@decocms/blocks 7.28.0-beta.3 → 7.28.0-beta.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.28.0-beta.3",
+  "version": "7.28.0-beta.5",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/cms/draftSource.test.ts

@@ -8,6 +8,7 @@ import {
   parseDraftPointer,
   previewApiOriginForHost,
   resolveDraftDecofile,
+  setDraftPreviewHosts,
 } from "./draftSource";
 
 const ENV_ON = { DECO_ALLOWED_PREVIEW_HOSTS: "preview.example" };
@@ -227,3 +228,31 @@ describe("DEFAULT_PREVIEW_API_DOMAINS", () => {
     ]);
   });
 });
+
+describe("site-block preview hosts", () => {
+  it("enables the feature from the site block alone — no env needed", () => {
+    setDraftPreviewHosts(["fila.vtex.app", "LOCALHOST:3100", 42, "  "]);
+    try {
+      expect(isDraftPreviewEnabled({})).toBe(true);
+      expect(isDraftHostAllowed("fila.vtex.app", {})).toBe(true);
+      // Sanitized: lowercased, non-strings and blanks dropped.
+      expect(isDraftHostAllowed("localhost:3100", {})).toBe(true);
+      expect(isDraftHostAllowed("evil.example", {})).toBe(false);
+    } finally {
+      setDraftPreviewHosts([]);
+    }
+  });
+
+  it("env REPLACES the block hosts when set — the operational escape hatch", () => {
+    setDraftPreviewHosts(["fila.vtex.app"]);
+    try {
+      const env = { DECO_ALLOWED_PREVIEW_HOSTS: "other.example" };
+      expect(isDraftHostAllowed("other.example", env)).toBe(true);
+      // Not merged: env is a kill switch / override, so the block value must
+      // not survive alongside it.
+      expect(isDraftHostAllowed("fila.vtex.app", env)).toBe(false);
+    } finally {
+      setDraftPreviewHosts([]);
+    }
+  });
+});

package/src/cms/draftSource.ts

@@ -108,12 +108,43 @@ export function previewApiOriginForHost(
   return `${local ? "http" : "https"}://${host}${port === undefined ? "" : `:${port}`}`;
 }
 
-/** Hosts allowed to render drafts (`DECO_ALLOWED_PREVIEW_HOSTS`, comma list). */
+/**
+ * Hosts declared by the site itself (the global `site` block's `previewHosts`),
+ * installed once at setup time by the framework binding.
+ *
+ * MUST be fed from the setup-time base blocks, never from `loadBlocks()` at
+ * request time: the request path merges the draft override, and an allowlist
+ * readable through the override could be rewritten by the very draft it gates.
+ */
+// globalThis-backed, like the block loader itself: bundlers can duplicate
+// this module across graphs, and a plain module variable set in one instance
+// is invisible to the others. (The MIDDLEWARE runtime is a separate world
+// even so — which is why the page-side gate is the authoritative one and the
+// middleware only hard-gates when the env override is present.)
+const G = globalThis as { __decoDraftHosts?: string[] };
+
+/** Install the site-declared preview hosts. Called by the framework binding at setup. */
+export function setDraftPreviewHosts(hosts: readonly unknown[]): void {
+  G.__decoDraftHosts = hosts
+    .filter((h): h is string => typeof h === "string")
+    .map((h) => h.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+/**
+ * Hosts allowed to render drafts.
+ *
+ * The site block is the expected source — the opt-in lives in the repo,
+ * reviewed in a PR, versioned with branches. `DECO_ALLOWED_PREVIEW_HOSTS`
+ * REPLACES it when set: an operational escape hatch (kill a bad value without
+ * a deploy, add a machine-specific port) — not the primary configuration.
+ */
 function readAllowedHosts(env: Record<string, string | undefined>): string[] {
-  return (env.DECO_ALLOWED_PREVIEW_HOSTS ?? "")
+  const fromEnv = (env.DECO_ALLOWED_PREVIEW_HOSTS ?? "")
     .split(",")
     .map((s) => s.trim().toLowerCase())
     .filter(Boolean);
+  return fromEnv.length > 0 ? fromEnv : (G.__decoDraftHosts ?? []);
 }
 
 /**

package/src/cms/index.ts

@@ -23,6 +23,7 @@ export {
   previewApiOriginForHost,
   resolveDraftDecofile,
   setDraftOverrideGetter,
+  setDraftPreviewHosts,
 } from "./draftSource";
 export type { DecoPage, Resolvable } from "./loader";
 export {