@avocadostudio-ai/site-sdk 0.11.2 → 0.11.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/editor-cors.js +23 -1
- package/package.json +6 -6
package/dist/editor-cors.js
CHANGED
|
@@ -59,7 +59,29 @@ export function applyEditorCors(response, requestOrigin) {
|
|
|
59
59
|
return response;
|
|
60
60
|
response.headers.set("Access-Control-Allow-Origin", requestOrigin);
|
|
61
61
|
response.headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
|
|
62
|
-
|
|
62
|
+
/*
|
|
63
|
+
* `x-access-token` is not optional here, and leaving it out shut the editor.
|
|
64
|
+
*
|
|
65
|
+
* The editor installs a global `fetch` wrapper that stamps its access token on
|
|
66
|
+
* every request whose *origin* matches the orchestrator's — not whose path
|
|
67
|
+
* does. In library mode the orchestrator is mounted inside the site, so
|
|
68
|
+
* `/api/avocado/*` and `/api/editor/*` share an origin and both get the
|
|
69
|
+
* header. The orchestrator's own CORS lists it; this list did not, so once a
|
|
70
|
+
* production gate was configured and a token minted, the browser refused the
|
|
71
|
+
* preflight for `/api/editor/blocks` and `/api/editor/pages` — the component
|
|
72
|
+
* manifest the whole editing surface is derived from — with the requests
|
|
73
|
+
* never leaving the browser. The server saw nothing and logged nothing.
|
|
74
|
+
*
|
|
75
|
+
* It only bites in production with a gate on, which is why `curl` and every
|
|
76
|
+
* development run looked fine: in development no token exists to stamp.
|
|
77
|
+
*
|
|
78
|
+
* These names must stay in step with the `access-control-allow-headers` the
|
|
79
|
+
* orchestrator's own preflight sends, in
|
|
80
|
+
* `orchestrator-core/src/handler/create-orchestrator.ts`. A header one group accepts
|
|
81
|
+
* and the other rejects is indistinguishable, from the browser, from the
|
|
82
|
+
* server being down.
|
|
83
|
+
*/
|
|
84
|
+
response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, x-access-token");
|
|
63
85
|
return response;
|
|
64
86
|
}
|
|
65
87
|
export function createEditorCorsOptionsHandler() {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@avocadostudio-ai/site-sdk",
|
|
3
|
-
"version": "0.11.
|
|
3
|
+
"version": "0.11.3",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -147,17 +147,17 @@
|
|
|
147
147
|
],
|
|
148
148
|
"dependencies": {
|
|
149
149
|
"zod": "^4.3.6",
|
|
150
|
-
"@avocadostudio-ai/blocks": "^0.11.
|
|
151
|
-
"@avocadostudio-ai/preview-adapter": "^0.11.
|
|
152
|
-
"@avocadostudio-ai/shared": "^0.11.
|
|
153
|
-
"@avocadostudio-ai/richtext": "^0.11.
|
|
150
|
+
"@avocadostudio-ai/blocks": "^0.11.3",
|
|
151
|
+
"@avocadostudio-ai/preview-adapter": "^0.11.3",
|
|
152
|
+
"@avocadostudio-ai/shared": "^0.11.3",
|
|
153
|
+
"@avocadostudio-ai/richtext": "^0.11.3"
|
|
154
154
|
},
|
|
155
155
|
"peerDependencies": {
|
|
156
156
|
"next": ">=15.0.0",
|
|
157
157
|
"react": ">=19.0.0",
|
|
158
158
|
"react-dom": ">=19.0.0",
|
|
159
159
|
"better-sqlite3": ">=12.0.0",
|
|
160
|
-
"@avocadostudio-ai/orchestrator-core": "^0.11.
|
|
160
|
+
"@avocadostudio-ai/orchestrator-core": "^0.11.3"
|
|
161
161
|
},
|
|
162
162
|
"peerDependenciesMeta": {
|
|
163
163
|
"@avocadostudio-ai/orchestrator-core": {
|