@decocms/nextjs 8.1.0-next.0 → 8.4.0

package/src/draftMiddleware.ts

@@ -1,163 +0,0 @@
-/**
- * Draft preview — middleware half.
- *
- * Two composable calls, because sites already own their middleware and this
- * must slot into it rather than replace it:
- *
- * ```ts
- * // middleware.ts (Next <16) / proxy.ts (Next 16+)
- * export function middleware(request: NextRequest) {
- *   const decision = prepareDraft(request);
- *   return applyDraft(NextResponse.next(), decision);
- * }
- * ```
- *
- * The middleware owns only the cookie and the cache/indexing headers — a
- * Server Component can read cookies but cannot set them, so that part has to
- * live here. The pointer itself is read by the page.
- *
- * Lives on its own subpath so middleware (edge runtime) never imports the root
- * barrel, which pulls in the client component graph.
- */
-
-import { isDraftHostAllowed } from "@decocms/blocks/cms";
-import { type NextRequest, NextResponse } from "next/server";
-import {
-  DRAFT_COOKIE,
-  DRAFT_COOKIE_OPTIONS,
-  DRAFT_HEADER,
-  type DraftMiddlewareDecision,
-  decideDraft,
-} from "./draft";
-
-/**
- * Compute the draft decision for a request.
- *
- * Only the cookie and the response headers are the middleware's business now —
- * the page reads the pointer itself from `searchParams` + `cookies()`, so
- * nothing has to be forwarded through the request. That also means a draft
- * still works on routes this middleware never matches.
- */
-const INERT: DraftMiddlewareDecision = { pointer: null, setCookie: null, clearCookie: false };
-
-export function prepareDraft(request: NextRequest): DraftMiddlewareDecision {
-  // The AUTHORITATIVE host gate lives page-side (`ensureDraft`): the site
-  // block's `previewHosts` are installed in the server-components graph, and
-  // middleware runs in a separate module graph/runtime that never sees them.
-  // Middleware therefore hard-gates only on the env override — keeping
-  // DECO_ALLOWED_PREVIEW_HOSTS a full kill switch — and otherwise passes the
-  // decision through. Worst case on a non-preview host is a cookie the
-  // page-side gate then ignores; drafts never render there.
-  if (process.env.DECO_ALLOWED_PREVIEW_HOSTS) {
-    const host =
-      request.headers.get("x-forwarded-host") ??
-      request.headers.get("host") ??
-      request.nextUrl.host;
-    if (!isDraftHostAllowed(host)) return INERT;
-  }
-  return decideDraft(new URL(request.url), request.cookies.get(DRAFT_COOKIE)?.value ?? null);
-}
-
-/**
- * URL prefix a drafted request is rewritten onto.
- *
- * The site must mount the matching route as `app/%5Fdraft/...` — URL-encoded.
- * A literal `_draft/` directory is a Next "private folder", excluded from
- * routing entirely, so the rewrite would fall through to whatever catch-all
- * follows and 404. The encoded directory serves the same `/_draft` URL while
- * staying routable.
- */
-export const DRAFT_ROUTE_PREFIX = "/_draft";
-
-/**
- * Rewrite a drafted request onto the dynamic draft route.
- *
- * This exists because `dynamic` / `revalidate` are STATIC route exports: a
- * statically rendered page cannot become dynamic for one request. Making the
- * real route dynamic to support drafts would cost every shopper their cached
- * page, and — worse — a statically rendered draft would be cached and served to
- * them. Rewriting sends only drafted requests to a route that is dynamic by
- * construction, leaving ordinary traffic's ISR completely untouched.
- *
- * The original path is preserved in the rewritten pathname, so the draft route
- * can resolve exactly the page the visitor asked for.
- *
- * Returns null when this request is not drafted, so callers fall through to
- * their normal response.
- */
-export function rewriteToDraftRoute(
-  request: NextRequest,
-  decision: DraftMiddlewareDecision,
-): NextResponse | null {
-  if (!decision.pointer) return null;
-  const url = request.nextUrl.clone();
-  // Already rewritten (Next re-runs middleware on the rewritten URL in some
-  // configurations) — never nest the prefix.
-  if (url.pathname.startsWith(`${DRAFT_ROUTE_PREFIX}/`)) return null;
-  url.pathname = `${DRAFT_ROUTE_PREFIX}${url.pathname}`;
-  return NextResponse.rewrite(url);
-}
-
-/**
- * Apply the cookie and the cache/indexing headers a draft response requires.
- *
- * The caching headers are the difference between a preview and a **leak**.
- * With the pointer in a cookie, a draft response and a published one share an
- * identical URL, so a CDN keyed on URL alone would happily serve unpublished
- * content to a real visitor. `no-store` is what actually prevents that;
- * `Vary: Cookie` keeps any intermediary that *does* respect it from mixing the
- * two; `X-Robots-Tag` keeps a leaked draft out of search results.
- */
-export function applyDraft(
-  response: NextResponse,
-  decision: DraftMiddlewareDecision,
-): NextResponse {
-  if (decision.clearCookie) {
-    response.cookies.delete(DRAFT_COOKIE);
-  } else if (decision.setCookie) {
-    response.cookies.set(DRAFT_COOKIE, decision.setCookie, DRAFT_COOKIE_OPTIONS);
-  }
-
-  if (decision.pointer) {
-    response.headers.set("cache-control", "no-store, private");
-    response.headers.set("vary", "Cookie");
-    response.headers.set("x-robots-tag", "noindex, nofollow");
-  }
-
-  return response;
-}
-
-/**
- * Request headers to forward downstream, carrying the active pointer on
- * `x-deco-draft` (see {@link DRAFT_HEADER}) so the RSC tree — including the app
- * shell — can bind the draft via `ensureDraft()` and reflect it in
- * shell-resolved Header/Footer, not only page sections.
- *
- * Pass to `NextResponse.next({ request: { headers } })`. Strips any
- * client-supplied `x-deco-draft` when this request is not previewing, so the
- * header is only ever present on a legitimately-gated preview request.
- */
-export function draftRequestHeaders(
-  request: NextRequest,
-  decision: DraftMiddlewareDecision,
-): Headers {
-  const headers = new Headers(request.headers);
-  if (decision.pointer) headers.set(DRAFT_HEADER, decision.pointer);
-  else headers.delete(DRAFT_HEADER);
-  return headers;
-}
-
-/**
- * Convenience for sites with no middleware of their own: prepare, forward the
- * pointer header, continue, apply. Sites that already have middleware should
- * call the halves directly (`prepareDraft` → `draftRequestHeaders` on the
- * `NextResponse.next({ request: { headers } })` → `applyDraft`) so their own
- * logic sits in between.
- */
-export function draftMiddleware(request: NextRequest): NextResponse {
-  const decision = prepareDraft(request);
-  const response = NextResponse.next({
-    request: { headers: draftRequestHeaders(request, decision) },
-  });
-  return applyDraft(response, decision);
-}

package/src/draftShell.test.ts

@@ -1,76 +0,0 @@
-/**
- * `ensureDraft()` must bind from the middleware-forwarded `x-deco-draft` header
- * — the only pointer source a LAYOUT (app shell) can see: it receives no
- * `searchParams`, and on the entry request the cookie has only just been set on
- * the response. This is what lets shell-resolved Header/Footer reflect a draft,
- * not just page sections.
- */
-import { clearDraftCache } from "@decocms/blocks/cms";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mutable header/cookie state the mock reads, so each test drives its own.
-let headerState = new Headers();
-let cookieState: Record<string, string> = {};
-
-vi.mock("next/headers", () => ({
-  headers: async () => headerState,
-  cookies: async () => ({
-    get: (name: string) =>
-      name in cookieState ? { name, value: cookieState[name] } : undefined,
-  }),
-}));
-
-const { ensureDraft, DRAFT_HEADER, DRAFT_COOKIE } = await import("./draft");
-
-const DRAFT_BLOCKS = { "pages-home": { title: "DRAFT" } };
-const POINTER = "abc.localhost:60534/api/o/decofile/m/main?token=t@v1";
-
-beforeEach(() => {
-  headerState = new Headers({ host: "site.example" });
-  cookieState = {};
-  process.env.DECO_ALLOWED_PREVIEW_HOSTS = "site.example";
-  clearDraftCache();
-  vi.stubGlobal(
-    "fetch",
-    vi.fn(async (url: string) => {
-      if (
-        String(url) ===
-        "http://abc.localhost:60534/api/o/decofile/m/main?token=t"
-      ) {
-        return new Response(JSON.stringify(DRAFT_BLOCKS), {
-          status: 200,
-          headers: { "content-type": "application/json" },
-        });
-      }
-      throw new Error(`unexpected fetch: ${url}`);
-    }),
-  );
-});
-
-afterEach(() => {
-  vi.unstubAllGlobals();
-  delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-});
-
-describe("ensureDraft — app-shell (layout) binding via the forwarded header", () => {
-  it("binds the draft from x-deco-draft with no searchParams (the layout case)", async () => {
-    headerState.set(DRAFT_HEADER, POINTER);
-    // No searchParams (layouts get none) and no cookie (entry request).
-    expect(await ensureDraft()).toBe(true);
-  });
-
-  it("still binds from the cookie when there is no forwarded header", async () => {
-    cookieState[DRAFT_COOKIE] = POINTER;
-    expect(await ensureDraft()).toBe(true);
-  });
-
-  it("does not bind when neither header, cookie, nor param is present", async () => {
-    expect(await ensureDraft()).toBe(false);
-  });
-
-  it("stays gated by the host allowlist even with a forwarded header", async () => {
-    headerState = new Headers({ host: "prod.example" });
-    headerState.set(DRAFT_HEADER, POINTER);
-    expect(await ensureDraft()).toBe(false);
-  });
-});

package/src/routeHandlers.test.ts

@@ -1,243 +0,0 @@
-// @vitest-environment node
-//
-// Route Handlers run server-side with no DOM (same rationale as
-// setup.test.ts in this package). This matters concretely here: jsdom's
-// bundled Request polyfill does not reproduce Node/edge's Request-as-init
-// body-stream forwarding (`new Request(url, existingRequest)`) — under
-// jsdom the body-forwarding test below silently loses the body. Node's
-// native Request (used in this environment, and in the real Next.js
-// runtime) preserves it, which is what the previews-rebuild code path
-// relies on.
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-  handleDecofileRead: vi.fn(async () => new Response("decofile")),
-  handleDecofileReload: vi.fn(async () => new Response("reloaded")),
-  handleInvoke: vi.fn(async () => new Response("invoked")),
-  handleMeta: vi.fn(() => new Response("meta")),
-  handleRender: vi.fn(async (req: Request) => new Response(new URL(req.url).pathname)),
-  setMetaData: vi.fn(),
-  // Real corsHeaders shape (mirrors blocks-admin/src/admin/cors.ts) so the
-  // CORS assertions below test genuine header propagation, not a stub echo.
-  corsHeaders: vi.fn((req: Request) => ({
-    "Access-Control-Allow-Origin": req.headers.get("origin") || "*",
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, If-None-Match",
-    "Access-Control-Allow-Credentials": "true",
-  })),
-}));
-vi.mock("@decocms/blocks-admin", () => mocks);
-
-import { setMetaData } from "@decocms/blocks-admin";
-import { createDecoRouteHandlers, metaGET } from "./routeHandlers";
-
-describe("routeHandlers (next)", () => {
-  it("metaGET returns the schema response", async () => {
-    setMetaData({ sections: {}, actions: {}, loaders: {} } as any);
-    const response = await metaGET(new Request("https://example.com/live/_meta"));
-    expect(response.status).toBe(200);
-  });
-});
-
-describe("createDecoRouteHandlers", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("runs setup before dispatching and routes decofile GET/POST", async () => {
-    const order: string[] = [];
-    const setup = vi.fn(async () => {
-      order.push("setup");
-    });
-    const { GET, POST } = createDecoRouteHandlers({ setup });
-
-    await GET(new Request("http://x/deco/decofile"));
-    expect(setup).toHaveBeenCalled();
-    expect(mocks.handleDecofileRead).toHaveBeenCalled();
-
-    await POST(new Request("http://x/deco/decofile", { method: "POST" }));
-    expect(mocks.handleDecofileReload).toHaveBeenCalled();
-  });
-
-  it("routes meta, render, and invoke", async () => {
-    const { GET, POST } = createDecoRouteHandlers();
-    await GET(new Request("http://x/deco/meta"));
-    expect(mocks.handleMeta).toHaveBeenCalled();
-    await POST(new Request("http://x/deco/render", { method: "POST" }));
-    expect(mocks.handleRender).toHaveBeenCalled();
-    await POST(new Request("http://x/deco/invoke/site/actions/x", { method: "POST" }));
-    expect(mocks.handleInvoke).toHaveBeenCalled();
-  });
-
-  it("redirects preview GETs to the fixed RSC page and preserves the path and query", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/deco/previews/pages-Home-123?props=x&deviceHint=mobile"),
-    );
-
-    expect(res.status).toBe(307);
-    expect(res.headers.get("location")).toBe(
-      "http://x/deco/preview/pages-Home-123?props=x&deviceHint=mobile",
-    );
-    expect(mocks.handleRender).not.toHaveBeenCalled();
-  });
-
-  it("redirects the public /live/previews path to the fixed RSC page", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/live/previews/site/sections/Hero.tsx?deviceHint=desktop"),
-    );
-
-    expect(res.status).toBe(307);
-    expect(res.headers.get("location")).toBe(
-      "http://x/deco/preview/site/sections/Hero.tsx?deviceHint=desktop",
-    );
-    expect(mocks.handleRender).not.toHaveBeenCalled();
-  });
-
-  it("keeps preview POSTs on handleRender", async () => {
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(
-      new Request("http://x/deco/previews/pages-Home-123", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ hello: "world" }),
-      }),
-    );
-
-    expect(res.status).toBe(200);
-    expect(mocks.handleRender).toHaveBeenCalledOnce();
-  });
-
-  it("forwards a POST body through the /deco/previews/* URL rebuild (Request-as-init carries the body stream)", async () => {
-    // Pins the `new Request(rebuilt, request)` semantics documented on the
-    // rebuild line: passing a Request as `init` clones the body stream
-    // without a `duplex` option. A refactor to a plain init object would
-    // throw "duplex option is required" for this POST body.
-    mocks.handleRender.mockImplementationOnce(async (req: Request) => {
-      const body = await req.json();
-      return new Response(JSON.stringify({ pathname: new URL(req.url).pathname, body }));
-    });
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(
-      new Request("http://x/deco/previews/pages-Home-123", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ hello: "world" }),
-      }),
-    );
-    const json = await res.json();
-    expect(json.pathname).toBe("/live/previews/pages-Home-123");
-    expect(json.body).toEqual({ hello: "world" });
-  });
-
-  it("404s unknown deco paths", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/deco/nope"));
-    expect(res.status).toBe(404);
-  });
-
-  // Regression coverage for the rewrite-source paths, not just their
-  // /deco/* destinations: a Next.js App Router route handler reached via a
-  // next.config.js `rewrites()` entry sees `request.url` as the ORIGINAL,
-  // pre-rewrite path (verified empirically against a real `next build` +
-  // `next start`) — NOT the /deco/* destination the rewrite maps to. Every
-  // test above this one only ever constructs an already-/deco/*-shaped
-  // Request, so it would keep passing even if the dispatcher only matched
-  // that form and 404'd every real rewritten request — which is exactly
-  // the bug these tests catch.
-  it("routes the rewrite-source /.decofile path (not just its /deco/decofile destination)", async () => {
-    const { GET, POST } = createDecoRouteHandlers();
-    await GET(new Request("http://x/.decofile"));
-    expect(mocks.handleDecofileRead).toHaveBeenCalled();
-    await POST(new Request("http://x/.decofile", { method: "POST" }));
-    expect(mocks.handleDecofileReload).toHaveBeenCalled();
-  });
-
-  it("routes the rewrite-source /live/_meta path (not just its /deco/meta destination)", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/live/_meta"));
-    expect(mocks.handleMeta).toHaveBeenCalled();
-    expect(res.status).not.toBe(404);
-  });
-
-  it("405s POST /live/_meta with Allow: GET (the PRE-rewrite URL form)", async () => {
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(new Request("http://x/live/_meta", { method: "POST" }));
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Allow")).toBe("GET");
-    expect(mocks.handleMeta).not.toHaveBeenCalled();
-  });
-
-  it("redirects the rewrite-source /live/previews/* path to the fixed RSC page", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/live/previews/pages-Home-123?props=x"));
-    expect(res.status).toBe(307);
-    expect(res.headers.get("location")).toBe("http://x/deco/preview/pages-Home-123?props=x");
-    expect(mocks.handleRender).not.toHaveBeenCalled();
-  });
-
-  it("405s GET /deco/invoke/* with Allow: POST (CSRF protection — see comment on the invoke branch)", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(new Request("http://x/deco/invoke/site/actions/x"));
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Allow")).toBe("POST");
-    expect(mocks.handleInvoke).not.toHaveBeenCalled();
-  });
-
-  it("405s POST /deco/meta with Allow: GET", async () => {
-    const { POST } = createDecoRouteHandlers();
-    const res = await POST(new Request("http://x/deco/meta", { method: "POST" }));
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Allow")).toBe("GET");
-    expect(mocks.handleMeta).not.toHaveBeenCalled();
-  });
-});
-
-describe("createDecoRouteHandlers — CORS (Studio is a cross-origin browser client)", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("answers OPTIONS preflight with 204 + CORS headers, without running setup", async () => {
-    const setup = vi.fn(async () => {});
-    const { OPTIONS } = createDecoRouteHandlers({ setup });
-    const res = await OPTIONS(
-      new Request("http://x/live/_meta", {
-        method: "OPTIONS",
-        headers: {
-          origin: "https://decocms.com",
-          "access-control-request-method": "GET",
-          "access-control-request-headers": "if-none-match",
-        },
-      }),
-    );
-    expect(res.status).toBe(204);
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://decocms.com");
-    expect(res.headers.get("Access-Control-Allow-Headers")).toContain("If-None-Match");
-    expect(setup).not.toHaveBeenCalled();
-  });
-
-  it("stamps CORS headers on successful responses (meta via pre-rewrite URL)", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/live/_meta", { headers: { origin: "https://admin.deco.cx" } }),
-    );
-    expect(await res.text()).toBe("meta");
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://admin.deco.cx");
-  });
-
-  it("stamps CORS headers on method-gate 405s too", async () => {
-    const { GET } = createDecoRouteHandlers();
-    const res = await GET(
-      new Request("http://x/deco/invoke/site/actions/x", {
-        headers: { origin: "https://decocms.com" },
-      }),
-    );
-    expect(res.status).toBe(405);
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://decocms.com");
-  });
-
-  it("named exports carry CORS as well (metaGET)", async () => {
-    const res = await metaGET(
-      new Request("http://x/live/_meta", { headers: { origin: "https://decocms.com" } }),
-    );
-    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://decocms.com");
-  });
-});