TRAC-525: fix - client.ts not using Header object for default values

Author: parthshahp

.changeset/fresh-steaks-remain.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-client": patch
+---
+
+Fix `client.fetch` so that custom headers passed via `fetchOptions.headers` properly override the client's default headers (including `Authorization`). Previously the merge produced two distinct keys (e.g. `Authorization` and `authorization`) in a plain object, which `fetch` then `append`ed into a comma-joined value. Headers are now built via a `Headers` object using `.set()`, so case-insensitive overrides work as expected.

packages/client/src/client.ts

@@ -130,20 +130,36 @@ class Client<FetcherRequestInit extends RequestInit = RequestInit> {
     const { headers: additionalFetchHeaders = {}, ...additionalFetchOptions } =
       (await this.beforeRequest?.(fetchOptions)) ?? {};
 
+    // Build headers via a Headers object so that case-insensitive overrides work as expected.
+    const requestHeaders = new Headers({
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${this.config.storefrontToken}`,
+      'User-Agent': this.backendUserAgent,
+    });
+
+    if (customerAccessToken) {
+      requestHeaders.set('X-Bc-Customer-Access-Token', customerAccessToken);
+    }
+
+    if (validateCustomerAccessToken) {
+      requestHeaders.set('X-Bc-Error-On-Invalid-Customer-Access-Token', 'true');
+    }
+
+    if (this.trustedProxySecret) {
+      requestHeaders.set('X-BC-Trusted-Proxy-Secret', this.trustedProxySecret);
+    }
+
+    new Headers(additionalFetchHeaders).forEach((value, key) => {
+      requestHeaders.set(key, value);
+    });
+
+    new Headers(headers).forEach((value, key) => {
+      requestHeaders.set(key, value);
+    });
+
     const response = await fetch(graphqlUrl, {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Authorization: `Bearer ${this.config.storefrontToken}`,
-        'User-Agent': this.backendUserAgent,
-        ...(customerAccessToken && { 'X-Bc-Customer-Access-Token': customerAccessToken }),
-        ...(validateCustomerAccessToken && {
-          'X-Bc-Error-On-Invalid-Customer-Access-Token': 'true',
-        }),
-        ...(this.trustedProxySecret && { 'X-BC-Trusted-Proxy-Secret': this.trustedProxySecret }),
-        ...Object.fromEntries(new Headers(additionalFetchHeaders).entries()),
-        ...Object.fromEntries(new Headers(headers).entries()),
-      },
+      headers: requestHeaders,
       body: JSON.stringify({
         query,
         ...(variables && { variables }),