From 115718cdf5d258a1e9ac3310c6f6b8c69a8d5f1a Mon Sep 17 00:00:00 2001
From: James Meng <james.meng@shopify.com>
Date: Thu, 28 Nov 2024 08:56:41 -0800
Subject: [PATCH] Use URL constructor to grab redirect pathname

---
 .../theme-environment/storefront-session.test.ts  | 15 +++++++++++++++
 .../theme-environment/storefront-session.ts       |  3 ++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/packages/theme/src/cli/utilities/theme-environment/storefront-session.test.ts b/packages/theme/src/cli/utilities/theme-environment/storefront-session.test.ts
index ff27317564..5c25602acd 100644
--- a/packages/theme/src/cli/utilities/theme-environment/storefront-session.test.ts
+++ b/packages/theme/src/cli/utilities/theme-environment/storefront-session.test.ts
@@ -83,6 +83,21 @@ describe('Storefront API', () => {
       // Then
       expect(isProtected).toBe(false)
     })
+
+    test('ignores query params', async () => {
+      // Given
+      vi.mocked(fetch)
+        .mockResolvedValueOnce(response({status: 200, url: 'https://store.myshopify.com/random?a=b'}))
+        .mockResolvedValueOnce(response({status: 200, url: 'https://store.myshopify.com/password?a=b'}))
+
+      // When
+      const redirectToRandomPath = await isStorefrontPasswordProtected('store.myshopify.com')
+      const redirectToPasswordPath = await isStorefrontPasswordProtected('store.myshopify.com')
+
+      // Then
+      expect(redirectToRandomPath).toBe(false)
+      expect(redirectToPasswordPath).toBe(true)
+    })
   })
 
   describe('getStorefrontSessionCookies', () => {
diff --git a/packages/theme/src/cli/utilities/theme-environment/storefront-session.ts b/packages/theme/src/cli/utilities/theme-environment/storefront-session.ts
index d8bbb15731..b7510e0d79 100644
--- a/packages/theme/src/cli/utilities/theme-environment/storefront-session.ts
+++ b/packages/theme/src/cli/utilities/theme-environment/storefront-session.ts
@@ -11,7 +11,8 @@ export async function isStorefrontPasswordProtected(storeURL: string): Promise<b
     method: 'GET',
   })
 
-  return response.url.endsWith('/password')
+  const redirectLocation = new URL(response.url)
+  return redirectLocation.pathname.endsWith('/password')
 }
 
 /**