@scayle/storefront-core 8.19.0 → 8.20.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @scayle/storefront-core
 
+## 8.20.0
+
+### Minor Changes
+
+- Include additional client information to Auth API requests to improve security.
+- Add `originalIp` to the RPCContext which represents the IP address of the request without considering the `x-forwarded-for` header.
+
+### Patch Changes
+
+- **\[Basket\]** Pass `campaignKey` to SAPI when updating an basket item using the `updateBasketItem` RPC.
+
+## 8.19.1
+
+### Patch Changes
+
+- Fix `getCategoriesByPath` RPC to return 404 for non-existing categories.
+
 ## 8.19.0
 
 ## 8.18.0

package/dist/api/oauth.mjs

@@ -25,11 +25,32 @@ export function getOAuthClient(context) {
   }
   const { clientId, clientSecret, apiHost } = context.oauth;
   const accessHeader = context.internalAccessHeader;
+  const requestHeaders = context.headers;
+  const host = requestHeaders.get("host");
+  const userAgent = requestHeaders.get("user-agent");
+  const contentType = requestHeaders.get("content-type");
+  const ip = context.originalIp;
+  const additionalHeaders = {};
+  if (ip) {
+    additionalHeaders["x-original-client-ip"] = ip;
+  }
+  if (userAgent) {
+    additionalHeaders["x-original-user-agent"] = userAgent;
+  }
+  if (host) {
+    additionalHeaders["x-original-host"] = host;
+  }
+  if (contentType) {
+    additionalHeaders["x-original-content-type"] = contentType;
+  }
+  if (accessHeader) {
+    additionalHeaders["x-internal-access"] = accessHeader;
+  }
   return new OAuthClient({
     clientId,
     clientSecret,
     apiHost,
-    additionalHeaders: accessHeader ? { "x-internal-access": accessHeader } : {}
+    additionalHeaders
   }, context.log);
 }
 export class OAuthClient {

package/dist/rpc/methods/basket/basket.mjs

@@ -241,11 +241,12 @@ export const updateBasketItem = async function updateBasketItem2({ basketItemKey
     context
   );
   const { quantity, ...updateParams } = update;
+  const campaignKey = update.campaignKey ?? await context.callRpc?.("getCampaignKey");
   const result = await sapiClient.basket.updateItem(
     basketKey,
     basketItemKey,
     quantity,
-    { ...updateParams, with: resolvedWith }
+    { ...updateParams, campaignKey, with: resolvedWith }
   );
   if (result.type === "success") {
     return { basket: result.basket };

package/dist/rpc/methods/categories.mjs

@@ -29,12 +29,18 @@ export const getCategoriesByPath = async function getCategoriesByPath2({ path, c
     return getRootCategories({ children, includeHidden, properties }, context);
   }
   const sanitizedPath = splitAndRemoveEmpty(path);
-  const result = await cached(sapiClient.categories.getByPath, {
-    cacheKeyPrefix: `getByPath-categories-${sanitizedPath}`
-  })(sanitizedPath, {
+  const result = await cached(
+    mapSAPIFetchErrorToResponse(sapiClient.categories.getByPath),
+    {
+      cacheKeyPrefix: `getByPath-categories-${sanitizedPath}`
+    }
+  )(sanitizedPath, {
     with: { children, properties },
     includeHidden
   });
+  if (result instanceof Response) {
+    return result;
+  }
   const rootPath = await Promise.all(
     (result.rootlineIds || []).map((id) => {
       return cached(sapiClient.categories.getById, {

package/dist/rpc/methods/checkout/checkout.mjs

@@ -36,7 +36,7 @@ export const getCheckoutToken = async function getCheckoutToken2(jwtPayload = {}
     carrier,
     basketId: context.basketKey,
     campaignKey
-  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"8.19.0"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
+  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"8.20.0"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
   return {
     accessToken: refreshedAccessToken,
     checkoutJwt

package/dist/types/api/context.d.ts

@@ -150,6 +150,7 @@ export type RpcContext = {
     generateWishlistKeyForUserId: (userId: string) => Promise<string>;
     routerBasePath?: string;
     ip?: string | undefined;
+    originalIp?: string;
     log: Log;
     auth: {
         resetPasswordUrl?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/storefront-core",
-  "version": "8.19.0",
+  "version": "8.20.0",
   "description": "Collection of essential utilities to work with the Storefront API",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",