@djangocfg/nextjs 2.1.4 → 2.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -104,13 +104,13 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/api": "^2.1.4",
+    "@djangocfg/api": "^2.1.6",
     "next": "^15.5.7"
   },
   "devDependencies": {
-    "@djangocfg/imgai": "^2.1.4",
-    "@djangocfg/layouts": "^2.1.4",
-    "@djangocfg/typescript-config": "^2.1.4",
+    "@djangocfg/imgai": "^2.1.6",
+    "@djangocfg/layouts": "^2.1.6",
+    "@djangocfg/typescript-config": "^2.1.6",
     "@types/node": "^24.7.2",
     "@types/react": "19.2.2",
     "@types/react-dom": "19.2.1",

package/src/config/constants.ts

@@ -10,17 +10,12 @@ export const VERSION_CACHE_TTL_MS = 60 * 60 * 1000;
 
 // ASCII Art Banner for Django CFG
 export const DJANGO_CFG_BANNER = `
-     888  d8b                                               .d888
-     888  Y8P                                              d88P"
-     888                                                   888
- .d88888 8888  8888b.  88888b.   .d88b.   .d88b.   .d8888b 888888 .d88b.
-d88" 888 "888     "88b 888 "88b d88P"88b d88""88b d88P"    888   d88P"88b
-888  888  888 .d888888 888  888 888  888 888  888 888      888   888  888
-Y88b 888  888 888  888 888  888 Y88b 888 Y88..88P Y88b.    888   Y88b 888
- "Y88888  888 "Y888888 888  888  "Y88888  "Y88P"   "Y8888P 888    "Y88888
-          888                        888                              888
-         d88P                   Y8b d88P                         Y8b d88P
-       888P"                     "Y88P"                           "Y88P"
+██████╗      ██╗ █████╗ ███╗   ██╗ ██████╗  ██████╗      ██████╗███████╗ ██████╗
+██╔══██╗     ██║██╔══██╗████╗  ██║██╔════╝ ██╔═══██╗    ██╔════╝██╔════╝██╔════╝
+██║  ██║     ██║███████║██╔██╗ ██║██║  ███╗██║   ██║    ██║     █████╗  ██║  ███╗
+██║  ██║██   ██║██╔══██║██║╚██╗██║██║   ██║██║   ██║    ██║     ██╔══╝  ██║   ██║
+██████╔╝╚█████╔╝██║  ██║██║ ╚████║╚██████╔╝╚██████╔╝    ╚██████╗██║     ╚██████╔╝
+╚═════╝  ╚════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝ ╚═════╝  ╚═════╝      ╚═════╝╚═╝      ╚═════╝
 `;
 
 // All @djangocfg packages that can be updated together

package/src/config/createNextConfig.ts

@@ -53,6 +53,11 @@ export interface BaseNextConfigOptions {
   checkPackages?: boolean;
   /** Auto-install missing packages without prompting (default: false) */
   autoInstall?: boolean;
+  /**
+   * Allow embedding this app in iframe from specified origins
+   * Set to ['*'] to allow all origins, or specify domains like ['https://djangocfg.com']
+   */
+  allowIframeFrom?: string[];
   /** Custom webpack configuration function (called after base webpack logic) */
   webpack?: (
     config: WebpackConfig,
@@ -118,6 +123,43 @@ export function createBaseNextConfig(
       unoptimized: true,
     },
 
+    // CORS headers for static files and iframe embedding
+    async headers() {
+      const headers: { source: string; headers: { key: string; value: string }[] }[] = [
+        {
+          source: '/static/:path*',
+          headers: [
+            { key: 'Access-Control-Allow-Origin', value: '*' },
+            { key: 'Access-Control-Allow-Methods', value: 'GET, OPTIONS' },
+            { key: 'Access-Control-Allow-Headers', value: 'Origin, Content-Type, Accept' },
+          ],
+        },
+      ];
+
+      // Add iframe embedding headers if allowIframeFrom is specified
+      if (options.allowIframeFrom && options.allowIframeFrom.length > 0) {
+        const frameAncestors = options.allowIframeFrom.includes('*')
+          ? '*'
+          : `'self' ${options.allowIframeFrom.join(' ')}`;
+
+        headers.push({
+          source: '/:path*',
+          headers: [
+            // Content-Security-Policy frame-ancestors directive
+            { key: 'Content-Security-Policy', value: `frame-ancestors ${frameAncestors}` },
+            // X-Frame-Options for older browsers (ALLOW-FROM is deprecated, use CSP instead)
+            // Only set SAMEORIGIN if allowing all, otherwise browsers will use CSP
+            ...(options.allowIframeFrom.includes('*')
+              ? []
+              : [{ key: 'X-Frame-Options', value: 'SAMEORIGIN' }]
+            ),
+          ],
+        });
+      }
+
+      return headers;
+    },
+
     // Transpile packages (merge with user-provided)
     transpilePackages: [
       ...DEFAULT_TRANSPILE_PACKAGES,
@@ -204,6 +246,7 @@ export function createBaseNextConfig(
   delete (finalConfig as any).forceCheckWorkspace;
   delete (finalConfig as any).checkPackages;
   delete (finalConfig as any).autoInstall;
+  delete (finalConfig as any).allowIframeFrom;
 
   return finalConfig;
 }