fix(apps-vtex): create Master Data documents with app credentials

Merged
AK
4d ago
+35-2

What

vtex.masterdata.create now sends X-VTEX-API-AppKey / X-VTEX-API-AppToken whenever the client is configured with them, leaving the shopper's cookie out of that call.

Why

VTEX is rejecting anonymous writes to /api/dataentities. call() only attaches app credentials when no cookie is passed (so shopper-scoped calls like the orderForm never come back with unmasked profile data). A masterdata.create called with the shopper's cookie therefore went out without credentials and failed.

The create response is only Id / Href / DocumentId, so sending it as the app unmasks nothing. The "no credentials next to a cookie" rule still holds: when credentials are used, the cookie is dropped.

  • With credentials: create always goes out as the app.
  • Without credentials: unchanged, the cookie is forwarded as before.
  • masterdata.search is unchanged.

Equivalent fix in deco-cx/apps: deco-cx/apps#1688

Note for sites

Sites need appKey / appToken with a role that has Dynamic Storage → Insert or update document. A site route or server function that exposes masterdata.create to the browser should pin the entity and whitelist fields, since writes now carry store credentials.

Testing

  • New test in vtexClient.test.ts covering both cases (with and without credentials).
  • apps-vtex tests (66), typecheck and biome pass.
  • Not yet tested against a live VTEX account.

🤖 Generated with Claude Code

Summary by cubic

Fixes vtex.masterdata.create so documents are written with store app credentials whenever they're configured, since VTEX now rejects anonymous writes to /api/dataentities.

Passing the shopper's cookie had made the client skip credentials, so those writes failed. With credentials configured, the call now goes out as the app and leaves the cookie out — safe because the create response only returns document IDs, nothing to unmask. Without credentials the behavior is unchanged, and masterdata.search is untouched.

Sites need an appKey/appToken with the Dynamic Storage → Insert or update document role. Any route or server function exposing masterdata.create to the browser should pin the entity and whitelist fields, because writes now carry store credentials.