Fix: Prevent unnecessary cart clearing on checkout step

[pabloppupulin]

Context

A customer reported an issue where, after completing a purchase, attempting another purchase results in all items being removed from the cart at the checkout step.

Steps to reproduce:

1. Go to the store login page.
2. Log in with a test user.
3. Add items to the cart (OrderFormId A).
4. Go to checkout and complete the order (OrderPlaced page). A new OrderFormId B is generated automatically.
5. From OrderPlaced, go back to home and add new items to the cart (OrderFormId B).
6. Go to checkout. Items are displayed correctly initially.
7. Proceed to the next step, and all items are removed.

⚠️ This issue is intermittent and does not occur for all users/accounts.

Root Cause

• Upon entering the checkout for the second time, storefront-permissions triggers a SetProfile API call.
• Even though all session data remains the same, SetProfile is designed to clear the cart when the OrderFormId is present.
• The issue occurs because SetProfile is mistakenly detecting a session change and invoking the cart reset logic.

Solution

✅ Implemented a session hash validation to prevent unnecessary cart clearing.

• The hash is generated using OrganizationId + CostCenterId.
• Cart clearing is now only triggered if a real organization or cost center change occurs (e.g., switching organizations).
• This ensures that even if SetProfile is triggered multiple times due to other events, the cart remains intact as long as the session hash remains unchanged.

Impact

• 🛒 Prevents unexpected cart clearing in checkout flow.
• 🚀 Ensures smoother user experience for B2B customers.
• 📉 Reduces unnecessary session-related API calls.

[vtex-io-ci-cd]

Hi! I'm VTEX IO CI/CD Bot and I'll be helping you to publish your app! 🤖

Please select which version do you want to release:

• Patch (backwards-compatible bug fixes)

• Minor (backwards-compatible functionality)

• Major (incompatible API changes)

And then you just need to merge your PR when you are ready! There is no need to create a release commit/tag.

• No thanks, I would rather do it manually 😞

[vtex-io-docs-bot]

Beep boop 🤖

I noticed you didn't make any changes at the docs/ folder

• There's nothing new to document 🤔
• I'll do it later 😞

In order to keep track, I'll create an issue if you decide now is not a good time

• I just updated 🎉🎉

[github-actions]

	Messages
📖	❤️ Thanks!
📖	🎉 PR additions = 25, PR deletions = 10

Generated by 🚫 dangerJS against f0870f2

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[vtex-io-ci-cd]

Your PR has been merged! App is being published. 🚀
Version 1.45.1 → 1.45.2

After the publishing process has been completed (check #vtex-io-releases) and doing A/B tests with the new version, you can deploy your release by running:

vtex deploy vtex.storefront-permissions@1.45.2

After that your app will be updated on all accounts.

For more information on the deployment process check the docs. 📖