@cmssy/react 16.8.0 → 16.9.1

package/README.md

@@ -95,6 +95,21 @@ export const CmssyEditor = (props) => (
 The editor talks to the cmssy admin over the `cmssy:*` bridge protocol for live
 preview.
 
+## Versioning: this package, not the API
+
+**Pinning this package does not pin the API it talks to.** The package version
+covers this client - its exports and their behaviour, normal semver. The cmssy
+delivery API is a hosted service whose GraphQL schema can change on any deploy,
+without a release here.
+
+There is no dated API version to pin; the delivery endpoint has no version
+segment. What protects you today is that a breaking schema change cannot merge
+silently - it is caught by a gate that validates the SDK's own operations, and
+shipping one anyway takes a recorded approval - and that fields we intend to
+remove are marked `@deprecated` first. There is no guaranteed deprecation window
+and no minimum notice period. Details in
+[`@cmssy/core`](https://www.npmjs.com/package/@cmssy/core).
+
 ## License
 
 MIT

package/dist/index.cjs

@@ -734,6 +734,44 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await core.verifyCmssyEditToken(
+      request.headers.get(core.CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
 Object.defineProperty(exports, "CmssyRequestError", {
   enumerable: true,
@@ -796,6 +834,7 @@ exports.CmssyServerLayout = CmssyServerLayout;
 exports.CmssyServerPage = CmssyServerPage;
 exports.UnknownBlock = UnknownBlock;
 exports.buildBlockMap = buildBlockMap;
+exports.createBlockDataHandler = createBlockDataHandler;
 exports.defineBlock = defineBlock;
 exports.handleBlockDataRequest = handleBlockDataRequest;
 exports.parseBlockDataRequest = parseBlockDataRequest;

package/dist/index.d.cts

@@ -7,7 +7,7 @@ export { FieldCondition, FieldConditionGroup, FieldConditionLogic } from '@cmssy
 export { buildBlockContext } from '@cmssy/core/internal';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactElement, ComponentType } from 'react';
-export { CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.cjs';
+export { CmssyBlockDataHandlerOptions, CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.cjs';
 
 interface CmssyServerPageProps {
     page: CmssyPageData | null;

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { FieldCondition, FieldConditionGroup, FieldConditionLogic } from '@cmssy
 export { buildBlockContext } from '@cmssy/core/internal';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactElement, ComponentType } from 'react';
-export { CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.js';
+export { CmssyBlockDataHandlerOptions, CmssyBlockDataRequest, CmssyBlockDataRequestBlock, CmssyBlockDataRequestPage, CmssyBlockDataResult, ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest } from './internal-server.js';
 
 interface CmssyServerPageProps {
     page: CmssyPageData | null;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { blocksToSchemas, resolveEditorOrigin } from '@cmssy/core';
+import { blocksToSchemas, resolveEditorOrigin, verifyCmssyEditToken, CMSSY_EDIT_TOKEN_HEADER } from '@cmssy/core';
 export { CmssyRequestError, PROTOCOL_VERSION, createCmssyClient, defineCmssyLayout, fields, graphqlRequest, isProtocolCompatible, mediaAlt, mediaUrl, mediaUrls, normalizeOrigin, parseEditorMessage, postToEditor } from '@cmssy/core';
 import { buildBlockContext, fetchLayouts, normalizeBlockContent, asBucket, resolveSiteLocales as resolveSiteLocales$1, getBlockContentForLanguage, resolveRelationContent } from '@cmssy/core/internal';
 export { buildBlockContext } from '@cmssy/core/internal';
@@ -734,5 +734,43 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await verifyCmssyEditToken(
+      request.headers.get(CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
-export { CmssyBlock, CmssyServerLayout, CmssyServerPage, UnknownBlock, buildBlockMap, defineBlock, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest, resolveCmssyLayout, resolveCmssyLayoutSlot, resolveEditorBlockData, resolveEditorLayoutBlockData };
+export { CmssyBlock, CmssyServerLayout, CmssyServerPage, UnknownBlock, buildBlockMap, createBlockDataHandler, defineBlock, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest, resolveCmssyLayout, resolveCmssyLayoutSlot, resolveEditorBlockData, resolveEditorLayoutBlockData };

package/dist/internal-server.cjs

@@ -264,11 +264,50 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await core.verifyCmssyEditToken(
+      request.headers.get(core.CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
 Object.defineProperty(exports, "blocksToSchemas", {
   enumerable: true,
   get: function () { return core.blocksToSchemas; }
 });
+exports.createBlockDataHandler = createBlockDataHandler;
 exports.handleBlockDataRequest = handleBlockDataRequest;
 exports.parseBlockDataRequest = parseBlockDataRequest;
 exports.resolveBlockData = resolveBlockData;

package/dist/internal-server.d.cts

@@ -42,4 +42,13 @@ declare function parseBlockDataRequest(body: unknown): CmssyBlockDataRequest;
 declare function resolveBlockDataRequest(request: CmssyBlockDataRequest, options: ResolveBlockDataRequestOptions): Promise<CmssyBlockDataResult>;
 declare function handleBlockDataRequest(body: unknown, options: ResolveBlockDataRequestOptions): Promise<Response>;
 
-export { type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };
+interface CmssyBlockDataHandlerOptions {
+    forms?: Record<string, CmssyFormDefinition>;
+    appContext?: Record<string, unknown>;
+    workspaceId?: string;
+}
+declare function createBlockDataHandler(config: CmssyClientConfig & {
+    draftSecret?: string;
+}, blocks: BlockDefinition[], options?: CmssyBlockDataHandlerOptions): (request: Request) => Promise<Response>;
+
+export { type CmssyBlockDataHandlerOptions, type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };

package/dist/internal-server.d.ts

@@ -42,4 +42,13 @@ declare function parseBlockDataRequest(body: unknown): CmssyBlockDataRequest;
 declare function resolveBlockDataRequest(request: CmssyBlockDataRequest, options: ResolveBlockDataRequestOptions): Promise<CmssyBlockDataResult>;
 declare function handleBlockDataRequest(body: unknown, options: ResolveBlockDataRequestOptions): Promise<Response>;
 
-export { type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };
+interface CmssyBlockDataHandlerOptions {
+    forms?: Record<string, CmssyFormDefinition>;
+    appContext?: Record<string, unknown>;
+    workspaceId?: string;
+}
+declare function createBlockDataHandler(config: CmssyClientConfig & {
+    draftSecret?: string;
+}, blocks: BlockDefinition[], options?: CmssyBlockDataHandlerOptions): (request: Request) => Promise<Response>;
+
+export { type CmssyBlockDataHandlerOptions, type CmssyBlockDataRequest, type CmssyBlockDataRequestBlock, type CmssyBlockDataRequestPage, type CmssyBlockDataResult, type ResolveBlockDataRequestOptions, createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockDataRequest };

package/dist/internal-server.js

@@ -1,5 +1,5 @@
 import { buildBlockContext, getBlockContentForLanguage, resolveRelationContent, normalizeBlockContent } from '@cmssy/core/internal';
-import { blocksToSchemas } from '@cmssy/core';
+import { blocksToSchemas, verifyCmssyEditToken, CMSSY_EDIT_TOKEN_HEADER } from '@cmssy/core';
 export { blocksToSchemas } from '@cmssy/core';
 
 // src/components/resolve-block-data.ts
@@ -263,5 +263,43 @@ async function handleBlockDataRequest(body, options) {
     headers: { "cache-control": "no-store" }
   });
 }
+function pageOf(body) {
+  if (typeof body !== "object" || body === null) return "";
+  const page = body.page;
+  if (typeof page !== "object" || page === null) return "";
+  const slug = page.slug;
+  return typeof slug === "string" ? slug : "";
+}
+function createBlockDataHandler(config, blocks, options = {}) {
+  return async function handle(request) {
+    if (!config.draftSecret) {
+      return new Response(
+        "cmssy: the block data route needs config.draftSecret to verify the editor",
+        { status: 500 }
+      );
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return Response.json(
+        { message: "cmssy: body is not JSON" },
+        { status: 400 }
+      );
+    }
+    const authorized = await verifyCmssyEditToken(
+      request.headers.get(CMSSY_EDIT_TOKEN_HEADER),
+      config.draftSecret,
+      { page: pageOf(body) }
+    );
+    if (!authorized) {
+      return new Response(
+        "cmssy: block data needs the edit token the editor page was rendered with",
+        { status: 403 }
+      );
+    }
+    return handleBlockDataRequest(body, { blocks, config, ...options });
+  };
+}
 
-export { handleBlockDataRequest, parseBlockDataRequest, resolveBlockData, resolveBlockDataRequest, resolveEditorBlockData, resolveEditorLayoutBlockData, resolveLayoutBlockData };
+export { createBlockDataHandler, handleBlockDataRequest, parseBlockDataRequest, resolveBlockData, resolveBlockDataRequest, resolveEditorBlockData, resolveEditorLayoutBlockData, resolveLayoutBlockData };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/react",
-  "version": "16.8.0",
+  "version": "16.9.1",
   "description": "React blocks, renderers, data client and editor bridge for cmssy headless sites",
   "keywords": [
     "cmssy",
@@ -97,7 +97,7 @@
   },
   "dependencies": {
     "@cmssy/types": "0.49.0",
-    "@cmssy/core": "16.8.0"
+    "@cmssy/core": "16.9.1"
   },
   "scripts": {
     "build": "tsup",