fix: locale validation pvt routes

[ArthurTriis1]

Problem

validateLocaleForHostname has three bugs that cause 404 on all SSR pages when upgrading to FastStore v4:

1. Wrong config import

The function imports from discovery.config.default.js (FastStore default config only) instead of discovery.config (merged default + store config). All other utils in the same codebase use discovery.config.

This means any locale bindings defined in the store's discovery.config.js are completely ignored during validation.

2. localization.enabled flag not respected

When localization.enabled: false, the function still runs full hostname/binding validation and returns notFound: true for any non-localhost host.

All other functions in bindingPaths.ts correctly check !storeConfig.localization?.enabled and return early — validateLocaleForHostname was the only one missing this check.

3. /pvt/ routes incorrectly validated

withLocaleValidationSSR is applied to all SSR pages including B2B portal pages under /pvt/. These are private authenticated routes that have no relationship to storefront locale routing and should never be blocked by locale validation.

Fix

1. Import fix: discovery.config.default.js → discovery.config
2. enabled check: Skip validation when localization.enabled is false, consistent with bindingPaths.ts
3. pvt bypass: Skip locale validation for routes starting with /pvt/

Impact

Stores upgrading to v4 with localization.enabled: false (the default) were getting 404 on all SSR pages (/pvt/account, /pvt/organization-account/..., etc.) in any non-localhost environment.

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• Bug Fixes
  • Localization validation now correctly respects the localization enabled/disabled setting, skipping unnecessary checks when disabled.
  • Private routes are now properly exempted from locale validation, preventing validation failures on internal endpoints.

[coderabbitai]

Walkthrough

The PR adds two early-exit conditions for locale validation: bypassing validation when localization is disabled via storeConfig.localization?.enabled, and skipping validation for private routes matching /pvt/ paths. Both utilities now short-circuit to avoid unnecessary hostname/locale binding checks.

Changes

Localization Validation Gating

Layer / File(s)	Summary
Config-based gating in validateLocaleForHostname packages/core/src/utils/localization/validateLocaleForHostname.ts	Import source for storeConfig changes from default config to the active config. An early-return exits with true when storeConfig.localization?.enabled is falsy, skipping all downstream hostname-binding validation.
Private route bypass in withLocaleValidationSSR packages/core/src/utils/localization/withLocaleValidation.ts	Extracts pathname from req.url by stripping query parameters. Validation is skipped and the original handler delegates immediately when the pathname starts with /pvt/.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• vtex/faststore#3358: Identical code-level fixes to validateLocaleForHostname import and short-circuit logic, plus /pvt/ pathname bypass in withLocaleValidationSSR.
• vtex/faststore#3296: Also gates localization behavior behind storeConfig.localization?.enabled in validateSession to skip locale/currency/channel recomputation.

Suggested labels

bug

Suggested reviewers

• renatomaurovtex

Poem

🔒 When locales must hide behind the gate,
And /pvt/ paths bypass the validate,
The config's word becomes the only fate—
No binding checks for routes that authenticate. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title 'fix: locale validation pvt routes' directly and clearly describes the main changes: fixing locale validation for /pvt/ routes, which is the primary bug fix in this changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/locale-validation-pvt-routes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

[sonar-workflows]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• 0.00% Coverage (15.20% Estimated after merge)
• 0.00% Duplicated Code (1.70% Estimated after merge)

Project ID: vtex_faststore_f0a862d5-9557-49f9-8d09-de40caa76622

View in SonarQube

[hellofanny]

Approving! It's already merged on main

@lemagnetic taggin you just to let you know 😉