@djangocfg/nextjs 2.1.5 → 2.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -104,13 +104,13 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/api": "^2.1.5",
+    "@djangocfg/api": "^2.1.6",
     "next": "^15.5.7"
   },
   "devDependencies": {
-    "@djangocfg/imgai": "^2.1.5",
-    "@djangocfg/layouts": "^2.1.5",
-    "@djangocfg/typescript-config": "^2.1.5",
+    "@djangocfg/imgai": "^2.1.6",
+    "@djangocfg/layouts": "^2.1.6",
+    "@djangocfg/typescript-config": "^2.1.6",
     "@types/node": "^24.7.2",
     "@types/react": "19.2.2",
     "@types/react-dom": "19.2.1",

package/src/config/createNextConfig.ts

@@ -53,6 +53,11 @@ export interface BaseNextConfigOptions {
   checkPackages?: boolean;
   /** Auto-install missing packages without prompting (default: false) */
   autoInstall?: boolean;
+  /**
+   * Allow embedding this app in iframe from specified origins
+   * Set to ['*'] to allow all origins, or specify domains like ['https://djangocfg.com']
+   */
+  allowIframeFrom?: string[];
   /** Custom webpack configuration function (called after base webpack logic) */
   webpack?: (
     config: WebpackConfig,
@@ -118,9 +123,9 @@ export function createBaseNextConfig(
       unoptimized: true,
     },
 
-    // CORS headers for static files
+    // CORS headers for static files and iframe embedding
     async headers() {
-      return [
+      const headers: { source: string; headers: { key: string; value: string }[] }[] = [
         {
           source: '/static/:path*',
           headers: [
@@ -130,6 +135,29 @@ export function createBaseNextConfig(
           ],
         },
       ];
+
+      // Add iframe embedding headers if allowIframeFrom is specified
+      if (options.allowIframeFrom && options.allowIframeFrom.length > 0) {
+        const frameAncestors = options.allowIframeFrom.includes('*')
+          ? '*'
+          : `'self' ${options.allowIframeFrom.join(' ')}`;
+
+        headers.push({
+          source: '/:path*',
+          headers: [
+            // Content-Security-Policy frame-ancestors directive
+            { key: 'Content-Security-Policy', value: `frame-ancestors ${frameAncestors}` },
+            // X-Frame-Options for older browsers (ALLOW-FROM is deprecated, use CSP instead)
+            // Only set SAMEORIGIN if allowing all, otherwise browsers will use CSP
+            ...(options.allowIframeFrom.includes('*')
+              ? []
+              : [{ key: 'X-Frame-Options', value: 'SAMEORIGIN' }]
+            ),
+          ],
+        });
+      }
+
+      return headers;
     },
 
     // Transpile packages (merge with user-provided)
@@ -218,6 +246,7 @@ export function createBaseNextConfig(
   delete (finalConfig as any).forceCheckWorkspace;
   delete (finalConfig as any).checkPackages;
   delete (finalConfig as any).autoInstall;
+  delete (finalConfig as any).allowIframeFrom;
 
   return finalConfig;
 }