@scayle/storefront-core 8.53.3 → 8.54.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @scayle/storefront-core
 
+## 8.54.0
+
+### Minor Changes
+
+- The `getCheckoutToken` RPC was updated to refresh the access token only when it was about to expire within 30 minutes. This change reduced unnecessary access token generation and minimized the risk of using outdated or revoked tokens.
+
+### Patch Changes
+
+**Dependencies**
+
+- Updated dependency to @scayle/storefront-api@18.18.1
+- Updated dependency to @scayle/unstorage-scayle-kv-driver@2.0.9
+
 ## 8.53.3
 
 ## 8.53.2

package/dist/rpc/methods/checkout/checkout.d.ts

@@ -34,7 +34,7 @@ interface CheckoutJwtPayload {
     carrier?: string;
 }
 /**
- * Generates a checkout token, which includes a refreshed access token and
+ * Generates a checkout token, which includes a access token token that is valid for at least 30 minutes and
  * a JWT containing checkout information.
  *
  * The generated JWT is signed with a secret and includes information from the

package/dist/rpc/methods/checkout/checkout.mjs

@@ -1,9 +1,10 @@
-import { SignJWT } from "jose";
+import { SignJWT, decodeJwt } from "jose";
 import { hasSession } from "../../../types/index.mjs";
 import { ErrorResponse } from "../../../errors/index.mjs";
 import { HttpStatusCode, HttpStatusMessage } from "../../../constants/index.mjs";
 import { getAccessToken } from "../user.mjs";
 import { defineRpcHandler } from "../../../utils/rpc.mjs";
+const ACCESS_TOKEN_REFRESH_THRESHOLD_IN_MILLISECONDS = 30 * 60 * 1e3;
 export const getCheckoutToken = defineRpcHandler(async (jwtPayload = {}, context) => {
   if (!hasSession(context)) {
     return new ErrorResponse(
@@ -14,8 +15,10 @@ export const getCheckoutToken = defineRpcHandler(async (jwtPayload = {}, context
   }
   let refreshedAccessToken;
   if (context.accessToken) {
+    const accessTokenPayload = decodeJwt(context.accessToken);
+    const shouldRefresh = !!accessTokenPayload.exp && accessTokenPayload.exp * 1e3 - Date.now() <= ACCESS_TOKEN_REFRESH_THRESHOLD_IN_MILLISECONDS;
     refreshedAccessToken = await getAccessToken(
-      { forceTokenRefresh: true },
+      { forceTokenRefresh: shouldRefresh },
       context
     );
     if (refreshedAccessToken instanceof Response) {
@@ -37,7 +40,7 @@ export const getCheckoutToken = defineRpcHandler(async (jwtPayload = {}, context
       ...customData,
       ...orderCustomData
     }
-  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"8.53.3"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
+  }).setIssuedAt(now).setNotBefore(now).setExpirationTime("1h").setIssuer(`${"@scayle/storefront-core"}@${"8.54.0"}`).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secret);
   return {
     accessToken: refreshedAccessToken,
     checkoutJwt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/storefront-core",
-  "version": "8.53.3",
+  "version": "8.54.0",
   "description": "Collection of essential utilities to work with the Storefront API",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",
@@ -48,8 +48,8 @@
     "ufo": "^1.5.3",
     "uncrypto": "^0.1.3",
     "utility-types": "^3.11.0",
-    "@scayle/storefront-api": "18.18.1",
-    "@scayle/unstorage-scayle-kv-driver": "2.0.9"
+    "@scayle/unstorage-scayle-kv-driver": "2.0.9",
+    "@scayle/storefront-api": "18.18.1"
   },
   "devDependencies": {
     "@types/crypto-js": "4.2.2",
@@ -66,8 +66,8 @@
     "unbuild": "3.6.1",
     "unstorage": "1.17.3",
     "vitest": "4.0.14",
-    "@scayle/eslint-config-storefront": "4.7.14",
-    "@scayle/vitest-config-storefront": "1.0.0"
+    "@scayle/vitest-config-storefront": "1.0.0",
+    "@scayle/eslint-config-storefront": "4.7.15"
   },
   "volta": {
     "node": "22.21.1"