@bygghammar/cms-platform 0.60.1 → 0.61.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.61.0
+
+- New `site/host-indexing` and `site/host-indexing-response`: the hostname-based
+  indexing policy (live-hostname + configured-origin condition, robots directive,
+  three-state robots meta tags and the `X-Robots-Tag` response wrapper) now lives
+  in the platform. Sites supply only their live hostname via
+  `createHostIndexingPolicy()` / `createHostIndexingResponsePolicy()`.
+
 ## 0.60.1
 
 - Drift manifest no longer lists site backoffice route files: sites reach the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.60.1",
+  "version": "0.61.0",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [
@@ -208,6 +208,8 @@
     "./server/media-usage-host": "./src/server/media-usage-host.ts",
     "./runtime/server-entry": "./src/runtime/server-entry.ts",
     "./site/indexing": "./src/site/indexing.ts",
+    "./site/host-indexing": "./src/site/host-indexing.ts",
+    "./site/host-indexing-response": "./src/site/host-indexing-response.ts",
     "./backoffice/IndexingStatusCard": "./src/backoffice/IndexingStatusCard.tsx",
     "./util/use-hash-scroll": "./src/util/use-hash-scroll.ts",
     "./site/site-url": "./src/site/site-url.ts",

package/src/site/host-indexing-response.ts

@@ -0,0 +1,83 @@
+/**
+ * Marking a response that must not be indexed.
+ *
+ * This lives in the platform so that the function a site's server entry calls is
+ * the function its tests import. A test that reimplements the server's logic
+ * passes whether or not the server still calls it, which makes it evidence about
+ * the test file and nothing else.
+ */
+import { NOINDEX_VALUE, robotsDirectiveForHost } from "./host-indexing";
+import { configuredPublicOrigin } from "./public-origin";
+
+export { NOINDEX_VALUE };
+
+/**
+ * The host the request arrived on, taken from the URL the server received and
+ * never from `X-Forwarded-Host` — that header is supplied by whoever is talking
+ * to us. An unparseable URL yields null, which fails to noindex.
+ */
+function requestHostname(request: Request): string | null {
+  try {
+    return new URL(request.url).hostname;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Adds `X-Robots-Tag` unless this deployment is the live site answering on the
+ * live hostname.
+ *
+ * Applied AFTER the shared header helper, because that helper sets its own
+ * headers and a value written before it could be replaced. The response is
+ * rebuilt with the same body, status and statusText, so streaming, redirects and
+ * error pages are unaffected — only the header set changes.
+ *
+ * `configuredOrigin` defaults to this deployment's own configuration; it is a
+ * parameter so tests can state a deployment's configuration directly instead of
+ * describing one.
+ */
+export function applyHostIndexingPolicy(
+  liveHostname: string,
+  request: Request,
+  response: Response,
+  configuredOrigin: string | null | undefined = configuredPublicOrigin(),
+): Response {
+  // A 5xx is the server saying it failed. Whatever it returned is not this
+  // site's content, on any deployment — including the live one, where the
+  // deployment check correctly adds nothing to ordinary pages. Without this, a
+  // root loader that throws on the live host is served as indexable.
+  const directive =
+    response.status >= 500
+      ? NOINDEX_VALUE
+      : robotsDirectiveForHost(liveHostname, configuredOrigin, requestHostname(request));
+  if (!directive) return response;
+
+  // The stricter policy wins.
+  //
+  // The platform applies its own environment indexing policy inside
+  // applyEdgeHeaders (SITE_INDEXING / SITE_ENV), which never looks at the
+  // request host. It runs first, and its value is stricter than this one, so an
+  // existing noindex is left exactly as it is rather than replaced by a shorter
+  // directive. A header that is NOT a noindex is replaced: a permissive value is
+  // not something to preserve.
+  const existing = response.headers.get("X-Robots-Tag");
+  if (existing && existing.toLowerCase().includes("noindex")) return response;
+
+  const headers = new Headers(response.headers);
+  headers.set("X-Robots-Tag", directive);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
+/** The response helper bound to one site's live hostname. */
+export function createHostIndexingResponsePolicy(liveHostname: string) {
+  return (
+    request: Request,
+    response: Response,
+    configuredOrigin: string | null | undefined = configuredPublicOrigin(),
+  ) => applyHostIndexingPolicy(liveHostname, request, response, configuredOrigin);
+}

package/src/site/host-indexing.ts

@@ -0,0 +1,152 @@
+/**
+ * Hostname-based indexing policy.
+ *
+ * A deployment serves the same application on more hostnames than the live one:
+ * a temporary production-preview host, staging, and sandbox previews. Each is
+ * exactly as indexable as the live site unless the application says otherwise,
+ * so duplicate content on `site.prod.example.com` competes with the real domain
+ * for the same pages.
+ *
+ * The condition is positive and has two halves, both required:
+ *
+ *   1. this deployment is CONFIGURED as the live origin, and
+ *   2. the request actually arrived on the live hostname.
+ *
+ * Either half alone is not enough. A staging deployment misconfigured with the
+ * live origin still answers on the staging hostname; a request carrying a forged
+ * `Host` still reaches a deployment configured as something else.
+ *
+ * Everything else — a temporary host, staging, a preview sandbox, an unknown
+ * host, a missing or malformed configuration — is noindex. Deciding from a list
+ * of hosts to EXCLUDE means every host nobody thought of is indexable, which is
+ * how a preview domain ends up in search results.
+ *
+ * This module imports nothing on purpose: build configs load it directly, before
+ * any alias or browser global exists.
+ */
+
+/** What a response that must not be indexed says. */
+export const NOINDEX_VALUE = "noindex, nofollow, noarchive";
+
+/**
+ * A hostname reduced to what can be compared: lowercased, port removed, one
+ * trailing dot removed.
+ *
+ * `SITE.SE`, `site.se:443` and `site.se.` are the same host. A suffix such as
+ * `evilsite.se` is not, and neither is the subdomain `site.se.example.com` —
+ * which is why this compares whole strings and never uses `endsWith`.
+ */
+export function normalizeHostname(value: string | null | undefined): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  // A Host header may carry a port; IPv6 literals carry brackets.
+  const withoutPort = trimmed.startsWith("[")
+    ? trimmed.slice(0, trimmed.indexOf("]") + 1)
+    : trimmed.split(":")[0];
+  if (!withoutPort) return null;
+  const lowered = withoutPort.toLowerCase();
+  const withoutRootDot = lowered.endsWith(".") ? lowered.slice(0, -1) : lowered;
+  return withoutRootDot || null;
+}
+
+/**
+ * The hostname a configured origin names, but only when that origin is exactly
+ * an `https://` URL with nothing else in it.
+ *
+ * Credentials, a port, a path, a query or a fragment all mean the value is not
+ * simply "this deployment's origin", and a value that cannot be parsed is not
+ * one to draw conclusions from. Each returns null, which fails to noindex.
+ */
+export function liveHostnameFromOrigin(origin: string | null | undefined): string | null {
+  if (typeof origin !== "string" || !origin.trim()) return null;
+  let url: URL;
+  try {
+    url = new URL(origin.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:") return null;
+  if (url.username || url.password) return null;
+  if (url.port) return null;
+  if (url.pathname !== "/" || url.search || url.hash) return null;
+  return normalizeHostname(url.hostname);
+}
+
+/**
+ * The two-part condition.
+ *
+ * `configuredOrigin` is the deployment's own configuration; `requestHostname` is
+ * the host the request arrived on. Both must resolve to `liveHostname`.
+ */
+export function isIndexableRequestForHost(
+  liveHostname: string,
+  configuredOrigin: string | null | undefined,
+  requestHostname: string | null | undefined,
+): boolean {
+  const live = normalizeHostname(liveHostname);
+  if (!live) return false;
+  if (liveHostnameFromOrigin(configuredOrigin) !== live) return false;
+  return normalizeHostname(requestHostname) === live;
+}
+
+/** The robots value this request should carry, whichever way it is expressed. */
+export function robotsDirectiveForHost(
+  liveHostname: string,
+  configuredOrigin: string | null | undefined,
+  requestHostname: string | null | undefined,
+): string | null {
+  return isIndexableRequestForHost(liveHostname, configuredOrigin, requestHostname)
+    ? null
+    : NOINDEX_VALUE;
+}
+
+/**
+ * The robots meta tags a rendered page should carry.
+ *
+ * Three states, not two. `robots: null` is the loader having run and found the
+ * request indexable, which means no tag at all. Loader data missing entirely is
+ * the root loader having thrown — an error render, on a deployment that could
+ * not be identified — and that is a noindex for both reasons. Reading the missing
+ * case as "indexable" is how an error page reaches a search index.
+ */
+export function robotsMetaTags(
+  loaderData: { robots?: string | null } | undefined,
+): Array<{ name: string; content: string }> {
+  if (!loaderData) return [{ name: "robots", content: NOINDEX_VALUE }];
+  return loaderData.robots ? [{ name: "robots", content: loaderData.robots }] : [];
+}
+
+export type HostIndexingPolicy = {
+  LIVE_HOSTNAME: string;
+  NOINDEX_VALUE: string;
+  normalizeHostname: typeof normalizeHostname;
+  liveHostnameFromOrigin: typeof liveHostnameFromOrigin;
+  isIndexableRequest: (
+    configuredOrigin: string | null | undefined,
+    requestHostname: string | null | undefined,
+  ) => boolean;
+  robotsDirective: (
+    configuredOrigin: string | null | undefined,
+    requestHostname: string | null | undefined,
+  ) => string | null;
+  robotsMetaTags: typeof robotsMetaTags;
+};
+
+/**
+ * The whole policy bound to one site's live hostname — the only site-specific
+ * fact in it.
+ */
+export function createHostIndexingPolicy(liveHostname: string): HostIndexingPolicy {
+  return {
+    LIVE_HOSTNAME: liveHostname,
+    NOINDEX_VALUE,
+    normalizeHostname,
+    liveHostnameFromOrigin,
+    isIndexableRequest: (configuredOrigin, requestHostname) =>
+      isIndexableRequestForHost(liveHostname, configuredOrigin, requestHostname),
+    robotsDirective: (configuredOrigin, requestHostname) =>
+      robotsDirectiveForHost(liveHostname, configuredOrigin, requestHostname),
+    robotsMetaTags,
+  };
+}