@decocms/blocks 7.28.0-beta.0 → 7.28.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.28.0-beta.0",
+  "version": "7.28.0-beta.2",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/cms/draftSource.test.ts

@@ -3,13 +3,15 @@ import { beforeEach, describe, expect, it } from "vitest";
 import {
   buildDraftOrigin,
   clearDraftCache,
+  DEFAULT_SANDBOX_ORIGIN_SUFFIXES,
+  isDraftHostAllowed,
   isDraftPreviewEnabled,
   parseDraftPointer,
   resolveDraftDecofile,
 } from "./draftSource";
 
 const ENV_ON = {
-  DECO_DRAFT_PREVIEW: "1",
+  DECO_DRAFT_PREVIEW_HOST: "preview.example",
   DECO_SANDBOX_ORIGIN_SUFFIXES: ".preview-studio.decocms.com",
 };
 
@@ -57,24 +59,27 @@ describe("parseDraftPointer", () => {
 
 describe("buildDraftOrigin", () => {
   it("builds https from the configured suffix", () => {
-    expect(buildDraftOrigin("abc", [".preview-studio.decocms.com"])).toBe(
+    expect(buildDraftOrigin("abc", ".preview-studio.decocms.com")).toBe(
       "https://abc.preview-studio.decocms.com",
     );
   });
 
   it("uses http for a localhost suffix (local e2e)", () => {
-    expect(buildDraftOrigin("abc", [".localhost:3200"])).toBe("http://abc.localhost:3200");
+    expect(buildDraftOrigin("abc", ".localhost:3200")).toBe("http://abc.localhost:3200");
   });
 
   it("returns null with no configured suffix — never guesses an origin", () => {
-    expect(buildDraftOrigin("abc", [])).toBeNull();
+    expect(buildDraftOrigin("abc", "")).toBeNull();
   });
 });
 
 describe("isDraftPreviewEnabled", () => {
-  it("needs both the flag and a suffix", () => {
+  it("is on iff an allowed host is configured — suffixes have defaults", () => {
+    // Inverted from the old two-key gate: suffixes now default to the
+    // deco-operated origins, so the single opt-in is the host allowlist.
+    // Upgrading the package with no host configured stays fully inert.
     expect(isDraftPreviewEnabled(ENV_ON)).toBe(true);
-    expect(isDraftPreviewEnabled({ DECO_DRAFT_PREVIEW: "1" })).toBe(false);
+    expect(isDraftPreviewEnabled({ DECO_DRAFT_PREVIEW_HOST: "a.example" })).toBe(true);
     expect(
       isDraftPreviewEnabled({
         DECO_SANDBOX_ORIGIN_SUFFIXES: ".preview-studio.decocms.com",
@@ -84,7 +89,41 @@ describe("isDraftPreviewEnabled", () => {
   });
 });
 
+describe("isDraftHostAllowed", () => {
+  const env = { DECO_DRAFT_PREVIEW_HOST: "fila.vtex.app, localhost:3100" };
+
+  it("matches listed hosts verbatim, port included, case-insensitively", () => {
+    expect(isDraftHostAllowed("fila.vtex.app", env)).toBe(true);
+    expect(isDraftHostAllowed("FILA.VTEX.APP", env)).toBe(true);
+    expect(isDraftHostAllowed("localhost:3100", env)).toBe(true);
+  });
+
+  it("rejects everything else — the production domain on the same build", () => {
+    expect(isDraftHostAllowed("fila.com.br", env)).toBe(false);
+    expect(isDraftHostAllowed("localhost", env)).toBe(false); // port matters
+    expect(isDraftHostAllowed(null, env)).toBe(false);
+    expect(isDraftHostAllowed("fila.vtex.app", {})).toBe(false);
+  });
+});
+
 describe("resolveDraftDecofile", () => {
+  it("uses the default deco suffixes when none are configured", async () => {
+    const calls: string[] = [];
+    await resolveDraftDecofile({
+      pointer: "abc@v1",
+      env: { DECO_DRAFT_PREVIEW_HOST: "preview.example" },
+      fetchImpl: (async (url: string) => {
+        calls.push(String(url));
+        throw new Error("unreachable");
+      }) as unknown as typeof fetch,
+    });
+    expect(calls).toEqual(
+      DEFAULT_SANDBOX_ORIGIN_SUFFIXES.map(
+        (sfx) => `${sfx.includes("localhost") ? "http" : "https"}://abc${sfx}/_sandbox/decofile`,
+      ),
+    );
+  });
+
   it("fetches the sandbox decofile and returns it", async () => {
     const calls: string[] = [];
     const blocks = await resolveDraftDecofile({
@@ -100,7 +139,7 @@ describe("resolveDraftDecofile", () => {
     expect(calls).toEqual(["https://abc.preview-studio.decocms.com/_sandbox/decofile"]);
   });
 
-  it("is inert unless explicitly enabled — no fetch at all", async () => {
+  it("is inert without a host allowlist — no fetch at all", async () => {
     let called = false;
     const blocks = await resolveDraftDecofile({
       pointer: "abc@v1",
@@ -152,6 +191,30 @@ describe("resolveDraftDecofile", () => {
     expect(fetches).toBe(5);
   });
 
+  it("falls through the suffix list until one origin answers", async () => {
+    // A deployment can serve sandboxes from more than one origin (cluster and
+    // desktop-link); the handle doesn't say which. The first suffix here is
+    // unreachable — the resolver must try the next, not give up.
+    const calls: string[] = [];
+    const blocks = await resolveDraftDecofile({
+      pointer: "abc@v1",
+      env: {
+        DECO_DRAFT_PREVIEW_HOST: "preview.example",
+        DECO_SANDBOX_ORIGIN_SUFFIXES: ".dead.example, .alive.example",
+      },
+      fetchImpl: (async (url: string) => {
+        calls.push(String(url));
+        if (String(url).includes("dead")) throw new Error("ECONNREFUSED");
+        return jsonResponse({ ok: true });
+      }) as unknown as typeof fetch,
+    });
+    expect(blocks).toEqual({ ok: true });
+    expect(calls).toEqual([
+      "https://abc.dead.example/_sandbox/decofile",
+      "https://abc.alive.example/_sandbox/decofile",
+    ]);
+  });
+
   it("degrades to published on a malformed pointer, without fetching", async () => {
     let called = false;
     const blocks = await resolveDraftDecofile({

package/src/cms/draftSource.ts

@@ -14,9 +14,12 @@
  * dependency-injection shape as `setFastDeployKVGetter`, so `blocks` keeps its
  * zero-dependency direction.
  *
- * Inert unless BOTH `DECO_DRAFT_PREVIEW=1` and `DECO_SANDBOX_ORIGIN_SUFFIXES`
- * are set, mirroring Fast Deploy's opt-in: upgrading the package must never be
- * enough to start fetching from the network and rendering unpublished content.
+ * Inert unless `DECO_DRAFT_PREVIEW_HOST` names the request's host: upgrading
+ * the package must never be enough to start fetching from the network and
+ * rendering unpublished content. Host-scoping (rather than a boolean) exists
+ * because one deployment commonly serves several domains — the preview domain
+ * may render drafts while the production domain, on the same build, must
+ * ignore a `?__draft=` entirely.
  */
 
 /** A parsed `<handle>@<version>` draft pointer. */
@@ -54,23 +57,75 @@ export function parseDraftPointer(raw: string | null | undefined): DraftPointer
   return { handle, version };
 }
 
-/** Configured suffixes, e.g. `.preview-studio.decocms.com,.localhost:3200`. */
+/**
+ * Default sandbox origin suffixes — deco-operated domains, so shipping them as
+ * defaults adds no SSRF surface: the origin is still configuration, never
+ * caller input. `DECO_SANDBOX_ORIGIN_SUFFIXES` overrides (e.g. to pin a local
+ * link port: `.localhost:60534`).
+ */
+export const DEFAULT_SANDBOX_ORIGIN_SUFFIXES = [
+  ".preview-studio.decocms.com",
+  ".local.studio.decocms.com",
+  ".localhost",
+];
+
+/**
+ * Suffixes are tried in order until one answers — a deployment can serve
+ * sandboxes from more than one origin (cluster and desktop-link), and the
+ * handle alone does not say which one it lives under.
+ */
 function readSuffixes(env: Record<string, string | undefined>): string[] {
-  return (env.DECO_SANDBOX_ORIGIN_SUFFIXES ?? "")
+  const configured = (env.DECO_SANDBOX_ORIGIN_SUFFIXES ?? "")
     .split(",")
     .map((s) => s.trim())
     .filter(Boolean);
+  return configured.length > 0 ? configured : DEFAULT_SANDBOX_ORIGIN_SUFFIXES;
+}
+
+/** Hosts allowed to render drafts (`DECO_DRAFT_PREVIEW_HOST`, comma list). */
+function readAllowedHosts(env: Record<string, string | undefined>): string[] {
+  return (env.DECO_DRAFT_PREVIEW_HOST ?? "")
+    .split(",")
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+/**
+ * Whether `host` (as seen on the request) may render drafts.
+ *
+ * Compared against `DECO_DRAFT_PREVIEW_HOST` verbatim, port included — local
+ * dev is `localhost:3100`, not `localhost`. The header is spoofable by a
+ * direct-to-origin request, but the sandbox handle is the actual capability;
+ * host-scoping bounds blast radius (production domains stay inert), it is not
+ * a secret.
+ */
+export function isDraftHostAllowed(
+  host: string | null | undefined,
+  env?: Record<string, string | undefined>,
+): boolean {
+  if (!host) return false;
+  const e = envOrProcess(env);
+  return readAllowedHosts(e).includes(host.trim().toLowerCase());
+}
+
+function envOrProcess(
+  env?: Record<string, string | undefined>,
+): Record<string, string | undefined> {
+  return (
+    env ??
+    (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ??
+    {}
+  );
 }
 
 /**
- * Build the sandbox origin for a handle.
+ * Build the sandbox origin for a handle under ONE configured suffix.
  *
- * The origin comes from CONFIGURED suffixes, never from caller input, so there
- * is no SSRF surface to defend and no allowlist to keep correct. A `localhost`
+ * The origin comes from configuration, never from caller input, so there is no
+ * SSRF surface to defend and no allowlist to keep correct. A `localhost`
  * suffix (local e2e) speaks http; everything else is https.
  */
-export function buildDraftOrigin(handle: string, suffixes: string[]): string | null {
-  const suffix = suffixes[0];
+export function buildDraftOrigin(handle: string, suffix: string): string | null {
   if (!suffix) return null;
   if (!HANDLE_RE.test(handle)) return null;
   const scheme = suffix.includes("localhost") ? "http" : "https";
@@ -125,11 +180,8 @@ export interface ResolveDraftOptions {
 export async function resolveDraftDecofile(
   options: ResolveDraftOptions,
 ): Promise<Record<string, unknown> | null> {
-  const env =
-    options.env ??
-    (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ??
-    {};
-  if (env.DECO_DRAFT_PREVIEW !== "1") return null;
+  const env = envOrProcess(options.env);
+  if (readAllowedHosts(env).length === 0) return null;
 
   const parsed = parseDraftPointer(options.pointer);
   if (!parsed) return null;
@@ -137,36 +189,44 @@ export async function resolveDraftDecofile(
   const cached = byVersion.get(parsed.version);
   if (cached) return cached;
 
-  const origin = buildDraftOrigin(parsed.handle, readSuffixes(env));
-  if (!origin) return null;
-
   const doFetch = options.fetchImpl ?? fetch;
-  let res: Response;
-  try {
-    res = await doFetch(`${origin}/_sandbox/decofile`, { cache: "no-store" });
-  } catch {
-    return null;
-  }
-  if (!res.ok) return null;
+  // Suffixes are tried in order; the first that answers with parseable JSON
+  // wins. A miss on one origin (unreachable, non-2xx, garbage) is expected —
+  // the handle only exists under one of them — so every failure falls through
+  // to the next rather than aborting the resolve.
+  for (const suffix of readSuffixes(env)) {
+    const origin = buildDraftOrigin(parsed.handle, suffix);
+    if (!origin) continue;
 
-  let blocks: Record<string, unknown>;
-  try {
-    blocks = (await res.json()) as Record<string, unknown>;
-  } catch {
-    return null;
-  }
+    let res: Response;
+    try {
+      res = await doFetch(`${origin}/_sandbox/decofile`, { cache: "no-store" });
+    } catch {
+      continue;
+    }
+    if (!res.ok) continue;
+
+    let blocks: Record<string, unknown>;
+    try {
+      blocks = (await res.json()) as Record<string, unknown>;
+    } catch {
+      continue;
+    }
 
-  cacheDraft(parsed.version, blocks);
-  return blocks;
+    cacheDraft(parsed.version, blocks);
+    return blocks;
+  }
+  return null;
 }
 
-/** True when the feature is switched on and configured. Inert otherwise. */
+/**
+ * True when any host is allowed to preview. A plain env read — callers use it
+ * to gate BEFORE touching dynamic APIs (`cookies()`/`headers()`), so an
+ * unconfigured site never loses static/ISR rendering. The per-request host
+ * match happens later, in `isDraftHostAllowed`.
+ */
 export function isDraftPreviewEnabled(env?: Record<string, string | undefined>): boolean {
-  const e =
-    env ??
-    (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ??
-    {};
-  return e.DECO_DRAFT_PREVIEW === "1" && readSuffixes(e).length > 0;
+  return readAllowedHosts(envOrProcess(env)).length > 0;
 }
 
 // ---------------------------------------------------------------------------

package/src/cms/index.ts

@@ -16,7 +16,9 @@ export type { DraftPointer, ResolveDraftOptions } from "./draftSource";
 export {
   buildDraftOrigin,
   clearDraftCache,
+  DEFAULT_SANDBOX_ORIGIN_SUFFIXES,
   getRequestDraftOverride,
+  isDraftHostAllowed,
   isDraftPreviewEnabled,
   parseDraftPointer,
   resolveDraftDecofile,