@jamwidgets/astro 0.3.1 → 0.3.3

package/README.md

@@ -17,6 +17,7 @@ Add your JamWidgets site key to your `.env`:
 
 ```
 JAMWIDGETS_SITE_KEY=your_site_key_here
+SITE_URL=https://example.com
 ```
 
 ## Content Loader (Posts)
@@ -31,12 +32,16 @@ import { jamwidgetsPostsLoader } from "@jamwidgets/astro/loader";
 const posts = defineCollection({
   loader: jamwidgetsPostsLoader({
     siteKey: import.meta.env.JAMWIDGETS_SITE_KEY,
+    origin: import.meta.env.SITE_URL,
   }),
 });
 
 export const collections = { posts };
 ```
 
+Set `origin` to an allowed origin for production builds. JamWidgets rejects the
+request when the site restricts origins and the loader omits it.
+
 Then use in your pages:
 
 ```astro
@@ -59,6 +64,7 @@ const posts = await getCollection("posts");
 jamwidgetsPostsLoader({
   siteKey: string;        // Required - your JamWidgets site key
   endpoint?: string;      // Default: 'https://jamwidgets.com'
+  origin?: string;        // Site URL used for allowed-origin validation
   tag?: string;           // Filter posts by tag
   limit?: number;         // Max posts to fetch (default: 500)
   onError?: 'throw' | 'warn' | 'ignore';  // Error handling

package/dist/loader.d.ts

@@ -26,6 +26,8 @@ export interface JamwidgetsPostsLoaderOptions {
     siteKey: string;
     /** Base URL of your Jamwidgets instance (default: 'https://jamwidgets.com') */
     endpoint?: string;
+    /** Site origin sent for allowed-origin validation */
+    origin?: string;
     /** Filter posts by tag */
     tag?: string;
     /** Maximum number of posts to fetch (default: 500) */

package/dist/loader.js

@@ -24,7 +24,7 @@ export { coreFetchPosts as fetchPosts, coreFetchPost as fetchPost };
  * Posts are fetched at build time and cached by Astro.
  */
 export function jamwidgetsPostsLoader(options) {
-    const { endpoint = DEFAULT_ENDPOINT, tag, limit = 500, onError = "throw", } = options;
+    const { endpoint = DEFAULT_ENDPOINT, origin, tag, limit = 500, onError = "throw", } = options;
     const siteKey = getSiteKey({ siteKey: options.siteKey });
     const baseUrl = endpoint.replace(/\/+$/, "") + API_PATH;
     return {
@@ -41,10 +41,9 @@ export function jamwidgetsPostsLoader(options) {
                 const response = await fetch(url.toString(), {
                     headers: {
                         "X-Jamwidgets-Key": siteKey,
-                        // Legacy headers for backward compatibility
                         "X-Seriph-Key": siteKey,
-                        // User-Agent to avoid bot detection (Cloudflare, etc.)
                         "User-Agent": "JamwidgetsAstroLoader/1.0",
+                        ...(origin ? { Origin: origin } : {}),
                     },
                 });
                 if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jamwidgets/astro",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Astro components and content loader for Jamwidgets (forms, comments, reactions, posts)",
   "repository": {
     "type": "git",
@@ -41,7 +41,8 @@
   ],
   "scripts": {
     "build": "tsc",
-    "dev": "tsc --watch"
+    "dev": "tsc --watch",
+    "test": "vitest run test/loader.test.ts"
   },
   "keywords": [
     "astro",
@@ -56,13 +57,14 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@jamwidgets/core": "^0.3.1"
+    "@jamwidgets/core": "^0.3.2"
   },
   "peerDependencies": {
     "astro": "^5.0.0 || ^6.0.0 || ^7.0.0"
   },
   "devDependencies": {
     "astro": "^7.1.3",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.10"
   }
 }

package/src/PoweredBy.astro

@@ -5,7 +5,7 @@
  * Rendered at the bottom of a drop-in widget. It hydrates hidden and only
  * reveals itself when the site is on the Free tier (no custom branding) — the
  * gate is the `hasCustomBranding` flag from `GET /api/v1/site`. Paid tiers
- * (Pro/Team) keep it hidden, and if the config fetch fails we stay hidden so a
+ * Team sites keep it hidden, and if the config fetch fails we stay hidden so a
  * paying site is never wrongly branded.
  *
  * Included by the block widgets (Comments, Form, Subscribe, Poll, Feedback,

package/src/loader.ts

@@ -39,6 +39,8 @@ export interface JamwidgetsPostsLoaderOptions {
   siteKey: string;
   /** Base URL of your Jamwidgets instance (default: 'https://jamwidgets.com') */
   endpoint?: string;
+  /** Site origin sent for allowed-origin validation */
+  origin?: string;
   /** Filter posts by tag */
   tag?: string;
   /** Maximum number of posts to fetch (default: 500) */
@@ -63,6 +65,7 @@ interface ApiResponse {
 export function jamwidgetsPostsLoader(options: JamwidgetsPostsLoaderOptions): Loader {
   const {
     endpoint = DEFAULT_ENDPOINT,
+    origin,
     tag,
     limit = 500,
     onError = "throw",
@@ -89,10 +92,9 @@ export function jamwidgetsPostsLoader(options: JamwidgetsPostsLoaderOptions): Lo
         const response = await fetch(url.toString(), {
           headers: {
             "X-Jamwidgets-Key": siteKey,
-            // Legacy headers for backward compatibility
             "X-Seriph-Key": siteKey,
-            // User-Agent to avoid bot detection (Cloudflare, etc.)
             "User-Agent": "JamwidgetsAstroLoader/1.0",
+            ...(origin ? { Origin: origin } : {}),
           },
         });