@faststore/core 4.10.1-dev.6 → 4.10.1-dev.7

package/test/pages/api/switch-contract.test.ts

@@ -3,11 +3,19 @@ import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 
 import type { SwitchContractResponse } from '../../../src/pages/api/fs/switch-contract'
 
-vi.mock('discovery.config', () => ({
-  __esModule: true,
-  default: { api: { storeId: 'test-store' } },
+const mockConfig = vi.hoisted(() => ({
+  default: {
+    api: { storeId: 'test-store' },
+    experimental: { refreshToken: true } as Record<string, unknown>,
+  } as {
+    api: { storeId: string }
+    experimental: Record<string, unknown>
+    secureSubdomain?: string
+  },
 }))
 
+vi.mock('discovery.config', () => ({ __esModule: true, ...mockConfig }))
+
 const CONTRACT_ID = '69b5d80e-8f61-44e0-a5cb-db54c326699c'
 const ORDER_FORM_COOKIES =
   'checkout.vtex.com=__ofid=abc123; CheckoutOrderFormOwnership=owner-1'
@@ -74,6 +82,7 @@ const setCookiesFrom = (res: { setHeader: Mock }): string[] => {
 describe('/api/fs/switch-contract', () => {
   beforeEach(() => {
     vi.resetModules()
+    mockConfig.default.secureSubdomain = undefined
     global.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
@@ -185,20 +194,299 @@ describe('/api/fs/switch-contract', () => {
     expect(res.json).toHaveBeenCalledWith({ success: true })
   })
 
-  it('carries Max-Age from expiresIn and Secure behind https', async () => {
+  it('writes the auth cookie with the same scope VTEX ID uses', async () => {
     const handler = await getHandler()
     const { req, res } = createReqRes()
 
     await handler(req, res)
 
     const authCookie = setCookiesFrom(res).find((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=new-contract-token')
+    )
+
+    expect(authCookie).toBe(
+      'VtexIdclientAutCookie_test-store=new-contract-token; Domain=store.example.com; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=None'
+    )
+  })
+
+  it('stays Secure even when the proxy forwards plain http', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { 'x-forwarded-proto': 'http' },
+    })
+
+    await handler(req, res)
+
+    const authCookie = setCookiesFrom(res).find((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=new-contract-token')
+    )
+
+    expect(authCookie).toContain('; Secure')
+  })
+
+  it('expires a leftover host-only auth cookie before setting the scoped one', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=')
+    )
+
+    expect(authCookies).toHaveLength(3)
+    expect(authCookies[0]).toMatch(/^VtexIdclientAutCookie_test-store=;/)
+    expect(authCookies[0]).toContain('max-age=0')
+    expect(authCookies[0]).toContain('path=/')
+    // Host-only: no Domain, so it cannot touch VTEX ID's scoped cookie.
+    expect(authCookies[0].toLowerCase()).not.toContain('domain=')
+    expect(authCookies[2]).toContain('Domain=store.example.com')
+  })
+
+  it('expires the copy VTEX ID refresh leaves on the parent domain', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=')
+    )
+
+    expect(authCookies[1]).toMatch(/^VtexIdclientAutCookie_test-store=;/)
+    expect(authCookies[1]).toContain('max-age=0')
+    expect(authCookies[1]).toContain('path=/')
+    expect(authCookies[1]).toContain('domain=example.com')
+    // The new token is never written to the parent domain.
+    expect(
+      authCookies.filter((cookie) => cookie.includes('new-contract-token'))
+    ).toEqual([expect.stringContaining('Domain=store.example.com;')])
+  })
+
+  it.each([
+    ['a single-label parent', 'store.com', []],
+    ['a deep host', 'a.b.store.com', ['b.store.com', 'store.com']],
+    ['a two-level suffix', 'www.store.com.br', ['store.com.br', 'com.br']],
+    ['a .co.uk store', 'www.store.co.uk', ['store.co.uk', 'co.uk']],
+    ['a .com.au store', 'shop.store.com.au', ['store.com.au', 'com.au']],
+  ])('expires every parent domain for %s', async (_label, host, parents) => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ headers: { host } })
+
+    await handler(req, res)
+
+    const expiredDomains = setCookiesFrom(res)
+      .filter((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=;')
+      )
+      .map((cookie) => cookie.match(/domain=([^;]+)/)?.[1])
+      .filter(Boolean)
+
+    expect(expiredDomains).toEqual(parents)
+  })
+
+  it.each(['www.store.com.br', 'www.store.co.uk', 'shop.store.com.au'])(
+    'writes the new token only on the request host for %s, never on a parent or public suffix',
+    async (host) => {
+      const handler = await getHandler()
+      const { req, res } = createReqRes({ headers: { host } })
+
+      await handler(req, res)
+
+      // Parents (including public suffixes such as co.uk, which the browser
+      // rejects) only ever get expiries; the token is scoped to the host.
+      expect(
+        setCookiesFrom(res).filter((cookie) =>
+          cookie.includes('new-contract-token')
+        )
+      ).toEqual([expect.stringContaining(`; Domain=${host}; Path=/;`)])
+    }
+  )
+
+  describe('with checkout on a sibling host', () => {
+    const tokenCookies = (cookies: string[]) =>
+      cookies.filter((cookie) => cookie.includes('new-contract-token'))
+
+    it('writes the same token on the host and on the shared parent', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.example.com'
+      const handler = await getHandler()
+      const { req, res } = createReqRes()
+
+      await handler(req, res)
+
+      const cookies = setCookiesFrom(res)
+
+      expect(tokenCookies(cookies)).toEqual([
+        'VtexIdclientAutCookie_test-store=new-contract-token; Domain=store.example.com; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=None',
+        'VtexIdclientAutCookie_test-store=new-contract-token; Domain=example.com; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=None',
+      ])
+      expect(
+        cookies.some(
+          (cookie) =>
+            cookie.startsWith('VtexIdclientAutCookie_test-store=;') &&
+            cookie.includes('domain=example.com;')
+        )
+      ).toBe(false)
+    })
+
+    it('still expires the parents above the shared one', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.b.store.com'
+      const handler = await getHandler()
+      const { req, res } = createReqRes({ headers: { host: 'a.b.store.com' } })
+
+      await handler(req, res)
+
+      const cookies = setCookiesFrom(res)
+      const expiredDomains = cookies
+        .filter((cookie) =>
+          cookie.startsWith('VtexIdclientAutCookie_test-store=;')
+        )
+        .map((cookie) => cookie.match(/domain=([^;]+)/)?.[1])
+        .filter(Boolean)
+
+      expect(expiredDomains).toEqual(['store.com'])
+      expect(tokenCookies(cookies)).toEqual([
+        expect.stringContaining('; Domain=a.b.store.com; Path=/;'),
+        expect.stringContaining('; Domain=b.store.com; Path=/;'),
+      ])
+    })
+
+    it.each([
+      ['on the store host', 'https://store.example.com'],
+      ['on a subdomain of the store host', 'https://secure.store.example.com'],
+      ['on an unrelated domain', 'https://secure.other.org'],
+      ['with an invalid URL', 'not a url'],
+    ])('writes only the host copy with checkout %s', async (_label, url) => {
+      mockConfig.default.secureSubdomain = url
+      const handler = await getHandler()
+      const { req, res } = createReqRes()
+
+      await handler(req, res)
+
+      expect(tokenCookies(setCookiesFrom(res))).toEqual([
+        expect.stringContaining('; Domain=store.example.com; Path=/;'),
+      ])
+    })
+
+    it('keeps preview hosts host-only', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.vtex.app'
+      const handler = await getHandler()
+      const { req, res } = createReqRes({
+        headers: { host: 'sfj-abc--test-store.preview.vtex.app' },
+      })
+
+      await handler(req, res)
+
+      const cookies = tokenCookies(setCookiesFrom(res))
+
+      expect(cookies).toHaveLength(1)
+      expect(cookies[0].toLowerCase()).not.toContain('domain=')
+    })
+
+    it('keeps vid_rt on the store host', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.example.com'
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+        status: 200,
+        json: async () => successPayload,
+        headers: {
+          getSetCookie: () => [
+            'vid_rt=rt-1; path=/api/authenticator/v1/refreshtoken/webstore; secure; httponly; Domain=test-store.myvtex.com',
+          ],
+        },
+      })
+      const handler = await getHandler()
+      const { req, res } = createReqRes()
+
+      await handler(req, res)
+
+      expect(
+        setCookiesFrom(res).filter((cookie) => cookie.startsWith('vid_rt='))
+      ).toEqual([expect.stringMatching(/; Domain=store\.example\.com$/)])
+    })
+  })
+
+  it('scopes the cookie to an {account}.vtex.app production host', async () => {
+    // Unlike previews, this domain receives the browser host in `Host`.
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { host: 'test-store.vtex.app' },
+    })
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
+      cookie.includes('new-contract-token')
+    )
+
+    expect(authCookies).toEqual([
+      expect.stringContaining('; Domain=test-store.vtex.app; Path=/;'),
+    ])
+  })
+
+  it.each([
+    ['a preview Host', { host: 'sfj-abc--test-store.preview.vtex.app' }],
+    [
+      'a preview x-forwarded-host behind an internal Host',
+      {
+        host: 'discovery.internal',
+        'x-forwarded-host': 'sfj-abc--test-store.preview.vtex.app',
+      },
+    ],
+    ['a .localhost Host', { host: 'store.localhost:3000' }],
+    ['a trailing-dot FQDN', { host: 'store.example.com.' }],
+  ])('writes a single host-only cookie for %s', async (_label, headers) => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ headers })
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
       cookie.startsWith('VtexIdclientAutCookie_test-store=')
     )
 
-    expect(authCookie).toContain('Max-Age=3600')
-    expect(authCookie).toContain('Path=/')
-    expect(authCookie).toContain('SameSite=Lax')
-    expect(authCookie).toContain('Secure')
+    expect(authCookies).toHaveLength(1)
+    expect(authCookies[0]).toContain('new-contract-token; Path=/;')
+    expect(authCookies[0].toLowerCase()).not.toContain('domain=')
+  })
+
+  it('does not let x-forwarded-host choose the Domain', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { 'x-forwarded-host': 'attacker.example.org' },
+    })
+
+    await handler(req, res)
+
+    const cookies = setCookiesFrom(res)
+
+    expect(cookies).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(
+          'new-contract-token; Domain=store.example.com;'
+        ),
+      ])
+    )
+    expect(
+      cookies.some((cookie) => cookie.includes('attacker.example.org'))
+    ).toBe(false)
+  })
+
+  it('strips the port from the Host header', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { host: 'store.example.com:443' },
+    })
+
+    await handler(req, res)
+
+    expect(setCookiesFrom(res)).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(
+          'new-contract-token; Domain=store.example.com; Path=/'
+        ),
+      ])
+    )
   })
 
   it.each([
@@ -222,7 +510,7 @@ describe('/api/fs/switch-contract', () => {
       await handler(req, res)
 
       const authCookie = setCookiesFrom(res).find((cookie) =>
-        cookie.startsWith('VtexIdclientAutCookie_test-store=')
+        cookie.startsWith('VtexIdclientAutCookie_test-store=new-contract-token')
       )
 
       // Max-Age=0 would delete the very credential this response installs.
@@ -231,19 +519,154 @@ describe('/api/fs/switch-contract', () => {
     }
   )
 
-  it('omits Secure on plain http', async () => {
+  it.each([
+    ['localhost', 'localhost:3000'],
+    ['127.0.0.1', '127.0.0.1:3000'],
+    ['a LAN IP', '192.168.1.10'],
+    ['an unsafe host', 'store.example.com;evil=1'],
+  ])('writes a single host-only cookie on %s', async (_label, host) => {
     const handler = await getHandler()
     const { req, res } = createReqRes({
-      headers: { 'x-forwarded-proto': 'http' },
+      headers: { host, 'x-forwarded-proto': 'http' },
     })
 
     await handler(req, res)
 
-    const authCookie = setCookiesFrom(res).find((cookie) =>
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
       cookie.startsWith('VtexIdclientAutCookie_test-store=')
     )
 
-    expect(authCookie).not.toContain('Secure')
+    // No Domain means the cookie already replaces the host-only one, so
+    // expiring it in the same batch would delete the new credential.
+    expect(authCookies).toEqual([
+      'VtexIdclientAutCookie_test-store=new-contract-token; Path=/; Max-Age=3600; HttpOnly; SameSite=Lax',
+    ])
+  })
+
+  it.each([
+    ['a LAN IP', '192.168.1.10'],
+    ['an IPv6 literal', '[2001:db8::1]'],
+  ])(
+    'keeps the host-only cookie Secure on %s over https',
+    async (_label, host) => {
+      const handler = await getHandler()
+      const { req, res } = createReqRes({
+        headers: { host, 'x-forwarded-proto': 'https' },
+      })
+
+      await handler(req, res)
+
+      const authCookies = setCookiesFrom(res).filter((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=')
+      )
+
+      expect(authCookies).toEqual([
+        'VtexIdclientAutCookie_test-store=new-contract-token; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax',
+      ])
+    }
+  )
+
+  it.each([
+    ['plain http', false, ''],
+    ['a TLS connection', true, '; Secure'],
+  ])(
+    'follows the connection without x-forwarded-proto on %s',
+    async (_label, encrypted, secureAttr) => {
+      const handler = await getHandler()
+      const { req, res } = createReqRes({
+        headers: { host: '192.168.1.10', 'x-forwarded-proto': undefined },
+        socket: { encrypted } as unknown as NextApiRequest['socket'],
+      })
+
+      await handler(req, res)
+
+      const authCookies = setCookiesFrom(res).filter((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=')
+      )
+
+      expect(authCookies).toEqual([
+        `VtexIdclientAutCookie_test-store=new-contract-token; Path=/; Max-Age=3600; HttpOnly${secureAttr}; SameSite=Lax`,
+      ])
+    }
+  )
+
+  it('relays the upstream vid_rt re-scoped to the storefront host', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => successPayload,
+      headers: {
+        getSetCookie: () => [
+          'vid_rt=rt-1; expires=Thu, 22 Oct 2027 00:00:00 GMT; domain=test-store.myvtex.com; path=/api/authenticator/v1/refreshtoken/webstore; secure; samesite=strict; httponly',
+          'VtexIdclientAutCookie_test-store=upstream-token; domain=test-store.myvtex.com; path=/',
+        ],
+      },
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const cookies = setCookiesFrom(res)
+    const vidRt = cookies.filter((cookie) => cookie.startsWith('vid_rt='))
+
+    expect(vidRt).toEqual([
+      'vid_rt=rt-1; expires=Thu, 22 Oct 2027 00:00:00 GMT; path=/api/authenticator/v1/refreshtoken/webstore; secure; samesite=strict; httponly; Domain=store.example.com',
+    ])
+    // Only vid_rt is relayed; the auth cookie still comes from the payload.
+    expect(cookies.some((cookie) => cookie.includes('upstream-token'))).toBe(
+      false
+    )
+  })
+
+  it('does not relay vid_rt when refresh token is disabled', async () => {
+    mockConfig.default.experimental = {}
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => successPayload,
+      headers: {
+        getSetCookie: () => [
+          'vid_rt=rt-1; domain=test-store.myvtex.com; path=/api/authenticator/v1/refreshtoken/webstore; secure; httponly',
+        ],
+      },
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    try {
+      await handler(req, res)
+    } finally {
+      mockConfig.default.experimental = { refreshToken: true }
+    }
+
+    const cookies = setCookiesFrom(res)
+    expect(cookies.some((cookie) => cookie.startsWith('vid_rt='))).toBe(false)
+    // The contract switch itself still goes through.
+    expect(
+      cookies.some((cookie) => cookie.includes('new-contract-token'))
+    ).toBe(true)
+  })
+
+  it('relays vid_rt host-only when the auth cookie is host-only', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => successPayload,
+      headers: {
+        getSetCookie: () => [
+          'vid_rt=rt-1; domain=test-store.myvtex.com; path=/api/vtexid/refreshtoken/webstore; httponly',
+        ],
+      },
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ headers: { host: 'localhost:3000' } })
+
+    await handler(req, res)
+
+    expect(
+      setCookiesFrom(res).filter((cookie) => cookie.startsWith('vid_rt='))
+    ).toEqual(['vid_rt=rt-1; path=/api/vtexid/refreshtoken/webstore; httponly'])
   })
 
   it('also emits the accountAuthCookie when present', async () => {
@@ -263,9 +686,14 @@ describe('/api/fs/switch-contract', () => {
 
     await handler(req, res)
 
-    expect(setCookiesFrom(res)).toEqual(
+    const cookies = setCookiesFrom(res)
+
+    expect(cookies).toEqual(
       expect.arrayContaining([
-        expect.stringContaining('VtexIdclientAutCookie_account=account-token'),
+        expect.stringMatching(/^VtexIdclientAutCookie_account=;.*max-age=0/),
+        expect.stringContaining(
+          'VtexIdclientAutCookie_account=account-token; Domain=store.example.com'
+        ),
       ])
     )
   })

package/test/pages/pvt/account/cards/index.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it, vi } from 'vitest'
 
 const mockExecute = vi.hoisted(() => vi.fn())
 const mockGetB2BSessionClaims = vi.hoisted(() => vi.fn())
-const mockGetIsRepresentative = vi.hoisted(() => vi.fn(() => true))
+const mockGetIsB2BBuyer = vi.hoisted(() => vi.fn(() => true))
 const mockGetMyAccountRedirect = vi.hoisted(() =>
   vi.fn(() => ({ isFaststoreMyAccountEnabled: true, redirect: undefined }))
 )
@@ -30,8 +30,8 @@ vi.mock('src/components/cms/GlobalSections', () => ({
 vi.mock('src/sdk/account/getB2BSessionClaims', () => ({
   getB2BSessionClaims: mockGetB2BSessionClaims,
 }))
-vi.mock('src/sdk/account/getIsRepresentative', () => ({
-  getIsRepresentative: mockGetIsRepresentative,
+vi.mock('src/sdk/account/getIsB2BBuyer', () => ({
+  getIsB2BBuyer: mockGetIsB2BBuyer,
 }))
 vi.mock('src/utils/myAccountRedirect', () => ({
   getMyAccountRedirect: mockGetMyAccountRedirect,

package/test/sdk/account/getIsB2BBuyer.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+import { getIsB2BBuyer } from '../../../src/sdk/account/getIsB2BBuyer'
+
+const ACCOUNT = 'storeaccount'
+
+const makeJwt = (payload: Record<string, unknown>) =>
+  `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`
+
+const withToken = (payload: Record<string, unknown>) => ({
+  headers: { cookie: `VtexIdclientAutCookie_${ACCOUNT}=${makeJwt(payload)}` },
+  account: ACCOUNT,
+})
+
+describe('getIsB2BBuyer', () => {
+  it('is true when the token has a unit and a contract', () => {
+    expect(
+      getIsB2BBuyer(withToken({ unitId: 'unit-1', customerId: 'contract-1' }))
+    ).toBe(true)
+  })
+
+  it('does not depend on the isRepresentative claim', () => {
+    expect(
+      getIsB2BBuyer(
+        withToken({
+          unitId: 'unit-1',
+          customerId: 'contract-1',
+          isRepresentative: false,
+        })
+      )
+    ).toBe(true)
+    expect(getIsB2BBuyer(withToken({ isRepresentative: true }))).toBe(false)
+  })
+
+  it.each([
+    ['without a unit', { customerId: 'contract-1' }],
+    ['without a contract', { unitId: 'unit-1' }],
+    ['with blank claims', { unitId: ' ', customerId: '' }],
+    ['with non-string claims', { unitId: 1, customerId: true }],
+  ])('is false %s', (_label, payload) => {
+    expect(getIsB2BBuyer(withToken(payload))).toBe(false)
+  })
+
+  it('is false without an auth cookie or with a malformed one', () => {
+    expect(getIsB2BBuyer({ headers: {}, account: ACCOUNT })).toBe(false)
+    expect(
+      getIsB2BBuyer({
+        headers: { cookie: `VtexIdclientAutCookie_${ACCOUNT}=not-a-jwt` },
+        account: ACCOUNT,
+      })
+    ).toBe(false)
+  })
+})

package/test/sdk/account/refreshToken.browser.test.ts

@@ -14,7 +14,7 @@ describe('refreshTokenRequest (browser)', () => {
   beforeEach(() => {
     mockFetch.mockResolvedValue({
       status: 200,
-      json: async () => ({ status: 'success' }),
+      json: async () => ({ authStatus: 'Success' }),
     })
   })
 
@@ -31,4 +31,13 @@ describe('refreshTokenRequest (browser)', () => {
     expect(url).toBe('/api/vtexid/refreshtoken/webstore')
     expect(init.headers).toEqual({ 'content-type': 'application/json' })
   })
+
+  it('uses the relative Authenticator route for B2B sessions', async () => {
+    await refreshTokenRequest({ isB2B: true })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(mockFetch.mock.calls[0][0]).toBe(
+      '/api/authenticator/v1/refreshtoken/webstore'
+    )
+  })
 })