@decocms/nextjs 7.28.0-beta.0 → 7.28.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/nextjs",
-  "version": "7.28.0-beta.0",
+  "version": "7.28.0-beta.2",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -29,8 +29,8 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.28.0-beta.0",
-    "@decocms/blocks-admin": "7.28.0-beta.0"
+    "@decocms/blocks": "7.28.0-beta.2",
+    "@decocms/blocks-admin": "7.28.0-beta.2"
   },
   "peerDependencies": {
     "next": ">=15.0.0",

package/src/createDecoPage.draft.test.tsx

@@ -13,7 +13,10 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 
 // The gate must stop us reaching cookies() at all when the feature is off.
 const cookiesMock = vi.fn(async () => ({ get: () => undefined }));
-vi.mock("next/headers", () => ({ cookies: () => cookiesMock() }));
+vi.mock("next/headers", () => ({
+  cookies: () => cookiesMock(),
+  headers: async () => new Headers(),
+}));
 
 // `connection()` is Next's runtime opt-out from static rendering; outside a
 // request scope it throws, so it is stubbed to a no-op here.
@@ -39,7 +42,7 @@ function seedPublishedHome() {
 afterEach(() => {
   cookiesMock.mockClear();
   connectionMock.mockClear();
-  delete process.env.DECO_DRAFT_PREVIEW;
+  delete process.env.DECO_DRAFT_PREVIEW_HOST;
   delete process.env.DECO_SANDBOX_ORIGIN_SUFFIXES;
 });
 
@@ -72,8 +75,7 @@ describe("createDecoPage — draft preview gate", () => {
   });
 
   it("reads cookies() once the feature is fully configured", async () => {
-    process.env.DECO_DRAFT_PREVIEW = "1";
-    process.env.DECO_SANDBOX_ORIGIN_SUFFIXES = ".preview-studio.decocms.com";
+    process.env.DECO_DRAFT_PREVIEW_HOST = "preview.example";
     seedPublishedHome();
 
     const { default: Page } = createDecoPage({ siteName: "test-site" });

package/src/createDecoPage.tsx

@@ -90,7 +90,8 @@ export function createDecoPage({ siteName }: CreateDecoPageOptions) {
    *     first wins for both. So this must be awaited at the top of BOTH, not
    *     just the page. `cache()` here makes the second call free.
    *
-   * Gated on `isDraftPreviewEnabled()` — a plain env read, not a dynamic API —
+   * Gated on `isDraftPreviewEnabled()` (DECO_DRAFT_PREVIEW_HOST non-empty) — a
+   * plain env read, not a dynamic API —
    * so sites that never opt in behave exactly as before. That gate is doing
    * real work: `cookies()` and `searchParams` are both dynamic, and touching
    * them unconditionally would opt EVERY page out of static/ISR rendering.

package/src/draft.ts

@@ -22,8 +22,12 @@
  * i.e. the page component. `ensureDraft()` exists so each site makes one call
  * instead of re-deriving that ordering rule.
  */
-import { resolveDraftDecofile, setDraftOverrideGetter } from "@decocms/blocks/cms";
-import { cookies } from "next/headers";
+import {
+  isDraftHostAllowed,
+  resolveDraftDecofile,
+  setDraftOverrideGetter,
+} from "@decocms/blocks/cms";
+import { cookies, headers } from "next/headers";
 import { cache } from "react";
 
 /** Cookie that carries the pointer across in-preview navigation. */
@@ -116,6 +120,14 @@ export async function ensureDraft(searchParams?: DraftSearchParams): Promise<boo
   const pointer = selectDraftPointer(searchParams, cookieStore.get(DRAFT_COOKIE)?.value);
   if (!pointer) return false;
 
+  // Host gate, checked only once a pointer exists (headers() is a dynamic
+  // API): the same build may serve the preview domain and the production
+  // domain, and only hosts named in DECO_DRAFT_PREVIEW_HOST may render
+  // drafts — production stays published no matter what the URL carries.
+  const requestHeaders = await headers();
+  const host = requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
+  if (!isDraftHostAllowed(host)) return false;
+
   const blocks = await resolveDraftDecofile({ pointer });
   if (!blocks) return false;
 

package/src/draftMiddleware.test.ts

@@ -1,8 +1,16 @@
 import { NextRequest, NextResponse } from "next/server";
-import { describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { DRAFT_COOKIE } from "./draft";
-import { applyDraft, prepareDraft } from "./draftMiddleware";
+import { applyDraft, prepareDraft, rewriteToDraftRoute } from "./draftMiddleware";
+
+beforeEach(() => {
+  // The middleware is host-gated; these tests run as the allowed host.
+  process.env.DECO_DRAFT_PREVIEW_HOST = "site.example";
+});
+afterEach(() => {
+  delete process.env.DECO_DRAFT_PREVIEW_HOST;
+});
 
 function request(url: string, cookie?: string): NextRequest {
   const req = new NextRequest(new URL(url), {
@@ -20,6 +28,14 @@ describe("prepareDraft", () => {
     expect(prepareDraft(request("https://site.example/p", "abc@v1")).pointer).toBe("abc@v1");
   });
 
+  it("is inert on a host outside the allowlist — the production domain", () => {
+    // Same build, different Host: no cookie, no rewrite, nothing touched.
+    const req = request("https://fila.com.br/p?__draft=abc@v1");
+    process.env.DECO_DRAFT_PREVIEW_HOST = "fila.vtex.app";
+    expect(prepareDraft(req)).toEqual({ pointer: null, setCookie: null, clearCookie: false });
+    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
+  });
+
   it("ignores a client-supplied draft header — the page owns the decision", () => {
     // There is no request-header path any more; the page reads searchParams
     // and cookies itself, so a forged header is simply not an input.
@@ -79,3 +95,39 @@ describe("applyDraft", () => {
     expect(res.headers.get("cache-control")).toBeNull();
   });
 });
+
+describe("rewriteToDraftRoute", () => {
+  it("rewrites a drafted request onto the dynamic draft route", () => {
+    const req = request("https://site.example/blog/hello?__draft=abc@v1");
+    const res = rewriteToDraftRoute(req, prepareDraft(req));
+    const target = new URL(res?.headers.get("x-middleware-rewrite") ?? "");
+    expect(target.pathname).toBe("/_draft/blog/hello");
+    // The pointer must survive: the draft page reads it from searchParams.
+    expect(target.searchParams.get("__draft")).toBe("abc@v1");
+  });
+
+  it("rewrites a cookie-only navigation too", () => {
+    const req = request("https://site.example/blog/hello", "abc@v1");
+    const res = rewriteToDraftRoute(req, prepareDraft(req));
+    expect(new URL(res?.headers.get("x-middleware-rewrite") ?? "").pathname).toBe(
+      "/_draft/blog/hello",
+    );
+  });
+
+  it("leaves an ordinary request alone — ISR must not be disturbed", () => {
+    // The whole point: only drafted requests go dynamic. A shopper's request
+    // must reach the real, statically rendered route untouched.
+    const req = request("https://site.example/blog/hello");
+    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
+  });
+
+  it("never nests the prefix when middleware re-runs on the rewritten URL", () => {
+    const req = request("https://site.example/_draft/blog/hello?__draft=abc@v1");
+    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
+  });
+
+  it("does not rewrite when leaving draft mode", () => {
+    const req = request("https://site.example/blog/hello?__draft=off", "abc@v1");
+    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
+  });
+});

package/src/draftMiddleware.ts

@@ -19,8 +19,9 @@
  * Lives on its own subpath so middleware (edge runtime) never imports the root
  * barrel, which pulls in the client component graph.
  */
-import { type NextRequest, NextResponse } from "next/server";
 
+import { isDraftHostAllowed } from "@decocms/blocks/cms";
+import { type NextRequest, NextResponse } from "next/server";
 import {
   DRAFT_COOKIE,
   DRAFT_COOKIE_OPTIONS,
@@ -36,10 +37,60 @@ import {
  * nothing has to be forwarded through the request. That also means a draft
  * still works on routes this middleware never matches.
  */
+const INERT: DraftMiddlewareDecision = { pointer: null, setCookie: null, clearCookie: false };
+
 export function prepareDraft(request: NextRequest): DraftMiddlewareDecision {
+  // Host gate first: on a host not named in DECO_DRAFT_PREVIEW_HOST the
+  // decision is inert — no cookie written, no rewrite, no headers touched —
+  // so the production domain behaves as if the feature didn't exist.
+  const host =
+    request.headers.get("x-forwarded-host") ??
+    request.headers.get("host") ??
+    request.nextUrl.host;
+  if (!isDraftHostAllowed(host)) return INERT;
   return decideDraft(new URL(request.url), request.cookies.get(DRAFT_COOKIE)?.value ?? null);
 }
 
+/**
+ * URL prefix a drafted request is rewritten onto.
+ *
+ * The site must mount the matching route as `app/%5Fdraft/...` — URL-encoded.
+ * A literal `_draft/` directory is a Next "private folder", excluded from
+ * routing entirely, so the rewrite would fall through to whatever catch-all
+ * follows and 404. The encoded directory serves the same `/_draft` URL while
+ * staying routable.
+ */
+export const DRAFT_ROUTE_PREFIX = "/_draft";
+
+/**
+ * Rewrite a drafted request onto the dynamic draft route.
+ *
+ * This exists because `dynamic` / `revalidate` are STATIC route exports: a
+ * statically rendered page cannot become dynamic for one request. Making the
+ * real route dynamic to support drafts would cost every shopper their cached
+ * page, and — worse — a statically rendered draft would be cached and served to
+ * them. Rewriting sends only drafted requests to a route that is dynamic by
+ * construction, leaving ordinary traffic's ISR completely untouched.
+ *
+ * The original path is preserved in the rewritten pathname, so the draft route
+ * can resolve exactly the page the visitor asked for.
+ *
+ * Returns null when this request is not drafted, so callers fall through to
+ * their normal response.
+ */
+export function rewriteToDraftRoute(
+  request: NextRequest,
+  decision: DraftMiddlewareDecision,
+): NextResponse | null {
+  if (!decision.pointer) return null;
+  const url = request.nextUrl.clone();
+  // Already rewritten (Next re-runs middleware on the rewritten URL in some
+  // configurations) — never nest the prefix.
+  if (url.pathname.startsWith(`${DRAFT_ROUTE_PREFIX}/`)) return null;
+  url.pathname = `${DRAFT_ROUTE_PREFIX}${url.pathname}`;
+  return NextResponse.rewrite(url);
+}
+
 /**
  * Apply the cookie and the cache/indexing headers a draft response requires.
  *

package/src/index.ts

@@ -19,6 +19,12 @@ export {
   registerDraftOverride,
   selectDraftPointer,
 } from "./draft";
+export {
+  applyDraft,
+  DRAFT_ROUTE_PREFIX,
+  prepareDraft,
+  rewriteToDraftRoute,
+} from "./draftMiddleware";
 export {
   decofileGET,
   decofilePOST,