Merge remote-tracking branch 'upstream/main'

.changeset/chilled-rocks-sneeze.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+Change the rest of the auth pages to use toasts.

.changeset/gentle-experts-remember.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+Converts the change password messages over to using a toast. This should provide a better DX and UX.

.changeset/grumpy-roses-attack.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+Update the register customer page to use toasts for messaging.

.changeset/late-boats-own.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+Converts the reset password messages over to using a toast.

.changeset/old-bananas-destroy.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+Remove the account state provider components

.changeset/proud-queens-serve.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+Converts the login messages over to using a toast.

.changeset/silly-balloons-stare.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+After login, redirect to orders page instead of an account overview page. This also removes the account overview page.

.changeset/yellow-cougars-allow.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+If a customer is already logged in, we want to redirect them back to their account pages if they are trying to hit one of the non-logged-in customer auth routes. The prevents any side effects that may occur trying to re-auth the client. This is done by providing a root layout.tsx page under the (auth) route group.

.changeset/young-pugs-dream.md

@@ -0,0 +1,5 @@
+---
+"@bigcommerce/catalyst-core": minor
+---
+
+Converts the change/forgot password messages over to using a toast.

.env.example

@@ -2,9 +2,9 @@
 # The control panel URL is of the form `https://store-{hash}.mybigcommerce.com`. 
 BIGCOMMERCE_STORE_HASH=
 
-# A bearer token that authorizes server-to-server requests to the GraphQL Storefront API
-# See https://developer.bigcommerce.com/docs/rest-authentication/tokens/customer-impersonation-token
-BIGCOMMERCE_CUSTOMER_IMPERSONATION_TOKEN=
+# A JWT Token for accessing the Storefront API. Enables server-to-server requests if allowed_cors_origins is omitted.
+# See https://developer.bigcommerce.com/docs/rest-authentication/tokens#storefront-tokens
+BIGCOMMERCE_STOREFRONT_TOKEN=
 
 # The Channel ID for the selling channel being serviced by this Catalyst storefront.
 # Channel ID 1 will allow you to load the same data being used on the default Stencil storefront on your store,

.github/dependabot.yml

@@ -17,3 +17,6 @@ updates:
         update-types: ['version-update:semver-major']
       - dependency-name: 'react-day-picker'
         update-types: ['version-update:semver-major']
+      # We are using the latest pre-releases for react and react-dom.
+      - dependency-name: 'react'
+      - dependency-name: 'react-dom'

.github/workflows/basic.yml

@@ -13,7 +13,7 @@ env:
   TURBO_TEAM: ${{ vars.TURBO_TEAM }}
   TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
   BIGCOMMERCE_STORE_HASH: ${{ secrets.BIGCOMMERCE_STORE_HASH }}
-  BIGCOMMERCE_CUSTOMER_IMPERSONATION_TOKEN: ${{ secrets.BIGCOMMERCE_CUSTOMER_IMPERSONATION_TOKEN }}
+  BIGCOMMERCE_STOREFRONT_TOKEN: ${{ secrets.BIGCOMMERCE_STOREFRONT_TOKEN }}
   BIGCOMMERCE_CHANNEL_ID: ${{ secrets.BIGCOMMERCE_CHANNEL_ID }}
 
 jobs:

.github/workflows/changesets-release.yml

@@ -29,6 +29,8 @@ jobs:
 
       - name: Build Packages
         run: pnpm --filter "./packages/**" build
+        env:
+          CLI_SEGMENT_WRITE_KEY: ${{ secrets.CLI_SEGMENT_WRITE_KEY }}
 
       - name: Create Release Pull Request or Publish to npm
         id: changesets

.github/workflows/regression-tests.yml

@@ -140,7 +140,7 @@ jobs:
       - name: Run Playwright tests
         run: |
           cd core
-          npx playwright test tests/ui/ --project=tests-chromium 
+          npx playwright test tests/ui/ --project=tests-chromium
 
       - uses: actions/upload-artifact@v4
         if: failure()
@@ -151,7 +151,7 @@ jobs:
 
       - name: Send slack notification
         uses: slackapi/slack-github-action@v1.26.0
-        if: ${{ steps.pr_details.outputs.draft != 'true' && failure() }}
+        if: ${{ steps.pr_details.outputs.draft != 'true' && steps.pr_details.outputs.pr && failure() }}
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
         with:
@@ -213,7 +213,7 @@ jobs:
 
       - name: Send slack notification
         uses: slackapi/slack-github-action@v1.26.0
-        if: ${{ steps.pr_details.outputs.draft != 'true' && failure() }}
+        if: ${{ steps.pr_details.outputs.draft != 'true' && steps.pr_details.outputs.pr && failure() }}
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
         with:

SECURITY.md

@@ -1,8 +1,11 @@
 # Reporting security issues
-If you have found a security vulnerability in an active open-source repository created and owned by BigCommerce, please report it to our [public bug bounty program](https://bugcrowd.com/bigcommerce). If you would prefer to submit via email, please send your report to [security@bigcommerce.com](mailto:security@bigcommerce.com)
+BigCommerce is dedicated to the responsible disclosure of security vulnerabilities.
+If you have found a security vulnerability in an active open-source repository created and owned by BigCommerce, please report it to our [public bug bounty program](https://bugcrowd.com/bigcommerce). If you would prefer to submit via email, please send your report to [security@bigcommerce.com](mailto:security@bigcommerce.com).
 
-*Note: Only submissions to our bounty program on BugCrowd will be eligible for bounties. Bounty eligibility and amounts are determined according to the program guidelines.*
+We ask that you **do not** open a public GitHub issue to report security concerns.
 
-Please ***do not*** use public issues to report security vulnerabilities.
+_Note: Only submissions to our bounty program on BugCrowd will be eligible for bounties. Bounty eligibility and amounts are determined according to the program guidelines._
 
-Bugs in 3rd-party modules should be reported to those modules’ maintainers.
+_Note: Bugs in 3rd-party modules and/or dependencies should be reported to the owners/maintainers or those modules and/or dependencies, BigCommerce has no control or authority over third party content._
+
+Thank you in advance for collaborating with us to help protect us and our customers.

core/.env.example

@@ -2,9 +2,9 @@
 # The control panel URL is of the form `https://store-{hash}.mybigcommerce.com`. 
 BIGCOMMERCE_STORE_HASH=
 
-# A bearer token that authorizes server-to-server requests to the GraphQL Storefront API
-# See https://developer.bigcommerce.com/docs/rest-authentication/tokens/customer-impersonation-token
-BIGCOMMERCE_CUSTOMER_IMPERSONATION_TOKEN=
+# A JWT Token for accessing the Storefront API. Enables server-to-server requests if allowed_cors_origins is omitted.
+# See https://developer.bigcommerce.com/docs/rest-authentication/tokens#storefront-tokens
+BIGCOMMERCE_STOREFRONT_TOKEN=
 
 # The Channel ID for the selling channel being serviced by this Catalyst storefront.
 # Channel ID 1 will allow you to load the same data being used on the default Stencil storefront on your store,

core/.eslintrc.cjs

@@ -27,6 +27,12 @@ const config = {
             name: 'next/link',
             message: "Please import 'Link' from '~/components/Link' instead.",
           },
+          {
+            name: 'next/image',
+            importNames: ['default'],
+            message:
+              "Please import 'Image' from '~/components/image' instead. This component handles CDN and static image optimization.",
+          },
           {
             name: '~/i18n/routing',
             importNames: ['Link'],

core/.gitignore

@@ -43,3 +43,6 @@ client/generated
 
 # secrets
 .catalyst
+
+# Build config
+build-config.json