@backmatter/next 0.0.35 → 0.0.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backmatter/next",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "description": "Experimental Next.js adapter for Backmatter. APIs will break. Not ready for production.",
   "type": "module",
   "publishConfig": {

package/src/preview-route.ts

@@ -20,7 +20,12 @@ import { MARKER_COOKIE, MARKER_TTL_S, safeReturnPath } from "./gate";
 import { requestUrlFrom } from "./request-url";
 
 export type PreviewRouteDeps = {
-  enableDraft?: () => void | Promise<void>;
+  /** Returns Next's preview bypass id when draft was just enabled. */
+  enableDraft?: () =>
+    | void
+    | string
+    | undefined
+    | Promise<void | string | undefined>;
   disableDraft?: () => void | Promise<void>;
   isDraftEnabled?: () => boolean | Promise<boolean>;
   now?: () => number;
@@ -51,6 +56,44 @@ function markerCookieHeader(secure: boolean, on: boolean): string {
   return parts.join("; ");
 }
 
+/** Next's static-bypass cookie. Same name Next sets; Partitioned so a cross-site frame keeps it. */
+const DRAFT_BYPASS_COOKIE = "__prerender_bypass";
+
+function partitionedDraftBypass(value: string): string | null {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  return [
+    `${DRAFT_BYPASS_COOKIE}=${value}`,
+    "Path=/",
+    "HttpOnly",
+    "Secure",
+    "SameSite=None",
+    "Partitioned",
+  ].join("; ");
+}
+
+function clearPartitionedDraftBypass(): string {
+  return [
+    `${DRAFT_BYPASS_COOKIE}=`,
+    "Path=/",
+    "HttpOnly",
+    "Secure",
+    "SameSite=None",
+    "Partitioned",
+    "Max-Age=0",
+  ].join("; ");
+}
+
+function appendPartitionedBypass(headers: Headers, secure: boolean, bypass: unknown) {
+  if (!secure || typeof bypass !== "string") return;
+  const cookie = partitionedDraftBypass(bypass);
+  if (cookie) headers.append("Set-Cookie", cookie);
+}
+
+function appendClearPartitionedBypass(headers: Headers, secure: boolean) {
+  if (!secure) return;
+  headers.append("Set-Cookie", clearPartitionedDraftBypass());
+}
+
 function cookieBase(name: string, secure: boolean, maxAge: number, value: string) {
   // HTTPS is cross-site from the CMS iframe (dash → customer origin). Lax is
   // not sent there, so draftMode can be on while the checkout cookie is missing
@@ -69,13 +112,21 @@ function cookieBase(name: string, secure: boolean, maxAge: number, value: string
   return parts.join("; ");
 }
 
-async function nextDraft(enable: boolean): Promise<void> {
+async function nextDraft(enable: boolean): Promise<string | undefined> {
+  // Same jar as draft.enable(): route phase is "action", so cookies()
+  // reads requestStore.mutableCookies. Do not cookies().set this name;
+  // the jar is keyed by name and a second set would replace Next's cookie.
   const mod = (await import("next/headers" as string)) as {
     draftMode: () => Promise<{ enable: () => void; disable: () => void }>;
+    cookies: () => Promise<{ get: (name: string) => { value: string } | undefined }>;
   };
   const draft = await mod.draftMode();
-  if (enable) draft.enable();
-  else draft.disable();
+  if (!enable) {
+    draft.disable();
+    return undefined;
+  }
+  draft.enable();
+  return (await mod.cookies()).get(DRAFT_BYPASS_COOKIE)?.value;
 }
 
 async function nextDraftEnabled(): Promise<boolean> {
@@ -161,6 +212,7 @@ export function createPreviewRoute(
         headers.append("Set-Cookie", cookieBase(PREVIEW_COOKIE, secure, 0, ""));
         headers.append("Set-Cookie", cookieBase(PREVIEW_SESSION_COOKIE, secure, 0, ""));
         headers.append("Set-Cookie", markerCookieHeader(secure, false));
+        appendClearPartitionedBypass(headers, secure);
         return Response.json({ mode: "live", reason: "invalid" }, { headers });
       };
       if (!claims || !token || !workspaceOk) {
@@ -275,7 +327,7 @@ export function createPreviewRoute(
       tree: payload.tree,
       exp: now() + PREVIEW_COOKIE_TTL_MS,
     });
-    await (deps.enableDraft ?? (() => nextDraft(true)))();
+    const bypass = await (deps.enableDraft ?? (() => nextDraft(true)))();
     const location = previewLocationWithCheckout(url.origin, payload.redirect, value);
     const headers = new Headers({ Location: location });
     headers.append(
@@ -295,6 +347,7 @@ export function createPreviewRoute(
     }
     // Entry opts the visitor in, so the bar shows on later pages without a param.
     headers.append("Set-Cookie", markerCookieHeader(secure, true));
+    appendPartitionedBypass(headers, secure, bypass);
     return new Response(null, { status: 302, headers });
   };
 
@@ -333,6 +386,7 @@ export function createPreviewRoute(
       await (deps.disableDraft ?? (() => nextDraft(false)))();
       const headers = new Headers();
       headers.append("Set-Cookie", cookieBase(PREVIEW_COOKIE, secure, 0, ""));
+      appendClearPartitionedBypass(headers, secure);
       return new Response(null, { status: 204, headers });
     }
 
@@ -353,13 +407,14 @@ export function createPreviewRoute(
         tree: claims.tree,
         exp: now() + PREVIEW_COOKIE_TTL_MS,
       });
-      await (deps.enableDraft ?? (() => nextDraft(true)))();
+      const bypass = await (deps.enableDraft ?? (() => nextDraft(true)))();
       const headers = new Headers();
       headers.append(
         "Set-Cookie",
         cookieBase(PREVIEW_COOKIE, secure, Math.floor(PREVIEW_COOKIE_TTL_MS / 1000), value),
       );
       headers.append("Set-Cookie", markerCookieHeader(secure, true));
+      appendPartitionedBypass(headers, secure, bypass);
       return new Response(null, { status: 204, headers });
     }
 
@@ -369,6 +424,7 @@ export function createPreviewRoute(
     headers.append("Set-Cookie", cookieBase(PREVIEW_SESSION_COOKIE, secure, 0, ""));
     // Exit also drops the marker; otherwise the next page would bounce straight back in.
     headers.append("Set-Cookie", markerCookieHeader(secure, false));
+    appendClearPartitionedBypass(headers, secure);
     return new Response(null, { status: 204, headers });
   };