@salla.sa/twilight-components 2.14.507 → 2.14.509

package/dist/collection/components/salla-reviews-summary/salla-reviews-summary.js

@@ -38,7 +38,6 @@ export class SallaReviewsSummary {
             });
             this.basedOnLabel = salla.lang.get('blocks.comments.based_on');
             this.recommendedLabel = salla.lang.get('blocks.comments.recommended');
-            this.overallRatingLabel = salla.lang.get('blocks.comments.overall_rating');
         });
     }
     async loadSummary() {
@@ -62,13 +61,6 @@ export class SallaReviewsSummary {
             console.error('Error loading reviews summary:', error);
         }
     }
-    renderFactorTags() {
-        const factors = this.data?.factors || [];
-        if (!factors.length) {
-            return null;
-        }
-        return (h("div", { class: "s-reviews-summary-factors" }, factors.map(factor => (h("div", { class: "s-reviews-summary-factor-tag" }, h("span", { class: "s-reviews-summary-factor-name" }, factor.name), h("span", { class: "s-reviews-summary-factor-star", innerHTML: Star2 }), h("span", { class: "s-reviews-summary-factor-rating" }, factor.rating || ''))))));
-    }
     renderRecommendation() {
         if (!this.showRecommendation || !this.data?.recommendation) {
             return null;
@@ -94,9 +86,9 @@ export class SallaReviewsSummary {
         };
         const reviewElements = Object.keys(ratings).reverse().map((rating) => {
             const percentage = ratings[rating];
-            return (h("div", { key: rating, class: "s-reviews-summary-row" }, h("div", { class: "s-reviews-summary-row-rate" }, rating, " ", h("span", { innerHTML: Star2 })), h("salla-progress-bar", { class: "s-reviews-summary-progress", value: percentage, target: 100, hideUnits: true, height: '16px' }), h("span", { class: "s-reviews-summary-percentage" }, percentage, "%")));
+            return (h("div", { key: rating, class: "s-reviews-summary-row" }, h("div", { class: "s-reviews-summary-row-rate" }, rating, " ", h("span", { innerHTML: Star2 })), h("salla-progress-bar", { class: "s-reviews-summary-progress", value: percentage, target: 100, hideUnits: true, height: '20px' }), h("span", { class: "s-reviews-summary-percentage" }, percentage, "%")));
         });
-        return (h(Host, { class: "s-reviews-summary-wrapper" }, h("div", { class: "s-reviews-summary-header" }, h("div", { class: "s-reviews-summary-overall-section items-start" }, h("p", { class: "s-reviews-summary-overall-label" }, this.overallRatingLabel), h("div", { class: "s-reviews-summary-overall-row" }, h("h3", { class: "s-reviews-summary-average" }, this.data.rating), h("div", null, h("salla-rating-stars", { size: 'large', value: this.data.rating }), h("p", { class: "s-reviews-summary-count" }, this.basedOnLabel, " ", salla.helpers.number(salla.lang.choice('pages.rating.reviews', this.data.count)))))), this.renderFactorTags(), this.renderRecommendation()), h("div", { class: "s-reviews-summary-rows" }, reviewElements)));
+        return (h(Host, { class: "s-reviews-summary-wrapper s-reviews-summary-main-container" }, h("div", { class: "s-reviews-summary-header" }, h("div", { class: "s-reviews-summary-overall-section items-start" }, h("div", { class: "s-reviews-summary-overall-row" }, h("h3", { class: "s-reviews-summary-average" }, this.data.rating), h("div", null, h("salla-rating-stars", { size: 'large', value: this.data.rating }), h("p", { class: "s-reviews-summary-count" }, this.basedOnLabel, " ", salla.helpers.number(salla.lang.choice('pages.rating.reviews', this.data.count)))))), !!this.data?.factors?.length && (h("div", { class: "s-reviews-summary-factors" }, h("salla-review-factors-tags", { factors: this.data.factors }))), this.renderRecommendation()), h("div", { class: "s-reviews-summary-rows" }, reviewElements)));
     }
     static get is() { return "salla-reviews-summary"; }
     static get originalStyleUrls() {
@@ -138,7 +130,6 @@ export class SallaReviewsSummary {
             "canRender": {},
             "basedOnLabel": {},
             "recommendedLabel": {},
-            "overallRatingLabel": {},
             "showRatingSummary": {},
             "recommendationOnly": {},
             "showRecommendation": {}

package/dist/collection/components/salla-social-share/salla-social-share.js

@@ -82,7 +82,7 @@ export class SallaSocialShare {
         if (this.host.hasAttribute('aria-label')) {
             this.host.removeAttribute('aria-label');
         }
-        if (document.getElementById('a2a-script')) {
+        if (salla.mobile?.isEnabled?.() || document.getElementById('a2a-script')) {
             return;
         }
         const script = document.createElement('script');
@@ -211,6 +211,13 @@ export class SallaSocialShare {
         this.deferOutsideClickGuard();
         return this.open();
     }
+    handleShareClick() {
+        if (salla.mobile?.isEnabled?.()) {
+            salla.event.dispatch('mobile::share.open', { url: this.getShareUrl() });
+            return;
+        }
+        void this.toggle();
+    }
     /**
      * Asynchronously initializes the "AddToAny" (a2a) social sharing tool on the current page.
      * If the global object `window.a2a` is available, it initializes the tool with the 'page' mode.
@@ -345,7 +352,7 @@ export class SallaSocialShare {
         })));
     }
     render() {
-        return (h("div", { key: 'e934ffb94fea491d445e62f26fcf98914ff0a399', class: "s-social-share-wrapper" }, h("slot", { key: '8dbf4a0c3fb6fb17a0a7c32ace57b357708c0678', name: "widget" }, h("salla-button", { key: 'eb6459bc99d4587bbfc6c0399003a2860d6992b0', "aria-label": "Share", onClick: () => this.toggle(), class: "s-social-share-btn", shape: "icon", fill: "outline", color: "light" }, h("span", { key: '3394f64755bd0bc07839b1a513f5459c8258f096', innerHTML: this.opened ? Cancel : ShareAlt }))), this.mode === 'modal' ? this.renderModal() : this.renderPopupList()));
+        return (h("div", { key: 'a96314583de0fd531a9cbc1298efd3c367dae23d', class: "s-social-share-wrapper" }, h("slot", { key: '9f8a1789871e46f02e06cf29a52404a5f01b1e5f', name: "widget" }, h("salla-button", { key: '22c00cfa4d3ca197d4016efcb6e1c49e54b923cf', "aria-label": "Share", onClick: () => this.handleShareClick(), class: "s-social-share-btn", shape: "icon", fill: "outline", color: "light" }, h("span", { key: '4e030b48ba5e673e66ac135f90e6b395c28df403', innerHTML: this.opened ? Cancel : ShareAlt }))), this.mode === 'modal' ? this.renderModal() : this.renderPopupList()));
     }
     static get is() { return "salla-social-share"; }
     static get originalStyleUrls() {

package/dist/collection/shared/catalog-recommendations.js

@@ -13,62 +13,67 @@ function getRecommendationsBaseUrl() {
 function getRecommendationsUrl(path) {
     return `${getRecommendationsBaseUrl()}${RECOMMENDATIONS_BASE_PATH}${path}`;
 }
-function parseHostname(value) {
-    if (!value) {
-        return null;
-    }
-    try {
-        const normalized = value.startsWith('http') ? value : `https://${value}`;
-        return new URL(normalized).hostname || null;
-    }
-    catch {
-        const hostname = String(value).replace(/^https?:\/\//i, '').split('/')[0];
-        return hostname || null;
-    }
-}
-function getStoreOriginHostname() {
-    const trackUrl = salla.config.get('jitsu.track_url');
-    const trackHostname = trackUrl ? parseHostname(String(trackUrl)) : null;
-    if (trackHostname) {
-        return trackHostname;
-    }
-    for (const candidate of [salla.config.get('store.domain'), salla.config.get('store.url')]) {
-        const hostname = candidate ? parseHostname(String(candidate)) : null;
-        if (hostname && !hostname.includes('beta.salla.group')) {
-            return hostname;
-        }
-    }
-    return window.location.hostname;
-}
-function getRecommendationsRequestConfig(params) {
+/**
+ * Minimal, CORS-allow-listed header set for the recommendations host.
+ *
+ * We deliberately do NOT go through `salla.api` here: axios injects default
+ * common headers (Authorization, UTM params, s-affiliate-code, allocation, …)
+ * that are not in the recommendations CORS allow-list and fail the preflight.
+ * Sending an explicit set via `fetch` avoids that whole class of failures.
+ * Store resolution uses the browser-set `Origin` header plus `s-store-id`.
+ *
+ * @internal exported for unit tests
+ */
+export function getRecommendationsHeaders() {
     const headers = {
         's-store-id': String(salla.config.get('store.id')),
-        origin: getStoreOriginHostname(),
         's-source': 'store',
         lang: salla.lang.getLocale(),
     };
-    const scopeId = salla.api.getHeader('s-scope-id');
+    // Only `s-scope-id` is on the recommendations CORS allow-list — `s-scope-type`
+    // is NOT, and requesting it makes the browser reject the preflight.
+    const scopeId = salla.api.getHeader?.('s-scope-id');
     if (scopeId) {
         headers['s-scope-id'] = String(scopeId);
     }
-    return { params, headers };
+    return headers;
 }
 function extractRecommendationIds(response) {
     return (response?.data ?? [])
         .map(item => item?.id)
         .filter((id) => Boolean(id));
 }
+/** Salla product ids are always numeric; reject anything else before it reaches the URL. */
+function toNumericId(value) {
+    const id = String(value);
+    return /^\d+$/.test(id) ? id : null;
+}
 function fetchRecommendations(path, params) {
-    const url = getRecommendationsUrl(path);
-    const config = getRecommendationsRequestConfig(params);
-    // Recommendations are a non-critical, best-effort feature; suppress the global
-    // API error notifier so transient failures stay invisible and the consuming
-    // component can silently hide its section via its own .catch().
-    return salla.api.withoutNotifier(() => salla.api.request(url, config, 'get'))
-        .then((response) => extractRecommendationIds(response));
+    const url = new URL(getRecommendationsUrl(path));
+    Object.entries(params).forEach(([key, value]) => url.searchParams.set(key, value));
+    // Native fetch (not salla.api) so only the explicit allow-listed headers are
+    // sent — no axios default headers to trip the recommendations CORS preflight.
+    // Best-effort feature: callers hide their section via .catch(), so no notifier.
+    // The host is the hardcoded constant CATALOG_RECOMMENDATIONS_API and only
+    // validated numeric ids reach the query string, so there is no SSRF surface.
+    // nosemgrep
+    return fetch(url.toString(), {
+        method: 'GET',
+        headers: getRecommendationsHeaders(),
+    })
+        .then((response) => {
+        if (!response.ok) {
+            throw new Error(`Recommendations request failed: ${response.status}`);
+        }
+        return response.json();
+    })
+        .then((payload) => extractRecommendationIds(payload));
 }
 export function fetchCartBoughtTogether(productIds) {
-    const ids = productIds.slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
+    const ids = productIds
+        .map(toNumericId)
+        .filter((id) => id !== null)
+        .slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
     if (!ids.length) {
         return Promise.resolve([]);
     }
@@ -77,10 +82,11 @@ export function fetchCartBoughtTogether(productIds) {
     });
 }
 export function fetchProductCustomersAlsoBought(productId) {
-    if (!productId) {
+    const id = toNumericId(productId);
+    if (!id) {
         return Promise.resolve([]);
     }
     return fetchRecommendations('/products/customers-also-bought', {
-        product_id: productId,
+        product_id: id,
     });
 }

package/dist/components/catalog-recommendations.js

@@ -13,62 +13,67 @@ function getRecommendationsBaseUrl() {
 function getRecommendationsUrl(path) {
     return `${getRecommendationsBaseUrl()}${RECOMMENDATIONS_BASE_PATH}${path}`;
 }
-function parseHostname(value) {
-    if (!value) {
-        return null;
-    }
-    try {
-        const normalized = value.startsWith('http') ? value : `https://${value}`;
-        return new URL(normalized).hostname || null;
-    }
-    catch {
-        const hostname = String(value).replace(/^https?:\/\//i, '').split('/')[0];
-        return hostname || null;
-    }
-}
-function getStoreOriginHostname() {
-    const trackUrl = salla.config.get('jitsu.track_url');
-    const trackHostname = trackUrl ? parseHostname(String(trackUrl)) : null;
-    if (trackHostname) {
-        return trackHostname;
-    }
-    for (const candidate of [salla.config.get('store.domain'), salla.config.get('store.url')]) {
-        const hostname = candidate ? parseHostname(String(candidate)) : null;
-        if (hostname && !hostname.includes('beta.salla.group')) {
-            return hostname;
-        }
-    }
-    return window.location.hostname;
-}
-function getRecommendationsRequestConfig(params) {
+/**
+ * Minimal, CORS-allow-listed header set for the recommendations host.
+ *
+ * We deliberately do NOT go through `salla.api` here: axios injects default
+ * common headers (Authorization, UTM params, s-affiliate-code, allocation, …)
+ * that are not in the recommendations CORS allow-list and fail the preflight.
+ * Sending an explicit set via `fetch` avoids that whole class of failures.
+ * Store resolution uses the browser-set `Origin` header plus `s-store-id`.
+ *
+ * @internal exported for unit tests
+ */
+function getRecommendationsHeaders() {
     const headers = {
         's-store-id': String(salla.config.get('store.id')),
-        origin: getStoreOriginHostname(),
         's-source': 'store',
         lang: salla.lang.getLocale(),
     };
-    const scopeId = salla.api.getHeader('s-scope-id');
+    // Only `s-scope-id` is on the recommendations CORS allow-list — `s-scope-type`
+    // is NOT, and requesting it makes the browser reject the preflight.
+    const scopeId = salla.api.getHeader?.('s-scope-id');
     if (scopeId) {
         headers['s-scope-id'] = String(scopeId);
     }
-    return { params, headers };
+    return headers;
 }
 function extractRecommendationIds(response) {
     return (response?.data ?? [])
         .map(item => item?.id)
         .filter((id) => Boolean(id));
 }
+/** Salla product ids are always numeric; reject anything else before it reaches the URL. */
+function toNumericId(value) {
+    const id = String(value);
+    return /^\d+$/.test(id) ? id : null;
+}
 function fetchRecommendations(path, params) {
-    const url = getRecommendationsUrl(path);
-    const config = getRecommendationsRequestConfig(params);
-    // Recommendations are a non-critical, best-effort feature; suppress the global
-    // API error notifier so transient failures stay invisible and the consuming
-    // component can silently hide its section via its own .catch().
-    return salla.api.withoutNotifier(() => salla.api.request(url, config, 'get'))
-        .then((response) => extractRecommendationIds(response));
+    const url = new URL(getRecommendationsUrl(path));
+    Object.entries(params).forEach(([key, value]) => url.searchParams.set(key, value));
+    // Native fetch (not salla.api) so only the explicit allow-listed headers are
+    // sent — no axios default headers to trip the recommendations CORS preflight.
+    // Best-effort feature: callers hide their section via .catch(), so no notifier.
+    // The host is the hardcoded constant CATALOG_RECOMMENDATIONS_API and only
+    // validated numeric ids reach the query string, so there is no SSRF surface.
+    // nosemgrep
+    return fetch(url.toString(), {
+        method: 'GET',
+        headers: getRecommendationsHeaders(),
+    })
+        .then((response) => {
+        if (!response.ok) {
+            throw new Error(`Recommendations request failed: ${response.status}`);
+        }
+        return response.json();
+    })
+        .then((payload) => extractRecommendationIds(payload));
 }
 function fetchCartBoughtTogether(productIds) {
-    const ids = productIds.slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
+    const ids = productIds
+        .map(toNumericId)
+        .filter((id) => id !== null)
+        .slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
     if (!ids.length) {
         return Promise.resolve([]);
     }
@@ -77,11 +82,12 @@ function fetchCartBoughtTogether(productIds) {
     });
 }
 function fetchProductCustomersAlsoBought(productId) {
-    if (!productId) {
+    const id = toNumericId(productId);
+    if (!id) {
         return Promise.resolve([]);
     }
     return fetchRecommendations('/products/customers-also-bought', {
-        product_id: productId,
+        product_id: id,
     });
 }