@faststore/core 4.10.1-dev.5 → 4.10.1-dev.7

package/test/sdk/product/useProductNotFoundRedirect.browser.test.ts

@@ -0,0 +1,83 @@
+/**
+ * @vitest-environment jsdom
+ */
+
+import { renderHook } from '@testing-library/react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const mockReplace = vi.hoisted(() => vi.fn())
+
+vi.mock('next/router', () => ({
+  useRouter: () => ({ replace: mockReplace }),
+}))
+
+import { useProductNotFoundRedirect } from '../../../src/sdk/product/useProductNotFoundRedirect'
+
+describe('useProductNotFoundRedirect', () => {
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('replaces the PDP with the 404 page when the BFF answers 404', () => {
+    renderHook(() => useProductNotFoundRedirect({ status: 404 }))
+
+    expect(mockReplace).toHaveBeenCalledWith('/404')
+  })
+
+  it('redirects without waiting for the session', () => {
+    // A segment restriction rejects the product for any shopper, B2B or not,
+    // so the hook does not read the session at all.
+    const { result } = renderHook(() =>
+      useProductNotFoundRedirect({ status: 404 })
+    )
+
+    expect(result.current).toBe(true)
+    expect(mockReplace).toHaveBeenCalledTimes(1)
+  })
+
+  it('navigates once even when the router changes identity', () => {
+    // The mocked `useRouter` returns a new object on every render.
+    const { rerender } = renderHook(() =>
+      useProductNotFoundRedirect({ status: 404 })
+    )
+    rerender()
+    rerender()
+
+    expect(mockReplace).toHaveBeenCalledTimes(1)
+  })
+
+  it('redirects again for a later not-found after one that cleared', () => {
+    const { rerender } = renderHook(
+      ({ error }: { error: unknown }) => useProductNotFoundRedirect(error),
+      { initialProps: { error: { status: 404 } as unknown } }
+    )
+    rerender({ error: undefined })
+    rerender({ error: { status: 404 } })
+
+    expect(mockReplace).toHaveBeenCalledTimes(2)
+  })
+
+  it('recognizes a NotFoundError carried in the GraphQL extensions', () => {
+    renderHook(() =>
+      useProductNotFoundRedirect({ extensions: { type: 'NotFoundError' } })
+    )
+
+    expect(mockReplace).toHaveBeenCalledTimes(1)
+  })
+
+  it('does nothing while the refetch has no error', () => {
+    const { result } = renderHook(() => useProductNotFoundRedirect(undefined))
+
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(result.current).toBe(false)
+  })
+
+  it('does nothing for errors other than not found', () => {
+    const { result } = renderHook(() =>
+      useProductNotFoundRedirect({ status: 500 })
+    )
+
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(result.current).toBe(false)
+  })
+})

package/test/sdk/product/useProductQuery.browser.test.ts

@@ -0,0 +1,154 @@
+/**
+ * @vitest-environment jsdom
+ */
+
+import { renderHook, waitFor } from '@testing-library/react'
+import { createElement, type ReactNode } from 'react'
+import { SWRConfig } from 'swr'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const mockRequest = vi.hoisted(() => vi.fn())
+const mockReplace = vi.hoisted(() => vi.fn())
+const mockUseSession = vi.hoisted(() => vi.fn())
+const mockSharedRetry = vi.hoisted(() => vi.fn())
+
+vi.mock('@generated', () => ({
+  gql: () => ({
+    __meta__: { operationName: 'ClientProductQuery', operationHash: 'hash' },
+  }),
+}))
+vi.mock('src/sdk/graphql/request', () => ({ request: mockRequest }))
+vi.mock('src/utils/cookieCacheBusting', () => ({
+  getClientCacheBustingValue: () => null,
+}))
+vi.mock('src/sdk/session', () => ({ useSession: mockUseSession }))
+// Spies on the shared retry policy while keeping its behavior. SWR calls
+// `onErrorRetry` synchronously when the error lands, so whether a retry was
+// scheduled is known without waiting on the clock.
+vi.mock('src/sdk/graphql/retryPolicy', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('src/sdk/graphql/retryPolicy')>()
+  mockSharedRetry.mockImplementation(actual.onErrorRetry)
+
+  return { ...actual, onErrorRetry: mockSharedRetry }
+})
+vi.mock('next/router', () => ({
+  useRouter: () => ({ replace: mockReplace }),
+}))
+
+import { useProductNotFoundRedirect } from '../../../src/sdk/product/useProductNotFoundRedirect'
+import { useProductQuery } from '../../../src/sdk/product/useProductQuery'
+
+const fallbackData = { product: { id: '123' } } as any
+
+// The real PDP wiring: the refetch error feeds the redirect hook.
+const usePdpClientQuery = () => {
+  const productQuery = useProductQuery('123', fallbackData)
+  useProductNotFoundRedirect(productQuery.error)
+
+  return productQuery
+}
+
+// SWR's cache is global; isolate it so a test never reads another one's result.
+const isolatedCache = ({ children }: { children: ReactNode }) =>
+  createElement(SWRConfig, { value: { provider: () => new Map() } }, children)
+
+describe('useProductQuery', () => {
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('exposes a failed refetch as `error` and stops validating', async () => {
+    mockUseSession.mockReturnValue({
+      channel: '{"salesChannel":"1"}',
+      locale: 'en-US',
+      b2b: null,
+    })
+    mockRequest.mockRejectedValue({ status: 404, message: 'Not Found' })
+
+    const { result } = renderHook(usePdpClientQuery, { wrapper: isolatedCache })
+
+    await waitFor(() => expect(result.current.error).toEqual(expect.anything()))
+
+    expect(result.current.error).toMatchObject({ status: 404 })
+    expect(result.current.isValidating).toBe(false)
+    // The data stays the static product, and the failed call is not retried.
+    expect(result.current.data).toBe(fallbackData)
+    expect(mockRequest).toHaveBeenCalledTimes(1)
+    // Shoppers without a B2B session are sent to the 404 page too.
+    await waitFor(() => expect(mockReplace).toHaveBeenCalledWith('/404'))
+  })
+
+  it('does not retry a NotFoundError carried in the GraphQL extensions', async () => {
+    mockUseSession.mockReturnValue({
+      channel: '{"salesChannel":"1"}',
+      locale: 'en-US',
+      b2b: { customerId: 'contract-137' },
+    })
+    mockRequest.mockRejectedValue({ extensions: { type: 'NotFoundError' } })
+
+    renderHook(usePdpClientQuery, { wrapper: isolatedCache })
+
+    await waitFor(() => expect(mockReplace).toHaveBeenCalledWith('/404'))
+    // The shared policy is what schedules a retry; it is never reached.
+    expect(mockSharedRetry).not.toHaveBeenCalled()
+    expect(mockRequest).toHaveBeenCalledTimes(1)
+  })
+
+  it('sends a B2B shopper to the 404 page when the refetch answers 404', async () => {
+    mockUseSession.mockReturnValue({
+      channel: '{"salesChannel":"1"}',
+      locale: 'en-US',
+      b2b: { customerId: 'contract-137' },
+    })
+    mockRequest.mockRejectedValue({ status: 404, message: 'Not Found' })
+
+    renderHook(usePdpClientQuery, { wrapper: isolatedCache })
+
+    await waitFor(() => expect(mockReplace).toHaveBeenCalledWith('/404'))
+  })
+
+  it('retries a transient failure instead of treating it as not found', async () => {
+    mockUseSession.mockReturnValue({
+      channel: '{"salesChannel":"1"}',
+      locale: 'en-US',
+      b2b: { customerId: 'contract-137' },
+    })
+    const fresh = { product: { id: '123', name: 'Fresh' } }
+    mockRequest
+      .mockRejectedValueOnce({ status: 500, message: 'Internal Server Error' })
+      .mockResolvedValue(fresh)
+
+    const fastRetries = ({ children }: { children: ReactNode }) =>
+      createElement(
+        SWRConfig,
+        { value: { provider: () => new Map(), errorRetryInterval: 1 } },
+        children
+      )
+
+    const { result } = renderHook(usePdpClientQuery, { wrapper: fastRetries })
+
+    await waitFor(() => expect(result.current.data).toEqual(fresh))
+
+    expect(mockRequest).toHaveBeenCalledTimes(2)
+    expect(mockSharedRetry).toHaveBeenCalledTimes(1)
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+
+  it('keeps the product and does not redirect when the refetch succeeds', async () => {
+    mockUseSession.mockReturnValue({
+      channel: '{"salesChannel":"1"}',
+      locale: 'en-US',
+      b2b: { customerId: 'contract-137' },
+    })
+    const fresh = { product: { id: '123', name: 'Fresh' } }
+    mockRequest.mockResolvedValue(fresh)
+
+    const { result } = renderHook(usePdpClientQuery, { wrapper: isolatedCache })
+
+    await waitFor(() => expect(result.current.data).toEqual(fresh))
+
+    expect(result.current.error).toBeUndefined()
+    expect(mockReplace).not.toHaveBeenCalled()
+  })
+})

package/test/sdk/session/refreshTokenRoute.browser.test.ts

@@ -0,0 +1,106 @@
+import type { Session } from '@faststore/sdk'
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from 'vitest'
+
+const mockRequest = vi.hoisted(() => vi.fn())
+const mockRefreshTokenRequest = vi.hoisted(() => vi.fn())
+
+vi.mock('../../../src/sdk/graphql/request', () => ({
+  request: mockRequest,
+}))
+
+// Keeps the real `isB2BSession`, so the route choice is exercised end to end.
+vi.mock('../../../src/sdk/account/refreshToken', async (importOriginal) => ({
+  ...(await importOriginal<
+    typeof import('../../../src/sdk/account/refreshToken')
+  >()),
+  refreshTokenRequest: mockRefreshTokenRequest,
+}))
+
+import storeConfig from '../../../discovery.config'
+import { validateSession } from '../../../src/sdk/session'
+
+// An already expired `refreshAfter` (in seconds) triggers the refresh.
+const expiredSession: Session = {
+  locale: 'en-US',
+  currency: { code: 'USD', symbol: '$' },
+  country: 'USA',
+  channel: '{"salesChannel":"1","regionId":""}',
+  deliveryMode: null,
+  addressType: null,
+  city: null,
+  postalCode: '10001',
+  geoCoordinates: null,
+  person: null,
+  b2b: null,
+  marketingData: null,
+  refreshAfter: '1',
+}
+
+const withB2b = (b2b: Partial<NonNullable<Session['b2b']>>) =>
+  ({ ...expiredSession, b2b }) as Session
+
+// The store validates its initial session when the module loads. Let that
+// call settle once, so no test depends on calls left by another one.
+beforeAll(async () => {
+  mockRequest.mockResolvedValue({ validateSession: null })
+  await vi.waitFor(() => expect(mockRequest).toHaveBeenCalled())
+})
+
+describe('validateSession refresh route', () => {
+  const originalLocation = window.location
+  const originalRefreshToken = storeConfig.experimental.refreshToken
+
+  beforeEach(() => {
+    // Local hosts skip the refresh, so run on a production host.
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: { ...originalLocation, hostname: 'brandless.fast.store' },
+    })
+    storeConfig.experimental.refreshToken = true
+    mockRequest.mockReset()
+    mockRequest.mockResolvedValue({ validateSession: null })
+    mockRefreshTokenRequest.mockReset()
+    mockRefreshTokenRequest.mockResolvedValue({
+      authStatus: 'Success',
+      refreshAfter: Math.floor(Date.now() / 1000) + 3600,
+    })
+  })
+
+  afterEach(() => {
+    storeConfig.experimental.refreshToken = originalRefreshToken
+    Object.defineProperty(window, 'location', {
+      configurable: true,
+      value: originalLocation,
+    })
+  })
+
+  it('uses the Authenticator route for a buyer with a unit and a contract', async () => {
+    await validateSession(
+      withB2b({ unitId: 'unit-1', customerId: 'contract-1' })
+    )
+
+    expect(mockRefreshTokenRequest).toHaveBeenCalledWith({ isB2B: true })
+  })
+
+  it('keeps the legacy route when `b2b` has no unit or contract', async () => {
+    // `b2b` exists for every isRepresentative token, which can be true
+    // outside B2B.
+    await validateSession(withB2b({ unitId: '', customerId: '' }))
+
+    expect(mockRefreshTokenRequest).toHaveBeenCalledWith({ isB2B: false })
+  })
+
+  it('keeps the legacy route without a B2B session', async () => {
+    await validateSession(expiredSession)
+
+    expect(mockRefreshTokenRequest).toHaveBeenCalledWith({ isB2B: false })
+  })
+})

package/test/sdk/session/validateSession.browser.test.ts

@@ -16,7 +16,10 @@ vi.mock('../../../src/sdk/graphql/request', () => ({
   request: mockRequest,
 }))
 
-vi.mock('../../../src/sdk/account/refreshToken', () => ({
+vi.mock('../../../src/sdk/account/refreshToken', async (importOriginal) => ({
+  ...(await importOriginal<
+    typeof import('../../../src/sdk/account/refreshToken')
+  >()),
   refreshTokenRequest: mockRefreshTokenRequest,
   isRefreshTokenSuccessful: () => true,
 }))

package/test/utils/trustedForwardedHost.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 
 import {
+  isCookieSafeHostname,
   singleForwardedHost,
   isHostAllowed,
   removeCookieDomain,
@@ -103,3 +104,23 @@ describe('removeCookieDomain', () => {
     expect(removeCookieDomain('a=1; path=/')).toBe('a=1; path=/')
   })
 })
+
+describe('isCookieSafeHostname', () => {
+  it.each(['store.example.com', 'b2b-store.vtexfaststore.com', 'Store.COM'])(
+    'accepts %s',
+    (host) => {
+      expect(isCookieSafeHostname(host)).toBe(true)
+    }
+  )
+
+  it.each([
+    'store.com;evil=1',
+    'store.com path=/',
+    'store.com,other.com',
+    'store.com\r\nSet-Cookie: evil=1',
+    'store.com%0d%0a',
+    '',
+  ])('rejects %j', (host) => {
+    expect(isCookieSafeHostname(host)).toBe(false)
+  })
+})

package/src/sdk/account/getIsRepresentative.ts

@@ -1,20 +0,0 @@
-import { parse } from 'cookie'
-import { parseJwt } from 'src/utils/getCookie'
-
-type GetIsRepresentativeParams = {
-  headers?: Record<string, string>
-  account: string
-}
-
-export function getIsRepresentative({
-  headers,
-  account,
-}: GetIsRepresentativeParams): boolean {
-  const authCookie = parse(headers?.cookie ?? '')?.[
-    'VtexIdclientAutCookie_' + account
-  ]
-  const jwt = parseJwt(authCookie)
-
-  const isRepresentative = jwt?.isRepresentative
-  return !!isRepresentative
-}