fix: forward an={account} on VTEX ID outbound calls

[vsseixaso]

Summary

Some axios-based callers in node/resolvers/auth and node/resolvers/profile/services were hitting vtexid.vtex.com.br without the an={account} query string. This caused the backend to reject some flows in production — for example, pub/authentication/accesskey/send returns HTTP 401 from storecomponents/master and the same call returns 200 once an=storecomponents is present (validated below).

This change adds ?an={account} to every direct call that previously omitted it, while keeping the host (vtexid.vtex.com.br) and the route shape unchanged.

Endpoints touched

Path	Status
pub/authentication/accesskey/validate	adds an
pub/authentication/accesskey/send	adds an
pub/authentication/classic/validate	adds an
pub/authentication/classic/setpassword	adds an
pvt/user/detailedinfo	adds an
pub/authentication/start (sessionToken)	intentionally not changed

pub/authentication/start is left without an because the backend validates that the host of callbackUrl and returnUrl matches the account in an. Callers in this codebase pass relative URLs (/), so adding an there returns HTTP 400 (The host and {callbackUrl,returnUrl} accounts do not match).

getAuthenticatedUser and IdentityClient.getUserWithToken already propagate an (via JanusClient and explicitly, respectively); loginSessions/logOutFromSession already had an in the URL.

Files

• node/resolvers/paths.ts — URL builders accept account and append &an=${account}.
• node/resolvers/auth/index.ts — 5 call sites pass ioContext.account.
• node/__tests__/resolvers/paths.test.ts — 7 unit tests for the URL builders (including a regression guard for loginSessions/logOutFromSession and an explicit assertion that sessionToken does not carry an).
• CHANGELOG.md — entry under [Unreleased] - Fixed.

Test plan

Unit suite (node/):

• yarn test → 871/871 green.

End-to-end via curl, comparing storecomponents/master (production, without the fix) against storecomponents/vulnsg (with this branch linked):

Scenario	master	vulnsg	Result
loginOptions query	200 OK	200 OK (byte-identical)	no regression
classicSignIn mutation (invalid creds)	WrongCredentials	WrongCredentials (byte-identical)	no regression
sendEmailVerification mutation (fresh email)	HTTP 401	{ sendEmailVerification: true } (200 OK)	fix unblocks the flow

Direct curls to vtexid.vtex.com.br confirmed that accesskey/{validate,send}, classic/{validate,setpassword} and pvt/user/detailedinfo accept an= without changing the response shape; only pub/authentication/start rejects an when callbackUrl/returnUrl are relative — hence the carve-out.

[vtex-io-docs-bot]

Beep boop 🤖

Thank you so much for keeping our documentation up-to-date ❤️

[vtex-io-ci-cd]

Hi! I'm VTEX IO CI/CD Bot and I'll be helping you to publish your app! 🤖

Please select which version do you want to release:

• Patch (backwards-compatible bug fixes)

• Minor (backwards-compatible functionality)

• Major (incompatible API changes)

And then you just need to merge your PR when you are ready! There is no need to create a release commit/tag.

• No thanks, I would rather do it manually 😞

[mendescamara]

[vtex-io-ci-cd]

Your PR has been merged! App is being published. 🚀
Version 2.177.1 → 2.177.2

After the publishing process has been completed (check #vtex-io-releases) and doing A/B tests with the new version, you can deploy your release by running:

vtex deploy vtex.store-graphql@2.177.2

After that your app will be updated on all accounts.

For more information on the deployment process check the docs. 📖