fix(core): use authenticator route for setpassword

[renatomaurovtex]

Summary

Migrates the My Account → Security → Reset password flow off the deprecated VTEX ID endpoint onto the new authenticator route, per SFS-3056.

• US-1 — Successful reset: useSetPassword now posts to /api/authenticator/pub/authentication/classic/setpassword?expireSessions=true&an={accountName} instead of /api/vtexid/pub/authentication/classic/setpassword. Method (POST), credentials: 'include', the multipart/form-data body (login, currentPassword, newPassword, accesskey, recaptcha) and the authStatus → authMessage mapping are all unchanged, so the success/error toasts and drawer behavior stay identical.
• US-2 — Error mapping: existing authStatus values (wrongcredentials, invalidemail, etc.) still resolve to the same user-facing messages; the non-2xx and thrown-error paths are untouched.
• US-3 — accountName propagation: the account name is now passed explicitly via the an query string (encodeURIComponent-ed), sourced from the useSetPassword(accountName) argument already plumbed through SecurityDrawer, with a defensive fallback to config.api.storeId so an is never empty.

The change is isolated to packages/core/src/sdk/account/useSetPassword.ts. No public API, GraphQL schema, codegen, or UI changes.

Tests

Adds packages/core/test/sdk/account/useSetPassword.test.ts covering:

• the new authenticator URL with expireSessions=true&an=… (and absence of /api/vtexid/);
• POST + credentials: 'include' + form-data body shape;
• success path (authStatus: success);
• error mapping (wrongcredentials → Wrong credentials);
• accountName fallback to config.api.storeId.

All 5 new tests pass. Pre-existing failures in test/pages/api/graphql.test.ts and test/utils/cookieCacheBusting.test.ts are unrelated (verified they fail without this change; the former belongs to the separate, not-yet-implemented BFF 4xx forwarding spec).

Out of scope

• Migrating the other /api/vtexid/pub/... callers (startlogin inside the same hook, logout in OrganizationDrawer) — tracked as follow-ups.
• GraphQL password.graphql types (this flow is REST-only).

Spec

specs/replace-vtexid-setpassword-route.md (status: Done). The specs/ directory is git-ignored in this repo, so the spec file is not part of this PR.

Made with Cursor

Summary by CodeRabbit

• Refactor

  • Improved password-change flow with tighter authentication integration, consistent account identification fallback, and better session-expiry handling for more reliable credential updates.

• Tests

  • Added end-to-end tests covering password submission, credential validation, authentication responses, and account fallback behavior to ensure correct success/error messaging.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 25d699d3-e583-4cd9-a0a5-ca5548587dab

📥 Commits

Reviewing files that changed from the base of the PR and between c48a56a and a59fb4b.

📒 Files selected for processing (2)

• packages/core/src/sdk/account/useSetPassword.ts
• packages/core/test/sdk/account/useSetPassword.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/core/src/sdk/account/useSetPassword.ts
• packages/core/test/sdk/account/useSetPassword.test.ts

---

Walkthrough

useSetPassword now encodes an account identifier as an, posts to authenticator setpassword with an, and calls the authenticator start endpoint with the same an. Tests validate endpoints, query params, FormData bodies, credentials, fallback storeId, and response mapping.

Changes

Set-Password Endpoint Migration

Layer / File(s)	Summary
Implementation: setPassword and startLogin updates packages/core/src/sdk/account/useSetPassword.ts	Derives an = encodeURIComponent(accountName ?? config.api.storeId), calls /api/authenticator/.../setpassword?expireSessions=true&an=${an} with FormData, updates startLogin to /api/authenticator/pub/authentication/start?an=${an} and reduces posted fields; updates useCallback deps.
Tests: request assertions and response mapping packages/core/test/sdk/account/useSetPassword.test.ts	Adds Vitest jsdom tests that mock discovery.config and fetch; assert setpassword and start endpoints use an, credentials: 'include', expected FormData fields, fallback to config.api.storeId, and mapping of authStatus to { success, message }.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested labels

hotfix

Suggested reviewers

• eduardoformiga
• lucasfp13

Poem

🔐 A hook that learns an encoded name,
Routes to auth so calls stay the same,
Tests keep watch on FormData flow,
Credentials included — ready to go!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: migrating the setPassword flow from the deprecated /api/vtexid route to the new /api/authenticator route, which is the primary objective of the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/replace-vtexid-setpassword-route

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/core/src/sdk/account/useSetPassword.ts (1)

42-121: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Add accountName to the useCallback dependency array.

The setPassword callback uses accountName (lines 46, 56) but omits it from the dependency array. If accountName changes between renders, the callback will continue using the stale value, sending the wrong account identifier to the API.

🔧 Proposed fix

-  }, [])
+  }, [accountName])

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/core/src/sdk/account/useSetPassword.ts` around lines 42 - 121, The
setPassword callback (defined with useCallback) closes over accountName but the
dependency array is empty, which can cause stale accountName to be used; update
the useCallback dependencies to include accountName (and any other external
values like config or authMessage if they are not stable) so setPassword
recalculates when accountName changes, e.g., add accountName to the dependency
array of the useCallback that defines setPassword.

🧹 Nitpick comments (1)

packages/core/test/sdk/account/useSetPassword.test.ts (1)

44-147: 💤 Low value

Consider adding a test for special characters in accountName.

While URL encoding is handled correctly in the implementation, an explicit test verifying that special characters (spaces, &, =, etc.) in accountName are properly encoded in the query string would strengthen confidence in edge cases.

💡 Example test case

it('properly URL-encodes special characters in accountName', async () => {
  mockFetch
    .mockResolvedValueOnce(okResponse({}))
    .mockResolvedValueOnce(okResponse({ authStatus: 'success' }))

  const { result } = renderHook(() => useSetPassword('my store & co'))

  await act(async () => {
    await result.current.setPassword(validInput)
  })

  const url = String(getSetPasswordCall()?.[0])
  expect(url).toContain('an=my%20store%20%26%20co')
})

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/core/test/sdk/account/useSetPassword.test.ts` around lines 44 - 147,
Add a test in the useSetPassword suite to verify accountName URL-encoding: mock
responses with mockFetch (using okResponse), render the hook with a name
containing special characters (e.g., "my store & co") via renderHook(() =>
useSetPassword('my store & co')), call result.current.setPassword(validInput)
inside act, then inspect getSetPasswordCall() and assert the request URL
contains the properly encoded query parameter (an=my%20store%20%26%20co).
Reference useSetPassword, getSetPasswordCall, mockFetch, okResponse, and
validInput when adding the test.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@packages/core/src/sdk/account/useSetPassword.ts`:
- Around line 42-121: The setPassword callback (defined with useCallback) closes
over accountName but the dependency array is empty, which can cause stale
accountName to be used; update the useCallback dependencies to include
accountName (and any other external values like config or authMessage if they
are not stable) so setPassword recalculates when accountName changes, e.g., add
accountName to the dependency array of the useCallback that defines setPassword.

---

Nitpick comments:
In `@packages/core/test/sdk/account/useSetPassword.test.ts`:
- Around line 44-147: Add a test in the useSetPassword suite to verify
accountName URL-encoding: mock responses with mockFetch (using okResponse),
render the hook with a name containing special characters (e.g., "my store &
co") via renderHook(() => useSetPassword('my store & co')), call
result.current.setPassword(validInput) inside act, then inspect
getSetPasswordCall() and assert the request URL contains the properly encoded
query parameter (an=my%20store%20%26%20co). Reference useSetPassword,
getSetPasswordCall, mockFetch, okResponse, and validInput when adding the test.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4ea60d6f-5461-46bf-a02c-285ae75edf83

📥 Commits

Reviewing files that changed from the base of the PR and between 25a03d5 and c48a56a.

📒 Files selected for processing (2)

• packages/core/src/sdk/account/useSetPassword.ts
• packages/core/test/sdk/account/useSetPassword.test.ts

[eduardoformiga]

Testei com as mudanças na loja de b2b e o fluxo não funcionou, está dando mensagem de InvalidToken.
referencia: https://vtex.slack.com/archives/C08P582BAKH/p1781124705319119

[pkg-pr-new]

Open in StackBlitz

@faststore/api

npm i https://pkg.pr.new/vtex/faststore/@faststore/api@a59fb4b

@faststore/cli

npm i https://pkg.pr.new/vtex/faststore/@faststore/cli@a59fb4b

@faststore/components

npm i https://pkg.pr.new/vtex/faststore/@faststore/components@a59fb4b

@faststore/core

npm i https://pkg.pr.new/vtex/faststore/@faststore/core@a59fb4b

@faststore/diagnostics

npm i https://pkg.pr.new/vtex/faststore/@faststore/diagnostics@a59fb4b

@faststore/lighthouse

npm i https://pkg.pr.new/vtex/faststore/@faststore/lighthouse@a59fb4b

@faststore/sdk

npm i https://pkg.pr.new/vtex/faststore/@faststore/sdk@a59fb4b

@faststore/ui

npm i https://pkg.pr.new/vtex/faststore/@faststore/ui@a59fb4b

commit: a59fb4b

[sonar-workflows]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• 100.00% Coverage (15.90% Estimated after merge)
• 0.00% Duplicated Code (1.60% Estimated after merge)

Project ID: vtex_faststore_f0a862d5-9557-49f9-8d09-de40caa76622

View in SonarQube

[eduardoformiga]

Blocker resolvido internamente, podemos seguir com o merge.