@salesforce/commerce-sdk-react 5.4.0-preview.0 → 5.4.0

package/CHANGELOG.md

@@ -1,4 +1,5 @@
-## v5.4.0-preview.0 (Aug 07, 2026)
+## v5.4.0 (Aug 12, 2026)
+- [Bugfix] Fix Trusted Agent (Order on Behalf) login hanging on a blank popup because `authorizeTrustedAgent` never sent an OAuth `state`. The storefront recognises the trusted agent callback by the presence of `state`: `request-processor.js` only keeps `code` on `/callback` (and `ssr.js` only serves that variant `no-store` and renders it) when `state` is set, and the callback page only hands `code`+`state` back to the opener when both are present. Without a `state` on the authorize request, SLAS redirected the popup to `/callback` with `code` only, the code was stripped as a standard-login redirect, an empty cacheable body was served, and the popup stayed blank with the login spinner never resolving. `authorizeTrustedAgent` now generates a CSRF `state` (a nonce distinct from the PKCE code verifier), sends it on the authorize request (SLAS echoes it back on the redirect), and returns it; `useTrustedAgent` compares the popup-echoed `state` against the one it minted before exchanging the code, and SLAS additionally binds `state`↔`code` on the token request.
 - [Bugfix] Fix Trusted Agent (Order on Behalf) login failing when the storefront sends a `Cross-Origin-Opener-Policy: same-origin` header. That header severs the authentication popup so the opener can no longer read the popup location and `popup.closed` wrongly reports `true`, which made the flow reject with "Popup closed without authenticating." before the agent finished. `useTrustedAgent` now receives the result out of band via `postMessage` from the same origin callback page with a `BroadcastChannel` fallback, and it no longer treats a severed `popup.closed` as user cancellation (a genuinely abandoned popup is still caught by the existing timeout). Exposes a `useTrustedAgentPopupCallback` hook for the same origin callback page to hand the OAuth result back to the opener. The hook owns the message contract and the delivery. After delivering the result the callback page also closes itself, since the opener's `popup.close()` is unreliable through the COOP-severed window reference. Additive to the public API. Adds `TRUSTED_AGENT_RUNBOOK.md` documenting the callback contract, the upgrade steps, and how to reproduce and verify the flow.
 - [Bugfix] Gracefully handle stale or malformed session tokens on load. A truncated `cc-at` cookie chunk or a value left by an older token format could be handed to `jwt-decode`, surfacing an `Invalid token specified: missing part #2` error to the storefront during `ready()`. The auth module now decodes such tokens defensively: an undecodable access token is discarded (and its cookie cleared) and treated as expired, an undecodable SFRA `cc-at` handoff token is cleared with a fallback to the local store, and a malformed `fetchedToken` is ignored — in every case the flow falls through to a refresh / guest login instead of throwing. Only affects non-HttpOnly / SSR / hybrid mode.
 

package/auth/index.d.ts

@@ -410,6 +410,7 @@ declare class Auth {
     }): Promise<{
         url: string;
         codeVerifier: string;
+        state: string;
     }>;
     /**
      * Trusted agent login

package/auth/index.js

@@ -1181,10 +1181,26 @@ class Auth {
       const loginId = credentials.loginId || 'guest';
       const isGuest = loginId === 'guest';
       const idpOrigin = isGuest ? 'slas' : 'ecom';
-      const url = `${slasClient.clientConfig.proxy || ''}/shopper/auth/v1/organizations/${organizationId}/oauth2/trusted-agent/authorize?${[...[`client_id=${clientId}`, `channel_id=${siteId}`, `login_id=${loginId}`, `redirect_uri=${_this9.redirectURI}`, `idp_origin=${idpOrigin}`, `response_type=code`], ...(!_this9.clientSecret ? [`code_challenge=${codeChallenge}`] : [])].join('&')}`;
+      // CSRF `state` for the OAuth authorize request. SLAS echoes it back on the
+      // final redirect to `/callback`, and the storefront relies on its presence:
+      // request-processor keeps `code` (and serves that variant no-store) only when
+      // `state` is set, and the callback page hands `code`+`state` back to the opener
+      // to finish login. Without it the redirect lands with `code` only, the code is
+      // stripped as a standard-login redirect, and the popup hangs. So it must be sent
+      // on every trusted agent authorize request.
+      //
+      // NOTE: this is a distinct nonce from the PKCE `codeVerifier` above and must NOT
+      // be collapsed into it. `createCodeVerifier` is reused only as a random
+      // high-entropy string generator; the two values serve different security roles
+      // (PKCE proof-of-possession vs. OAuth CSRF `state`) and are compared/validated on
+      // separate requests. The caller re-verifies the echoed `state` matches this value
+      // before exchanging the code, and SLAS also binds `state`↔`code` on the token request.
+      const state = _commerceSdkIsomorphic.helpers.createCodeVerifier();
+      const url = `${slasClient.clientConfig.proxy || ''}/shopper/auth/v1/organizations/${organizationId}/oauth2/trusted-agent/authorize?${[...[`client_id=${clientId}`, `channel_id=${siteId}`, `login_id=${loginId}`, `redirect_uri=${_this9.redirectURI}`, `idp_origin=${idpOrigin}`, `response_type=code`, `state=${state}`], ...(!_this9.clientSecret ? [`code_challenge=${codeChallenge}`] : [])].join('&')}`;
       return {
         url,
-        codeVerifier
+        codeVerifier,
+        state
       };
     })();
   }

package/hooks/useTrustedAgent.js

@@ -357,7 +357,8 @@ const useTrustedAgent = () => {
       }
       const {
         url,
-        codeVerifier
+        codeVerifier,
+        state: expectedState
       } = yield authorizeTrustedAgent.mutateAsync({
         loginId
       });
@@ -365,6 +366,13 @@ const useTrustedAgent = () => {
         code,
         state
       } = yield createTrustedAgentPopup(url, refresh);
+      // CSRF check: the `state` echoed back through the popup must match the one we
+      // minted for this authorize request. SLAS also binds `state`↔`code` on the
+      // token request below, but comparing here fails fast and stops a mismatched
+      // code from ever being exchanged.
+      if (state !== expectedState) {
+        throw new Error('Trusted agent login failed: state mismatch on authentication callback.');
+      }
       return yield loginTrustedAgent.mutateAsync({
         loginId,
         code,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/commerce-sdk-react",
-  "version": "5.4.0-preview.0",
+  "version": "5.4.0",
   "description": "A library that provides react hooks for fetching data from Commerce Cloud",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/ecom-react-hooks#readme",
   "bugs": {
@@ -46,7 +46,7 @@
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@salesforce/pwa-kit-dev": "3.20.0-preview.0",
+    "@salesforce/pwa-kit-dev": "3.20.0",
     "@tanstack/react-query": "^4.28.0",
     "@testing-library/jest-dom": "^5.16.5",
     "@testing-library/react": "^14.0.0",
@@ -61,7 +61,7 @@
     "@types/react-helmet": "~6.1.6",
     "@types/react-router-dom": "~5.3.3",
     "cross-env": "^5.2.1",
-    "internal-lib-build": "3.20.0-preview.0",
+    "internal-lib-build": "3.20.0",
     "jsonwebtoken": "^9.0.0",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
@@ -98,5 +98,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "63b3848e2c46b8e1ca540f8c80e7f9d96a4a7cb9"
+  "gitHead": "bb0a49284fed371ae582ced1268991a843f33be4"
 }