@akinon/projectzero 2.0.79-beta.1 → 2.0.79-rc.0

package/app-template/src/app/api/preview/link/route.ts

@@ -1,115 +0,0 @@
-import { isValidPreviewId, PREVIEW_ID_QUERY_PARAM } from '@akinon/next/utils/preview';
-import {
-  DEFAULT_PREVIEW_LINK_TTL_SECONDS,
-  signPreviewToken
-} from '@akinon/next/utils/preview-token';
-import { NextRequest, NextResponse } from 'next/server';
-
-/**
- * Mints a signed, expiring preview entry token for the theme editor.
- *
- * The editor is a static SPA on another origin and must never hold the
- * storefront's PREVIEW_SECRET. Instead it proves it is an editor user by
- * forwarding its Omnitron session token; this handler verifies that token
- * against Omnitron (`OMNITRON_URL`) and answers with a token the editor puts
- * on the link as `?preview=<token>`. The link opens exactly one preview and
- * stops working after PREVIEW_LINK_TTL_SECONDS (default 24h).
- *
- * CORS is open on purpose: the request carries no cookies, only the caller's
- * Omnitron token, and the response is worthless without one.
- */
-const CORS_HEADERS = {
-  'Access-Control-Allow-Origin': '*',
-  'Access-Control-Allow-Methods': 'GET, OPTIONS',
-  'Access-Control-Allow-Headers': 'Authorization, Content-Type',
-  'Access-Control-Max-Age': '600',
-  'Cache-Control': 'no-store'
-};
-
-const json = (body: Record<string, unknown>, status: number) =>
-  NextResponse.json(body, { status, headers: CORS_HEADERS });
-
-export async function OPTIONS() {
-  return new NextResponse(null, { status: 204, headers: CORS_HEADERS });
-}
-
-/** Bounded wait for Omnitron — an unreachable host must fail fast, not hang the editor. */
-const OMNITRON_TIMEOUT_MS = 8_000;
-
-/** True when Omnitron accepts the token as a signed-in user. */
-const isEditorUser = async (
-  omnitronUrl: string,
-  authorization: string
-): Promise<boolean> => {
-  try {
-    const response = await fetch(
-      `${omnitronUrl.replace(/\/+$/, '')}/api/v1/active_user/`,
-      {
-        headers: { Authorization: authorization, Accept: 'application/json' },
-        cache: 'no-store',
-        signal: AbortSignal.timeout(OMNITRON_TIMEOUT_MS)
-      }
-    );
-    return response.status === 200;
-  } catch {
-    return false;
-  }
-};
-
-export async function GET(request: NextRequest) {
-  const secret = process.env.PREVIEW_SECRET;
-  const omnitronUrl = process.env.OMNITRON_URL;
-  if (!secret || !omnitronUrl) {
-    return json(
-      {
-        error: 'preview-disabled',
-        message:
-          'Preview links are disabled: PREVIEW_SECRET and OMNITRON_URL must both be configured on the storefront.'
-      },
-      503
-    );
-  }
-
-  const previewId =
-    request.nextUrl.searchParams.get(PREVIEW_ID_QUERY_PARAM) ?? '';
-  if (!isValidPreviewId(previewId)) {
-    return json(
-      { error: 'invalid-preview-id', message: 'A valid preview_id is required.' },
-      400
-    );
-  }
-
-  const authorization = request.headers.get('authorization') ?? '';
-  if (!/^Token \S+$/i.test(authorization)) {
-    return json(
-      { error: 'unauthorized', message: 'An Omnitron token is required.' },
-      401
-    );
-  }
-  if (!(await isEditorUser(omnitronUrl, authorization))) {
-    return json(
-      {
-        error: 'unauthorized',
-        message: `Omnitron at ${omnitronUrl} did not accept the token (or did not answer).`
-      },
-      401
-    );
-  }
-
-  const ttl =
-    Number(process.env.PREVIEW_LINK_TTL_SECONDS) ||
-    DEFAULT_PREVIEW_LINK_TTL_SECONDS;
-  const expiresAt = Math.floor(Date.now() / 1000) + ttl;
-  const token = await signPreviewToken({ previewId, expiresAt }, secret);
-
-  return json(
-    {
-      token,
-      previewId,
-      expiresAt: new Date(expiresAt * 1000).toISOString(),
-      // Ready to append to any page url of this storefront.
-      query: `preview=${encodeURIComponent(token)}`
-    },
-    200
-  );
-}

package/app-template/src/app/api/preview/route.ts

@@ -1,96 +0,0 @@
-import { PREVIEW_ID_COOKIE, PREVIEW_ID_QUERY_PARAM } from '@akinon/next/utils/preview';
-import { verifyPreviewToken } from '@akinon/next/utils/preview-token';
-import { cookies, draftMode } from 'next/headers';
-import { redirect } from 'next/navigation';
-import { NextRequest, NextResponse } from 'next/server';
-
-/**
- * Enables/disables Next.js Draft Mode for widget previews, and records WHICH
- * named preview is being viewed.
- *
- * Visitors never call this directly — any page url carrying `?preview` is
- * redirected here by the middleware (see src/proxy.ts), and redirected back
- * to the same page once the cookies are set. With draft mode on, the widget
- * fetch layer serves `<slug>-preview-<id>` copies (falling back to live).
- *
- * The preview id rides in its own cookie rather than the url: pages keep
- * their clean addresses and links followed afterwards stay inside the same
- * preview. The cookie is folded into the pz route segment by the middleware
- * (see settings.js `pzSegments`) because the widget pages are force-static,
- * where Next.js blanks `cookies()` inside the render.
- *
- * Deny-by-default: entering preview ALWAYS requires `?preview=<token>` — a
- * signed, expiring token minted by /api/preview/link for an editor user (see
- * utils/preview-token.ts); PREVIEW_SECRET is the signing key and never
- * travels in a url. Environments without the env have preview disabled
- * entirely. Exiting never requires a token.
- */
-export async function GET(request: NextRequest) {
-  const { searchParams } = request.nextUrl;
-
-  // Only ever redirect within the site — the target comes from the query.
-  const target = searchParams.get('redirect') ?? '/';
-  let safeTarget =
-    target.startsWith('/') && !target.startsWith('//') ? target : '/';
-  // Never bounce back to a url that still carries ?preview — that would
-  // re-enter the middleware redirect and loop.
-  const targetUrl = new URL(safeTarget, request.nextUrl.origin);
-  targetUrl.searchParams.delete('preview');
-  targetUrl.searchParams.delete(PREVIEW_ID_QUERY_PARAM);
-  safeTarget = `${targetUrl.pathname}${targetUrl.search}`;
-  // URL normalization can reintroduce a protocol-relative target the first
-  // guard already rejected (e.g. '/..//evil.com' normalizes to pathname
-  // '//evil.com', which browsers resolve to https://evil.com) — re-check the
-  // FINAL string, not just the raw input.
-  if (!safeTarget.startsWith('/') || safeTarget.startsWith('//')) {
-    safeTarget = '/';
-  }
-
-  const draft = await draftMode();
-  const cookieStore = await cookies();
-
-  if (searchParams.has('exit')) {
-    draft.disable();
-    cookieStore.delete(PREVIEW_ID_COOKIE);
-    redirect(safeTarget);
-  }
-
-  const secret = process.env.PREVIEW_SECRET;
-  if (!secret) {
-    return new NextResponse(
-      'Preview is disabled: PREVIEW_SECRET is not configured.',
-      { status: 401 }
-    );
-  }
-
-  const verdict = await verifyPreviewToken(
-    searchParams.get('token') ?? '',
-    secret
-  );
-  if (verdict.ok !== true) {
-    const { reason } = verdict;
-    return new NextResponse(
-      reason === 'expired'
-        ? 'This preview link has expired — open the page from the editor again to get a fresh one.'
-        : 'Preview link is invalid or missing. Preview pages are opened from the theme editor.',
-      { status: 401 }
-    );
-  }
-  const { previewId } = verdict.claims;
-
-  draft.enable();
-  // Same flags Next gives its own draft cookie (SameSite=None; Secure outside
-  // development): the storefront may be embedded cross-site (editor,
-  // Omnitron), and a Lax id cookie would be dropped there while the draft
-  // cookie survives — draft mode on, no id, live content under a "Preview"
-  // banner. `nextUrl.protocol` is not consulted: behind a TLS-terminating
-  // proxy it reads http even in production.
-  const isDevelopment = process.env.NODE_ENV === 'development';
-  cookieStore.set(PREVIEW_ID_COOKIE, previewId, {
-    path: '/',
-    httpOnly: true,
-    sameSite: isDevelopment ? 'lax' : 'none',
-    secure: !isDevelopment
-  });
-  redirect(safeTarget);
-}

package/app-template/src/utils/__tests__/preview-contract.test.ts

@@ -1,223 +0,0 @@
-import {
-  isPreviewCopySlug,
-  isPreviewSlug,
-  isValidPreviewId,
-  previewSlug,
-  resolvePreviewSegment
-} from '@akinon/next/utils/preview';
-import {
-  decodePzValue,
-  encodePzValue,
-  getPzSegmentsConfig
-} from '@akinon/next/utils/pz-segments';
-import {
-  signPreviewToken,
-  verifyPreviewToken
-} from '@akinon/next/utils/preview-token';
-import { webcrypto } from 'node:crypto';
-import { TextEncoder as NodeTextEncoder } from 'node:util';
-
-// jsdom ships neither Web Crypto nor TextEncoder; the token code needs both.
-if (!globalThis.crypto?.subtle) {
-  Object.defineProperty(globalThis, 'crypto', { value: webcrypto });
-}
-if (typeof globalThis.TextEncoder === 'undefined') {
-  Object.defineProperty(globalThis, 'TextEncoder', { value: NodeTextEncoder });
-}
-
-/**
- * The half of the preview contract this app owns: which named preview a
- * request belongs to, and the widget slug that preview's copies live under.
- * The theme editor builds the same slugs — if these change, previews stop
- * resolving and every page silently falls back to live.
- */
-
-const req = (cookie?: string, draft = true) => ({
-  cookies: {
-    get: (name: string) => {
-      if (name === '__prerender_bypass') {
-        return draft ? { value: 'bypass' } : undefined;
-      }
-      return name === 'pz-preview-id' && cookie !== undefined
-        ? { value: cookie }
-        : undefined;
-    }
-  }
-});
-
-describe('preview id validation', () => {
-  it('accepts the ids the editor produces', () => {
-    expect(isValidPreviewId('staging')).toBe(true);
-    expect(isValidPreviewId('black-friday')).toBe(true);
-    expect(isValidPreviewId('kis-kampanyasi-2026')).toBe(true);
-    expect(isValidPreviewId('a'.repeat(32))).toBe(true);
-  });
-
-  it('rejects anything that could escape the slug', () => {
-    // Ids arrive from a cookie, so this is a trust boundary.
-    expect(isValidPreviewId('')).toBe(false);
-    expect(isValidPreviewId('-leading')).toBe(false);
-    expect(isValidPreviewId('Upper')).toBe(false);
-    expect(isValidPreviewId('has space')).toBe(false);
-    expect(isValidPreviewId('../etc')).toBe(false);
-    expect(isValidPreviewId('a'.repeat(33))).toBe(false);
-    expect(isValidPreviewId(undefined)).toBe(false);
-    // `--` is the pz segment separator; the editor never produces it.
-    expect(isValidPreviewId('a--b')).toBe(false);
-    expect(isValidPreviewId('trailing-')).toBe(false);
-  });
-});
-
-describe('preview slugs', () => {
-  it('suffixes the live slug with the preview id', () => {
-    expect(previewSlug('homepage-body-new', 'staging')).toBe(
-      'homepage-body-new-preview-staging'
-    );
-    expect(previewSlug('homepage-body-new', 'black-friday')).toBe(
-      'homepage-body-new-preview-black-friday'
-    );
-  });
-
-  it('recognises its own output so previews are never nested', () => {
-    expect(isPreviewSlug('homepage-body-new-preview-staging')).toBe(true);
-    expect(isPreviewSlug('homepage-body-new')).toBe(false);
-    // The old single-preview suffix carries no id and is not one of ours.
-    expect(isPreviewSlug('homepage-body-new-preview')).toBe(false);
-  });
-
-  it('only treats a slug as a copy when it belongs to THIS preview', () => {
-    expect(isPreviewCopySlug('header-preview-staging', 'staging')).toBe(true);
-    // Another preview's copy is not ours to skip.
-    expect(isPreviewCopySlug('header-preview-winter', 'staging')).toBe(false);
-    // A live custom page whose name merely looks like a copy still gets its
-    // overlay — the shape-only check used to skip it and render live.
-    expect(isPreviewCopySlug('page-summer-preview-2026', 'staging')).toBe(
-      false
-    );
-    expect(isPreviewCopySlug('header', '')).toBe(false);
-  });
-});
-
-describe('the preview id inside the pz segment', () => {
-  const settings = {
-    pzSegments: { segments: [{ name: 'preview' }] }
-  };
-  const config = getPzSegmentsConfig(settings);
-  const url = encodeURIComponent('https://shop.test/collections/summer--sale');
-
-  it('round-trips a url containing the separator with a preview id after it', () => {
-    const encoded = encodePzValue(
-      { locale: 'en', currency: 'usd', url, preview: 'staging' },
-      config
-    );
-    expect(decodePzValue(encoded, config)).toEqual({
-      locale: 'en',
-      currency: 'usd',
-      url,
-      preview: 'staging'
-    });
-  });
-
-  it('round-trips such a url when no preview is active', () => {
-    const encoded = encodePzValue(
-      { locale: 'en', currency: 'usd', url, preview: '' },
-      config
-    );
-    expect(decodePzValue(encoded, config)).toEqual({
-      locale: 'en',
-      currency: 'usd',
-      url,
-      preview: ''
-    });
-  });
-
-  it('still reads a plain segment positionally', () => {
-    expect(decodePzValue('tr--try--%2F--kis', config)).toEqual({
-      locale: 'tr',
-      currency: 'try',
-      url: '%2F',
-      preview: 'kis'
-    });
-  });
-});
-
-describe('resolvePreviewSegment', () => {
-  it('passes a valid cookie through to the pz segment', () => {
-    expect(resolvePreviewSegment(req('staging'))).toBe('staging');
-  });
-
-  it('yields no preview for a missing or tampered cookie', () => {
-    expect(resolvePreviewSegment(req())).toBe('');
-    expect(resolvePreviewSegment(req(''))).toBe('');
-    expect(resolvePreviewSegment(req('../../evil'))).toBe('');
-    expect(resolvePreviewSegment(req('Staging'))).toBe('');
-  });
-
-  it('ignores the id cookie unless draft mode is on', () => {
-    // An anonymous visitor forging pz-preview-id must not get a private
-    // cache key per request — without the draft cookie the id is inert.
-    expect(resolvePreviewSegment(req('staging', false))).toBe('');
-  });
-});
-
-describe('signed preview links', () => {
-  const secret = 'k3y';
-  const now = 1_800_000_000_000; // ms
-  const inAnHour = Math.floor(now / 1000) + 3600;
-
-  it('round-trips the preview id and expiry it was minted with', async () => {
-    const token = await signPreviewToken(
-      { previewId: 'kis-kampanyasi', expiresAt: inAnHour },
-      secret
-    );
-    expect(token.startsWith('v1.kis-kampanyasi.')).toBe(true);
-    expect(await verifyPreviewToken(token, secret, now)).toEqual({
-      ok: true,
-      claims: { previewId: 'kis-kampanyasi', expiresAt: inAnHour }
-    });
-  });
-
-  it('dies at its expiry', async () => {
-    const token = await signPreviewToken(
-      { previewId: 'staging', expiresAt: inAnHour },
-      secret
-    );
-    expect(await verifyPreviewToken(token, secret, inAnHour * 1000)).toEqual({
-      ok: false,
-      reason: 'expired'
-    });
-  });
-
-  it('rejects tampering with the id, the expiry or the key', async () => {
-    const token = await signPreviewToken(
-      { previewId: 'staging', expiresAt: inAnHour },
-      secret
-    );
-    const [v, , exp, sig] = token.split('.');
-    expect(
-      (await verifyPreviewToken(`${v}.winter.${exp}.${sig}`, secret, now)).ok
-    ).toBe(false);
-    expect(
-      (await verifyPreviewToken(`${v}.staging.${exp + 1}.${sig}`, secret, now))
-        .ok
-    ).toBe(false);
-    expect((await verifyPreviewToken(token, 'other-key', now)).ok).toBe(false);
-  });
-
-  it('treats anything else as malformed — including the old raw secret', async () => {
-    expect(await verifyPreviewToken('pz-preview-local', secret, now)).toEqual({
-      ok: false,
-      reason: 'malformed'
-    });
-    expect((await verifyPreviewToken('', secret, now)).ok).toBe(false);
-    expect(
-      (await verifyPreviewToken('v1.Bad Id.123.sig', secret, now)).ok
-    ).toBe(false);
-  });
-
-  it('refuses to mint for an invalid id', async () => {
-    await expect(
-      signPreviewToken({ previewId: '../x', expiresAt: inAnHour }, secret)
-    ).rejects.toThrow();
-  });
-});