '/'
+
+      response.setHeader('Set-Cookie', [
+        `${COOKIE_NAME}=${data.token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${TOKEN_TTL_SECONDS}`,
+      ])
+
+      response.status(200).json({
+        success: true,
+        redirectUrl: sanitizedReturnTo,
+      })
+    } else {
+      response.status(401).json({
+        success: false,
+        error: 'Invalid password',
+      })
+    }
+  } catch {
+    response.status(503).json({
+      success: false,
+      error: 'Service temporarily unavailable',
+    })
+  }
+}
+
+export default handler

package/src/pages/fs-auth-login/fs-auth-login.module.scss

@@ -0,0 +1,41 @@
+@layer components {
+  .fsAuthLogin {
+    @import "@faststore/ui/src/components/atoms/Button/styles.scss";
+    @import "@faststore/ui/src/components/atoms/Input/styles.scss";
+    @import "@faststore/ui/src/components/atoms/Loader/styles.scss";
+    @import "@faststore/ui/src/components/molecules/InputField/styles.scss";
+  }
+}
+
+.page {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  min-height: 100vh;
+  padding: var(--fs-spacing-3);
+}
+
+.title {
+  margin: 0 0 var(--fs-spacing-6) 0;
+  font-size: var(--fs-text-size-title-section);
+  font-weight: var(--fs-text-weight-bold);
+}
+
+.subtitle {
+  margin: 0 0 var(--fs-spacing-3) 0;
+  font-size: var(--fs-text-size-body);
+}
+
+.form {
+  display: flex;
+  flex-direction: column;
+  gap: var(--fs-spacing-2);
+  align-items: stretch;
+  width: 100%;
+  max-width: 20rem;
+
+  button {
+    align-self: center;
+  }
+}

package/src/pages/fs-auth-login/index.tsx

@@ -0,0 +1,90 @@
+import { Button, InputField } from '@faststore/ui'
+import Head from 'next/head'
+import { useRouter } from 'next/router'
+import { type FormEvent, useState } from 'react'
+
+import { isLoginResponse } from '../../utils/loginResponse'
+import styles from './fs-auth-login.module.scss'
+
+export default function PasswordProtectionLogin() {
+  const router = useRouter()
+  const returnTo =
+    typeof router.query.returnTo === 'string' ? router.query.returnTo : '/'
+
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  const handleSubmit = async (e: FormEvent) => {
+    e.preventDefault()
+    setLoading(true)
+    setError('')
+
+    try {
+      const url = new URL('/api/fs/auth/login', globalThis.location.origin)
+      url.searchParams.set('returnTo', returnTo)
+
+      const response = await fetch(url.toString(), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ password }),
+      })
+
+      const data: unknown = await response.json()
+
+      if (!isLoginResponse(data)) {
+        setError('Service temporarily unavailable')
+        return
+      }
+
+      if (data.success && data.redirectUrl) {
+        globalThis.location.href = data.redirectUrl
+      } else {
+        setError(data.error ?? 'Invalid password')
+      }
+    } catch {
+      setError('Service temporarily unavailable')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  return (
+    <div className={styles.fsAuthLogin}>
+      <Head>
+        <meta name="robots" content="noindex,nofollow" />
+      </Head>
+      <div className={styles.page}>
+        <h1 className={styles.title}>This store is password protected</h1>
+
+        <h2 className={styles.subtitle}>
+          Enter the password to access the store
+        </h2>
+
+        <form className={styles.form} onSubmit={handleSubmit}>
+          <InputField
+            id="fs-auth-password"
+            label="Password"
+            type="password"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+            placeholder="Enter password"
+            autoComplete="current-password"
+            required
+            disabled={loading}
+            error={error || undefined}
+          />
+          <Button
+            type="submit"
+            variant="primary"
+            size="small"
+            disabled={loading}
+            loading={loading}
+          >
+            Login
+          </Button>
+        </form>
+      </div>
+    </div>
+  )
+}