fix: forward an={account} on VTEX ID outbound calls

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Fixed
+
+- Add `an={account}` query string to VTEX ID authentication and user info calls.
+
 ## [2.177.1] - 2026-05-11
 
 ### Added

node/__tests__/resolvers/paths.test.ts

@@ -0,0 +1,58 @@
+import paths from '../../resolvers/paths'
+
+describe('VTEX ID paths attach ?an={account}', () => {
+  const ACCOUNT = 'storecomponents'
+
+  it('accessKeySignIn carries an=account', () => {
+    expect(paths.accessKeySignIn(ACCOUNT)).toBe(
+      'http://vtexid.vtex.com.br/api/vtexid/pub/authentication/accesskey/validate?an=storecomponents'
+    )
+  })
+
+  it('classicSignIn carries an=account', () => {
+    expect(paths.classicSignIn(ACCOUNT)).toBe(
+      'http://vtexid.vtex.com.br/api/vtexid/pub/authentication/classic/validate?an=storecomponents'
+    )
+  })
+
+  it('setPassword carries an=account', () => {
+    expect(paths.setPassword(ACCOUNT)).toBe(
+      'http://vtexid.vtex.com.br/api/vtexid/pub/authentication/classic/setpassword?an=storecomponents'
+    )
+  })
+
+  it('sendEmailVerification carries an=account', () => {
+    expect(paths.sendEmailVerification(ACCOUNT)).toBe(
+      'http://vtexid.vtex.com.br/api/vtexid/pub/authentication/accesskey/send?an=storecomponents'
+    )
+  })
+
+  it('getUser keeps scope and adds an', () => {
+    const url = paths.getUser(ACCOUNT)
+
+    expect(url).toContain('scope=storecomponents')
+    expect(url).toContain('an=storecomponents')
+  })
+
+  it('sessionToken keeps accountName and does NOT add an (relative callbackUrl/returnUrl trip backend account-host validation)', () => {
+    const url = paths.sessionToken(ACCOUNT, ACCOUNT, '/foo', '/bar')
+
+    expect(url).toContain('accountName=storecomponents')
+    expect(url).not.toContain('an=')
+    expect(url).toContain('callbackUrl=/foo')
+    expect(url).toContain('returnUrl=/bar')
+  })
+
+  it('loginSessions and logOutFromSession remain unchanged (regression guard)', () => {
+    expect(paths.loginSessions(ACCOUNT, ACCOUNT)).toContain(
+      'an=storecomponents'
+    )
+    expect(
+      paths.logOutFromSession({
+        scope: ACCOUNT,
+        account: ACCOUNT,
+        sessionId: 'abc',
+      })
+    ).toContain('an=storecomponents')
+  })
+})

node/resolvers/auth/index.ts

@@ -207,7 +207,7 @@ export const mutations = {
     } = await makeRequest({
       ctx: ioContext,
       method: 'POST',
-      url: paths.accessKeySignIn(),
+      url: paths.accessKeySignIn(ioContext.account),
       body: {
         accesskey: args.code,
         authenticationToken: VtexSessionToken,
@@ -238,7 +238,7 @@ export const mutations = {
     } = await makeRequest({
       ctx: ioContext,
       method: 'POST',
-      url: paths.classicSignIn(),
+      url: paths.classicSignIn(ioContext.account),
       body: {
         authenticationToken: VtexSessionToken,
         login: args.email,
@@ -343,7 +343,7 @@ export const mutations = {
     } = await makeRequest({
       ctx: ioContext,
       method: 'POST',
-      url: paths.setPassword(),
+      url: paths.setPassword(ioContext.account),
       body,
     })
 
@@ -379,7 +379,7 @@ export const mutations = {
     } = await makeRequest({
       ctx: ioContext,
       method: 'POST',
-      url: paths.setPassword(),
+      url: paths.setPassword(ioContext.account),
       body,
       vtexIdVersion: args.vtexIdVersion,
     })
@@ -409,7 +409,7 @@ export const mutations = {
     await makeRequest({
       ctx: ioContext,
       method: 'POST',
-      url: paths.sendEmailVerification(),
+      url: paths.sendEmailVerification(ioContext.account),
       body: {
         authenticationToken: VtexSessionToken,
         email: args.email,

node/resolvers/paths.ts

@@ -48,15 +48,18 @@ const paths = {
     `${paths.gateway(account)}/pub/sessions/${sessionId}/tokens`,
 
   /** VTEX ID API */
-  accessKeySignIn: () => `${paths.vtexIdPub}/authentication/accesskey/validate`,
-  classicSignIn: () => `${paths.vtexIdPub}/authentication/classic/validate`,
-  getUser: (accountName: any) =>
-    `${paths.vtexIdPvt}/user/detailedinfo?scope=${accountName}`,
+  accessKeySignIn: (account: string) =>
+    `${paths.vtexIdPub}/authentication/accesskey/validate?an=${account}`,
+  classicSignIn: (account: string) =>
+    `${paths.vtexIdPub}/authentication/classic/validate?an=${account}`,
+  getUser: (accountName: string) =>
+    `${paths.vtexIdPvt}/user/detailedinfo?scope=${accountName}&an=${accountName}`,
   oAuth: (authenticationToken: any, providerName: any) =>
     `${paths.vtexIdPub}/authentication/oauth/redirect?authenticationToken=${authenticationToken}&providerName=${providerName}`,
-  setPassword: () => `${paths.vtexIdPub}/authentication/classic/setpassword`,
-  sendEmailVerification: () =>
-    `${paths.vtexIdPub}/authentication/accesskey/send`,
+  setPassword: (account: string) =>
+    `${paths.vtexIdPub}/authentication/classic/setpassword?an=${account}`,
+  sendEmailVerification: (account: string) =>
+    `${paths.vtexIdPub}/authentication/accesskey/send?an=${account}`,
   sessionToken: (scope: any, account: any, redirect = '/', returnUrl = '/') =>
     `${
       paths.vtexIdPub