@faststore/core 4.10.1-dev.4 → 4.10.1-dev.5

package/test/pages/pvt/account/403.test.ts

@@ -0,0 +1,67 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockExecute = vi.hoisted(() => vi.fn())
+
+vi.mock('src/server', () => ({ execute: mockExecute }))
+vi.mock('src/server/cms/global', () => ({
+  injectGlobalSections: vi.fn(() => ({ sections: [], settings: {} })),
+}))
+vi.mock('src/server/cms/fetchMyAccountPageContent', () => ({
+  fetchMyAccountPageContent: vi.fn(async () => ({ sections: [] })),
+}))
+vi.mock('src/components/cms/GlobalSections', () => ({
+  getGlobalSectionsData: vi.fn(() => [
+    Promise.resolve(null),
+    Promise.resolve(null),
+    Promise.resolve(null),
+  ]),
+}))
+
+import storeConfig from 'discovery.config'
+import { getServerSideProps } from 'src/pages/pvt/account/403'
+
+function makeContext(host: string) {
+  return {
+    req: { headers: { host } },
+    query: {},
+    previewData: undefined,
+    locale: undefined,
+  } as any
+}
+
+describe('/pvt/account/403 getServerSideProps refresh-token bypass', () => {
+  const originalRefreshToken = storeConfig.experimental.refreshToken
+
+  beforeEach(() => {
+    storeConfig.experimental.refreshToken = true
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    mockExecute.mockResolvedValue({
+      data: null,
+      errors: [{ extensions: { status: 401 } }],
+    })
+  })
+
+  afterEach(() => {
+    storeConfig.experimental.refreshToken = originalRefreshToken
+    vi.restoreAllMocks()
+  })
+
+  it.each([
+    'localhost:3000',
+    '127.0.0.1:3000',
+    'brandless-abc123.preview.vtex.app',
+  ])('does not ask for a token refresh on %s', async (host) => {
+    const result: any = await getServerSideProps(makeContext(host))
+
+    expect(result.props.needsRefreshToken).toBe(false)
+  })
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'asks for a token refresh on the production host %s',
+    async (host) => {
+      const result: any = await getServerSideProps(makeContext(host))
+
+      expect(result.props.needsRefreshToken).toBe(true)
+    }
+  )
+})

package/test/sdk/account/useRefreshToken.browser.test.ts

@@ -0,0 +1,69 @@
+import { renderHook, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockRefreshTokenRequest = vi.hoisted(() => vi.fn())
+const mockLogoutAndClearSession = vi.hoisted(() => vi.fn())
+
+vi.mock('../../../src/sdk/account/refreshToken', () => ({
+  refreshTokenRequest: mockRefreshTokenRequest,
+  isRefreshTokenSuccessful: () => false,
+}))
+
+vi.mock('../../../src/sdk/session', () => ({
+  logoutAndClearSession: mockLogoutAndClearSession,
+  sessionStore: { read: () => null, readInitial: () => ({}) },
+}))
+
+import { useRefreshToken } from '../../../src/sdk/account/useRefreshToken'
+
+const originalLocation = window.location
+
+function stubHostname(hostname: string) {
+  // jsdom forbids assigning to `window.location` directly, so we redefine the
+  // descriptor with a minimal stub that exposes the hostname we want to test.
+  Object.defineProperty(window, 'location', {
+    configurable: true,
+    value: { ...originalLocation, hostname },
+  })
+}
+
+describe('useRefreshToken', () => {
+  beforeEach(() => {
+    mockRefreshTokenRequest.mockResolvedValue({ status: 'error' })
+    mockLogoutAndClearSession.mockResolvedValue(undefined)
+  })
+
+  afterEach(() => {
+    vi.clearAllMocks()
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: originalLocation,
+    })
+  })
+
+  it.each(['localhost', 'brandless-abc123.preview.vtex.app'])(
+    'shows the 403 view without refreshing or logging out on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+
+      const { result } = renderHook(() => useRefreshToken(true))
+
+      await waitFor(() => expect(result.current.shouldShow403).toBe(true))
+      expect(mockRefreshTokenRequest).not.toHaveBeenCalled()
+      expect(mockLogoutAndClearSession).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'refreshes the token and logs out when it fails on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+
+      const { result } = renderHook(() => useRefreshToken(true))
+
+      await waitFor(() => expect(result.current.shouldShow403).toBe(true))
+      expect(mockRefreshTokenRequest).toHaveBeenCalledTimes(1)
+      expect(mockLogoutAndClearSession).toHaveBeenCalledTimes(1)
+    }
+  )
+})

package/test/sdk/session/validateSession.browser.test.ts

@@ -1,12 +1,27 @@
 import type { Session } from '@faststore/sdk'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from 'vitest'
 
 const mockRequest = vi.hoisted(() => vi.fn())
+const mockRefreshTokenRequest = vi.hoisted(() => vi.fn())
 
 vi.mock('../../../src/sdk/graphql/request', () => ({
   request: mockRequest,
 }))
 
+vi.mock('../../../src/sdk/account/refreshToken', () => ({
+  refreshTokenRequest: mockRefreshTokenRequest,
+  isRefreshTokenSuccessful: () => true,
+}))
+
+import storeConfig from '../../../discovery.config'
 import { validateSession } from '../../../src/sdk/session'
 
 const session: Session = {
@@ -25,12 +40,17 @@ const session: Session = {
   refreshAfter: null,
 }
 
+// The store validates its initial session when the module loads. Let that
+// call settle once, so no test depends on calls left by another one.
+beforeAll(async () => {
+  mockRequest.mockResolvedValue({ validateSession: null })
+  await vi.waitFor(() => expect(mockRequest).toHaveBeenCalled())
+})
+
 describe('validateSession', () => {
-  beforeEach(async () => {
+  beforeEach(() => {
+    mockRequest.mockReset()
     mockRequest.mockResolvedValue({ validateSession: null })
-    // The store validates its initial session on load; let it settle first
-    await vi.waitFor(() => expect(mockRequest).toHaveBeenCalled())
-    mockRequest.mockClear()
   })
 
   it('does not send the UI state persisted with the session', async () => {
@@ -45,3 +65,86 @@ describe('validateSession', () => {
     expect(mockRequest.mock.calls[0][1].session).toStrictEqual(session)
   })
 })
+
+describe('validateSession refresh-token bypass', () => {
+  const originalLocation = window.location
+  const originalRefreshToken = storeConfig.experimental.refreshToken
+
+  // An already expired `refreshAfter` (in seconds) triggers the refresh path.
+  const expiredSession: Session = { ...session, refreshAfter: '1' }
+
+  function stubHostname(hostname: string) {
+    // jsdom forbids assigning to `window.location` directly, so we redefine the
+    // descriptor with a minimal stub that exposes the hostname we want to test.
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: { ...originalLocation, hostname },
+    })
+  }
+
+  beforeEach(() => {
+    mockRequest.mockReset()
+    mockRequest.mockResolvedValue({ validateSession: null })
+    mockRefreshTokenRequest.mockReset()
+    mockRefreshTokenRequest.mockResolvedValue({
+      status: 'success',
+      refreshAfter: new Date(Date.now() + 60_000).toISOString(),
+    })
+    storeConfig.experimental.refreshToken = true
+  })
+
+  afterEach(() => {
+    storeConfig.experimental.refreshToken = originalRefreshToken
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: originalLocation,
+    })
+  })
+
+  it.each(['localhost', 'brandless-abc123.preview.vtex.app'])(
+    'skips the refresh when refreshAfter is expired on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+
+      await validateSession(expiredSession)
+
+      expect(mockRefreshTokenRequest).not.toHaveBeenCalled()
+      expect(mockRequest).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each(['localhost', 'brandless-abc123.preview.vtex.app'])(
+    'skips the refresh when ValidateSession answers 401 on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+      mockRequest.mockRejectedValueOnce({ status: 401 })
+
+      await validateSession(session)
+
+      expect(mockRefreshTokenRequest).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'refreshes the token when refreshAfter is expired on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+
+      await validateSession(expiredSession)
+
+      expect(mockRefreshTokenRequest).toHaveBeenCalledTimes(1)
+    }
+  )
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'refreshes the token when ValidateSession answers 401 on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+      mockRequest.mockRejectedValueOnce({ status: 401 })
+
+      await validateSession(session)
+
+      expect(mockRefreshTokenRequest).toHaveBeenCalledTimes(1)
+    }
+  )
+})

package/test/utils/shouldBypassRefreshToken.browser.test.ts

@@ -0,0 +1,38 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { shouldBypassRefreshTokenBrowser } from '../../src/utils/shouldBypassRefreshToken'
+
+const originalLocation = window.location
+
+function stubHostname(hostname: string) {
+  // jsdom forbids assigning to `window.location` directly, so we redefine the
+  // descriptor with a minimal stub that exposes the hostname we want to test.
+  Object.defineProperty(window, 'location', {
+    configurable: true,
+    value: { ...originalLocation, hostname },
+  })
+}
+
+describe('shouldBypassRefreshTokenBrowser', () => {
+  afterEach(() => {
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: originalLocation,
+    })
+  })
+
+  it.each(['localhost', '127.0.0.1', 'brandless-abc123.preview.vtex.app'])(
+    'returns true when window.location.hostname is "%s"',
+    (hostname) => {
+      stubHostname(hostname)
+      expect(shouldBypassRefreshTokenBrowser()).toBe(true)
+    }
+  )
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'returns false for the production hostname "%s"',
+    (hostname) => {
+      stubHostname(hostname)
+      expect(shouldBypassRefreshTokenBrowser()).toBe(false)
+    }
+  )
+})

package/test/utils/shouldBypassRefreshToken.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest'
+import {
+  shouldBypassRefreshToken,
+  shouldBypassRefreshTokenBrowser,
+  shouldBypassRefreshTokenForRequest,
+} from '../../src/utils/shouldBypassRefreshToken'
+
+describe('shouldBypassRefreshToken', () => {
+  it.each(['localhost', '127.0.0.1'])('returns true for "%s"', (hostname) => {
+    expect(shouldBypassRefreshToken(hostname)).toBe(true)
+  })
+
+  it('returns true for a WebOps preview host', () => {
+    expect(shouldBypassRefreshToken('brandless-abc123.preview.vtex.app')).toBe(
+      true
+    )
+  })
+
+  it('is case-insensitive for preview hosts', () => {
+    expect(shouldBypassRefreshToken('Brandless-ABC123.Preview.VTEX.app')).toBe(
+      true
+    )
+  })
+
+  it('ignores the trailing dot of a fully qualified preview host', () => {
+    expect(shouldBypassRefreshToken('brandless-abc123.preview.vtex.app.')).toBe(
+      true
+    )
+  })
+
+  it('returns false for the production "{account}.vtex.app" domain', () => {
+    // `{account}.vtex.app` is a production default domain, not a preview.
+    expect(shouldBypassRefreshToken('brandless.vtex.app')).toBe(false)
+  })
+
+  it('returns false for a custom store domain', () => {
+    expect(shouldBypassRefreshToken('brandless.fast.store')).toBe(false)
+  })
+
+  it('returns false for hosts that only contain the preview suffix', () => {
+    expect(shouldBypassRefreshToken('preview.vtex.app')).toBe(false)
+    expect(shouldBypassRefreshToken('x.preview.vtex.app.evil.com')).toBe(false)
+  })
+
+  it('returns false for nullish or empty input', () => {
+    expect(shouldBypassRefreshToken(null)).toBe(false)
+    expect(shouldBypassRefreshToken(undefined)).toBe(false)
+    expect(shouldBypassRefreshToken('')).toBe(false)
+  })
+})
+
+describe('shouldBypassRefreshTokenForRequest', () => {
+  it('returns true when the Host header is a local or preview host', () => {
+    expect(shouldBypassRefreshTokenForRequest({ host: 'localhost:3000' })).toBe(
+      true
+    )
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'brandless-abc123.preview.vtex.app',
+      })
+    ).toBe(true)
+  })
+
+  it('returns true when the preview host arrives in x-forwarded-host', () => {
+    // Behind the preview ingress, Host is an internal name.
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'faststore-internal:3000',
+        'x-forwarded-host': 'brandless-abc123.preview.vtex.app',
+      })
+    ).toBe(true)
+  })
+
+  it('ignores a multi-value x-forwarded-host', () => {
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'brandless.fast.store',
+        'x-forwarded-host': 'brandless-abc123.preview.vtex.app, proxy',
+      })
+    ).toBe(false)
+  })
+
+  it('returns false on production hosts', () => {
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'brandless.fast.store',
+        'x-forwarded-host': 'brandless.fast.store',
+      })
+    ).toBe(false)
+    expect(shouldBypassRefreshTokenForRequest({})).toBe(false)
+  })
+})
+
+describe('shouldBypassRefreshTokenBrowser', () => {
+  it('returns false when window is not available (SSR/Node)', () => {
+    expect(shouldBypassRefreshTokenBrowser()).toBe(false)
+  })
+})

package/test/utils/isLocalHost.browser.test.ts

@@ -1,37 +0,0 @@
-import { afterEach, describe, expect, it } from 'vitest'
-import { isLocalHostBrowser } from '../../src/utils/isLocalHost'
-
-const originalLocation = window.location
-
-function stubHostname(hostname: string) {
-  // jsdom forbids assigning to `window.location` directly, so we redefine the
-  // descriptor with a minimal stub that exposes the hostname we want to test.
-  Object.defineProperty(window, 'location', {
-    configurable: true,
-    value: { ...originalLocation, hostname },
-  })
-}
-
-describe('isLocalHostBrowser', () => {
-  afterEach(() => {
-    Object.defineProperty(window, 'location', {
-      configurable: true,
-      value: originalLocation,
-    })
-  })
-
-  it('returns true when window.location.hostname is "localhost"', () => {
-    stubHostname('localhost')
-    expect(isLocalHostBrowser()).toBe(true)
-  })
-
-  it('returns true when window.location.hostname is "127.0.0.1"', () => {
-    stubHostname('127.0.0.1')
-    expect(isLocalHostBrowser()).toBe(true)
-  })
-
-  it('returns false for a production hostname', () => {
-    stubHostname('brandless.fast.store')
-    expect(isLocalHostBrowser()).toBe(false)
-  })
-})