Skip to content

feat: accept personalAccessToken as alternative auth in createCheckoutSession - #1449

Merged
wcole1-godaddy merged 1 commit into
godaddy:mainfrom
mmelnyk-godaddy:feat/DEVX-1079-access-token-auth
Sep 11, 2026
Merged

wcole1-godaddy merged 1 commit into
godaddy:mainfrom
mmelnyk-godaddy:feat/DEVX-1079-access-token-auth

Conversation

@mmelnyk-godaddy

@mmelnyk-godaddy mmelnyk-godaddy commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add personalAccessToken as direct Bearer token option for createCheckoutSession
  • PAT path routes through API Gateway (https://{apiHost}/v2/commerce/stores/{storeId}/checkout-subgraph)
  • OAuth path (clientId/clientSecret) unchanged — uses original direct checkout host
  • TypeScript discriminated union (never fields) enforces mutual exclusivity at compile time; runtime check as safety net
  • 6 unit tests covering both auth paths, caching, and error cases

Changes

  • packages/react/src/types.tsCheckoutSessionAuth discriminated union type
  • packages/react/src/lib/godaddy/godaddy.ts — optional host override param (+1 line)
  • packages/react/src/server.ts — PAT/OAuth branching, API Gateway host for PAT
  • packages/react/src/server.test.ts — 6 unit tests (new file)

Test plan

  • personalAccessToken path routes through API Gateway
  • clientId/clientSecret OAuth path unchanged (backward compatible)
  • Mutual exclusivity throws clear error
  • No-auth failure handled gracefully
  • Token caching isolated to OAuth path only
  • All 6 tests pass

DEVX-1079

@mmelnyk-godaddy
mmelnyk-godaddy requested a review from a team as a code owner September 8, 2026 14:07
@changeset-bot

changeset-bot Bot commented Sep 8, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 70ab88f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
@godaddy/react Patch
nextjs Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Comment thread packages/react/src/server.ts
@pbennett1-godaddy

Copy link
Copy Markdown
Contributor

@mmelnyk-godaddy - include a patch changeset as well for this PR.

Comment thread packages/react/src/lib/godaddy/godaddy.ts Outdated
Comment thread packages/react/src/server.test.ts Outdated
@mmelnyk-godaddy
mmelnyk-godaddy force-pushed the feat/DEVX-1079-access-token-auth branch 3 times, most recently from b2e157f to f431075 Compare September 11, 2026 13:34
@mmelnyk-godaddy mmelnyk-godaddy changed the title feat: accept accessToken as alternative auth in createCheckoutSession feat: accept personalAccessToken as alternative auth in createCheckoutSession Sep 11, 2026
@mmelnyk-godaddy
mmelnyk-godaddy force-pushed the feat/DEVX-1079-access-token-auth branch from f431075 to d75d560 Compare September 11, 2026 13:39
Comment thread packages/react/src/lib/godaddy/godaddy.ts Outdated
@mmelnyk-godaddy
mmelnyk-godaddy force-pushed the feat/DEVX-1079-access-token-auth branch 2 times, most recently from 2e8a133 to 321fe02 Compare September 11, 2026 14:48
…tSession

- PAT path routes through API Gateway via endpoint param
- OAuth path unchanged (direct checkout host)
- Mutual exclusivity enforced at runtime
- Empty PAT rejected before OAuth fallback branch
- Token caching only applies to OAuth path
@mmelnyk-godaddy
mmelnyk-godaddy force-pushed the feat/DEVX-1079-access-token-auth branch from 321fe02 to 70ab88f Compare September 11, 2026 15:17
@wcole1-godaddy
wcole1-godaddy merged commit 12ea9d7 into godaddy:main Sep 11, 2026
3 checks passed
@mmelnyk-godaddy
mmelnyk-godaddy deleted the feat/DEVX-1079-access-token-auth branch September 11, 2026 16:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants