npm - @salla.sa/twilight-components - Versions diffs - 2.14.507 → 2.14.508 - Mend

@@ -0,0 +1,97 @@
+/*!
+ * Crafted with ❤ by Salla
+ */
+'use strict';
+const RECOMMENDATIONS_BASE_PATH = '/recommendations/v1';
+const CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS = 5;
+const CATALOG_RECOMMENDATIONS_API = 'https://api.salla.dev';
+function getRecommendationsBaseUrl() {
+    // Recommendations live on the global catalog host (https://api.salla.dev), not
+    // under store.api — which is typically https://api.salla.dev/store/v1 and would
+    // produce a wrong path like /store/v1/recommendations/v1/...
+    return CATALOG_RECOMMENDATIONS_API;
+}
+function getRecommendationsUrl(path) {
+    return `${getRecommendationsBaseUrl()}${RECOMMENDATIONS_BASE_PATH}${path}`;
+}
+/**
+ * Minimal, CORS-allow-listed header set for the recommendations host.
+ *
+ * We deliberately do NOT go through `salla.api` here: axios injects default
+ * common headers (Authorization, UTM params, s-affiliate-code, allocation, …)
+ * that are not in the recommendations CORS allow-list and fail the preflight.
+ * Sending an explicit set via `fetch` avoids that whole class of failures.
+ * Store resolution uses the browser-set `Origin` header plus `s-store-id`.
+ *
+ * @internal exported for unit tests
+ */
+function getRecommendationsHeaders() {
+    const headers = {
+        's-store-id': String(salla.config.get('store.id')),
+        's-source': 'store',
+        lang: salla.lang.getLocale(),
+    };
+    // Only `s-scope-id` is on the recommendations CORS allow-list — `s-scope-type`
+    // is NOT, and requesting it makes the browser reject the preflight.
+    const scopeId = salla.api.getHeader?.('s-scope-id');
+    if (scopeId) {
+        headers['s-scope-id'] = String(scopeId);
+    }
+    return headers;
+}
+function extractRecommendationIds(response) {
+    return (response?.data ?? [])
+        .map(item => item?.id)
+        .filter((id) => Boolean(id));
+}
+/** Salla product ids are always numeric; reject anything else before it reaches the URL. */
+function toNumericId(value) {
+    const id = String(value);
+    return /^\d+$/.test(id) ? id : null;
+}
+function fetchRecommendations(path, params) {
+    const url = new URL(getRecommendationsUrl(path));
+    Object.entries(params).forEach(([key, value]) => url.searchParams.set(key, value));
+    // Native fetch (not salla.api) so only the explicit allow-listed headers are
+    // sent — no axios default headers to trip the recommendations CORS preflight.
+    // Best-effort feature: callers hide their section via .catch(), so no notifier.
+    // The host is the hardcoded constant CATALOG_RECOMMENDATIONS_API and only
+    // validated numeric ids reach the query string, so there is no SSRF surface.
+    // nosemgrep
+    return fetch(url.toString(), {
+        method: 'GET',
+        headers: getRecommendationsHeaders(),
+    })
+        .then((response) => {
+        if (!response.ok) {
+            throw new Error(`Recommendations request failed: ${response.status}`);
+        }
+        return response.json();
+    })
+        .then((payload) => extractRecommendationIds(payload));
+}
+function fetchCartBoughtTogether(productIds) {
+    const ids = productIds
+        .map(toNumericId)
+        .filter((id) => id !== null)
+        .slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
+    if (!ids.length) {
+        return Promise.resolve([]);
+    }
+    return fetchRecommendations('/carts/bought-together', {
+        product_ids: ids.join(','),
+    });
+}
+function fetchProductCustomersAlsoBought(productId) {
+    const id = toNumericId(productId);
+    if (!id) {
+        return Promise.resolve([]);
+    }
+    return fetchRecommendations('/products/customers-also-bought', {
+        product_id: id,
+    });
+}
+exports.fetchCartBoughtTogether = fetchCartBoughtTogether;
+exports.fetchProductCustomersAlsoBought = fetchProductCustomersAlsoBought;

@@ -3,7 +3,7 @@
  */
 'use strict';
-var index = require('./index-DDEOCBF1.js');
+var index = require('./index-hhUDuquL.js');
 function _mergeNamespaces(n, m) {
     m.forEach(function (e) {

@@ -3,7 +3,7 @@
  */
 'use strict';
-var index = require('./index-DDEOCBF1.js');
+var index = require('./index-hhUDuquL.js');
 function _mergeNamespaces(n, m) {
   m.forEach(function (e) {

@@ -3,7 +3,7 @@
  */
 'use strict';
-var index = require('./index-DDEOCBF1.js');
+var index = require('./index-hhUDuquL.js');
 function _mergeNamespaces(n, m) {
     m.forEach(function (e) {

@@ -3,7 +3,7 @@
  */
 'use strict';
-var index = require('./index-DDEOCBF1.js');
+var index = require('./index-hhUDuquL.js');
 function _mergeNamespaces(n, m) {
     m.forEach(function (e) {

@@ -3,7 +3,7 @@
  */
 'use strict';
-var index = require('./index-DDEOCBF1.js');
+var index = require('./index-hhUDuquL.js');
 function _mergeNamespaces(n, m) {
   m.forEach(function (e) {

@salla.sa/twilight-components 2.14.507 → 2.14.508