@faststore/core 4.8.1-dev.0 → 4.8.1-dev.2

package/src/pages/api/fs/switch-contract.ts

@@ -0,0 +1,194 @@
+import { parse } from 'cookie'
+import type { NextApiHandler, NextApiRequest, NextApiResponse } from 'next'
+
+import storeConfig from 'discovery.config'
+import { expireCookieServer, getCookieDomains } from 'src/utils/clearCookies'
+import { getRequestHostname } from 'src/utils/getRequestHostname'
+
+/**
+ * Cookies holding the checkout orderForm of the previous commercial context.
+ * Both are `HttpOnly`, so they are unreachable from `document.cookie` and can
+ * only be expired from the server (B2BTEAM-3827).
+ */
+const ORDER_FORM_COOKIES = [
+  'checkout.vtex.com',
+  'CheckoutOrderFormOwnership',
+] as const
+
+const SWITCH_PROPERTIES_TIMEOUT_MS = 30_000
+const DEFAULT_AUTH_COOKIE_MAX_AGE = 86_400
+
+type VtexAuthCookie = {
+  Name: string
+  Value: string
+}
+
+/** Untrusted upstream payload: every field is validated before use. */
+type SwitchPropertiesResponse = {
+  authStatus?: string
+  expiresIn?: unknown
+  authCookie?: VtexAuthCookie | null
+  accountAuthCookie?: VtexAuthCookie | null
+}
+
+export type SwitchContractResponse = {
+  success: boolean
+  error?: string
+}
+
+const isAuthCookie = (cookie: unknown): cookie is VtexAuthCookie => {
+  const candidate = cookie as VtexAuthCookie | null
+
+  return Boolean(candidate?.Name?.trim() && candidate?.Value)
+}
+
+const isSecureRequest = (request: NextApiRequest): boolean => {
+  const forwarded = request.headers['x-forwarded-proto']
+  const proto = Array.isArray(forwarded) ? forwarded[0] : forwarded
+
+  if (proto) {
+    return proto.split(',')[0].trim() === 'https'
+  }
+
+  const hostname = getRequestHostname(request.headers.host)
+
+  return hostname !== 'localhost' && hostname !== '127.0.0.1'
+}
+
+/**
+ * A non-positive `expiresIn` would turn into `Max-Age=0`, which expires the
+ * credential the response is supposed to install — logging the buyer out while
+ * the route reports success. Anything that is not a positive integer falls back
+ * to the default.
+ */
+const resolveMaxAge = (expiresIn: unknown): number =>
+  typeof expiresIn === 'number' && Number.isInteger(expiresIn) && expiresIn > 0
+    ? expiresIn
+    : DEFAULT_AUTH_COOKIE_MAX_AGE
+
+/**
+ * Mirrors the attributes the storefront used to write via `document.cookie`.
+ * `HttpOnly` is deliberately left out: the cookie lives on a domain shared
+ * with VTEX's own checkout, so hardening it is a separate, explicitly tested
+ * change.
+ */
+const buildAuthCookies = (
+  payload: SwitchPropertiesResponse,
+  secure: boolean
+): string[] => {
+  const maxAge = resolveMaxAge(payload.expiresIn)
+  const secureAttr = secure ? '; Secure' : ''
+
+  return [payload.authCookie, payload.accountAuthCookie]
+    .filter(isAuthCookie)
+    .map(
+      (cookie) =>
+        `${cookie.Name}=${cookie.Value}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secureAttr}`
+    )
+}
+
+const buildOrderFormExpiryCookies = (request: NextApiRequest): string[] => {
+  const hostname = getRequestHostname(request.headers.host)
+  const domains = hostname ? getCookieDomains(hostname) : [undefined]
+  const cookies = parse(request.headers.cookie ?? '')
+
+  return ORDER_FORM_COOKIES.filter((name) => cookies[name]).flatMap((name) =>
+    domains.map((domain) => expireCookieServer({ name, path: '/', domain }))
+  )
+}
+
+/**
+ * Switches the buyer's active contract and drops the previous contract's
+ * checkout orderForm in a single response.
+ *
+ * Relays to VTEX Identity server-side, forwarding the buyer cookie as the only
+ * credential — no app keys involved, same as `commerce.storeFront`. On success
+ * the new auth cookie and the orderForm expiry travel in the same `Set-Cookie`
+ * batch, so the browser can never end up authenticated as the new contract
+ * while still carrying the old contract's orderForm. On any failure nothing is
+ * emitted at all and the previous contract stays active.
+ */
+const handler: NextApiHandler<SwitchContractResponse> = async (
+  request: NextApiRequest,
+  response: NextApiResponse<SwitchContractResponse>
+) => {
+  if (request.method !== 'POST') {
+    response.status(405).end()
+    return
+  }
+
+  const { contractId } = request.body ?? {}
+
+  if (!contractId || typeof contractId !== 'string') {
+    response
+      .status(400)
+      .json({ success: false, error: 'contractId is required' })
+    return
+  }
+
+  const account = storeConfig.api.storeId
+  const an = encodeURIComponent(account)
+  const url = `https://${account}.myvtex.com/api/authenticator/storefront/credential/switch-properties?an=${an}`
+
+  try {
+    const switchResponse = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        cookie: request.headers.cookie ?? '',
+      },
+      body: JSON.stringify({ properties: { customerId: contractId } }),
+      signal: AbortSignal.timeout(SWITCH_PROPERTIES_TIMEOUT_MS),
+      // A redirect is never a successful switch, and following one would carry
+      // the buyer's cookie to whatever target the upstream names (CVE-2023-45143
+      // on Node < 20.8.1). Fail closed instead.
+      redirect: 'error',
+    })
+
+    if (!switchResponse.ok) {
+      const unauthorized =
+        switchResponse.status === 401 || switchResponse.status === 403
+
+      response
+        .status(unauthorized ? 401 : 502)
+        .json({ success: false, error: 'Failed to switch contract' })
+      return
+    }
+
+    const payload = (await switchResponse.json()) as SwitchPropertiesResponse
+
+    if (
+      payload.authStatus?.toLowerCase() !== 'success' ||
+      !isAuthCookie(payload.authCookie)
+    ) {
+      response
+        .status(502)
+        .json({ success: false, error: 'Contract switch was not successful' })
+      return
+    }
+
+    response.setHeader('Set-Cookie', [
+      ...buildAuthCookies(payload, isSecureRequest(request)),
+      ...buildOrderFormExpiryCookies(request),
+    ])
+
+    response.status(200).json({ success: true })
+  } catch (error) {
+    const timedOut =
+      error instanceof Error &&
+      (error.name === 'TimeoutError' || error.name === 'AbortError')
+
+    // Only the error name is logged: the request and response carry the buyer's
+    // credentials.
+    console.error(
+      'switch-contract: upstream failure',
+      error instanceof Error ? error.name : 'unknown'
+    )
+
+    response
+      .status(timedOut ? 504 : 502)
+      .json({ success: false, error: 'Failed to switch contract' })
+  }
+}
+
+export default handler

package/src/pages/api/graphql.ts

@@ -150,6 +150,112 @@ const hasVtexIdclientAutCookie = (request: NextApiRequest): boolean => {
   )
 }
 
+/**
+ * Responds to a GraphQL execution that returned errors: recovers the
+ * upstream status from a FastStoreError when possible instead of collapsing
+ * everything to 500, and logs every error for observability.
+ */
+const respondWithGraphqlErrors = (
+  errors: readonly unknown[],
+  response: Parameters<NextApiHandler>[1]
+) => {
+  // After error masking, entries are GraphQLError instances whose `name` is
+  // "GraphQLError" — the original FastStoreError (carrying the upstream
+  // status) is nested in `originalError`. Recover it so the BFF propagates
+  // the real status instead of collapsing everything to 500.
+  const fastStoreError = errors.map(recoverFastStoreError).find(Boolean)
+  const reportedErrors = errors.map((graphqlError) => {
+    const fsError = recoverFastStoreError(graphqlError)
+
+    return {
+      message: (graphqlError as { message?: string })?.message,
+      status: fsError?.extensions.status,
+      type: fsError?.extensions.type,
+    }
+  })
+
+  console.error('Graphql execution returned with error: ', reportedErrors)
+  OTELLogger(
+    'error',
+    'Graphql execution returned with error: %o',
+    reportedErrors
+  )
+
+  const status = fastStoreError?.extensions.status ?? 500
+
+  // Error responses are never cacheable: some upstream statuses (404, 410,
+  // ...) are heuristically cacheable by intermediaries per RFC 9111 §4.2.2,
+  // which would let a CDN cache an error for this operation.
+  response.setHeader('cache-control', 'no-store')
+
+  // No recoverable FastStoreError: keep the masked, body-less 500.
+  if (!fastStoreError) {
+    response.status(status).end()
+    return
+  }
+
+  // Only FastStoreError-derived details are exposed. `type`/`status` are a
+  // closed enum (safe everywhere); the free-text `message` may echo raw
+  // upstream text, so it is restricted to non-production responses. The
+  // full message is still available server-side via the log above.
+  const responseError = {
+    extensions: {
+      type: fastStoreError.extensions.type,
+      status: fastStoreError.extensions.status,
+    },
+    ...(process.env.NODE_ENV === 'production'
+      ? {}
+      : { message: fastStoreError.message }),
+  }
+
+  response.status(status)
+  response.setHeader('content-type', 'application/json')
+  response.send(JSON.stringify({ errors: [responseError] }))
+}
+
+/**
+ * Responds to an error thrown out of the main handler try-block (a rejected
+ * `parseRequest`/`execute`, or anything else unexpected).
+ */
+const respondToUnexpectedError = (
+  err: unknown,
+  response: Parameters<NextApiHandler>[1]
+) => {
+  // Same rationale as `respondWithGraphqlErrors`: a 400/401/500 here must
+  // never be cached. This path can run after the success branch has already
+  // set a cacheable cache-control (e.g. `setHeader('set-cookie', ...)`
+  // rejecting a malformed upstream cookie, or `JSON.stringify` throwing
+  // after cache-control was set but before `send` completed). Guarded by
+  // `headersSent`: if the throw came from `send()` itself after headers were
+  // already flushed, `setHeader` would throw ERR_HTTP_HEADERS_SENT and this
+  // would fail to produce a handled response.
+  if (!response.headersSent) {
+    response.setHeader('cache-control', 'no-store')
+  }
+
+  console.error(
+    'Something unexpected occurred querying Graphql endpoint: \n',
+    err
+  )
+  OTELLogger(
+    'error',
+    'Something unexpected occurred querying Graphql endpoint: %o',
+    err
+  )
+
+  if (err instanceof BadRequestError) {
+    response.status(400).end()
+    return
+  }
+
+  if (err instanceof UnauthorizedError) {
+    response.status(401).end()
+    return
+  }
+
+  response.status(500).end()
+}
+
 const handler: NextApiHandler = async (request, response) => {
   if (request.method !== 'POST' && request.method !== 'GET') {
     response.status(405).end()
@@ -222,53 +328,7 @@ const handler: NextApiHandler = async (request, response) => {
     const hasErrors = Array.isArray(errors) && errors.length > 0
 
     if (hasErrors) {
-      // After error masking, entries are GraphQLError instances whose
-      // `name` is "GraphQLError" — the original FastStoreError (carrying the
-      // upstream status) is nested in `originalError`. Recover it so the BFF
-      // propagates the real status instead of collapsing everything to 500.
-      const fastStoreError = errors.map(recoverFastStoreError).find(Boolean)
-      const reportedErrors = errors.map((graphqlError) => {
-        const fsError = recoverFastStoreError(graphqlError)
-
-        return {
-          message: (graphqlError as { message?: string })?.message,
-          status: fsError?.extensions.status,
-          type: fsError?.extensions.type,
-        }
-      })
-
-      console.error('Graphql execution returned with error: ', reportedErrors)
-      OTELLogger(
-        'error',
-        'Graphql execution returned with error: %o',
-        reportedErrors
-      )
-
-      const status = fastStoreError?.extensions.status ?? 500
-
-      // No recoverable FastStoreError: keep the masked, body-less 500.
-      if (!fastStoreError) {
-        response.status(status).end()
-        return
-      }
-
-      // Only FastStoreError-derived details are exposed. `type`/`status` are a
-      // closed enum (safe everywhere); the free-text `message` may echo raw
-      // upstream text, so it is restricted to non-production responses. The
-      // full message is still available server-side via the log above.
-      const responseError = {
-        extensions: {
-          type: fastStoreError.extensions.type,
-          status: fastStoreError.extensions.status,
-        },
-        ...(process.env.NODE_ENV !== 'production'
-          ? { message: fastStoreError.message }
-          : {}),
-      }
-
-      response.status(status)
-      response.setHeader('content-type', 'application/json')
-      response.send(JSON.stringify({ errors: [responseError] }))
+      respondWithGraphqlErrors(errors, response)
       return
     }
 
@@ -321,28 +381,7 @@ const handler: NextApiHandler = async (request, response) => {
     response.setHeader('content-type', 'application/json')
     response.send(JSON.stringify({ data, errors }))
   } catch (err) {
-    console.error(
-      'Something unexpected occurred querying Graphql endpoint: \n',
-      err
-    )
-    OTELLogger(
-      'error',
-      'Something unexpected occurred querying Graphql endpoint: %o',
-      err
-    )
-
-    if (err instanceof BadRequestError) {
-      response.status(400).end()
-      return
-    }
-
-    if (err instanceof UnauthorizedError) {
-      response.status(401).end()
-      return
-    }
-
-    response.status(500).end()
-    return
+    respondToUnexpectedError(err, response)
   }
 }
 

package/src/sdk/account/accountPageContext.ts

@@ -4,8 +4,9 @@ import type {
   ServerOrderDetailsQueryQuery,
   ServerProfileQueryQuery,
 } from '@generated/graphql'
+import { useContext } from 'react'
 import type { PageGlobalContext } from 'src/sdk/overrides/PageProvider'
-import { usePage } from 'src/sdk/overrides/PageProvider'
+import { PageContext, usePage } from 'src/sdk/overrides/PageProvider'
 import type { OrderStatusCmsLabels } from 'src/utils/userOrderStatus'
 import type { AccountNavigationLabels } from './getMyAccountRoutes'
 
@@ -76,9 +77,19 @@ export interface AccountPageContext extends PageGlobalContext {
   navigationLabels?: AccountNavigationLabels
 }
 
+/**
+ * Same data as `usePage<AccountPageContext>().navigationLabels`, but safe to
+ * call from components (e.g. the B2B organization drawer) that render both
+ * inside and outside a My Account `PageProvider` tree — returns `undefined`
+ * instead of throwing when there is no provider, so callers fall back to
+ * their hardcoded default label.
+ */
 export function useAccountNavigationLabels() {
-  const ctx = usePage<AccountPageContext>()
-  return ctx.navigationLabels
+  const context = useContext(PageContext)?.context
+
+  return context && 'navigationLabels' in context
+    ? context.navigationLabels
+    : undefined
 }
 
 export function useAccountPageData<

package/src/sdk/account/changeContractToken.ts

@@ -1,7 +1,5 @@
 import fetch from 'isomorphic-unfetch'
 
-import storeConfig from '../../../discovery.config'
-
 export class ContractSwitchError extends Error {
   constructor(message: string) {
     super(message)
@@ -11,51 +9,20 @@ export class ContractSwitchError extends Error {
 
 export const isContractSwitchEnabled = true
 
-type VtexAuthCookie = {
-  Name: string
-  Value: string
-}
-
-export type SwitchPropertiesResponse = {
-  authStatus?: string
-  expiresIn?: number
-  authCookie?: VtexAuthCookie | null
-  accountAuthCookie?: VtexAuthCookie | null
-}
-
-const DEFAULT_AUTH_COOKIE_MAX_AGE = 86_400
-const SWITCH_PROPERTIES_TIMEOUT_MS = 30_000
-
-export function applyVtexAuthCookieFromSwitchResponse(
-  response: SwitchPropertiesResponse
-): void {
-  if (globalThis.window === undefined) {
-    return
-  }
-
-  const maxAge = response.expiresIn ?? DEFAULT_AUTH_COOKIE_MAX_AGE
-  const secure =
-    globalThis.window.location.protocol === 'https:' ? '; secure' : ''
-
-  const cookies = [response.authCookie, response.accountAuthCookie].filter(
-    (cookie): cookie is VtexAuthCookie =>
-      Boolean(cookie?.Name?.trim() && cookie?.Value)
-  )
-
-  for (const cookie of cookies) {
-    document.cookie = `${cookie.Name}=${cookie.Value}; path=/; max-age=${maxAge}; samesite=lax${secure}`
-  }
-}
+const SWITCH_CONTRACT_TIMEOUT_MS = 30_000
 
 /**
- * Switches the buyer's active contract via VTEX Identity storefront credential API.
+ * Switches the buyer's active contract through `/api/fs/switch-contract`.
  *
- * POST /api/authenticator/storefront/credential/switch-properties?an={account}
- * Body: { properties: { customerId: contractId } }
+ * The route relays the call to VTEX Identity and answers with a single
+ * `Set-Cookie` batch: the new auth cookie plus the expiry of the previous
+ * contract's checkout orderForm cookies, which are `HttpOnly` and therefore
+ * unreachable from here. Because both travel in the same response, there is no
+ * window where the browser holds the new credential alongside the old
+ * orderForm (B2BTEAM-3827).
  *
- * Applies the returned `authCookie` (and optional `accountAuthCookie`) so the
- * storefront JWT reflects the new commercial context. Throws `ContractSwitchError`
- * on hard failures so `switchContract` can keep the previous contract active.
+ * Throws `ContractSwitchError` on any failure so `switchContract` can keep the
+ * previous contract active.
  */
 export async function changeContractToken(
   contractId: string
@@ -64,23 +31,16 @@ export async function changeContractToken(
     throw new ContractSwitchError('Missing contractId for contract switch')
   }
 
-  const an = encodeURIComponent(storeConfig.api.storeId)
-  const url = `/api/authenticator/storefront/credential/switch-properties?an=${an}`
-
   let response: Response
   try {
-    response = await fetch(url, {
+    response = await fetch('/api/fs/switch-contract', {
       method: 'POST',
       credentials: 'include',
       headers: {
         'Content-Type': 'application/json',
       },
-      body: JSON.stringify({
-        properties: {
-          customerId: contractId,
-        },
-      }),
-      signal: AbortSignal.timeout(SWITCH_PROPERTIES_TIMEOUT_MS),
+      body: JSON.stringify({ contractId }),
+      signal: AbortSignal.timeout(SWITCH_CONTRACT_TIMEOUT_MS),
     })
   } catch (error) {
     if (
@@ -101,19 +61,15 @@ export async function changeContractToken(
     )
   }
 
-  const payload = (await response.json()) as SwitchPropertiesResponse
+  // Reading the body to completion guarantees the `Set-Cookie` headers are
+  // committed before `switchContract` reloads the page.
+  const payload = (await response.json().catch(() => null)) as {
+    success?: boolean
+  } | null
 
-  if (payload.authStatus?.toLowerCase() !== 'success') {
+  if (!payload?.success) {
     throw new ContractSwitchError('Contract switch was not successful')
   }
 
-  if (!payload.authCookie?.Name || !payload.authCookie?.Value) {
-    throw new ContractSwitchError(
-      'Contract switch succeeded but no auth cookie was returned'
-    )
-  }
-
-  applyVtexAuthCookieFromSwitchResponse(payload)
-
   return true
 }

package/src/sdk/account/clearPersistedSessionState.ts

@@ -4,20 +4,26 @@ import {
   STORAGE_KEY_PERSON_ID,
 } from 'src/utils/cookieCacheBusting'
 
+/** Persisted `@faststore/sdk` stores that belong to the previous commercial context. */
+export const PERSISTED_STORE_KEYS = ['fs::session', 'fs::cart'] as const
+
 /**
- * Clears client-side session persistence so a hard reload rehydrates from
- * validateSession instead of stale IndexedDB / sessionStorage values.
+ * Clears client-side persistence of the previous commercial context so a hard
+ * reload rehydrates from validateSession / validateCart under the new
+ * contract.
+ *
+ * The checkout orderForm cookies are `HttpOnly` and are expired by
+ * `/api/fs/switch-contract` instead (B2BTEAM-3827).
  */
 export async function clearPersistedSessionState(): Promise<void> {
   try {
     const { del } = await import('idb-keyval')
-    await del('fs::session').catch(() => {})
+    await Promise.all(
+      PERSISTED_STORE_KEYS.map((key) => del(key).catch(() => {}))
+    )
   } catch {}
 
-  if (typeof sessionStorage === 'undefined') {
-    return
-  }
-
+  if (typeof sessionStorage === 'undefined') return
   try {
     sessionStorage.removeItem(SESSION_READY_KEY)
     sessionStorage.removeItem(STORAGE_KEY_PERSON_ID)

package/src/sdk/account/getMyAccountRoutes.ts

@@ -22,6 +22,7 @@ export type AccountNavigationLabels = Partial<{
   companyLabel: string
   contractLabel: string
   cardsLabel: string
+  quotesLabel: string
 }>
 
 interface GetMyAccountRouteParams {
@@ -45,6 +46,7 @@ const ROUTE_LABEL_KEYS: Record<string, keyof AccountNavigationLabels> = {
   [USER_DETAILS_ROUTE]: 'userDetailsLabel',
   [SECURITY_ROUTE]: 'securityLabel',
   [CARDS_ROUTE]: 'cardsLabel',
+  [QUOTES_ROUTE]: 'quotesLabel',
 }
 
 // This is the default route list for My Account, we should add then as the feature is implemented

package/src/sdk/account/useAvailableContracts.ts

@@ -13,6 +13,7 @@ export const AvailableContractsQuery = gql(`
       id
       corporateName
       isActive
+      isDefault
     }
   }
 `)

package/src/sdk/account/useSwitchContract.ts

@@ -11,8 +11,11 @@ import {
  * Orchestrates a full change of commercial context (REQ-06).
  *
  * Steps:
- *  1. POST switch-properties with the target contract id and apply the returned auth cookie.
- *  2. Clear persisted session state and reload the page.
+ *  1. POST `/api/fs/switch-contract`, which swaps the auth cookie and expires
+ *     the previous contract's checkout orderForm in one response. A failure
+ *     here changes nothing, so the previous contract stays active.
+ *  2. Clear persisted session and cart state and reload the page so
+ *     validateSession/validateCart run under the new contract.
  */
 export const useSwitchContract = () => {
   const [loading, setLoading] = useState(false)
@@ -31,7 +34,12 @@ export const useSwitchContract = () => {
         return false
       }
 
-      await clearPersistedSessionState()
+      // The cookies were already swapped, so the reload has to happen even if
+      // clearing the local stores fails: from here on the server session is
+      // the authoritative source and validateCart rebuilds the cart.
+      try {
+        await clearPersistedSessionState()
+      } catch {}
 
       if (globalThis.window !== undefined) {
         globalThis.window.location.reload()

package/src/sdk/overrides/PageProvider.tsx

@@ -62,7 +62,7 @@ export const isSearchPage = (x: any): x is SearchPageContext =>
   x?.data?.title != undefined ||
   x?.data?.searchTerm != undefined
 
-const PageContext = createContext<PageProviderContextValue | null>(null)
+export const PageContext = createContext<PageProviderContextValue | null>(null)
 
 function PageProvider({
   context,

package/src/sdk/session/index.ts

@@ -282,8 +282,9 @@ export const useSession = ({ filter }: SessionOptions = { filter: true }) => {
       channel,
       isValidating,
       isSessionReady,
+      hasValidated,
     }),
-    [isValidating, session, channel, isSessionReady]
+    [isValidating, session, channel, isSessionReady, hasValidated]
   )
 }
 

package/src/sdk/session/isSignInAreaResolved.ts

@@ -0,0 +1,12 @@
+/**
+ * The Navbar account area must not render "Sign in" for a B2B buyer whose
+ * session has not been validated yet on this page load (Design QA 26/Aug
+ * 00:02:55–00:03:52). `isSessionReady` alone is pre-seeded from sessionStorage.
+ */
+export const isSignInAreaResolved = ({
+  isSessionReady,
+  hasValidated,
+}: {
+  isSessionReady: boolean
+  hasValidated: boolean
+}): boolean => isSessionReady && hasValidated