@decocms/nextjs 7.28.0-beta.4 → 7.28.0-beta.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/nextjs",
-  "version": "7.28.0-beta.4",
+  "version": "7.28.0-beta.5",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -29,8 +29,8 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.28.0-beta.4",
-    "@decocms/blocks-admin": "7.28.0-beta.4"
+    "@decocms/blocks": "7.28.0-beta.5",
+    "@decocms/blocks-admin": "7.28.0-beta.5"
   },
   "peerDependencies": {
     "next": ">=15.0.0",

package/src/draftMiddleware.test.ts

@@ -32,6 +32,14 @@ describe("prepareDraft", () => {
     );
   });
 
+  it("passes through when no env override is set — the page gate is authoritative", () => {
+    // The site-block hosts live in the server-components graph; middleware
+    // can't see them, so without the env kill switch it must not block.
+    delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
+    const req = request("https://anything.example/p?__draft=abc.localhost@v1");
+    expect(prepareDraft(req).pointer).toBe("abc.localhost@v1");
+  });
+
   it("is inert on a host outside the allowlist — the production domain", () => {
     // Same build, different Host: no cookie, no rewrite, nothing touched.
     const req = request("https://fila.com.br/p?__draft=abc@v1");

package/src/draftMiddleware.ts

@@ -40,12 +40,20 @@ import {
 const INERT: DraftMiddlewareDecision = { pointer: null, setCookie: null, clearCookie: false };
 
 export function prepareDraft(request: NextRequest): DraftMiddlewareDecision {
-  // Host gate first: on a host not named in DECO_ALLOWED_PREVIEW_HOSTS the
-  // decision is inert — no cookie written, no rewrite, no headers touched —
-  // so the production domain behaves as if the feature didn't exist.
-  const host =
-    request.headers.get("x-forwarded-host") ?? request.headers.get("host") ?? request.nextUrl.host;
-  if (!isDraftHostAllowed(host)) return INERT;
+  // The AUTHORITATIVE host gate lives page-side (`ensureDraft`): the site
+  // block's `previewHosts` are installed in the server-components graph, and
+  // middleware runs in a separate module graph/runtime that never sees them.
+  // Middleware therefore hard-gates only on the env override — keeping
+  // DECO_ALLOWED_PREVIEW_HOSTS a full kill switch — and otherwise passes the
+  // decision through. Worst case on a non-preview host is a cookie the
+  // page-side gate then ignores; drafts never render there.
+  if (process.env.DECO_ALLOWED_PREVIEW_HOSTS) {
+    const host =
+      request.headers.get("x-forwarded-host") ??
+      request.headers.get("host") ??
+      request.nextUrl.host;
+    if (!isDraftHostAllowed(host)) return INERT;
+  }
   return decideDraft(new URL(request.url), request.cookies.get(DRAFT_COOKIE)?.value ?? null);
 }
 

package/src/setup.ts

@@ -110,9 +110,29 @@ export interface NextSetupOptions {
  * instead, nothing imports the JSON, so edits invalidate nothing and dev
  * serves stale content until a full restart.
  */
+/**
+ * Install the site block's `previewHosts` as the draft-preview allowlist.
+ *
+ * Reads the BASE blocks handed to setup — never `loadBlocks()` at request
+ * time, where the draft override is merged in: an allowlist readable through
+ * the override could be rewritten by the very draft it gates.
+ * `DECO_ALLOWED_PREVIEW_HOSTS` remains an operational override that replaces
+ * this list when set.
+ */
+function installPreviewHosts(blocks: Record<string, unknown> | undefined): void {
+  const site = blocks?.site as { previewHosts?: unknown } | undefined;
+  if (Array.isArray(site?.previewHosts)) setDraftPreviewHosts(site.previewHosts);
+}
+
 export function createNextSetup(options: NextSetupOptions): () => Promise<void> {
   let setupPromise: Promise<void> | null = null;
 
+  // Draft preview opt-in from the repo: read SYNCHRONOUSLY at createNextSetup
+  // time (module evaluation), not inside the lazy ensureSetup — pages call
+  // `ensureDraft` BEFORE they resolve CMS content, so hosts installed lazily
+  // would arrive after the gate already said no on the first request.
+  installPreviewHosts(options.blocks);
+
   return function ensureSetup(): Promise<void> {
     setupPromise ??= (async () => {
       const dirBlocks =
@@ -120,17 +140,8 @@ export function createNextSetup(options: NextSetupOptions): () => Promise<void>
           ? {}
           : await loadDecofileDirectory(options.blocksDir ?? ".deco/blocks");
       const blocks = { ...dirBlocks, ...options.blocks };
-
-      // Draft preview opt-in from the repo itself: the global `site` block may
-      // declare `previewHosts` (e.g. ["fila.vtex.app", "localhost:3100"]).
-      // Read here, from the SETUP-TIME base blocks — never via loadBlocks()
-      // at request time, where the draft override is merged in: an allowlist
-      // readable through the override could be rewritten by the very draft it
-      // gates. DECO_ALLOWED_PREVIEW_HOSTS remains an operational override.
-      const siteBlock = blocks.site as { previewHosts?: unknown } | undefined;
-      if (Array.isArray(siteBlock?.previewHosts)) {
-        setDraftPreviewHosts(siteBlock.previewHosts);
-      }
+      // Covers the blocksDir mode, where blocks only exist after the fs read.
+      installPreviewHosts(blocks);
 
       createSiteSetup({
         sections: options.sections,