@faststore/core 3.99.6 → 3.100.1

package/test/server/authentication-service.test.ts

@@ -0,0 +1,460 @@
+import { decodeJwt, errors, importSPKI, jwtVerify } from 'jose'
+import { NextRequest } from 'next/server'
+
+import {
+  AuthenticationService,
+  resetPasswordProtectionPublicKeyCacheForTests,
+} from '../../src/server/authentication-service'
+
+function setNodeEnv(value: string | undefined): void {
+  const env = process.env as Record<string, string | undefined>
+  env.NODE_ENV = value
+}
+
+jest.mock('../../discovery.config', () => ({
+  __esModule: true,
+  default: {
+    api: { storeId: 'test-store' },
+  },
+}))
+
+jest.mock('jose', () => {
+  class MockJWTExpired extends Error {
+    payload: Record<string, unknown>
+    claim: string
+
+    constructor(
+      message: string,
+      payload: Record<string, unknown>,
+      claim = 'exp'
+    ) {
+      super(message)
+      this.name = 'JWTExpired'
+      this.payload = payload
+      this.claim = claim
+    }
+  }
+
+  return {
+    jwtVerify: jest.fn(),
+    importSPKI: jest.fn(),
+    decodeJwt: jest.fn(),
+    errors: {
+      JWTExpired: MockJWTExpired,
+    },
+  }
+})
+
+const jwtVerifyMock = jwtVerify as jest.MockedFunction<typeof jwtVerify>
+const importSPKIMock = importSPKI as jest.MockedFunction<typeof importSPKI>
+const decodeJwtMock = decodeJwt as jest.MockedFunction<typeof decodeJwt>
+
+function previewRequest(
+  path: string,
+  init?: ConstructorParameters<typeof NextRequest>[1]
+): NextRequest {
+  return new NextRequest(`https://preview.vtex.app${path}`, {
+    ...init,
+    headers: {
+      host: 'preview.vtex.app',
+      ...init?.headers,
+    },
+  })
+}
+
+describe('AuthenticationService', () => {
+  const originalNodeEnv = process.env.NODE_ENV
+  const originalCustomDomains = process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED
+
+  beforeEach(() => {
+    setNodeEnv('production')
+    delete process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED
+    resetPasswordProtectionPublicKeyCacheForTests()
+    jest.clearAllMocks()
+    importSPKIMock.mockResolvedValue({} as CryptoKey)
+    global.fetch = jest.fn()
+  })
+
+  afterAll(() => {
+    setNodeEnv(originalNodeEnv)
+    process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED = originalCustomDomains
+  })
+
+  it('skips protection in development', async () => {
+    setNodeEnv('development')
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(previewRequest('/p'))
+
+    expect(response.status).toBe(200)
+    expect(global.fetch).not.toHaveBeenCalled()
+  })
+
+  it('allows traffic when WebOps reports not protected and sets negative-cache cookie', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        protected: false,
+        token: 'neg-cache-token',
+      }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/products')
+    )
+
+    expect(response.status).toBe(200)
+    expect(response.cookies.get('__fs_auth_token')?.value).toBe(
+      'neg-cache-token'
+    )
+    expect(global.fetch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        href: expect.stringMatching(
+          /\/api\/v1\/password-protection\/status.*storeId=test-store/
+        ),
+      }),
+      expect.any(Object)
+    )
+  })
+
+  it('redirects to login when protected and host matches DEFAULT_DOMAINS scope', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        protected: true,
+        passwordVersion: 'v1',
+        scope: 'DEFAULT_DOMAINS',
+      }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/secret')
+    )
+
+    expect(response.status).toBe(307)
+    const location = response.headers.get('location') ?? ''
+    expect(location).toContain('/fs-auth-login')
+    expect(location).toContain('returnTo=%2Fsecret')
+  })
+
+  it('allows traffic when protected but scope does not apply to this host', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        protected: true,
+        scope: 'CUSTOM_DOMAINS',
+      }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(previewRequest('/p'))
+
+    expect(response.status).toBe(200)
+  })
+
+  it('redirects to login when protected for ALL_DOMAINS on custom host', async () => {
+    process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED = 'true'
+    ;(global.fetch as jest.Mock).mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        protected: true,
+        scope: 'ALL_DOMAINS',
+      }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      new NextRequest('https://shop.example.com/checkout', {
+        headers: { host: 'shop.example.com' },
+      })
+    )
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toContain('returnTo=%2Fcheckout')
+  })
+
+  it('allows traffic when JWT is valid and store is password-protected', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+
+    jwtVerifyMock.mockResolvedValueOnce({
+      payload: {
+        storeId: 'test-store',
+        protected: true,
+        scope: 'DEFAULT_DOMAINS',
+      },
+      protectedHeader: { alg: 'RS256' },
+    } as unknown as Awaited<ReturnType<typeof jwtVerify>>)
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/account', {
+        headers: { cookie: '__fs_auth_token=valid' },
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(global.fetch).toHaveBeenCalledTimes(1)
+    expect((global.fetch as jest.Mock).mock.calls[0][0]).toEqual(
+      expect.objectContaining({
+        pathname: '/api/v1/password-protection/public-key',
+      })
+    )
+  })
+
+  it('verifies JWT locally when cookie present (not protected payload)', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+
+    jwtVerifyMock.mockResolvedValueOnce({
+      payload: {
+        storeId: 'test-store',
+        protected: false,
+      },
+      protectedHeader: { alg: 'RS256' },
+    } as unknown as Awaited<ReturnType<typeof jwtVerify>>)
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/p', {
+        headers: {
+          host: 'preview.vtex.app',
+          cookie: '__fs_auth_token=abc',
+        },
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(jwtVerifyMock).toHaveBeenCalled()
+  })
+
+  it('treats wrong storeId in JWT as unauthenticated and calls status', async () => {
+    jwtVerifyMock.mockResolvedValueOnce({
+      payload: {
+        storeId: 'other-store',
+        protected: false,
+      },
+      protectedHeader: { alg: 'RS256' },
+    } as unknown as Awaited<ReturnType<typeof jwtVerify>>)
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({
+        protected: true,
+        scope: 'DEFAULT_DOMAINS',
+      }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/x', {
+        headers: {
+          cookie: '__fs_auth_token=bad',
+        },
+      })
+    )
+
+    expect(response.status).toBe(307)
+  })
+
+  it('falls back to status when cookie JWT fails verification for non-expiry reasons', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+    jwtVerifyMock.mockRejectedValueOnce(new Error('invalid signature'))
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({
+        protected: false,
+        token: 'after-bad-jwt',
+      }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/p', {
+        headers: { cookie: '__fs_auth_token=garbage' },
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(response.cookies.get('__fs_auth_token')?.value).toBe('after-bad-jwt')
+    expect(jwtVerifyMock).toHaveBeenCalled()
+    expect(global.fetch).toHaveBeenCalledTimes(2)
+  })
+
+  it('renews session when JWT is expired and WebOps renew succeeds', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+
+    jwtVerifyMock.mockRejectedValueOnce(
+      new errors.JWTExpired('jwt expired', { storeId: 'test-store' })
+    )
+
+    decodeJwtMock.mockReturnValueOnce({
+      storeId: 'test-store',
+      protected: true,
+      scope: 'DEFAULT_DOMAINS',
+    } as ReturnType<typeof decodeJwt>)
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({
+        valid: true,
+        token: 'renewed-token',
+      }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/p', {
+        headers: { cookie: '__fs_auth_token=old' },
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(response.cookies.get('__fs_auth_token')?.value).toBe('renewed-token')
+  })
+
+  it('redirects to login when JWT is expired and renew response is not ok', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+    jwtVerifyMock.mockRejectedValueOnce(
+      new errors.JWTExpired('jwt expired', { storeId: 'test-store' })
+    )
+    decodeJwtMock.mockReturnValueOnce({
+      storeId: 'test-store',
+      protected: true,
+      scope: 'DEFAULT_DOMAINS',
+    } as ReturnType<typeof decodeJwt>)
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: false,
+      status: 502,
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/p', {
+        headers: { cookie: '__fs_auth_token=expired' },
+      })
+    )
+
+    expect(response.status).toBe(307)
+  })
+
+  it('redirects to login when JWT is expired and renew body is not valid', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+    jwtVerifyMock.mockRejectedValueOnce(
+      new errors.JWTExpired('jwt expired', { storeId: 'test-store' })
+    )
+    decodeJwtMock.mockReturnValueOnce({
+      storeId: 'test-store',
+      protected: true,
+      scope: 'DEFAULT_DOMAINS',
+    } as ReturnType<typeof decodeJwt>)
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ valid: false }),
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/p', {
+        headers: { cookie: '__fs_auth_token=expired' },
+      })
+    )
+
+    expect(response.status).toBe(307)
+  })
+
+  it('allows traffic when renew fails but expired JWT scope does not apply to this host', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ publicKey: 'test-pem' }),
+    })
+    jwtVerifyMock.mockRejectedValueOnce(
+      new errors.JWTExpired('jwt expired', { storeId: 'test-store' })
+    )
+    decodeJwtMock.mockReturnValueOnce({
+      storeId: 'test-store',
+      protected: true,
+      scope: 'CUSTOM_DOMAINS',
+    } as ReturnType<typeof decodeJwt>)
+    ;(global.fetch as jest.Mock).mockRejectedValueOnce(new Error('renew down'))
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(
+      previewRequest('/p', {
+        headers: { cookie: '__fs_auth_token=old' },
+      })
+    )
+
+    expect(response.status).toBe(200)
+  })
+
+  it('fail-closes to login on default domain when status request fails', async () => {
+    ;(global.fetch as jest.Mock).mockRejectedValue(new Error('network'))
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(previewRequest('/p'))
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toContain('/fs-auth-login')
+  })
+
+  it('fail-closes to login when status endpoint returns a non-ok HTTP status', async () => {
+    ;(global.fetch as jest.Mock).mockResolvedValue({
+      ok: false,
+      status: 503,
+    })
+
+    const service = new AuthenticationService()
+    const { response } = await service.authenticateRequest(previewRequest('/p'))
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toContain('/fs-auth-login')
+  })
+
+  it('fail-closes to login on custom domain when status request fails', async () => {
+    process.env.CUSTOM_DOMAINS_PROTECTION_ENABLED = 'true'
+    ;(global.fetch as jest.Mock).mockRejectedValue(new Error('network'))
+
+    const service = new AuthenticationService()
+    const request = new NextRequest('https://shop.example.com/page', {
+      headers: { host: 'shop.example.com' },
+    })
+
+    const { response } = await service.authenticateRequest(request)
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toContain('/fs-auth-login')
+  })
+
+  it('does not enforce protection on custom domain when env gate is off', async () => {
+    const service = new AuthenticationService()
+    const request = new NextRequest('https://shop.example.com/page', {
+      headers: { host: 'shop.example.com' },
+    })
+
+    const { response } = await service.authenticateRequest(request)
+
+    expect(response.status).toBe(200)
+    expect(global.fetch).not.toHaveBeenCalled()
+  })
+})

package/.next/static/UmIFhJcdMOfy3xrHNNZS2/_buildManifest.js

@@ -1 +0,0 @@
-self.__BUILD_MANIFEST=function(c,s,t,a,e,u,n){return{__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},"/":[c,s,t,e,"static/css/02259c549b2179f2.css","static/chunks/pages/index-8774d5b4a8744eb2.js"],"/404":[c,s,t,a,"static/chunks/pages/404-e3dfbbac003b02a2.js"],"/500":[c,s,t,a,"static/chunks/pages/500-c7814e085081d7b8.js"],"/_error":["static/chunks/pages/_error-2b0148be56a716e9.js"],"/checkout":[c,s,t,"static/chunks/pages/checkout-2071467ad42dfb99.js"],"/login":[c,s,t,a,"static/chunks/pages/login-e74747c9f9cb5b49.js"],"/pvt/account":["static/chunks/pages/pvt/account-65fefcc699344bdb.js"],"/pvt/account/403":[c,s,t,"static/css/6819dddf2b1b5ea7.css","static/chunks/pages/pvt/account/403-ccddb4364ef27179.js"],"/pvt/account/404":[c,s,t,"static/css/ea11d74a2848b093.css","static/chunks/pages/pvt/account/404-5ad472d9f2ee1980.js"],"/pvt/account/orders":[c,s,t,"static/css/14176a4704ff97b2.css","static/chunks/pages/pvt/account/orders-faab39f2aff05fae.js"],"/pvt/account/orders/[id]":[c,s,t,"static/css/82f3cd529b672812.css","static/chunks/pages/pvt/account/orders/[id]-64e42157c0974c48.js"],"/pvt/account/profile":[c,s,t,"static/css/a852afa9be31e946.css","static/chunks/pages/pvt/account/profile-9672177ee2665bc0.js"],"/pvt/account/security":[c,s,t,"static/css/24d91007fc96be10.css","static/chunks/pages/pvt/account/security-03eb1ccab9a30563.js"],"/pvt/account/user-details":[c,s,t,"static/css/16d65422bfa80f51.css","static/chunks/pages/pvt/account/user-details-7838e3f79781596c.js"],"/pvt/account/[...unknown]":["static/chunks/pages/pvt/account/[...unknown]-f80f645594d2740c.js"],"/s":[c,s,t,u,n,a,"static/chunks/pages/s-162ba789e6611175.js"],"/[slug]/p":[c,"static/chunks/227-f109b24190a008ab.js",s,t,e,"static/css/1c4983f11b861ea0.css","static/chunks/3166-0b30a3887c0c346d.js","static/css/54cedf4b65e5863f.css","static/chunks/pages/[slug]/p-644f1132f5a0f736.js"],"/[...slug]":[c,s,t,u,n,"static/chunks/pages/[...slug]-dc8a395a43b081f1.js"],sortedPages:["/","/404","/500","/_app","/_error","/checkout","/login","/pvt/account","/pvt/account/403","/pvt/account/404","/pvt/account/orders","/pvt/account/orders/[id]","/pvt/account/profile","/pvt/account/security","/pvt/account/user-details","/pvt/account/[...unknown]","/s","/[slug]/p","/[...slug]"]}}("static/chunks/9298-1d1ed0a54133cb59.js","static/css/2c19433e38fd7533.css","static/chunks/9173-515913f3f10caf5e.js","static/css/2980acad3f8e1028.css","static/css/837662922091162f.css","static/css/fdc1868dcfd42aa4.css","static/chunks/7191-d221f01388571ca9.js"),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();