feat(core): B2B contract switcher in the account drawer

.gitignore

@@ -115,4 +115,7 @@ packages/core/@generated/cached-operations.json
 /tmp
 oclif.manifest.json
 
+# Local store overrides (copy from discovery.config.local.example.js)
+packages/core/discovery.config.local.js
+
 *storybook.log

packages/api/src/platforms/vtex/clients/commerce/Contract.ts

@@ -1,6 +1,7 @@
 export interface ContractResponse {
   isCorporate: boolean
   corporateName: string
+  email?: string
   firstName: string
   lastName: string
   userName: string

packages/api/src/platforms/vtex/clients/commerce/index.ts

@@ -77,6 +77,18 @@ export const VtexCommerce = (
 
   const forwardedHost = host.replace(selectedPrefix, '')
 
+  const withBuyerAuthHeaders = (
+    additionalHeaders: Record<string, string> = {}
+  ): HeadersInit => {
+    const authToken = getAuthCookie(getUpdatedCookie(ctx) ?? '', account)
+
+    return withCookie({
+      ...additionalHeaders,
+      'X-FORWARDED-HOST': forwardedHost,
+      ...(authToken ? { [`VtexIdclientAutCookie_${account}`]: authToken } : {}),
+    })
+  }
+
   return {
     catalog: {
       salesChannel: (sc: string): Promise<SalesChannel> =>
@@ -453,7 +465,7 @@ export const VtexCommerce = (
 
       params.set(
         'items',
-        'profile.id,profile.email,profile.firstName,profile.lastName,profile.phone,shopper.firstName,shopper.lastName,shopper.organizationManager,store.channel,store.countryCode,store.cultureInfo,store.currencyCode,store.currencySymbol,authentication.customerId,authentication.storeUserId,authentication.storeUserEmail,authentication.unitId,authentication.unitName,checkout.regionId,public.postalCode'
+        'profile.id,profile.email,profile.firstName,profile.lastName,profile.phone,shopper.firstName,shopper.lastName,shopper.organizationManager,shopper.availableContracts,shopper.activeContractId,store.channel,store.countryCode,store.cultureInfo,store.currencyCode,store.currencySymbol,authentication.customerId,authentication.storeUserId,authentication.storeUserEmail,authentication.unitId,authentication.unitName,checkout.regionId,public.postalCode'
       )
 
       const headers: HeadersInit = withCookie({
@@ -760,10 +772,9 @@ export const VtexCommerce = (
           throw new BadRequestError('Missing contractId to fetch CL fields.')
         }
 
-        const headers: HeadersInit = withAppKeyAndToken({
+        const headers: HeadersInit = withBuyerAuthHeaders({
           Accept: 'application/json',
           'content-type': 'application/json',
-          'X-FORWARDED-HOST': forwardedHost,
         })
 
         return fetchAPI(

packages/api/src/platforms/vtex/clients/commerce/types/Session.ts

@@ -40,10 +40,19 @@ export interface Profile {
   phone?: Value
 }
 
+export type SessionAvailableContract = {
+  customerId: string
+  contractName: string
+  isActive: boolean
+  isCurrent: boolean
+}
+
 export interface Shopper {
   firstName?: Value
   lastName?: Value
   organizationManager?: { value: boolean }
+  availableContracts?: { value: SessionAvailableContract[] }
+  activeContractId?: Value
 }
 
 export interface Checkout {

packages/api/src/platforms/vtex/resolvers/query.ts

@@ -2,6 +2,7 @@ import type {
   ProcessOrderAuthorizationRule,
   QueryAllCollectionsArgs,
   QueryAllProductsArgs,
+  QueryAvailableContractsArgs,
   QueryCollectionArgs,
   QueryListUserOrdersArgs,
   QueryPickupPointsArgs,
@@ -14,6 +15,7 @@ import type {
   QuerySellersArgs,
   QueryShippingArgs,
   QueryUserOrderArgs,
+  StoreContract,
   UserOrderFromList,
 } from '../../../__generated__/schema'
 import { getOrderEntryOperation } from './getOrderEntryOperation'
@@ -31,6 +33,12 @@ import type { SearchArgs } from '../clients/search'
 import type { ProductSearchResult } from '../clients/search/types/ProductSearchResult'
 import type { GraphqlContext } from '../index'
 import { extractRuleForAuthorization } from '../utils/commercialAuth'
+import {
+  mapSessionContractsToStoreContracts,
+  parseSessionAvailableContracts,
+  resolveActiveContractDisplayName,
+  resolveActiveContractIdFromSession,
+} from '../utils/contract'
 import { mutateChannelContext, mutateLocaleContext } from '../utils/contex'
 import { getAuthCookie, parseJwt } from '../utils/cookies'
 import { enhanceSku } from '../utils/enhanceSku'
@@ -664,9 +672,7 @@ export const Query = {
         contractId: profile?.id?.value ?? '',
       })
 
-      const name =
-        contract?.corporateName ??
-        `${(profile?.firstName?.value ?? '').trim()} ${(profile?.lastName?.value ?? '').trim()}`.trim()
+      const name = resolveActiveContractDisplayName(contract, profile)
 
       return {
         name: name || '',
@@ -689,6 +695,55 @@ export const Query = {
       // createdAt: '',
     }
   },
+  // only b2b users
+  // Contract list from VTEX session `shopper.availableContracts`.
+  availableContracts: async (
+    _: unknown,
+    { orgUnitId }: QueryAvailableContractsArgs,
+    ctx: GraphqlContext
+  ): Promise<StoreContract[]> => {
+    if (!orgUnitId) {
+      throw new BadRequestError('Missing orgUnitId')
+    }
+
+    const {
+      account,
+      headers,
+      clients: { commerce },
+    } = ctx
+
+    const sessionData = await commerce.session('').catch(() => null)
+    const authToken = getAuthCookie(headers?.cookie ?? '', account)
+    let jwt: ReturnType<typeof parseJwt> = null
+
+    try {
+      jwt = authToken ? parseJwt(authToken) : null
+    } catch {
+      jwt = null
+    }
+
+    const sessionUnitId =
+      sessionData?.namespaces.authentication?.unitId?.value?.trim() ??
+      jwt?.unitId?.trim() ??
+      ''
+
+    if (!sessionUnitId || sessionUnitId !== orgUnitId) {
+      throw new ForbiddenError(
+        'You are not allowed to list contracts for this organization unit'
+      )
+    }
+
+    const contracts = parseSessionAvailableContracts(
+      sessionData?.namespaces.shopper
+    )
+
+    const activeContractId =
+      resolveActiveContractIdFromSession(sessionData) ||
+      jwt?.customerId?.trim() ||
+      ''
+
+    return mapSessionContractsToStoreContracts(contracts, activeContractId)
+  },
   pickupPoints: async (
     _: unknown,
     { geoCoordinates }: QueryPickupPointsArgs,

packages/api/src/platforms/vtex/resolvers/validateSession.ts

@@ -7,6 +7,7 @@ import type {
   StoreSession,
 } from '../../../__generated__/schema'
 import ChannelMarshal from '../utils/channel'
+import { resolveActiveContractDisplayName } from '../utils/contract'
 import { getAuthCookie, parseJwt } from '../utils/cookies'
 
 async function getPreciseLocationData(
@@ -198,7 +199,7 @@ export const validateSession = async (
             `${typeof shopper?.firstName?.value === 'string' ? shopper.firstName.value : ''} ${typeof shopper?.lastName?.value === 'string' ? shopper.lastName.value : ''}`.trim(),
           userEmail: authentication?.storeUserEmail.value ?? '',
           savedPostalCode: publicData?.postalCode?.value ?? '',
-          contractName: contract?.corporateName ?? '',
+          contractName: resolveActiveContractDisplayName(contract, profile),
           organizationManager: shopper?.organizationManager?.value ?? false,
         }
       : null,

packages/api/src/platforms/vtex/typeDefs/organization.graphql

@@ -17,3 +17,21 @@ input IStoreOrganization {
   """
   identifier: String!
 }
+
+"""
+A commercial contract available to a buyer's Organization Unit.
+"""
+type StoreContract {
+  """
+  Contract identifier (the contract/scope ID associated with the Organization Unit).
+  """
+  id: ID!
+  """
+  Human-readable corporate name of the contract (resolved from MasterData).
+  """
+  corporateName: String!
+  """
+  Indicates whether this contract is the one currently active in the session.
+  """
+  isActive: Boolean!
+}

packages/api/src/platforms/vtex/typeDefs/query.graphql

@@ -451,6 +451,18 @@ type Query {
     @auth
     @cacheControl(scope: "private", sMaxAge: 300, staleWhileRevalidate: 3600)
 
+  """
+  Lists the commercial contracts associated with the given Organization Unit,
+  resolved to human-readable corporate names. Governed: only contracts associated
+  with the authenticated buyer's Organization Unit are returned.
+  """
+  availableContracts(
+    """
+    The Organization Unit identifier whose contracts will be listed.
+    """
+    orgUnitId: String!
+  ): [StoreContract!]! @auth @cacheControl(scope: "private", sMaxAge: 0)
+
   """
   Returns a list of pickup points near to the given geo coordinates.
   """