fix(api): use account-scoped cookie in orderEntry headers by lemagnetic · Pull Request #3395 · vtex/faststore

lemagnetic · 2026-06-16T21:33:37Z

What's the purpose of this pull request?

fix(api): use account-scoped cookie in orderEntry headers

The orderEntry methods (file upload via OES, #3334) still referenced the
withAutCookie helper that #3381 removed, since that PR was not rebased on
the latest dev and did not see the newly merged orderEntry block. This
left an undefined withAutCookie reference, breaking the build and tests
on dev.

Replace the 5 withAutCookie(forwardedHost, account) calls with the
withCookie({ 'content-type', 'X-FORWARDED-HOST' }) pattern adopted by
#3381

Summary by CodeRabbit

Bug Fixes
- Improved authentication/header handling for order entry endpoints to ensure requests consistently include the correct Content-Type and forwarded host information.
- Ensures file upload continues to use multipart/form-data with the proper boundary while retaining the updated base header behavior.

coderabbitai · 2026-06-16T21:33:50Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f88d8d30-4749-4160-bd57-697f097acad5

📥 Commits

Reviewing files that changed from the base of the PR and between a2d9a19 and e604235.

📒 Files selected for processing (1)

packages/api/src/platforms/vtex/clients/commerce/index.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/api/src/platforms/vtex/clients/commerce/index.ts

Walkthrough

Five orderEntry methods in the VTEX commerce client (uploadFile, startOperation, getOperation, createOrderForm, getOrderFormItems) replace withAutCookie(forwardedHost, account) with withCookie(...) that explicitly sets content-type: application/json and X-FORWARDED-HOST: forwardedHost. No URLs or control flow change.

Changes

orderEntry Header Construction Refactor

Layer / File(s)	Summary
orderEntry autHeaders: `withAutCookie` → `withCookie` across five methods `packages/api/src/platforms/vtex/clients/commerce/index.ts`	`uploadFile`, `startOperation`, `getOperation`, `createOrderForm`, and `getOrderFormItems` each replace `withAutCookie(forwardedHost, account)` with `withCookie` that explicitly includes `content-type: application/json` and `X-FORWARDED-HOST: forwardedHost`.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related PRs

vtex/faststore#3381: Directly related — that PR previously removed the withAutCookie/getWithAutCookie helper and began migrating other methods to withCookie, which is precisely the same pattern applied here to the remaining five orderEntry methods.

Suggested reviewers

lucasfp13
hellofanny
eduardoformiga

Poem

🍪 Swap the cookie, set the host,
content-type — a must, not a boast.
Five methods dressed in headers new,
X-FORWARDED-HOST shining through.
Clean and explicit, no magic lost! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: replacing withAutCookie with account-scoped cookie handling in orderEntry headers.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/ci-withAutCookie

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codesandbox-ci · 2026-06-16T21:34:36Z

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/api/src/platforms/vtex/clients/commerce/index.ts`:
- Around line 902-905: Remove redundant header definitions across the three
methods startOperation, createOrderForm, and getOrderFormItems. Since autHeaders
already contains lowercase 'content-type' and 'X-FORWARDED-HOST', locate each
place where autHeaders is spread and an uppercase 'Content-Type' header is added
separately, and remove that redundant 'Content-Type' property. Additionally, in
createOrderForm and getOrderFormItems, remove the redundant 'X-FORWARDED-HOST'
header that duplicates what is already in autHeaders. Simply spread autHeaders
directly without adding these duplicate headers.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f3f5c33d-894e-4cab-a2a8-7722e6d2ca91

📥 Commits

Reviewing files that changed from the base of the PR and between 37d6fcf and a2d9a19.

📒 Files selected for processing (1)

packages/api/src/platforms/vtex/clients/commerce/index.ts

pkg-pr-new · 2026-06-16T23:17:39Z

Open in StackBlitz

@faststore/api

npm i https://pkg.pr.new/vtex/faststore/@faststore/api@e604235

@faststore/cli

npm i https://pkg.pr.new/vtex/faststore/@faststore/cli@e604235

@faststore/components

npm i https://pkg.pr.new/vtex/faststore/@faststore/components@e604235

@faststore/core

npm i https://pkg.pr.new/vtex/faststore/@faststore/core@e604235

@faststore/diagnostics

npm i https://pkg.pr.new/vtex/faststore/@faststore/diagnostics@e604235

@faststore/lighthouse

npm i https://pkg.pr.new/vtex/faststore/@faststore/lighthouse@e604235

@faststore/sdk

npm i https://pkg.pr.new/vtex/faststore/@faststore/sdk@e604235

@faststore/ui

npm i https://pkg.pr.new/vtex/faststore/@faststore/ui@e604235

commit: e604235

sonar-workflows · 2026-06-16T23:19:45Z

Quality Gate passed

Issues

Measures

Project ID: vtex_faststore_f0a862d5-9557-49f9-8d09-de40caa76622

View in SonarQube

## Summary Graduate the `4.3.0-dev.8` prerelease cycle to the stable `4.3.0` release on `latest`. Merging this PR triggers CD on `main`, which runs `lerna version --conventional-graduate` and publishes all `@faststore/*` packages to the `latest` dist-tag. ### Features - Password Protection (v4) (#3276) - File upload via Order Entry Service (OES) (#3334) - Add sitemap to CMS Landing Page content-type (#3386) ### Bug Fixes - **core:** use authenticator route for setpassword (#3380) - migrate partytown `@builder.io` → `@qwik.dev@0.14.0` (#3394) - **api:** use account-scoped cookie in orderEntry headers (#3395) - forward auth token only via account-scoped cookie (#3381) - **core:** propagate upstream error status instead of always 500 (#3379) ## Pre-flight (faststore-release skill) - Working tree clean; `release.yml` has `fetch-depth: 0` - All 8 packages have `repository.url` - No breaking changes since `v4.2.0` - `dev → main` merges cleanly (no CHANGELOG/codegen conflicts) - No unmerged hotfixes on `main` (accidental `4.2.1` was fully reverted in #3375) ## Test plan - [ ] CI green on this PR - [ ] After merge, confirm CD publishes all 8 packages at `4.3.0` under `latest` Made with [Cursor](https://cursor.com) --------- Co-authored-by: Matheus P. Silva <cout.matheusps@gmail.com> Co-authored-by: vtexgithubbot <vtexgithubbot@github.com> Co-authored-by: Lucas Feijó <lucas.portela@vtex.com> Co-authored-by: Luiz Falcão <39093175+llfalcao@users.noreply.github.com> Co-authored-by: Artur Santiago <artur.santiago@cubos.io> Co-authored-by: Larícia Mota <laricia.mota@vtex.com.br> Co-authored-by: Sahan Jayawardana <sahan@clouda.io> Co-authored-by: Mateus Pontes <mateuspo10@gmail.com> Co-authored-by: Matheus Martins <mathews_2010@outlook.com> Co-authored-by: renatomaurovtex <167437775+renatomaurovtex@users.noreply.github.com> Co-authored-by: Leandro Rodrigues <leandro.rodrigues@vtex.com> Co-authored-by: Fanny Chien <fanny.chien@vtex.com> Co-authored-by: Arthur Andrade <arthurfelandrade@gmail.com> Co-authored-by: Leandro Rodrigues <leandro.swf@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Thiago Pereira <thiago.pereira@vtex.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Giuliana Rigaud <62848434+giurigaud@users.noreply.github.com> Co-authored-by: renato <renato.neto@cubos.io> Co-authored-by: Bruna Santos <brunassdev@gmail.com> Co-authored-by: BrunaCubos <104789782+BrunaCubos@users.noreply.github.com> Co-authored-by: Ícaro Oliveira <icarovinici@gmail.com> Co-authored-by: Bruna Santos <bruna.santos@cubos.io> Co-authored-by: Everton Ataide <everton.ataide@vtex.com> Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Otavio Moreira Meirelles <otavio.meirelles@vtex.com> Co-authored-by: Marco Cardoso <marcopaulo@outlook.com> Co-authored-by: Gabriel Paladino <gabpaladino@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai> Co-authored-by: dk-portal[bot] <134092483+dk-portal[bot]@users.noreply.github.com> Co-authored-by: Rodrigo Tavares <rodrigo.tavares@vtex.com> Co-authored-by: vitorflg <vitor.gomes@vtex.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Válber Laux <valber.laux@vtex.com>

fix(api): use account-scoped cookie in orderEntry headers

a2d9a19

lemagnetic requested a review from a team as a code owner June 16, 2026 21:33

lemagnetic requested review from hellofanny and lucasfp13 and removed request for a team June 16, 2026 21:33

coderabbitai Bot reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/api/src/platforms/vtex/clients/commerce/index.ts

eduardoformiga approved these changes Jun 16, 2026

View reviewed changes

fix(api): remove redundant headers

e604235

lemagnetic merged commit d5f6ac3 into dev Jun 16, 2026
12 of 13 checks passed

lemagnetic deleted the fix/ci-withAutCookie branch June 16, 2026 23:25

eduardoformiga mentioned this pull request Jun 17, 2026

feat: graduate v4.3.0 #3396

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(api): use account-scoped cookie in orderEntry headers#3395

fix(api): use account-scoped cookie in orderEntry headers#3395
lemagnetic merged 2 commits into
devfrom
fix/ci-withAutCookie

lemagnetic commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

codesandbox-ci Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026

Uh oh!

sonar-workflows Bot commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lemagnetic commented Jun 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's the purpose of this pull request?

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

codesandbox-ci Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026

Uh oh!

sonar-workflows Bot commented Jun 16, 2026

Quality Gate passed

Issues

Measures

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lemagnetic commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

codesandbox-ci Bot commented Jun 16, 2026 •

edited

Loading