@faststore/core 4.10.1-dev.5 → 4.10.1-dev.7

package/src/sdk/account/refreshToken.ts

@@ -1,10 +1,21 @@
 import fetch from 'isomorphic-unfetch'
 import { getStoreURL } from 'src/sdk/localization/useLocalizationConfig'
 import { sanitizeHost } from 'src/utils/utilities'
+import {
+  AUTHENTICATOR_REFRESH_TOKEN_PATH,
+  LEGACY_REFRESH_TOKEN_PATH,
+} from './refreshTokenPaths'
 
+/**
+ * Covers both refresh routes:
+ * - Authenticator: `{ authStatus: 'Success', refreshAfter: 1792717383 }`
+ *   (epoch seconds).
+ * - Legacy VTEX ID: `{ status: 'Success', refreshAfter: '2026-03-26T02:53:39+00:00' }`.
+ */
 export interface RefreshTokenResponse {
   status?: string
-  refreshAfter?: string
+  authStatus?: string
+  refreshAfter?: string | number
 }
 
 async function fetchWithRetry(
@@ -25,12 +36,12 @@ async function fetchWithRetry(
   return undefined
 }
 
-function getRefreshTokenUrl(): string {
+function getRefreshTokenUrl(path: string): string {
   if (globalThis.window !== undefined) {
-    return '/api/vtexid/refreshtoken/webstore'
+    return path
   }
 
-  return `${new URL(getStoreURL()).origin}/api/vtexid/refreshtoken/webstore`
+  return `${new URL(getStoreURL()).origin}${path}`
 }
 
 function getRefreshTokenHeaders(): HeadersInit {
@@ -45,10 +56,43 @@ function getRefreshTokenHeaders(): HeadersInit {
   return headers
 }
 
-export const refreshTokenRequest = async (): Promise<
-  RefreshTokenResponse | undefined
-> => {
-  return fetchWithRetry(getRefreshTokenUrl(), {
+export const isRefreshTokenSuccessful = (
+  result: RefreshTokenResponse | undefined
+): boolean => {
+  return (result?.authStatus ?? result?.status)?.toLowerCase?.() === 'success'
+}
+
+/**
+ * Whether the session belongs to a B2B buyer: one with an organizational unit
+ * (`unitId`) and a contract (`customerId`), the same rule the API uses to
+ * fill `session.b2b`.
+ */
+export const isB2BSession = (
+  session:
+    | {
+        b2b?: {
+          unitId?: string | null
+          customerId?: string | null
+        } | null
+      }
+    | null
+    | undefined
+): boolean => Boolean(session?.b2b?.unitId && session?.b2b?.customerId)
+
+/**
+ * Refresh route for the session. B2B sessions use the Authenticator route,
+ * which keeps the selected contract (`customerId`, `unitId`,
+ * `isRepresentative`). Every other session keeps the legacy VTEX ID route, as
+ * VTEX ID recommends. There is no fallback between them: like before, a failed
+ * refresh logs the shopper out.
+ */
+export const getRefreshTokenPath = (isB2B: boolean): string =>
+  isB2B ? AUTHENTICATOR_REFRESH_TOKEN_PATH : LEGACY_REFRESH_TOKEN_PATH
+
+export const refreshTokenRequest = async ({
+  isB2B = false,
+}: { isB2B?: boolean } = {}): Promise<RefreshTokenResponse | undefined> => {
+  return fetchWithRetry(getRefreshTokenUrl(getRefreshTokenPath(isB2B)), {
     credentials: 'include',
     headers: getRefreshTokenHeaders(),
     body: JSON.stringify({}),
@@ -56,8 +100,42 @@ export const refreshTokenRequest = async (): Promise<
   })
 }
 
-export const isRefreshTokenSuccessful = (
+/**
+ * Normalizes `refreshAfter` to epoch seconds as a string, the format stored in
+ * the session. Accepts epoch seconds (number or numeric string) and ISO dates.
+ * Returns `null` when the value is missing or unparseable.
+ */
+export const getRefreshAfterSeconds = (
   result: RefreshTokenResponse | undefined
-): boolean => {
-  return result?.status?.toLowerCase?.() === 'success'
+): string | null => {
+  const value = result?.refreshAfter
+
+  if (value === undefined || value === null || value === '') {
+    return null
+  }
+
+  const seconds =
+    typeof value === 'number' || /^\d+$/.test(value)
+      ? Number(value)
+      : new Date(value).getTime() / 1000
+
+  return Number.isFinite(seconds) ? String(Math.floor(seconds)) : null
 }
+
+/**
+ * How long to wait before refreshing again when a successful refresh carries
+ * no usable `refreshAfter`. Keeping the old, already-expired value would make
+ * every following session validation call the refresh route again.
+ */
+export const REFRESH_AFTER_FALLBACK_SECONDS = 60 * 60
+
+/**
+ * `refreshAfter` to store after a successful refresh: the value from the
+ * response, or a short fallback from now when the response has none.
+ */
+export const getNextRefreshAfter = (
+  result: RefreshTokenResponse | undefined,
+  nowSeconds = Math.floor(Date.now() / 1000)
+): string =>
+  getRefreshAfterSeconds(result) ??
+  String(nowSeconds + REFRESH_AFTER_FALLBACK_SECONDS)

package/src/sdk/account/refreshTokenPaths.ts

@@ -0,0 +1,25 @@
+/**
+ * VTEX ID refresh route. The recommended route for every non-B2B session.
+ * For B2B it drops the contract claims set by `switch-properties` and also
+ * writes the auth cookie on the parent domain.
+ */
+export const LEGACY_REFRESH_TOKEN_PATH = '/api/vtexid/refreshtoken/webstore'
+
+/**
+ * Authenticator refresh route, recommended for the B2B flow only. It keeps the
+ * contract claims (`customerId`, `unitId`, `isRepresentative`) and writes the
+ * auth cookie only on the request host.
+ */
+export const AUTHENTICATOR_REFRESH_TOKEN_PATH =
+  '/api/authenticator/v1/refreshtoken/webstore'
+
+/**
+ * Every path `vid_rt` can be scoped to. VTEX ID writes it only on the legacy
+ * path; Authenticator writes it on all three. The browser only sends it to
+ * these paths, so it never reaches any other route.
+ */
+export const VID_RT_PATHS = [
+  LEGACY_REFRESH_TOKEN_PATH,
+  '/api/authenticator/refreshtoken/webstore',
+  AUTHENTICATOR_REFRESH_TOKEN_PATH,
+] as const

package/src/sdk/account/useRefreshToken.ts

@@ -1,7 +1,12 @@
 import { useEffect, useState } from 'react'
 import { shouldBypassRefreshTokenBrowser } from 'src/utils/shouldBypassRefreshToken'
 import { logoutAndClearSession, sessionStore } from '../session'
-import { isRefreshTokenSuccessful, refreshTokenRequest } from './refreshToken'
+import {
+  getNextRefreshAfter,
+  isB2BSession,
+  isRefreshTokenSuccessful,
+  refreshTokenRequest,
+} from './refreshToken'
 
 export const useRefreshToken = (
   needsRefreshToken?: boolean,
@@ -26,13 +31,13 @@ export const useRefreshToken = (
       const currentSession = sessionStore.read() ?? sessionStore.readInitial()
 
       try {
-        const result = await refreshTokenRequest()
+        const result = await refreshTokenRequest({
+          isB2B: isB2BSession(currentSession),
+        })
 
         if (isRefreshTokenSuccessful(result)) {
           // Update session with new refreshAfter timestamp
-          const refreshAfter = String(
-            Math.floor(new Date(result?.refreshAfter).getTime() / 1000)
-          )
+          const refreshAfter = getNextRefreshAfter(result)
 
           sessionStore.set({
             ...currentSession,

package/src/sdk/product/isProductNotFound.ts

@@ -0,0 +1,13 @@
+/**
+ * Whether a product request failed because the product is not available to
+ * the shopper. A non-2xx BFF response reaches the client as `{ status }` (see
+ * `ParseInvalidRequest`), while a 2xx one keeps the GraphQL `extensions`.
+ */
+export const isProductNotFound = (error: unknown) => {
+  const { status, extensions } = (error ?? {}) as {
+    status?: number
+    extensions?: { type?: string }
+  }
+
+  return status === 404 || extensions?.type === 'NotFoundError'
+}

package/src/sdk/product/usePageProductsQuery.ts

@@ -69,6 +69,69 @@ export const query = gql(`
 
 const getKey = (object: any) => JSON.stringify(object)
 
+const isDeliveryPromiseEnabled = storeConfig.deliveryPromise?.enabled ?? false
+
+/**
+ * Cache-only keys that scope gallery pages to the shopper context. They make
+ * the local cache comparison (and the SWR key) miss when a page was loaded for
+ * another context (e.g. the anonymous SSG page). They are not declared by the
+ * operation, so the API ignores them, but they are still sent with the
+ * variables, which go in the URL because this query is a GET operation.
+ * - `_postalCode`: pages are invalidated on region change. Only applied when
+ *   deliveryPromise is enabled to avoid unnecessary cache fragmentation.
+ * - `_contract`: the B2B contract assortment is applied server-side from the
+ *   session cookie, so it never shows up in the query variables. Keyed off
+ *   the presence of a `b2b` session (not `customerId`'s value) because
+ *   `customerId` can resolve to an empty string for a legitimate B2B buyer
+ *   (see `buildB2bSession` in `@faststore/api`). The fallback chain still
+ *   forces the re-fetch for them: the real `customerId`, when present, keeps
+ *   invalidating the cache on contract switch; otherwise the organizational
+ *   unit (`unitId`) tells buyers of different units apart; a generic marker is
+ *   the last resort. Since the value ends up in the URL, it is hashed so the
+ *   raw contract or unit id is not written to access, CDN or RUM logs as is.
+ *   These ids are not secrets (the session already hands them to the
+ *   browser), so the hash is cosmetic, not a privacy control: it is unkeyed
+ *   and a guessable id can be recovered from it. The URL still differs per
+ *   contract, so a contract page is never served from the anonymous page's
+ *   cache entry.
+ */
+const getShopperScope = ({
+  postalCode,
+  contract,
+}: {
+  postalCode?: string | null
+  contract?: string | null
+}) => ({
+  ...(isDeliveryPromiseEnabled && { _postalCode: postalCode ?? '' }),
+  ...(contract && { _contract: hashContractScope(contract) }),
+})
+
+/** The id a B2B session is scoped by, or `null` outside a B2B session. */
+const getContractScope = (
+  b2b?: { customerId?: string | null; unitId?: string | null } | null
+) => (b2b ? b2b.customerId || b2b.unitId || 'b2b' : null)
+
+/**
+ * 53-bit string hash (cyrb53): wide enough that two contracts in the same
+ * browser never share a cache key in practice, without exposing the raw id.
+ */
+export function hashContractScope(value: string) {
+  let h1 = 0xdeadbeef
+  let h2 = 0x41c6ce57
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0
+    h1 = Math.imul(h1 ^ code, 2654435761)
+    h2 = Math.imul(h2 ^ code, 1597334677)
+  }
+  h1 =
+    Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^
+    Math.imul(h2 ^ (h2 >>> 13), 3266489909)
+  h2 =
+    Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^
+    Math.imul(h1 ^ (h1 >>> 13), 3266489909)
+  return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(36)
+}
+
 interface UseCreateUseGalleryPageProps {
   initialPages: ClientManyProductsQueryWithSearchIdQuery
   serverManyProductsVariables: ClientManyProductsQueryWithSearchIdQueryVariables
@@ -82,21 +145,17 @@ export const useCreateUseGalleryPage = (
 ) => {
   const initialPages = params?.initialPages?.search ? [params.initialPages] : []
 
-  // Seed the cache with the same region-aware key shape that useGalleryPage uses,
-  // so hasSameVariables correctly matches on first mount and avoids an unnecessary
-  // re-fetch of the SSR-loaded page.
-  const isDeliveryPromiseEnabled = storeConfig.deliveryPromise?.enabled ?? false
+  // Seed the cache with the same key shape that useGalleryPage uses, so
+  // hasSameVariables matches on first mount and avoids an unnecessary re-fetch
+  // of the SSR-loaded page. The SSG page is built without a buyer, so it is
+  // seeded without a contract: B2B buyers re-fetch it with their assortment.
   const { postalCode } = useSession()
   const initialVariables = params?.serverManyProductsVariables
     ? [
-        getKey(
-          isDeliveryPromiseEnabled
-            ? {
-                ...params.serverManyProductsVariables,
-                _postalCode: postalCode ?? '',
-              }
-            : params.serverManyProductsVariables
-        ),
+        getKey({
+          ...params.serverManyProductsVariables,
+          ...getShopperScope({ postalCode }),
+        }),
       ]
     : []
 
@@ -113,7 +172,7 @@ export const useCreateUseGalleryPage = (
       itemsPerPage,
     } = useSearch()
 
-    const { postalCode, isValidating: isSessionValidating } = useSession()
+    const { postalCode, b2b, isValidating: isSessionValidating } = useSession()
 
     const localizedVariables = useLocalizedVariables({
       first: itemsPerPage,
@@ -123,15 +182,15 @@ export const useCreateUseGalleryPage = (
       selectedFacets,
     })
 
-    // Include postalCode in the cache key so pages are invalidated on region change.
-    // _postalCode is not sent to the API — it only affects the local cache comparison.
-    // Only applied when deliveryPromise is enabled to avoid unnecessary cache fragmentation.
+    // Keyed on the contract id, not the `b2b` object, which is rebuilt on
+    // every session update.
+    const contract = getContractScope(b2b)
     const localizedVariablesWithRegion = useMemo(
-      () =>
-        isDeliveryPromiseEnabled
-          ? { ...localizedVariables, _postalCode: postalCode ?? '' }
-          : localizedVariables,
-      [localizedVariables, postalCode]
+      () => ({
+        ...localizedVariables,
+        ...getShopperScope({ postalCode, contract }),
+      }),
+      [localizedVariables, postalCode, contract]
     )
 
     const hasSameVariables = deepEquals(

package/src/sdk/product/useProductNotFoundRedirect.ts

@@ -0,0 +1,43 @@
+import { useRouter } from 'next/router'
+import { useEffect, useRef } from 'react'
+
+import { isProductNotFound } from './isProductNotFound'
+
+/**
+ * The PDP is statically generated without the shopper's session, so an
+ * assortment restriction (e.g. a B2B contract limited to a collection) is only
+ * enforced when the client refetches the product. Replaces the PDP with the
+ * store's 404 page when that refetch says the product is not available to the
+ * shopper. The URL becomes `/404`: passing the product path as the `as`
+ * argument would make Next load the PDP's data for the 404 page, which expects
+ * a different shape and crashes.
+ *
+ * Applies to every shopper: the API rejects the product from the
+ * `vtex_segment` assortment, the same rule Intelligent Search applies to
+ * listings, whether or not the session is B2B.
+ *
+ * Returns whether the PDP must keep its loading state instead of the product's
+ * price and buy button while the redirect is pending. Without it, the failed
+ * refetch falls back to the static product and its price shows until the 404
+ * page loads.
+ */
+export const useProductNotFoundRedirect = (error: unknown) => {
+  const router = useRouter()
+  const shouldRedirect = isProductNotFound(error)
+  // The router changes identity on route events, which re-runs the effect.
+  // Navigate once per not-found so a pending redirect is not restarted.
+  const hasRedirected = useRef(false)
+
+  useEffect(() => {
+    if (!shouldRedirect) {
+      hasRedirected.current = false
+      return
+    }
+    if (hasRedirected.current) return
+
+    hasRedirected.current = true
+    router.replace('/404')
+  }, [shouldRedirect, router])
+
+  return shouldRedirect
+}

package/src/sdk/product/useProductQuery.ts

@@ -6,8 +6,11 @@ import type {
   ClientProductQueryQueryVariables,
 } from '@generated/graphql'
 
+import { request } from '../graphql/request'
+import { onErrorRetry } from '../graphql/retryPolicy'
 import { useQuery } from '../graphql/useQuery'
 import { useSession } from '../session'
+import { isProductNotFound } from './isProductNotFound'
 
 const query = gql(`
   query ClientProductQuery($locator: [IStoreSelectedFacet!]!) {
@@ -18,6 +21,19 @@ const query = gql(`
   }
 `)
 
+const nextTick = () => new Promise<void>((resolve) => setTimeout(resolve))
+
+const fetchProduct = async <T extends ClientProductQueryQuery>(
+  variables: ClientProductQueryQueryVariables
+) => {
+  await nextTick()
+
+  return (await request<
+    ClientProductQueryQuery & T,
+    ClientProductQueryQueryVariables
+  >(query, variables)) as ClientProductQueryQuery & T
+}
+
 export const useProductQuery = <T extends ClientProductQueryQuery>(
   productID: string,
   fallbackData?: T
@@ -45,5 +61,18 @@ export const useProductQuery = <T extends ClientProductQueryQuery>(
   >(query, variables, {
     fallbackData,
     revalidateOnMount: true,
+    // `useQuery`'s default fetcher never settles when `request` throws, so SWR
+    // never exposes `error` (e.g. the B2B assortment 404 the PDP reacts to).
+    // This fetcher keeps the same deferral but forwards the rejection.
+    fetcher: () => fetchProduct<T>(variables),
+    // A not-found is the answer (the product is not available to this
+    // shopper), not a transient failure, so it is not retried. It is matched
+    // the same way the PDP redirect matches it. Other errors follow the shared
+    // retry policy.
+    onErrorRetry: (error, key, config, revalidate, opts) => {
+      if (isProductNotFound(error)) return
+
+      onErrorRetry(error, key, config, revalidate, opts)
+    },
   })
 }

package/src/sdk/session/index.ts

@@ -12,6 +12,8 @@ import { shouldBypassRefreshTokenBrowser } from 'src/utils/shouldBypassRefreshTo
 import { filterChannel } from 'src/utils/utilities'
 import storeConfig from '../../../discovery.config'
 import {
+  getNextRefreshAfter,
+  isB2BSession,
   isRefreshTokenSuccessful,
   refreshTokenRequest,
 } from '../account/refreshToken'
@@ -94,14 +96,12 @@ export const mutation = gql(`
 `)
 
 async function handleRefreshToken(session: Session): Promise<Session | null> {
-  const result = await refreshTokenRequest()
+  const result = await refreshTokenRequest({ isB2B: isB2BSession(session) })
 
   if (isRefreshTokenSuccessful(result)) {
     return {
       ...session,
-      refreshAfter: String(
-        Math.floor(new Date(result?.refreshAfter).getTime() / 1000)
-      ),
+      refreshAfter: getNextRefreshAfter(result),
     }
   }
 

package/src/utils/getCheckoutParentDomain.ts

@@ -0,0 +1,53 @@
+import storeConfig from 'discovery.config'
+
+const parseHostname = (url: unknown): string | undefined => {
+  if (typeof url !== 'string' || !url) {
+    return undefined
+  }
+
+  try {
+    return new URL(url).hostname.toLowerCase()
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Common parent of the store host and the checkout host (`secureSubdomain`)
+ * when checkout runs on a sibling host: `www.store.com` and `secure.store.com`
+ * share `store.com`.
+ *
+ * Returns `undefined` when a cookie scoped to the store host already reaches
+ * checkout (same host, or checkout on a subdomain of it), and when the hosts
+ * share fewer than two labels.
+ */
+export const getCheckoutParentDomain = (
+  hostname: string
+): string | undefined => {
+  const checkoutHostname = parseHostname(storeConfig.secureSubdomain)
+
+  if (!checkoutHostname) {
+    return undefined
+  }
+
+  const storeLabels = hostname.toLowerCase().split('.').reverse()
+  const checkoutLabels = checkoutHostname.split('.').reverse()
+  const common: string[] = []
+
+  for (
+    let index = 0;
+    index < Math.min(storeLabels.length, checkoutLabels.length) &&
+    storeLabels[index] === checkoutLabels[index];
+    index++
+  ) {
+    common.unshift(storeLabels[index])
+  }
+
+  if (common.length < 2) {
+    return undefined
+  }
+
+  const parent = common.join('.')
+
+  return parent === hostname.toLowerCase() ? undefined : parent
+}

package/src/utils/trustedForwardedHost.ts

@@ -2,6 +2,24 @@
 // characters such as ";" or spaces would inject cookie attributes.
 const HOSTNAME_PATTERN = /^[a-z0-9.-]+$/
 
+/**
+ * Hosts whose upstream cookie domain does not match the browser host (previews
+ * and local development). Cookies served there are written host-only.
+ */
+export const HOST_ONLY_COOKIE_HOST_SUFFIXES = [
+  'localhost',
+  '.vtex.app',
+  '.localhost',
+]
+
+/**
+ * Whether `host` can be written as a Set-Cookie Domain attribute without
+ * injecting extra attributes.
+ */
+export function isCookieSafeHostname(host: string): boolean {
+  return HOSTNAME_PATTERN.test(host.toLowerCase())
+}
+
 /**
  * An entry starting with "." matches subdomains only; any other entry matches
  * the host itself and its subdomains. Matching is anchored on a label boundary,

package/test/components/account/Layout.test.tsx

@@ -60,7 +60,7 @@ describe('Layout', () => {
     mockUseSession.mockReturnValue({ b2b: { unitId: 'unit-1' } })
 
     render(
-      <Layout accountName="Jane Doe" isRepresentative={false}>
+      <Layout accountName="Jane Doe" isB2BBuyer={false}>
         content
       </Layout>
     )

package/test/components/account/Menu.browser.test.tsx

@@ -65,7 +65,7 @@ describe('Menu', () => {
 
   it('mounts the OrganizationDrawer with initialView "switch" when Switch is clicked', () => {
     mockUseSession.mockReturnValue({
-      b2b: { unitId: 'unit-1', isRepresentative: true },
+      b2b: { unitId: 'unit-1', customerId: 'contract-1' },
     })
 
     render(<Menu accountName="Jane" items={items} />)
@@ -79,19 +79,21 @@ describe('Menu', () => {
       expect.objectContaining({
         isOpen: true,
         initialView: 'switch',
-        isRepresentative: true,
+        isB2BBuyer: true,
       })
     )
   })
 
-  it('passes isRepresentative as a boolean even when b2b.isRepresentative is undefined', () => {
-    mockUseSession.mockReturnValue({ b2b: { unitId: 'unit-1' } })
+  it('passes isB2BBuyer for a B2B session without the isRepresentative flag', () => {
+    mockUseSession.mockReturnValue({
+      b2b: { unitId: 'unit-1', isRepresentative: false },
+    })
 
     render(<Menu accountName="Jane" items={items} />)
     fireEvent.click(screen.getByRole('button', { name: 'Switch' }))
 
     expect(mockOrganizationDrawer).toHaveBeenCalledWith(
-      expect.objectContaining({ isRepresentative: false })
+      expect.objectContaining({ isB2BBuyer: true })
     )
   })