@decocms/blocks 7.34.2 → 7.34.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.34.2",
+  "version": "7.34.4",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/cms/applySectionConventions.ts

@@ -10,6 +10,7 @@ import { registerSection, registerSectionsSync } from "./registry";
 import {
   type AsyncRenderingConfig,
   getAsyncRenderingConfig,
+  registerAlwaysDeferSections,
   registerEagerSections,
   registerNeverDeferSections,
   registerSeoSections,
@@ -24,6 +25,7 @@ import {
 export interface SectionMetaEntry {
   eager?: boolean;
   neverDefer?: boolean;
+  deferred?: boolean;
   cache?: string;
   layout?: boolean;
   sync?: boolean;
@@ -48,6 +50,7 @@ export function applySectionConventions(input: ApplySectionConventionsInput): vo
 
   const eagerSections: string[] = [];
   const neverDeferSections: string[] = [];
+  const alwaysDeferSections: string[] = [];
   const layoutSections: string[] = [];
   const seoSections: string[] = [];
   const cacheableSections: Record<string, CacheableSectionInput> = {};
@@ -55,6 +58,7 @@ export function applySectionConventions(input: ApplySectionConventionsInput): vo
   for (const [key, entry] of Object.entries(meta)) {
     if (entry.eager) eagerSections.push(key);
     if (entry.neverDefer) neverDeferSections.push(key);
+    if (entry.deferred) alwaysDeferSections.push(key);
     if (entry.layout) layoutSections.push(key);
     if (entry.seo) seoSections.push(key);
     if (entry.cache) cacheableSections[key] = entry.cache as CacheableSectionInput;
@@ -88,6 +92,10 @@ export function applySectionConventions(input: ApplySectionConventionsInput): vo
     registerNeverDeferSections(neverDeferSections);
   }
 
+  if (alwaysDeferSections.length > 0) {
+    registerAlwaysDeferSections(alwaysDeferSections);
+  }
+
   // Always initialize asyncConfig so CMS Lazy deferral (`respectCmsLazy`) is
   // active — this is what makes the admin ⚡ toggle the source of truth. Without
   // it, asyncConfig stays null, `useAsync` is false in resolveDecoPage, and

package/src/cms/resolve.test.ts

@@ -32,6 +32,7 @@ import {
   isEagerRequest,
   registerCommerceLoader,
   registerEagerSections,
+  registerAlwaysDeferSections,
   registerNeverDeferSections,
   resolveDecoPage,
   resolveDeferredSectionFull,
@@ -468,6 +469,22 @@ describe("shouldDeferSection — admin is the source of truth", () => {
     expect(shouldDeferSection(section, 5, mkCfg({ foldThreshold: 3 }), false)).toBe(true);
     expect(shouldDeferSection(section, 1, mkCfg({ foldThreshold: 3 }), false)).toBe(false);
   });
+
+  it("`export const deferred = true` defers one section even with respectCmsLazy off", () => {
+    const key = "site/sections/HeavyPLP.tsx";
+    registerAlwaysDeferSections([key]);
+    const section = { __resolveType: key };
+    // Not ⚡-wrapped and respectCmsLazy disabled — the per-section flag is the
+    // only thing forcing deferral here.
+    expect(shouldDeferSection(section, 0, mkCfg({ respectCmsLazy: false }), false)).toBe(true);
+  });
+
+  it("`export const deferred = true` still stays eager for bots (SEO)", () => {
+    const key = "site/sections/HeavyPLPBot.tsx";
+    registerAlwaysDeferSections([key]);
+    const section = { __resolveType: key };
+    expect(shouldDeferSection(section, 0, mkCfg({ respectCmsLazy: false }), true)).toBe(false);
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/cms/resolve.ts

@@ -243,6 +243,28 @@ function isNeverDeferSection(key: string): boolean {
   return (G.__deco.neverDeferSectionKeys as Set<string> | undefined)?.has(key) ?? false;
 }
 
+// ---------------------------------------------------------------------------
+// Permanent alwaysDefer section registry
+// ---------------------------------------------------------------------------
+
+/**
+ * Register sections that declared `export const deferred = true`.
+ * These sections are ALWAYS deferred (rendered client-side on scroll),
+ * independent of the global `respectCmsLazy` config — the per-section opt-in
+ * for async-rendering a single heavy section (e.g. a PLP grid) without
+ * turning on deferral site-wide. Bots stay eager via the `isBotReq`
+ * short-circuit in {@link shouldDeferSection}.
+ */
+export function registerAlwaysDeferSections(keys: string[]): void {
+  G.__deco.alwaysDeferSectionKeys ??= new Set();
+  const set: Set<string> = G.__deco.alwaysDeferSectionKeys;
+  for (const k of keys) set.add(k);
+}
+
+function isAlwaysDeferSection(key: string): boolean {
+  return (G.__deco.alwaysDeferSectionKeys as Set<string> | undefined)?.has(key) ?? false;
+}
+
 // ---------------------------------------------------------------------------
 // Deferred rawProps cache — keeps rawProps server-side to trim HTML payload
 // ---------------------------------------------------------------------------
@@ -1497,6 +1519,12 @@ export function shouldDeferSection(
   const finalKey = resolveFinalSectionKey(section, matcherCtx);
   if (!finalKey) return false;
 
+  // ── PER-SECTION FORCE-DEFER (`export const deferred = true`) ───────────────
+  // Explicit code-level opt-in to defer one section regardless of the global
+  // `respectCmsLazy` config — lets a site async-render a single heavy section
+  // without a site-wide skeleton sweep. Bots already returned eager above.
+  if (isAlwaysDeferSection(finalKey)) return true;
+
   // ── ADMIN IS THE SOURCE OF TRUTH ──────────────────────────────────────────
   // If the editor marked the section ⚡ (wrapped in CMS Lazy/Deferred at any
   // nesting level, including multivariate flags), it is deferred —

package/src/sdk/crypto.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Regression test for the CF Workers secret-decryption bug: in production/preview
+ * DECO_CRYPTO_KEY is neither in process.env nor in .dev.vars — it only reaches
+ * getEnvVar() via the `env` binding stashed in RequestContext (setRuntimeEnv).
+ * If getEnvVar() stops consulting getRuntimeEnv(), encrypted secrets silently
+ * decrypt to null in production and this test fails.
+ */
+
+import { webcrypto } from "node:crypto";
+import { beforeAll, describe, expect, it } from "vitest";
+import { resolveSecret } from "./crypto";
+import { setRuntimeEnv } from "./otelAdapters";
+import { RequestContext } from "./requestContext";
+
+// Ensure crypto.subtle exists in the Node test runtime.
+beforeAll(() => {
+  if (!globalThis.crypto?.subtle) {
+    (globalThis as { crypto: Crypto }).crypto = webcrypto as unknown as Crypto;
+  }
+});
+
+/** Build a DECO_CRYPTO_KEY value + an encrypted-hex ciphertext for `plaintext`. */
+async function makeKeyAndCiphertext(plaintext: string) {
+  const rawKey = webcrypto.getRandomValues(new Uint8Array(16));
+  const iv = webcrypto.getRandomValues(new Uint8Array(16));
+  const key = await webcrypto.subtle.importKey("raw", rawKey, "AES-CBC", false, [
+    "encrypt",
+  ]);
+  const ct = new Uint8Array(
+    await webcrypto.subtle.encrypt(
+      { name: "AES-CBC", iv },
+      key,
+      new TextEncoder().encode(plaintext),
+    ),
+  );
+  const encryptedHex = Array.from(ct)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+  const decoCryptoKey = btoa(
+    JSON.stringify({ key: Array.from(rawKey), iv: Array.from(iv) }),
+  );
+  return { decoCryptoKey, encryptedHex };
+}
+
+describe("resolveSecret in CF Workers (no process.env / no .dev.vars)", () => {
+  it("decrypts using DECO_CRYPTO_KEY from the RequestContext env binding", async () => {
+    // Use a unique plaintext so the module-level secretCache can't mask a
+    // regression with a value cached by another test/run.
+    const plaintext = `appToken-${Math.random().toString(36).slice(2)}`;
+    const { decoCryptoKey, encryptedHex } = await makeKeyAndCiphertext(plaintext);
+
+    // Guard: process.env must NOT carry the key, so the only source is the ALS.
+    expect(process.env.DECO_CRYPTO_KEY).toBeUndefined();
+
+    const resolved = await RequestContext.run(
+      new Request("https://site.example/"),
+      async () => {
+        setRuntimeEnv({ DECO_CRYPTO_KEY: decoCryptoKey });
+        return resolveSecret({ encrypted: encryptedHex });
+      },
+    );
+
+    expect(resolved).toBe(plaintext);
+  });
+});

package/src/sdk/crypto.ts

@@ -15,6 +15,8 @@
  *   const apiKey = await resolveSecret(block.apiKey, "RESEND_API_KEY");
  */
 
+import { getRuntimeEnv } from "./otelAdapters";
+
 const textDecoder = new TextDecoder();
 const textEncoder = new TextEncoder();
 
@@ -150,10 +152,13 @@ export async function resolveSecret(
 }
 
 /**
- * Get an environment variable, checking process.env first, then .dev.vars file.
+ * Get an environment variable, checking process.env first, then .dev.vars file,
+ * then the Cloudflare Workers `env` binding stashed in RequestContext.
  * Cloudflare Workers dev mode stores env vars in .dev.vars but they're only
  * accessible via the `env` binding inside request handlers. During setup.ts
- * (module-level init), we need to read the file directly.
+ * (module-level init), we need to read the file directly. In production/preview
+ * there is no .dev.vars and no process.env — the only source is the `env` object
+ * passed to the fetch handler, which workerEntry.ts stashes via setRuntimeEnv().
  */
 function getEnvVar(name: string): string | undefined {
 	// 1. process.env (works in Node, may work in Workers with nodejs_compat)
@@ -181,5 +186,14 @@ function getEnvVar(name: string): string | undefined {
 		// fs not available (e.g., pure Worker runtime) — ignore
 	}
 
+	// 3. CF Workers `env` binding, stashed per-request in RequestContext by
+	// workerEntry.ts's setRuntimeEnv(env). This is the ONLY source in a real
+	// Workers production/preview deploy (no process.env, no .dev.vars). Returns
+	// undefined at module-init time (no active request) — that's why apps are
+	// re-configured on the first request via reconfigureAppsOnce().
+	const runtimeEnv = getRuntimeEnv();
+	const v = runtimeEnv?.[name];
+	if (typeof v === "string" && v) return v;
+
 	return undefined;
 }