@faststore/core 4.10.1 → 4.10.2

package/src/utils/shouldBypassRefreshToken.ts

@@ -0,0 +1,63 @@
+import { getRequestHostname } from './getRequestHostname'
+import { isLocalHost } from './isLocalHost'
+import { isHostAllowed, singleForwardedHost } from './trustedForwardedHost'
+
+/**
+ * WebOps preview deployments are served under `<preview>.preview.vtex.app`.
+ *
+ * Only this subdomain is matched: `{account}.vtex.app` is a production default
+ * domain and MUST keep the refresh-token flow.
+ */
+const PREVIEW_HOST_SUFFIXES = ['.preview.vtex.app']
+
+/**
+ * Returns `true` when the refresh-token flow must be skipped for the given
+ * hostname: local development (`localhost` / `127.0.0.1`) and WebOps previews.
+ *
+ * Neither environment proxies VTEX ID, so `/api/vtexid/refreshtoken/webstore`
+ * always fails there and the resulting logout wipes a manually injected
+ * `VtexIdclientAutCookie_<account>` cookie. Skipping the flow lets developers
+ * test logged-in scenarios with that cookie alone.
+ *
+ * The input MUST be a bare hostname (no port). Use {@link getRequestHostname}
+ * on server-side request headers before calling this helper. A trailing dot
+ * (fully qualified name) is ignored.
+ */
+export function shouldBypassRefreshToken(
+  hostname: string | null | undefined
+): boolean {
+  if (!hostname) return false
+  const normalizedHostname = hostname.toLowerCase().replace(/\.$/, '')
+  return (
+    isLocalHost(normalizedHostname) ||
+    isHostAllowed(normalizedHostname, PREVIEW_HOST_SUFFIXES)
+  )
+}
+
+/**
+ * Server-side check from the request headers. Behind the WebOps preview
+ * ingress the browser host arrives in `x-forwarded-host` rather than `Host`
+ * (see `normalizeSetCookieDomain` in `pages/api/graphql.ts`), so both are
+ * checked. Both are client-controlled: a forged value only skips the forced
+ * refresh, which grants nothing since the JWT is still validated upstream.
+ */
+export function shouldBypassRefreshTokenForRequest(headers: {
+  host?: string
+  'x-forwarded-host'?: string | string[]
+}): boolean {
+  return (
+    shouldBypassRefreshToken(getRequestHostname(headers.host)) ||
+    shouldBypassRefreshToken(
+      getRequestHostname(singleForwardedHost(headers['x-forwarded-host']))
+    )
+  )
+}
+
+/**
+ * Browser-side wrapper that reads `window.location.hostname`. Returns `false`
+ * when `window` is not available (SSR/Node).
+ */
+export function shouldBypassRefreshTokenBrowser(): boolean {
+  if (globalThis.window === undefined) return false
+  return shouldBypassRefreshToken(globalThis.window.location.hostname)
+}

package/src/utils/trustedForwardedHost.ts

@@ -2,6 +2,24 @@
 // characters such as ";" or spaces would inject cookie attributes.
 const HOSTNAME_PATTERN = /^[a-z0-9.-]+$/
 
+/**
+ * Hosts whose upstream cookie domain does not match the browser host (previews
+ * and local development). Cookies served there are written host-only.
+ */
+export const HOST_ONLY_COOKIE_HOST_SUFFIXES = [
+  'localhost',
+  '.vtex.app',
+  '.localhost',
+]
+
+/**
+ * Whether `host` can be written as a Set-Cookie Domain attribute without
+ * injecting extra attributes.
+ */
+export function isCookieSafeHostname(host: string): boolean {
+  return HOSTNAME_PATTERN.test(host.toLowerCase())
+}
+
 /**
  * An entry starting with "." matches subdomains only; any other entry matches
  * the host itself and its subdomains. Matching is anchored on a label boundary,

package/test/components/account/Layout.test.tsx

@@ -60,7 +60,7 @@ describe('Layout', () => {
     mockUseSession.mockReturnValue({ b2b: { unitId: 'unit-1' } })
 
     render(
-      <Layout accountName="Jane Doe" isRepresentative={false}>
+      <Layout accountName="Jane Doe" isB2BBuyer={false}>
         content
       </Layout>
     )

package/test/components/account/Menu.browser.test.tsx

@@ -65,7 +65,7 @@ describe('Menu', () => {
 
   it('mounts the OrganizationDrawer with initialView "switch" when Switch is clicked', () => {
     mockUseSession.mockReturnValue({
-      b2b: { unitId: 'unit-1', isRepresentative: true },
+      b2b: { unitId: 'unit-1', customerId: 'contract-1' },
     })
 
     render(<Menu accountName="Jane" items={items} />)
@@ -79,19 +79,21 @@ describe('Menu', () => {
       expect.objectContaining({
         isOpen: true,
         initialView: 'switch',
-        isRepresentative: true,
+        isB2BBuyer: true,
       })
     )
   })
 
-  it('passes isRepresentative as a boolean even when b2b.isRepresentative is undefined', () => {
-    mockUseSession.mockReturnValue({ b2b: { unitId: 'unit-1' } })
+  it('passes isB2BBuyer for a B2B session without the isRepresentative flag', () => {
+    mockUseSession.mockReturnValue({
+      b2b: { unitId: 'unit-1', isRepresentative: false },
+    })
 
     render(<Menu accountName="Jane" items={items} />)
     fireEvent.click(screen.getByRole('button', { name: 'Switch' }))
 
     expect(mockOrganizationDrawer).toHaveBeenCalledWith(
-      expect.objectContaining({ isRepresentative: false })
+      expect.objectContaining({ isB2BBuyer: true })
     )
   })
 

package/test/components/account/OrganizationDrawer.browser.test.tsx

@@ -108,7 +108,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -124,7 +124,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -141,7 +141,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -152,7 +152,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen={false}
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -160,7 +160,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -181,7 +181,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -200,7 +200,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -215,7 +215,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={vi.fn()}
-        isRepresentative
+        isB2BBuyer
         initialView="switch"
       />
     )
@@ -258,7 +258,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -301,7 +301,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -313,7 +313,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen={false}
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -323,7 +323,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 
@@ -340,7 +340,7 @@ describe('OrganizationDrawer', () => {
       <OrganizationDrawer
         isOpen
         closeDrawer={mockCloseDrawer}
-        isRepresentative={false}
+        isB2BBuyer={false}
       />
     )
 

package/test/components/account/OrganizationDrawerBody.test.tsx

@@ -27,7 +27,7 @@ describe('OrganizationDrawerBody', () => {
   it('hides the Quotes route when the user is not an org member', () => {
     mockUseAccountNavigationLabels.mockReturnValue(undefined)
 
-    render(<OrganizationDrawerBody isRepresentative isOrgMember={false} />)
+    render(<OrganizationDrawerBody isB2BBuyer isOrgMember={false} />)
 
     expect(screen.queryByText('Quotes')).toBeNull()
     expect(screen.getByText('Profile')).toBeTruthy()
@@ -36,7 +36,7 @@ describe('OrganizationDrawerBody', () => {
   it('shows the Quotes route when the user belongs to an org unit', () => {
     mockUseAccountNavigationLabels.mockReturnValue(undefined)
 
-    render(<OrganizationDrawerBody isRepresentative isOrgMember />)
+    render(<OrganizationDrawerBody isB2BBuyer isOrgMember />)
 
     expect(screen.getByText('Quotes')).toBeTruthy()
   })
@@ -44,7 +44,7 @@ describe('OrganizationDrawerBody', () => {
   it('hides User Details when not a representative, regardless of org membership', () => {
     mockUseAccountNavigationLabels.mockReturnValue(undefined)
 
-    render(<OrganizationDrawerBody isRepresentative={false} isOrgMember />)
+    render(<OrganizationDrawerBody isB2BBuyer={false} isOrgMember />)
 
     expect(screen.queryByText('User Details')).toBeNull()
     expect(screen.getByText('Quotes')).toBeTruthy()

package/test/components/account/OrganizationSignInButton.browser.test.tsx

@@ -2,10 +2,13 @@
  * @vitest-environment jsdom
  */
 import '@testing-library/jest-dom/vitest'
-import { render, screen } from '@testing-library/react'
+import { fireEvent, render, screen } from '@testing-library/react'
 import { describe, expect, it, vi } from 'vitest'
 
 const mockUseSession = vi.hoisted(() => vi.fn())
+const mockOrganizationDrawer = vi.hoisted(() =>
+  vi.fn((_props: Record<string, unknown>) => null)
+)
 vi.mock('src/sdk/session', () => ({ useSession: mockUseSession }))
 vi.mock('src/sdk/account/accountPageContext', () => ({
   useAccountNavigationLabels: () => ({
@@ -16,7 +19,7 @@ vi.mock('src/sdk/account/accountPageContext', () => ({
 vi.mock(
   'src/components/account/Drawer/OrganizationDrawer/OrganizationDrawer',
   () => ({
-    OrganizationDrawer: () => null,
+    OrganizationDrawer: mockOrganizationDrawer,
   })
 )
 
@@ -30,7 +33,7 @@ describe('OrganizationSignInButton', () => {
       person: { id: 'p1' },
       b2b: { contractName: ' Caetano Corp ' },
     })
-    render(<OrganizationSignInButton icon={icon} isRepresentative />)
+    render(<OrganizationSignInButton icon={icon} isB2BBuyer />)
     expect(screen.getByRole('button', { name: 'account' })).toHaveTextContent(
       'Caetano Corp'
     )
@@ -41,9 +44,21 @@ describe('OrganizationSignInButton', () => {
       person: { id: 'p1' },
       b2b: { contractName: '' },
     })
-    render(<OrganizationSignInButton icon={icon} isRepresentative />)
+    render(<OrganizationSignInButton icon={icon} isB2BBuyer />)
     expect(screen.getByRole('button', { name: 'account' })).toHaveTextContent(
       'Company'
     )
   })
+
+  it.each([
+    ['isB2BBuyer', { isB2BBuyer: true }],
+    ['the deprecated isRepresentative', { isRepresentative: true }],
+  ])('opens the drawer as a B2B buyer from %s', (_label, props) => {
+    mockUseSession.mockReturnValue({ person: { id: 'p1' }, b2b: {} })
+    render(<OrganizationSignInButton icon={icon} {...props} />)
+    fireEvent.click(screen.getByRole('button', { name: 'account' }))
+    expect(mockOrganizationDrawer.mock.lastCall?.[0]).toMatchObject({
+      isB2BBuyer: true,
+    })
+  })
 })

package/test/components/navigation/Navbar.browser.test.tsx

@@ -146,11 +146,11 @@ describe('Navbar', () => {
     )
   })
 
-  it('forwards isSignInResolved=true and isOrganizationEnabled for a resolved B2B representative session', () => {
+  it('forwards isSignInResolved=true and isOrganizationEnabled for a resolved B2B session', () => {
     mockStoreConfig.experimental.enableFaststoreMyAccount = true
     mockUseScreenResize.mockReturnValue({ isDesktop: true })
     mockUseSession.mockReturnValue({
-      b2b: { isRepresentative: true },
+      b2b: { unitId: 'unit-1', customerId: 'contract-1' },
       isSessionReady: true,
       hasValidated: true,
     })
@@ -161,7 +161,7 @@ describe('Navbar', () => {
       expect.objectContaining({
         isSignInResolved: true,
         isOrganizationEnabled: true,
-        isRepresentative: true,
+        isB2BBuyer: true,
       })
     )
 

package/test/components/navigation/NavbarAccountArea.browser.test.tsx

@@ -11,17 +11,17 @@ vi.mock(
   () => ({
     OrganizationSignInButton: ({
       icon,
-      isRepresentative,
+      isB2BBuyer,
     }: {
       icon: { alt: string; icon: string }
-      isRepresentative?: boolean
+      isB2BBuyer?: boolean
     }) => (
       <button
         type="button"
         data-testid="organization-signin"
         data-icon={icon.alt}
       >
-        {isRepresentative ? 'Representative' : 'Not representative'}
+        {isB2BBuyer ? 'B2B buyer' : 'Not a B2B buyer'}
       </button>
     ),
   })
@@ -85,7 +85,7 @@ describe('NavbarAccountArea', () => {
       <NavbarAccountArea
         isSignInResolved
         isOrganizationEnabled
-        isRepresentative
+        isB2BBuyer
         signInButton={signInButton}
         ButtonSignIn={ButtonSignInStub}
         skeletonAttr="data-fs-navbar-signin-skeleton"
@@ -93,7 +93,7 @@ describe('NavbarAccountArea', () => {
     )
 
     expect(screen.getByTestId('organization-signin')).toHaveTextContent(
-      'Representative'
+      'B2B buyer'
     )
     expect(screen.queryByTestId('storefront-signin')).toBeNull()
   })

package/test/components/navigation/NavbarSlider.browser.test.tsx

@@ -120,10 +120,10 @@ describe('NavbarSlider', () => {
     )
   })
 
-  it('forwards isSignInResolved=true and isOrganizationEnabled once the B2B representative session resolves', () => {
+  it('forwards isSignInResolved=true and isOrganizationEnabled once the B2B session resolves', () => {
     mockStoreConfig.experimental.enableFaststoreMyAccount = true
     mockUseSession.mockReturnValue({
-      b2b: { isRepresentative: true },
+      b2b: { unitId: 'unit-1', customerId: 'contract-1' },
       isSessionReady: true,
       hasValidated: true,
     })
@@ -134,7 +134,7 @@ describe('NavbarSlider', () => {
       expect.objectContaining({
         isSignInResolved: true,
         isOrganizationEnabled: true,
-        isRepresentative: true,
+        isB2BBuyer: true,
       })
     )
 

package/test/experimental/myAccountCmsServerSideProps.test.ts

@@ -2,7 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mockValidateUser = vi.fn()
 const mockGetMyAccountRedirect = vi.fn()
-const mockGetIsRepresentative = vi.fn()
+const mockGetIsB2BBuyer = vi.fn()
 const mockFetchMyAccountPageContent = vi.fn()
 const mockGetGlobalSectionsData = vi.fn()
 const mockExecute = vi.fn()
@@ -20,8 +20,8 @@ vi.mock('src/utils/myAccountRedirect', () => ({
     mockGetMyAccountRedirect(...args),
 }))
 
-vi.mock('src/sdk/account/getIsRepresentative', () => ({
-  getIsRepresentative: (...args: unknown[]) => mockGetIsRepresentative(...args),
+vi.mock('src/sdk/account/getIsB2BBuyer', () => ({
+  getIsB2BBuyer: (...args: unknown[]) => mockGetIsB2BBuyer(...args),
 }))
 
 vi.mock('src/server/cms/fetchMyAccountPageContent', () => ({
@@ -78,7 +78,7 @@ function buildContext(overrides: Record<string, unknown> = {}) {
 describe('myAccountCmsServerSideProps', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockGetIsRepresentative.mockReturnValue(false)
+    mockGetIsB2BBuyer.mockReturnValue(false)
     mockGetGlobalSectionsData.mockReturnValue([
       Promise.resolve({ sections: [], settings: {} }),
       Promise.resolve({ sections: [] }),
@@ -176,7 +176,7 @@ describe('myAccountCmsServerSideProps', () => {
     expect(result).toMatchObject({
       props: {
         accountName: 'Ada',
-        isRepresentative: false,
+        isB2BBuyer: false,
         navigationLabels: { profileLabel: 'Profile' },
         pageSections: [
           {

package/test/pages/api/graphql.test.ts

@@ -9,14 +9,23 @@ import { GraphQLError } from 'graphql'
 import type { NextApiRequest, NextApiResponse } from 'next'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+import discoveryConfig from '../../../discovery.config'
 import handler from '../../../src/pages/api/graphql'
 import { execute } from '../../../src/server'
+import { shouldForceRefreshTokenForValidateSession } from '../../../src/utils/validateSessionRefreshToken'
 
 vi.mock('../../../src/server', () => ({
   execute: vi.fn(),
 }))
 
+vi.mock('../../../src/utils/validateSessionRefreshToken', () => ({
+  shouldForceRefreshTokenForValidateSession: vi.fn(),
+}))
+
 const mockedExecute = vi.mocked(execute)
+const mockedShouldForceRefreshToken = vi.mocked(
+  shouldForceRefreshTokenForValidateSession
+)
 
 const createResponse = ({ headersSent = false } = {}) => {
   const res = {
@@ -229,3 +238,169 @@ describe('/api/graphql request handling', () => {
     expect(res.end).toHaveBeenCalled()
   })
 })
+
+describe('/api/graphql ValidateSession refresh-token bypass', () => {
+  const originalRefreshToken = discoveryConfig.experimental.refreshToken
+
+  const createValidateSessionRequest = (
+    host: string,
+    extraHeaders: Record<string, string> = {}
+  ) =>
+    ({
+      method: 'GET',
+      url: '/api/graphql',
+      headers: { host, ...extraHeaders },
+      query: {
+        operationName: 'ValidateSession',
+        operationHash: 'hash',
+        variables: JSON.stringify({ session: {} }),
+      },
+    }) as unknown as NextApiRequest
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    discoveryConfig.experimental.refreshToken = true
+    mockedShouldForceRefreshToken.mockReturnValue(true)
+    mockedExecute.mockResolvedValue({
+      data: { validateSession: null },
+      errors: undefined,
+      extensions: { cookies: new Map(), cacheControl: undefined },
+    } as never)
+  })
+
+  afterEach(() => {
+    discoveryConfig.experimental.refreshToken = originalRefreshToken
+  })
+
+  it.each([
+    'localhost:3000',
+    '127.0.0.1:3000',
+    'brandless-abc123.preview.vtex.app',
+  ])('does not force a 401 on %s', async (host) => {
+    const res = createResponse()
+    await handler(createValidateSessionRequest(host), res)
+
+    expect(mockedShouldForceRefreshToken).not.toHaveBeenCalled()
+    expect(res.status).not.toHaveBeenCalledWith(401)
+    expect(mockedExecute).toHaveBeenCalled()
+  })
+
+  it('does not force a 401 on a preview behind the ingress', async () => {
+    const res = createResponse()
+    await handler(
+      createValidateSessionRequest('faststore-internal:3000', {
+        'x-forwarded-host': 'brandless-abc123.preview.vtex.app',
+      }),
+      res
+    )
+
+    expect(mockedShouldForceRefreshToken).not.toHaveBeenCalled()
+    expect(res.status).not.toHaveBeenCalledWith(401)
+    expect(mockedExecute).toHaveBeenCalled()
+  })
+
+  it.each(['brandless.vtex.app', 'brandless.fast.store'])(
+    'forces a 401 on the production host %s',
+    async (host) => {
+      const res = createResponse()
+      await handler(createValidateSessionRequest(host), res)
+
+      expect(res.status).toHaveBeenCalledWith(401)
+      expect(mockedExecute).not.toHaveBeenCalled()
+    }
+  )
+})
+
+describe('/api/graphql success cache-control', () => {
+  const originalGraphqlCacheControl =
+    discoveryConfig.experimental.graphqlCacheControl
+
+  const mockExecuteWithCacheControl = (cacheControl?: unknown) => {
+    mockedExecute.mockResolvedValue({
+      data: {},
+      errors: undefined,
+      extensions: { cookies: new Map(), cacheControl },
+    } as never)
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    discoveryConfig.experimental.graphqlCacheControl =
+      originalGraphqlCacheControl
+  })
+
+  it('uses the cache-control collected while executing the operation', async () => {
+    mockExecuteWithCacheControl({ scope: 'public', sMaxAge: 120 })
+
+    const res = createResponse()
+    await handler(createRequest(), res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'public, s-maxage=120, stale-while-revalidate=0'
+    )
+  })
+
+  it('makes collected cache-control private when there is an auth cookie', async () => {
+    mockExecuteWithCacheControl({ scope: 'public', sMaxAge: 120 })
+
+    const req = createRequest()
+    req.headers.cookie = 'VtexIdclientAutCookie_store=jwt'
+    const res = createResponse()
+    await handler(req, res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'private, s-maxage=120, stale-while-revalidate=0'
+    )
+  })
+
+  it('falls back to the default max-age for GET queries without collected cache-control', async () => {
+    discoveryConfig.experimental.graphqlCacheControl = {
+      maxAge: 0,
+      staleWhileRevalidate: 0,
+    }
+    mockExecuteWithCacheControl()
+
+    const res = createResponse()
+    await handler(createRequest(), res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'public, s-maxage=300, stale-while-revalidate=3600'
+    )
+  })
+
+  it('uses the configured max-age and stale-while-revalidate for GET queries', async () => {
+    discoveryConfig.experimental.graphqlCacheControl = {
+      maxAge: 60,
+      staleWhileRevalidate: 30,
+    }
+    mockExecuteWithCacheControl()
+
+    const req = createRequest()
+    req.headers.cookie = 'VtexIdclientAutCookie_store=jwt'
+    const res = createResponse()
+    await handler(req, res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'private, s-maxage=60, stale-while-revalidate=30'
+    )
+  })
+
+  it('does not cache operations that are not GET queries', async () => {
+    mockExecuteWithCacheControl()
+
+    const res = createResponse()
+    await handler(createRequest('SubscribeToNewsletter'), res)
+
+    expect(res.setHeader).toHaveBeenCalledWith(
+      'cache-control',
+      'no-cache, no-store'
+    )
+  })
+})