chore: version 2026 21 1144

[eduardoformiga]

What's the purpose of this pull request?

This PR aims to group changes to publish a new version.

Summary by CodeRabbit

Release Notes

• New Features

  • Enhanced logout functionality with comprehensive browser storage clearance, including sessions, cookies, and local storage.

• Bug Fixes

  • Resolved Partytown cross-origin errors in iframe environments.
  • Added slug field support to landing page schema.

• Documentation

  • Improved CLI README with reorganized installation and usage sections.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

This PR introduces resilience improvements to VTEX orderForm API calls by making the ID parameter optional, refactors the validateCart resolver flow, and implements a new logout feature with comprehensive browser storage clearing. Additional changes include a landing page schema slug field, Partytown cross-origin error prevention, and documentation updates.

Changes

Cohort / File(s)	Summary
VTEX Commerce API packages/api/src/platforms/vtex/clients/commerce/index.ts, packages/api/src/platforms/vtex/resolvers/validateCart.ts	Made orderForm ID parameter optional; conditionally includes refreshOutdatedData in query params and omits body when ID is absent. Updated validateCart to fetch orderForm using cookie-derived ID and reordered data extraction to align with new retrieval pattern.
VTEX Integration Tests packages/api/test/integration/mutations.test.ts, packages/api/test/mocks/ValidateCartMutation.ts	Added orderFormCookie to integration test headers; reordered query parameters in mock endpoint URLs to align with updated orderForm API calls.
Logout & Storage Clearing packages/core/src/components/account/MyAccountDrawer/OrganizationDrawer/OrganizationDrawer.tsx, packages/core/src/pages/api/fs/logout.ts, packages/core/src/utils/clearCookies.ts, packages/core/test/utils/clearCookies.test.ts	Introduced new logout flow with async storage clearing (sessionStorage, IndexedDB, VTEX cookies), server-side API route for cookie expiration via Set-Cookie headers, and utility functions for multi-domain/path cookie removal across client and server contexts. Comprehensive test coverage for cookie utilities.
Schema & Rendering Fixes packages/core/cms/faststore/pages/cms_content_type__landingpage.jsonc, packages/core/src/components/ThirdPartyScripts/ThirdPartyScripts.tsx	Added slug field to landing page schema; added guard condition to prevent Partytown rendering in cross-origin iframe contexts.
Documentation packages/cli/CHANGELOG.md, packages/cli/README.md, packages/core/CHANGELOG.md	Added pre-release version entries and expanded CLI README with structured Usage, Installation, and Commands sections.

Sequence Diagram(s)

sequenceDiagram
    participant User as User
    participant Drawer as OrganizationDrawer Component
    participant Storage as Browser Storage
    participant API as /api/fs/logout
    participant VTEX as VTEX Logout

    User->>Drawer: Click logout
    Drawer->>Storage: Clear sessionStorage keys
    Drawer->>Storage: Clear __fs_gallery_page_* keys
    Drawer->>Storage: Clear IndexedDB keyval-store
    Drawer->>API: POST with credentials + cookies
    API->>API: Extract & derive cookie domains/paths
    API->>API: Expire VTEX & additional cookies
    API->>Drawer: Return Set-Cookie headers + 200
    Drawer->>Drawer: Apply Set-Cookie headers
    Drawer->>VTEX: Redirect to VTEX logout endpoint

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• fix: Clear cart (get new orderForm) if there is no checkout cookie present #3178 — Shares modifications to VTEX orderForm API behavior and validateCart resolver flow, including optional ID parameter and cookie-based retrieval patterns.

Suggested labels

enhancement

Suggested reviewers

• hellofanny
• ommeirelles

Poem

🔐 A logout dance, both swift and clean,
Cookie crumbs swept from the browser scene—
VTEX paths and domains untangled with care,
Storage erased, no trace left there.
The orderForm bends to optional might,
Resilience blooms in the Faststore light! 🌟

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'chore: version 2026 21 1144' is vague and does not convey meaningful information about the actual changes; it merely references a version number without describing what was fixed or implemented.	Consider using a more descriptive title that highlights the primary change, such as 'chore: logout storage clearing and Partytown iframe handling' or similar, to help reviewers quickly understand the changeset's main purpose.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@packages/core/src/components/ThirdPartyScripts/ThirdPartyScripts.tsx`:
- Around line 40-43: The current conditional render in ThirdPartyScripts.tsx
uses typeof window !== 'undefined' && window.self === window.top which differs
between SSR and client and causes hydration mismatch; update the
ThirdPartyScripts component to perform the iframe/top check only on the client
by introducing local state (e.g., isTopWindow) and setting it inside a useEffect
that runs on mount, then render <Partytown /> only when that state is true;
reference the ThirdPartyScripts component, the Partytown JSX element, and
useEffect/state to locate and modify the code.

🧹 Nitpick comments (6)

packages/core/test/utils/clearCookies.test.ts (1)

112-140: Weak test assertions for expireCookieClient.

The tests for expireCookieClient with domain and secure flags only verify that the function doesn't throw, but don't verify the actual cookie string being set. While jsdom has limitations for domain-specific cookies, you could spy on document.cookie setter to verify the correct string is constructed.

💡 Optional: Add spy-based assertion

 it('should expire a cookie with domain', () => {
-  document.cookie = 'test-cookie=value; path=/; domain=.example.com'
-
-  expireCookieClient({
-    name: 'test-cookie',
-    path: '/',
-    domain: '.example.com',
-  })
-
-  // Note: We can't easily verify domain-specific cookies in jsdom,
-  // but we can verify the function doesn't throw
-  expect(() => {
-    expireCookieClient({
-      name: 'test-cookie',
-      path: '/',
-      domain: '.example.com',
-    })
-  }).not.toThrow()
+  const cookieSpy = jest.spyOn(document, 'cookie', 'set')
+  
+  expireCookieClient({
+    name: 'test-cookie',
+    path: '/',
+    domain: '.example.com',
+  })
+
+  expect(cookieSpy).toHaveBeenCalledWith(
+    expect.stringContaining('test-cookie=; expires=Thu, 01 Jan 1970')
+  )
+  expect(cookieSpy).toHaveBeenCalledWith(
+    expect.stringContaining('domain=.example.com')
+  )
+  cookieSpy.mockRestore()
 })

packages/core/src/pages/api/fs/logout.ts (2)

17-24: Consider adding CSRF protection.

This endpoint clears authentication cookies via POST. While it requires the request to include cookies (credentials: 'include' on client), there's no CSRF token validation. An attacker could potentially trigger logout via a cross-site request.

Consider adding a CSRF token check or verifying the Origin/Referer header matches your domain:

 const handler: NextApiHandler = async (
   request: NextApiRequest,
   response: NextApiResponse
 ) => {
   if (request.method !== 'POST') {
     response.status(405).end()
     return
   }

+  // Basic CSRF check - verify origin matches host
+  const origin = request.headers.origin
+  const host = request.headers.host
+  if (origin && host && !origin.includes(host.split(':')[0])) {
+    response.status(403).json({ success: false, error: 'Forbidden' })
+    return
+  }

---

68-73: Error logging exposes internal details.

Logging the full error object could expose sensitive information in server logs.

🔒 Sanitize error logging

   } catch (error) {
-    console.error('Error clearing cookies:', error)
+    console.error('Error clearing cookies:', error instanceof Error ? error.message : 'Unknown error')
     response
       .status(500)
       .json({ success: false, error: 'Failed to clear cookies' })
   }

packages/core/src/components/account/MyAccountDrawer/OrganizationDrawer/OrganizationDrawer.tsx (2)

22-54: Silent error swallowing obscures debugging.

Multiple nested try/catch blocks with empty catches make debugging difficult. Consider at least logging errors in development mode.

🔧 Optional: Add development-only logging

     for (const key of sessionStorageKeys) {
       try {
         window.sessionStorage?.removeItem(key)
-      } catch {}
+      } catch (e) {
+        if (process.env.NODE_ENV === 'development') {
+          console.debug('Failed to remove sessionStorage key:', key, e)
+        }
+      }
     }

---

73-81: O(n³) cookie clearing loop could be slow with many cookies.

The triple nested loop (names × paths × domains) could become slow if there are many VTEX cookies. For typical cases this is fine, but worth noting.

The current implementation is correct and defensive. If performance becomes an issue with many cookies, consider batching or parallel execution.

packages/core/src/utils/clearCookies.ts (1)

1-12: Consider exporting type definitions.

The ExpireCookieClientParams and ExpireCookieServerParams types are useful for consumers of these utilities but aren't exported.

-type ExpireCookieClientParams = {
+export type ExpireCookieClientParams = {
   name: string
   path: string
   domain?: string
   secure?: boolean
 }

-type ExpireCookieServerParams = {
+export type ExpireCookieServerParams = {
   name: string
   path: string
   domain?: string
 }

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Potential hydration mismatch with window check in JSX.

The typeof window !== 'undefined' check evaluates differently between SSR (false) and client hydration (true), causing a hydration mismatch. During SSR, Partytown won't be included in the HTML, but React will try to render it during hydration.

Consider using a useEffect with state to handle the iframe detection client-side only:

🔧 Suggested fix

+import { useState, useEffect } from 'react'
+
 function ThirdPartyScripts() {
   const forwards = []
   if (includeVTEX) forwards.push('sendrc')
+  
+  const [shouldRenderPartytown, setShouldRenderPartytown] = useState(true)
+  
+  useEffect(() => {
+    // Disable Partytown in iframe contexts to prevent cross-origin errors
+    if (window.self !== window.top) {
+      setShouldRenderPartytown(false)
+    }
+  }, [])

   return (
     <>
       {/* ... existing code ... */}
-      {/* Only render Partytown when not in an iframe to prevent cross-origin errors. */}
-      {typeof window !== 'undefined' && window.self === window.top && (
-        <Partytown key="partytown" />
-      )}
+      {shouldRenderPartytown && <Partytown key="partytown" />}
     </>
   )
 }

🤖 Prompt for AI Agents

In `@packages/core/src/components/ThirdPartyScripts/ThirdPartyScripts.tsx` around
lines 40 - 43, The current conditional render in ThirdPartyScripts.tsx uses
typeof window !== 'undefined' && window.self === window.top which differs
between SSR and client and causes hydration mismatch; update the
ThirdPartyScripts component to perform the iframe/top check only on the client
by introducing local state (e.g., isTopWindow) and setting it inside a useEffect
that runs on mount, then render <Partytown /> only when that state is true;
reference the ThirdPartyScripts component, the Partytown JSX element, and
useEffect/state to locate and modify the code.