@faststore/core 4.10.1 → 4.10.2

package/test/utils/shouldBypassRefreshToken.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest'
+import {
+  shouldBypassRefreshToken,
+  shouldBypassRefreshTokenBrowser,
+  shouldBypassRefreshTokenForRequest,
+} from '../../src/utils/shouldBypassRefreshToken'
+
+describe('shouldBypassRefreshToken', () => {
+  it.each(['localhost', '127.0.0.1'])('returns true for "%s"', (hostname) => {
+    expect(shouldBypassRefreshToken(hostname)).toBe(true)
+  })
+
+  it('returns true for a WebOps preview host', () => {
+    expect(shouldBypassRefreshToken('brandless-abc123.preview.vtex.app')).toBe(
+      true
+    )
+  })
+
+  it('is case-insensitive for preview hosts', () => {
+    expect(shouldBypassRefreshToken('Brandless-ABC123.Preview.VTEX.app')).toBe(
+      true
+    )
+  })
+
+  it('ignores the trailing dot of a fully qualified preview host', () => {
+    expect(shouldBypassRefreshToken('brandless-abc123.preview.vtex.app.')).toBe(
+      true
+    )
+  })
+
+  it('returns false for the production "{account}.vtex.app" domain', () => {
+    // `{account}.vtex.app` is a production default domain, not a preview.
+    expect(shouldBypassRefreshToken('brandless.vtex.app')).toBe(false)
+  })
+
+  it('returns false for a custom store domain', () => {
+    expect(shouldBypassRefreshToken('brandless.fast.store')).toBe(false)
+  })
+
+  it('returns false for hosts that only contain the preview suffix', () => {
+    expect(shouldBypassRefreshToken('preview.vtex.app')).toBe(false)
+    expect(shouldBypassRefreshToken('x.preview.vtex.app.evil.com')).toBe(false)
+  })
+
+  it('returns false for nullish or empty input', () => {
+    expect(shouldBypassRefreshToken(null)).toBe(false)
+    expect(shouldBypassRefreshToken(undefined)).toBe(false)
+    expect(shouldBypassRefreshToken('')).toBe(false)
+  })
+})
+
+describe('shouldBypassRefreshTokenForRequest', () => {
+  it('returns true when the Host header is a local or preview host', () => {
+    expect(shouldBypassRefreshTokenForRequest({ host: 'localhost:3000' })).toBe(
+      true
+    )
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'brandless-abc123.preview.vtex.app',
+      })
+    ).toBe(true)
+  })
+
+  it('returns true when the preview host arrives in x-forwarded-host', () => {
+    // Behind the preview ingress, Host is an internal name.
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'faststore-internal:3000',
+        'x-forwarded-host': 'brandless-abc123.preview.vtex.app',
+      })
+    ).toBe(true)
+  })
+
+  it('ignores a multi-value x-forwarded-host', () => {
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'brandless.fast.store',
+        'x-forwarded-host': 'brandless-abc123.preview.vtex.app, proxy',
+      })
+    ).toBe(false)
+  })
+
+  it('returns false on production hosts', () => {
+    expect(
+      shouldBypassRefreshTokenForRequest({
+        host: 'brandless.fast.store',
+        'x-forwarded-host': 'brandless.fast.store',
+      })
+    ).toBe(false)
+    expect(shouldBypassRefreshTokenForRequest({})).toBe(false)
+  })
+})
+
+describe('shouldBypassRefreshTokenBrowser', () => {
+  it('returns false when window is not available (SSR/Node)', () => {
+    expect(shouldBypassRefreshTokenBrowser()).toBe(false)
+  })
+})

package/test/utils/trustedForwardedHost.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 
 import {
+  isCookieSafeHostname,
   singleForwardedHost,
   isHostAllowed,
   removeCookieDomain,
@@ -103,3 +104,23 @@ describe('removeCookieDomain', () => {
     expect(removeCookieDomain('a=1; path=/')).toBe('a=1; path=/')
   })
 })
+
+describe('isCookieSafeHostname', () => {
+  it.each(['store.example.com', 'b2b-store.vtexfaststore.com', 'Store.COM'])(
+    'accepts %s',
+    (host) => {
+      expect(isCookieSafeHostname(host)).toBe(true)
+    }
+  )
+
+  it.each([
+    'store.com;evil=1',
+    'store.com path=/',
+    'store.com,other.com',
+    'store.com\r\nSet-Cookie: evil=1',
+    'store.com%0d%0a',
+    '',
+  ])('rejects %j', (host) => {
+    expect(isCookieSafeHostname(host)).toBe(false)
+  })
+})

package/src/sdk/account/getIsRepresentative.ts

@@ -1,20 +0,0 @@
-import { parse } from 'cookie'
-import { parseJwt } from 'src/utils/getCookie'
-
-type GetIsRepresentativeParams = {
-  headers?: Record<string, string>
-  account: string
-}
-
-export function getIsRepresentative({
-  headers,
-  account,
-}: GetIsRepresentativeParams): boolean {
-  const authCookie = parse(headers?.cookie ?? '')?.[
-    'VtexIdclientAutCookie_' + account
-  ]
-  const jwt = parseJwt(authCookie)
-
-  const isRepresentative = jwt?.isRepresentative
-  return !!isRepresentative
-}

package/test/utils/isLocalHost.browser.test.ts

@@ -1,37 +0,0 @@
-import { afterEach, describe, expect, it } from 'vitest'
-import { isLocalHostBrowser } from '../../src/utils/isLocalHost'
-
-const originalLocation = window.location
-
-function stubHostname(hostname: string) {
-  // jsdom forbids assigning to `window.location` directly, so we redefine the
-  // descriptor with a minimal stub that exposes the hostname we want to test.
-  Object.defineProperty(window, 'location', {
-    configurable: true,
-    value: { ...originalLocation, hostname },
-  })
-}
-
-describe('isLocalHostBrowser', () => {
-  afterEach(() => {
-    Object.defineProperty(window, 'location', {
-      configurable: true,
-      value: originalLocation,
-    })
-  })
-
-  it('returns true when window.location.hostname is "localhost"', () => {
-    stubHostname('localhost')
-    expect(isLocalHostBrowser()).toBe(true)
-  })
-
-  it('returns true when window.location.hostname is "127.0.0.1"', () => {
-    stubHostname('127.0.0.1')
-    expect(isLocalHostBrowser()).toBe(true)
-  })
-
-  it('returns false for a production hostname', () => {
-    stubHostname('brandless.fast.store')
-    expect(isLocalHostBrowser()).toBe(false)
-  })
-})