@scayle/storefront-core 7.37.0 → 7.38.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @scayle/storefront-core
 
+## 7.38.1
+
+### Patch Changes
+
+- Fix potential empty user after login
+
+## 7.38.0
+
+### Minor Changes
+
+- Allow the session of an `RpcContext` to be undefined
+
+  BREAKING: This changes the structure of the `RpcContext`, so it may be a breaking change if you have written custom RPC methods.
+
+  The affected properties on the `RpcContext` are `sessionId`, `wishlistKey` and `basketKey` and the affected methods are `destroySession`, `createUserBoundSession`, `updateUser`, and `updateTokens`. If you use these methods or properties in a custom RPC method, make sure that you handle the case where they might be undefined. TypeScript will also catch these cases if you have `strictNullChecks` enabled.
+
+  You can check `context.sessionId` (or another session-dependent property) to determine if the session is present. If one of these properties is present, all will be. Alternatively, you can call `assertSession(context)` before referencing any properties on the context. If the session is not present, an error will be thrown. For any usage of `context` after `assertSession` is called, TypeScript will understand that the session properties are present.
+
 ## 7.37.0
 
 ### Minor Changes

package/dist/api/customer.cjs

@@ -50,16 +50,16 @@ class CustomerAPIClient {
    * When not logged in will return undefined.
    * @see https://scayle.dev/api/oauth/latest/fetch-authorized-payload
    */
-  async getMe(shopId) {
+  async getMe(shopId, accessToken) {
     const response = await fetch(`${this.baseURL}/api/oauth/me`, {
       headers: {
         ...this.headers,
+        ...(accessToken ? {
+          Authorization: `Bearer ${accessToken}`
+        } : {}),
         "X-Shop-Id": shopId.toString()
       }
     });
-    if (response.status === _httpStatus.HttpStatusCode.FORBIDDEN) {
-      return void 0;
-    }
     return this.handleResponse(response);
   }
   /**

package/dist/api/customer.d.ts

@@ -49,7 +49,7 @@ export declare class CustomerAPIClient {
      * When not logged in will return undefined.
      * @see https://scayle.dev/api/oauth/latest/fetch-authorized-payload
      */
-    getMe(shopId: number): Promise<ShopUser | undefined>;
+    getMe(shopId: number, accessToken?: string): Promise<ShopUser>;
     /**
      * Fetch a customer's order
      * @see https://scayle.dev/api/oauth/latest/fetch-order-by-id
@@ -60,11 +60,11 @@ export declare class CustomerAPIClient {
      *
      * @see https://scayle.dev/api/oauth/latest/put-customer-contact
      */
-    updateContactInfo(shopId: number, { email, phone }: ContactData): Promise<ShopUser>;
+    updateContactInfo(shopId: number, { email, phone }: Partial<ContactData>): Promise<ShopUser>;
     /**
      * Update the customer's personal details
      */
-    updatePersonalInfo(shopId: number, payload: PersonalData): Promise<ShopUser>;
+    updatePersonalInfo(shopId: number, payload: Partial<PersonalData>): Promise<ShopUser>;
     /**
      * Update the customer's password
      *

package/dist/api/customer.mjs

@@ -44,16 +44,14 @@ export class CustomerAPIClient {
    * When not logged in will return undefined.
    * @see https://scayle.dev/api/oauth/latest/fetch-authorized-payload
    */
-  async getMe(shopId) {
+  async getMe(shopId, accessToken) {
     const response = await fetch(`${this.baseURL}/api/oauth/me`, {
       headers: {
         ...this.headers,
+        ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
         "X-Shop-Id": shopId.toString()
       }
     });
-    if (response.status === HttpStatusCode.FORBIDDEN) {
-      return void 0;
-    }
     return this.handleResponse(response);
   }
   /**

package/dist/api/oauth.cjs

@@ -27,9 +27,12 @@ function emptyOAuthResponseHandler(response) {
   }
 }
 function getOAuthClient(context) {
-  const clientId = context.oauth?.clientId;
-  const clientSecret = context.oauth?.clientSecret;
-  const apiHost = context.oauth?.apiHost;
+  if (!context.oauth) {
+    throw new Error("OAuth configuration is missing");
+  }
+  const clientId = context.oauth.clientId;
+  const clientSecret = context.oauth.clientSecret;
+  const apiHost = context.oauth.apiHost;
   return new OAuthClient({
     clientId,
     clientSecret,

package/dist/api/oauth.d.ts

@@ -15,7 +15,7 @@ export declare class OAuthClient {
     headers: HeadersInit;
     baseURL: string;
     logger?: Log;
-    clientId?: string;
+    clientId: string;
     constructor(options: OAuthOptions, logger?: Log);
     /**
      * Register a user and retrieve a token set

package/dist/api/oauth.mjs

@@ -20,9 +20,12 @@ function emptyOAuthResponseHandler(response) {
   }
 }
 export function getOAuthClient(context) {
-  const clientId = context.oauth?.clientId;
-  const clientSecret = context.oauth?.clientSecret;
-  const apiHost = context.oauth?.apiHost;
+  if (!context.oauth) {
+    throw new Error("OAuth configuration is missing");
+  }
+  const clientId = context.oauth.clientId;
+  const clientSecret = context.oauth.clientSecret;
+  const apiHost = context.oauth.apiHost;
   return new OAuthClient({ clientId, clientSecret, apiHost }, context.log);
 }
 export class OAuthClient {

package/dist/cache/cached.cjs

@@ -40,7 +40,9 @@ class Cached {
           return cachedResponse;
         }
       } catch (e) {
-        this.handleError(e);
+        if (e instanceof Error) {
+          this.handleError(e);
+        }
       }
       const response = await fn(...args);
       if (response === void 0 || response === null) {
@@ -49,7 +51,9 @@ class Cached {
       try {
         await this.setCacheValue(cacheKey, response, options);
       } catch (e) {
-        this.handleError(e);
+        if (e instanceof Error) {
+          this.handleError(e);
+        }
       }
       return response;
     };

package/dist/cache/cached.mjs

@@ -34,7 +34,9 @@ export class Cached {
           return cachedResponse;
         }
       } catch (e) {
-        this.handleError(e);
+        if (e instanceof Error) {
+          this.handleError(e);
+        }
       }
       const response = await fn(...args);
       if (response === void 0 || response === null) {
@@ -43,7 +45,9 @@ export class Cached {
       try {
         await this.setCacheValue(cacheKey, response, options);
       } catch (e) {
-        this.handleError(e);
+        if (e instanceof Error) {
+          this.handleError(e);
+        }
       }
       return response;
     };

package/dist/helpers/filterHelper.d.ts

@@ -73,7 +73,7 @@ export type Filter = Record<string, string | number | (string | number | null)[]
  *
  * @param filter
  */
-export declare const serializeFilters: (filter: Filter) => SerializedFilter;
+export declare const serializeFilters: (filter: Filter) => SerializedFilter | undefined;
 /**
  * Converts filter values back into their original data type.
  *

package/dist/rpc/methods/basket/basket.cjs

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.removeItemFromBasket = exports.mergeBaskets = exports.getBasket = exports.clearBasket = exports.addItemsToBasket = exports.addItemToBasket = void 0;
 var _errors = require("../../../errors/index.cjs");
+var _types = require("../../../types/index.cjs");
 var _constants = require("../../../constants/index.cjs");
 var _user = require("../../../utils/user.cjs");
 const BAPI_ERROR_NAME = "BAPI ERROR";
@@ -21,6 +22,7 @@ const addItemToBasket = exports.addItemToBasket = async function addItemToBasket
   itemGroup,
   with: _with
 }, context) {
+  (0, _types.assertSession)(context);
   const {
     campaignKey,
     bapiClient,
@@ -33,7 +35,7 @@ const addItemToBasket = exports.addItemToBasket = async function addItemToBasket
     variantId,
     quantity,
     params: {
-      promotionId,
+      promotionId: promotionId ?? void 0,
       campaignKey,
       displayData,
       pricePromotionKey: resolvedWith?.pricePromotionKey || "",
@@ -62,6 +64,7 @@ const addItemToBasket = exports.addItemToBasket = async function addItemToBasket
   }
 };
 const addItemsToBasket = exports.addItemsToBasket = async function addItemsToBasket2(params, context) {
+  (0, _types.assertSession)(context);
   const {
     campaignKey,
     bapiClient,
@@ -72,7 +75,7 @@ const addItemsToBasket = exports.addItemsToBasket = async function addItemsToBas
     variantId: item.variantId,
     quantity: item.quantity,
     params: {
-      promotionId: item.promotionId,
+      promotionId: item.promotionId ?? void 0,
       campaignKey,
       displayData: item.displayData,
       pricePromotionKey: resolvedWith?.pricePromotionKey || "",
@@ -104,6 +107,7 @@ const addItemsToBasket = exports.addItemsToBasket = async function addItemsToBas
   }
 };
 const getBasket = exports.getBasket = async function getBasket2(options, context) {
+  (0, _types.assertSession)(context);
   const {
     bapiClient,
     campaignKey,
@@ -127,6 +131,7 @@ const getBasket = exports.getBasket = async function getBasket2(options, context
   return response.basket;
 };
 const removeItemFromBasket = exports.removeItemFromBasket = async function removeItemFromBasket2(options, context) {
+  (0, _types.assertSession)(context);
   const {
     bapiClient,
     campaignKey,
@@ -160,18 +165,16 @@ const mergeBaskets = exports.mergeBaskets = async function mergeBaskets2({
   return await (0, _user.mergeBaskets)(fromBasketKey, toBasketKey, resolvedWith, context);
 };
 function parseBasketError(response) {
-  if (response.type === "failure") {
-    const parsedError = {
-      message: "",
-      statusCode: 500
-    };
-    if ("statusCode" in response) {
-      parsedError.statusCode = response.statusCode;
-    } else {
-      const [error] = response.errors;
-      parsedError.message = response.errors?.map(error2 => `${error2.operation !== "delete" ? error2.kind + ":" : ""}${error2.operation}:${error2.variantId} - ${error2.message}`).join(" | ");
-      parsedError.statusCode = error.statusCode;
-    }
-    return parsedError;
+  const parsedError = {
+    message: "",
+    statusCode: 500
+  };
+  if ("statusCode" in response) {
+    parsedError.statusCode = response.statusCode;
+  } else {
+    const [error] = response.errors;
+    parsedError.message = response.errors?.map(error2 => `${error2.operation !== "delete" ? error2.kind + ":" : ""}${error2.operation}:${error2.variantId} - ${error2.message}`).join(" | ");
+    parsedError.statusCode = error.statusCode;
   }
+  return parsedError;
 }

package/dist/rpc/methods/basket/basket.mjs

@@ -1,4 +1,7 @@
 import { BAPIError } from "../../../errors/index.mjs";
+import {
+  assertSession
+} from "../../../types/index.mjs";
 import {
   ExistingItemHandling,
   MIN_WITH_PARAMS_BASKET
@@ -18,6 +21,7 @@ export const addItemToBasket = async function addItemToBasket2({
   itemGroup,
   with: _with
 }, context) {
+  assertSession(context);
   const { campaignKey, bapiClient, basketKey } = context;
   const resolvedWith = getWithParams(
     { with: _with },
@@ -30,7 +34,7 @@ export const addItemToBasket = async function addItemToBasket2({
         variantId,
         quantity,
         params: {
-          promotionId,
+          promotionId: promotionId ?? void 0,
           campaignKey,
           displayData,
           pricePromotionKey: resolvedWith?.pricePromotionKey || "",
@@ -62,13 +66,14 @@ export const addItemToBasket = async function addItemToBasket2({
   }
 };
 export const addItemsToBasket = async function addItemsToBasket2(params, context) {
+  assertSession(context);
   const { campaignKey, bapiClient, basketKey } = context;
   const resolvedWith = getWithParams(params, context);
   const itemsToBeAddedOrUpdated = params.items.map((item) => ({
     variantId: item.variantId,
     quantity: item.quantity,
     params: {
-      promotionId: item.promotionId,
+      promotionId: item.promotionId ?? void 0,
       campaignKey,
       displayData: item.displayData,
       pricePromotionKey: resolvedWith?.pricePromotionKey || "",
@@ -109,6 +114,7 @@ export const addItemsToBasket = async function addItemsToBasket2(params, context
   }
 };
 export const getBasket = async function getBasket2(options, context) {
+  assertSession(context);
   const { bapiClient, campaignKey, basketKey } = context;
   const resolvedWith = getWithParams(
     { with: options },
@@ -131,6 +137,7 @@ export const getBasket = async function getBasket2(options, context) {
   return response.basket;
 };
 export const removeItemFromBasket = async function removeItemFromBasket2(options, context) {
+  assertSession(context);
   const { bapiClient, campaignKey, basketKey } = context;
   const resolvedWith = getWithParams(options, context);
   return await bapiClient.basket.deleteItem(basketKey, options.itemKey, {
@@ -162,20 +169,18 @@ export const mergeBaskets = async function mergeBaskets2({ fromBasketKey, toBask
   );
 };
 function parseBasketError(response) {
-  if (response.type === "failure") {
-    const parsedError = {
-      message: "",
-      statusCode: 500
-    };
-    if ("statusCode" in response) {
-      parsedError.statusCode = response.statusCode;
-    } else {
-      const [error] = response.errors;
-      parsedError.message = response.errors?.map(
-        (error2) => `${error2.operation !== "delete" ? error2.kind + ":" : ""}${error2.operation}:${error2.variantId} - ${error2.message}`
-      ).join(" | ");
-      parsedError.statusCode = error.statusCode;
-    }
-    return parsedError;
+  const parsedError = {
+    message: "",
+    statusCode: 500
+  };
+  if ("statusCode" in response) {
+    parsedError.statusCode = response.statusCode;
+  } else {
+    const [error] = response.errors;
+    parsedError.message = response.errors?.map(
+      (error2) => `${error2.operation !== "delete" ? error2.kind + ":" : ""}${error2.operation}:${error2.variantId} - ${error2.message}`
+    ).join(" | ");
+    parsedError.statusCode = error.statusCode;
   }
+  return parsedError;
 }

package/dist/rpc/methods/checkout/shopUser.cjs

@@ -58,10 +58,13 @@ const updatePassword = exports.updatePassword = async function updatePassword2({
   newPassword
 }, context) {
   const shopUser = context.user;
-  const oauthEnabled = context.oauth.apiHost && context.oauth.clientId && context.oauth.clientSecret;
+  const oauthEnabled = context.oauth?.apiHost && context.oauth?.clientId && context.oauth?.clientSecret;
   try {
     if (oauthEnabled) {
       const client2 = (0, _oauth.getOAuthClient)(context);
+      if (!context.accessToken) {
+        throw new Error("User is not logged in");
+      }
       await client2.updatePassword({
         password: oldPassword,
         new_password: newPassword
@@ -94,4 +97,7 @@ const updatePassword = exports.updatePassword = async function updatePassword2({
       throw new Error("404 - Failed to update user's password - User not found");
     }
   }
+  return {
+    user: shopUser
+  };
 };

package/dist/rpc/methods/checkout/shopUser.d.ts

@@ -3,5 +3,5 @@ export declare const updateShopUser: RpcHandler<Partial<ShopUser>, {
     user: ShopUser;
 }>;
 export declare const updatePassword: RpcHandler<UpdatePasswordParams, {
-    user: ShopUser;
+    user: ShopUser | undefined;
 }>;

package/dist/rpc/methods/checkout/shopUser.mjs

@@ -46,10 +46,13 @@ export const updateShopUser = async function updateShopUser2(payload, context) {
 };
 export const updatePassword = async function updatePassword2({ oldPassword, newPassword }, context) {
   const shopUser = context.user;
-  const oauthEnabled = context.oauth.apiHost && context.oauth.clientId && context.oauth.clientSecret;
+  const oauthEnabled = context.oauth?.apiHost && context.oauth?.clientId && context.oauth?.clientSecret;
   try {
     if (oauthEnabled) {
       const client2 = getOAuthClient(context);
+      if (!context.accessToken) {
+        throw new Error("User is not logged in");
+      }
       await client2.updatePassword(
         {
           password: oldPassword,
@@ -83,4 +86,5 @@ export const updatePassword = async function updatePassword2({ oldPassword, newP
       throw new Error("404 - Failed to update user's password - User not found");
     }
   }
+  return { user: shopUser };
 };

package/dist/rpc/methods/oauth/idp.cjs

@@ -5,17 +5,17 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.handleIDPLoginCallback = exports.getExternalIdpRedirect = void 0;
 var _jose = require("jose");
+var _types = require("../../../types/index.cjs");
 var _oauth = require("../../../api/oauth.cjs");
 const getExternalIdpRedirect = exports.getExternalIdpRedirect = async function getExternalIdpRedirect2(context) {
   const shopId = context.shopId.toString();
   const OAuthClient = (0, _oauth.getOAuthClient)(context);
   const checkoutSecret = context.checkout.secret;
-  const isIDPEnabled = context.idp.enabled;
-  const IDPKeys = context.idp.idpKeys;
-  const IDPRedirectURL = context.idp.idpRedirectURL;
-  if (!isIDPEnabled) {
+  if (!context.idp?.enabled) {
     throw new Error("IDP disabled");
   }
+  const IDPKeys = context.idp.idpKeys;
+  const IDPRedirectURL = context.idp.idpRedirectURL;
   if (!IDPKeys.length) {
     throw new Error("No IDP keys configured");
   }
@@ -40,6 +40,7 @@ const getExternalIdpRedirect = exports.getExternalIdpRedirect = async function g
   return Object.fromEntries(results);
 };
 const handleIDPLoginCallback = exports.handleIDPLoginCallback = async function handleIDPLoginCallback2(code, context) {
+  (0, _types.assertSession)(context);
   const OAuthClient = (0, _oauth.getOAuthClient)(context);
   const {
     access_token: accessToken,

package/dist/rpc/methods/oauth/idp.mjs

@@ -1,15 +1,15 @@
 import { SignJWT } from "jose";
+import { assertSession } from "../../../types/index.mjs";
 import { getOAuthClient } from "../../../api/oauth.mjs";
 export const getExternalIdpRedirect = async function getExternalIdpRedirect2(context) {
   const shopId = context.shopId.toString();
   const OAuthClient = getOAuthClient(context);
   const checkoutSecret = context.checkout.secret;
-  const isIDPEnabled = context.idp.enabled;
-  const IDPKeys = context.idp.idpKeys;
-  const IDPRedirectURL = context.idp.idpRedirectURL;
-  if (!isIDPEnabled) {
+  if (!context.idp?.enabled) {
     throw new Error("IDP disabled");
   }
+  const IDPKeys = context.idp.idpKeys;
+  const IDPRedirectURL = context.idp.idpRedirectURL;
   if (!IDPKeys.length) {
     throw new Error("No IDP keys configured");
   }
@@ -36,6 +36,7 @@ export const getExternalIdpRedirect = async function getExternalIdpRedirect2(con
   return Object.fromEntries(results);
 };
 export const handleIDPLoginCallback = async function handleIDPLoginCallback2(code, context) {
+  assertSession(context);
   const OAuthClient = getOAuthClient(context);
   const { access_token: accessToken, refresh_token: refreshToken } = await OAuthClient.generateToken(code);
   context.updateTokens({

package/dist/rpc/methods/products.cjs

@@ -115,13 +115,14 @@ const getFilters = exports.getFilters = async function getFilters2({
   includeSoldOut = false,
   includeSellableForFree = false,
   orFiltersOperator
-}, {
-  cached,
-  bapiClient,
-  campaignKey
-}) {
+}, context) {
   let result;
   let allFiltersForCategory = [];
+  const {
+    cached,
+    bapiClient,
+    campaignKey
+  } = context;
   if (category !== "/") {
     result = await cached(bapiClient.categories.getByPath, {
       cacheKeyPrefix: `getByPath-categories-${category}`
@@ -132,11 +133,7 @@ const getFilters = exports.getFilters = async function getFilters2({
         slug: category
       },
       includedFilters
-    }, {
-      cached,
-      bapiClient,
-      campaignKey
-    });
+    }, context);
   }
   const sanitizedAttributes = sanitizeAttributesForBAPI({
     attributes: where?.attributes || [],

package/dist/rpc/methods/products.mjs

@@ -94,16 +94,17 @@ export const getFilters = async function getFilters2({
   includeSoldOut = false,
   includeSellableForFree = false,
   orFiltersOperator
-}, { cached, bapiClient, campaignKey }) {
+}, context) {
   let result;
   let allFiltersForCategory = [];
+  const { cached, bapiClient, campaignKey } = context;
   if (category !== "/") {
     result = await cached(bapiClient.categories.getByPath, {
       cacheKeyPrefix: `getByPath-categories-${category}`
     })(splitAndRemoveEmpty(category));
     allFiltersForCategory = await fetchAllFiltersForCategory(
       { category: { id: result.id, slug: category }, includedFilters },
-      { cached, bapiClient, campaignKey }
+      context
     );
   }
   const sanitizedAttributes = sanitizeAttributesForBAPI({

package/dist/rpc/methods/session.cjs

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.updatePasswordByHash = exports.refreshAccessToken = exports.oauthRevokeToken = exports.oauthRegister = exports.oauthLogin = exports.oauthGuestLogin = exports.oauthForgetPassword = exports.convertErrorForRpcCall = void 0;
 var _jose = require("jose");
+var _types = require("../../types/index.cjs");
 var _constants = require("../../constants/index.cjs");
 var _fetch = require("../../utils/fetch.cjs");
 var _user = require("../../utils/user.cjs");
@@ -16,19 +17,16 @@ const convertErrorForRpcCall = (error, httpStatuses) => {
   }
 };
 exports.convertErrorForRpcCall = convertErrorForRpcCall;
-const saveUserOnSession = async (accessToken, context) => {
+async function postLogin(context, tokens) {
   const user = await (0, _user2.fetchUser)({
-    accessToken,
+    accessToken: tokens.access_token,
     callback: ""
   }, context);
-  context.updateUser(user);
-};
-async function postLogin(context, tokens) {
   context.updateTokens({
     accessToken: tokens.access_token,
     refreshToken: tokens.refresh_token
   });
-  await saveUserOnSession(tokens.access_token, context);
+  context.updateUser(user);
   const {
     customerId
   } = (0, _jose.decodeJwt)(tokens.access_token);
@@ -36,6 +34,7 @@ async function postLogin(context, tokens) {
   await context.createUserBoundSession();
 }
 const oauthLogin = async (login, context) => {
+  (0, _types.assertSession)(context);
   const shopId = context.shopId;
   const client = (0, _oauth.getOAuthClient)(context);
   if (!login.email || !login.password) {
@@ -48,7 +47,7 @@ const oauthLogin = async (login, context) => {
     });
     await postLogin(context, tokens);
   } catch (error) {
-    const err = convertErrorForRpcCall(error, [_constants.HttpStatusCode.INTERNAL_SERVER_ERROR, _constants.HttpStatusCode.BAD_REQUEST, _constants.HttpStatusCode.UNAUTHORIZED, _constants.HttpStatusCode.NOT_FOUND]);
+    const err = convertErrorForRpcCall(error, [_constants.HttpStatusCode.INTERNAL_SERVER_ERROR, _constants.HttpStatusCode.BAD_REQUEST, _constants.HttpStatusCode.UNAUTHORIZED, _constants.HttpStatusCode.NOT_FOUND, _constants.HttpStatusCode.FORBIDDEN]);
     if (err) {
       throw err;
     }
@@ -56,6 +55,7 @@ const oauthLogin = async (login, context) => {
 };
 exports.oauthLogin = oauthLogin;
 const oauthRegister = async (register, context) => {
+  (0, _types.assertSession)(context);
   const shopId = context.shopId;
   const client = (0, _oauth.getOAuthClient)(context);
   try {
@@ -65,7 +65,7 @@ const oauthRegister = async (register, context) => {
     });
     await postLogin(context, tokens);
   } catch (error) {
-    const err = convertErrorForRpcCall(error, [_constants.HttpStatusCode.BAD_REQUEST, _constants.HttpStatusCode.UNAUTHORIZED, _constants.HttpStatusCode.CONFLICT]);
+    const err = convertErrorForRpcCall(error, [_constants.HttpStatusCode.BAD_REQUEST, _constants.HttpStatusCode.UNAUTHORIZED, _constants.HttpStatusCode.CONFLICT, _constants.HttpStatusCode.FORBIDDEN]);
     if (err) {
       throw err;
     }
@@ -73,6 +73,7 @@ const oauthRegister = async (register, context) => {
 };
 exports.oauthRegister = oauthRegister;
 const oauthGuestLogin = async (guest, context) => {
+  (0, _types.assertSession)(context);
   const shopId = context.shopId;
   const client = (0, _oauth.getOAuthClient)(context);
   try {
@@ -82,7 +83,7 @@ const oauthGuestLogin = async (guest, context) => {
     });
     await postLogin(context, tokens);
   } catch (error) {
-    const err = convertErrorForRpcCall(error, [_constants.HttpStatusCode.BAD_REQUEST, _constants.HttpStatusCode.UNAUTHORIZED, _constants.HttpStatusCode.CONFLICT]);
+    const err = convertErrorForRpcCall(error, [_constants.HttpStatusCode.BAD_REQUEST, _constants.HttpStatusCode.UNAUTHORIZED, _constants.HttpStatusCode.CONFLICT, _constants.HttpStatusCode.FORBIDDEN]);
     if (err) {
       throw err;
     }
@@ -90,6 +91,7 @@ const oauthGuestLogin = async (guest, context) => {
 };
 exports.oauthGuestLogin = oauthGuestLogin;
 const refreshAccessToken = async context => {
+  (0, _types.assertSession)(context);
   const refreshToken = context.refreshToken;
   const client = (0, _oauth.getOAuthClient)(context);
   if (!refreshToken) {
@@ -112,10 +114,14 @@ const refreshAccessToken = async context => {
     if (err) {
       throw err;
     }
+    return {
+      success: false
+    };
   }
 };
 exports.refreshAccessToken = refreshAccessToken;
 const oauthRevokeToken = async context => {
+  (0, _types.assertSession)(context);
   const accessToken = context.accessToken;
   if (!accessToken) {
     throw new Error("No app oauth authentication credentials");
@@ -141,9 +147,13 @@ exports.oauthRevokeToken = oauthRevokeToken;
 const oauthForgetPassword = async ({
   email
 }, context) => {
+  (0, _types.assertSession)(context);
   const shopId = context.shopId;
   const client = (0, _oauth.getOAuthClient)(context);
   try {
+    if (!context.auth.resetPasswordUrl) {
+      throw new Error("Missing password reset URL");
+    }
     const resetUrl = new URL(context.auth.resetPasswordUrl);
     if (!resetUrl.searchParams.has("hash")) {
       resetUrl.searchParams.append("hash", "{hash}");
@@ -170,6 +180,7 @@ const oauthForgetPassword = async ({
 };
 exports.oauthForgetPassword = oauthForgetPassword;
 const updatePasswordByHash = async (passwordHash, context) => {
+  (0, _types.assertSession)(context);
   const shopId = context.shopId;
   const client = (0, _oauth.getOAuthClient)(context);
   try {

package/dist/rpc/methods/session.d.ts

@@ -3,7 +3,7 @@ import type { GuestRequest, LoginRequest, ParamRpcHandler, RegisterRequest, RpcH
 /**
  * Ensure error is a fetch error with one of the status codes
  */
-export declare const convertErrorForRpcCall: (error: any, httpStatuses: Array<number>) => Error;
+export declare const convertErrorForRpcCall: (error: any, httpStatuses: Array<number>) => Error | undefined;
 export declare const oauthLogin: ParamRpcHandler<Optional<LoginRequest, 'shop_id'>, undefined>;
 export declare const oauthRegister: ParamRpcHandler<Optional<RegisterRequest, 'shop_id'>, undefined>;
 export declare const oauthGuestLogin: ParamRpcHandler<Optional<GuestRequest, 'shop_id'>, undefined>;

package/dist/rpc/methods/session.mjs

@@ -1,4 +1,5 @@
 import { decodeJwt } from "jose";
+import { assertSession } from "../../types/index.mjs";
 import { DEFAULT_WITH_LISTING, HttpStatusCode } from "../../constants/index.mjs";
 import { FetchError } from "../../utils/fetch.mjs";
 import { mergeBaskets, mergeWishlists } from "../../utils/user.mjs";
@@ -9,16 +10,16 @@ export const convertErrorForRpcCall = (error, httpStatuses) => {
     return error;
   }
 };
-const saveUserOnSession = async (accessToken, context) => {
-  const user = await fetchUser({ accessToken, callback: "" }, context);
-  context.updateUser(user);
-};
 async function postLogin(context, tokens) {
+  const user = await fetchUser(
+    { accessToken: tokens.access_token, callback: "" },
+    context
+  );
   context.updateTokens({
     accessToken: tokens.access_token,
     refreshToken: tokens.refresh_token
   });
-  await saveUserOnSession(tokens.access_token, context);
+  context.updateUser(user);
   const { customerId } = decodeJwt(tokens.access_token);
   await Promise.all([
     mergeBaskets(
@@ -37,6 +38,7 @@ async function postLogin(context, tokens) {
   await context.createUserBoundSession();
 }
 export const oauthLogin = async (login, context) => {
+  assertSession(context);
   const shopId = context.shopId;
   const client = getOAuthClient(context);
   if (!login.email || !login.password) {
@@ -52,7 +54,8 @@ export const oauthLogin = async (login, context) => {
       HttpStatusCode.INTERNAL_SERVER_ERROR,
       HttpStatusCode.BAD_REQUEST,
       HttpStatusCode.UNAUTHORIZED,
-      HttpStatusCode.NOT_FOUND
+      HttpStatusCode.NOT_FOUND,
+      HttpStatusCode.FORBIDDEN
     ]);
     if (err) {
       throw err;
@@ -60,6 +63,7 @@ export const oauthLogin = async (login, context) => {
   }
 };
 export const oauthRegister = async (register, context) => {
+  assertSession(context);
   const shopId = context.shopId;
   const client = getOAuthClient(context);
   try {
@@ -72,7 +76,8 @@ export const oauthRegister = async (register, context) => {
     const err = convertErrorForRpcCall(error, [
       HttpStatusCode.BAD_REQUEST,
       HttpStatusCode.UNAUTHORIZED,
-      HttpStatusCode.CONFLICT
+      HttpStatusCode.CONFLICT,
+      HttpStatusCode.FORBIDDEN
     ]);
     if (err) {
       throw err;
@@ -80,6 +85,7 @@ export const oauthRegister = async (register, context) => {
   }
 };
 export const oauthGuestLogin = async (guest, context) => {
+  assertSession(context);
   const shopId = context.shopId;
   const client = getOAuthClient(context);
   try {
@@ -92,7 +98,8 @@ export const oauthGuestLogin = async (guest, context) => {
     const err = convertErrorForRpcCall(error, [
       HttpStatusCode.BAD_REQUEST,
       HttpStatusCode.UNAUTHORIZED,
-      HttpStatusCode.CONFLICT
+      HttpStatusCode.CONFLICT,
+      HttpStatusCode.FORBIDDEN
     ]);
     if (err) {
       throw err;
@@ -100,6 +107,7 @@ export const oauthGuestLogin = async (guest, context) => {
   }
 };
 export const refreshAccessToken = async (context) => {
+  assertSession(context);
   const refreshToken = context.refreshToken;
   const client = getOAuthClient(context);
   if (!refreshToken) {
@@ -123,9 +131,11 @@ export const refreshAccessToken = async (context) => {
     if (err) {
       throw err;
     }
+    return { success: false };
   }
 };
 export const oauthRevokeToken = async (context) => {
+  assertSession(context);
   const accessToken = context.accessToken;
   if (!accessToken) {
     throw new Error("No app oauth authentication credentials");
@@ -148,9 +158,13 @@ export const oauthRevokeToken = async (context) => {
   }
 };
 export const oauthForgetPassword = async ({ email }, context) => {
+  assertSession(context);
   const shopId = context.shopId;
   const client = getOAuthClient(context);
   try {
+    if (!context.auth.resetPasswordUrl) {
+      throw new Error("Missing password reset URL");
+    }
     const resetUrl = new URL(context.auth.resetPasswordUrl);
     if (!resetUrl.searchParams.has("hash")) {
       resetUrl.searchParams.append("hash", "{hash}");
@@ -177,6 +191,7 @@ export const oauthForgetPassword = async ({ email }, context) => {
   }
 };
 export const updatePasswordByHash = async (passwordHash, context) => {
+  assertSession(context);
   const shopId = context.shopId;
   const client = getOAuthClient(context);
   try {

package/dist/rpc/methods/user.cjs

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.refreshUser = exports.getUser = exports.fetchUser = void 0;
+var _types = require("../../types/index.cjs");
 var _customer = require("../../api/customer.cjs");
 const getUser = exports.getUser = function getUser2(context) {
   return {
@@ -18,32 +19,28 @@ const fetchUser = exports.fetchUser = async function fetchUser2(payload, context
     shopId
   } = context;
   const client = new _customer.CustomerAPIClient(context);
-  const user = await client.getMe(shopId);
-  return {
-    ...user,
-    authentication: {
-      ...user?.authentication,
-      storefrontAccessToken: accessToken
-    },
-    ...{
-      loginShopId: shopId
-    }
-  };
+  const user = await client.getMe(shopId, accessToken);
+  if (user.authentication) {
+    user.authentication.storefrontAccessToken = accessToken;
+  }
+  user.loginShopId = shopId;
+  return user;
 };
 const refreshUser = exports.refreshUser = async function refreshUser2(context) {
+  (0, _types.assertSession)(context);
   const {
     accessToken,
     shopId
   } = context;
   const client = new _customer.CustomerAPIClient(context);
-  const user = await client.getMe(shopId);
-  if (user?.id) {
+  try {
+    const user = await client.getMe(shopId);
     context.updateUser({
       ...user,
-      authentication: {
-        ...user?.authentication,
+      authentication: user.authentication ? {
+        ...user.authentication,
         storefrontAccessToken: accessToken
-      },
+      } : void 0,
       ...{
         loginShopId: shopId
       }
@@ -51,9 +48,10 @@ const refreshUser = exports.refreshUser = async function refreshUser2(context) {
     return {
       user
     };
+  } catch {
+    await context.destroySession();
+    return {
+      user: void 0
+    };
   }
-  await context.destroySession();
-  return {
-    user: void 0
-  };
 };

package/dist/rpc/methods/user.d.ts

@@ -1,4 +1,4 @@
-import { AuthConfig, RpcHandler, ShopUser } from '../../types';
+import type { AuthConfig, RpcHandler, ShopUser } from '../../types';
 declare const getUser: RpcHandler<{
     user: ShopUser | undefined;
 }>;

package/dist/rpc/methods/user.mjs

@@ -1,3 +1,4 @@
+import { assertSession } from "../../types/index.mjs";
 import { CustomerAPIClient } from "../../api/customer.mjs";
 const getUser = function getUser2(context) {
   return {
@@ -8,32 +9,31 @@ const fetchUser = async function fetchUser2(payload, context) {
   const { accessToken } = payload;
   const { shopId } = context;
   const client = new CustomerAPIClient(context);
-  const user = await client.getMe(shopId);
-  return {
-    ...user,
-    authentication: {
-      ...user?.authentication,
-      storefrontAccessToken: accessToken
-    },
-    ...{ loginShopId: shopId }
-  };
+  const user = await client.getMe(shopId, accessToken);
+  if (user.authentication) {
+    user.authentication.storefrontAccessToken = accessToken;
+  }
+  user.loginShopId = shopId;
+  return user;
 };
 const refreshUser = async function refreshUser2(context) {
+  assertSession(context);
   const { accessToken, shopId } = context;
   const client = new CustomerAPIClient(context);
-  const user = await client.getMe(shopId);
-  if (user?.id) {
+  try {
+    const user = await client.getMe(shopId);
     context.updateUser({
       ...user,
-      authentication: {
-        ...user?.authentication,
+      authentication: user.authentication ? {
+        ...user.authentication,
         storefrontAccessToken: accessToken
-      },
+      } : void 0,
       ...{ loginShopId: shopId }
     });
     return { user };
+  } catch {
+    await context.destroySession();
+    return { user: void 0 };
   }
-  await context.destroySession();
-  return { user: void 0 };
 };
 export { getUser, fetchUser, refreshUser };

package/dist/rpc/methods/wishlist.cjs

@@ -4,11 +4,13 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.removeItemFromWishlist = exports.getWishlist = exports.clearWishlist = exports.addItemToWishlist = void 0;
+var _types = require("../../types/index.cjs");
 var _constants = require("../../constants/index.cjs");
 function getWithParams(params, context) {
   return params.with ?? context.withParams?.basket ?? _constants.MIN_WITH_PARAMS_WISHLIST;
 }
 const addItemToWishlist = exports.addItemToWishlist = async function addItemToWishlist2(options, context) {
+  (0, _types.assertSession)(context);
   const {
     bapiClient,
     campaignKey,
@@ -48,20 +50,23 @@ const addItemToWishlist = exports.addItemToWishlist = async function addItemToWi
   }
 };
 const getWishlist = exports.getWishlist = async function getWishlist2(options, context) {
+  (0, _types.assertSession)(context);
   const {
     bapiClient,
-    campaignKey
+    campaignKey,
+    wishlistKey
   } = context;
   const resolvedWith = getWithParams({
     with: options
   }, context);
-  return await bapiClient.wishlist.get(context.wishlistKey, {
+  return await bapiClient.wishlist.get(wishlistKey, {
     with: resolvedWith,
     campaignKey,
     pricePromotionKey: resolvedWith?.pricePromotionKey ?? ""
   });
 };
 const removeItemFromWishlist = exports.removeItemFromWishlist = async function removeItemFromWishlist2(options, context) {
+  (0, _types.assertSession)(context);
   const {
     bapiClient,
     campaignKey,

package/dist/rpc/methods/wishlist.d.ts

@@ -1,5 +1,5 @@
 import type { WishlistResponseData } from '@aboutyou/backbone/endpoints/wishlist/getWishlist';
-import { RpcHandler, ParamRpcHandler, WishlistWithOptions } from '../../types';
+import type { RpcHandler, ParamRpcHandler, WishlistWithOptions } from '../../types';
 export declare const addItemToWishlist: ParamRpcHandler<{
     variantId?: number;
     productId?: number;

package/dist/rpc/methods/wishlist.mjs

@@ -1,8 +1,10 @@
+import { assertSession } from "../../types/index.mjs";
 import { MIN_WITH_PARAMS_WISHLIST } from "../../constants/index.mjs";
 function getWithParams(params, context) {
   return params.with ?? context.withParams?.basket ?? MIN_WITH_PARAMS_WISHLIST;
 }
 export const addItemToWishlist = async function addItemToWishlist2(options, context) {
+  assertSession(context);
   const { bapiClient, campaignKey, wishlistKey } = context;
   const { productId, variantId } = options;
   const resolvedWith = getWithParams(options, context);
@@ -28,15 +30,17 @@ export const addItemToWishlist = async function addItemToWishlist2(options, cont
   }
 };
 export const getWishlist = async function getWishlist2(options, context) {
-  const { bapiClient, campaignKey } = context;
+  assertSession(context);
+  const { bapiClient, campaignKey, wishlistKey } = context;
   const resolvedWith = getWithParams({ with: options }, context);
-  return await bapiClient.wishlist.get(context.wishlistKey, {
+  return await bapiClient.wishlist.get(wishlistKey, {
     with: resolvedWith,
     campaignKey,
     pricePromotionKey: resolvedWith?.pricePromotionKey ?? ""
   });
 };
 export const removeItemFromWishlist = async function removeItemFromWishlist2(options, context) {
+  assertSession(context);
   const { bapiClient, campaignKey, wishlistKey } = context;
   const resolvedWith = getWithParams(options, context);
   return await bapiClient.wishlist.deleteItem(wishlistKey, options.itemKey, {

package/dist/types/api/context.cjs

@@ -1 +1,11 @@
-"use strict";
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.assertSession = assertSession;
+function assertSession(context) {
+  if (!context.sessionId) {
+    throw new Error("No session for RpcContext available");
+  }
+}

package/dist/types/api/context.d.ts

@@ -1,7 +1,7 @@
 import type { BapiClient } from '@aboutyou/backbone';
-import { Log } from '../../utils';
-import { CachedType } from '../../cache/cached';
-import { ShopUser } from '../user';
+import type { Log } from '../../utils';
+import type { CachedType } from '../../cache/cached';
+import type { ShopUser } from '../user';
 import type { WishlistWithOptions, BasketWithOptions, ProductWith, VariantWith, SearchWith, CategoryWith, ProductCategoryWith } from '../';
 import { OAuthTokens, IDPConfig } from './auth';
 export type WithParams = Partial<{
@@ -16,9 +16,29 @@ export type WithParams = Partial<{
 export interface RuntimeConfiguration {
     [key: string]: any;
 }
-export interface RpcContext {
+interface ContextWithSession {
     wishlistKey: string;
     basketKey: string;
+    sessionId: string;
+    user?: ShopUser;
+    accessToken?: string;
+    destroySession: () => Promise<void>;
+    createUserBoundSession: () => Promise<void>;
+    updateUser: (user: ShopUser) => void;
+    updateTokens: (tokens: OAuthTokens) => void;
+}
+interface ContextNoSession {
+    wishlistKey: undefined;
+    basketKey: undefined;
+    sessionId: undefined;
+    user: undefined;
+    accessToken: undefined;
+    destroySession: undefined;
+    createUserBoundSession: undefined;
+    updateUser: undefined;
+    updateTokens: undefined;
+}
+export type RpcContext = {
     locale: string;
     checkout: {
         url: string;
@@ -33,26 +53,19 @@ export interface RpcContext {
     };
     bapiClient: BapiClient;
     cached: CachedType;
-    user?: ShopUser;
-    accessToken?: string;
     refreshToken?: string;
     isCmsPreview: boolean;
     shopId: number;
     domain: string;
     withParams?: WithParams;
     campaignKey?: string;
-    updateUser: (user: ShopUser) => void;
     destroySessionsForUserId: (userId: number, sessionsToKeep?: string[]) => Promise<void>;
-    updateTokens: (tokens: OAuthTokens) => void;
-    destroySession: () => Promise<void>;
     generateBasketKeyForUserId: (userId: string) => Promise<string>;
     generateWishlistKeyForUserId: (userId: string) => Promise<string>;
-    createUserBoundSession: () => Promise<void>;
     storeCampaignKeyword?: string;
     routerBasePath?: string;
     ip?: string | undefined;
     log: Log;
-    sessionId: string;
     auth: {
         resetPasswordUrl?: string;
     };
@@ -63,4 +76,9 @@ export interface RpcContext {
     };
     runtimeConfiguration: RuntimeConfiguration;
     idp?: IDPConfig;
-}
+} & (ContextNoSession | ContextWithSession);
+export type RpcContextWithSession = RpcContext & {
+    sessionId: string;
+};
+export declare function assertSession(context: RpcContext): asserts context is RpcContextWithSession;
+export {};

package/dist/types/api/context.mjs

@@ -0,0 +1,5 @@
+export function assertSession(context) {
+  if (!context.sessionId) {
+    throw new Error("No session for RpcContext available");
+  }
+}

package/dist/utils/keys.d.ts

@@ -7,18 +7,18 @@ export declare const generateKey: ({ keyTemplate, hashAlgorithm, shopId, userId,
     shopId: string;
     userId: string;
     log?: Log | undefined;
-}) => Promise<any>;
+}) => Promise<string>;
 export declare const generateWishlistKey: ({ keyTemplate, hashAlgorithm, shopId, userId, log, }: {
     keyTemplate: string;
     hashAlgorithm: HashAlgorithm;
     shopId: string;
     userId: string;
     log?: Log | undefined;
-}) => Promise<any>;
+}) => Promise<string>;
 export declare const generateBasketKey: ({ keyTemplate, hashAlgorithm, shopId, userId, log, }: {
     keyTemplate: string;
     hashAlgorithm: HashAlgorithm;
     shopId: string;
     userId: string;
     log?: Log | undefined;
-}) => Promise<any>;
+}) => Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/storefront-core",
-  "version": "7.37.0",
+  "version": "7.38.1",
   "description": "Collection of essential utilities to work with the Storefront API",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",
@@ -59,22 +59,22 @@
     "test:ci": "vitest --run --passWithNoTests --coverage --reporter=default --reporter=junit"
   },
   "dependencies": {
-    "@aboutyou/backbone": "16.0.2",
+    "@aboutyou/backbone": "16.1.0",
     "crypto-js": "4.2.0",
-    "jose": "^5.2.0",
-    "radash": "^11.0.0",
-    "slugify": "^1.6.0",
-    "ufo": "^1.1.1",
-    "uncrypto": "^0.1.3",
-    "utility-types": "^3.10.0"
+    "jose": "5.2.0",
+    "radash": "11.0.0",
+    "slugify": "1.6.6",
+    "ufo": "1.3.2",
+    "uncrypto": "0.1.3",
+    "utility-types": "3.11.0"
   },
   "devDependencies": {
     "@scayle/eslint-config-storefront": "3.2.6",
     "@scayle/prettier-config-storefront": "2.0.2",
-    "@types/crypto-js": "4.2.1",
-    "@types/node": "20.11.4",
+    "@types/crypto-js": "4.2.2",
+    "@types/node": "20.11.5",
     "@types/webpack-env": "1.18.4",
-    "@vitest/coverage-v8": "1.2.0",
+    "@vitest/coverage-v8": "1.2.1",
     "eslint": "8.56.0",
     "eslint-formatter-gitlab": "5.1.0",
     "prettier": "3.0.0",
@@ -84,7 +84,7 @@
     "typescript": "5.3.3",
     "unbuild": "2.0.0",
     "unstorage": "1.10.1",
-    "vitest": "1.2.0"
+    "vitest": "1.2.1"
   },
   "optionalDependencies": {
     "redis": "4"