@faststore/core 4.10.1 → 4.10.2-dev.0

package/test/pages/api/logout.test.ts

@@ -0,0 +1,106 @@
+import type { NextApiRequest, NextApiResponse } from 'next'
+import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+
+const mockConfig = vi.hoisted(() => ({
+  default: {
+    experimental: { refreshToken: true } as Record<string, unknown>,
+  } as { experimental: Record<string, unknown>; secureSubdomain?: string },
+}))
+
+vi.mock('discovery.config', () => ({ __esModule: true, ...mockConfig }))
+
+function createReqRes(cookie = 'VtexIdclientAutCookie_test-store=token') {
+  const res = {
+    status: vi.fn().mockReturnThis(),
+    json: vi.fn(),
+    end: vi.fn(),
+    setHeader: vi.fn(),
+  }
+
+  return {
+    req: {
+      method: 'POST',
+      headers: { host: 'store.example.com', cookie },
+    } as unknown as NextApiRequest,
+    res: res as unknown as NextApiResponse & { setHeader: Mock },
+  }
+}
+
+const setCookiesFrom = (res: { setHeader: Mock }): string[] =>
+  (res.setHeader.mock.calls.find(
+    ([name]) => String(name).toLowerCase() === 'set-cookie'
+  )?.[1] as string[] | undefined) ?? []
+
+async function getHandler() {
+  const mod = await import('../../../src/pages/api/fs/logout')
+  return mod.default
+}
+
+describe('/api/fs/logout', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    mockConfig.default.experimental = { refreshToken: true }
+    mockConfig.default.secureSubdomain = undefined
+  })
+
+  it('expires vid_rt on every path it can be scoped to, even though the request never carries it', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const vidRt = setCookiesFrom(res).filter((cookie) =>
+      cookie.startsWith('vid_rt=;')
+    )
+
+    for (const path of [
+      '/api/vtexid/refreshtoken/webstore',
+      '/api/authenticator/refreshtoken/webstore',
+      '/api/authenticator/v1/refreshtoken/webstore',
+    ]) {
+      expect(vidRt.some((cookie) => cookie.includes(`path=${path}`))).toBe(true)
+    }
+  })
+
+  it('does not touch vid_rt when refresh token is disabled', async () => {
+    mockConfig.default.experimental = {}
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(
+      setCookiesFrom(res).some((cookie) => cookie.startsWith('vid_rt='))
+    ).toBe(false)
+  })
+
+  it('expires the auth cookie on the parent shared with a sibling checkout host', async () => {
+    mockConfig.default.secureSubdomain = 'https://secure.example.com'
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(
+      setCookiesFrom(res).filter((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=;')
+      )
+    ).toEqual(
+      expect.arrayContaining([expect.stringContaining('; domain=example.com;')])
+    )
+  })
+
+  it('does not touch the parent domain when checkout runs on the store host', async () => {
+    mockConfig.default.secureSubdomain = 'https://store.example.com'
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(
+      setCookiesFrom(res).some((cookie) =>
+        cookie.includes('; domain=example.com;')
+      )
+    ).toBe(false)
+  })
+})

package/test/pages/api/switch-contract.test.ts

@@ -3,11 +3,19 @@ import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
 
 import type { SwitchContractResponse } from '../../../src/pages/api/fs/switch-contract'
 
-vi.mock('discovery.config', () => ({
-  __esModule: true,
-  default: { api: { storeId: 'test-store' } },
+const mockConfig = vi.hoisted(() => ({
+  default: {
+    api: { storeId: 'test-store' },
+    experimental: { refreshToken: true } as Record<string, unknown>,
+  } as {
+    api: { storeId: string }
+    experimental: Record<string, unknown>
+    secureSubdomain?: string
+  },
 }))
 
+vi.mock('discovery.config', () => ({ __esModule: true, ...mockConfig }))
+
 const CONTRACT_ID = '69b5d80e-8f61-44e0-a5cb-db54c326699c'
 const ORDER_FORM_COOKIES =
   'checkout.vtex.com=__ofid=abc123; CheckoutOrderFormOwnership=owner-1'
@@ -74,6 +82,7 @@ const setCookiesFrom = (res: { setHeader: Mock }): string[] => {
 describe('/api/fs/switch-contract', () => {
   beforeEach(() => {
     vi.resetModules()
+    mockConfig.default.secureSubdomain = undefined
     global.fetch = vi.fn().mockResolvedValue({
       ok: true,
       status: 200,
@@ -185,20 +194,299 @@ describe('/api/fs/switch-contract', () => {
     expect(res.json).toHaveBeenCalledWith({ success: true })
   })
 
-  it('carries Max-Age from expiresIn and Secure behind https', async () => {
+  it('writes the auth cookie with the same scope VTEX ID uses', async () => {
     const handler = await getHandler()
     const { req, res } = createReqRes()
 
     await handler(req, res)
 
     const authCookie = setCookiesFrom(res).find((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=new-contract-token')
+    )
+
+    expect(authCookie).toBe(
+      'VtexIdclientAutCookie_test-store=new-contract-token; Domain=store.example.com; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=None'
+    )
+  })
+
+  it('stays Secure even when the proxy forwards plain http', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { 'x-forwarded-proto': 'http' },
+    })
+
+    await handler(req, res)
+
+    const authCookie = setCookiesFrom(res).find((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=new-contract-token')
+    )
+
+    expect(authCookie).toContain('; Secure')
+  })
+
+  it('expires a leftover host-only auth cookie before setting the scoped one', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=')
+    )
+
+    expect(authCookies).toHaveLength(3)
+    expect(authCookies[0]).toMatch(/^VtexIdclientAutCookie_test-store=;/)
+    expect(authCookies[0]).toContain('max-age=0')
+    expect(authCookies[0]).toContain('path=/')
+    // Host-only: no Domain, so it cannot touch VTEX ID's scoped cookie.
+    expect(authCookies[0].toLowerCase()).not.toContain('domain=')
+    expect(authCookies[2]).toContain('Domain=store.example.com')
+  })
+
+  it('expires the copy VTEX ID refresh leaves on the parent domain', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=')
+    )
+
+    expect(authCookies[1]).toMatch(/^VtexIdclientAutCookie_test-store=;/)
+    expect(authCookies[1]).toContain('max-age=0')
+    expect(authCookies[1]).toContain('path=/')
+    expect(authCookies[1]).toContain('domain=example.com')
+    // The new token is never written to the parent domain.
+    expect(
+      authCookies.filter((cookie) => cookie.includes('new-contract-token'))
+    ).toEqual([expect.stringContaining('Domain=store.example.com;')])
+  })
+
+  it.each([
+    ['a single-label parent', 'store.com', []],
+    ['a deep host', 'a.b.store.com', ['b.store.com', 'store.com']],
+    ['a two-level suffix', 'www.store.com.br', ['store.com.br', 'com.br']],
+    ['a .co.uk store', 'www.store.co.uk', ['store.co.uk', 'co.uk']],
+    ['a .com.au store', 'shop.store.com.au', ['store.com.au', 'com.au']],
+  ])('expires every parent domain for %s', async (_label, host, parents) => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ headers: { host } })
+
+    await handler(req, res)
+
+    const expiredDomains = setCookiesFrom(res)
+      .filter((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=;')
+      )
+      .map((cookie) => cookie.match(/domain=([^;]+)/)?.[1])
+      .filter(Boolean)
+
+    expect(expiredDomains).toEqual(parents)
+  })
+
+  it.each(['www.store.com.br', 'www.store.co.uk', 'shop.store.com.au'])(
+    'writes the new token only on the request host for %s, never on a parent or public suffix',
+    async (host) => {
+      const handler = await getHandler()
+      const { req, res } = createReqRes({ headers: { host } })
+
+      await handler(req, res)
+
+      // Parents (including public suffixes such as co.uk, which the browser
+      // rejects) only ever get expiries; the token is scoped to the host.
+      expect(
+        setCookiesFrom(res).filter((cookie) =>
+          cookie.includes('new-contract-token')
+        )
+      ).toEqual([expect.stringContaining(`; Domain=${host}; Path=/;`)])
+    }
+  )
+
+  describe('with checkout on a sibling host', () => {
+    const tokenCookies = (cookies: string[]) =>
+      cookies.filter((cookie) => cookie.includes('new-contract-token'))
+
+    it('writes the same token on the host and on the shared parent', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.example.com'
+      const handler = await getHandler()
+      const { req, res } = createReqRes()
+
+      await handler(req, res)
+
+      const cookies = setCookiesFrom(res)
+
+      expect(tokenCookies(cookies)).toEqual([
+        'VtexIdclientAutCookie_test-store=new-contract-token; Domain=store.example.com; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=None',
+        'VtexIdclientAutCookie_test-store=new-contract-token; Domain=example.com; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=None',
+      ])
+      expect(
+        cookies.some(
+          (cookie) =>
+            cookie.startsWith('VtexIdclientAutCookie_test-store=;') &&
+            cookie.includes('domain=example.com;')
+        )
+      ).toBe(false)
+    })
+
+    it('still expires the parents above the shared one', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.b.store.com'
+      const handler = await getHandler()
+      const { req, res } = createReqRes({ headers: { host: 'a.b.store.com' } })
+
+      await handler(req, res)
+
+      const cookies = setCookiesFrom(res)
+      const expiredDomains = cookies
+        .filter((cookie) =>
+          cookie.startsWith('VtexIdclientAutCookie_test-store=;')
+        )
+        .map((cookie) => cookie.match(/domain=([^;]+)/)?.[1])
+        .filter(Boolean)
+
+      expect(expiredDomains).toEqual(['store.com'])
+      expect(tokenCookies(cookies)).toEqual([
+        expect.stringContaining('; Domain=a.b.store.com; Path=/;'),
+        expect.stringContaining('; Domain=b.store.com; Path=/;'),
+      ])
+    })
+
+    it.each([
+      ['on the store host', 'https://store.example.com'],
+      ['on a subdomain of the store host', 'https://secure.store.example.com'],
+      ['on an unrelated domain', 'https://secure.other.org'],
+      ['with an invalid URL', 'not a url'],
+    ])('writes only the host copy with checkout %s', async (_label, url) => {
+      mockConfig.default.secureSubdomain = url
+      const handler = await getHandler()
+      const { req, res } = createReqRes()
+
+      await handler(req, res)
+
+      expect(tokenCookies(setCookiesFrom(res))).toEqual([
+        expect.stringContaining('; Domain=store.example.com; Path=/;'),
+      ])
+    })
+
+    it('keeps preview hosts host-only', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.vtex.app'
+      const handler = await getHandler()
+      const { req, res } = createReqRes({
+        headers: { host: 'sfj-abc--test-store.preview.vtex.app' },
+      })
+
+      await handler(req, res)
+
+      const cookies = tokenCookies(setCookiesFrom(res))
+
+      expect(cookies).toHaveLength(1)
+      expect(cookies[0].toLowerCase()).not.toContain('domain=')
+    })
+
+    it('keeps vid_rt on the store host', async () => {
+      mockConfig.default.secureSubdomain = 'https://secure.example.com'
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+        status: 200,
+        json: async () => successPayload,
+        headers: {
+          getSetCookie: () => [
+            'vid_rt=rt-1; path=/api/authenticator/v1/refreshtoken/webstore; secure; httponly; Domain=test-store.myvtex.com',
+          ],
+        },
+      })
+      const handler = await getHandler()
+      const { req, res } = createReqRes()
+
+      await handler(req, res)
+
+      expect(
+        setCookiesFrom(res).filter((cookie) => cookie.startsWith('vid_rt='))
+      ).toEqual([expect.stringMatching(/; Domain=store\.example\.com$/)])
+    })
+  })
+
+  it('scopes the cookie to an {account}.vtex.app production host', async () => {
+    // Unlike previews, this domain receives the browser host in `Host`.
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { host: 'test-store.vtex.app' },
+    })
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
+      cookie.includes('new-contract-token')
+    )
+
+    expect(authCookies).toEqual([
+      expect.stringContaining('; Domain=test-store.vtex.app; Path=/;'),
+    ])
+  })
+
+  it.each([
+    ['a preview Host', { host: 'sfj-abc--test-store.preview.vtex.app' }],
+    [
+      'a preview x-forwarded-host behind an internal Host',
+      {
+        host: 'discovery.internal',
+        'x-forwarded-host': 'sfj-abc--test-store.preview.vtex.app',
+      },
+    ],
+    ['a .localhost Host', { host: 'store.localhost:3000' }],
+    ['a trailing-dot FQDN', { host: 'store.example.com.' }],
+  ])('writes a single host-only cookie for %s', async (_label, headers) => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ headers })
+
+    await handler(req, res)
+
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
       cookie.startsWith('VtexIdclientAutCookie_test-store=')
     )
 
-    expect(authCookie).toContain('Max-Age=3600')
-    expect(authCookie).toContain('Path=/')
-    expect(authCookie).toContain('SameSite=Lax')
-    expect(authCookie).toContain('Secure')
+    expect(authCookies).toHaveLength(1)
+    expect(authCookies[0]).toContain('new-contract-token; Path=/;')
+    expect(authCookies[0].toLowerCase()).not.toContain('domain=')
+  })
+
+  it('does not let x-forwarded-host choose the Domain', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { 'x-forwarded-host': 'attacker.example.org' },
+    })
+
+    await handler(req, res)
+
+    const cookies = setCookiesFrom(res)
+
+    expect(cookies).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(
+          'new-contract-token; Domain=store.example.com;'
+        ),
+      ])
+    )
+    expect(
+      cookies.some((cookie) => cookie.includes('attacker.example.org'))
+    ).toBe(false)
+  })
+
+  it('strips the port from the Host header', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { host: 'store.example.com:443' },
+    })
+
+    await handler(req, res)
+
+    expect(setCookiesFrom(res)).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(
+          'new-contract-token; Domain=store.example.com; Path=/'
+        ),
+      ])
+    )
   })
 
   it.each([
@@ -222,7 +510,7 @@ describe('/api/fs/switch-contract', () => {
       await handler(req, res)
 
       const authCookie = setCookiesFrom(res).find((cookie) =>
-        cookie.startsWith('VtexIdclientAutCookie_test-store=')
+        cookie.startsWith('VtexIdclientAutCookie_test-store=new-contract-token')
       )
 
       // Max-Age=0 would delete the very credential this response installs.
@@ -231,19 +519,154 @@ describe('/api/fs/switch-contract', () => {
     }
   )
 
-  it('omits Secure on plain http', async () => {
+  it.each([
+    ['localhost', 'localhost:3000'],
+    ['127.0.0.1', '127.0.0.1:3000'],
+    ['a LAN IP', '192.168.1.10'],
+    ['an unsafe host', 'store.example.com;evil=1'],
+  ])('writes a single host-only cookie on %s', async (_label, host) => {
     const handler = await getHandler()
     const { req, res } = createReqRes({
-      headers: { 'x-forwarded-proto': 'http' },
+      headers: { host, 'x-forwarded-proto': 'http' },
     })
 
     await handler(req, res)
 
-    const authCookie = setCookiesFrom(res).find((cookie) =>
+    const authCookies = setCookiesFrom(res).filter((cookie) =>
       cookie.startsWith('VtexIdclientAutCookie_test-store=')
     )
 
-    expect(authCookie).not.toContain('Secure')
+    // No Domain means the cookie already replaces the host-only one, so
+    // expiring it in the same batch would delete the new credential.
+    expect(authCookies).toEqual([
+      'VtexIdclientAutCookie_test-store=new-contract-token; Path=/; Max-Age=3600; HttpOnly; SameSite=Lax',
+    ])
+  })
+
+  it.each([
+    ['a LAN IP', '192.168.1.10'],
+    ['an IPv6 literal', '[2001:db8::1]'],
+  ])(
+    'keeps the host-only cookie Secure on %s over https',
+    async (_label, host) => {
+      const handler = await getHandler()
+      const { req, res } = createReqRes({
+        headers: { host, 'x-forwarded-proto': 'https' },
+      })
+
+      await handler(req, res)
+
+      const authCookies = setCookiesFrom(res).filter((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=')
+      )
+
+      expect(authCookies).toEqual([
+        'VtexIdclientAutCookie_test-store=new-contract-token; Path=/; Max-Age=3600; HttpOnly; Secure; SameSite=Lax',
+      ])
+    }
+  )
+
+  it.each([
+    ['plain http', false, ''],
+    ['a TLS connection', true, '; Secure'],
+  ])(
+    'follows the connection without x-forwarded-proto on %s',
+    async (_label, encrypted, secureAttr) => {
+      const handler = await getHandler()
+      const { req, res } = createReqRes({
+        headers: { host: '192.168.1.10', 'x-forwarded-proto': undefined },
+        socket: { encrypted } as unknown as NextApiRequest['socket'],
+      })
+
+      await handler(req, res)
+
+      const authCookies = setCookiesFrom(res).filter((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=')
+      )
+
+      expect(authCookies).toEqual([
+        `VtexIdclientAutCookie_test-store=new-contract-token; Path=/; Max-Age=3600; HttpOnly${secureAttr}; SameSite=Lax`,
+      ])
+    }
+  )
+
+  it('relays the upstream vid_rt re-scoped to the storefront host', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => successPayload,
+      headers: {
+        getSetCookie: () => [
+          'vid_rt=rt-1; expires=Thu, 22 Oct 2027 00:00:00 GMT; domain=test-store.myvtex.com; path=/api/authenticator/v1/refreshtoken/webstore; secure; samesite=strict; httponly',
+          'VtexIdclientAutCookie_test-store=upstream-token; domain=test-store.myvtex.com; path=/',
+        ],
+      },
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const cookies = setCookiesFrom(res)
+    const vidRt = cookies.filter((cookie) => cookie.startsWith('vid_rt='))
+
+    expect(vidRt).toEqual([
+      'vid_rt=rt-1; expires=Thu, 22 Oct 2027 00:00:00 GMT; path=/api/authenticator/v1/refreshtoken/webstore; secure; samesite=strict; httponly; Domain=store.example.com',
+    ])
+    // Only vid_rt is relayed; the auth cookie still comes from the payload.
+    expect(cookies.some((cookie) => cookie.includes('upstream-token'))).toBe(
+      false
+    )
+  })
+
+  it('does not relay vid_rt when refresh token is disabled', async () => {
+    mockConfig.default.experimental = {}
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => successPayload,
+      headers: {
+        getSetCookie: () => [
+          'vid_rt=rt-1; domain=test-store.myvtex.com; path=/api/authenticator/v1/refreshtoken/webstore; secure; httponly',
+        ],
+      },
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    try {
+      await handler(req, res)
+    } finally {
+      mockConfig.default.experimental = { refreshToken: true }
+    }
+
+    const cookies = setCookiesFrom(res)
+    expect(cookies.some((cookie) => cookie.startsWith('vid_rt='))).toBe(false)
+    // The contract switch itself still goes through.
+    expect(
+      cookies.some((cookie) => cookie.includes('new-contract-token'))
+    ).toBe(true)
+  })
+
+  it('relays vid_rt host-only when the auth cookie is host-only', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => successPayload,
+      headers: {
+        getSetCookie: () => [
+          'vid_rt=rt-1; domain=test-store.myvtex.com; path=/api/vtexid/refreshtoken/webstore; httponly',
+        ],
+      },
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ headers: { host: 'localhost:3000' } })
+
+    await handler(req, res)
+
+    expect(
+      setCookiesFrom(res).filter((cookie) => cookie.startsWith('vid_rt='))
+    ).toEqual(['vid_rt=rt-1; path=/api/vtexid/refreshtoken/webstore; httponly'])
   })
 
   it('also emits the accountAuthCookie when present', async () => {
@@ -263,9 +686,14 @@ describe('/api/fs/switch-contract', () => {
 
     await handler(req, res)
 
-    expect(setCookiesFrom(res)).toEqual(
+    const cookies = setCookiesFrom(res)
+
+    expect(cookies).toEqual(
       expect.arrayContaining([
-        expect.stringContaining('VtexIdclientAutCookie_account=account-token'),
+        expect.stringMatching(/^VtexIdclientAutCookie_account=;.*max-age=0/),
+        expect.stringContaining(
+          'VtexIdclientAutCookie_account=account-token; Domain=store.example.com'
+        ),
       ])
     )
   })

package/test/pages/pvt/account/403.test.ts

@@ -0,0 +1,67 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mockExecute = vi.hoisted(() => vi.fn())
+
+vi.mock('src/server', () => ({ execute: mockExecute }))
+vi.mock('src/server/cms/global', () => ({
+  injectGlobalSections: vi.fn(() => ({ sections: [], settings: {} })),
+}))
+vi.mock('src/server/cms/fetchMyAccountPageContent', () => ({
+  fetchMyAccountPageContent: vi.fn(async () => ({ sections: [] })),
+}))
+vi.mock('src/components/cms/GlobalSections', () => ({
+  getGlobalSectionsData: vi.fn(() => [
+    Promise.resolve(null),
+    Promise.resolve(null),
+    Promise.resolve(null),
+  ]),
+}))
+
+import storeConfig from 'discovery.config'
+import { getServerSideProps } from 'src/pages/pvt/account/403'
+
+function makeContext(host: string) {
+  return {
+    req: { headers: { host } },
+    query: {},
+    previewData: undefined,
+    locale: undefined,
+  } as any
+}
+
+describe('/pvt/account/403 getServerSideProps refresh-token bypass', () => {
+  const originalRefreshToken = storeConfig.experimental.refreshToken
+
+  beforeEach(() => {
+    storeConfig.experimental.refreshToken = true
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+    mockExecute.mockResolvedValue({
+      data: null,
+      errors: [{ extensions: { status: 401 } }],
+    })
+  })
+
+  afterEach(() => {
+    storeConfig.experimental.refreshToken = originalRefreshToken
+    vi.restoreAllMocks()
+  })
+
+  it.each([
+    'localhost:3000',
+    '127.0.0.1:3000',
+    'brandless-abc123.preview.vtex.app',
+  ])('does not ask for a token refresh on %s', async (host) => {
+    const result: any = await getServerSideProps(makeContext(host))
+
+    expect(result.props.needsRefreshToken).toBe(false)
+  })
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'asks for a token refresh on the production host %s',
+    async (host) => {
+      const result: any = await getServerSideProps(makeContext(host))
+
+      expect(result.props.needsRefreshToken).toBe(true)
+    }
+  )
+})