@faststore/core 4.10.1 → 4.10.2-dev.0

package/src/pages/api/fs/switch-contract.ts

@@ -1,9 +1,17 @@
 import { parse } from 'cookie'
 import type { NextApiHandler, NextApiRequest, NextApiResponse } from 'next'
+import { isIP } from 'node:net'
 
 import storeConfig from 'discovery.config'
 import { expireCookieServer, getCookieDomains } from 'src/utils/clearCookies'
+import { getCheckoutParentDomain } from 'src/utils/getCheckoutParentDomain'
 import { getRequestHostname } from 'src/utils/getRequestHostname'
+import {
+  isCookieSafeHostname,
+  isHostAllowed,
+  removeCookieDomain,
+  singleForwardedHost,
+} from 'src/utils/trustedForwardedHost'
 
 /**
  * Cookies holding the checkout orderForm of the previous commercial context.
@@ -42,6 +50,23 @@ const isAuthCookie = (cookie: unknown): cookie is VtexAuthCookie => {
   return Boolean(candidate?.Name?.trim() && candidate?.Value)
 }
 
+/**
+ * A non-positive `expiresIn` would turn into `Max-Age=0`, which expires the
+ * credential the response is supposed to install — logging the buyer out while
+ * the route reports success. Anything that is not a positive integer falls back
+ * to the default.
+ */
+const resolveMaxAge = (expiresIn: unknown): number =>
+  typeof expiresIn === 'number' && Number.isInteger(expiresIn) && expiresIn > 0
+    ? expiresIn
+    : DEFAULT_AUTH_COOKIE_MAX_AGE
+
+/**
+ * Uses the forwarded protocol when a proxy sets it, otherwise the connection
+ * itself. A non-local hostname alone does not imply https: a `Secure` cookie
+ * sent over plain http is dropped by the browser while the route reports
+ * success.
+ */
 const isSecureRequest = (request: NextApiRequest): boolean => {
   const forwarded = request.headers['x-forwarded-proto']
   const proto = Array.isArray(forwarded) ? forwarded[0] : forwarded
@@ -50,41 +75,162 @@ const isSecureRequest = (request: NextApiRequest): boolean => {
     return proto.split(',')[0].trim() === 'https'
   }
 
-  const hostname = getRequestHostname(request.headers.host)
+  const socket = request.socket
+  return Boolean(socket && 'encrypted' in socket && socket.encrypted)
+}
+
+/**
+ * Every parent of `hostname` with at least two labels, closest first:
+ * `a.b.store.com` gives `b.store.com` and `store.com`. A parent that is a
+ * public suffix (e.g. `com.br`) is rejected by the browser, so expiring a
+ * cookie there is a no-op.
+ */
+const getParentDomains = (hostname: string): string[] => {
+  const labels = hostname.split('.')
 
-  return hostname !== 'localhost' && hostname !== '127.0.0.1'
+  return labels
+    .slice(1, -1)
+    .map((_, index) => labels.slice(index + 1).join('.'))
 }
 
 /**
- * A non-positive `expiresIn` would turn into `Max-Age=0`, which expires the
- * credential the response is supposed to install — logging the buyer out while
- * the route reports success. Anything that is not a positive integer falls back
- * to the default.
+ * Hosts where the auth cookies stay host-only: WebOps previews, whose ingress
+ * does not pass the browser host in `Host`, and local development.
+ * `{account}.vtex.app` is a production domain that receives the browser host,
+ * so it gets a Domain like any custom domain. `/api/graphql` keeps its wider
+ * `.vtex.app` list for the cookies it relays from upstream.
  */
-const resolveMaxAge = (expiresIn: unknown): number =>
-  typeof expiresIn === 'number' && Number.isInteger(expiresIn) && expiresIn > 0
-    ? expiresIn
-    : DEFAULT_AUTH_COOKIE_MAX_AGE
+const HOST_ONLY_AUTH_COOKIE_SUFFIXES = [
+  'localhost',
+  '.localhost',
+  '.preview.vtex.app',
+]
+
+const isHostOnlyCookieHost = (hostname: string | null): boolean =>
+  !!hostname && isHostAllowed(hostname, HOST_ONLY_AUTH_COOKIE_SUFFIXES)
 
 /**
- * Mirrors the attributes the storefront used to write via `document.cookie`.
- * `HttpOnly` is deliberately left out: the cookie lives on a domain shared
- * with VTEX's own checkout, so hardening it is a separate, explicitly tested
- * change.
+ * Domain for the auth cookies, or `undefined` to write them host-only.
+ *
+ * Previews and local hosts stay host-only: behind the preview ingress `Host`
+ * is not the host the browser requested, and a mismatched Domain makes the browser drop
+ * the cookie while the route reports success. `x-forwarded-host` only decides
+ * that the cookie is host-only; it never chooses the Domain. IP literals and
+ * hosts that cannot be written verbatim into the attribute (including a
+ * trailing-dot FQDN) are host-only too.
+ */
+const resolveAuthCookieDomain = (
+  request: NextApiRequest
+): string | undefined => {
+  const hostname = getRequestHostname(request.headers.host)
+  const forwardedHost = getRequestHostname(
+    singleForwardedHost(request.headers['x-forwarded-host'])
+  )
+
+  if (
+    !hostname ||
+    isHostOnlyCookieHost(hostname) ||
+    isHostOnlyCookieHost(forwardedHost) ||
+    isIP(hostname) !== 0 ||
+    hostname.endsWith('.') ||
+    !isCookieSafeHostname(hostname)
+  ) {
+    return undefined
+  }
+
+  return hostname
+}
+
+/**
+ * Mirrors the attributes VTEX ID uses when it sets these cookies at login and
+ * refresh (`Domain=<host>; Path=/; Secure; SameSite=None; HttpOnly`).
+ *
+ * Browsers tell cookies apart by name, domain and path, and a cookie with a
+ * Domain attribute never matches a host-only one. Writing the contract token
+ * host-only would sit next to VTEX ID's cookie instead of replacing it, leaving
+ * two `VtexIdclientAutCookie_<account>` with different contracts. Each reader
+ * then picks a different one. Any host-only copy left by earlier versions is
+ * expired in the same batch.
+ *
+ * VTEX ID's refresh also writes the cookie on the parent domain (e.g.
+ * `Domain=store.com` for `www.store.com`). Parent copies are expired, so the
+ * only auth cookie left holds the switched contract. The exception is the
+ * parent shared with a checkout on a sibling host (`secure.store.com`): the
+ * token is written there too, with the same value as the host copy, so
+ * checkout keeps the session after the switch.
+ *
+ * The Domain-scoped cookie is always `Secure`, like VTEX ID's, because the
+ * forwarded protocol is not reliable behind the CDN. The host-only fallback
+ * follows the request protocol so plain-http local hosts keep working.
  */
 const buildAuthCookies = (
   payload: SwitchPropertiesResponse,
+  domain: string | undefined,
   secure: boolean
 ): string[] => {
-  const maxAge = resolveMaxAge(payload.expiresIn)
-  const secureAttr = secure ? '; Secure' : ''
+  const checkoutParent = domain ? getCheckoutParentDomain(domain) : undefined
+  const staleScopes: Array<string | undefined> = domain
+    ? [
+        undefined,
+        ...getParentDomains(domain).filter(
+          (parent) => parent !== checkoutParent
+        ),
+      ]
+    : []
+  const writeScopes = checkoutParent ? [domain, checkoutParent] : [domain]
+  const attributes = (scope: string | undefined) =>
+    [
+      scope && `Domain=${scope}`,
+      'Path=/',
+      `Max-Age=${resolveMaxAge(payload.expiresIn)}`,
+      'HttpOnly',
+      (scope || secure) && 'Secure',
+      `SameSite=${scope ? 'None' : 'Lax'}`,
+    ]
+      .filter(Boolean)
+      .join('; ')
 
   return [payload.authCookie, payload.accountAuthCookie]
     .filter(isAuthCookie)
-    .map(
-      (cookie) =>
-        `${cookie.Name}=${cookie.Value}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secureAttr}`
-    )
+    .flatMap((cookie) => [
+      ...staleScopes.map((staleDomain) =>
+        expireCookieServer({
+          name: cookie.Name,
+          path: '/',
+          domain: staleDomain,
+        })
+      ),
+      ...writeScopes.map(
+        (scope) => `${cookie.Name}=${cookie.Value}; ${attributes(scope)}`
+      ),
+    ])
+}
+
+/**
+ * `switch-properties` also issues `vid_rt` (the refresh token) on the
+ * Authenticator refresh paths. It is called server-side on
+ * `<account>.myvtex.com`, so its Domain points there and the browser would
+ * reject it. Re-scope it like the auth cookies so the next B2B refresh, which
+ * goes through the Authenticator route, finds it.
+ *
+ * Only relayed with `experimental.refreshToken` on: otherwise nothing uses it,
+ * and `/api/fs/logout` does not expire it either, so it would outlive logout.
+ */
+const relayRefreshTokenCookies = (
+  headers: Headers | undefined,
+  domain: string | undefined
+): string[] => {
+  if (!storeConfig.experimental?.refreshToken) {
+    return []
+  }
+
+  return (headers?.getSetCookie?.() ?? [])
+    .filter((cookie) => cookie.trimStart().startsWith('vid_rt='))
+    .map((cookie) => {
+      const hostOnly = removeCookieDomain(cookie)
+
+      return domain ? `${hostOnly}; Domain=${domain}` : hostOnly
+    })
 }
 
 const buildOrderFormExpiryCookies = (request: NextApiRequest): string[] => {
@@ -167,8 +313,11 @@ const handler: NextApiHandler<SwitchContractResponse> = async (
       return
     }
 
+    const domain = resolveAuthCookieDomain(request)
+
     response.setHeader('Set-Cookie', [
-      ...buildAuthCookies(payload, isSecureRequest(request)),
+      ...buildAuthCookies(payload, domain, isSecureRequest(request)),
+      ...relayRefreshTokenCookies(switchResponse.headers, domain),
       ...buildOrderFormExpiryCookies(request),
     ])
 

package/src/pages/api/graphql.ts

@@ -1,5 +1,6 @@
 import {
   BadRequestError,
+  type CacheControl,
   UnauthorizedError,
   isFastStoreError,
   stringifyCacheControl,
@@ -10,8 +11,9 @@ import type { NextApiHandler, NextApiRequest } from 'next'
 import discoveryConfig from 'discovery.config'
 import { getJWTAutCookie } from 'src/utils/getCookie'
 import { getRequestHostname } from 'src/utils/getRequestHostname'
-import { isLocalHost } from 'src/utils/isLocalHost'
+import { shouldBypassRefreshTokenForRequest } from 'src/utils/shouldBypassRefreshToken'
 import {
+  HOST_ONLY_COOKIE_HOST_SUFFIXES,
   isHostAllowed,
   removeCookieDomain,
   singleForwardedHost,
@@ -24,7 +26,6 @@ const OTELLogger = logger('@faststore/core')
 
 const DEFAULT_MAX_AGE = 5 * 60 // 5 minutes
 const DEFAULT_STALE_WHILE_REVALIDATE = 60 * 60 // 1 hour
-const ALLOWED_HOST_SUFFIXES = ['localhost', '.vtex.app', '.localhost']
 
 /**
  * Recovers a FastStoreError from an execution error, whether it is the error
@@ -87,7 +88,8 @@ const normalizeSetCookieDomain = ({
     OTELLogger('warn', 'Ignoring multi-value or malformed x-forwarded-host')
   }
   const host =
-    forwardedHost && isHostAllowed(forwardedHost, ALLOWED_HOST_SUFFIXES)
+    forwardedHost &&
+    isHostAllowed(forwardedHost, HOST_ONLY_COOKIE_HOST_SUFFIXES)
       ? forwardedHost
       : getRequestHostname(request.headers.host)
   if (!host) {
@@ -96,7 +98,7 @@ const normalizeSetCookieDomain = ({
   const cookieDomain = domainMatch[1]
 
   if (
-    !isHostAllowed(host, ALLOWED_HOST_SUFFIXES) ||
+    !isHostAllowed(host, HOST_ONLY_COOKIE_HOST_SUFFIXES) ||
     !shouldReplaceCookieDomain({ cookieDomain, host })
   ) {
     return setCookie
@@ -260,6 +262,87 @@ const respondToUnexpectedError = (
   response.status(500).end()
 }
 
+/**
+ * With `experimental.refreshToken` on, rejects a ValidateSession with 401 when
+ * the token needs a refresh, so the client runs the refresh-token flow first.
+ *
+ * Skipped on localhost and WebOps previews: neither proxies VTEX ID, so the
+ * refresh would fail and log out a manually injected auth cookie.
+ */
+const assertValidateSessionTokenIsFresh = ({
+  request,
+  operationName,
+  sessionRefreshAfter,
+}: {
+  request: NextApiRequest
+  operationName: string | undefined
+  sessionRefreshAfter: string | null | undefined
+}) => {
+  if (
+    operationName !== 'ValidateSession' ||
+    !discoveryConfig.experimental?.refreshToken ||
+    shouldBypassRefreshTokenForRequest(request.headers)
+  ) {
+    return
+  }
+
+  const jwt = getJWTAutCookie({
+    headers: request.headers,
+    account: discoveryConfig.api.storeId,
+  })
+
+  if (shouldForceRefreshTokenForValidateSession({ jwt, sessionRefreshAfter })) {
+    throw new UnauthorizedError(
+      'Unauthorized: Token expired. Please login again or refresh the page.'
+    )
+  }
+}
+
+/**
+ * Cache-Control for a successful response: the directives collected while
+ * executing the operation when there are any, otherwise a default
+ * `s-maxage`/`stale-while-revalidate` for GET queries and `no-store` for
+ * everything else.
+ */
+const getSuccessCacheControl = ({
+  request,
+  operationName,
+  cacheControl,
+  hasAuthCookie,
+}: {
+  request: NextApiRequest
+  operationName: string | undefined
+  cacheControl: CacheControl | undefined
+  hasAuthCookie: boolean
+}) => {
+  if (cacheControl) {
+    return stringifyCacheControl(cacheControl, hasAuthCookie)
+  }
+
+  if (
+    request.method !== 'GET' ||
+    !operationName?.toLowerCase()?.endsWith('query')
+  ) {
+    return 'no-cache, no-store'
+  }
+
+  const graphqlCacheControl = discoveryConfig?.experimental?.graphqlCacheControl
+
+  const maxAge =
+    graphqlCacheControl?.maxAge && graphqlCacheControl.maxAge > 0
+      ? graphqlCacheControl.maxAge
+      : DEFAULT_MAX_AGE // 5 minutes
+
+  const staleWhileRevalidate =
+    graphqlCacheControl?.staleWhileRevalidate &&
+    graphqlCacheControl.staleWhileRevalidate > 0
+      ? graphqlCacheControl.staleWhileRevalidate
+      : DEFAULT_STALE_WHILE_REVALIDATE // 1 hour
+
+  const scope = hasAuthCookie ? 'private' : 'public'
+  return `${scope}, s-maxage=${maxAge}, stale-while-revalidate=${staleWhileRevalidate}`
+}
+
 const handler: NextApiHandler = async (request, response) => {
   if (request.method !== 'POST' && request.method !== 'GET') {
     response.status(405).end()
@@ -286,29 +369,11 @@ const handler: NextApiHandler = async (request, response) => {
       operation?.__meta__?.operationHash
     )
 
-    const isLocal = isLocalHost(getRequestHostname(request.headers.host))
-
-    if (
-      !isLocal &&
-      operation.__meta__.operationName === 'ValidateSession' &&
-      discoveryConfig.experimental?.refreshToken
-    ) {
-      const jwt = getJWTAutCookie({
-        headers: request.headers,
-        account: discoveryConfig.api.storeId,
-      })
-
-      const shouldRefreshToken = shouldForceRefreshTokenForValidateSession({
-        jwt,
-        sessionRefreshAfter: variables?.session?.refreshAfter,
-      })
-
-      if (shouldRefreshToken) {
-        throw new UnauthorizedError(
-          'Unauthorized: Token expired. Please login again or refresh the page.'
-        )
-      }
-    }
+    assertValidateSessionTokenIsFresh({
+      request,
+      operationName: operation.__meta__.operationName,
+      sessionRefreshAfter: variables?.session?.refreshAfter,
+    })
 
     // Prevents to call ValidateSession or ValidateCartMutation without session (required) and get GraphQLError
     const doNotRun =
@@ -338,39 +403,15 @@ const handler: NextApiHandler = async (request, response) => {
 
     const hasAuthCookie = hasVtexIdclientAutCookie(request)
 
-    if (extensions.cacheControl) {
-      const cacheControl = stringifyCacheControl(
-        extensions.cacheControl,
-        hasAuthCookie
-      )
-      response.setHeader('cache-control', cacheControl)
-    } else if (
-      request.method === 'GET' &&
-      operation.__meta__.operationName?.toLowerCase()?.endsWith('query')
-    ) {
-      const maxAge =
-        discoveryConfig?.experimental?.graphqlCacheControl?.maxAge &&
-        discoveryConfig?.experimental?.graphqlCacheControl?.maxAge > 0
-          ? discoveryConfig.experimental.graphqlCacheControl.maxAge
-          : DEFAULT_MAX_AGE // 5 minutes
-
-      const staleWhileRevalidate =
-        discoveryConfig?.experimental?.graphqlCacheControl
-          ?.staleWhileRevalidate &&
-        discoveryConfig?.experimental?.graphqlCacheControl
-          ?.staleWhileRevalidate > 0
-          ? discoveryConfig.experimental.graphqlCacheControl
-              .staleWhileRevalidate
-          : DEFAULT_STALE_WHILE_REVALIDATE // 1 hour
-
-      const scope = hasAuthCookie ? 'private' : 'public'
-      response.setHeader(
-        'cache-control',
-        `${scope}, s-maxage=${maxAge}, stale-while-revalidate=${staleWhileRevalidate}`
-      )
-    } else {
-      response.setHeader('cache-control', 'no-cache, no-store')
-    }
+    response.setHeader(
+      'cache-control',
+      getSuccessCacheControl({
+        request,
+        operationName: operation.__meta__.operationName,
+        cacheControl: extensions.cacheControl,
+        hasAuthCookie,
+      })
+    )
 
     const setCookieValues = Array.from(extensions.cookies.values())
     if (setCookieValues.length > 0 && !hasErrors) {

package/src/pages/pvt/account/403.tsx

@@ -24,8 +24,7 @@ import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { fetchMyAccountPageContent } from 'src/server/cms/fetchMyAccountPageContent'
-import { getRequestHostname } from 'src/utils/getRequestHostname'
-import { isLocalHost } from 'src/utils/isLocalHost'
+import { shouldBypassRefreshTokenForRequest } from 'src/utils/shouldBypassRefreshToken'
 import { withLocaleValidationSSR } from 'src/utils/localization/withLocaleValidation'
 import { getMyAccountRedirect } from 'src/utils/myAccountRedirect'
 
@@ -137,14 +136,16 @@ const getServerSidePropsBase: GetServerSideProps<
 
     const statusCode: number = (account.errors[0] as any)?.extensions?.status
 
-    const isLocal = isLocalHost(getRequestHostname(context.req.headers.host))
+    const bypassRefreshToken = shouldBypassRefreshTokenForRequest(
+      context.req.headers
+    )
 
     return {
       props: {
         globalSections: globalSectionsResult,
         pageSections: pageContent.sections,
         needsRefreshToken:
-          !isLocal &&
+          !bypassRefreshToken &&
           (statusCode === 401 || statusCode === 403) &&
           storeConfig.experimental?.refreshToken,
         fromPage,

package/src/pages/pvt/account/cards/index.tsx

@@ -21,7 +21,7 @@ import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountCardsPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
 import { getB2BSessionClaims } from 'src/sdk/account/getB2BSessionClaims'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
@@ -72,7 +72,7 @@ export default function ListCardsPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ListCardsPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -89,7 +89,7 @@ export default function ListCardsPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -109,7 +109,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -249,7 +249,7 @@ const getServerSidePropsBase: GetServerSideProps<
         hasError,
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/orders/[id].tsx

@@ -23,7 +23,7 @@ import storeConfig from 'discovery.config'
 import { getGlobalSectionsData } from 'src/components/cms/GlobalSections'
 import { default as AfterSection } from 'src/customizations/src/myAccount/extensions/orders/[id]/after'
 import { default as BeforeSection } from 'src/customizations/src/myAccount/extensions/orders/[id]/before'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import PageProvider from 'src/sdk/overrides/PageProvider'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
@@ -51,7 +51,7 @@ export default function OrderDetailsPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: OrderDetailsPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -68,7 +68,7 @@ export default function OrderDetailsPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -313,7 +313,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -415,7 +415,7 @@ const getServerSidePropsBase: GetServerSideProps<
         ...(orderStatusLabels ? { orderStatusLabels } : {}),
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/orders/index.tsx

@@ -22,7 +22,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountOrdersListPageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { execute } from 'src/server'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
@@ -52,7 +52,7 @@ export default function ListOrdersPage({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ListOrdersPageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -69,7 +69,7 @@ export default function ListOrdersPage({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -132,7 +132,7 @@ const getServerSidePropsBase: GetServerSideProps<
   Record<string, string>,
   Locator
 > = async (context) => {
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -265,7 +265,7 @@ const getServerSidePropsBase: GetServerSideProps<
         },
       },
       pageSections,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }

package/src/pages/pvt/account/profile.tsx

@@ -22,7 +22,7 @@ import { default as BeforeSection } from 'src/customizations/src/myAccount/exten
 import type { MyAccountProps } from 'src/experimental/myAccountServerSideProps'
 import type { AccountProfilePageData } from 'src/sdk/account/accountPageContext'
 import type { AccountNavigationLabels } from 'src/sdk/account/getMyAccountRoutes'
-import { getIsRepresentative } from 'src/sdk/account/getIsRepresentative'
+import { getIsB2BBuyer } from 'src/sdk/account/getIsB2BBuyer'
 import { injectGlobalSections } from 'src/server/cms/global'
 import { extractAccountNavigationData } from 'src/server/cms/myAccountDefaultSections'
 import { fetchMyAccountPageContent } from 'src/server/cms/fetchMyAccountPageContent'
@@ -51,7 +51,7 @@ export default function Profile({
   navigationLabels,
   accountPageData,
   accountName,
-  isRepresentative,
+  isB2BBuyer,
 }: ProfilePageProps) {
   const { sections: globalSections, settings: globalSettings } =
     globalSectionsProp ?? {}
@@ -68,7 +68,7 @@ export default function Profile({
         <NextSeo noindex nofollow />
 
         <Layout
-          isRepresentative={isRepresentative}
+          isB2BBuyer={isB2BBuyer}
           accountName={accountName}
           navigationLabels={navigationLabels}
         >
@@ -108,7 +108,7 @@ const getServerSidePropsBase: GetServerSideProps<
     return { redirect }
   }
 
-  const isRepresentative = getIsRepresentative({
+  const isB2BBuyer = getIsB2BBuyer({
     headers: context.req.headers as Record<string, string>,
     account: storeConfig.api.storeId,
   })
@@ -184,7 +184,7 @@ const getServerSidePropsBase: GetServerSideProps<
       },
       pageSections,
       navigationLabels: navigationData as AccountNavigationLabels,
-      isRepresentative,
+      isB2BBuyer,
     },
   }
 }