@decocms/blocks 7.41.1 → 7.43.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.41.1",
+  "version": "7.43.0",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/cms/index.ts

@@ -77,7 +77,7 @@ export type {
   SerializedSection,
   SerializeOptions,
 } from "./renderJson";
-export { serializeRenderJson } from "./renderJson";
+export { isSecretValue, serializeRenderJson, stringifyWithoutSecrets } from "./renderJson";
 export type {
   AsyncRenderingConfig,
   CommerceLoader,

package/src/cms/renderJson.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, it } from "vitest";
-import { type RenderJsonModule, serializeRenderJson } from "./renderJson";
+import {
+  isSecretValue,
+  type RenderJsonModule,
+  serializeRenderJson,
+  stringifyWithoutSecrets,
+} from "./renderJson";
 
 const modules: Record<string, RenderJsonModule> = {
   "site/sections/Product/ProductDetails.tsx": {
@@ -127,3 +132,36 @@ describe("serializeRenderJson", () => {
     expect(out).toEqual([{ component: "site/sections/Header.tsx", props: {} }]);
   });
 });
+
+describe("isSecretValue / stringifyWithoutSecrets", () => {
+  it("detects a resolved Secret ({ get: fn }) and an unresolved secret block", () => {
+    expect(isSecretValue({ get: () => "plaintext" })).toBe(true);
+    expect(isSecretValue({ __resolveType: "website/loaders/secret.ts", encrypted: "x" })).toBe(true);
+  });
+
+  it("does not flag content that merely has a `get` method or other shapes", () => {
+    expect(isSecretValue({ get: () => 1, other: true })).toBe(false); // extra key
+    expect(isSecretValue({ token: "abc" })).toBe(false); // plaintext (undetectable by shape)
+    expect(isSecretValue("just a string")).toBe(false);
+    expect(isSecretValue(null)).toBe(false);
+  });
+
+  it("strips Secret-shaped values anywhere in the tree", () => {
+    const payload = {
+      title: "keep",
+      apiKey: { get: () => "SECRET" }, // resolved Secret → dropped
+      nested: { token: { get: () => "SECRET2" }, keep: 1 },
+      list: [{ get: () => "S" }, { real: "item" }],
+      block: { __resolveType: "website/loaders/secret.ts", encrypted: "enc" }, // dropped
+    };
+    const out = JSON.parse(stringifyWithoutSecrets(payload));
+    expect(out).toEqual({
+      title: "keep",
+      nested: { keep: 1 },
+      list: [null, { real: "item" }], // Secret element → null (array slot preserved)
+      // apiKey and block are gone entirely
+    });
+    expect("apiKey" in out).toBe(false);
+    expect("block" in out).toBe(false);
+  });
+});

package/src/cms/renderJson.ts

@@ -147,3 +147,33 @@ export function serializeRenderJson(
   // Interleave eager + lazy by their position in the page's flat section list.
   return [...eager, ...lazy].sort((a, b) => (a.index ?? 0) - (b.index ?? 0)).map((e) => e.out);
 }
+
+/**
+ * A resolved Deco `Secret` is `{ get: () => string | null }` (apps-website
+ * `loaders/secret.ts`) — the plaintext lives behind a function, so JSON.stringify
+ * already drops it to `{}`. An unresolved secret block is `{ __resolveType:
+ * ".../secret.ts", encrypted, ... }`. Neither has any place in a page-as-JSON
+ * payload, so we remove the whole field. Matches by shape, so no content field
+ * is caught by accident.
+ *
+ * Limitation: a *plaintext* secret a loader extracted into a string prop (the
+ * deprecated `SecretString` or a manual `secret.get()`) is indistinguishable from
+ * content — keep secrets as `Secret`, never resolve them into a serialized prop.
+ */
+export function isSecretValue(value: unknown): boolean {
+  if (!value || typeof value !== "object") return false;
+  const o = value as Record<string, unknown>;
+  // Resolved Secret: an object whose only own key is a `get` function.
+  if (typeof o.get === "function" && Object.keys(o).length === 1) return true;
+  // Unresolved secret block (defensive — resolved props usually drop __resolveType).
+  const rt = o.__resolveType;
+  return typeof rt === "string" && /secret/i.test(rt);
+}
+
+/**
+ * `JSON.stringify` that drops any Secret-shaped value ({@link isSecretValue})
+ * anywhere in the tree. Used for both `?renderJson` and `?asJson` bodies.
+ */
+export function stringifyWithoutSecrets(value: unknown): string {
+  return JSON.stringify(value, (_key, v) => (isSecretValue(v) ? undefined : v));
+}