@cmssy/next 16.7.0 → 16.8.0

package/README.md

@@ -113,7 +113,8 @@ re-exported from `@cmssy/next` (and `@cmssy/core`).
 ## Exports
 
 `@cmssy/next/server`: `createCmssyPage`, `createCmssyEditPage`,
-`createDraftRoute`, `createCmssyRevalidateRoute`, `CmssyLayoutSlot`,
+`createDraftRoute`, `createCmssyRevalidateRoute`, `createCmssyBlockDataRoute`,
+`CmssyLayoutSlot`,
 `resolveCmssyLayout`, `isCmssyEditMode`. `@cmssy/next/middleware`:
 `createCmssyProxy`, `cmssyEditRewrite`, `applyCmssyCsp`, `isCmssyEditRequest`.
 Root: `defineCmssyConfig`, `localizeHref`, `nextRetryMode`, `cmssyCachedFetch`,

package/dist/server.cjs

@@ -4,10 +4,10 @@ require('server-only');
 var headers = require('next/headers');
 var navigation = require('next/navigation');
 var react = require('@cmssy/react');
+var core = require('@cmssy/core');
 var internal$1 = require('@cmssy/react/internal');
 var internalServer = require('@cmssy/react/internal-server');
 var internal = require('@cmssy/core/internal');
-var core = require('@cmssy/core');
 var jsxRuntime = require('react/jsx-runtime');
 var cache = require('next/cache');
 
@@ -147,7 +147,13 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
           enabledLocales,
           edit: {
             editorOrigin: bridgeOrigin,
-            ...config.layout ? { layoutRegions: config.layout.regions } : {}
+            ...config.layout ? { layoutRegions: config.layout.regions } : {},
+            ...config.draftSecret ? {
+              blockDataToken: await core.mintCmssyEditToken(
+                config.draftSecret,
+                { page: page.slug ?? "" }
+              )
+            } : {}
           },
           forms,
           data: editorData.data,
@@ -218,7 +224,8 @@ async function renderNothingPublishedPage(config, path) {
           shown
         ] }),
         /* @__PURE__ */ jsxRuntime.jsxs("p", { style: { margin: "0 0 1rem" }, children: [
-          "Your app is wired to workspace ",
+          "Your app is wired to workspace",
+          " ",
           /* @__PURE__ */ jsxRuntime.jsxs("code", { children: [
             config.org,
             "/",
@@ -379,12 +386,19 @@ async function CmssyLayoutSlot({
   const { groups, settings, page: routed, element } = layout;
   return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: children({ groups, settings, page: routed, element }) });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
 function createCmssyBlockDataRoute(config, blocks, options = {}) {
   return async function POST(request) {
-    if (!await isCmssyEditMode()) {
+    if (!config.draftSecret) {
       return new Response(
-        "cmssy: block data is only resolved for a verified editor request",
-        { status: 403 }
+        "cmssy: createCmssyBlockDataRoute needs config.draftSecret to verify the editor",
+        { status: 500 }
       );
     }
     let body;
@@ -393,9 +407,18 @@ function createCmssyBlockDataRoute(config, blocks, options = {}) {
     } catch {
       return Response.json(
         { message: "cmssy: body is not JSON" },
-        {
-          status: 400
-        }
+        { status: 400 }
+      );
+    }
+    const authorized = await core.verifyCmssyEditToken(
+      request.headers.get(core.CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
       );
     }
     return react.handleBlockDataRequest(body, { blocks, config, ...options });

package/dist/server.d.cts

@@ -56,6 +56,8 @@ interface CmssyBlockDataRouteConfig {
     appContext?: Record<string, unknown>;
     workspaceId?: string;
 }
-declare function createCmssyBlockDataRoute(config: CmssyClientConfig, blocks: BlockDefinition[], options?: CmssyBlockDataRouteConfig): (request: Request) => Promise<Response>;
+declare function createCmssyBlockDataRoute(config: CmssyClientConfig & {
+    draftSecret?: string;
+}, blocks: BlockDefinition[], options?: CmssyBlockDataRouteConfig): (request: Request) => Promise<Response>;
 
 export { type CmssyBlockDataRouteConfig, CmssyDataCacheOptions, type CmssyDraftRouteConfig, CmssyLayoutSlot, type CmssyLayoutSlotProps, type CmssyLayoutSlotRenderProps, type CmssyRevalidateRouteConfig, type ResolveCmssyLayoutOptions, createCmssyBlockDataRoute, createCmssyRevalidateRoute, createDraftRoute, isCmssyEditMode, resolveCmssyLayout };

package/dist/server.d.ts

@@ -56,6 +56,8 @@ interface CmssyBlockDataRouteConfig {
     appContext?: Record<string, unknown>;
     workspaceId?: string;
 }
-declare function createCmssyBlockDataRoute(config: CmssyClientConfig, blocks: BlockDefinition[], options?: CmssyBlockDataRouteConfig): (request: Request) => Promise<Response>;
+declare function createCmssyBlockDataRoute(config: CmssyClientConfig & {
+    draftSecret?: string;
+}, blocks: BlockDefinition[], options?: CmssyBlockDataRouteConfig): (request: Request) => Promise<Response>;
 
 export { type CmssyBlockDataRouteConfig, CmssyDataCacheOptions, type CmssyDraftRouteConfig, CmssyLayoutSlot, type CmssyLayoutSlotProps, type CmssyLayoutSlotRenderProps, type CmssyRevalidateRouteConfig, type ResolveCmssyLayoutOptions, createCmssyBlockDataRoute, createCmssyRevalidateRoute, createDraftRoute, isCmssyEditMode, resolveCmssyLayout };

package/dist/server.js

@@ -2,10 +2,10 @@ import 'server-only';
 import { draftMode, headers } from 'next/headers';
 import { notFound, redirect } from 'next/navigation';
 import { createCmssyClient, CmssyServerPage, resolveCmssyLayout as resolveCmssyLayout$1, handleBlockDataRequest } from '@cmssy/react';
+import { mintCmssyEditToken, CMSSY_SECRET_QUERY_PARAM, resolveEditorOrigin, verifyCmssyWebhook, CmssyWebhookError, CMSSY_EDIT_HEADER, verifyCmssyEditToken, CMSSY_EDIT_TOKEN_HEADER, CMSSY_EDIT_QUERY_PARAM } from '@cmssy/core';
 import { CmssyLocaleProvider } from '@cmssy/react/internal';
 import { blocksToSchemas, resolveEditorBlockData } from '@cmssy/react/internal-server';
 import { isDevelopment, resolveSiteLocales, splitLocaleFromPath, fetchPage, resolveForms, toCspOrigin, cmssySecretsMatch } from '@cmssy/core/internal';
-import { CMSSY_SECRET_QUERY_PARAM, resolveEditorOrigin, verifyCmssyWebhook, CmssyWebhookError, CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM } from '@cmssy/core';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 import { revalidateTag } from 'next/cache';
 
@@ -145,7 +145,13 @@ function buildCmssyPageRenderer(config, blocks, options, editRoute) {
           enabledLocales,
           edit: {
             editorOrigin: bridgeOrigin,
-            ...config.layout ? { layoutRegions: config.layout.regions } : {}
+            ...config.layout ? { layoutRegions: config.layout.regions } : {},
+            ...config.draftSecret ? {
+              blockDataToken: await mintCmssyEditToken(
+                config.draftSecret,
+                { page: page.slug ?? "" }
+              )
+            } : {}
           },
           forms,
           data: editorData.data,
@@ -216,7 +222,8 @@ async function renderNothingPublishedPage(config, path) {
           shown
         ] }),
         /* @__PURE__ */ jsxs("p", { style: { margin: "0 0 1rem" }, children: [
-          "Your app is wired to workspace ",
+          "Your app is wired to workspace",
+          " ",
           /* @__PURE__ */ jsxs("code", { children: [
             config.org,
             "/",
@@ -377,12 +384,19 @@ async function CmssyLayoutSlot({
   const { groups, settings, page: routed, element } = layout;
   return /* @__PURE__ */ jsx(Fragment, { children: children({ groups, settings, page: routed, element }) });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
 function createCmssyBlockDataRoute(config, blocks, options = {}) {
   return async function POST(request) {
-    if (!await isCmssyEditMode()) {
+    if (!config.draftSecret) {
       return new Response(
-        "cmssy: block data is only resolved for a verified editor request",
-        { status: 403 }
+        "cmssy: createCmssyBlockDataRoute needs config.draftSecret to verify the editor",
+        { status: 500 }
       );
     }
     let body;
@@ -391,9 +405,18 @@ function createCmssyBlockDataRoute(config, blocks, options = {}) {
     } catch {
       return Response.json(
         { message: "cmssy: body is not JSON" },
-        {
-          status: 400
-        }
+        { status: 400 }
+      );
+    }
+    const authorized = await verifyCmssyEditToken(
+      request.headers.get(CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
       );
     }
     return handleBlockDataRequest(body, { blocks, config, ...options });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/next",
-  "version": "16.7.0",
+  "version": "16.8.0",
   "description": "Next.js App Router bindings for cmssy headless sites (createCmssyPage + draft preview)",
   "keywords": [
     "cmssy",
@@ -71,7 +71,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@cmssy/react": "^16.7.0",
+    "@cmssy/react": "^16.8.0",
     "next": ">=15",
     "react": "^18.2.0 || ^19.0.0",
     "react-dom": "^18.2.0 || ^19.0.0"
@@ -85,12 +85,12 @@
     "tsup": "^8.3.0",
     "typescript": "^5.6.0",
     "vitest": "^2.1.0",
-    "@cmssy/react": "16.7.0"
+    "@cmssy/react": "16.8.0"
   },
   "dependencies": {
     "@cmssy/types": "0.49.0",
     "server-only": "^0.0.1",
-    "@cmssy/core": "16.7.0"
+    "@cmssy/core": "16.8.0"
   },
   "scripts": {
     "build": "tsup",