@salla.sa/twilight-components 2.14.507 → 2.14.508

package/dist/collection/shared/catalog-recommendations.js

@@ -13,62 +13,67 @@ function getRecommendationsBaseUrl() {
 function getRecommendationsUrl(path) {
     return `${getRecommendationsBaseUrl()}${RECOMMENDATIONS_BASE_PATH}${path}`;
 }
-function parseHostname(value) {
-    if (!value) {
-        return null;
-    }
-    try {
-        const normalized = value.startsWith('http') ? value : `https://${value}`;
-        return new URL(normalized).hostname || null;
-    }
-    catch {
-        const hostname = String(value).replace(/^https?:\/\//i, '').split('/')[0];
-        return hostname || null;
-    }
-}
-function getStoreOriginHostname() {
-    const trackUrl = salla.config.get('jitsu.track_url');
-    const trackHostname = trackUrl ? parseHostname(String(trackUrl)) : null;
-    if (trackHostname) {
-        return trackHostname;
-    }
-    for (const candidate of [salla.config.get('store.domain'), salla.config.get('store.url')]) {
-        const hostname = candidate ? parseHostname(String(candidate)) : null;
-        if (hostname && !hostname.includes('beta.salla.group')) {
-            return hostname;
-        }
-    }
-    return window.location.hostname;
-}
-function getRecommendationsRequestConfig(params) {
+/**
+ * Minimal, CORS-allow-listed header set for the recommendations host.
+ *
+ * We deliberately do NOT go through `salla.api` here: axios injects default
+ * common headers (Authorization, UTM params, s-affiliate-code, allocation, …)
+ * that are not in the recommendations CORS allow-list and fail the preflight.
+ * Sending an explicit set via `fetch` avoids that whole class of failures.
+ * Store resolution uses the browser-set `Origin` header plus `s-store-id`.
+ *
+ * @internal exported for unit tests
+ */
+export function getRecommendationsHeaders() {
     const headers = {
         's-store-id': String(salla.config.get('store.id')),
-        origin: getStoreOriginHostname(),
         's-source': 'store',
         lang: salla.lang.getLocale(),
     };
-    const scopeId = salla.api.getHeader('s-scope-id');
+    // Only `s-scope-id` is on the recommendations CORS allow-list — `s-scope-type`
+    // is NOT, and requesting it makes the browser reject the preflight.
+    const scopeId = salla.api.getHeader?.('s-scope-id');
     if (scopeId) {
         headers['s-scope-id'] = String(scopeId);
     }
-    return { params, headers };
+    return headers;
 }
 function extractRecommendationIds(response) {
     return (response?.data ?? [])
         .map(item => item?.id)
         .filter((id) => Boolean(id));
 }
+/** Salla product ids are always numeric; reject anything else before it reaches the URL. */
+function toNumericId(value) {
+    const id = String(value);
+    return /^\d+$/.test(id) ? id : null;
+}
 function fetchRecommendations(path, params) {
-    const url = getRecommendationsUrl(path);
-    const config = getRecommendationsRequestConfig(params);
-    // Recommendations are a non-critical, best-effort feature; suppress the global
-    // API error notifier so transient failures stay invisible and the consuming
-    // component can silently hide its section via its own .catch().
-    return salla.api.withoutNotifier(() => salla.api.request(url, config, 'get'))
-        .then((response) => extractRecommendationIds(response));
+    const url = new URL(getRecommendationsUrl(path));
+    Object.entries(params).forEach(([key, value]) => url.searchParams.set(key, value));
+    // Native fetch (not salla.api) so only the explicit allow-listed headers are
+    // sent — no axios default headers to trip the recommendations CORS preflight.
+    // Best-effort feature: callers hide their section via .catch(), so no notifier.
+    // The host is the hardcoded constant CATALOG_RECOMMENDATIONS_API and only
+    // validated numeric ids reach the query string, so there is no SSRF surface.
+    // nosemgrep
+    return fetch(url.toString(), {
+        method: 'GET',
+        headers: getRecommendationsHeaders(),
+    })
+        .then((response) => {
+        if (!response.ok) {
+            throw new Error(`Recommendations request failed: ${response.status}`);
+        }
+        return response.json();
+    })
+        .then((payload) => extractRecommendationIds(payload));
 }
 export function fetchCartBoughtTogether(productIds) {
-    const ids = productIds.slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
+    const ids = productIds
+        .map(toNumericId)
+        .filter((id) => id !== null)
+        .slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
     if (!ids.length) {
         return Promise.resolve([]);
     }
@@ -77,10 +82,11 @@ export function fetchCartBoughtTogether(productIds) {
     });
 }
 export function fetchProductCustomersAlsoBought(productId) {
-    if (!productId) {
+    const id = toNumericId(productId);
+    if (!id) {
         return Promise.resolve([]);
     }
     return fetchRecommendations('/products/customers-also-bought', {
-        product_id: productId,
+        product_id: id,
     });
 }

package/dist/components/catalog-recommendations.js

@@ -13,62 +13,67 @@ function getRecommendationsBaseUrl() {
 function getRecommendationsUrl(path) {
     return `${getRecommendationsBaseUrl()}${RECOMMENDATIONS_BASE_PATH}${path}`;
 }
-function parseHostname(value) {
-    if (!value) {
-        return null;
-    }
-    try {
-        const normalized = value.startsWith('http') ? value : `https://${value}`;
-        return new URL(normalized).hostname || null;
-    }
-    catch {
-        const hostname = String(value).replace(/^https?:\/\//i, '').split('/')[0];
-        return hostname || null;
-    }
-}
-function getStoreOriginHostname() {
-    const trackUrl = salla.config.get('jitsu.track_url');
-    const trackHostname = trackUrl ? parseHostname(String(trackUrl)) : null;
-    if (trackHostname) {
-        return trackHostname;
-    }
-    for (const candidate of [salla.config.get('store.domain'), salla.config.get('store.url')]) {
-        const hostname = candidate ? parseHostname(String(candidate)) : null;
-        if (hostname && !hostname.includes('beta.salla.group')) {
-            return hostname;
-        }
-    }
-    return window.location.hostname;
-}
-function getRecommendationsRequestConfig(params) {
+/**
+ * Minimal, CORS-allow-listed header set for the recommendations host.
+ *
+ * We deliberately do NOT go through `salla.api` here: axios injects default
+ * common headers (Authorization, UTM params, s-affiliate-code, allocation, …)
+ * that are not in the recommendations CORS allow-list and fail the preflight.
+ * Sending an explicit set via `fetch` avoids that whole class of failures.
+ * Store resolution uses the browser-set `Origin` header plus `s-store-id`.
+ *
+ * @internal exported for unit tests
+ */
+function getRecommendationsHeaders() {
     const headers = {
         's-store-id': String(salla.config.get('store.id')),
-        origin: getStoreOriginHostname(),
         's-source': 'store',
         lang: salla.lang.getLocale(),
     };
-    const scopeId = salla.api.getHeader('s-scope-id');
+    // Only `s-scope-id` is on the recommendations CORS allow-list — `s-scope-type`
+    // is NOT, and requesting it makes the browser reject the preflight.
+    const scopeId = salla.api.getHeader?.('s-scope-id');
     if (scopeId) {
         headers['s-scope-id'] = String(scopeId);
     }
-    return { params, headers };
+    return headers;
 }
 function extractRecommendationIds(response) {
     return (response?.data ?? [])
         .map(item => item?.id)
         .filter((id) => Boolean(id));
 }
+/** Salla product ids are always numeric; reject anything else before it reaches the URL. */
+function toNumericId(value) {
+    const id = String(value);
+    return /^\d+$/.test(id) ? id : null;
+}
 function fetchRecommendations(path, params) {
-    const url = getRecommendationsUrl(path);
-    const config = getRecommendationsRequestConfig(params);
-    // Recommendations are a non-critical, best-effort feature; suppress the global
-    // API error notifier so transient failures stay invisible and the consuming
-    // component can silently hide its section via its own .catch().
-    return salla.api.withoutNotifier(() => salla.api.request(url, config, 'get'))
-        .then((response) => extractRecommendationIds(response));
+    const url = new URL(getRecommendationsUrl(path));
+    Object.entries(params).forEach(([key, value]) => url.searchParams.set(key, value));
+    // Native fetch (not salla.api) so only the explicit allow-listed headers are
+    // sent — no axios default headers to trip the recommendations CORS preflight.
+    // Best-effort feature: callers hide their section via .catch(), so no notifier.
+    // The host is the hardcoded constant CATALOG_RECOMMENDATIONS_API and only
+    // validated numeric ids reach the query string, so there is no SSRF surface.
+    // nosemgrep
+    return fetch(url.toString(), {
+        method: 'GET',
+        headers: getRecommendationsHeaders(),
+    })
+        .then((response) => {
+        if (!response.ok) {
+            throw new Error(`Recommendations request failed: ${response.status}`);
+        }
+        return response.json();
+    })
+        .then((payload) => extractRecommendationIds(payload));
 }
 function fetchCartBoughtTogether(productIds) {
-    const ids = productIds.slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
+    const ids = productIds
+        .map(toNumericId)
+        .filter((id) => id !== null)
+        .slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
     if (!ids.length) {
         return Promise.resolve([]);
     }
@@ -77,11 +82,12 @@ function fetchCartBoughtTogether(productIds) {
     });
 }
 function fetchProductCustomersAlsoBought(productId) {
-    if (!productId) {
+    const id = toNumericId(productId);
+    if (!id) {
         return Promise.resolve([]);
     }
     return fetchRecommendations('/products/customers-also-bought', {
-        product_id: productId,
+        product_id: id,
     });
 }