@@ -402,125 +402,115 @@ describe('dev proxy', () => {
402402 )
403403 } )
404404
405- describe ( 'Authorization header behavior' , ( ) => {
406- const themeCtx = {
407- session : {
408- storeFqdn : 'my-store.myshopify.com' ,
409- storefrontToken : 'test-sfr-token' ,
410- storefrontPassword : '' ,
411- sessionCookies : { } ,
412- } ,
413- options : { host : 'localhost' , port : '9292' } ,
414- localThemeFileSystem : { files : new Map ( ) } ,
415- localThemeExtensionFileSystem : { files : new Map ( ) } ,
416- type : 'theme' ,
417- } as unknown as DevServerContext
405+ const themeCtx = {
406+ session : {
407+ storeFqdn : 'my-store.myshopify.com' ,
408+ storefrontToken : 'test-sfr-token' ,
409+ storefrontPassword : '' ,
410+ sessionCookies : { } ,
411+ } ,
412+ options : { host : 'localhost' , port : '9292' } ,
413+ localThemeFileSystem : { files : new Map ( ) } ,
414+ localThemeExtensionFileSystem : { files : new Map ( ) } ,
415+ type : 'theme' ,
416+ } as unknown as DevServerContext
417+
418+ const extensionCtx = {
419+ ...themeCtx ,
420+ type : 'theme-extension' ,
421+ } as unknown as DevServerContext
422+
423+ let fetchMock : ReturnType < typeof vi . fn >
424+
425+ afterEach ( ( ) => {
426+ vi . unstubAllGlobals ( )
427+ } )
418428
419- const extensionCtx = {
420- ...themeCtx ,
421- type : 'theme-extension' ,
422- } as unknown as DevServerContext
429+ function stubFetchAndProxy ( method : string , path : string , context : DevServerContext ) {
430+ fetchMock = vi . fn ( ) . mockResolvedValue ( new Response ( 'ok' ) )
431+ vi . stubGlobal ( 'fetch' , fetchMock )
432+ const event = createH3Event ( method , path )
433+ return proxyStorefrontRequest ( event , context )
434+ }
435+
436+ function getAuthHeader ( ) : string | undefined {
437+ const headers = fetchMock . mock . calls [ 0 ] ! [ 1 ] . headers as { [ key : string ] : string }
438+ return headers . Authorization ?? headers . authorization
439+ }
440+
441+ test ( 'excludes Bearer token for POST /cart/add.js' , async ( ) => {
442+ await stubFetchAndProxy ( 'POST' , '/cart/add.js' , themeCtx )
443+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
444+ } )
423445
424- let fetchMock : ReturnType < typeof vi . fn >
446+ test ( 'excludes Bearer token for POST /cart/update.js' , async ( ) => {
447+ await stubFetchAndProxy ( 'POST' , '/cart/update.js' , themeCtx )
448+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
449+ } )
425450
426- afterEach ( ( ) => {
427- vi . unstubAllGlobals ( )
428- } )
451+ test ( 'excludes Bearer token for GET /cart.js' , async ( ) => {
452+ await stubFetchAndProxy ( 'GET' , '/cart.js' , themeCtx )
453+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
454+ } )
429455
430- function stubFetchAndProxy ( method : string , path : string , context : DevServerContext ) {
431- fetchMock = vi . fn ( ) . mockResolvedValue ( new Response ( 'ok' ) )
432- vi . stubGlobal ( 'fetch' , fetchMock )
433- const event = createH3Event ( method , path )
434- return proxyStorefrontRequest ( event , context )
435- }
436-
437- function getAuthHeader ( ) : string | undefined {
438- const headers = fetchMock . mock . calls [ 0 ] ! [ 1 ] . headers as Record < string , string >
439- return headers . Authorization ?? headers . authorization
440- }
441-
442- describe ( 'excludes Bearer token for session-cookie-auth paths' , ( ) => {
443- test ( 'POST /cart/add.js' , async ( ) => {
444- await stubFetchAndProxy ( 'POST' , '/cart/add.js' , themeCtx )
445- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
446- } )
447-
448- test ( 'POST /cart/update.js' , async ( ) => {
449- await stubFetchAndProxy ( 'POST' , '/cart/update.js' , themeCtx )
450- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
451- } )
452-
453- test ( 'GET /cart.js' , async ( ) => {
454- await stubFetchAndProxy ( 'GET' , '/cart.js' , themeCtx )
455- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
456- } )
457-
458- test ( 'GET /cart.json' , async ( ) => {
459- await stubFetchAndProxy ( 'GET' , '/cart.json' , themeCtx )
460- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
461- } )
462-
463- test ( 'POST /cart (bare)' , async ( ) => {
464- await stubFetchAndProxy ( 'POST' , '/cart' , themeCtx )
465- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
466- } )
467-
468- test ( 'POST /cart/change.js' , async ( ) => {
469- await stubFetchAndProxy ( 'POST' , '/cart/change.js' , themeCtx )
470- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
471- } )
472-
473- test ( 'GET /checkouts/abc123' , async ( ) => {
474- await stubFetchAndProxy ( 'GET' , '/checkouts/abc123' , themeCtx )
475- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
476- } )
477-
478- test ( 'GET /account/logout' , async ( ) => {
479- await stubFetchAndProxy ( 'GET' , '/account/logout' , themeCtx )
480- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
481- } )
482- } )
456+ test ( 'excludes Bearer token for GET /cart.json' , async ( ) => {
457+ await stubFetchAndProxy ( 'GET' , '/cart.json' , themeCtx )
458+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
459+ } )
483460
484- describe ( 'excludes Bearer token when path has query strings' , ( ) => {
485- test ( 'GET /cart.js?sections=header' , async ( ) => {
486- await stubFetchAndProxy ( 'GET' , '/cart.js?sections=header' , themeCtx )
487- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
488- } )
489-
490- test ( 'POST /cart/add.js?sections=main-cart-items' , async ( ) => {
491- await stubFetchAndProxy ( 'POST' , '/cart/add.js?sections=main-cart-items' , themeCtx )
492- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
493- } )
494-
495- test ( 'GET /account?foo=bar' , async ( ) => {
496- await stubFetchAndProxy ( 'GET' , '/account?foo=bar' , themeCtx )
497- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
498- } )
499- } )
461+ test ( 'excludes Bearer token for POST /cart (bare)' , async ( ) => {
462+ await stubFetchAndProxy ( 'POST' , '/cart' , themeCtx )
463+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
464+ } )
500465
501- describe ( 'includes Bearer token for CDN and asset paths' , ( ) => {
502- test ( 'GET /cdn/shop/t/10/assets/theme.css' , async ( ) => {
503- await stubFetchAndProxy ( 'GET' , '/cdn/shop/t/10/assets/theme.css' , themeCtx )
504- expect ( getAuthHeader ( ) ) . toBe ( 'Bearer test-sfr-token' )
505- } )
506-
507- test ( 'GET /some-path.js' , async ( ) => {
508- await stubFetchAndProxy ( 'GET' , '/some-path.js' , themeCtx )
509- expect ( getAuthHeader ( ) ) . toBe ( 'Bearer test-sfr-token' )
510- } )
511-
512- test ( 'GET /checkouts/internal/something (negative lookahead boundary)' , async ( ) => {
513- await stubFetchAndProxy ( 'GET' , '/checkouts/internal/something' , themeCtx )
514- expect ( getAuthHeader ( ) ) . toBe ( 'Bearer test-sfr-token' )
515- } )
516- } )
466+ test ( 'excludes Bearer token for POST /cart/change.js' , async ( ) => {
467+ await stubFetchAndProxy ( 'POST' , '/cart/change.js' , themeCtx )
468+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
469+ } )
517470
518- describe ( 'excludes Bearer token for theme-extension context' , ( ) => {
519- test ( 'GET /cdn/shop/t/10/assets/theme.css with theme-extension type' , async ( ) => {
520- await stubFetchAndProxy ( 'GET' , '/cdn/shop/t/10/assets/theme.css' , extensionCtx )
521- expect ( getAuthHeader ( ) ) . toBeUndefined ( )
522- } )
523- } )
471+ test ( 'excludes Bearer token for GET /checkouts/abc123' , async ( ) => {
472+ await stubFetchAndProxy ( 'GET' , '/checkouts/abc123' , themeCtx )
473+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
474+ } )
475+
476+ test ( 'excludes Bearer token for GET /account/logout' , async ( ) => {
477+ await stubFetchAndProxy ( 'GET' , '/account/logout' , themeCtx )
478+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
479+ } )
480+
481+ test ( 'excludes Bearer token for GET /cart.js?sections=header (query string)' , async ( ) => {
482+ await stubFetchAndProxy ( 'GET' , '/cart.js?sections=header' , themeCtx )
483+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
484+ } )
485+
486+ test ( 'excludes Bearer token for POST /cart/add.js?sections=main-cart-items (query string)' , async ( ) => {
487+ await stubFetchAndProxy ( 'POST' , '/cart/add.js?sections=main-cart-items' , themeCtx )
488+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
489+ } )
490+
491+ test ( 'excludes Bearer token for GET /account?foo=bar (query string with $ anchor)' , async ( ) => {
492+ await stubFetchAndProxy ( 'GET' , '/account?foo=bar' , themeCtx )
493+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
494+ } )
495+
496+ test ( 'includes Bearer token for GET /cdn/shop/t/10/assets/theme.css' , async ( ) => {
497+ await stubFetchAndProxy ( 'GET' , '/cdn/shop/t/10/assets/theme.css' , themeCtx )
498+ expect ( getAuthHeader ( ) ) . toBe ( 'Bearer test-sfr-token' )
499+ } )
500+
501+ test ( 'includes Bearer token for GET /some-path.js' , async ( ) => {
502+ await stubFetchAndProxy ( 'GET' , '/some-path.js' , themeCtx )
503+ expect ( getAuthHeader ( ) ) . toBe ( 'Bearer test-sfr-token' )
504+ } )
505+
506+ test ( 'includes Bearer token for GET /checkouts/internal/something (negative lookahead)' , async ( ) => {
507+ await stubFetchAndProxy ( 'GET' , '/checkouts/internal/something' , themeCtx )
508+ expect ( getAuthHeader ( ) ) . toBe ( 'Bearer test-sfr-token' )
509+ } )
510+
511+ test ( 'excludes Bearer token for theme-extension context' , async ( ) => {
512+ await stubFetchAndProxy ( 'GET' , '/cdn/shop/t/10/assets/theme.css' , extensionCtx )
513+ expect ( getAuthHeader ( ) ) . toBeUndefined ( )
524514 } )
525515 } )
526516} )
0 commit comments