@faststore/core 4.10.1-dev.4 → 4.10.1-dev.6

package/test/pages/api/graphql.test.ts

@@ -9,14 +9,23 @@ import { GraphQLError } from 'graphql'
 import type { NextApiRequest, NextApiResponse } from 'next'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+import discoveryConfig from '../../../discovery.config'
 import handler from '../../../src/pages/api/graphql'
 import { execute } from '../../../src/server'
+import { shouldForceRefreshTokenForValidateSession } from '../../../src/utils/validateSessionRefreshToken'
 
 vi.mock('../../../src/server', () => ({
   execute: vi.fn(),
 }))
 
+vi.mock('../../../src/utils/validateSessionRefreshToken', () => ({
+  shouldForceRefreshTokenForValidateSession: vi.fn(),
+}))
+
 const mockedExecute = vi.mocked(execute)
+const mockedShouldForceRefreshToken = vi.mocked(
+  shouldForceRefreshTokenForValidateSession
+)
 
 const createResponse = ({ headersSent = false } = {}) => {
   const res = {
@@ -229,3 +238,169 @@ describe('/api/graphql request handling', () => {
     expect(res.end).toHaveBeenCalled()
   })
 })
+
+describe('/api/graphql ValidateSession refresh-token bypass', () => {
+  const originalRefreshToken = discoveryConfig.experimental.refreshToken
+
+  const createValidateSessionRequest = (
+    host: string,
+    extraHeaders: Record<string, string> = {}
+  ) =>
+    ({
+      method: 'GET',
+      url: '/api/graphql',
+      headers: { host, ...extraHeaders },
+      query: {
+        operationName: 'ValidateSession',
+        operationHash: 'hash',
+        variables: JSON.stringify({ session: {} }),
+      },
+    }) as unknown as NextApiRequest
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    discoveryConfig.experimental.refreshToken = true
+    mockedShouldForceRefreshToken.mockReturnValue(true)
+    mockedExecute.mockResolvedValue({
+      data: { validateSession: null },
+      errors: undefined,
+      extensions: { cookies: new Map(), cacheControl: undefined },
+    } as never)
+  })
+
+  afterEach(() => {
+    discoveryConfig.experimental.refreshToken = originalRefreshToken
+  })
+
+  it.each([
+    'localhost:3000',
+    '127.0.0.1:3000',
+    'brandless-abc123.preview.vtex.app',
+  ])('does not force a 401 on %s', async (host) => {
+    const res = createResponse()
+    await handler(createValidateSessionRequest(host), res)
+
+    expect(mockedShouldForceRefreshToken).not.toHaveBeenCalled()
+    expect(res.status).not.toHaveBeenCalledWith(401)
+    expect(mockedExecute).toHaveBeenCalled()
+  })
+
+  it('does not force a 401 on a preview behind the ingress', async () => {
+    const res = createResponse()
+    await handler(
+      createValidateSessionRequest('faststore-internal:3000', {
+        'x-forwarded-host': 'brandless-abc123.preview.vtex.app',
+      }),
+      res
+    )
+
+    expect(mockedShouldForceRefreshToken).not.toHaveBeenCalled()
+    expect(res.status).not.toHaveBeenCalledWith(401)
+    expect(mockedExecute).toHaveBeenCalled()
+  })
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'forces a 401 on the production host %s',
+    async (host) => {
+      const res = createResponse()
+      await handler(createValidateSessionRequest(host), res)
+
+      expect(res.status).toHaveBeenCalledWith(401)
+      expect(mockedExecute).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('/api/graphql success cache-control', () => {
+  const originalGraphqlCacheControl =
+    discoveryConfig.experimental.graphqlCacheControl
+
+  const mockExecuteWithCacheControl = (cacheControl?: unknown) => {
+    mockedExecute.mockResolvedValue({
+      data: {},
+      errors: undefined,
+      extensions: { cookies: new Map(), cacheControl },
+    } as never)
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    discoveryConfig.experimental.graphqlCacheControl =
+      originalGraphqlCacheControl
+  })
+
+  it('uses the cache-control collected while executing the operation', async () => {
+    mockExecuteWithCacheControl({ scope: 'public', sMaxAge: 120 })
+
+    const res = createResponse()
+    await handler(createRequest(), res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'public, s-maxage=120, stale-while-revalidate=0'
+    )
+  })
+
+  it('makes collected cache-control private when there is an auth cookie', async () => {
+    mockExecuteWithCacheControl({ scope: 'public', sMaxAge: 120 })
+
+    const req = createRequest()
+    req.headers.cookie = 'VtexIdclientAutCookie_store=jwt'
+    const res = createResponse()
+    await handler(req, res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'private, s-maxage=120, stale-while-revalidate=0'
+    )
+  })
+
+  it('falls back to the default max-age for GET queries without collected cache-control', async () => {
+    discoveryConfig.experimental.graphqlCacheControl = {
+      maxAge: 0,
+      staleWhileRevalidate: 0,
+    }
+    mockExecuteWithCacheControl()
+
+    const res = createResponse()
+    await handler(createRequest(), res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'public, s-maxage=300, stale-while-revalidate=3600'
+    )
+  })
+
+  it('uses the configured max-age and stale-while-revalidate for GET queries', async () => {
+    discoveryConfig.experimental.graphqlCacheControl = {
+      maxAge: 60,
+      staleWhileRevalidate: 30,
+    }
+    mockExecuteWithCacheControl()
+
+    const req = createRequest()
+    req.headers.cookie = 'VtexIdclientAutCookie_store=jwt'
+    const res = createResponse()
+    await handler(req, res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'private, s-maxage=60, stale-while-revalidate=30'
+    )
+  })
+
+  it('does not cache operations that are not GET queries', async () => {
+    mockExecuteWithCacheControl()
+
+    const res = createResponse()
+    await handler(createRequest('SubscribeToNewsletter'), res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'no-cache, no-store'
+    )
+  })
+})

package/test/pages/pvt/account/403.test.ts

@@ -0,0 +1,67 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockExecute = vi.hoisted(() => vi.fn())
+
+vi.mock('src/server', () => ({ execute: mockExecute }))
+vi.mock('src/server/cms/global', () => ({
+  injectGlobalSections: vi.fn(() => ({ sections: [], settings: {} })),
+}))
+vi.mock('src/server/cms/fetchMyAccountPageContent', () => ({
+  fetchMyAccountPageContent: vi.fn(async () => ({ sections: [] })),
+}))
+vi.mock('src/components/cms/GlobalSections', () => ({
+  getGlobalSectionsData: vi.fn(() => [
+    Promise.resolve(null),
+    Promise.resolve(null),
+    Promise.resolve(null),
+  ]),
+}))
+
+import storeConfig from 'discovery.config'
+import { getServerSideProps } from 'src/pages/pvt/account/403'
+
+function makeContext(host: string) {
+  return {
+    req: { headers: { host } },
+    query: {},
+    previewData: undefined,
+    locale: undefined,
+  } as any
+}
+
+describe('/pvt/account/403 getServerSideProps refresh-token bypass', () => {
+  const originalRefreshToken = storeConfig.experimental.refreshToken
+
+  beforeEach(() => {
+    storeConfig.experimental.refreshToken = true
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    mockExecute.mockResolvedValue({
+      data: null,
+      errors: [{ extensions: { status: 401 } }],
+    })
+  })
+
+  afterEach(() => {
+    storeConfig.experimental.refreshToken = originalRefreshToken
+    vi.restoreAllMocks()
+  })
+
+  it.each([
+    'localhost:3000',
+    '127.0.0.1:3000',
+    'brandless-abc123.preview.vtex.app',
+  ])('does not ask for a token refresh on %s', async (host) => {
+    const result: any = await getServerSideProps(makeContext(host))
+
+    expect(result.props.needsRefreshToken).toBe(false)
+  })
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'asks for a token refresh on the production host %s',
+    async (host) => {
+      const result: any = await getServerSideProps(makeContext(host))
+
+      expect(result.props.needsRefreshToken).toBe(true)
+    }
+  )
+})

package/test/sdk/account/useRefreshToken.browser.test.ts

@@ -0,0 +1,69 @@
+import { renderHook, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockRefreshTokenRequest = vi.hoisted(() => vi.fn())
+const mockLogoutAndClearSession = vi.hoisted(() => vi.fn())
+
+vi.mock('../../../src/sdk/account/refreshToken', () => ({
+  refreshTokenRequest: mockRefreshTokenRequest,
+  isRefreshTokenSuccessful: () => false,
+}))
+
+vi.mock('../../../src/sdk/session', () => ({
+  logoutAndClearSession: mockLogoutAndClearSession,
+  sessionStore: { read: () => null, readInitial: () => ({}) },
+}))
+
+import { useRefreshToken } from '../../../src/sdk/account/useRefreshToken'
+
+const originalLocation = window.location
+
+function stubHostname(hostname: string) {
+  // jsdom forbids assigning to `window.location` directly, so we redefine the
+  // descriptor with a minimal stub that exposes the hostname we want to test.
+  Object.defineProperty(window, 'location', {
+    configurable: true,
+    value: { ...originalLocation, hostname },
+  })
+}
+
+describe('useRefreshToken', () => {
+  beforeEach(() => {
+    mockRefreshTokenRequest.mockResolvedValue({ status: 'error' })
+    mockLogoutAndClearSession.mockResolvedValue(undefined)
+  })
+
+  afterEach(() => {
+    vi.clearAllMocks()
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: originalLocation,
+    })
+  })
+
+  it.each(['localhost', 'brandless-abc123.preview.vtex.app'])(
+    'shows the 403 view without refreshing or logging out on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+
+      const { result } = renderHook(() => useRefreshToken(true))
+
+      await waitFor(() => expect(result.current.shouldShow403).toBe(true))
+      expect(mockRefreshTokenRequest).not.toHaveBeenCalled()
+      expect(mockLogoutAndClearSession).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'refreshes the token and logs out when it fails on %s',
+    async (hostname) => {
+      stubHostname(hostname)
+
+      const { result } = renderHook(() => useRefreshToken(true))
+
+      await waitFor(() => expect(result.current.shouldShow403).toBe(true))
+      expect(mockRefreshTokenRequest).toHaveBeenCalledTimes(1)
+      expect(mockLogoutAndClearSession).toHaveBeenCalledTimes(1)
+    }
+  )
+})

package/test/sdk/product/usePageProductsQuery.browser.test.ts

@@ -0,0 +1,260 @@
+/**
+ * @vitest-environment jsdom
+ */
+
+import { renderHook } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const mockUseSession = vi.hoisted(() => vi.fn())
+const mockUseQuery = vi.hoisted(() => vi.fn())
+const mockUseLocalizedVariables = vi.hoisted(() => vi.fn())
+
+vi.mock('@generated', () => ({ gql: (query: unknown) => query }))
+vi.mock('discovery.config', () => ({
+  default: { deliveryPromise: { enabled: false } },
+}))
+vi.mock('@faststore/sdk', () => ({
+  useSearch: () => ({
+    state: { sort: 'score_desc', term: '', selectedFacets: [] },
+    itemsPerPage: 12,
+  }),
+}))
+vi.mock('src/sdk/session', () => ({ useSession: mockUseSession }))
+vi.mock('src/sdk/graphql/useQuery', () => ({ useQuery: mockUseQuery }))
+vi.mock('src/sdk/product/useLocalizedVariables', () => ({
+  useLocalizedVariables: mockUseLocalizedVariables,
+}))
+
+import {
+  hashContractScope,
+  useCreateUseGalleryPage,
+} from '../../../src/sdk/product/usePageProductsQuery'
+
+const serverManyProductsVariables = {
+  first: 12,
+  after: '0',
+  sort: 'score_desc' as const,
+  term: '',
+  selectedFacets: [
+    { key: 'category-1', value: 'computers---tablets' },
+    { key: 'channel', value: '{"salesChannel":"1"}' },
+    { key: 'locale', value: 'en-CA' },
+  ],
+  sponsoredCount: 3,
+}
+
+type GalleryProps = NonNullable<Parameters<typeof useCreateUseGalleryPage>[0]>
+
+const initialPages = {
+  search: { products: { pageInfo: { totalCount: 2 }, edges: [] } },
+} as unknown as GalleryProps['initialPages']
+
+const renderFirstGalleryPage = () => {
+  const { result: created } = renderHook(() =>
+    useCreateUseGalleryPage({ initialPages, serverManyProductsVariables })
+  )
+
+  return renderHook(() => created.current.useGalleryPage(0))
+}
+
+describe('useCreateUseGalleryPage', () => {
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('reuses the SSG first page for anonymous shoppers', () => {
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: null,
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: null })
+
+    const { result } = renderFirstGalleryPage()
+
+    expect(mockUseQuery).toHaveBeenCalledWith(
+      expect.anything(),
+      serverManyProductsVariables,
+      expect.objectContaining({ doNotRun: true })
+    )
+    expect(result.current.data).toBe(initialPages)
+  })
+
+  it('re-fetches the first page for B2B buyers so the contract assortment applies', () => {
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: { customerId: 'contract-137' },
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: null })
+
+    renderFirstGalleryPage()
+
+    expect(mockUseQuery).toHaveBeenCalledWith(
+      expect.anything(),
+      {
+        ...serverManyProductsVariables,
+        _contract: hashContractScope('contract-137'),
+      },
+      expect.objectContaining({ doNotRun: false })
+    )
+  })
+
+  it('still re-fetches for B2B buyers whose customerId resolves to an empty string', () => {
+    // `buildB2bSession` in @faststore/api can resolve `customerId` to `''`
+    // (see validateSessionHelpers.ts) even for a representative with an
+    // active contract. The fix must not depend on the value being truthy —
+    // only on the `b2b` session existing — or it silently falls back to the
+    // anonymous behavior (reusing the unfiltered SSG page).
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: { customerId: '' },
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: null })
+
+    renderFirstGalleryPage()
+
+    expect(mockUseQuery).toHaveBeenCalledWith(
+      expect.anything(),
+      { ...serverManyProductsVariables, _contract: hashContractScope('b2b') },
+      expect.objectContaining({ doNotRun: false })
+    )
+  })
+
+  it('hashes the contract scope to a stable value', () => {
+    // Golden value: catches a change to the hash itself, which the other
+    // tests miss because they derive their expectations from it.
+    expect(hashContractScope('contract-137')).toBe('185k3l4sd4t')
+  })
+
+  it('keeps the raw contract id out of the query variables', () => {
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: { customerId: 'contract-137', unitId: 'unit-42' },
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: null })
+
+    renderFirstGalleryPage()
+
+    // The variables go in the GET URL, so they must not carry the raw ids.
+    const variables = JSON.stringify(mockUseQuery.mock.calls.at(-1)?.[1])
+    expect(variables).not.toContain('contract-137')
+    expect(variables).not.toContain('unit-42')
+    expect(hashContractScope('contract-a')).not.toBe(
+      hashContractScope('contract-b')
+    )
+  })
+
+  it('tells B2B buyers apart by organizational unit when customerId is empty', () => {
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: { customerId: '', unitId: 'unit-42' },
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: null })
+
+    renderFirstGalleryPage()
+
+    expect(mockUseQuery).toHaveBeenCalledWith(
+      expect.anything(),
+      {
+        ...serverManyProductsVariables,
+        _contract: hashContractScope('unit-42'),
+      },
+      expect.objectContaining({ doNotRun: false })
+    )
+  })
+
+  it('re-fetches the first page when the buyer switches contract', () => {
+    const contractPage = {
+      search: { products: { pageInfo: { totalCount: 1 }, edges: [] } },
+    }
+
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: { customerId: 'contract-a' },
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: contractPage })
+
+    const { result: created } = renderHook(() =>
+      useCreateUseGalleryPage({ initialPages, serverManyProductsVariables })
+    )
+    const { rerender } = renderHook(() => created.current.useGalleryPage(0))
+
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: { customerId: 'contract-b' },
+      isValidating: false,
+    })
+    rerender()
+
+    expect(mockUseQuery).toHaveBeenLastCalledWith(
+      expect.anything(),
+      {
+        ...serverManyProductsVariables,
+        _contract: hashContractScope('contract-b'),
+      },
+      expect.objectContaining({ doNotRun: false })
+    )
+  })
+
+  it('stops scoping the first page once the B2B session ends', () => {
+    const contractPage = {
+      search: { products: { pageInfo: { totalCount: 1 }, edges: [] } },
+    }
+
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: { customerId: 'contract-a' },
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: contractPage })
+
+    const { result: created } = renderHook(() =>
+      useCreateUseGalleryPage({ initialPages, serverManyProductsVariables })
+    )
+    const { rerender } = renderHook(() => created.current.useGalleryPage(0))
+
+    mockUseSession.mockReturnValue({
+      postalCode: null,
+      b2b: null,
+      isValidating: false,
+    })
+    rerender()
+
+    expect(mockUseQuery).toHaveBeenLastCalledWith(
+      expect.anything(),
+      serverManyProductsVariables,
+      expect.objectContaining({ doNotRun: false })
+    )
+  })
+
+  it('ignores the postal code while deliveryPromise is disabled', () => {
+    mockUseSession.mockReturnValue({
+      postalCode: '01310-100',
+      b2b: null,
+      isValidating: false,
+    })
+    mockUseLocalizedVariables.mockReturnValue(serverManyProductsVariables)
+    mockUseQuery.mockReturnValue({ data: null })
+
+    const { result } = renderFirstGalleryPage()
+
+    expect(mockUseQuery).toHaveBeenCalledWith(
+      expect.anything(),
+      serverManyProductsVariables,
+      expect.objectContaining({ doNotRun: true })
+    )
+    expect(result.current.data).toBe(initialPages)
+  })
+})