@decocms/nextjs 7.28.0-beta.1 → 7.28.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/nextjs",
-  "version": "7.28.0-beta.1",
+  "version": "7.28.0-beta.2",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -29,8 +29,8 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.28.0-beta.1",
-    "@decocms/blocks-admin": "7.28.0-beta.1"
+    "@decocms/blocks": "7.28.0-beta.2",
+    "@decocms/blocks-admin": "7.28.0-beta.2"
   },
   "peerDependencies": {
     "next": ">=15.0.0",

package/src/createDecoPage.draft.test.tsx

@@ -13,7 +13,10 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 
 // The gate must stop us reaching cookies() at all when the feature is off.
 const cookiesMock = vi.fn(async () => ({ get: () => undefined }));
-vi.mock("next/headers", () => ({ cookies: () => cookiesMock() }));
+vi.mock("next/headers", () => ({
+  cookies: () => cookiesMock(),
+  headers: async () => new Headers(),
+}));
 
 // `connection()` is Next's runtime opt-out from static rendering; outside a
 // request scope it throws, so it is stubbed to a no-op here.
@@ -39,7 +42,7 @@ function seedPublishedHome() {
 afterEach(() => {
   cookiesMock.mockClear();
   connectionMock.mockClear();
-  delete process.env.DECO_DRAFT_PREVIEW;
+  delete process.env.DECO_DRAFT_PREVIEW_HOST;
   delete process.env.DECO_SANDBOX_ORIGIN_SUFFIXES;
 });
 
@@ -72,8 +75,7 @@ describe("createDecoPage — draft preview gate", () => {
   });
 
   it("reads cookies() once the feature is fully configured", async () => {
-    process.env.DECO_DRAFT_PREVIEW = "1";
-    process.env.DECO_SANDBOX_ORIGIN_SUFFIXES = ".preview-studio.decocms.com";
+    process.env.DECO_DRAFT_PREVIEW_HOST = "preview.example";
     seedPublishedHome();
 
     const { default: Page } = createDecoPage({ siteName: "test-site" });

package/src/createDecoPage.tsx

@@ -90,7 +90,8 @@ export function createDecoPage({ siteName }: CreateDecoPageOptions) {
    *     first wins for both. So this must be awaited at the top of BOTH, not
    *     just the page. `cache()` here makes the second call free.
    *
-   * Gated on `isDraftPreviewEnabled()` — a plain env read, not a dynamic API —
+   * Gated on `isDraftPreviewEnabled()` (DECO_DRAFT_PREVIEW_HOST non-empty) — a
+   * plain env read, not a dynamic API —
    * so sites that never opt in behave exactly as before. That gate is doing
    * real work: `cookies()` and `searchParams` are both dynamic, and touching
    * them unconditionally would opt EVERY page out of static/ISR rendering.

package/src/draft.ts

@@ -22,8 +22,12 @@
  * i.e. the page component. `ensureDraft()` exists so each site makes one call
  * instead of re-deriving that ordering rule.
  */
-import { resolveDraftDecofile, setDraftOverrideGetter } from "@decocms/blocks/cms";
-import { cookies } from "next/headers";
+import {
+  isDraftHostAllowed,
+  resolveDraftDecofile,
+  setDraftOverrideGetter,
+} from "@decocms/blocks/cms";
+import { cookies, headers } from "next/headers";
 import { cache } from "react";
 
 /** Cookie that carries the pointer across in-preview navigation. */
@@ -116,6 +120,14 @@ export async function ensureDraft(searchParams?: DraftSearchParams): Promise<boo
   const pointer = selectDraftPointer(searchParams, cookieStore.get(DRAFT_COOKIE)?.value);
   if (!pointer) return false;
 
+  // Host gate, checked only once a pointer exists (headers() is a dynamic
+  // API): the same build may serve the preview domain and the production
+  // domain, and only hosts named in DECO_DRAFT_PREVIEW_HOST may render
+  // drafts — production stays published no matter what the URL carries.
+  const requestHeaders = await headers();
+  const host = requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
+  if (!isDraftHostAllowed(host)) return false;
+
   const blocks = await resolveDraftDecofile({ pointer });
   if (!blocks) return false;
 

package/src/draftMiddleware.test.ts

@@ -1,9 +1,17 @@
 import { NextRequest, NextResponse } from "next/server";
-import { describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { DRAFT_COOKIE } from "./draft";
 import { applyDraft, prepareDraft, rewriteToDraftRoute } from "./draftMiddleware";
 
+beforeEach(() => {
+  // The middleware is host-gated; these tests run as the allowed host.
+  process.env.DECO_DRAFT_PREVIEW_HOST = "site.example";
+});
+afterEach(() => {
+  delete process.env.DECO_DRAFT_PREVIEW_HOST;
+});
+
 function request(url: string, cookie?: string): NextRequest {
   const req = new NextRequest(new URL(url), {
     headers: cookie ? { cookie: `${DRAFT_COOKIE}=${cookie}` } : {},
@@ -20,6 +28,14 @@ describe("prepareDraft", () => {
     expect(prepareDraft(request("https://site.example/p", "abc@v1")).pointer).toBe("abc@v1");
   });
 
+  it("is inert on a host outside the allowlist — the production domain", () => {
+    // Same build, different Host: no cookie, no rewrite, nothing touched.
+    const req = request("https://fila.com.br/p?__draft=abc@v1");
+    process.env.DECO_DRAFT_PREVIEW_HOST = "fila.vtex.app";
+    expect(prepareDraft(req)).toEqual({ pointer: null, setCookie: null, clearCookie: false });
+    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
+  });
+
   it("ignores a client-supplied draft header — the page owns the decision", () => {
     // There is no request-header path any more; the page reads searchParams
     // and cookies itself, so a forged header is simply not an input.

package/src/draftMiddleware.ts

@@ -19,8 +19,9 @@
  * Lives on its own subpath so middleware (edge runtime) never imports the root
  * barrel, which pulls in the client component graph.
  */
-import { type NextRequest, NextResponse } from "next/server";
 
+import { isDraftHostAllowed } from "@decocms/blocks/cms";
+import { type NextRequest, NextResponse } from "next/server";
 import {
   DRAFT_COOKIE,
   DRAFT_COOKIE_OPTIONS,
@@ -36,16 +37,28 @@ import {
  * nothing has to be forwarded through the request. That also means a draft
  * still works on routes this middleware never matches.
  */
+const INERT: DraftMiddlewareDecision = { pointer: null, setCookie: null, clearCookie: false };
+
 export function prepareDraft(request: NextRequest): DraftMiddlewareDecision {
+  // Host gate first: on a host not named in DECO_DRAFT_PREVIEW_HOST the
+  // decision is inert — no cookie written, no rewrite, no headers touched —
+  // so the production domain behaves as if the feature didn't exist.
+  const host =
+    request.headers.get("x-forwarded-host") ??
+    request.headers.get("host") ??
+    request.nextUrl.host;
+  if (!isDraftHostAllowed(host)) return INERT;
   return decideDraft(new URL(request.url), request.cookies.get(DRAFT_COOKIE)?.value ?? null);
 }
 
 /**
- * Route prefix a drafted request is rewritten onto.
+ * URL prefix a drafted request is rewritten onto.
  *
- * Deliberately a `_`-prefixed segment: Next treats those as private folders and
- * excludes them from routing, so a site cannot accidentally expose it as a real
- * page — it is reachable only through the middleware rewrite below.
+ * The site must mount the matching route as `app/%5Fdraft/...` — URL-encoded.
+ * A literal `_draft/` directory is a Next "private folder", excluded from
+ * routing entirely, so the rewrite would fall through to whatever catch-all
+ * follows and 404. The encoded directory serves the same `/_draft` URL while
+ * staying routable.
  */
 export const DRAFT_ROUTE_PREFIX = "/_draft";