@salesforce/pwa-kit-runtime 4.0.0-extensibility-preview.3 → 4.0.0-extensibility-preview.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/pwa-kit-runtime",
-  "version": "4.0.0-extensibility-preview.3",
+  "version": "4.0.0-extensibility-preview.4",
   "description": "The PWAKit Runtime",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/pwa-kit-runtime#readme",
   "bugs": {
@@ -46,13 +46,13 @@
   },
   "devDependencies": {
     "@loadable/component": "^5.15.3",
-    "@salesforce/pwa-kit-dev": "4.0.0-extensibility-preview.3",
-    "@salesforce/pwa-kit-extension-sdk": "4.0.0-extensibility-preview.3",
+    "@salesforce/pwa-kit-dev": "4.0.0-extensibility-preview.4",
+    "@salesforce/pwa-kit-extension-sdk": "4.0.0-extensibility-preview.4",
     "@serverless/event-mocks": "^1.1.1",
     "@types/express": "^4.17.21",
     "aws-lambda-mock-context": "^3.2.1",
     "fs-extra": "^11.1.1",
-    "internal-lib-build": "4.0.0-extensibility-preview.3",
+    "internal-lib-build": "4.0.0-extensibility-preview.4",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
     "sinon": "^13.0.2",
@@ -60,7 +60,7 @@
     "supertest": "^4.0.2"
   },
   "peerDependencies": {
-    "@salesforce/pwa-kit-dev": "4.0.0-extensibility-preview.3"
+    "@salesforce/pwa-kit-dev": "4.0.0-extensibility-preview.4"
   },
   "peerDependenciesMeta": {
     "@salesforce/pwa-kit-dev": {
@@ -68,11 +68,11 @@
     }
   },
   "engines": {
-    "node": "^16.11.0 || ^18.0.0 || ^20.0.0",
-    "npm": "^8.0.0 || ^9.0.0 || ^10.0.0"
+    "node": "^16.11.0 || ^18.0.0 || ^20.0.0 || ^22.0.0",
+    "npm": "^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0"
   },
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "904de01e826117febeea952e034478349e16ea4d"
+  "gitHead": "5ad3b1f0e598cfe0fbdec5b1212b4dabc0a8733c"
 }

package/ssr/server/build-remote-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-remote-server.d.ts","sourceRoot":"","sources":["../../../src/ssr/server/build-remote-server.js"],"names":[],"mappings":"AAqEA;;;;GAIG;AACH,gDAKC;;IAWG;;OAEG;IACH,uCAgFC;IAED;;OAEG;IAEH,gDAEC;IAED;;OAEG;IAEH,iDAEC;IAED;;OAEG;IAEH,4CAEC;IAED;;OAEG;IACH,uDAEC;IAED;;OAEG;IAEH,2CAEC;IAED;;OAEG;IACH,6CAEC;IAED;;OAEG;IACH,4DAIC;IAED;;OAEG;IAEH,yCAEC;IAED;;OAEG;IAEH,uCA6CC;IAED;;;OAGG;IACH,uCAcC;IAED;;OAEG;IAEH,+CAEC;IAED;;OAEG;IACH,kDAEC;IAED;;OAEG;IACH,oDAEC;IAED;;OAEG;IACH,+EA2CC;IAED;;OAEG;IACH,sFAyDC;IAED;;OAEG;IAEH,iDAEC;IAED;;;OAGG;IACH,4DAWC;IAED;;OAEG;IACH,6DAwLC;IAED;;OAEG;IAEH,sDAOC;IAED;;OAEG;IACH,yDAOC;IAED;;OAEG;IACH,oEA4EC;IAED;;OAEG;IACH,2CAIC;IAED;;OAEG;IACH,8DAiBC;IAED;;OAEG;IACH,oDA0EC;IAED;;OAEG;IACH,wCAEC;IAED;;OAEG;IACH,gDAGC;IAED;;;;;;;;;;;OAWG;IACH,sDAwBC;IAED;;;;;;;OAOG;IACH,wFAKC;IAED;;OAEG;IACH,4FASC;IAED;;;;;;;;;;OAUG;IACH,6DAWC;IAED;;;;;;;OAOG;IACH;;;;MAgGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;;;;;;;;MAKC;IAED;;OAEG;IAEH,8CAEC;;AA2HE,uDASN"}
+{"version":3,"file":"build-remote-server.d.ts","sourceRoot":"","sources":["../../../src/ssr/server/build-remote-server.js"],"names":[],"mappings":"AAsEA;;;;GAIG;AACH,gDAKC;;IAWG;;OAEG;IACH,uCAiFC;IAED;;OAEG;IAEH,gDAEC;IAED;;OAEG;IAEH,iDAEC;IAED;;OAEG;IAEH,4CAEC;IAED;;OAEG;IACH,uDAEC;IAED;;OAEG;IAEH,2CAEC;IAED;;OAEG;IACH,6CAEC;IAED;;OAEG;IACH,4DAIC;IAED;;OAEG;IAEH,yCAEC;IAED;;OAEG;IAEH,uCA6CC;IAED;;;OAGG;IACH,uCAcC;IAED;;OAEG;IAEH,+CAEC;IAED;;OAEG;IACH,kDAEC;IAED;;OAEG;IACH,oDAEC;IAED;;OAEG;IACH,+EA2CC;IAED;;OAEG;IACH,sFA2DC;IAED;;OAEG;IAEH,iDAEC;IAED;;;OAGG;IACH,4DAWC;IAED;;OAEG;IACH,6DAwLC;IAED;;OAEG;IAEH,sDAOC;IAED;;OAEG;IACH,yDAOC;IAED;;OAEG;IACH,oEA2EC;IAED;;OAEG;IACH,2CAIC;IAED;;OAEG;IACH,8DAiBC;IAED;;OAEG;IACH,oDA0EC;IAED;;OAEG;IACH,wCAEC;IAED;;OAEG;IACH,gDAGC;IAED;;;;;;;;;;;OAWG;IACH,sDA2CC;IAED;;;;;;;OAOG;IACH,wFAKC;IAED;;OAEG;IACH,4FASC;IAED;;;;;;;;;;OAUG;IACH,6DAWC;IAED;;;;;;;OAOG;IACH;;;;MAmGC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;;;;;;;;MAKC;IAED;;OAEG;IAEH,8CAEC;;AA2HE,uDASN"}

package/ssr/server/build-remote-server.js

@@ -103,9 +103,9 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
       useSLASPrivateClient: false,
       // A regex for identifying which SLAS endpoints the custom SLAS private
       // client secret handler will inject an Authorization header.
-      // Do not modify unless a project wants to customize additional SLAS
-      // endpoints that we currently do not support (ie. /oauth2/passwordless/token)
-      applySLASPrivateClientToEndpoints: /\/oauth2\/token/
+      // To allow additional SLAS endpoints, users can override this value in
+      // their project's ssr.js.
+      applySLASPrivateClientToEndpoints: /\/oauth2\/(token|passwordless\/(login|token)|password\/(reset|action))/
     };
     options = _extends({}, defaults, options);
     (0, _ssrServer.setQuiet)(options.quiet || process.env.SSR_QUIET);
@@ -320,6 +320,8 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
     app.disable('x-powered-by');
     const mixin = {
       options,
+      // Forcing a GC is no longer necessary, and will be
+      // skipped by default (unless FORCE_GC env-var is set).
       _collectGarbage() {
         // Do global.gc in a separate 'then' handler so
         // that all major variables are out of scope and
@@ -611,8 +613,7 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
         });
 
         // We pattern match and add client secrets only to endpoints that
-        // match the regex specified by options.applySLASPrivateClientToEndpoints.
-        // By default, this regex matches only calls to SLAS /oauth2/token
+        // match the regex specified by options.applySLASPrivateClientToEndpoints
         // (see option defaults at the top of this file).
         // Other SLAS endpoints, ie. SLAS authenticate (/oauth2/login) and
         // SLAS logout (/oauth2/logout), use the Authorization header for a different
@@ -765,8 +766,27 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
       encoding: 'utf8'
     });
 
+    // If the service worker is not updated when content security policy headers inside
+    // ssr.js are changed, then service worker initiated requests will continue to use
+    // the old CSP headers.
+    //
+    // This is problematic in stacked CDN setups where an old service worker with
+    // old CSPs can remain cached if the content of the service worker itself is not changed.
+    //
+    // To ensure the service worker is refetched when CSPs are changed, we factor in
+    // the CSP headers when generating the Etag.
+    //
+    // See https://gus.lightning.force.com/lightning/r/ADM_Work__c/a07EE000025yeu9YAA/view
+    // and https://salesforce-internal.slack.com/archives/C01GLHLBPT5/p1730739370922629
+    // for more details.
+
+    const contentSecurityPolicyHeader = res.getHeaders()[_constants.CONTENT_SECURITY_POLICY] || '';
+
     // Serve the file, with a strong ETag
-    res.set('etag', (0, _ssrServer.getHashForString)(content));
+    // For this to be a valid ETag, the string must be placed between  ""
+    // See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag#etag_value for
+    // more details
+    res.set('etag', `"${(0, _ssrServer.getHashForString)(content + contentSecurityPolicyHeader)}"`);
     res.set(_constants.CONTENT_TYPE, 'application/javascript');
     res.send(content);
   },
@@ -870,12 +890,15 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
       // the response to the browser.
       context.callbackWaitsForEmptyEventLoop = false;
       if (lambdaContainerReused) {
-        // DESKTOP-434 If this Lambda container is being reused,
-        // clean up memory now, so that we start with low usage.
-        // These regular GC calls take about 80-100 mS each, as opposed
-        // to forced GC calls, which occur randomly and can take several
-        // hundred mS.
-        app._collectGarbage();
+        const forceGarbageCollection = process.env.FORCE_GC;
+        if (forceGarbageCollection && forceGarbageCollection.toLowerCase() === 'true') {
+          // DESKTOP-434 If this Lambda container is being reused,
+          // clean up memory now, so that we start with low usage.
+          // These regular GC calls take about 80-100 mS each, as opposed
+          // to forced GC calls, which occur randomly and can take several
+          // hundred mS.
+          app._collectGarbage();
+        }
         app.sendMetric('LambdaReused');
       } else {
         // This is the first use of this container, so set the

package/ssr/server/express.lambda.test.js

@@ -54,6 +54,54 @@ const testFixtures = path.resolve(process.cwd(), 'src/ssr/server/test_fixtures')
 const httpsAgent = new https.Agent({
   rejectUnauthorized: false
 });
+function createServerWithGCSpy() {
+  const route = jest.fn((req, res) => {
+    res.send('<html/>');
+  });
+  const options = {
+    buildDir: testFixtures,
+    mobify: testPackageMobify,
+    sslFilePath: path.join(testFixtures, 'localhost.pem'),
+    quiet: true,
+    port: TEST_PORT,
+    fetchAgents: {
+      https: httpsAgent
+    }
+  };
+  const {
+    handler,
+    server,
+    app
+  } = RemoteServerFactory.createHandler(options, app => {
+    app.get('/*', route);
+  });
+  const collectGarbage = jest.spyOn(app, '_collectGarbage');
+  const sendMetric = jest.spyOn(app, 'sendMetric');
+  return {
+    route,
+    handler,
+    collectGarbage,
+    sendMetric,
+    server
+  };
+}
+function createApiGatewayEvent() {
+  // Set up a fake event and a fake context for the Lambda call
+  const event = createEvent('aws:apiGateway', {
+    path: '/',
+    body: undefined
+  });
+  if (event.queryStringParameters) {
+    delete event.queryStringParameters;
+  }
+  const context = AWSMockContext({
+    functionName: 'SSRTest'
+  });
+  return {
+    event,
+    context
+  };
+}
 describe('SSRServer Lambda integration', () => {
   let savedEnvironment;
   let server;
@@ -329,42 +377,50 @@ describe('SSRServer Lambda integration', () => {
       X_HEADERS_TO_REMOVE_ORIGIN.forEach(key => expect(reqHeaders[key]).toBeUndefined());
     });
   });
-  test('Lambda reuse behaviour', () => {
-    const route = jest.fn((req, res) => {
-      res.send('<html/>');
-    });
-    const options = {
-      buildDir: testFixtures,
-      mobify: testPackageMobify,
-      sslFilePath: path.join(testFixtures, 'localhost.pem'),
-      quiet: true,
-      port: TEST_PORT,
-      fetchAgents: {
-        https: httpsAgent
-      }
-    };
+  test('Lambda reuse -- Default Behavior', () => {
     const {
-      app,
+      route,
       handler,
-      server: srv
-    } = RemoteServerFactory.createHandler(options, app => {
-      app.get('/*', route);
-    });
-    const collectGarbage = jest.spyOn(app, '_collectGarbage');
-    const sendMetric = jest.spyOn(app, 'sendMetric');
-    server = srv;
-
-    // Set up a fake event and a fake context for the Lambda call
-    const event = createEvent('aws:apiGateway', {
-      path: '/',
-      body: undefined
-    });
-    if (event.queryStringParameters) {
-      delete event.queryStringParameters;
-    }
-    const context = AWSMockContext({
-      functionName: 'SSRTest'
+      collectGarbage,
+      sendMetric,
+      new_server
+    } = createServerWithGCSpy();
+    const {
+      event,
+      context
+    } = createApiGatewayEvent();
+    server = new_server;
+    const call = event => new Promise(resolve => handler(event, context, (err, response) => resolve(response)));
+    return Promise.resolve().then(() => call(event)).then(response => {
+      // First request - Lambda container created
+      expect(response.statusCode).toBe(200);
+      expect(collectGarbage.mock.calls).toHaveLength(0);
+      expect(route.mock.calls).toHaveLength(1);
+      expect(sendMetric).toHaveBeenCalledWith('LambdaCreated');
+      expect(sendMetric).not.toHaveBeenCalledWith('LambdaReused');
+    }).then(() => call(event)).then(response => {
+      // Second call - Lambda container reused
+      expect(response.statusCode).toBe(200);
+      expect(collectGarbage.mock.calls).toHaveLength(0);
+      expect(route.mock.calls).toHaveLength(2);
+      expect(sendMetric).toHaveBeenCalledWith('LambdaCreated');
+      expect(sendMetric).toHaveBeenCalledWith('LambdaReused');
     });
+  });
+  test('Lambda reuse -- with Forced Garbage Collection Enabled', () => {
+    process.env.FORCE_GC = 'true';
+    const {
+      event,
+      context
+    } = createApiGatewayEvent();
+    const {
+      route,
+      handler,
+      collectGarbage,
+      sendMetric,
+      new_server
+    } = createServerWithGCSpy();
+    server = new_server;
     const call = event => new Promise(resolve => handler(event, context, (err, response) => resolve(response)));
     return Promise.resolve().then(() => call(event)).then(response => {
       // First request - Lambda container created

package/utils/ssr-server/metrics-sender.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics-sender.d.ts","sourceRoot":"","sources":["../../../src/utils/ssr-server/metrics-sender.js"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH;IAKQ,iDAAe;IAKf,cAAgB;IAGpB;;;OAGG;IACH,0BAEC;IAED;;;;;;OAMG;IACH,eAaC;IAED;;;;;;;;OAQG;IACH,uBA0BC;IAED;;;;OAIG;IACH,+BAyBC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,aA4BC;CACJ;;;IAOD;;;;;OAKG;IACH,oCAKC"}
+{"version":3,"file":"metrics-sender.d.ts","sourceRoot":"","sources":["../../../src/utils/ssr-server/metrics-sender.js"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH;IAKQ,iDAAe;IAKf,cAAgB;IAGpB;;;OAGG;IACH,0BAEC;IAED;;;;;;OAMG;IACH,eAiBC;IAED;;;;;;;;OAQG;IACH,uBA0BC;IAED;;;;OAIG;IACH,+BAyBC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,aA4BC;CACJ;;;IAOD;;;;;OAKG;IACH,oCAKC"}

package/utils/ssr-server/metrics-sender.js

@@ -59,7 +59,11 @@ class MetricsSender {
         apiVersion: '2010-08-01',
         // The AWS_REGION variable is defined by the Lambda
         // environment.
-        region: process.env.AWS_REGION || 'us-east-1'
+        region: process.env.AWS_REGION || 'us-east-1',
+        // Setting maxRetries to 0 will prevent the SDK from retrying.
+        // This is necessary because under high load, there will be backpressure
+        // on the Lambda function, and causing severe performance issues (400-500ms latency)
+        maxRetries: 0
       });
     }
     return this._CW;