@W-15248536@ - [v3] Google Search Console fix createCodeVerifier

[adamraya]

Problem
When Google crawler calls createCodeVerifier() to create the code verifier we use for the PKCE authentication flow, the result from nanoid() is the same in two different runs. This causes the same generated code_challenge to be used twice thus Google crawler gets the error stating that the PKCE code_challenge must be unique error.

The root of this issue is the fact that Googlebot’s implementation of random() is deterministic, meaning that it won’t produce unique random values from one string of runs to the next.

The result is that Google crawler indexes the error page instead of the proper page.

Solution
Add entropy to nanoid() using the library seedrandom to avoid duplicated code_challenge sent to SCAPI by Google crawler browser.

Nanoid docs on Custom Random Bytes Generator.

How to Test-Drive This PR

1. Follow the steps to reproduce in the quip doc: https://salesforce.quip.com/U1k5A2fXzpym#temp:C:DXJd70645fbe1a44e999dff07b74
2. Verify Google Search Console can successfully index the indicated URLs.

[joeluong-sfcc]

yarn run check:size results:

current main branch:

 PASS  lib/index.cjs.js: 44.84KB < maxSize 45KB (gzip) 

 PASS  lib/index.esm.js: 44.73KB < maxSize 45KB (gzip) 

 PASS  commerce-sdk-isomorphic-with-deps.tgz: 338.08KB < maxSize 350KB (gzip) 

google-search-console-fix-v3 branch:

 PASS  lib/index.cjs.js: 44.96KB < maxSize 46KB (gzip) 

 PASS  lib/index.esm.js: 44.84KB < maxSize 46KB (gzip) 

 PASS  commerce-sdk-isomorphic-with-deps.tgz: 390.52KB < maxSize 400KB (gzip)

We go from 338.08KB to 390.52KB which is a decent jump for commerce-sdk-isomorphic-with-deps.tgz. We should try to make this package should be as lightweight as possible so just wanted to ask a few things:

1. Might be a silly question, but is it possible for us to add entropy without the use of a third party package?
2. Is there a specific reason why we use seedrandom versus an alternative package that provides similar functionality? Mostly asking if there's an alternative package we could use that is smaller in size

This PR looks good otherwise, just wanted to check for the reasoning behind the implementation

[adamraya]

We go from 338.08KB to 390.52KB which is a decent jump for commerce-sdk-isomorphic-with-deps.tgz. We should try to make this package should be as lightweight as possible so just wanted to ask a few things:

1. Might be a silly question, but is it possible for us to add entropy without the use of a third party package?
2. Is there a specific reason why we use seedrandom versus an alternative package that provides similar functionality? Mostly asking if there's an alternative package we could use that is smaller in size

This PR looks good otherwise, just wanted to check for the reasoning behind the implementation

No silly question at all. I did notice the same. I think it's a good convo to have before making a decision.

The reasons to use seedrandom.

1. It's documented on the nanoid docs. https://github.com/ai/nanoid?tab=readme-ov-file#custom-random-bytes-generator
2. It's a popular NPM package with a high number of downloads. https://www.npmjs.com/package/seedrandom

We need to find a solution that doesn't rely on Math.random() to add entropy which is the source of the issue. I didn't find an alternative to seedrandom.

The Googlebot doesn't use a deterministic value when using seedrandom. That's why we get a new number from one run to the other.

[joeluong-sfcc]

Thought about this some more, I think the size change should be ok since the minified bundle size is the size that we care more about, and that has only increased slightly.

[bendvc]

Is this because that lib has a lot of docs or large source that is being added to the gzip?

[adamraya]

I assume that's the reason as you can see in the previous Joel's comment comparing the before and after file sizes. We added two libraries seedrandom as a dependency and @types/seedrandom as a devDependency.

But as later Joel also mentions the minimized bundle size is the size we care about and that one only increased slightly, 1KB.