@faststore/core 4.10.1-dev.6 → 4.10.1-dev.7

package/src/pages/api/fs/switch-contract.ts

@@ -1,9 +1,17 @@
 import { parse } from 'cookie'
 import type { NextApiHandler, NextApiRequest, NextApiResponse } from 'next'
+import { isIP } from 'node:net'
 
 import storeConfig from 'discovery.config'
 import { expireCookieServer, getCookieDomains } from 'src/utils/clearCookies'
+import { getCheckoutParentDomain } from 'src/utils/getCheckoutParentDomain'
 import { getRequestHostname } from 'src/utils/getRequestHostname'
+import {
+  isCookieSafeHostname,
+  isHostAllowed,
+  removeCookieDomain,
+  singleForwardedHost,
+} from 'src/utils/trustedForwardedHost'
 
 /**
  * Cookies holding the checkout orderForm of the previous commercial context.
@@ -42,6 +50,23 @@ const isAuthCookie = (cookie: unknown): cookie is VtexAuthCookie => {
   return Boolean(candidate?.Name?.trim() && candidate?.Value)
 }
 
+/**
+ * A non-positive `expiresIn` would turn into `Max-Age=0`, which expires the
+ * credential the response is supposed to install — logging the buyer out while
+ * the route reports success. Anything that is not a positive integer falls back
+ * to the default.
+ */
+const resolveMaxAge = (expiresIn: unknown): number =>
+  typeof expiresIn === 'number' && Number.isInteger(expiresIn) && expiresIn > 0
+    ? expiresIn
+    : DEFAULT_AUTH_COOKIE_MAX_AGE
+
+/**
+ * Uses the forwarded protocol when a proxy sets it, otherwise the connection
+ * itself. A non-local hostname alone does not imply https: a `Secure` cookie
+ * sent over plain http is dropped by the browser while the route reports
+ * success.
+ */
 const isSecureRequest = (request: NextApiRequest): boolean => {
   const forwarded = request.headers['x-forwarded-proto']
   const proto = Array.isArray(forwarded) ? forwarded[0] : forwarded
@@ -50,41 +75,162 @@ const isSecureRequest = (request: NextApiRequest): boolean => {
     return proto.split(',')[0].trim() === 'https'
   }
 
-  const hostname = getRequestHostname(request.headers.host)
+  const socket = request.socket
+  return Boolean(socket && 'encrypted' in socket && socket.encrypted)
+}
+
+/**
+ * Every parent of `hostname` with at least two labels, closest first:
+ * `a.b.store.com` gives `b.store.com` and `store.com`. A parent that is a
+ * public suffix (e.g. `com.br`) is rejected by the browser, so expiring a
+ * cookie there is a no-op.
+ */
+const getParentDomains = (hostname: string): string[] => {
+  const labels = hostname.split('.')
 
-  return hostname !== 'localhost' && hostname !== '127.0.0.1'
+  return labels
+    .slice(1, -1)
+    .map((_, index) => labels.slice(index + 1).join('.'))
 }
 
 /**
- * A non-positive `expiresIn` would turn into `Max-Age=0`, which expires the
- * credential the response is supposed to install — logging the buyer out while
- * the route reports success. Anything that is not a positive integer falls back
- * to the default.
+ * Hosts where the auth cookies stay host-only: WebOps previews, whose ingress
+ * does not pass the browser host in `Host`, and local development.
+ * `{account}.vtex.app` is a production domain that receives the browser host,
+ * so it gets a Domain like any custom domain. `/api/graphql` keeps its wider
+ * `.vtex.app` list for the cookies it relays from upstream.
  */
-const resolveMaxAge = (expiresIn: unknown): number =>
-  typeof expiresIn === 'number' && Number.isInteger(expiresIn) && expiresIn > 0
-    ? expiresIn
-    : DEFAULT_AUTH_COOKIE_MAX_AGE
+const HOST_ONLY_AUTH_COOKIE_SUFFIXES = [
+  'localhost',
+  '.localhost',
+  '.preview.vtex.app',
+]
+
+const isHostOnlyCookieHost = (hostname: string | null): boolean =>
+  !!hostname && isHostAllowed(hostname, HOST_ONLY_AUTH_COOKIE_SUFFIXES)
 
 /**
- * Mirrors the attributes the storefront used to write via `document.cookie`.
- * `HttpOnly` is deliberately left out: the cookie lives on a domain shared
- * with VTEX's own checkout, so hardening it is a separate, explicitly tested
- * change.
+ * Domain for the auth cookies, or `undefined` to write them host-only.
+ *
+ * Previews and local hosts stay host-only: behind the preview ingress `Host`
+ * is not the host the browser requested, and a mismatched Domain makes the browser drop
+ * the cookie while the route reports success. `x-forwarded-host` only decides
+ * that the cookie is host-only; it never chooses the Domain. IP literals and
+ * hosts that cannot be written verbatim into the attribute (including a
+ * trailing-dot FQDN) are host-only too.
+ */
+const resolveAuthCookieDomain = (
+  request: NextApiRequest
+): string | undefined => {
+  const hostname = getRequestHostname(request.headers.host)
+  const forwardedHost = getRequestHostname(
+    singleForwardedHost(request.headers['x-forwarded-host'])
+  )
+
+  if (
+    !hostname ||
+    isHostOnlyCookieHost(hostname) ||
+    isHostOnlyCookieHost(forwardedHost) ||
+    isIP(hostname) !== 0 ||
+    hostname.endsWith('.') ||
+    !isCookieSafeHostname(hostname)
+  ) {
+    return undefined
+  }
+
+  return hostname
+}
+
+/**
+ * Mirrors the attributes VTEX ID uses when it sets these cookies at login and
+ * refresh (`Domain=<host>; Path=/; Secure; SameSite=None; HttpOnly`).
+ *
+ * Browsers tell cookies apart by name, domain and path, and a cookie with a
+ * Domain attribute never matches a host-only one. Writing the contract token
+ * host-only would sit next to VTEX ID's cookie instead of replacing it, leaving
+ * two `VtexIdclientAutCookie_<account>` with different contracts. Each reader
+ * then picks a different one. Any host-only copy left by earlier versions is
+ * expired in the same batch.
+ *
+ * VTEX ID's refresh also writes the cookie on the parent domain (e.g.
+ * `Domain=store.com` for `www.store.com`). Parent copies are expired, so the
+ * only auth cookie left holds the switched contract. The exception is the
+ * parent shared with a checkout on a sibling host (`secure.store.com`): the
+ * token is written there too, with the same value as the host copy, so
+ * checkout keeps the session after the switch.
+ *
+ * The Domain-scoped cookie is always `Secure`, like VTEX ID's, because the
+ * forwarded protocol is not reliable behind the CDN. The host-only fallback
+ * follows the request protocol so plain-http local hosts keep working.
  */
 const buildAuthCookies = (
   payload: SwitchPropertiesResponse,
+  domain: string | undefined,
   secure: boolean
 ): string[] => {
-  const maxAge = resolveMaxAge(payload.expiresIn)
-  const secureAttr = secure ? '; Secure' : ''
+  const checkoutParent = domain ? getCheckoutParentDomain(domain) : undefined
+  const staleScopes: Array<string | undefined> = domain
+    ? [
+        undefined,
+        ...getParentDomains(domain).filter(
+          (parent) => parent !== checkoutParent
+        ),
+      ]
+    : []
+  const writeScopes = checkoutParent ? [domain, checkoutParent] : [domain]
+  const attributes = (scope: string | undefined) =>
+    [
+      scope && `Domain=${scope}`,
+      'Path=/',
+      `Max-Age=${resolveMaxAge(payload.expiresIn)}`,
+      'HttpOnly',
+      (scope || secure) && 'Secure',
+      `SameSite=${scope ? 'None' : 'Lax'}`,
+    ]
+      .filter(Boolean)
+      .join('; ')
 
   return [payload.authCookie, payload.accountAuthCookie]
     .filter(isAuthCookie)
-    .map(
-      (cookie) =>
-        `${cookie.Name}=${cookie.Value}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secureAttr}`
-    )
+    .flatMap((cookie) => [
+      ...staleScopes.map((staleDomain) =>
+        expireCookieServer({
+          name: cookie.Name,
+          path: '/',
+          domain: staleDomain,
+        })
+      ),
+      ...writeScopes.map(
+        (scope) => `${cookie.Name}=${cookie.Value}; ${attributes(scope)}`
+      ),
+    ])
+}
+
+/**
+ * `switch-properties` also issues `vid_rt` (the refresh token) on the
+ * Authenticator refresh paths. It is called server-side on
+ * `<account>.myvtex.com`, so its Domain points there and the browser would
+ * reject it. Re-scope it like the auth cookies so the next B2B refresh, which
+ * goes through the Authenticator route, finds it.
+ *
+ * Only relayed with `experimental.refreshToken` on: otherwise nothing uses it,
+ * and `/api/fs/logout` does not expire it either, so it would outlive logout.
+ */
+const relayRefreshTokenCookies = (
+  headers: Headers | undefined,
+  domain: string | undefined
+): string[] => {
+  if (!storeConfig.experimental?.refreshToken) {
+    return []
+  }
+
+  return (headers?.getSetCookie?.() ?? [])
+    .filter((cookie) => cookie.trimStart().startsWith('vid_rt='))
+    .map((cookie) => {
+      const hostOnly = removeCookieDomain(cookie)
+
+      return domain ? `${hostOnly}; Domain=${domain}` : hostOnly
+    })
 }
 
 const buildOrderFormExpiryCookies = (request: NextApiRequest): string[] => {
@@ -167,8 +313,11 @@ const handler: NextApiHandler<SwitchContractResponse> = async (
       return
     }
 
+    const domain = resolveAuthCookieDomain(request)
+
     response.setHeader('Set-Cookie', [
-      ...buildAuthCookies(payload, isSecureRequest(request)),
+      ...buildAuthCookies(payload, domain, isSecureRequest(request)),
+      ...relayRefreshTokenCookies(switchResponse.headers, domain),
       ...buildOrderFormExpiryCookies(request),
     ])
 

package/src/pages/api/graphql.ts

@@ -13,6 +13,7 @@ import { getJWTAutCookie } from 'src/utils/getCookie'
 import { getRequestHostname } from 'src/utils/getRequestHostname'
 import { shouldBypassRefreshTokenForRequest } from 'src/utils/shouldBypassRefreshToken'
 import {
+  HOST_ONLY_COOKIE_HOST_SUFFIXES,
   isHostAllowed,
   removeCookieDomain,
   singleForwardedHost,
@@ -25,7 +26,6 @@ const OTELLogger = logger('@faststore/core')
 
 const DEFAULT_MAX_AGE = 5 * 60 // 5 minutes
 const DEFAULT_STALE_WHILE_REVALIDATE = 60 * 60 // 1 hour
-const ALLOWED_HOST_SUFFIXES = ['localhost', '.vtex.app', '.localhost']
 
 /**
  * Recovers a FastStoreError from an execution error, whether it is the error
@@ -88,7 +88,8 @@ const normalizeSetCookieDomain = ({
     OTELLogger('warn', 'Ignoring multi-value or malformed x-forwarded-host')
   }
   const host =
-    forwardedHost && isHostAllowed(forwardedHost, ALLOWED_HOST_SUFFIXES)
+    forwardedHost &&
+    isHostAllowed(forwardedHost, HOST_ONLY_COOKIE_HOST_SUFFIXES)
       ? forwardedHost
       : getRequestHostname(request.headers.host)
   if (!host) {
@@ -97,7 +98,7 @@ const normalizeSetCookieDomain = ({
   const cookieDomain = domainMatch[1]
 
   if (
-    !isHostAllowed(host, ALLOWED_HOST_SUFFIXES) ||
+    !isHostAllowed(host, HOST_ONLY_COOKIE_HOST_SUFFIXES) ||
     !shouldReplaceCookieDomain({ cookieDomain, host })
   ) {
     return setCookie

package/src/pages/pvt/account/cards/index.tsx

@@ -21,7 +21,7 @@ import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountCardsPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
 import { getB2BSessionClaims } from 'src/sdk/account/getB2BSessionClaims'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
@@ -72,7 +72,7 @@ export default function ListCardsPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ListCardsPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -89,7 +89,7 @@ export default function ListCardsPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -109,7 +109,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -249,7 +249,7 @@ const getServerSidePropsBase: GetServerSideProps<
         hasError,
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/orders/[id].tsx

@@ -23,7 +23,7 @@ import storeConfig from 'discovery.config'
 import { getGlobalSectionsData } from 'src/components/cms/GlobalSections'
 import { default as AfterSection } from 'src/customizations/src/myAccount/extensions/orders/[id]/after'
 import { default as BeforeSection } from 'src/customizations/src/myAccount/extensions/orders/[id]/before'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
@@ -51,7 +51,7 @@ export default function OrderDetailsPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: OrderDetailsPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -68,7 +68,7 @@ export default function OrderDetailsPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -313,7 +313,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -415,7 +415,7 @@ const getServerSidePropsBase: GetServerSideProps<
         ...(orderStatusLabels ? { orderStatusLabels } : {}),
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/orders/index.tsx

@@ -22,7 +22,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountOrdersListPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
@@ -52,7 +52,7 @@ export default function ListOrdersPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ListOrdersPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -69,7 +69,7 @@ export default function ListOrdersPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -132,7 +132,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -265,7 +265,7 @@ const getServerSidePropsBase: GetServerSideProps<
         },
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/profile.tsx

@@ -22,7 +22,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountProfilePageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
 import { fetchMyAccountPageContent } from 'src/server/cms/fetchMyAccountPageContent'
@@ -51,7 +51,7 @@ export default function Profile({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ProfilePageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -68,7 +68,7 @@ export default function Profile({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -108,7 +108,7 @@ const getServerSidePropsBase: GetServerSideProps<
     return { redirect }
   }
 
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -184,7 +184,7 @@ const getServerSidePropsBase: GetServerSideProps<
       },
       pageSections,
       navigationLabels: navigationData as AccountNavigationLabels,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/quotes/index.tsx

@@ -27,7 +27,7 @@ import BeforeSection from 'src/customizations/src/myAccount/extensions/quotes/be
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountQuotesPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
@@ -56,7 +56,7 @@ export default function ListQuotesPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ListQuotesPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -73,7 +73,7 @@ export default function ListQuotesPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -122,7 +122,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -273,7 +273,7 @@ const getServerSidePropsBase: GetServerSideProps<
         },
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/security.tsx

@@ -22,7 +22,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountSecurityPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
@@ -51,7 +51,7 @@ export default function Page({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: SecurityPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -68,7 +68,7 @@ export default function Page({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -101,7 +101,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -185,7 +185,7 @@ const getServerSidePropsBase: GetServerSideProps<
       },
       globalSections: globalSectionsResult,
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/user-details.tsx

@@ -23,7 +23,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountUserDetailsPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
@@ -50,7 +50,7 @@ export default function Page({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: UserDetailsPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -67,7 +67,7 @@ export default function Page({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -105,7 +105,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -118,7 +118,7 @@ const getServerSidePropsBase: GetServerSideProps<
     return { redirect }
   }
 
-  if (!isRepresentative) {
+  if (!isB2BBuyer) {
     return {
       redirect: {
         destination: localizeRedirectDestination('/pvt/account', context),
@@ -209,7 +209,7 @@ const getServerSidePropsBase: GetServerSideProps<
         },
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/sdk/account/getB2BSessionClaims.ts

@@ -10,7 +10,7 @@ export type B2BSessionClaims = {
   /**
    * Whether the buyer is associated with a Unit/Contract. Per the Personal
    * Cards PRD (REQ-2), this is detected by the presence of a `unitId` claim in
-   * the VTEX ID JWT — the same cookie `getIsRepresentative` already decodes.
+   * the VTEX ID JWT — the same cookie `getIsB2BBuyer` already decodes.
    * Gates the Shared tab (FR-5).
    *
    * Note this is the only part of the gate that lives in the token. The

package/src/sdk/account/getIsB2BBuyer.ts

@@ -0,0 +1,28 @@
+import { parse } from 'cookie'
+import { parseJwt } from 'src/utils/getCookie'
+
+type GetIsB2BBuyerParams = {
+  headers?: Record<string, string>
+  account: string
+}
+
+/**
+ * Whether the buyer is a B2B member: the VTEX ID token carries both an
+ * organizational unit and a contract, the rule Buyer Portal uses. The
+ * `isRepresentative` claim is not read, since it can be true outside B2B.
+ */
+export function getIsB2BBuyer({
+  headers,
+  account,
+}: GetIsB2BBuyerParams): boolean {
+  const authCookie = parse(headers?.cookie ?? '')?.[
+    'VtexIdclientAutCookie_' + account
+  ]
+  const jwt = parseJwt(authCookie)
+
+  return isNonBlankString(jwt?.unitId) && isNonBlankString(jwt?.customerId)
+}
+
+function isNonBlankString(value: unknown): boolean {
+  return typeof value === 'string' && value.trim() !== ''
+}