@levo-so/next-middleware 0.3.7 → 0.3.9

package/dist/geoIp.d.ts

@@ -6,6 +6,16 @@
  * Traefik GeoIP2. Only surfaces `bestCountry` + `languageData` — the helpers
  * that were historically exported (client IPs, provider-specific getters,
  * raw header maps) are no longer used by any consumer.
+ *
+ * DELIBERATE DUPLICATE of `external/site-runtime/src/locale/geoIp.ts` (the Studio v3 copy).
+ * Not merged on purpose: this package is Next-only and serves V2 slate apps, and coupling
+ * a V2 app to the V3 site runtime would tie two independent release trains together. A
+ * header added to ONE copy is a silent gap in the other — change both.
+ *
+ * REVIEW-SKIP: no automated parity check between the two copies, by decision. This package is
+ * slated for deprecation, so the drift window is short and bounded; investing in a shared
+ * fixture or a generated header table would outlive the thing it protects. Everything below
+ * the header is byte-identical to the V3 copy today.
  */
 export interface ICountryInfo {
     countryCode: string;

package/dist/geoIp.js

@@ -6,6 +6,16 @@
  * Traefik GeoIP2. Only surfaces `bestCountry` + `languageData` — the helpers
  * that were historically exported (client IPs, provider-specific getters,
  * raw header maps) are no longer used by any consumer.
+ *
+ * DELIBERATE DUPLICATE of `external/site-runtime/src/locale/geoIp.ts` (the Studio v3 copy).
+ * Not merged on purpose: this package is Next-only and serves V2 slate apps, and coupling
+ * a V2 app to the V3 site runtime would tie two independent release trains together. A
+ * header added to ONE copy is a silent gap in the other — change both.
+ *
+ * REVIEW-SKIP: no automated parity check between the two copies, by decision. This package is
+ * slated for deprecation, so the drift window is short and bounded; investing in a shared
+ * fixture or a generated header table would outlive the thing it protects. Everything below
+ * the header is byte-identical to the V3 copy today.
  */
 const safeDecode = (value) => {
     try {
@@ -78,11 +88,15 @@ const parseAcceptLanguage = (acceptLanguage) => {
         .map((lang) => {
         const [locale, quality] = lang.trim().split(";q=");
         const [language, region] = (locale || "").split("-");
+        // A malformed q ("de;q=abc") parses to NaN, and NaN loses every comparison in the sort
+        // below — which scrambles the order of the WHOLE list, not just that entry. Callers take
+        // the first match, so one bad entry would hand the visitor the wrong language.
+        const parsed = Number.parseFloat(quality ?? "");
         return {
             locale: locale?.trim() || "",
             language: language?.trim() || "",
             region: region?.trim().toUpperCase(),
-            quality: quality ? parseFloat(quality) : 1.0,
+            quality: Number.isFinite(parsed) ? parsed : 1.0,
         };
     })
         .filter((l) => l.locale)
@@ -112,6 +126,12 @@ const headersToObject = (headers) => {
     }
     const obj = {};
     for (const [k, v] of Object.entries(headers)) {
+        // Skip absent values. Node types `req.headers` as `string | string[] | undefined`, and
+        // `String(undefined)` is the truthy string "undefined" — which `extractCountry` would then
+        // report as `countryCode: "undefined"`, sending locale resolution down the geo branch with
+        // a country that does not exist.
+        if (v === undefined || v === null)
+            continue;
         obj[k.toLowerCase()] = Array.isArray(v) ? v.join(", ") : String(v);
     }
     return obj;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@levo-so/next-middleware",
   "description": "Next middleware to add a proxy for levo integration in apps",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "author": "Levo Engineering <devs@theinternetfolks.com>",
   "devDependencies": {
     "@types/react": "19.2.14",