@scayle/storefront-core 7.65.6 → 7.65.8

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @scayle/storefront-core
 
+## 7.65.8
+
+### Patch Changes
+
+- Fixed an issue with handling the deprecated MD5 hash support, e.g. used for generating a user-specific basket hash, resulting in a potential application crash
+
+## 7.65.7
+
+### Patch Changes
+
+- Delete `refreshToken` if it fails to refresh the access token
+
 ## 7.65.6
 
 ### Patch Changes

package/dist/api/customer.cjs

@@ -34,18 +34,29 @@ class CustomerAPIClient {
     if ((response.status === _httpStatus.HttpStatusCode.UNAUTHORIZED && response.headers.get("WWW-Authenticate")?.includes("invalid_token") || response.status === _httpStatus.HttpStatusCode.FORBIDDEN) && this.context.accessToken && this.context.refreshToken) {
       if (retry) {
         const client = (0, _oauth.getOAuthClient)(this.context);
-        const tokens = await client.refreshToken({
-          grant_type: "refresh_token",
-          refresh_token: this.context.refreshToken
-        });
-        this.context.updateTokens({
-          accessToken: tokens?.access_token,
-          refreshToken: tokens?.refresh_token
-        });
+        try {
+          const tokens = await client.refreshToken({
+            grant_type: "refresh_token",
+            refresh_token: this.context.refreshToken
+          });
+          this.context.updateTokens({
+            accessToken: tokens?.access_token,
+            refreshToken: tokens?.refresh_token
+          });
+        } catch (e) {
+          if (e instanceof _fetch.FetchError && e.response.status === _httpStatus.HttpStatusCode.UNAUTHORIZED) {
+            this.context.log.debug("Failed to refresh Checkout Token due to invalid refresh token. Deleting session");
+            await this.context.destroySession();
+          } else {
+            this.context.log.debug("Failed to refresh Checkout Token for unknown reason.");
+          }
+          throw new _fetch.FetchError(response);
+        }
         return await this.sendRequest(request, false);
+      } else {
+        this.context.log.debug("Invalid Checkout Token. Deleting session");
+        await this.context.destroySession();
       }
-      this.context.log.debug("Invalid Checkout Token. Deleting session");
-      await this.context.destroySession();
     }
     throw new _fetch.FetchError(response);
   }

package/dist/api/customer.d.ts

@@ -37,7 +37,7 @@ interface PasswordUpdate {
 export declare class CustomerAPIClient {
     baseURL: string;
     context: RpcContext;
-    private additionalHeaders;
+    additionalHeaders: HeadersInit | undefined;
     constructor(context: RpcContext);
     get headers(): HeadersInit;
     sendRequest<BodyType>(request: () => Promise<Response>, retry?: boolean): Promise<BodyType>;

package/dist/api/customer.mjs

@@ -28,18 +28,33 @@ export class CustomerAPIClient {
     ) || response.status === HttpStatusCode.FORBIDDEN) && this.context.accessToken && this.context.refreshToken) {
       if (retry) {
         const client = getOAuthClient(this.context);
-        const tokens = await client.refreshToken({
-          grant_type: "refresh_token",
-          refresh_token: this.context.refreshToken
-        });
-        this.context.updateTokens({
-          accessToken: tokens?.access_token,
-          refreshToken: tokens?.refresh_token
-        });
+        try {
+          const tokens = await client.refreshToken({
+            grant_type: "refresh_token",
+            refresh_token: this.context.refreshToken
+          });
+          this.context.updateTokens({
+            accessToken: tokens?.access_token,
+            refreshToken: tokens?.refresh_token
+          });
+        } catch (e) {
+          if (e instanceof FetchError && e.response.status === HttpStatusCode.UNAUTHORIZED) {
+            this.context.log.debug(
+              "Failed to refresh Checkout Token due to invalid refresh token. Deleting session"
+            );
+            await this.context.destroySession();
+          } else {
+            this.context.log.debug(
+              "Failed to refresh Checkout Token for unknown reason."
+            );
+          }
+          throw new FetchError(response);
+        }
         return await this.sendRequest(request, false);
+      } else {
+        this.context.log.debug("Invalid Checkout Token. Deleting session");
+        await this.context.destroySession();
       }
-      this.context.log.debug("Invalid Checkout Token. Deleting session");
-      await this.context.destroySession();
     }
     throw new FetchError(response);
   }

package/dist/rpc/methods/checkout/checkout.cjs

@@ -37,7 +37,7 @@ const getCheckoutToken = exports.getCheckoutToken = async function getCheckoutTo
     carrier,
     basketId: context.basketKey,
     campaignKey: context.campaignKey
-  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.65.6"}`).setProtectedHeader({
+  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.65.8"}`).setProtectedHeader({
     alg: "HS256",
     typ: "JWT"
   }).sign(secret);

package/dist/rpc/methods/checkout/checkout.mjs

@@ -35,7 +35,7 @@ export const getCheckoutToken = async function getCheckoutToken2(jwtPayload = {}
     carrier,
     basketId: context.basketKey,
     campaignKey: context.campaignKey
-  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.65.6"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
+  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"7.65.8"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
   return {
     accessToken: refreshedAccessToken,
     checkoutJwt

package/dist/rpc/methods/session.cjs

@@ -143,6 +143,12 @@ const refreshAccessToken = async context => {
     };
   } catch (error) {
     const res = convertErrorForRpcCall(error, [_constants.HttpStatusCode.BAD_REQUEST, _constants.HttpStatusCode.UNAUTHORIZED]);
+    if (res && res.status === _constants.HttpStatusCode.UNAUTHORIZED) {
+      context.log.debug("Failed to refresh Checkout Token due to invalid refresh token. Deleting session");
+      await context.destroySession();
+    } else {
+      context.log.debug("Failed to refresh Checkout Token for unknown reason.");
+    }
     if (res) {
       return res;
     }

package/dist/rpc/methods/session.mjs

@@ -190,6 +190,16 @@ export const refreshAccessToken = async (context) => {
       HttpStatusCode.BAD_REQUEST,
       HttpStatusCode.UNAUTHORIZED
     ]);
+    if (res && res.status === HttpStatusCode.UNAUTHORIZED) {
+      context.log.debug(
+        "Failed to refresh Checkout Token due to invalid refresh token. Deleting session"
+      );
+      await context.destroySession();
+    } else {
+      context.log.debug(
+        "Failed to refresh Checkout Token for unknown reason."
+      );
+    }
     if (res) {
       return res;
     }

package/dist/rpc/methods/user.cjs

@@ -9,6 +9,7 @@ var _customer = require("../../api/customer.cjs");
 var _oauth = require("../../api/oauth.cjs");
 var _constants = require("../../constants/index.cjs");
 var _errors = require("../../errors/index.cjs");
+var _fetch = require("../../utils/fetch.cjs");
 const getUser = exports.getUser = function getUser2(context) {
   const {
     user,
@@ -84,18 +85,31 @@ const getAccessToken = exports.getAccessToken = async function getAccessToken2({
       return new _errors.ErrorResponse(_constants.HttpStatusCode.UNAUTHORIZED, _constants.HttpStatusMessage.UNAUTHORIZED, "No refresh token present");
     }
     const client = (0, _oauth.getOAuthClient)(context);
-    const tokens = await client.refreshToken({
-      grant_type: "refresh_token",
-      refresh_token: context.refreshToken
-    });
-    context.updateTokens({
-      accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token
-    });
-    const user = await fetchUser({
-      accessToken: tokens.access_token
-    }, context);
-    context.updateUser(user);
+    try {
+      const tokens = await client.refreshToken({
+        grant_type: "refresh_token",
+        refresh_token: context.refreshToken
+      });
+      context.updateTokens({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token
+      });
+      try {
+        const user = await fetchUser({
+          accessToken: tokens.access_token
+        }, context);
+        context.updateUser(user);
+      } catch {
+        context.log.debug("Failed to update user");
+      }
+    } catch (e) {
+      if (e instanceof _fetch.FetchError && e.response.status === _constants.HttpStatusCode.UNAUTHORIZED) {
+        context.log.debug("Failed to refresh Checkout Token due to invalid refresh token. Deleting session");
+        await context.destroySession();
+      } else {
+        context.log.debug("Failed to refresh Checkout Token for unknown reason.");
+      }
+    }
   }
   return context.accessToken;
 };

package/dist/rpc/methods/user.mjs

@@ -3,6 +3,7 @@ import { CustomerAPIClient } from "../../api/customer.mjs";
 import { getOAuthClient } from "../../api/oauth.mjs";
 import { HttpStatusCode, HttpStatusMessage } from "../../constants/index.mjs";
 import { ErrorResponse } from "../../errors/index.mjs";
+import { FetchError } from "../../utils/fetch.mjs";
 const getUser = function getUser2(context) {
   const { user, accessToken, shopId } = context;
   if (user) {
@@ -74,19 +75,36 @@ const getAccessToken = async function getAccessToken2({ forceTokenRefresh = fals
       );
     }
     const client = getOAuthClient(context);
-    const tokens = await client.refreshToken({
-      grant_type: "refresh_token",
-      refresh_token: context.refreshToken
-    });
-    context.updateTokens({
-      accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token
-    });
-    const user = await fetchUser(
-      { accessToken: tokens.access_token },
-      context
-    );
-    context.updateUser(user);
+    try {
+      const tokens = await client.refreshToken({
+        grant_type: "refresh_token",
+        refresh_token: context.refreshToken
+      });
+      context.updateTokens({
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token
+      });
+      try {
+        const user = await fetchUser(
+          { accessToken: tokens.access_token },
+          context
+        );
+        context.updateUser(user);
+      } catch {
+        context.log.debug("Failed to update user");
+      }
+    } catch (e) {
+      if (e instanceof FetchError && e.response.status === HttpStatusCode.UNAUTHORIZED) {
+        context.log.debug(
+          "Failed to refresh Checkout Token due to invalid refresh token. Deleting session"
+        );
+        await context.destroySession();
+      } else {
+        context.log.debug(
+          "Failed to refresh Checkout Token for unknown reason."
+        );
+      }
+    }
   }
   return context.accessToken;
 };

package/dist/utils/hash.cjs

@@ -5,12 +5,15 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.verifyOrderSuccessToken = exports.sha256 = exports.md5 = exports.hmac = exports.encodeBase64 = exports.decodeBase64 = exports.buildSignature = exports.buildHashPayload = void 0;
 var _uncrypto = require("uncrypto");
+function stringToBoolean(value, defaultValue = false) {
+  return value ? value.toLowerCase() === "true" : defaultValue;
+}
 const md5 = async value => {
-  if (!process.env.SFC_OMIT_MD5) {
-    const md5EncryptImport = await Promise.resolve().then(() => require("crypto-js/md5"));
-    const hexImport = await Promise.resolve().then(() => require("crypto-js/enc-hex"));
-    const md5Encrypt = md5EncryptImport.default && typeof md5EncryptImport.default === "function" ? md5EncryptImport.default : md5EncryptImport;
-    const hex = hexImport.default && typeof hexImport.default === "function" ? hexImport.default : hexImport;
+  if (!stringToBoolean(process.env.SFC_OMIT_MD5)) {
+    const md5EncryptImport = await Promise.resolve().then(() => require("crypto-js/md5.js"));
+    const hexImport = await Promise.resolve().then(() => require("crypto-js/enc-hex.js"));
+    const md5Encrypt = md5EncryptImport.default && (typeof md5EncryptImport.default === "function" || typeof md5EncryptImport.default === "object") ? md5EncryptImport.default : md5EncryptImport;
+    const hex = hexImport.default && (typeof hexImport.default === "function" || typeof hexImport.default === "object") ? hexImport.default : hexImport;
     return hex.stringify(md5Encrypt(value));
   } else {
     throw Error("SFC was built without support for MD5");

package/dist/utils/hash.mjs

@@ -1,10 +1,13 @@
 import { subtle } from "uncrypto";
+function stringToBoolean(value, defaultValue = false) {
+  return value ? value.toLowerCase() === "true" : defaultValue;
+}
 export const md5 = async (value) => {
-  if (!process.env.SFC_OMIT_MD5) {
-    const md5EncryptImport = await import("crypto-js/md5");
-    const hexImport = await import("crypto-js/enc-hex");
-    const md5Encrypt = md5EncryptImport.default && typeof md5EncryptImport.default === "function" ? md5EncryptImport.default : md5EncryptImport;
-    const hex = hexImport.default && typeof hexImport.default === "function" ? hexImport.default : hexImport;
+  if (!stringToBoolean(process.env.SFC_OMIT_MD5)) {
+    const md5EncryptImport = await import("crypto-js/md5.js");
+    const hexImport = await import("crypto-js/enc-hex.js");
+    const md5Encrypt = md5EncryptImport.default && (typeof md5EncryptImport.default === "function" || typeof md5EncryptImport.default === "object") ? md5EncryptImport.default : md5EncryptImport;
+    const hex = hexImport.default && (typeof hexImport.default === "function" || typeof hexImport.default === "object") ? hexImport.default : hexImport;
     return hex.stringify(md5Encrypt(value));
   } else {
     throw Error("SFC was built without support for MD5");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/storefront-core",
-  "version": "7.65.6",
+  "version": "7.65.8",
   "description": "Collection of essential utilities to work with the Storefront API",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",