@cmssy/react 16.7.1 → 16.9.0

package/dist/client.cjs

@@ -650,6 +650,7 @@ var DEBOUNCE_MS = 300;
 function useBlockLoaderData({
   enabled,
   url = CMSSY_BLOCK_DATA_PATH,
+  token,
   blocks,
   locale,
   defaultLocale,
@@ -677,7 +678,10 @@ function useBlockLoaderData({
         try {
           const response = await fetch(url, {
             method: "POST",
-            headers: { "content-type": "application/json" },
+            headers: {
+              "content-type": "application/json",
+              ...token ? { [core.CMSSY_EDIT_TOKEN_HEADER]: token } : {}
+            },
             body: request,
             signal: controller.signal
           });
@@ -705,7 +709,7 @@ function useBlockLoaderData({
       clearTimeout(timer);
       controller.abort();
     };
-  }, [request, url, blocks.length]);
+  }, [request, url, token, blocks.length]);
   return data;
 }
 
@@ -984,6 +988,7 @@ function EditableBlocks({
   const liveData = useBlockLoaderData({
     enabled: loaderBlocks.length > 0,
     ...edit.blockDataUrl ? { url: edit.blockDataUrl } : {},
+    ...edit.blockDataToken ? { token: edit.blockDataToken } : {},
     blocks: loaderBlocks,
     locale,
     defaultLocale,

package/dist/client.d.cts

@@ -9,6 +9,7 @@ interface EditBridgeConfig {
     blockMeta?: Record<string, BlockMeta>;
     layoutRegions?: readonly LayoutRegion[] | undefined;
     blockDataUrl?: string;
+    blockDataToken?: string;
 }
 type PatchMap = Partial<Record<string, Record<string, unknown>>>;
 interface InsertedBlock {

package/dist/client.d.ts

@@ -9,6 +9,7 @@ interface EditBridgeConfig {
     blockMeta?: Record<string, BlockMeta>;
     layoutRegions?: readonly LayoutRegion[] | undefined;
     blockDataUrl?: string;
+    blockDataToken?: string;
 }
 type PatchMap = Partial<Record<string, Record<string, unknown>>>;
 interface InsertedBlock {

package/dist/client.js

@@ -1,6 +1,6 @@
 "use client";
 import { useState, useRef, useEffect, useMemo, createElement } from 'react';
-import { blocksToMeta, blocksToSchemas, postToEditor, layoutRegionsToBridge, PROTOCOL_VERSION, parseEditorMessage } from '@cmssy/core';
+import { blocksToMeta, blocksToSchemas, postToEditor, layoutRegionsToBridge, PROTOCOL_VERSION, parseEditorMessage, CMSSY_EDIT_TOKEN_HEADER } from '@cmssy/core';
 import { resolveInitialTarget, buildBlockContext, getBlockContentForLanguage, normalizeBlockContent, asBucket } from '@cmssy/core/internal';
 import { BlockErrorBoundary } from '@cmssy/react/block-error-boundary';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
@@ -648,6 +648,7 @@ var DEBOUNCE_MS = 300;
 function useBlockLoaderData({
   enabled,
   url = CMSSY_BLOCK_DATA_PATH,
+  token,
   blocks,
   locale,
   defaultLocale,
@@ -675,7 +676,10 @@ function useBlockLoaderData({
         try {
           const response = await fetch(url, {
             method: "POST",
-            headers: { "content-type": "application/json" },
+            headers: {
+              "content-type": "application/json",
+              ...token ? { [CMSSY_EDIT_TOKEN_HEADER]: token } : {}
+            },
             body: request,
             signal: controller.signal
           });
@@ -703,7 +707,7 @@ function useBlockLoaderData({
       clearTimeout(timer);
       controller.abort();
     };
-  }, [request, url, blocks.length]);
+  }, [request, url, token, blocks.length]);
   return data;
 }
 
@@ -982,6 +986,7 @@ function EditableBlocks({
   const liveData = useBlockLoaderData({
     enabled: loaderBlocks.length > 0,
     ...edit.blockDataUrl ? { url: edit.blockDataUrl } : {},
+    ...edit.blockDataToken ? { token: edit.blockDataToken } : {},
     blocks: loaderBlocks,
     locale,
     defaultLocale,

package/dist/index.cjs

@@ -734,6 +734,44 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await core.verifyCmssyEditToken(
+      request.headers.get(core.CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
 Object.defineProperty(exports, "CmssyRequestError", {
   enumerable: true,
@@ -796,6 +834,7 @@ exports.CmssyServerLayout = CmssyServerLayout;
 exports.CmssyServerPage = CmssyServerPage;
 exports.UnknownBlock = UnknownBlock;
 exports.buildBlockMap = buildBlockMap;
+exports.createBlockDataHandler = createBlockDataHandler;
 exports.defineBlock = defineBlock;
 exports.handleBlockDataRequest = handleBlockDataRequest;
 exports.parseBlockDataRequest = parseBlockDataRequest;

package/dist/index.d.cts

@@ -7,7 +7,7 @@ export { FieldCondition, FieldConditionGroup, FieldConditionLogic } from '@cmssy
 export { buildBlockContext } from '@cmssy/core/internal';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactElement, ComponentType } from 'react';
-export { CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.cjs';
+export { CmssyBlockDataHandlerOptions, CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.cjs';
 
 interface CmssyServerPageProps {
     page: CmssyPageData | null;

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { FieldCondition, FieldConditionGroup, FieldConditionLogic } from '@cmssy
 export { buildBlockContext } from '@cmssy/core/internal';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactElement, ComponentType } from 'react';
-export { CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.js';
+export { CmssyBlockDataHandlerOptions, CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.js';
 
 interface CmssyServerPageProps {
     page: CmssyPageData | null;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { blocksToSchemas, resolveEditorOrigin } from '@cmssy/core';
+import { blocksToSchemas, resolveEditorOrigin, verifyCmssyEditToken, CMSSY_EDIT_TOKEN_HEADER } from '@cmssy/core';
 export { CmssyRequestError, PROTOCOL_VERSION, createCmssyClient, defineCmssyLayout, fields, graphqlRequest, isProtocolCompatible, mediaAlt, mediaUrl, mediaUrls, normalizeOrigin, parseEditorMessage, postToEditor } from '@cmssy/core';
 import { buildBlockContext, fetchLayouts, normalizeBlockContent, asBucket, resolveSiteLocales as resolveSiteLocales$1, getBlockContentForLanguage, resolveRelationContent } from '@cmssy/core/internal';
 export { buildBlockContext } from '@cmssy/core/internal';
@@ -734,5 +734,43 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await verifyCmssyEditToken(
+      request.headers.get(CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
-export { CmssyBlock, CmssyServerLayout, CmssyServerPage, UnknownBlock, buildBlockMap, defineBlock, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest, resolveCmssyLayout, resolveCmssyLayoutSlot, resolveEditorBlockData, resolveEditorLayoutBlockData };
+export { CmssyBlock, CmssyServerLayout, CmssyServerPage, UnknownBlock, buildBlockMap, createBlockDataHandler, defineBlock, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest, resolveCmssyLayout, resolveCmssyLayoutSlot, resolveEditorBlockData, resolveEditorLayoutBlockData };

package/dist/internal-server.cjs

@@ -264,11 +264,50 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await core.verifyCmssyEditToken(
+      request.headers.get(core.CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
 Object.defineProperty(exports, "blocksToSchemas", {
   enumerable: true,
   get: function () { return core.blocksToSchemas; }
 });
+exports.createBlockDataHandler = createBlockDataHandler;
 exports.handleBlockDataRequest = handleBlockDataRequest;
 exports.parseBlockDataRequest = parseBlockDataRequest;
 exports.resolveBlockData = resolveBlockData;

package/dist/internal-server.d.cts

@@ -42,4 +42,13 @@ declare function parseBlockDataRequest(body: unknown): CmssyBlockDataRequest;
 declare function resolveBlockDataRequest(request: CmssyBlockDataRequest, options: ResolveBlockDataRequestOptions): Promise<CmssyBlockDataResult>;
 declare function handleBlockDataRequest(body: unknown, options: ResolveBlockDataRequestOptions): Promise<Response>;
 
-export { type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };
+interface CmssyBlockDataHandlerOptions {
+    forms?: Record<string, CmssyFormDefinition>;
+    appContext?: Record<string, unknown>;
+    workspaceId?: string;
+}
+declare function createBlockDataHandler(config: CmssyClientConfig & {
+    draftSecret?: string;
+}, blocks: BlockDefinition[], options?: CmssyBlockDataHandlerOptions): (request: Request) => Promise<Response>;
+
+export { type CmssyBlockDataHandlerOptions, type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };

package/dist/internal-server.d.ts

@@ -42,4 +42,13 @@ declare function parseBlockDataRequest(body: unknown): CmssyBlockDataRequest;
 declare function resolveBlockDataRequest(request: CmssyBlockDataRequest, options: ResolveBlockDataRequestOptions): Promise<CmssyBlockDataResult>;
 declare function handleBlockDataRequest(body: unknown, options: ResolveBlockDataRequestOptions): Promise<Response>;
 
-export { type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };
+interface CmssyBlockDataHandlerOptions {
+    forms?: Record<string, CmssyFormDefinition>;
+    appContext?: Record<string, unknown>;
+    workspaceId?: string;
+}
+declare function createBlockDataHandler(config: CmssyClientConfig & {
+    draftSecret?: string;
+}, blocks: BlockDefinition[], options?: CmssyBlockDataHandlerOptions): (request: Request) => Promise<Response>;
+
+export { type CmssyBlockDataHandlerOptions, type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };

package/dist/internal-server.js

@@ -1,5 +1,5 @@
 import { buildBlockContext, getBlockContentForLanguage, resolveRelationContent, normalizeBlockContent } from '@cmssy/core/internal';
-import { blocksToSchemas } from '@cmssy/core';
+import { blocksToSchemas, verifyCmssyEditToken, CMSSY_EDIT_TOKEN_HEADER } from '@cmssy/core';
 export { blocksToSchemas } from '@cmssy/core';
 
 // src/components/resolve-block-data.ts
@@ -263,5 +263,43 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await verifyCmssyEditToken(
+      request.headers.get(CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
-export { handleBlockDataRequest, parseBlockDataRequest, resolveBlockData, resolveBlockDataRequest, resolveEditorBlockData, resolveEditorLayoutBlockData, resolveLayoutBlockData };
+export { createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockData, resolveBlockDataRequest, resolveEditorBlockData, resolveEditorLayoutBlockData, resolveLayoutBlockData };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/react",
-  "version": "16.7.1",
+  "version": "16.9.0",
   "description": "React blocks, renderers, data client and editor bridge for cmssy headless sites",
   "keywords": [
     "cmssy",
@@ -97,7 +97,7 @@
   },
   "dependencies": {
     "@cmssy/types": "0.49.0",
-    "@cmssy/core": "16.7.1"
+    "@cmssy/core": "16.9.0"
   },
   "scripts": {
     "build": "tsup",