@fluid-app/fluid-cli-member-site 0.1.24 → 0.1.26

package/dist/index.mjs

@@ -1022,6 +1022,26 @@ function rewritePreviewHtml(html, target, previewToken) {
 function rewritePreviewAsset(source, target, previewToken) {
 	return source.split(`/accounts/_frame/${target.siteId}/assets/`).join(`${ASSET_ROUTE_PREFIX}${previewToken}/`);
 }
+const FETCH_DIRECTIVES = new Set([
+	"script-src",
+	"style-src",
+	"img-src",
+	"font-src",
+	"media-src"
+]);
+/**
+* Adds the preview's own origin to the sources of code, styles, images, fonts
+* and media in the server's policy. The server renders a draft for no origin
+* in particular and names only Fluid's site SDK, so a page shown from here
+* would otherwise have its assets, which this proxy serves, blocked. Every
+* other directive, the closed network included, is kept as the server sent it.
+*/
+function allowPreviewOrigin(policy, origin) {
+	return policy.split(";").map((directive) => {
+		const name = directive.trim().split(/\s+/)[0] ?? "";
+		return FETCH_DIRECTIVES.has(name) ? `${directive.trimEnd()} ${origin}` : directive;
+	}).join(";");
+}
 /**
 * Serves a draft preview by asking the preview route of the member or company
 * API with the CLI's bearer, from this process only. The browser sends no
@@ -1106,7 +1126,8 @@ var PreviewProxy = class {
 			return text(502, "The draft preview could not be rendered.");
 		}
 		const type = upstream.headers.get("content-type") ?? "text/plain; charset=utf-8";
-		const policy = upstream.headers.get("content-security-policy") ?? "frame-ancestors 'self'; sandbox allow-scripts allow-forms";
+		const upstreamPolicy = upstream.headers.get("content-security-policy");
+		const policy = upstreamPolicy ? allowPreviewOrigin(upstreamPolicy, url.origin) : PREVIEW_SANDBOX_POLICY;
 		const raw = Buffer.from(await upstream.arrayBuffer());
 		const rewrite = type.startsWith("text/html") ? rewritePreviewHtml : /^(text\/css|(text|application)\/(x-)?javascript)\b/.test(type) ? rewritePreviewAsset : void 0;
 		send(200, type, rewrite ? Buffer.from(rewrite(raw.toString("utf8"), target, this.previewToken)) : raw, policy, isSandboxedAssetRequest(req, this.previewToken) ? {