fix(core): fix locale validation for disabled localization and pvt routes

[ArthurTriis1]

Problem

validateLocaleForHostname has three bugs that cause 404 on all SSR pages when upgrading to FastStore v4:

1. Wrong config import

The function imports from discovery.config.default.js (FastStore default config only) instead of discovery.config (merged default + store config). All other utils in the same codebase use discovery.config.

This means any locale bindings defined in the store's discovery.config.js are completely ignored during validation.

2. localization.enabled flag not respected

When localization.enabled: false, the function still runs full hostname/binding validation and returns notFound: true for any non-localhost host.

All other functions in bindingPaths.ts correctly check !storeConfig.localization?.enabled and return early — validateLocaleForHostname was the only one missing this check.

3. /pvt/ routes incorrectly validated

withLocaleValidationSSR is applied to all SSR pages including B2B portal pages under /pvt/. These are private authenticated routes that have no relationship to storefront locale routing and should never be blocked by locale validation.

Fix

1. Import fix: discovery.config.default.js → discovery.config
2. enabled check: Skip validation when localization.enabled is false, consistent with bindingPaths.ts
3. pvt bypass: Skip locale validation for routes starting with /pvt/

Impact

Stores upgrading to v4 with localization.enabled: false (the default) were getting 404 on all SSR pages (/pvt/account, /pvt/organization-account/..., etc.) in any non-localhost environment.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Locale validation now correctly short-circuits when localization is disabled, preventing unnecessary validation and avoiding false negatives.
  • Locale validation is skipped for private/authenticated routes, ensuring those requests proceed without hostname-based locale checks and improving request handling for protected paths.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 19e190a7-d964-46ad-9321-207661477c2f

📥 Commits

Reviewing files that changed from the base of the PR and between 3312cd1 and 4916693.

📒 Files selected for processing (1)

• packages/core/src/utils/localization/validateLocaleForHostname.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/core/src/utils/localization/validateLocaleForHostname.ts

---

Walkthrough

Two localization validation utilities add early-return short-circuits to skip hostname/locale binding validation in specific scenarios: when localization is disabled in store configuration, and when requests target private/authenticated routes (paths prefixed with /pvt/).

Changes

Localization Validation Short-Circuits

Layer / File(s)	Summary
Localization-disabled bypass packages/core/src/utils/localization/validateLocaleForHostname.ts	Import source updated to discovery.config. Function now returns early with true when storeConfig.localization?.enabled is falsy, bypassing hostname/locale binding validation entirely when localization is disabled.
Private route bypass packages/core/src/utils/localization/withLocaleValidation.ts	withLocaleValidationSSR extracts the request pathname from req.url, checks if it starts with /pvt/, and if so, immediately delegates to the original getServerSidePropsFn without validating the locale against the hostname.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• vtex/faststore#3216: Also gates localization-dependent behavior on storeConfig.localization?.enabled.
• vtex/faststore#3269: Modifies validateLocaleForHostname.ts validation and hostname handling.

Suggested labels

bug

Suggested reviewers

• lemagnetic
• lariciamota
• gabpaladino

When locales nap and flags go dim,
Private paths pass by on a whim,
A short-circuit hums, validation sleeps,
Lightweight routes make lighter heaps. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the two main fixes in the changeset: locale validation for disabled localization and private routes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/locale-validation-pvt-routes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[pkg-pr-new]

Open in StackBlitz

@faststore/api

yarn add https://pkg.pr.new/vtex/faststore/@faststore/api@4916693.tgz

@faststore/cli

yarn add https://pkg.pr.new/vtex/faststore/@faststore/cli@4916693.tgz

@faststore/components

yarn add https://pkg.pr.new/vtex/faststore/@faststore/components@4916693.tgz

@faststore/core

yarn add https://pkg.pr.new/vtex/faststore/@faststore/core@4916693.tgz

@faststore/diagnostics

yarn add https://pkg.pr.new/vtex/faststore/@faststore/diagnostics@4916693.tgz

@faststore/lighthouse

yarn add https://pkg.pr.new/vtex/faststore/@faststore/lighthouse@4916693.tgz

@faststore/sdk

yarn add https://pkg.pr.new/vtex/faststore/@faststore/sdk@4916693.tgz

@faststore/ui

yarn add https://pkg.pr.new/vtex/faststore/@faststore/ui@4916693.tgz

commit: 4916693

[hellofanny]

Nice catch! Thanks! 🚀