fix: use sku from path and sanitize

src/catalog/handler.js

@@ -10,6 +10,7 @@
  * governing permissions and limitations under the License.
  */
 
+import { hasUppercase } from '../utils/product.js';
 import { errorResponse } from '../utils/http.js';
 import { handleProductLookupRequest } from './lookup.js';
 import { handleProductFetchRequest } from './fetch.js';
@@ -45,6 +46,10 @@ export default async function catalogHandler(ctx, config, request) {
 
   const [storeCode, storeViewCode, subRoute, sku] = pathSegments.slice(catalogIndex + 1);
 
+  if (hasUppercase(sku)) {
+    return errorResponse(400, 'Invalid SKU: SKU cannot contain uppercase letters');
+  }
+
   Object.assign(config, {
     storeCode, storeViewCode, subRoute, sku,
   });

src/utils/product.js

@@ -10,6 +10,8 @@
  * governing permissions and limitations under the License.
  */
 
+export const hasUppercase = (str) => /[A-Z]/.test(str);
+
 /**
  * This function combines an array of strings with interpolated
  * parameters to create a GraphQL query string.

src/utils/r2.js

@@ -51,7 +51,8 @@ export async function saveProducts(ctx, config, products) {
   const storeProductsBatch = async (batch) => {
     const storePromises = batch.map(async (product) => {
       try {
-        const { sku, name, urlKey } = product;
+        const { name, urlKey } = product;
+        const { sku } = config;
         const key = `${config.org}/${config.site}/${config.env}/${config.storeCode}/${config.storeViewCode}/products/${sku}.json`;
         const body = JSON.stringify(product);
         const customMetadata = { sku, name, urlKey };