fix(vtex): initVtexFromBlocks must not clobber decrypted creds - #456
Open
JonasJesus42 wants to merge 1 commit into
Open
fix(vtex): initVtexFromBlocks must not clobber decrypted creds#456JonasJesus42 wants to merge 1 commit into
JonasJesus42 wants to merge 1 commit into
Conversation
initVtexFromBlocks is wired as the site's initPlatform hook and re-runs on
every resolve (onBeforeResolve). It only reads PLAIN-STRING appKey/appToken,
but the CMS stores them encrypted ({ encrypted }) — decrypted asynchronously by
autoconfigApps' configure() via resolveSecret. Writing undefined for the
non-string case clobbered those decrypted credentials on every resolve, so
privileged VTEX calls (MasterData writes) went out anonymous and VTEX answered
403 'Cannot write in private fields'. Broke Bagaggio's lead-capture form
(deco-sites/bagaggio-tanstack), which needed a site-side ensureVtexAuth()
workaround.
When the block's appKey/appToken isn't a usable string, preserve whatever
credential is already configured (via getVtexConfig()) instead of overwriting
it. Sync, minimal; the async decrypt path stays owned by configure().
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problema
initVtexFromBlocks(@decocms/apps-vtex) é usado pelos sites como hookinitPlatforme roda a cada resolve (onBeforeResolve). Ele só entendeappKey/appTokencomo string pura:Mas o CMS guarda os secrets criptografados (
{ encrypted }), que oautoconfigApps→configure()descriptografa de forma assíncrona viaresolveSecrete instala comconfigureVtex. ComoinitVtexFromBlocksescreviaundefinedno caso não-string (objeto criptografado), a cada resolve ele clobberava as credenciais descriptografadas → chamadas VTEX privilegiadas (escrita no MasterData) saíam anônimas →403 "Cannot write in private fields".Quebrou o form de lead-capture da Bagaggio (deco-sites/bagaggio-tanstack), que precisou de um workaround
ensureVtexAuth()no próprio site.Fix
Quando o
appKey/appTokendo bloco não é uma string usável, preservar a credencial já configurada (viagetVtexConfig()) em vez de sobrescrever comundefined. Sync e mínimo; o caminho de decrypt assíncrono continua sendo responsabilidade doconfigure().Teste
initVtexFromBlocks.test.ts(novo): garante que uma cred já descriptografada não é clobberada quando o bloco trazappKeycomo objeto{ encrypted }, e que uma string ainda é aplicada normalmente.@decocms/apps-vtex: 268 testes passam (+2 novos)Impacto
Sites deixam de precisar de workaround pra escrita no MasterData quando as creds VTEX estão criptografadas no bloco
deco-vtex.🤖 Generated with Claude Code
Summary by cubic
Stops
initVtexFromBlocksin@decocms/apps-vtexfrom overwriting decrypted VTEX credentials when blocks contain encrypted secrets, keeping VTEX calls authenticated. Fixes 403 errors on MasterData writes and removes the need for site workarounds.appKey/appTokenfromgetVtexConfig()when block values aren’t plain strings; still apply plain strings when present.Written for commit d3deb32. Summary will update on new commits.