merge from parent branch

Author: unandyala

e2e/tests/a11y/desktop/a11y-snapshot-test-guest.spec.js

@@ -111,7 +111,8 @@ test.describe('Accessibility Tests with Snapshots for guest user', () => {
         await runAccessibilityTest(page, ['guest', 'cart-a11y-violations.json'])
     })
 
-    test('Checkout should not have new accessibility issues', async ({page}) => {
+    // TODO: Remove skip and regenerate snapshots.
+    test.skip('Checkout should not have new accessibility issues', async ({page}) => {
         await addProductToCart({page})
 
         // cart

packages/pwa-kit-runtime/CHANGELOG.md

@@ -1,5 +1,6 @@
 ## [Unreleased]
 - Add HttpOnly session cookies for SLAS private client proxy [#3680](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3680)
+- Handle logout when HttpOnly session cookies is enabled  [#3699](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3699)
 
 ## v3.17.0-dev
 - Add Node 24 support. Migrate deprecated Node.js `url.parse()` and `url.format()` to the WHATWG `URL` [#3652](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3652)

packages/pwa-kit-runtime/src/ssr/server/build-remote-server.js

@@ -967,6 +967,7 @@ export const RemoteServerFactory = {
                         // purpose so we don't want to overwrite the header for those calls.
                         proxyRequest.setHeader('Authorization', `Basic ${encodedSlasCredentials}`)
                     } else if (
+                        process.env.MRT_DISABLE_HTTPONLY_SESSION_COOKIES === 'false' &&
                         incomingRequest.path?.match(options.slasEndpointsRequiringAccessToken)
                     ) {
                         // Inject tokens from HttpOnly cookies for endpoints like /oauth2/logout
@@ -984,13 +985,19 @@ export const RemoteServerFactory = {
                                 }
 
                                 // Inject refresh_token into query string from HttpOnly cookie
-                                // Try registered user cookie first, then guest
-                                const refreshToken =
-                                    cookies[`cc-nx_${site}`] || cookies[`cc-nx-g_${site}`]
+                                // refresh_token ishouls required for /oauth2/logout
+                                const refreshToken = cookies[`cc-nx_${site}`]
                                 if (refreshToken) {
                                     const url = new URL(proxyRequest.path, 'http://localhost')
                                     url.searchParams.set('refresh_token', refreshToken)
                                     proxyRequest.path = url.pathname + url.search
+                                } else {
+                                    logger.warn(
+                                        `Registered refresh token cookie (cc-nx_${site}) not found for ${incomingRequest.path}. The logout request may fail.`,
+                                        {
+                                            namespace: '_setupSlasPrivateClientProxy'
+                                        }
+                                    )
                                 }
                             }
                         }

packages/pwa-kit-runtime/src/ssr/server/process-token-response.js

@@ -197,6 +197,23 @@ export function applyHttpOnlySessionCookies(responseBuffer, proxyRes, req, res,
                 expires: refreshExpires
             })
         )
+
+        // Delete the opposite refresh token cookie to mirror client-side behavior:
+        // Login (guest → registered): delete guest cookie cc-nx-g
+        // Logout (registered → guest): delete registered cookie cc-nx
+        const staleCookieName = isGuest ? `cc-nx_${site}` : `cc-nx-g_${site}`
+        res.append(
+            SET_COOKIE,
+            cookieAsString({
+                name: staleCookieName,
+                value: '',
+                path: '/',
+                secure: true,
+                sameSite: 'lax',
+                httpOnly: true,
+                expires: new Date(0)
+            })
+        )
     }
 
     // Strip token fields from body so they are not exposed to the client

packages/pwa-kit-runtime/src/ssr/server/process-token-response.test.js

@@ -210,8 +210,12 @@ describe('applyHttpOnlySessionCookies', () => {
         expect(uidoCookie.value).toBe('ecom')
         expect(uidoCookie.httpOnly).toBeUndefined()
 
-        // Should NOT have registered refresh cookie
-        expect(res.cookies.find((c) => c.startsWith('cc-nx_testsite='))).toBeUndefined()
+        // Registered refresh cookie should be expired (deleted)
+        const staleRegisteredCookie = parseCookie(
+            res.cookies.find((c) => c.startsWith('cc-nx_testsite='))
+        )
+        expect(staleRegisteredCookie.value).toBe('')
+        expect(staleRegisteredCookie.expires).toEqual(new Date(0))
 
         // Tokens stripped from body, other fields preserved
         const body = JSON.parse(result.toString('utf8'))
@@ -255,8 +259,12 @@ describe('applyHttpOnlySessionCookies', () => {
         const uidoCookie = parseCookie(res.cookies.find((c) => c.includes('uido_testsite=')))
         expect(uidoCookie.value).toBe('ecom')
 
-        // Should NOT have guest refresh cookie
-        expect(res.cookies.find((c) => c.includes('cc-nx-g_testsite='))).toBeUndefined()
+        // Guest refresh cookie should be expired (deleted)
+        const staleGuestCookie = parseCookie(
+            res.cookies.find((c) => c.startsWith('cc-nx-g_testsite='))
+        )
+        expect(staleGuestCookie.value).toBe('')
+        expect(staleGuestCookie.expires).toEqual(new Date(0))
 
         // No dnt cookie when dnt absent from JWT
         expect(res.cookies.find((c) => c.includes('cc-at-dnt_testsite'))).toBeUndefined()

packages/template-retail-react-app/CHANGELOG.md

@@ -4,6 +4,7 @@
 ## v9.1.0-dev
 - Update jest-fetch-mock and Jest 29 dependencies [#3663](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3663)
 - Add Node 24 support. Drop Node 16 support [#3652](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3652)
+- [Bugfix] Fix error toast for no applicable shipping methods in one-click checkout [#3673](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3673)
 - [Feature] Subscribe to marketing communications. Email capture component updated in footer section to use Shopper Consents API. [#3674](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3674)
 - [Bugfix] Fix for custom billing address as returning shoppers in 1CC [#3693](https://github.com/SalesforceCommerceCloud/pwa-kit/pull/3693)
 

packages/template-retail-react-app/app/components/display-price/list-price.jsx

@@ -36,7 +36,7 @@ const ListPrice = ({labelForA11y, price, isRange = false, as = 's', currency, ..
                     aria-label={intl.formatMessage(msg.ariaLabelListPriceWithRange, {
                         listPrice: listPriceText || ''
                     })}
-                    color="gray.600"
+                    color="gray.700"
                 >
                     {listPriceText}
                 </Text>
@@ -47,7 +47,7 @@ const ListPrice = ({labelForA11y, price, isRange = false, as = 's', currency, ..
                     aria-label={intl.formatMessage(msg.ariaLabelListPrice, {
                         listPrice: listPriceText || ''
                     })}
-                    color="gray.600"
+                    color="gray.700"
                 >
                     {listPriceText}
                 </Text>

packages/template-retail-react-app/app/pages/cart/index.jsx

@@ -81,7 +81,10 @@ import {
 import {useCurrentCustomer} from '@salesforce/retail-react-app/app/hooks/use-current-customer'
 import UnavailableProductConfirmationModal from '@salesforce/retail-react-app/app/components/unavailable-product-confirmation-modal'
 import {getUpdateBundleChildArray} from '@salesforce/retail-react-app/app/utils/product-utils'
-import {isPickupShipment} from '@salesforce/retail-react-app/app/utils/shipment-utils'
+import {
+    isPickupShipment,
+    groupShipmentsByDeliveryOption
+} from '@salesforce/retail-react-app/app/utils/shipment-utils'
 import {useSelectedStore} from '@salesforce/retail-react-app/app/hooks/use-selected-store'
 import {useMultiship} from '@salesforce/retail-react-app/app/hooks/use-multiship'
 
@@ -377,6 +380,15 @@ const Cart = () => {
                 return
             }
 
+            // Don't assign methods until at least one delivery shipment has an address
+            const {deliveryShipments} = groupShipmentsByDeliveryOption(basket)
+            const hasDeliveryWithAddress = deliveryShipments.some(
+                (s) => s.shippingAddress?.address1
+            )
+            if (deliveryShipments.length > 0 && !hasDeliveryWithAddress) {
+                return
+            }
+
             setIsProcessingShippingMethods(true)
             try {
                 await updateShipmentsWithoutMethods()

packages/template-retail-react-app/app/pages/checkout-one-click/partials/one-click-shipping-address.jsx

@@ -48,24 +48,25 @@ export default function ShippingAddress(props) {
     const {enableUserRegistration = false, isShipmentCleanupComplete = true} = props
     const {formatMessage} = useIntl()
     const [isManualSubmitLoading, setIsManualSubmitLoading] = useState(false)
-    const [isMultiShipping, setIsMultiShipping] = useState(false)
-    const [openedByUser, setOpenedByUser] = useState(false)
     const {data: customer} = useCurrentCustomer()
     const currentBasketQuery = useCurrentBasket()
     const {data: basket} = currentBasketQuery
     const deliveryShipments =
         basket?.shipments?.filter((shipment) => !isPickupShipment(shipment)) || []
+    const hasMultipleDeliveryShipments = deliveryShipments.length > 1
+    const [isMultiShipping, setIsMultiShipping] = useState(hasMultipleDeliveryShipments)
+    const [openedByUser, setOpenedByUser] = useState(false)
     const selectedShippingAddress = deliveryShipments[0]?.shippingAddress
     const targetDeliveryShipmentId = deliveryShipments[0]?.shipmentId || 'me'
     const isAddressFilled = selectedShippingAddress?.address1 && selectedShippingAddress?.city
-    const {step, STEPS, goToStep, goToNextStep, contactPhone} = useCheckout()
+    const {step, STEPS, goToStep, goToNextStep, contactPhone, setConsolidationLock} = useCheckout()
     const createCustomerAddress = useShopperCustomersMutation('createCustomerAddress')
     const updateCustomerAddress = useShopperCustomersMutation('updateCustomerAddress')
     const updateShippingAddressForShipment = useShopperBasketsMutation(
         'updateShippingAddressForShipment'
     )
     const multishipEnabled = getConfig()?.app?.multishipEnabled ?? true
-    const hasMultipleDeliveryShipments = deliveryShipments.length > 1
+
     const {removeEmptyShipments} = useMultiship(basket)
     const {updateItemsToDeliveryShipment} = useItemShipmentManagement(basket?.basketId)
 
@@ -114,6 +115,14 @@ export default function ShippingAddress(props) {
             const targetShipmentId = targetShipment?.shipmentId || DEFAULT_SHIPMENT_ID
             let basketAfterItemMoves = null
 
+            // Do not advance the step while basket mutations are in flight
+            const willConsolidate = deliveryItems.some(
+                (item) => item.shipmentId !== targetShipmentId
+            )
+            if (willConsolidate) {
+                setConsolidationLock(true)
+            }
+
             await updateShippingAddressForShipment.mutateAsync({
                 parameters: {
                     basketId: basket.basketId,
@@ -172,6 +181,7 @@ export default function ShippingAddress(props) {
             }
             // Remove any empty shipments. Use updated basket if available
             await removeEmptyShipments(basketAfterItemMoves || basket)
+            setConsolidationLock(false)
 
             // For registered shoppers: if an existing shipping method is still valid for the new address,
             // skip the Shipping Options step and go straight to Payment.
@@ -198,6 +208,7 @@ export default function ShippingAddress(props) {
                 console.error('Error submitting shipping address:', error)
             }
         } finally {
+            setConsolidationLock(false)
             setIsManualSubmitLoading(false)
         }
     }