@faststore/core 4.10.1-dev.6 → 4.10.1-dev.7

package/@generated/schema.graphql

@@ -1280,7 +1280,7 @@ type StoreAuthor {
 
 type StoreB2B {
   customerId: String!
-  isRepresentative: Boolean
+  isRepresentative: Boolean @deprecated(reason: "Always true when `b2b` is set: a B2B session is identified by `unitId` and `customerId`. Check that `b2b` is not null instead. Scheduled for removal in the next major.")
   unitName: String
   unitId: String
   firstName: String

package/CHANGELOG.md

@@ -3,6 +3,35 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.10.1-dev.7](https://github.com/vtex/faststore/compare/v4.10.1-dev.6...v4.10.1-dev.7) (2026-10-28)
+
+### Bug Fixes
+
+- **api:** apply the unit and contract rule to accountProfile and guard non-string claims ([ab97c85](https://github.com/vtex/faststore/commit/ab97c85951e0c4b1a4f0f57a0e9a49560b74a81b))
+- **api:** identify B2B sessions by organizational unit and contract ([36b7dc6](https://github.com/vtex/faststore/commit/36b7dc6eead7c8dd0ae38b15d4020b35ddafe8d2))
+- **core:** address Sonar findings on the PDP 404 redirect ([47ccb81](https://github.com/vtex/faststore/commit/47ccb81b741a48d14a7c8da5361e23b08c15d3ca))
+- **core:** expire parent-domain auth cookies on contract switch ([abe0845](https://github.com/vtex/faststore/commit/abe0845bcb487d1998294aab5ee5fd3a91e269e7))
+- **core:** keep a single refresh route per session, like main ([afd6ce9](https://github.com/vtex/faststore/commit/afd6ce90126830d0c67f9e6bdf9521f95345c9f6))
+- **core:** keep IP hosts host-only and Secure by scheme in switch-contract ([20ab5bf](https://github.com/vtex/faststore/commit/20ab5bf951b4be0dbb5ec09263b1e0c0aa32571e))
+- **core:** keep switch-contract cookies host-only on previews ([940e76e](https://github.com/vtex/faststore/commit/940e76e6751293592cdb8b60d581be42c8c8e8dd))
+- **core:** keep the PDP loading until the B2B 404 redirect ([7dc8008](https://github.com/vtex/faststore/commit/7dc80084c23e85e38d456a7bde0f505f38d11649))
+- **core:** keep the switched contract on a sibling checkout host ([3b69fad](https://github.com/vtex/faststore/commit/3b69fad4594699c5b395ce86dbf19cb1821eba97))
+- **core:** read the connection when x-forwarded-proto is absent ([6d4a7fa](https://github.com/vtex/faststore/commit/6d4a7fa9902d6d486e239001aeac94b51c1d06f6))
+- **core:** redirect to /404 without reusing PDP path as data source ([158e653](https://github.com/vtex/faststore/commit/158e65305048eb3cf4d275324eef00d0c5bcb152))
+- **core:** redirect to the 404 page for any shopper out of the assortment ([9ba660d](https://github.com/vtex/faststore/commit/9ba660d3f513512fd4bc0c27fb1750c6211a9182))
+- **core:** redirect to the 404 page once per not-found product ([17bc72b](https://github.com/vtex/faststore/commit/17bc72b35291b9a847e1550555ecdaeb7805c40c))
+- **core:** refresh the token through the Authenticator route ([8da50ef](https://github.com/vtex/faststore/commit/8da50efb6d9924385c2e2be98cdf0ca9a0564891))
+- **core:** relay vid_rt on contract switch and bound the refreshAfter fallback ([d154bff](https://github.com/vtex/faststore/commit/d154bffc6523b51f391da0db928234223f693e8e))
+- **core:** relay vid_rt on contract switch only with refresh token on ([0111217](https://github.com/vtex/faststore/commit/0111217b01079d4efdbd86bdee7be90a08bac8cf))
+- **core:** retry transient PDP refetch failures, not 404s ([638f8a4](https://github.com/vtex/faststore/commit/638f8a47d878256239b4e1e43987fc6e287dade5))
+- **core:** scope switch-contract auth cookie like VTEX ID ([dcab25f](https://github.com/vtex/faststore/commit/dcab25f861e022ec460606e234a0e8ac8e2ef2f7))
+- **core:** scope the switched auth cookie on {account}.vtex.app ([b878178](https://github.com/vtex/faststore/commit/b87817886efd0632e61b30e6c4edb96975a4c05e))
+- **core:** show 404 on the PDP when a B2B shopper cannot access the product ([45485ad](https://github.com/vtex/faststore/commit/45485adfb31b67e5310144cf8d37a0867b51a19c))
+- **core:** skip retries for every not-found shape on the PDP refetch ([f7e808e](https://github.com/vtex/faststore/commit/f7e808ee4253ad5c966feb02c3b574abe5a742e3))
+- **core:** surface a failed PDP product refetch so the 404 redirect can run ([d6a0923](https://github.com/vtex/faststore/commit/d6a0923125a68308913b122f8c2584e0fb5fcf32))
+- **core:** use the Authenticator refresh route only for B2B sessions ([31d55cd](https://github.com/vtex/faststore/commit/31d55cd293b91646aba6147edfda84c37ba3fd17))
+- **core:** use the B2B refresh route only with a unit and a contract ([bd76720](https://github.com/vtex/faststore/commit/bd76720a84fd4bae3e6fbea2d8b1bf3afdaabe02))
+
 ## [4.10.1-dev.6](https://github.com/vtex/faststore/compare/v4.10.1-dev.5...v4.10.1-dev.6) (2026-10-28)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "4.10.1-dev.6",
+  "version": "4.10.1-dev.7",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -71,11 +71,11 @@
     "style-loader": "^3.3.1",
     "swr": "^2.2.5",
     "use-sync-external-store": "^1.6.0",
-    "@faststore/api": "4.10.1-dev.6",
-    "@faststore/lighthouse": "4.10.1-dev.6",
-    "@faststore/diagnostics": "4.10.1-dev.6",
-    "@faststore/ui": "4.10.1-dev.6",
-    "@faststore/sdk": "4.10.1-dev.6"
+    "@faststore/api": "4.10.1-dev.7",
+    "@faststore/diagnostics": "4.10.1-dev.7",
+    "@faststore/sdk": "4.10.1-dev.7",
+    "@faststore/ui": "4.10.1-dev.7",
+    "@faststore/lighthouse": "4.10.1-dev.7"
   },
   "devDependencies": {
     "@cypress/code-coverage": "^3.12.1",

package/src/components/account/Drawer/OrganizationDrawer/OrganizationDrawer.tsx

@@ -23,7 +23,7 @@ type OrganizationDrawerView = 'menu' | 'switch'
 type OrganizationDrawerProps = {
   isOpen: boolean
   closeDrawer: () => void
-  isRepresentative: boolean
+  isB2BBuyer: boolean
   /** Open straight into the contract switcher (My Account "Switch" button). */
   initialView?: OrganizationDrawerView
 }
@@ -142,7 +142,7 @@ export const doLogout = async (_event?: unknown) => {
 export const OrganizationDrawer = ({
   isOpen,
   closeDrawer,
-  isRepresentative,
+  isB2BBuyer,
   initialView = 'menu',
 }: OrganizationDrawerProps) => {
   const { fade, fadeOut } = useFadeEffect()
@@ -210,7 +210,7 @@ export const OrganizationDrawer = ({
               }
             />
             <OrganizationDrawerBody
-              isRepresentative={isRepresentative}
+              isB2BBuyer={isB2BBuyer}
               isOrgMember={isOrgMember}
             />
           </div>

package/src/components/account/Drawer/OrganizationDrawer/OrganizationDrawerBody.tsx

@@ -9,13 +9,13 @@ import {
   getMyAccountRoutes,
 } from 'src/sdk/account/getMyAccountRoutes'
 
-const ROUTES_ONLY_FOR_REPRESENTATIVE = [USER_DETAILS_ROUTE]
+const ROUTES_ONLY_FOR_B2B_BUYERS = new Set<string>([USER_DETAILS_ROUTE])
 
 export const OrganizationDrawerBody = ({
-  isRepresentative,
+  isB2BBuyer,
   isOrgMember,
 }: {
-  isRepresentative: boolean
+  isB2BBuyer: boolean
   isOrgMember: boolean
 }) => {
   const navigationLabels = useAccountNavigationLabels()
@@ -26,11 +26,9 @@ export const OrganizationDrawerBody = ({
   })
 
   const routes = (
-    isRepresentative
+    isB2BBuyer
       ? menuItems
-      : menuItems.filter(
-          ({ route }) => !ROUTES_ONLY_FOR_REPRESENTATIVE.includes(route)
-        )
+      : menuItems.filter(({ route }) => !ROUTES_ONLY_FOR_B2B_BUYERS.has(route))
   ).filter(
     ({ route }) => isOrgMember || !ROUTES_ONLY_FOR_B2B_MEMBERS.includes(route)
   )

package/src/components/account/Drawer/OrganizationSignInButton/OrganizationSignInButton.tsx

@@ -6,9 +6,12 @@ import { OrganizationDrawer } from '../OrganizationDrawer/OrganizationDrawer'
 
 export const OrganizationSignInButton = ({
   icon: { alt, icon },
+  isB2BBuyer,
   isRepresentative,
 }: {
   icon: { alt: string; icon: string }
+  isB2BBuyer?: boolean
+  /** @deprecated Use `isB2BBuyer`. */
   isRepresentative?: boolean
 }) => {
   const [isOpen, setIsOpen] = useState(false)
@@ -50,7 +53,7 @@ export const OrganizationSignInButton = ({
         <OrganizationDrawer
           isOpen={isOpen}
           closeDrawer={closeDrawer}
-          isRepresentative={isRepresentative}
+          isB2BBuyer={Boolean(isB2BBuyer ?? isRepresentative)}
         />
       )}
     </>

package/src/components/account/Layout/Layout.tsx

@@ -13,16 +13,16 @@ import styles from '../section.module.scss'
 
 export type LayoutProps = {
   accountName: string
-  isRepresentative?: boolean
+  isB2BBuyer?: boolean
   navigationLabels?: AccountNavigationLabels
 }
 
-const ROUTES_ONLY_FOR_REPRESENTATIVE = [USER_DETAILS_ROUTE]
+const ROUTES_ONLY_FOR_B2B_BUYERS = new Set<string>([USER_DETAILS_ROUTE])
 
 const Layout = ({
   children,
   accountName,
-  isRepresentative = true,
+  isB2BBuyer = true,
   navigationLabels,
 }: PropsWithChildren<LayoutProps>) => {
   const { b2b } = useSession()
@@ -41,11 +41,9 @@ const Layout = ({
   // page. `useAdHocCard` is a separate, finer gate that only affects the
   // Personal-tab rendering inside the page itself — it never hides the entry.
   const routes = (
-    isRepresentative
+    isB2BBuyer
       ? menuItems
-      : menuItems.filter(
-          ({ route }) => !ROUTES_ONLY_FOR_REPRESENTATIVE.includes(route)
-        )
+      : menuItems.filter(({ route }) => !ROUTES_ONLY_FOR_B2B_BUYERS.has(route))
   ).filter(
     ({ route }) => isOrgMember || !ROUTES_ONLY_FOR_B2B_MEMBERS.includes(route)
   )

package/src/components/account/Menu/Menu.tsx

@@ -79,7 +79,7 @@ const Menu = ({ avatarImageUrl, accountName, items }: MenuProps) => {
         <OrganizationDrawer
           isOpen
           closeDrawer={() => setIsSwitcherOpen(false)}
-          isRepresentative={Boolean(b2b?.isRepresentative)}
+          isB2BBuyer={Boolean(b2b)}
           initialView="switch"
         />
       )}

package/src/components/navigation/Navbar/Navbar.tsx

@@ -132,9 +132,9 @@ function Navbar({
   const isFaststoreMyAccountEnabled =
     storeConfig.experimental?.enableFaststoreMyAccount
 
-  const isRepresentative = b2b?.isRepresentative
+  const isB2BBuyer = Boolean(b2b)
 
-  const isOrganizationEnabled = isFaststoreMyAccountEnabled && isRepresentative
+  const isOrganizationEnabled = isFaststoreMyAccountEnabled && isB2BBuyer
   const isLocalizationEnabled =
     storeConfig.localization?.enabled &&
     localizationButton?.shouldDisplayLocalizationButton
@@ -240,7 +240,7 @@ function Navbar({
               <NavbarAccountArea
                 isSignInResolved={isSignInResolved}
                 isOrganizationEnabled={isOrganizationEnabled}
-                isRepresentative={isRepresentative}
+                isB2BBuyer={isB2BBuyer}
                 signInButton={signInButton}
                 ButtonSignIn={ButtonSignIn}
                 skeletonAttr="data-fs-navbar-signin-skeleton"

package/src/components/navigation/Navbar/NavbarAccountArea.tsx

@@ -10,9 +10,9 @@ type NavbarOverrides = ReturnType<typeof useOverrideComponents<'Navbar'>>
 export type NavbarAccountAreaProps = {
   /** Whether the B2B session has resolved enough to know what to render. */
   isSignInResolved: boolean
-  /** Whether the representative-only Organization sign-in area is enabled. */
+  /** Whether the Organization sign-in area for B2B buyers is enabled. */
   isOrganizationEnabled: boolean | undefined
-  isRepresentative?: boolean
+  isB2BBuyer?: boolean
   signInButton: SectionNavbarProps['signInButton']
   ButtonSignIn: NavbarOverrides['_experimentalButtonSignIn']
   /** Data attribute toggled on the loading skeleton (Navbar vs NavbarSlider). */
@@ -24,13 +24,13 @@ export type NavbarAccountAreaProps = {
 /**
  * Renders the account/sign-in area shared by the desktop Navbar and the
  * mobile NavbarSlider: a loading skeleton until the B2B session resolves,
- * then either the Organization sign-in button (representatives) or the
+ * then either the Organization sign-in button (B2B buyers) or the
  * storefront's own sign-in button.
  */
 export const NavbarAccountArea = ({
   isSignInResolved,
   isOrganizationEnabled,
-  isRepresentative,
+  isB2BBuyer,
   signInButton,
   ButtonSignIn,
   skeletonAttr,
@@ -48,7 +48,7 @@ export const NavbarAccountArea = ({
     return (
       <OrganizationSignInButton
         icon={signInButton.icon}
-        isRepresentative={isRepresentative}
+        isB2BBuyer={isB2BBuyer}
       />
     )
   }

package/src/components/navigation/NavbarSlider/NavbarSlider.tsx

@@ -54,8 +54,8 @@ function NavbarSlider({
   const isFaststoreMyAccountEnabled =
     storeConfig.experimental?.enableFaststoreMyAccount
 
-  const isRepresentative = b2b?.isRepresentative
-  const isOrganizationEnabled = isFaststoreMyAccountEnabled && isRepresentative
+  const isB2BBuyer = Boolean(b2b)
+  const isOrganizationEnabled = isFaststoreMyAccountEnabled && isB2BBuyer
 
   const isLocalizationEnabled =
     storeConfig.localization?.enabled &&
@@ -92,7 +92,7 @@ function NavbarSlider({
           <NavbarAccountArea
             isSignInResolved={isSignInResolved}
             isOrganizationEnabled={isOrganizationEnabled}
-            isRepresentative={isRepresentative}
+            isB2BBuyer={isB2BBuyer}
             signInButton={signInButton}
             ButtonSignIn={ButtonSignIn}
             skeletonAttr="data-fs-navbar-slider-signin-skeleton"

package/src/experimental/myAccountCmsServerSideProps.ts

@@ -7,7 +7,7 @@ import type { Locator } from '@vtex/client-cms'
 import type { GetServerSideProps } from 'next'
 
 import { getGlobalSectionsData } from 'src/components/cms/GlobalSections'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
 import { validateUser } from 'src/sdk/account/validateUser'
 import { execute } from 'src/server'
@@ -87,7 +87,7 @@ export function myAccountCmsServerSideProps(
       return { redirect }
     }
 
-    const isRepresentative = getIsRepresentative({
+    const isB2BBuyer = getIsB2BBuyer({
       headers: context.req.headers as Record<string, string>,
       account: storeConfig.api.storeId,
     })
@@ -135,7 +135,7 @@ export function myAccountCmsServerSideProps(
       props: {
         globalSections: globalSectionsResult,
         accountName: account.data?.accountProfile?.name ?? '',
-        isRepresentative,
+        isB2BBuyer,
         pageSections,
         navigationLabels: navigationData as AccountNavigationLabels,
       },

package/src/experimental/myAccountServerSideProps.ts

@@ -10,7 +10,7 @@ import {
   type GlobalSectionsData,
   getGlobalSectionsData,
 } from 'src/components/cms/GlobalSections'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { execute } from 'src/server'
 
 import { validateUser } from 'src/sdk/account/validateUser'
@@ -23,7 +23,7 @@ import storeConfig from '../../discovery.config'
 export type MyAccountProps = {
   globalSections: GlobalSectionsData
   accountName: string
-  isRepresentative?: boolean
+  isB2BBuyer?: boolean
 }
 
 const query = gql(`
@@ -77,7 +77,7 @@ const getServerSidePropsBase: GetServerSideProps<
     return { redirect }
   }
 
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -115,7 +115,7 @@ const getServerSidePropsBase: GetServerSideProps<
     props: {
       globalSections: globalSectionsResult,
       accountName: account.data?.accountProfile?.name ?? '',
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/[slug]/p.tsx

@@ -44,6 +44,7 @@ import { LocalizedProductProvider } from 'src/sdk/localization/LocalizedProductC
 import { getStoreURL } from 'src/sdk/localization/useLocalizationConfig'
 import { getOfferUrl, useOffer } from 'src/sdk/offer'
 import PageProvider, { type PDPContext } from 'src/sdk/overrides/PageProvider'
+import { useProductNotFoundRedirect } from 'src/sdk/product/useProductNotFoundRedirect'
 import { useProductQuery } from 'src/sdk/product/useProductQuery'
 import { injectGlobalSections } from 'src/server/cms/global'
 import type { PDPContentType } from 'src/server/cms/pdp'
@@ -185,7 +186,7 @@ function Page({
     )
   }
 
-  const { client, isValidating } = isClientOfferEnabled
+  const { client, isValidating, clientError } = isClientOfferEnabled
     ? (() => {
         const offer = useOffer({ skuId: product.sku })
         return {
@@ -195,6 +196,11 @@ function Page({
             },
           },
           isValidating: offer.isValidating,
+          // This mode reads the offer straight from Intelligent Search and
+          // never runs `ClientProductQuery`, where the B2B contract assortment
+          // is checked, so there is no not-found to redirect on. Supporting
+          // the redirect here is out of scope for now.
+          clientError: undefined,
         }
       })()
     : (() => {
@@ -204,15 +210,18 @@ function Page({
         return {
           client: productQuery.data,
           isValidating: productQuery.isValidating,
+          clientError: productQuery.error,
         }
       })()
 
+  const isLeavingForNotFound = useProductNotFoundRedirect(clientError)
+
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
   const context = {
     data: {
       ...deepmerge(server, client, { arrayMerge: overwriteMerge }),
-      isValidating,
+      isValidating: isValidating || isLeavingForNotFound,
     },
     globalSettings,
   } as PDPContext

package/src/pages/api/fs/logout.ts

@@ -7,6 +7,8 @@ import {
   getCookieDomains,
   getVtexCookieNames,
 } from 'src/utils/clearCookies'
+import { VID_RT_PATHS } from 'src/sdk/account/refreshTokenPaths'
+import { getCheckoutParentDomain } from 'src/utils/getCheckoutParentDomain'
 import { getRequestHostname } from 'src/utils/getRequestHostname'
 
 const ADDITIONAL_COOKIES = ['CheckoutOrderFormOwnership'] as const
@@ -27,20 +29,26 @@ const handler: NextApiHandler = async (
   try {
     const hostname = getRequestHostname(request.headers.host)
     const cookies = parse(request.headers.cookie ?? '')
-    const domains = hostname ? getCookieDomains(hostname) : [undefined]
+    const checkoutParent = hostname
+      ? getCheckoutParentDomain(hostname)
+      : undefined
+    const domains = [
+      ...(hostname ? getCookieDomains(hostname) : [undefined]),
+      ...(checkoutParent ? [checkoutParent] : []),
+    ]
     const clearedCookies: string[] = []
 
     const vtexCookieNames = getVtexCookieNames(Object.keys(cookies))
 
-    // Clear vid_rt cookie with specific path (only if refreshToken is enabled)
-    if (discoveryConfig.experimental?.refreshToken && cookies.vid_rt) {
-      for (const domain of domains) {
-        const clearedCookie = expireCookieServer({
-          name: 'vid_rt',
-          path: '/api/vtexid/refreshtoken/webstore',
-          domain,
-        })
-        clearedCookies.push(clearedCookie)
+    // vid_rt is scoped to the refresh routes, so the browser never sends it
+    // here and its presence can't be checked. Expire it on every path it can be scoped to.
+    if (discoveryConfig.experimental?.refreshToken) {
+      for (const path of VID_RT_PATHS) {
+        for (const domain of domains) {
+          clearedCookies.push(
+            expireCookieServer({ name: 'vid_rt', path, domain })
+          )
+        }
       }
     }