@vtex/api 6.50.0-beta → 7.0.0

package/lib/service/worker/runtime/graphql/schema/schemaDirectives/Auth.d.ts

@@ -3,4 +3,4 @@ import { SchemaDirectiveVisitor } from 'graphql-tools';
 export declare class Auth extends SchemaDirectiveVisitor {
     visitFieldDefinition(field: GraphQLField<any, any>): void;
 }
-export declare const authDirectiveTypeDefs = "\nenum Scope {\n  PUBLIC\n  PRIVATE\n}\n\ndirective @auth(\n  scope: Scope\n  productCode: String\n  resourceCode: String\n) on FIELD_DEFINITION\n";
+export declare const authDirectiveTypeDefs = "\ndirective @auth(\n  productCode: String\n  resourceCode: String\n) on FIELD_DEFINITION\n";

package/lib/service/worker/runtime/graphql/schema/schemaDirectives/Auth.js

@@ -8,11 +8,6 @@ const apollo_server_errors_1 = require("apollo-server-errors");
 const axios_1 = __importDefault(require("axios"));
 const graphql_1 = require("graphql");
 const graphql_tools_1 = require("graphql-tools");
-var Scope;
-(function (Scope) {
-    Scope["PUBLIC"] = "PUBLIC";
-    Scope["PRIVATE"] = "PRIVATE";
-})(Scope || (Scope = {}));
 async function parseIdToken(authToken, vtexIdToken) {
     const url = `vtexid.vtex.com.br/api/vtexid/pub/authenticated/user?authToken=${vtexIdToken}`;
     const req = await axios_1.default.request({
@@ -56,7 +51,7 @@ async function auth(ctx, authArgs) {
 }
 function parseArgs(authArgs) {
     if (!authArgs.productCode || !authArgs.resourceCode) {
-        throw new apollo_server_errors_1.UserInputError('Invalid auth schema directive args. Usage: @auth(scope: Scope, productCode: String, resourceCode: String).');
+        throw new apollo_server_errors_1.UserInputError('Invalid auth schema directive args. Usage: @auth(productCode: String, resourceCode: String).');
     }
     return authArgs;
 }
@@ -65,22 +60,14 @@ class Auth extends graphql_tools_1.SchemaDirectiveVisitor {
         const { resolve = graphql_1.defaultFieldResolver } = field;
         field.resolve = async (root, args, ctx, info) => {
             const authArgs = parseArgs(this.args);
-            if (!authArgs.scope || authArgs.scope == Scope.PRIVATE) {
-                await auth(ctx, authArgs);
-            }
+            await auth(ctx, authArgs);
             return resolve(root, args, ctx, info);
         };
     }
 }
 exports.Auth = Auth;
 exports.authDirectiveTypeDefs = `
-enum Scope {
-  PUBLIC
-  PRIVATE
-}
-
 directive @auth(
-  scope: Scope
   productCode: String
   resourceCode: String
 ) on FIELD_DEFINITION

package/lib/service/worker/runtime/graphql/schema/schemaDirectives/index.d.ts

@@ -2,7 +2,6 @@ import { Auth } from './Auth';
 import { CacheControl } from './CacheControl';
 import { Deprecated } from './Deprecated';
 import { Metric } from './Metric';
-import { Public } from './Public';
 import { SanitizeDirective } from './Sanitize';
 import { SettingsDirective } from './Settings';
 import { SmartCacheDirective } from './SmartCacheDirective';
@@ -19,6 +18,5 @@ export declare const nativeSchemaDirectives: {
     smartcache: typeof SmartCacheDirective;
     translatableV2: typeof TranslatableV2;
     translateTo: typeof TranslateTo;
-    public: typeof Public;
 };
 export declare const nativeSchemaDirectivesTypeDefs: string;

package/lib/service/worker/runtime/graphql/schema/schemaDirectives/index.js

@@ -5,7 +5,6 @@ const Auth_1 = require("./Auth");
 const CacheControl_1 = require("./CacheControl");
 const Deprecated_1 = require("./Deprecated");
 const Metric_1 = require("./Metric");
-const Public_1 = require("./Public");
 const Sanitize_1 = require("./Sanitize");
 const Settings_1 = require("./Settings");
 const SmartCacheDirective_1 = require("./SmartCacheDirective");
@@ -24,7 +23,6 @@ exports.nativeSchemaDirectives = {
     smartcache: SmartCacheDirective_1.SmartCacheDirective,
     translatableV2: TranslatableV2_1.TranslatableV2,
     translateTo: TranslateTo_1.TranslateTo,
-    public: Public_1.Public
 };
 exports.nativeSchemaDirectivesTypeDefs = [
     Auth_1.authDirectiveTypeDefs,
@@ -36,5 +34,4 @@ exports.nativeSchemaDirectivesTypeDefs = [
     SmartCacheDirective_1.smartCacheDirectiveTypeDefs,
     TranslatableV2_1.translatableV2DirectiveTypeDefs,
     TranslateTo_1.translateToDirectiveTypeDefs,
-    Public_1.publicDirectiveTypeDefs
 ].join('\n\n');

package/lib/tracing/utils.d.ts

@@ -3,9 +3,14 @@ export interface TraceInfo {
     traceId?: string;
     isSampled: boolean;
 }
+/**
+ * Headers that are interesting for tracing and debugging purposes
+ */
+export declare const INTERESTING_HEADERS: string[];
 export declare function getTraceInfo(span?: Span): TraceInfo;
 /**
  * Do a shallow copy of a headers object and redacts sensitive information.
+ * Only includes headers that are in the INTERESTING_HEADERS whitelist.
  *
  * @param headersObj The headers object
  * @param resultFieldsPrefix The prefix that will be added to each field on the result object

package/lib/tracing/utils.js

@@ -1,7 +1,53 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cloneAndSanitizeHeaders = exports.getTraceInfo = void 0;
+exports.cloneAndSanitizeHeaders = exports.getTraceInfo = exports.INTERESTING_HEADERS = void 0;
 const node_error_report_1 = require("@vtex/node-error-report");
+/**
+ * Headers that are interesting for tracing and debugging purposes
+ */
+exports.INTERESTING_HEADERS = [
+    // Request/Response Identification & Routing
+    'x-request-id',
+    'x-correlation-id',
+    'x-trace-id',
+    'x-span-id',
+    'x-forwarded-for',
+    'x-real-ip',
+    'host',
+    'referer',
+    // Content & Encoding
+    'content-type',
+    'content-length',
+    'content-encoding',
+    'accept',
+    'accept-encoding',
+    'accept-language',
+    // Caching & Performance
+    'cache-control',
+    'etag',
+    'if-none-match',
+    'expires',
+    'last-modified',
+    // Client Information
+    'user-agent',
+    'x-forwarded-proto',
+    'x-forwarded-host',
+    'x-forwarded-port',
+    // VTEX/E-commerce Specific (x-vtex-* headers are handled automatically)
+    'x-router-cache',
+    'x-powered-by-vtex-cache',
+    'jaeger-debug-id',
+    // API & Service Headers
+    'x-api-version',
+    'x-service-name',
+    'x-timeout',
+    'retry-after',
+    // Security (will be sanitized)
+    'authorization',
+    'cookie',
+];
+// Create the set once for performance
+const INTERESTING_HEADERS_SET = new Set(exports.INTERESTING_HEADERS.map(h => h.toLowerCase()));
 function getTraceInfo(span) {
     var _a, _b;
     const spanContext = span === null || span === void 0 ? void 0 : span.context();
@@ -13,6 +59,7 @@ function getTraceInfo(span) {
 exports.getTraceInfo = getTraceInfo;
 /**
  * Do a shallow copy of a headers object and redacts sensitive information.
+ * Only includes headers that are in the INTERESTING_HEADERS whitelist.
  *
  * @param headersObj The headers object
  * @param resultFieldsPrefix The prefix that will be added to each field on the result object
@@ -21,6 +68,11 @@ const cloneAndSanitizeHeaders = (headersObj, resultFieldsPrefix = '') => {
     const ret = {};
     const entries = Object.entries(headersObj);
     for (const [key, val] of entries) {
+        const lowerKey = key.toLowerCase();
+        // Only include headers that are in our whitelist or start with x-vtex-
+        if (!INTERESTING_HEADERS_SET.has(lowerKey) && !lowerKey.startsWith('x-vtex-')) {
+            continue;
+        }
         // Most of the time val is a string, but there are some cases, for example when we do a axios interceptor,
         // that a header field can contain an object, for example:
         // ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtex/api",
-  "version": "6.50.0-beta",
+  "version": "7.0.0",
   "description": "VTEX I/O API client",
   "main": "lib/index.js",
   "typings": "lib/index.d.ts",
@@ -49,7 +49,7 @@
   "dependencies": {
     "@types/koa": "^2.11.0",
     "@types/koa-compose": "^3.2.3",
-    "@vtex/diagnostics-nodejs": "0.1.0-beta.8",
+    "@vtex/diagnostics-nodejs": "0.1.0-beta.10",
     "@vtex/node-error-report": "^0.0.3",
     "@wry/equality": "^0.1.9",
     "agentkeepalive": "^4.0.2",
@@ -124,27 +124,5 @@
     "typemoq": "^2.1.0",
     "typescript": "^4.4.4",
     "typescript-json-schema": "^0.52.0"
-  },
-  "resolutions": {
-    "@opentelemetry/core": "1.30.1",
-    "@opentelemetry/exporter-metrics-otlp-grpc": "0.57.2",
-    "@opentelemetry/exporter-metrics-otlp-http": "0.57.2",
-    "@opentelemetry/exporter-logs-otlp-grpc": "0.57.2",
-    "@opentelemetry/exporter-logs-otlp-http": "0.57.2",
-    "@opentelemetry/exporter-trace-otlp-grpc": "0.57.2",
-    "@opentelemetry/exporter-trace-otlp-http": "0.57.2",
-    "@opentelemetry/instrumentation": "0.57.2",
-    "@opentelemetry/instrumentation-http": "0.57.2",
-    "@opentelemetry/instrumentation-grpc": "0.57.2",
-    "@opentelemetry/instrumentation-net": "0.43.1",
-    "@opentelemetry/propagator-b3": "1.30.1",
-    "@opentelemetry/resource-detector-aws": "1.12.0",
-    "@opentelemetry/resources": "1.30.1",
-    "@opentelemetry/sdk-node": "0.57.2",
-    "@opentelemetry/sdk-logs": "0.57.2",
-    "@opentelemetry/sdk-metrics": "1.30.1",
-    "@opentelemetry/sdk-trace-base": "1.30.1",
-    "@opentelemetry/sdk-trace-node": "1.30.1"
-  },
-  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
+  }
 }

package/lib/service/worker/runtime/graphql/schema/schemaDirectives/Public.d.ts

@@ -1,6 +0,0 @@
-import { GraphQLField } from "graphql";
-import { SchemaDirectiveVisitor } from "graphql-tools";
-export declare class Public extends SchemaDirectiveVisitor {
-    visitFieldDefinition(field: GraphQLField<any, any>): void;
-}
-export declare const publicDirectiveTypeDefs = "directive @public on FIELD_DEFINITION";

package/lib/service/worker/runtime/graphql/schema/schemaDirectives/Public.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicDirectiveTypeDefs = exports.Public = void 0;
-const graphql_1 = require("graphql");
-const graphql_tools_1 = require("graphql-tools");
-class Public extends graphql_tools_1.SchemaDirectiveVisitor {
-    visitFieldDefinition(field) {
-        const { resolve = graphql_1.defaultFieldResolver } = field;
-        field.resolve = async function (...args) {
-            return resolve.apply(this, args);
-        };
-    }
-}
-exports.Public = Public;
-exports.publicDirectiveTypeDefs = `directive @public on FIELD_DEFINITION`;