@decocms/nextjs 8.1.0-next.0 → 8.5.0

package/src/draftConstants.test.ts

@@ -1,21 +0,0 @@
-import { DRAFT_COOKIE_NAME, DRAFT_QUERY_PARAM } from "@decocms/blocks/cms";
-import { describe, expect, it } from "vitest";
-
-import { DRAFT_COOKIE, DRAFT_PARAM } from "./draftConstants";
-
-/**
- * The draft cookie/param names are wire protocol shared across a package
- * boundary: the client-safe copy here (the badge imports it without pulling
- * `next/headers` into the client bundle) MUST stay identical to the
- * framework-agnostic owner in `@decocms/blocks`, which `/deco/invoke` reads to
- * bind the same draft. If these drift, invoke silently serves published content
- * while the page shows the draft.
- */
-describe("draft constants parity with @decocms/blocks", () => {
-  it("cookie name matches", () => {
-    expect(DRAFT_COOKIE).toBe(DRAFT_COOKIE_NAME);
-  });
-  it("query param matches", () => {
-    expect(DRAFT_PARAM).toBe(DRAFT_QUERY_PARAM);
-  });
-});

package/src/draftConstants.ts

@@ -1,30 +0,0 @@
-/**
- * Draft-preview constants with ZERO server imports.
- *
- * `draft.ts` statically imports `next/headers`, so anything reachable from a
- * `"use client"` file must not import from it — that would pull `next/headers`
- * into the client bundle and fail the build. The client-side badge
- * (`DraftPreviewBadge`) needs `DRAFT_PARAM` to build its links, so the shared
- * constants live here and `draft.ts` re-exports them for its own callers.
- */
-
-/** Query param that enters draft mode (and, with `off`, leaves it). */
-export const DRAFT_PARAM = "__draft";
-
-/** Cookie that carries the pointer across in-preview navigation. */
-export const DRAFT_COOKIE = "__deco_draft";
-
-/**
- * Request header the middleware forwards the active pointer on, so the whole
- * RSC tree — including the root layout / app shell — can bind the draft on the
- * SAME request. The page reads `?__draft=` from its own `searchParams`, but a
- * layout never receives `searchParams` and, on the entry request, the cookie
- * has only just been set on the *response* (not yet readable). Forwarding the
- * pointer as a request header closes both gaps so `ensureDraft()` works from a
- * layout, letting shell-resolved Header/Footer reflect the draft too.
- *
- * Not a new trust surface: the pointer was never a secret (the draft id is the
- * capability, host-scoping bounds blast radius — see `draftSource`), so a
- * forwarded/forged header is equivalent to typing the query param.
- */
-export const DRAFT_HEADER = "x-deco-draft";

package/src/draftMiddleware.test.ts

@@ -1,179 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-
-import { DRAFT_COOKIE } from "./draft";
-import {
-  applyDraft,
-  draftRequestHeaders,
-  prepareDraft,
-  rewriteToDraftRoute,
-} from "./draftMiddleware";
-
-beforeEach(() => {
-  // The middleware is host-gated; these tests run as the allowed host.
-  process.env.DECO_ALLOWED_PREVIEW_HOSTS = "site.example";
-});
-afterEach(() => {
-  delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-});
-
-function request(url: string, cookie?: string): NextRequest {
-  const req = new NextRequest(new URL(url), {
-    headers: cookie ? { cookie: `${DRAFT_COOKIE}=${cookie}` } : {},
-  });
-  return req;
-}
-
-describe("prepareDraft", () => {
-  it("reads the pointer from the param", () => {
-    expect(prepareDraft(request("https://site.example/p?__draft=abc.localhost@v1")).pointer).toBe(
-      "abc.localhost@v1",
-    );
-  });
-
-  it("reads the pointer from the cookie on a plain navigation", () => {
-    expect(prepareDraft(request("https://site.example/p", "abc.localhost@v1")).pointer).toBe(
-      "abc.localhost@v1",
-    );
-  });
-
-  it("passes through when no env override is set — the page gate is authoritative", () => {
-    // The site-block hosts live in the server-components graph; middleware
-    // can't see them, so without the env kill switch it must not block.
-    delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-    const req = request("https://anything.example/p?__draft=abc.localhost@v1");
-    expect(prepareDraft(req).pointer).toBe("abc.localhost@v1");
-  });
-
-  it("is inert on a host outside the allowlist — the production domain", () => {
-    // Same build, different Host: no cookie, no rewrite, nothing touched.
-    const req = request("https://acme.com.br/p?__draft=abc@v1");
-    process.env.DECO_ALLOWED_PREVIEW_HOSTS = "acme.vtex.app";
-    expect(prepareDraft(req)).toEqual({ pointer: null, setCookie: null, clearCookie: false });
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("does not read a client-supplied draft header — the decision is param/cookie only", () => {
-    // The forwarded `x-deco-draft` header (read by `ensureDraft` in the layout)
-    // is an OUTPUT of the middleware decision, never an input to it: prepareDraft
-    // still decides purely from the param + cookie. A client that forges the
-    // header directly can't manufacture a decision here (and `draftRequestHeaders`
-    // strips it when not previewing).
-    const req = new NextRequest(new URL("https://site.example/p"), {
-      headers: { "x-deco-draft": "attacker.localhost@v1" },
-    });
-    expect(prepareDraft(req).pointer).toBeNull();
-  });
-});
-
-describe("draftRequestHeaders", () => {
-  it("forwards the active pointer on x-deco-draft so a layout can bind it", () => {
-    const req = request("https://site.example/p?__draft=abc.localhost@v1");
-    const headers = draftRequestHeaders(req, prepareDraft(req));
-    expect(headers.get("x-deco-draft")).toBe("abc.localhost@v1");
-  });
-
-  it("forwards the cookie-carried pointer on plain navigation", () => {
-    const req = request("https://site.example/p", "abc.localhost@v1");
-    const headers = draftRequestHeaders(req, prepareDraft(req));
-    expect(headers.get("x-deco-draft")).toBe("abc.localhost@v1");
-  });
-
-  it("strips a client-forged header when the request is not previewing", () => {
-    // Direct-to-origin request carrying a forged header but no real pointer:
-    // the forwarded headers must not carry it downstream.
-    const req = new NextRequest(new URL("https://site.example/p"), {
-      headers: { "x-deco-draft": "attacker.localhost@v1" },
-    });
-    const headers = draftRequestHeaders(req, prepareDraft(req));
-    expect(headers.get("x-deco-draft")).toBeNull();
-  });
-});
-
-describe("applyDraft", () => {
-  it("sets a partitioned cross-site cookie when entering draft mode", () => {
-    const decision = prepareDraft(request("https://site.example/p?__draft=abc.localhost@v1"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    const setCookie = res.headers.get("set-cookie") ?? "";
-    expect(setCookie).toContain(`${DRAFT_COOKIE}=abc.localhost%40v1`);
-    // The preview iframe is cross-site, so these attributes are what make the
-    // cookie survive at all — not hardening extras.
-    expect(setCookie).toMatch(/SameSite=None/i);
-    expect(setCookie).toMatch(/Secure/i);
-    expect(setCookie).toMatch(/Partitioned/i);
-    expect(setCookie).toMatch(/HttpOnly/i);
-  });
-
-  it("marks a draft response uncacheable and unindexable", () => {
-    // With the pointer in a cookie, draft and published share a URL — a CDN
-    // keyed on URL alone would serve unpublished content to a real visitor.
-    const decision = prepareDraft(request("https://site.example/p", "abc.localhost@v1"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    expect(res.headers.get("cache-control")).toBe("no-store, private");
-    expect(res.headers.get("vary")).toBe("Cookie");
-    expect(res.headers.get("x-robots-tag")).toBe("noindex, nofollow");
-  });
-
-  it("leaves an ordinary response completely untouched", () => {
-    const decision = prepareDraft(request("https://site.example/p"));
-    const res = applyDraft(NextResponse.next(), decision);
-
-    expect(res.headers.get("cache-control")).toBeNull();
-    expect(res.headers.get("vary")).toBeNull();
-    expect(res.headers.get("x-robots-tag")).toBeNull();
-    expect(res.headers.get("set-cookie")).toBeNull();
-  });
-
-  it("clears the cookie on ?__draft=off", () => {
-    const decision = prepareDraft(
-      request("https://site.example/p?__draft=off", "abc.localhost@v1"),
-    );
-    expect(decision.clearCookie).toBe(true);
-
-    const res = applyDraft(NextResponse.next(), decision);
-    const setCookie = res.headers.get("set-cookie") ?? "";
-    // Deletion is a set with an immediate expiry.
-    expect(setCookie).toContain(DRAFT_COOKIE);
-    expect(setCookie).toMatch(/Max-Age=0|Expires=Thu, 01 Jan 1970/i);
-    // And the response is not treated as a draft render.
-    expect(res.headers.get("cache-control")).toBeNull();
-  });
-});
-
-describe("rewriteToDraftRoute", () => {
-  it("rewrites a drafted request onto the dynamic draft route", () => {
-    const req = request("https://site.example/blog/hello?__draft=abc.localhost@v1");
-    const res = rewriteToDraftRoute(req, prepareDraft(req));
-    const target = new URL(res?.headers.get("x-middleware-rewrite") ?? "");
-    expect(target.pathname).toBe("/_draft/blog/hello");
-    // The pointer must survive: the draft page reads it from searchParams.
-    expect(target.searchParams.get("__draft")).toBe("abc.localhost@v1");
-  });
-
-  it("rewrites a cookie-only navigation too", () => {
-    const req = request("https://site.example/blog/hello", "abc.localhost@v1");
-    const res = rewriteToDraftRoute(req, prepareDraft(req));
-    expect(new URL(res?.headers.get("x-middleware-rewrite") ?? "").pathname).toBe(
-      "/_draft/blog/hello",
-    );
-  });
-
-  it("leaves an ordinary request alone — ISR must not be disturbed", () => {
-    // The whole point: only drafted requests go dynamic. A shopper's request
-    // must reach the real, statically rendered route untouched.
-    const req = request("https://site.example/blog/hello");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("never nests the prefix when middleware re-runs on the rewritten URL", () => {
-    const req = request("https://site.example/_draft/blog/hello?__draft=abc.localhost@v1");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-
-  it("does not rewrite when leaving draft mode", () => {
-    const req = request("https://site.example/blog/hello?__draft=off", "abc.localhost@v1");
-    expect(rewriteToDraftRoute(req, prepareDraft(req))).toBeNull();
-  });
-});

package/src/draftMiddleware.ts

@@ -1,163 +0,0 @@
-/**
- * Draft preview — middleware half.
- *
- * Two composable calls, because sites already own their middleware and this
- * must slot into it rather than replace it:
- *
- * ```ts
- * // middleware.ts (Next <16) / proxy.ts (Next 16+)
- * export function middleware(request: NextRequest) {
- *   const decision = prepareDraft(request);
- *   return applyDraft(NextResponse.next(), decision);
- * }
- * ```
- *
- * The middleware owns only the cookie and the cache/indexing headers — a
- * Server Component can read cookies but cannot set them, so that part has to
- * live here. The pointer itself is read by the page.
- *
- * Lives on its own subpath so middleware (edge runtime) never imports the root
- * barrel, which pulls in the client component graph.
- */
-
-import { isDraftHostAllowed } from "@decocms/blocks/cms";
-import { type NextRequest, NextResponse } from "next/server";
-import {
-  DRAFT_COOKIE,
-  DRAFT_COOKIE_OPTIONS,
-  DRAFT_HEADER,
-  type DraftMiddlewareDecision,
-  decideDraft,
-} from "./draft";
-
-/**
- * Compute the draft decision for a request.
- *
- * Only the cookie and the response headers are the middleware's business now —
- * the page reads the pointer itself from `searchParams` + `cookies()`, so
- * nothing has to be forwarded through the request. That also means a draft
- * still works on routes this middleware never matches.
- */
-const INERT: DraftMiddlewareDecision = { pointer: null, setCookie: null, clearCookie: false };
-
-export function prepareDraft(request: NextRequest): DraftMiddlewareDecision {
-  // The AUTHORITATIVE host gate lives page-side (`ensureDraft`): the site
-  // block's `previewHosts` are installed in the server-components graph, and
-  // middleware runs in a separate module graph/runtime that never sees them.
-  // Middleware therefore hard-gates only on the env override — keeping
-  // DECO_ALLOWED_PREVIEW_HOSTS a full kill switch — and otherwise passes the
-  // decision through. Worst case on a non-preview host is a cookie the
-  // page-side gate then ignores; drafts never render there.
-  if (process.env.DECO_ALLOWED_PREVIEW_HOSTS) {
-    const host =
-      request.headers.get("x-forwarded-host") ??
-      request.headers.get("host") ??
-      request.nextUrl.host;
-    if (!isDraftHostAllowed(host)) return INERT;
-  }
-  return decideDraft(new URL(request.url), request.cookies.get(DRAFT_COOKIE)?.value ?? null);
-}
-
-/**
- * URL prefix a drafted request is rewritten onto.
- *
- * The site must mount the matching route as `app/%5Fdraft/...` — URL-encoded.
- * A literal `_draft/` directory is a Next "private folder", excluded from
- * routing entirely, so the rewrite would fall through to whatever catch-all
- * follows and 404. The encoded directory serves the same `/_draft` URL while
- * staying routable.
- */
-export const DRAFT_ROUTE_PREFIX = "/_draft";
-
-/**
- * Rewrite a drafted request onto the dynamic draft route.
- *
- * This exists because `dynamic` / `revalidate` are STATIC route exports: a
- * statically rendered page cannot become dynamic for one request. Making the
- * real route dynamic to support drafts would cost every shopper their cached
- * page, and — worse — a statically rendered draft would be cached and served to
- * them. Rewriting sends only drafted requests to a route that is dynamic by
- * construction, leaving ordinary traffic's ISR completely untouched.
- *
- * The original path is preserved in the rewritten pathname, so the draft route
- * can resolve exactly the page the visitor asked for.
- *
- * Returns null when this request is not drafted, so callers fall through to
- * their normal response.
- */
-export function rewriteToDraftRoute(
-  request: NextRequest,
-  decision: DraftMiddlewareDecision,
-): NextResponse | null {
-  if (!decision.pointer) return null;
-  const url = request.nextUrl.clone();
-  // Already rewritten (Next re-runs middleware on the rewritten URL in some
-  // configurations) — never nest the prefix.
-  if (url.pathname.startsWith(`${DRAFT_ROUTE_PREFIX}/`)) return null;
-  url.pathname = `${DRAFT_ROUTE_PREFIX}${url.pathname}`;
-  return NextResponse.rewrite(url);
-}
-
-/**
- * Apply the cookie and the cache/indexing headers a draft response requires.
- *
- * The caching headers are the difference between a preview and a **leak**.
- * With the pointer in a cookie, a draft response and a published one share an
- * identical URL, so a CDN keyed on URL alone would happily serve unpublished
- * content to a real visitor. `no-store` is what actually prevents that;
- * `Vary: Cookie` keeps any intermediary that *does* respect it from mixing the
- * two; `X-Robots-Tag` keeps a leaked draft out of search results.
- */
-export function applyDraft(
-  response: NextResponse,
-  decision: DraftMiddlewareDecision,
-): NextResponse {
-  if (decision.clearCookie) {
-    response.cookies.delete(DRAFT_COOKIE);
-  } else if (decision.setCookie) {
-    response.cookies.set(DRAFT_COOKIE, decision.setCookie, DRAFT_COOKIE_OPTIONS);
-  }
-
-  if (decision.pointer) {
-    response.headers.set("cache-control", "no-store, private");
-    response.headers.set("vary", "Cookie");
-    response.headers.set("x-robots-tag", "noindex, nofollow");
-  }
-
-  return response;
-}
-
-/**
- * Request headers to forward downstream, carrying the active pointer on
- * `x-deco-draft` (see {@link DRAFT_HEADER}) so the RSC tree — including the app
- * shell — can bind the draft via `ensureDraft()` and reflect it in
- * shell-resolved Header/Footer, not only page sections.
- *
- * Pass to `NextResponse.next({ request: { headers } })`. Strips any
- * client-supplied `x-deco-draft` when this request is not previewing, so the
- * header is only ever present on a legitimately-gated preview request.
- */
-export function draftRequestHeaders(
-  request: NextRequest,
-  decision: DraftMiddlewareDecision,
-): Headers {
-  const headers = new Headers(request.headers);
-  if (decision.pointer) headers.set(DRAFT_HEADER, decision.pointer);
-  else headers.delete(DRAFT_HEADER);
-  return headers;
-}
-
-/**
- * Convenience for sites with no middleware of their own: prepare, forward the
- * pointer header, continue, apply. Sites that already have middleware should
- * call the halves directly (`prepareDraft` → `draftRequestHeaders` on the
- * `NextResponse.next({ request: { headers } })` → `applyDraft`) so their own
- * logic sits in between.
- */
-export function draftMiddleware(request: NextRequest): NextResponse {
-  const decision = prepareDraft(request);
-  const response = NextResponse.next({
-    request: { headers: draftRequestHeaders(request, decision) },
-  });
-  return applyDraft(response, decision);
-}

package/src/draftShell.test.ts

@@ -1,76 +0,0 @@
-/**
- * `ensureDraft()` must bind from the middleware-forwarded `x-deco-draft` header
- * — the only pointer source a LAYOUT (app shell) can see: it receives no
- * `searchParams`, and on the entry request the cookie has only just been set on
- * the response. This is what lets shell-resolved Header/Footer reflect a draft,
- * not just page sections.
- */
-import { clearDraftCache } from "@decocms/blocks/cms";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mutable header/cookie state the mock reads, so each test drives its own.
-let headerState = new Headers();
-let cookieState: Record<string, string> = {};
-
-vi.mock("next/headers", () => ({
-  headers: async () => headerState,
-  cookies: async () => ({
-    get: (name: string) =>
-      name in cookieState ? { name, value: cookieState[name] } : undefined,
-  }),
-}));
-
-const { ensureDraft, DRAFT_HEADER, DRAFT_COOKIE } = await import("./draft");
-
-const DRAFT_BLOCKS = { "pages-home": { title: "DRAFT" } };
-const POINTER = "abc.localhost:60534/api/o/decofile/m/main?token=t@v1";
-
-beforeEach(() => {
-  headerState = new Headers({ host: "site.example" });
-  cookieState = {};
-  process.env.DECO_ALLOWED_PREVIEW_HOSTS = "site.example";
-  clearDraftCache();
-  vi.stubGlobal(
-    "fetch",
-    vi.fn(async (url: string) => {
-      if (
-        String(url) ===
-        "http://abc.localhost:60534/api/o/decofile/m/main?token=t"
-      ) {
-        return new Response(JSON.stringify(DRAFT_BLOCKS), {
-          status: 200,
-          headers: { "content-type": "application/json" },
-        });
-      }
-      throw new Error(`unexpected fetch: ${url}`);
-    }),
-  );
-});
-
-afterEach(() => {
-  vi.unstubAllGlobals();
-  delete process.env.DECO_ALLOWED_PREVIEW_HOSTS;
-});
-
-describe("ensureDraft — app-shell (layout) binding via the forwarded header", () => {
-  it("binds the draft from x-deco-draft with no searchParams (the layout case)", async () => {
-    headerState.set(DRAFT_HEADER, POINTER);
-    // No searchParams (layouts get none) and no cookie (entry request).
-    expect(await ensureDraft()).toBe(true);
-  });
-
-  it("still binds from the cookie when there is no forwarded header", async () => {
-    cookieState[DRAFT_COOKIE] = POINTER;
-    expect(await ensureDraft()).toBe(true);
-  });
-
-  it("does not bind when neither header, cookie, nor param is present", async () => {
-    expect(await ensureDraft()).toBe(false);
-  });
-
-  it("stays gated by the host allowlist even with a forwarded header", async () => {
-    headerState = new Headers({ host: "prod.example" });
-    headerState.set(DRAFT_HEADER, POINTER);
-    expect(await ensureDraft()).toBe(false);
-  });
-});