@bygghammar/cms-platform 0.90.0-m7.2 → 0.90.0-m7.3

package/CHANGELOG.md

@@ -8,6 +8,18 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.90.0-m7.3
+
+- Popup exclusions are derived from the configured `backofficePath`, so a site
+  that mounts its office at `/admin` or `/cms/backoffice` is covered without
+  naming it twice. Both the tree and its landing page are excluded: `/admin/**`
+  does not match `/admin`.
+- `registerPopupPublicHost` accepts `excludedPaths` for a site's own private
+  routes — a checkout, a members' area. The CMS adds to that list and never
+  replaces it, and drops duplicates rather than repeating a path.
+- Requires `@bygghammar/lightweight-popup@>=0.2.0-m7.3`, whose defaults no
+  longer name anyone's backoffice.
+
 ## 0.90.0-m7.2
 
 - `backofficePaths` gains `popups` and `popupDestinations`, and both popup

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.90.0-m7.2",
+  "version": "0.90.0-m7.3",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [
@@ -263,7 +263,7 @@
     "@dnd-kit/sortable": ">=3",
     "@dnd-kit/utilities": ">=3",
     "zod": ">=3",
-    "@bygghammar/lightweight-popup": ">=0.2.0-m7.2"
+    "@bygghammar/lightweight-popup": ">=0.2.0-m7.3"
   },
   "peerDependenciesMeta": {
     "@supabase/supabase-js": {
@@ -328,7 +328,7 @@
     "check": "bun run typecheck && bun run test && bun run verify:pack"
   },
   "devDependencies": {
-    "@bygghammar/lightweight-popup": "file:./vendor/bygghammar-lightweight-popup-0.2.0-m7.2.tgz",
+    "@bygghammar/lightweight-popup": "file:./vendor/bygghammar-lightweight-popup-0.2.0-m7.3.tgz",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",

package/src/popups/host.ts

@@ -19,6 +19,15 @@ import type {
 export type PopupPublicHost = {
   readonly configs: PopupConfigRepository;
   readonly analytics: AnalyticsEventRepository;
+  /**
+   * Paths of the site's own that no popup may appear on.
+   *
+   * The backoffice is added for every site already, from the configured
+   * `backofficePath` — this is for the rest: a checkout, a members' area, a
+   * page a site simply wants left alone. Patterns are the popup package's:
+   * `/checkout` for one page, `/checkout/**` for everything beneath it.
+   */
+  readonly excludedPaths?: readonly string[];
 };
 
 /**

package/src/popups/runtime.tsx

@@ -13,12 +13,16 @@
 import { useCallback, useEffect, useMemo, useRef } from "react";
 import type { ReactNode } from "react";
 import { useRouterState } from "@tanstack/react-router";
-import { PopupRuntime } from "@bygghammar/lightweight-popup/runtime";
+import {
+  PopupRuntime,
+  withExcludedBase,
+} from "@bygghammar/lightweight-popup/runtime";
 import type { RuntimeAdapters } from "@bygghammar/lightweight-popup/adapters";
 
 import { ManagedForm } from "../forms/FormRenderer";
 import { onFormSubmissionSuccess } from "../forms/success-listeners";
 import { siteConfig } from "../config/site-config";
+import type { PopupPublicHost } from "./host";
 import { popupPublicHost } from "./host";
 
 /**
@@ -52,13 +56,26 @@ function PopupForm({
 /**
  * Paths the runtime never displays on.
  *
- * Derived from the site's configured backoffice path rather than a hardcoded
- * `/kontoret`, plus the CMS preview routes — a popup over the editor's own
- * live preview would end up in screenshots.
+ * Three sources, in one list. The site's own exclusions come first and are
+ * kept whole — this only ever adds to them. `/preview/**` is the platform's:
+ * a popup over the editor's live preview ends up in screenshots. The
+ * backoffice comes from the site's configured `backofficePath`, the same
+ * value `backofficePaths()` builds every backoffice address from, so a site
+ * that mounts its office at `/admin` or `/cms/backoffice` is covered without
+ * telling anyone twice.
+ *
+ * The popup package deliberately excludes nothing by itself. It cannot know
+ * which of a site's paths are private, and when it used to guess, every site
+ * whose office was named differently got popups over its own admin screens.
  */
-function excludedPaths(): readonly string[] {
-  const base = siteConfig().backofficePath.replace(/\/+$/, "");
-  return [`${base}/**`, base, "/preview/**"];
+export function popupExcludedPaths(
+  host: Pick<PopupPublicHost, "excludedPaths">,
+  backofficePath: string,
+): readonly string[] {
+  return withExcludedBase(
+    [...(host.excludedPaths ?? []), "/preview/**"],
+    backofficePath,
+  );
 }
 
 export function PopupModuleRuntime(): ReactNode {
@@ -85,7 +102,7 @@ export function PopupModuleRuntime(): ReactNode {
     <PopupRuntime
       path={path}
       adapters={adapters}
-      excludedPaths={excludedPaths()}
+      excludedPaths={popupExcludedPaths(host, siteConfig().backofficePath)}
     />
   );
 }