Skip to content

Conversation

@kdaviduik
Copy link
Contributor

WHY are these changes introduced?

Fixes #0000

WHAT is this pull request doing?

HOW to test your changes?

Post-merge steps

Checklist

  • I've read the Contributing Guidelines
  • I've considered possible cross-platform impacts (Mac, Linux, Windows)
  • I've added a changeset if this PR contains user-facing or noteworthy changes
  • I've added tests to cover my changes
  • I've added or updated the documentation

This commit adds the infrastructure for migrating tracking cookies
from legacy _shopify_y/_shopify_s cookies to consolidated encrypted
cookies using Server-Timing headers.

Key changes:
- Add tracking-utils.ts with getTrackingValues() to read tracking
  values from Server-Timing headers via Performance API
- Add server-timing.ts with utilities for detecting SFAPI proxy mode
  and server-returned tracking values
- Update storefront client to forward tracking values via headers
- Add sameDomainForStorefrontApi option for proxy detection
- Update customer-privacy component to support new cookie migration
- Add buyerIpSig to StorefrontHeaders type
- Update useShopifyCookies with fetchTrackingValues option
This commit adds comprehensive E2E tests for the tracking cookies
migration feature, including both new and legacy cookie scenarios.

Test structure:
- new-cookies/: Tests for the new consolidated cookie system
  - consent-tracking-accept/decline.spec.ts
  - privacy-banner-accept/decline/consent-change.spec.ts
  - privacy-banner-migration.spec.ts (migration from legacy cookies)
- old-cookies/: Tests for legacy _shopify_y/_shopify_s cookies
  - consent-tracking-accept/decline.spec.ts
  - privacy-banner-accept/decline.spec.ts
- smoke/: Basic smoke tests for cart and home page

Also adds:
- Unit tests for tracking-utils.ts and server-timing.ts
- E2E fixtures for server setup and storefront mocking
- Environment configurations for different consent scenarios
- Updated playwright configuration
This fixes a bug where PerfKit would load before consent was collected,
causing it to use stale tracking values. The fix delays PerfKit loading
until after the consent collection callback is fired.

Changes:
- Add consentCollected state to AnalyticsProvider
- Only render PerfKit after consentCollected is true
- Update onVisitorConsentCollected callback to track consent state
- Add sameDomainForStorefrontApi to Consent type
- Update @shopify/remix-oxygen createRequestHandler with SFAPI proxy
- Add new createRequestHandler export to @Shopify/hydrogen
- Proxy automatically routes /api/.../graphql.json to Storefront API
- Forward Set-Cookie and server-timing headers from subrequests
- Set _sfapi_proxy server-timing header for document requests
- New proxyStorefrontApiRequests option (default: true)
Updates both @Shopify/hydrogen and @shopify/remix-oxygen
createRequestHandler to match the implementation in PR #3309:

- Add collectTrackingInformation option (default: true)
- Add warning when storefront instance is missing from context
- Use appendServerTimingHeader utility instead of manual header
- Move poweredByHeader append to after tracking header processing
- Add TODO comments for future major version changes
- Improve JSDoc documentation for all options
Re-export getTrackingValues from @shopify/hydrogen-react to align
with PR #3309 cookie migration implementation.
Add the buyerIpSig field to both the StorefrontHeaders type and
getStorefrontHeaders function in remix-oxygen to align with the
hydrogen package's StorefrontHeaders type.

This fixes type compatibility when passing getStorefrontHeaders()
result to createStorefrontClient().
Align with hydrogen's getStorefrontHeaders to check sec-purpose first,
then fall back to purpose. This ensures browser-initiated prefetches
(via Speculation Rules API or <link rel="prefetch">) are properly detected.
Aligns the parameter name with PR #3309 for consistency.
Fixes Chromium crashes (SIGTRAP/SEGV) on macOS 15 Sequoia
when running e2e tests. The older version 1.40.1 had
compatibility issues with the newer macOS version.
Update the route interception pattern in setWithPrivacyBanner to match
Vite's pre-bundled dependency path format. The previous pattern
(**/@fs/**/hydrogen/dist/**/*.js) didn't match the actual paths served
by Vite dev server (**/node_modules/.vite/deps/@shopify_hydrogen.js*).
Update the integration test snapshot to include the TokenlessApi route
that was added in #2948 but the snapshot was never updated.

Also includes skeleton template changes for the cookie migration backport:
- Use createRequestHandler from @Shopify/hydrogen with proxyStandardRoutes
- Minor formatting cleanup in root.tsx
The classic-remix example uses @shopify/remix-oxygen's createRequestHandler
which now defaults to proxyStandardRoutes: true. This requires a storefront
instance with specific methods that the classic-remix example doesn't provide.

Setting proxyStandardRoutes: false restores the previous behavior and fixes
the dev test.
The classic-remix example doesn't use the full Hydrogen stack,
so disable both proxyStandardRoutes and collectTrackingInformation
to avoid issues with the new request handler options.
Some environments like the classic Remix compiler may not have
the getSetCookie method on their Headers implementation.
@shopify
Copy link
Contributor

shopify bot commented Dec 11, 2025

Oxygen deployed a preview of your kd-test-2025-04-bf branch. Details:

Storefront Status Preview link Deployment details Last update (UTC)
metaobjects ✅ Successful (Logs) Preview deployment Inspect deployment December 11, 202510:50 AM
classic-remix ✅ Successful (Logs) Preview deployment Inspect deployment December 11, 202510:49 AM
third-party-queries-caching ✅ Successful (Logs) Preview deployment Inspect deployment December 11, 202510:50 AM
Skeleton (skeleton.hydrogen.shop) ✅ Successful (Logs) Preview deployment Inspect deployment December 11, 202510:49 AM
custom-cart-method ✅ Successful (Logs) Preview deployment Inspect deployment December 11, 202510:49 AM

Learn more about Hydrogen's GitHub integration.

@kdaviduik kdaviduik closed this Dec 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant