@faststore/core 4.8.1-dev.1 → 4.8.1-dev.2

package/test/pages/api/switch-contract.test.ts

@@ -0,0 +1,385 @@
+import type { NextApiRequest, NextApiResponse } from 'next'
+import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest'
+
+import type { SwitchContractResponse } from '../../../src/pages/api/fs/switch-contract'
+
+vi.mock('discovery.config', () => ({
+  __esModule: true,
+  default: { api: { storeId: 'test-store' } },
+}))
+
+const CONTRACT_ID = '69b5d80e-8f61-44e0-a5cb-db54c326699c'
+const ORDER_FORM_COOKIES =
+  'checkout.vtex.com=__ofid=abc123; CheckoutOrderFormOwnership=owner-1'
+const AUTH_COOKIE = 'VtexIdclientAutCookie_test-store=old-token'
+
+const successPayload = {
+  authStatus: 'Success',
+  expiresIn: 3600,
+  authCookie: {
+    Name: 'VtexIdclientAutCookie_test-store',
+    Value: 'new-contract-token',
+  },
+  accountAuthCookie: null,
+}
+
+function createReqRes(overrides: Partial<NextApiRequest> = {}): {
+  req: NextApiRequest
+  res: NextApiResponse<SwitchContractResponse> & {
+    status: Mock
+    json: Mock
+    end: Mock
+    setHeader: Mock
+  }
+} {
+  const res: Record<string, unknown> = {
+    status: vi.fn().mockImplementation(function (this: unknown) {
+      return this
+    }),
+    json: vi.fn(),
+    end: vi.fn(),
+    setHeader: vi.fn(),
+  }
+
+  return {
+    req: {
+      method: 'POST',
+      body: { contractId: CONTRACT_ID },
+      query: {},
+      ...overrides,
+      headers: {
+        host: 'store.example.com',
+        cookie: `${AUTH_COOKIE}; ${ORDER_FORM_COOKIES}`,
+        'x-forwarded-proto': 'https',
+        ...overrides.headers,
+      },
+    } as unknown as NextApiRequest,
+    res: res as unknown as ReturnType<typeof createReqRes>['res'],
+  }
+}
+
+async function getHandler() {
+  const mod = await import('../../../src/pages/api/fs/switch-contract')
+  return mod.default
+}
+
+const setCookiesFrom = (res: { setHeader: Mock }): string[] => {
+  const call = res.setHeader.mock.calls.find(
+    ([name]) => String(name).toLowerCase() === 'set-cookie'
+  )
+
+  return (call?.[1] as string[] | undefined) ?? []
+}
+
+describe('/api/fs/switch-contract', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    global.fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => successPayload,
+    })
+    vi.spyOn(console, 'error').mockImplementation(() => {})
+  })
+
+  it('returns 405 for non-POST requests', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ method: 'GET' })
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(405)
+    expect(res.end).toHaveBeenCalled()
+    expect(global.fetch).not.toHaveBeenCalled()
+  })
+
+  it('returns 400 when contractId is missing', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ body: {} })
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(400)
+    expect(res.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        success: false,
+        error: 'contractId is required',
+      })
+    )
+  })
+
+  it('returns 400 when the body is missing', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ body: undefined })
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(400)
+  })
+
+  it('returns 400 when contractId is not a string', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ body: { contractId: 42 } })
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(400)
+  })
+
+  it('relays to switch-properties forwarding the buyer cookie', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(global.fetch).toHaveBeenCalledTimes(1)
+    const [url, init] = (global.fetch as Mock).mock.calls[0]
+
+    expect(url).toBe(
+      'https://test-store.myvtex.com/api/authenticator/storefront/credential/switch-properties?an=test-store'
+    )
+    expect(init.method).toBe('POST')
+    expect(init.headers.cookie).toBe(`${AUTH_COOKIE}; ${ORDER_FORM_COOKIES}`)
+    expect(init.signal).toBeDefined()
+    expect(JSON.parse(init.body as string)).toEqual({
+      properties: { customerId: CONTRACT_ID },
+    })
+  })
+
+  it('refuses to follow redirects so the cookie cannot leak cross-origin', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const [, init] = (global.fetch as Mock).mock.calls[0]
+
+    expect(init.redirect).toBe('error')
+  })
+
+  it('emits the new auth cookie and the orderForm expiry in one batch', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const cookies = setCookiesFrom(res)
+
+    expect(cookies).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(
+          'VtexIdclientAutCookie_test-store=new-contract-token'
+        ),
+      ])
+    )
+    expect(
+      cookies.filter((cookie) => cookie.startsWith('checkout.vtex.com=;'))
+        .length
+    ).toBeGreaterThan(0)
+    expect(
+      cookies.filter((cookie) =>
+        cookie.startsWith('CheckoutOrderFormOwnership=;')
+      ).length
+    ).toBeGreaterThan(0)
+    expect(res.status).toHaveBeenCalledWith(200)
+    expect(res.json).toHaveBeenCalledWith({ success: true })
+  })
+
+  it('carries Max-Age from expiresIn and Secure behind https', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const authCookie = setCookiesFrom(res).find((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=')
+    )
+
+    expect(authCookie).toContain('Max-Age=3600')
+    expect(authCookie).toContain('Path=/')
+    expect(authCookie).toContain('SameSite=Lax')
+    expect(authCookie).toContain('Secure')
+  })
+
+  it.each([
+    ['zero', 0],
+    ['negative', -1],
+    ['fractional', 1.5],
+    ['a numeric string', '3600'],
+    ['not a number', 'soon'],
+    ['missing', undefined],
+  ])(
+    'falls back to the default Max-Age when expiresIn is %s',
+    async (_label, expiresIn) => {
+      ;(global.fetch as Mock).mockResolvedValue({
+        ok: true,
+        status: 200,
+        json: async () => ({ ...successPayload, expiresIn }),
+      })
+      const handler = await getHandler()
+      const { req, res } = createReqRes()
+
+      await handler(req, res)
+
+      const authCookie = setCookiesFrom(res).find((cookie) =>
+        cookie.startsWith('VtexIdclientAutCookie_test-store=')
+      )
+
+      // Max-Age=0 would delete the very credential this response installs.
+      expect(authCookie).toContain('Max-Age=86400')
+      expect(res.status).toHaveBeenCalledWith(200)
+    }
+  )
+
+  it('omits Secure on plain http', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({
+      headers: { 'x-forwarded-proto': 'http' },
+    })
+
+    await handler(req, res)
+
+    const authCookie = setCookiesFrom(res).find((cookie) =>
+      cookie.startsWith('VtexIdclientAutCookie_test-store=')
+    )
+
+    expect(authCookie).not.toContain('Secure')
+  })
+
+  it('also emits the accountAuthCookie when present', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => ({
+        ...successPayload,
+        accountAuthCookie: {
+          Name: 'VtexIdclientAutCookie_account',
+          Value: 'account-token',
+        },
+      }),
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(setCookiesFrom(res)).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining('VtexIdclientAutCookie_account=account-token'),
+      ])
+    )
+  })
+
+  it('does not expire orderForm cookies that the request does not carry', async () => {
+    const handler = await getHandler()
+    const { req, res } = createReqRes({ headers: { cookie: AUTH_COOKIE } })
+
+    await handler(req, res)
+
+    const cookies = setCookiesFrom(res)
+
+    expect(
+      cookies.some((cookie) => cookie.startsWith('checkout.vtex.com=;'))
+    ).toBe(false)
+    expect(res.status).toHaveBeenCalledWith(200)
+  })
+
+  it('returns 401 and sets no cookies when the upstream rejects the token', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({ ok: false, status: 401 })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(401)
+    expect(res.setHeader).not.toHaveBeenCalled()
+  })
+
+  it('maps upstream 403 to 401', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({ ok: false, status: 403 })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(401)
+  })
+
+  it('returns 502 and sets no cookies on other upstream failures', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({ ok: false, status: 500 })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(502)
+    expect(res.setHeader).not.toHaveBeenCalled()
+  })
+
+  it('returns 502 and sets no cookies when authStatus is not success', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => ({ ...successPayload, authStatus: 'WrongCredentials' }),
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(502)
+    expect(res.setHeader).not.toHaveBeenCalled()
+  })
+
+  it('returns 502 and sets no cookies when no auth cookie comes back', async () => {
+    ;(global.fetch as Mock).mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => ({ ...successPayload, authCookie: null }),
+    })
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(502)
+    expect(res.setHeader).not.toHaveBeenCalled()
+  })
+
+  it('returns 504 when the upstream call times out', async () => {
+    const timeout = new Error('aborted')
+    timeout.name = 'TimeoutError'
+    ;(global.fetch as Mock).mockRejectedValue(timeout)
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(504)
+    expect(res.setHeader).not.toHaveBeenCalled()
+  })
+
+  it('returns 502 when the upstream call throws', async () => {
+    ;(global.fetch as Mock).mockRejectedValue(new Error('network failure'))
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    expect(res.status).toHaveBeenCalledWith(502)
+    expect(res.setHeader).not.toHaveBeenCalled()
+  })
+
+  it('does not log the error object, only its name', async () => {
+    ;(global.fetch as Mock).mockRejectedValue(new Error('token=super-secret'))
+    const handler = await getHandler()
+    const { req, res } = createReqRes()
+
+    await handler(req, res)
+
+    const logged = (console.error as Mock).mock.calls.flat().join(' ')
+
+    expect(logged).not.toContain('super-secret')
+    expect(logged).toContain('Error')
+  })
+})

package/test/sdk/account/changeContractToken.browser.test.ts

@@ -4,44 +4,25 @@
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('discovery.config', () => ({
-  default: {
-    api: { storeId: 'b2bfaststoredev' },
-  },
-}))
-
 const mockFetch = vi.hoisted(() => vi.fn())
 vi.mock('isomorphic-unfetch', () => ({ __esModule: true, default: mockFetch }))
 
 import {
   ContractSwitchError,
-  applyVtexAuthCookieFromSwitchResponse,
   changeContractToken,
   isContractSwitchEnabled,
 } from '../../../src/sdk/account/changeContractToken'
 
-const successPayload = {
-  authStatus: 'Success',
-  expiresIn: 86_399,
-  authCookie: {
-    Name: 'VtexIdclientAutCookie_b2bfaststoredev',
-    Value: 'new-contract-token',
-  },
-  accountAuthCookie: null,
-}
-
 describe('changeContractToken', () => {
   beforeEach(() => {
-    document.cookie = ''
     mockFetch.mockResolvedValue({
       ok: true,
       status: 200,
-      json: async () => successPayload,
+      json: async () => ({ success: true }),
     })
   })
 
   afterEach(() => {
-    document.cookie = ''
     vi.clearAllMocks()
   })
 
@@ -51,35 +32,30 @@ describe('changeContractToken', () => {
 
   it('rejects when contractId is missing', async () => {
     await expect(changeContractToken('')).rejects.toThrow(ContractSwitchError)
+    expect(mockFetch).not.toHaveBeenCalled()
   })
 
-  it('posts to switch-properties with the contract customerId', async () => {
+  it('posts the contractId to the switch-contract route', async () => {
     const contractId = '69b5d80e-8f61-44e0-a5cb-db54c326699c'
 
     await expect(changeContractToken(contractId)).resolves.toBe(true)
 
     expect(mockFetch).toHaveBeenCalledTimes(1)
     const [url, init] = mockFetch.mock.calls[0]
-    expect(url).toBe(
-      '/api/authenticator/storefront/credential/switch-properties?an=b2bfaststoredev'
-    )
+    expect(url).toBe('/api/fs/switch-contract')
     expect(init.method).toBe('POST')
     expect(init.credentials).toBe('include')
     expect(init.signal).toBeDefined()
-    expect(JSON.parse(init.body as string)).toEqual({
-      properties: { customerId: contractId },
-    })
+    expect(JSON.parse(init.body as string)).toEqual({ contractId })
   })
 
-  it('applies the auth cookie returned by switch-properties', async () => {
+  it('never writes cookies from the client', async () => {
     await changeContractToken('contract-1')
 
-    expect(document.cookie).toContain(
-      'VtexIdclientAutCookie_b2bfaststoredev=new-contract-token'
-    )
+    expect(document.cookie).not.toContain('VtexIdclientAutCookie')
   })
 
-  it('throws when the switch request fails', async () => {
+  it('throws when the route responds with a failure status', async () => {
     mockFetch.mockResolvedValueOnce({ ok: false, status: 401 })
 
     await expect(changeContractToken('contract-1')).rejects.toThrow(
@@ -87,7 +63,7 @@ describe('changeContractToken', () => {
     )
   })
 
-  it('throws when the switch request times out', async () => {
+  it('throws when the request times out', async () => {
     const timeoutError = new Error('The operation was aborted')
     timeoutError.name = 'TimeoutError'
     mockFetch.mockRejectedValueOnce(timeoutError)
@@ -97,61 +73,37 @@ describe('changeContractToken', () => {
     )
   })
 
-  it('throws when authStatus is not success', async () => {
-    mockFetch.mockResolvedValueOnce({
-      ok: true,
-      status: 200,
-      json: async () => ({ ...successPayload, authStatus: 'Failed' }),
-    })
+  it('throws when the network call fails', async () => {
+    mockFetch.mockRejectedValueOnce(new Error('offline'))
 
     await expect(changeContractToken('contract-1')).rejects.toThrow(
-      /Contract switch was not successful/
+      /Failed to switch contract: offline/
     )
   })
 
-  it('throws when authCookie is missing from a successful response', async () => {
+  it('throws when the route reports success: false', async () => {
     mockFetch.mockResolvedValueOnce({
       ok: true,
       status: 200,
-      json: async () => ({
-        authStatus: 'Success',
-        authCookie: null,
-      }),
+      json: async () => ({ success: false, error: 'nope' }),
     })
 
     await expect(changeContractToken('contract-1')).rejects.toThrow(
-      /no auth cookie was returned/
+      /Contract switch was not successful/
     )
   })
-})
 
-describe('applyVtexAuthCookieFromSwitchResponse', () => {
-  beforeEach(() => {
-    document.cookie = ''
-  })
-
-  afterEach(() => {
-    document.cookie = ''
-  })
-
-  it('sets auth and account auth cookies when present', () => {
-    applyVtexAuthCookieFromSwitchResponse({
-      expiresIn: 3600,
-      authCookie: {
-        Name: 'VtexIdclientAutCookie_b2bfaststoredev',
-        Value: 'store-token',
-      },
-      accountAuthCookie: {
-        Name: 'VtexIdclientAutCookie_account',
-        Value: 'account-token',
+  it('throws when the response body is not valid JSON', async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      status: 200,
+      json: async () => {
+        throw new Error('invalid json')
       },
     })
 
-    expect(document.cookie).toContain(
-      'VtexIdclientAutCookie_b2bfaststoredev=store-token'
-    )
-    expect(document.cookie).toContain(
-      'VtexIdclientAutCookie_account=account-token'
+    await expect(changeContractToken('contract-1')).rejects.toThrow(
+      /Contract switch was not successful/
     )
   })
 })

package/test/sdk/account/clearPersistedSessionState.browser.test.ts

@@ -38,4 +38,28 @@ describe('clearPersistedSessionState', () => {
     expect(sessionStorage.getItem(STORAGE_KEY_PERSON_ID)).toBeNull()
     expect(sessionStorage.getItem(STORAGE_KEY_CACHE_BUST_LAST_VALUE)).toBeNull()
   })
+
+  it('also clears the persisted cart (fs::cart)', async () => {
+    await clearPersistedSessionState()
+
+    expect(mockDel).toHaveBeenCalledWith('fs::cart')
+  })
+
+  it('leaves cookies alone: the HttpOnly orderForm cookies are the route\u2019s job', async () => {
+    document.cookie = 'checkout.vtex.com=__ofid=abc123; path=/'
+
+    await clearPersistedSessionState()
+
+    expect(document.cookie).toContain('checkout.vtex.com')
+  })
+
+  it('still clears sessionStorage when IndexedDB deletion rejects', async () => {
+    mockDel.mockRejectedValue(new Error('blocked'))
+
+    await expect(clearPersistedSessionState()).resolves.toBeUndefined()
+
+    expect(sessionStorage.getItem(SESSION_READY_KEY)).toBeNull()
+    expect(sessionStorage.getItem(STORAGE_KEY_PERSON_ID)).toBeNull()
+    expect(sessionStorage.getItem(STORAGE_KEY_CACHE_BUST_LAST_VALUE)).toBeNull()
+  })
 })

package/test/sdk/account/useSwitchContract.browser.test.ts

@@ -69,6 +69,27 @@ describe('useSwitchContract', () => {
     expect(result.current.error).toBeNull()
   })
 
+  it('still reloads when clearing the persisted state fails', async () => {
+    vi.spyOn(
+      changeContractTokenModule,
+      'changeContractToken'
+    ).mockResolvedValueOnce(true)
+    mockClearPersistedSessionState.mockRejectedValueOnce(new Error('blocked'))
+
+    const { result } = renderHook(() => useSwitchContract())
+
+    let ok: boolean | undefined
+    await act(async () => {
+      ok = await result.current.switchContract('contract-2')
+    })
+
+    // The route already swapped the cookies, so stopping here would leave the
+    // UI on the previous contract while the browser is on the new one.
+    expect(ok).toBe(true)
+    expect(mockReload).toHaveBeenCalledTimes(1)
+    expect(result.current.error).toBeNull()
+  })
+
   it('surfaces an error when switch-properties fails', async () => {
     vi.spyOn(
       changeContractTokenModule,

package/test/sdk/session/isSignInAreaResolved.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { isSignInAreaResolved } from '../../../src/sdk/session/isSignInAreaResolved'
+
+describe('isSignInAreaResolved', () => {
+  it('waits for the first validation of this page load', () => {
+    expect(
+      isSignInAreaResolved({ isSessionReady: true, hasValidated: false })
+    ).toBe(false)
+  })
+
+  it('resolves once the session is ready and validated', () => {
+    expect(
+      isSignInAreaResolved({ isSessionReady: true, hasValidated: true })
+    ).toBe(true)
+  })
+
+  it('never resolves before the session is ready', () => {
+    expect(
+      isSignInAreaResolved({ isSessionReady: false, hasValidated: true })
+    ).toBe(false)
+  })
+})