@salesforce/pwa-kit-runtime 3.17.0-preview.2 → 3.17.1-preview.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/pwa-kit-runtime",
-  "version": "3.17.0-preview.2",
+  "version": "3.17.1-preview.0",
   "description": "The PWAKit Runtime",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/pwa-kit-runtime#readme",
   "bugs": {
@@ -48,11 +48,11 @@
   },
   "devDependencies": {
     "@loadable/component": "^5.15.3",
-    "@salesforce/pwa-kit-dev": "3.17.0-preview.2",
+    "@salesforce/pwa-kit-dev": "3.17.1-preview.0",
     "@serverless/event-mocks": "^1.1.1",
     "aws-lambda-mock-context": "^3.2.1",
     "fs-extra": "^11.1.1",
-    "internal-lib-build": "3.17.0-preview.2",
+    "internal-lib-build": "3.17.1-preview.0",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
     "sinon": "^13.0.2",
@@ -60,7 +60,7 @@
     "supertest": "^4.0.2"
   },
   "peerDependencies": {
-    "@salesforce/pwa-kit-dev": "3.17.0-preview.2"
+    "@salesforce/pwa-kit-dev": "3.17.1-preview.0"
   },
   "peerDependenciesMeta": {
     "@salesforce/pwa-kit-dev": {
@@ -74,5 +74,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "1da061ff7778db2ff9737838b71c2d09975382b1"
+  "gitHead": "beabe8a971b6170bddfe08ae3f5ca2f1bfe66aa7"
 }

package/ssr/server/build-remote-server.js

@@ -515,8 +515,9 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
         return next();
       }
 
-      // For other routes, only proceed if path actually starts with base path
-      if (!req.path.startsWith(basePath)) {
+      // For other routes, only proceed if path equals basePath or path starts with basePath + '/'
+      const pathMatchesBasePath = req.path === basePath || req.path.startsWith(basePath + '/');
+      if (!pathMatchesBasePath) {
         return next();
       }
 

package/ssr/server/express.test.js

@@ -13,6 +13,7 @@ var _ssrCache = require("../../utils/ssr-cache");
 var _ssrServer = require("../../utils/ssr-server");
 var ssrServerUtils = _interopRequireWildcard(require("../../utils/ssr-server/utils"));
 var ssrConfig = _interopRequireWildcard(require("../../utils/ssr-config"));
+var ssrNamespacePaths = _interopRequireWildcard(require("../../utils/ssr-namespace-paths"));
 var _buildRemoteServer = require("./build-remote-server");
 var _constants = require("./constants");
 var _express2 = require("./express");
@@ -1191,10 +1192,11 @@ describe('SLAS private client proxy', () => {
   }));
 });
 describe('Base path tests', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
   test('Base path is removed from /mobify request path and still gets through to /mobify endpoint', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
     return (0, _supertest.default)(app).get('/basepath/mobify/ping').then(response => {
       expect(response.status).toBe(200);
@@ -1202,9 +1204,7 @@ describe('Base path tests', () => {
   }), 15000);
   test('should not remove base path from non /mobify non-express routes', /*#__PURE__*/_asyncToGenerator(function* () {
     // Set base path to something that might also be a site id used by react router routes
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/us'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/us');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
 
     // Add a middleware to capture the request path after base path processing
@@ -1221,9 +1221,7 @@ describe('Base path tests', () => {
     });
   }), 15000);
   test('should remove base path from routes with path parameters', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
     app.get('/api/users/:id', (req, res) => {
       res.status(200).json({
@@ -1236,9 +1234,7 @@ describe('Base path tests', () => {
     });
   }), 15000);
   test('should remove base path from routes defined with regex', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
     app.get(/\/api\/users\/\d+/, (req, res) => {
       // Extract the user ID from the URL path since regex routes don't create req.params automatically
@@ -1253,25 +1249,8 @@ describe('Base path tests', () => {
       expect(response.body.userId).toBe('123');
     });
   }), 15000);
-  test('remove base path can handle multi-part base paths', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/my/base/path'
-    });
-    const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
-    app.get('/api/test', (req, res) => {
-      res.status(200).json({
-        message: 'test'
-      });
-    });
-    return (0, _supertest.default)(app).get('/my/base/path/api/test').then(response => {
-      expect(response.status).toBe(200);
-      expect(response.body.message).toBe('test');
-    });
-  }), 15000);
   test('should handle optional characters in route pattern', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
 
     // This route is intentionally made complex to test the following:

package/utils/ssr-namespace-paths.js

@@ -4,9 +4,6 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.ssrNamespace = exports.slasPrivateProxyPath = exports.proxyBasePath = exports.healthCheckPath = exports.getEnvBasePath = exports.cachingBasePath = exports.bundleBasePath = void 0;
-var _ssrConfig = require("./ssr-config");
-var _loggerInstance = _interopRequireDefault(require("./logger-instance"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 /*
  * Copyright (c) 2025, salesforce.com, inc.
  * All rights reserved.
@@ -32,35 +29,39 @@ const SLAS_PRIVATE_CLIENT_PROXY_PATH = `${MOBIFY_PATH}/slas/private`;
 
 /*
  * Returns the base path. This is prepended to a /mobify path.
- * Returns an empty string if the base path is not set or is '/'.
+ * Returns an empty string if the base path is not set.
+ * Throws an error if the base path is not valid.
+ *
+ * Use this function if you are working with an express route
+ * (ie. The route is defined in ssr.js).
+ *
+ * Use getRouterBasePath (pwa-kit-react-sdk) if you are working
+ * with a React Router route
+ * (ie. The route is defined in routes.jsx).
  */
 const getEnvBasePath = () => {
-  const config = (0, _ssrConfig.getConfig)();
-  let basePath = (config === null || config === void 0 ? void 0 : config.envBasePath) || '';
-  if (typeof basePath !== 'string') {
-    _loggerInstance.default.warn('Invalid envBasePath configuration. No base path is applied.', {
-      namespace: 'ssr-namespace-paths.getEnvBasePath'
-    });
-    return '';
+  let basePath = '';
+  if (typeof window !== 'undefined') {
+    basePath = window.__MRT_ENV_BASE_PATH__ || '';
+  } else {
+    basePath = process.env.MRT_ENV_BASE_PATH || '';
   }
 
-  // Normalize the base path
-  basePath = basePath.trim().replace(/^\/?/, '/') // Ensure leading slash
-  .replace(/\/+/g, '/') // Normalize multiple slashes
-  .replace(/\/$/, ''); // Remove trailing slash
-
-  // Return empty string for root path or empty result
-  if (basePath === '/' || !basePath) {
+  // Return empty string if no base path is set
+  if (!basePath) {
     return '';
   }
 
-  // only allow simple, safe characters
-  // eslint-disable-next-line no-useless-escape
-  if (!/^\/[a-zA-Z0-9\-_\/]*$/.test(basePath)) {
-    _loggerInstance.default.warn('Invalid envBasePath configuration. Only letters, numbers, hyphens, underscores, and slashes allowed. No base path is applied.', {
-      namespace: 'ssr-namespace-paths.getEnvBasePath'
-    });
-    return '';
+  // MRT will throw an error on bundle upload if the base path does not match
+  // the following regex: /^\/[a-zA-Z0-9_.+$~"'@:-]{1,63}$/
+  // This validates:
+  // - Starts with /
+  // - Followed by 1-63 characters (letters, numbers, and special chars: - _ . + $ ~ " ' @ :)
+  // - No additional slashes (multi-part paths not allowed, no trailing slashes)
+  // - No spaces
+  // - Total max length of 64 characters (1 slash + 63 chars)
+  if (!/^\/[a-zA-Z0-9_.+$~"'@:-]{1,63}$/.test(basePath)) {
+    throw new Error("Invalid envBasePath configuration. Base path must start with '/' followed by 1-63 characters. Only letters, numbers, and the following special characters are allowed: - _ . + $ ~ \" ' @ :");
   }
   return basePath;
 };

package/utils/ssr-namespace-paths.test.js

@@ -1,55 +1,98 @@
 "use strict";
 
 var _ssrNamespacePaths = require("./ssr-namespace-paths");
-var ssrConfig = _interopRequireWildcard(require("./ssr-config"));
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-/*
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
+function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == typeof i ? i : i + ""; }
+function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != typeof i) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); } /*
  * Copyright (c) 2024, Salesforce, Inc.
  * All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
  * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/BSD-3-Clause
  */
-
-jest.mock('./ssr-config');
 describe('ssr-namespace-paths tests', () => {
-  test('getEnvBasePath returns base path from config', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/sample'
-    });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
+  const originalEnv = process.env;
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = _objectSpread({}, originalEnv);
+    delete process.env.MRT_ENV_BASE_PATH;
+    // Ensure we're in Node environment (no window)
+    delete global.window;
   });
-  test('getEnvBasePath returns empty string if no base path is set', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({});
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
+  afterEach(() => {
+    process.env = originalEnv;
+    delete global.window;
   });
-  test('getEnvBasePath returns empty string if envBasePath is not a string', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: 123
+  describe('Node environment (process.env)', () => {
+    test('getEnvBasePath returns base path from environment variable', () => {
+      process.env.MRT_ENV_BASE_PATH = '/sample';
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
-  });
-  test('getEnvBasePath removes trailing slash', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/sample/'
+    test('getEnvBasePath returns empty string if no base path is set', () => {
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
-  });
-  test('getEnvBasePath returns empty string if invalid cahracters are detected in envBasePath', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/sample.*'
+    test('getEnvBasePath throws error for base path with trailing slash', () => {
+      process.env.MRT_ENV_BASE_PATH = '/sample/';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
-  });
-  test('getEnvBasePath normalizes envBasePath', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '  //sample/  '
+    test('getEnvBasePath throws error for just a slash', () => {
+      process.env.MRT_ENV_BASE_PATH = '/';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error if invalid characters are detected in envBasePath', () => {
+      process.env.MRT_ENV_BASE_PATH = '/sample<script>';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for envBasePath with whitespace', () => {
+      process.env.MRT_ENV_BASE_PATH = '  /sample  ';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for multi-part base paths with slashes', () => {
+      process.env.MRT_ENV_BASE_PATH = '/test/sample';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath allows special characters: . + $ ~ " \' @ : -', () => {
+      process.env.MRT_ENV_BASE_PATH = '/a.b+c$d~e"f\'g@h:i-j_k';
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/a.b+c$d~e"f\'g@h:i-j_k');
+    });
+    test('getEnvBasePath throws error if base path exceeds 64 characters', () => {
+      // 65 characters total (1 slash + 64 chars)
+      process.env.MRT_ENV_BASE_PATH = '/' + 'a'.repeat(64);
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath allows base path of exactly 64 characters', () => {
+      // 64 characters total (1 slash + 63 chars)
+      process.env.MRT_ENV_BASE_PATH = '/' + 'a'.repeat(63);
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/' + 'a'.repeat(63));
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
   });
-  test('getEnvBasePath works with multiple part base path', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '//test/sample/  '
+  describe('Browser environment (window)', () => {
+    beforeEach(() => {
+      global.window = {};
+    });
+    test('getEnvBasePath returns base path from window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/sample';
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
+    });
+    test('getEnvBasePath returns empty string if window global is not set', () => {
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
+    });
+    test('getEnvBasePath throws error for base path with trailing slash from window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/sample/';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for window global value with whitespace', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '  /sample  ';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error if invalid characters in window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/sample<script>';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for multi-part base paths in window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/test/sample';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/test/sample');
   });
 });