fix(vtex): always authenticate masterdata createDocument

Merged
AK
4d ago
+16-21

What

vtex/actions/masterdata/createDocument now always calls Master Data through vcs, which sends X-VTEX-API-AppKey / X-VTEX-API-AppToken when the VTEX app has them configured.

Why

VTEX is rejecting anonymous writes to /api/dataentities. By default (isPrivateEntity unset) this action went through vcsDeprecated, which never sends App Key/Token — only the shopper's cookie — so document creation started failing.

  • The action is already defaultVisibility = "private" (not invokable from the browser), so always using the store credentials does not expose them.
  • updateDocument and searchDocuments already use vcs — no change.
  • isPrivateEntity is kept in Props as @deprecated / @hide and ignored, so existing blocks and TS callers don't break.

Impact on sites

  • Sites with App Key/Token configured: creation is now authenticated and works again.
  • Sites without them: request stays anonymous, same as before (no regression, still fails if VTEX blocks it). They need to configure a dedicated App Key/Token whose role has Dynamic Storage → Insert or update document.
  • Sites that wrap this action in their own public action should pin the acronym and whitelist fields, since writes now carry store credentials.

Testing

  • deno task check (fmt, lint, check) passes.
  • Not yet tested against a live VTEX account with credentials.

🤖 Generated with Claude Code

Summary by cubic

Fixes createDocument so Master Data writes always go through vcs, which sends the app's App Key/Token when configured, because VTEX now rejects anonymous writes to /api/dataentities. The isPrivateEntity prop is deprecated and ignored; vcsDeprecated is no longer used.

Impact

  • Sites with App Key/Token configured: document creation is authenticated again.
  • Sites without them: requests stay anonymous, unchanged; configure credentials with Dynamic Storage → Insert or update document.
  • Wrapper actions should pin the acronym and whitelist fields since writes now carry store credentials.

Summary by CodeRabbit

  • Bug Fixes

    • Document creation requests now consistently use the app’s configured credentials.
    • Requests no longer vary based on the deprecated private-entity setting, providing more predictable behavior.

  • Deprecation

    • The private-entity configuration is deprecated and is now ignored for document creation requests.