@decocms/blocks-admin 7.28.1 → 8.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks-admin",
-  "version": "7.28.1",
+  "version": "8.0.0",
   "type": "module",
   "description": "Deco admin protocol: /live/_meta, /.decofile, /deco/invoke, /deco/render, plus admin-facing site setup and commerce-app auto-configuration",
   "repository": {
@@ -25,7 +25,7 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.28.1"
+    "@decocms/blocks": "8.0.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/admin/invoke.test.ts

@@ -15,6 +15,7 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { clearDraftCache, loadBlocks, setBlocks } from "@decocms/blocks/cms";
 import { RequestContext } from "@decocms/blocks/sdk/requestContext";
 import {
   clearInvokeHandlers,
@@ -139,3 +140,81 @@ describe("handleInvoke — Set-Cookie propagation (batch)", () => {
     expect(cookies).toContain(COOKIE_C);
   });
 });
+
+/**
+ * Draft binding: /deco/invoke is a separate request from the page render, so
+ * the page's request-scoped draft never reaches it. handleInvoke must
+ * re-resolve the draft from the request it received and bind it, or a
+ * client-fetched (lazy) section resolves its loaders against PUBLISHED blocks.
+ */
+describe("handleInvoke — draft binding", () => {
+  const origFetch = globalThis.fetch;
+
+  beforeEach(() => {
+    clearInvokeHandlers();
+    clearDraftCache();
+    setBlocks({ "site/x": { value: "published" } });
+    registerInvokeHandlers({
+      "site/loaders/x.ts": async () => (loadBlocks() as Record<string, any>)["site/x"],
+    });
+  });
+  afterEach(() => {
+    clearInvokeHandlers();
+    clearDraftCache();
+    globalThis.fetch = origFetch;
+    delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
+  });
+
+  function invokeReq(headers: Record<string, string>): Request {
+    return new Request("https://preview.example/deco/invoke/site/loaders/x.ts", {
+      method: "POST",
+      headers: { "content-type": "application/json", ...headers },
+      body: "{}",
+    });
+  }
+
+  it("resolves loaders against the DRAFT when the request carries an allowed draft cookie", async () => {
+    process.env.DECO_ALLOWED_PREVIEW_HOSTS = "preview.example";
+    globalThis.fetch = (async () =>
+      new Response(JSON.stringify({ "site/x": { value: "draft" } }), {
+        headers: { "content-type": "application/json" },
+      })) as unknown as typeof fetch;
+
+    const res = await handleInvoke(
+      invokeReq({
+        "x-forwarded-host": "preview.example",
+        cookie: "__deco_draft=abc.preview-studio.decocms.com@vX",
+      }),
+    );
+    expect(await res.json()).toEqual({ value: "draft" });
+  });
+
+  it("resolves against PUBLISHED blocks when no draft cookie is present — no network", async () => {
+    process.env.DECO_ALLOWED_PREVIEW_HOSTS = "preview.example";
+    let called = false;
+    globalThis.fetch = (async () => {
+      called = true;
+      return new Response("{}");
+    }) as unknown as typeof fetch;
+
+    const res = await handleInvoke(invokeReq({ "x-forwarded-host": "preview.example" }));
+    expect(await res.json()).toEqual({ value: "published" });
+    expect(called).toBe(false);
+  });
+
+  it("ignores a draft cookie on a non-allowed host (production stays published)", async () => {
+    process.env.DECO_ALLOWED_PREVIEW_HOSTS = "preview.example";
+    globalThis.fetch = (async () =>
+      new Response(JSON.stringify({ "site/x": { value: "draft" } }), {
+        headers: { "content-type": "application/json" },
+      })) as unknown as typeof fetch;
+
+    const res = await handleInvoke(
+      invokeReq({
+        "x-forwarded-host": "prod.example",
+        cookie: "__deco_draft=abc.preview-studio.decocms.com@vX",
+      }),
+    );
+    expect(await res.json()).toEqual({ value: "published" });
+  });
+});

package/src/admin/invoke.ts

@@ -13,6 +13,7 @@
  * copies those headers into the final HTTP Response.
  */
 
+import { resolveDraftForRequest, withBlocksOverride } from "@decocms/blocks/cms";
 import { RequestContext } from "@decocms/blocks/sdk/requestContext";
 
 export type InvokeLoader = (props: any, request: Request) => Promise<any>;
@@ -213,7 +214,27 @@ function warnMissingHandlerOnce(key: string): void {
   console.warn(`[invoke] ${unknownHandlerMessage(key)}`);
 }
 
+/**
+ * Bind a draft, if the request carries one, for the whole invoke resolution.
+ *
+ * A loader/action reaches `loadBlocks()` while resolving its `__resolveType`
+ * refs; without this, `/deco/invoke` — a separate request from the page render,
+ * so the page's request-scoped draft binding never reaches it — would resolve
+ * against PUBLISHED blocks and hand a reviewer stale content in any
+ * client-fetched (lazy/on-scroll) or self-fetched section. `withBlocksOverride`
+ * uses AsyncLocalStorage, so each concurrent invoke gets its own override with
+ * no cross-request bleed (the same isolation the layout-cache race taught us to
+ * keep). Inert unless the draft gate passes — no draft, no wrap, published path
+ * untouched.
+ */
 export async function handleInvoke(request: Request): Promise<Response> {
+  const draftBlocks = await resolveDraftForRequest(request);
+  return draftBlocks
+    ? withBlocksOverride(draftBlocks, () => dispatchInvoke(request))
+    : dispatchInvoke(request);
+}
+
+async function dispatchInvoke(request: Request): Promise<Response> {
   const url = new URL(request.url);
   const pathParts = url.pathname.split("/deco/invoke/");
   const invokeKey = pathParts[1] || "";