fix(vtex/proxy): manual redirect for share + vtexid auth endpoints

[JonasJesus42]

Summary

The VTEX cart-share endpoint (/api/io/_v/share/<id>) responds 302 with a Set-Cookie restoring the orderForm, then redirects to /checkout?step=payment. The default redirect:"follow" in createVtexCheckoutProxy lets the fetch consume the 302 internally, so the intermediate Set-Cookie is dropped and the browser lands on an empty checkout.

The vtexid auth-redirect endpoints (/api/vtexid/pub/authentication/{redirect,finish}, /api/vtexid/oauth/redirect) hit the same trap: they carry post-login cookies and a Location that often points back to the worker host — fetch follows it, Cloudflare sees a same-host subrequest loop and returns 404.

Switch redirect to "manual" for these paths so the 302 + Set-Cookie flow through to the browser, which then follows the Location with the cookie applied. Existing Set-Cookie domain rewriting and Location rewriting in the proxy already handle the response correctly.

Repro

With the A/B worker active on a VTEX store, opening a cart-share URL like /api/io/_v/share/<id>?step=payment opens /checkout with no orderForm. Reproduced on bagaggio; the production site is currently shipping a per-site worker-entry workaround (proxyManualRedirect). This framework fix unblocks every store using createVtexCheckoutProxy.

Test plan

• Manual: open a cart-share URL on a VTEX site with the worker proxy active — checkout should open at step=payment with the shared cart applied
• Manual: complete a VTEX ID login flow — the post-login redirect should land logged in (no 404)
• Manual: existing checkout / logout flows still work (paths already on manual)

🤖 Generated with Claude Code

---

Summary by cubic

Switches createVtexCheckoutProxy to use manual redirects for VTEX cart-share and vtexid auth endpoints so 302 responses with Set-Cookie reach the browser. Fixes empty checkout after share links and prevents 404 loops after login.

• Bug Fixes
  • Cart-share (/api/io/_v/share/<id>) now restores the orderForm and lands on /checkout?step=payment.
  • VTEX ID auth redirects (/api/vtexid/pub/authentication/{redirect,finish}, /api/vtexid/oauth/redirect) now keep post-login cookies and avoid same-host redirect loops.

^{Written for commit 1e64377. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}