feat(checkout): CHECKOUT-9821 Add B2B Dev Tool#3252
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4b73a9f. Configure here.
| return false; | ||
| } catch { | ||
| return false; | ||
| } |
There was a problem hiding this comment.
Dev mode lacks environment guard, activatable in production
High Severity
isB2bDevModeEnabled has no environment guard (e.g., process.env.NODE_ENV !== 'production'), so any end user in production can add ?enableB2bDevMode to the checkout URL. This causes the B2B token flow to use a hardcoded dev appClientId and redirect authentication requests to a different API base URL. The hardcoded credential B2B_DEV_MODE_APP_CLIENT_ID will also be embedded in the production JavaScript bundle.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 4b73a9f. Configure here.
There was a problem hiding this comment.
Yeah client id is meant to be public.
bc-donfran
left a comment
bc-donfran
left a comment
There was a problem hiding this comment.
Looks safe from a sec perspective
3 participants
What/Why?
Add a removable B2B dev tool to enable calling B2B API.
This tool will be removed as part of CHECKOUT-9979.
Rollout/Rollback
Revert.
Testing
CI.
Note
Medium Risk
Introduces a dev-only path that can override B2B API base URL and client ID at runtime via a URL param, which risks accidental use in non-dev environments and changes how B2B tokens are requested.
Overview
Adds a temporary
b2b-dev-toolsmodule that enables a dev-only “B2B Dev Mode” when theenableB2bDevModeURL param is present, hardcoding a B2BbaseUrlandappClientIdoverride (with unit tests).Updates
B2BTokenActionCreator.loadB2BTokento resolveb2bApiSettings.clientId/baseUrlthrough these helpers before callinggetB2BToken, so token requests can be redirected to the dev B2B API without changing store config.Reviewed by Cursor Bugbot for commit 4b73a9f. Bugbot is set up for automated code reviews on this repo. Configure here.