@reactionary/hcl 0.9.17 → 0.9.18

package/capabilities/identity.capability.js

@@ -120,16 +120,6 @@ class HclIdentityCapability extends IdentityCapability {
   }
   async register(payload) {
     debug("Registering new user: %s", payload.username);
-    const guest = await this.client.callPost(
-      this.createGuestIdentityUrl()
-    );
-    this.storeSessionTokens(
-      guest.WCToken,
-      guest.WCTrustedToken,
-      guest.userId,
-      "guest",
-      guest.personalizationID
-    );
     const registered = await this.client.callPut(
       this.registerPersonUrl(),
       this.registerPersonPayload(payload.username, payload.password)

package/core/client.js

@@ -1,6 +1,8 @@
 import { getLocaleParams } from "./locale-params.js";
 import {
+  SESSION_KEY_IDENTITY_TYPE,
   SESSION_KEY_PERSONALIZATION_ID,
+  SESSION_KEY_USER_ID,
   SESSION_KEY_WC_TOKEN,
   SESSION_KEY_WC_TRUSTED_TOKEN
 } from "./session-keys.js";
@@ -15,7 +17,10 @@ class HclClient {
     this.config = config;
     this.context = context;
     const origin = config.apiUrl.replace(/\/+$/, "");
-    const searchOrigin = (config.searchApiUrl ?? config.apiUrl).replace(/\/+$/, "");
+    const searchOrigin = (config.searchApiUrl ?? config.apiUrl).replace(
+      /\/+$/,
+      ""
+    );
     this.catalogBaseUrl = `${searchOrigin}/search/resources`;
     this.transactionBaseUrl = `${origin}/wcs/resources/store/${config.storeId}`;
   }
@@ -40,6 +45,7 @@ class HclClient {
     return response.json();
   }
   async callPost(url, body = {}) {
+    await this.ensureGuestSession(url);
     const response = await fetch(url, {
       method: "POST",
       headers: { ...this.buildHeaders(), "Content-Type": "application/json" },
@@ -54,6 +60,7 @@ class HclClient {
     return response.json();
   }
   async callPut(url, body) {
+    await this.ensureGuestSession(url);
     const response = await fetch(url, {
       method: "PUT",
       headers: { ...this.buildHeaders(), "Content-Type": "application/json" },
@@ -78,6 +85,67 @@ class HclClient {
       );
     }
   }
+  /**
+   * Bootstraps a guest WCS session for whitelisted transaction endpoints.
+   *
+   * Only fires when no WCToken is present AND the URL targets one of the
+   * whitelisted capabilities (cart, order, profile). Catalog URLs and
+   * non-whitelisted transaction paths are left as anonymous so that browsing
+   * sessions never create guest-identity rows in the WCS database.
+   *
+   * @see requiresGuestSession
+   */
+  async ensureGuestSession(url) {
+    if (!this.requiresGuestSession(url))
+      return;
+    if (this.context.session[SESSION_KEY_WC_TOKEN])
+      return;
+    const guestUrl = `${this.transactionBaseUrl}/guestidentity`;
+    const response = await fetch(guestUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify({})
+    });
+    if (!response.ok) {
+      throw new Error(
+        `HCL guest identity bootstrap failed: ${response.status} ${response.statusText}`
+      );
+    }
+    const data = await response.json();
+    this.context.session[SESSION_KEY_WC_TOKEN] = data.WCToken;
+    this.context.session[SESSION_KEY_WC_TRUSTED_TOKEN] = data.WCTrustedToken;
+    this.context.session[SESSION_KEY_USER_ID] = data.userId;
+    this.context.session[SESSION_KEY_IDENTITY_TYPE] = "guest";
+    if (data.personalizationID) {
+      this.context.session[SESSION_KEY_PERSONALIZATION_ID] = data.personalizationID;
+    } else {
+      delete this.context.session[SESSION_KEY_PERSONALIZATION_ID];
+    }
+    this.context.session.identityContext.identity = {
+      type: "Guest",
+      id: { userId: data.userId }
+    };
+    this.context.session.identityContext.lastUpdated = /* @__PURE__ */ new Date();
+  }
+  /**
+   * Returns true when `url` targets a transaction endpoint that should trigger
+   * automatic guest-session bootstrapping.
+   *
+   * Only the following path prefixes are whitelisted — other transaction calls
+   * (price rules, espots, segments, inventory, …) must NOT create guest-identity
+   * rows in the WCS database for anonymous browsing sessions.
+   *
+   * Override in project-specific subclasses to adjust the whitelist.
+   */
+  requiresGuestSession(url) {
+    if (!url.startsWith(this.transactionBaseUrl))
+      return false;
+    const path = url.slice(this.transactionBaseUrl.length);
+    return path.startsWith("/cart") || path.startsWith("/order") || path.startsWith("/person");
+  }
   /**
    * Merges caller-supplied params with locale defaults (langId, currency)
    * derived from the request context. Caller-supplied values always win.

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@reactionary/hcl",
-  "version": "0.9.17",
+  "version": "0.9.18",
   "type": "module",
   "main": "./index.js",
   "types": "./src/index.d.ts",
   "dependencies": {
-    "@reactionary/core": "0.9.17",
+    "@reactionary/core": "0.9.18",
     "debug": "^4.4.3",
     "zod": "4.1.9"
   },

package/src/core/client.d.ts

@@ -37,6 +37,28 @@ export declare class HclClient {
     callDelete(url: string, opts?: {
         ignore404?: boolean;
     }): Promise<void>;
+    /**
+     * Bootstraps a guest WCS session for whitelisted transaction endpoints.
+     *
+     * Only fires when no WCToken is present AND the URL targets one of the
+     * whitelisted capabilities (cart, order, profile). Catalog URLs and
+     * non-whitelisted transaction paths are left as anonymous so that browsing
+     * sessions never create guest-identity rows in the WCS database.
+     *
+     * @see requiresGuestSession
+     */
+    protected ensureGuestSession(url: string): Promise<void>;
+    /**
+     * Returns true when `url` targets a transaction endpoint that should trigger
+     * automatic guest-session bootstrapping.
+     *
+     * Only the following path prefixes are whitelisted — other transaction calls
+     * (price rules, espots, segments, inventory, …) must NOT create guest-identity
+     * rows in the WCS database for anonymous browsing sessions.
+     *
+     * Override in project-specific subclasses to adjust the whitelist.
+     */
+    protected requiresGuestSession(url: string): boolean;
     /**
      * Merges caller-supplied params with locale defaults (langId, currency)
      * derived from the request context. Caller-supplied values always win.