@payload-onpage/next 0.3.2 → 0.4.1

package/README.md

@@ -25,3 +25,7 @@ Part of [**payload-onpage**](https://github.com/jellologic/payload-onpage): on-p
 MIT licensed.
 
 See the **[tour](https://github.com/jellologic/payload-onpage/blob/main/docs/tour.md)** and **[getting started](https://github.com/jellologic/payload-onpage/blob/main/docs/getting-started.md)**.
+
+---
+
+_Found a bug? [Report it](https://github.com/jellologic/payload-onpage/issues/new?template=bug_report.yml) or see [CONTRIBUTING.md](https://github.com/jellologic/payload-onpage/blob/main/CONTRIBUTING.md) to fix it yourself._

package/dist/binding.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The editor's `onpage` mode cookie: `<mode>`, or `<mode>:<authCookie>:<hash>`
+ * when bound to a session. Shared by the session helpers (server components)
+ * and the proxy, so both read a binding the same way.
+ */
+import { type OnPageMode } from '@payload-onpage/core';
+export declare const fingerprint: (token: string) => Promise<string>;
+export interface ModeCookie {
+    mode: OnPageMode;
+    /** True when bound to an auth cookie that is present and matches. */
+    bound: boolean;
+}
+/** Parse the mode cookie; null when unknown or bound to a session that ended. */
+export declare function readModeCookie(raw: string | undefined, cookie: (name: string) => string | undefined): Promise<ModeCookie | null>;
+//# sourceMappingURL=binding.d.ts.map

package/dist/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAG5E,eAAO,MAAM,WAAW,GAAU,OAAO,MAAM,oBAAgD,CAAA;AAE/F,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,qEAAqE;IACrE,KAAK,EAAE,OAAO,CAAA;CACf;AAED,iFAAiF;AACjF,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC3C,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAQ5B"}

package/dist/binding.js

@@ -0,0 +1,23 @@
+/**
+ * The editor's `onpage` mode cookie: `<mode>`, or `<mode>:<authCookie>:<hash>`
+ * when bound to a session. Shared by the session helpers (server components)
+ * and the proxy, so both read a binding the same way.
+ */
+import { isOnPageMode, sha256 } from '@payload-onpage/core';
+const HASH_LENGTH = 32;
+export const fingerprint = async (token) => (await sha256(token)).slice(0, HASH_LENGTH);
+/** Parse the mode cookie; null when unknown or bound to a session that ended. */
+export async function readModeCookie(raw, cookie) {
+    if (!raw)
+        return null;
+    const [mode, bound, hash] = raw.split(':');
+    if (!isOnPageMode(mode))
+        return null;
+    if (!bound)
+        return { mode, bound: false };
+    const token = cookie(bound);
+    if (!token || (await fingerprint(token)) !== hash)
+        return null;
+    return { mode, bound: true };
+}
+//# sourceMappingURL=binding.js.map

package/dist/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,EAAmB,MAAM,sBAAsB,CAAA;AAE5E,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAQ/F,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAuB,EACvB,MAA4C;IAE5C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AAC9B,CAAC"}

package/dist/proxy.d.ts

@@ -2,6 +2,17 @@ import { type NextMiddleware, type NextRequest } from 'next/server.js';
 export interface OnPageProxyOptions {
     /** Same secret as the plugin (default: Payload's `secret`, i.e. PAYLOAD_SECRET). */
     secret: string | undefined;
+    /**
+     * Strict draft guard. Next's draft cookie is one site-wide key, so once a
+     * preview-link viewer's browser holds it (`cdnBypass`), anyone who copies it
+     * could read every draft. With `allowDraft`, a request keeps the draft cookie
+     * only on the page its preview link covers, for an editor whose bound
+     * session is still signed in, or when `allowDraft` says so (e.g. your own
+     * preview route's users: check the session is an admin). Otherwise it's
+     * stripped before rendering. Without it, the cookie is stripped only when it
+     * arrives with a preview link for another page.
+     */
+    allowDraft?: (request: NextRequest) => boolean | Promise<boolean>;
 }
 /** Request headers for the rest of the pipeline, with draft mode injected for a valid grant. */
 export declare function withOnPage(request: NextRequest, opts: OnPageProxyOptions, headers?: Headers): Promise<Headers>;

package/dist/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEpF,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3B;AAQD,gGAAgG;AAChG,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,kBAAkB,EACxB,OAAO,GAAE,OAAsC,GAC9C,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CAQ1E"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAGpF,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAClE;AAQD,gGAAgG;AAChG,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,kBAAkB,EACxB,OAAO,GAAE,OAAsC,GAC9C,OAAO,CAAC,OAAO,CAAC,CAqBlB;AAqBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CAQ1E"}

package/dist/proxy.js

@@ -2,9 +2,11 @@
  * The payload-onpage proxy (Next.js middleware). Required for preview links:
  * it unseals the `onpage_preview` grant and, only on the shared page and
  * before the grant expires, injects Next's draft-mode cookie into the request.
- * Static pages then render the draft for the viewer, while the browser never
- * holds a usable draft credential. It also passes the request path to server
- * components.
+ * Static pages then render the draft for the viewer. It also guards Next's
+ * draft cookie itself: on a CDN like Vercel's the viewer's browser holds it,
+ * scoped to the shared page (nextSession `cdnBypass`), and the proxy strips it
+ * from any request the grant doesn't cover, so a copied cookie unlocks nothing.
+ * It also passes the request path to server components.
  *
  *   // proxy.ts (Next 16; middleware.ts on Next 15)
  *   import { createOnPageProxy } from '@payload-onpage/next/proxy'
@@ -15,6 +17,7 @@
  */
 import { COOKIE, HEADER, SEAL_PURPOSE, isLivePreviewGrant, samePath, unseal, } from '@payload-onpage/core';
 import { NextResponse } from 'next/server.js';
+import { readModeCookie } from "./binding.js";
 const withoutCookies = (header, names) => (header ?? '')
     .split(';')
     .map((c) => c.trim())
@@ -25,17 +28,33 @@ export async function withOnPage(request, opts, headers = new Headers(request.he
     headers.delete(HEADER.shared); // never trust it from the client
     headers.set(HEADER.path, path);
     const sealed = request.cookies.get(COOKIE.preview)?.value;
-    if (!sealed || !opts.secret)
+    const grant = sealed && opts.secret ? await unseal(sealed, opts.secret, SEAL_PURPOSE.previewCookie) : null;
+    if (isLivePreviewGrant(grant) && samePath(path, grant.path)) {
+        const cookie = withoutCookies(headers.get('cookie'), [COOKIE.nextDraft, COOKIE.mode]);
+        cookie.push(`${COOKIE.nextDraft}=${grant.draft}`, `${COOKIE.mode}=view`);
+        headers.set('cookie', cookie.join('; '));
+        headers.set(HEADER.shared, '1');
         return headers;
-    const grant = await unseal(sealed, opts.secret, SEAL_PURPOSE.previewCookie);
-    if (!isLivePreviewGrant(grant) || !samePath(path, grant.path))
-        return headers;
-    const cookie = withoutCookies(headers.get('cookie'), [COOKIE.nextDraft, COOKIE.mode]);
-    cookie.push(`${COOKIE.nextDraft}=${grant.draft}`, `${COOKIE.mode}=view`);
-    headers.set('cookie', cookie.join('; '));
-    headers.set(HEADER.shared, '1');
+    }
+    if (request.cookies.has(COOKIE.nextDraft) && !(await mayKeepDraft(request, opts, !!sealed))) {
+        headers.set('cookie', withoutCookies(headers.get('cookie'), [COOKIE.nextDraft, COOKIE.mode]).join('; '));
+    }
     return headers;
 }
+/** No preview grant covers this page: may the request keep its own draft cookie? */
+async function mayKeepDraft(request, opts, hasPreviewCookie) {
+    if (!opts.allowDraft)
+        return !hasPreviewCookie;
+    const mode = await readModeCookie(request.cookies.get(COOKIE.mode)?.value, (name) => request.cookies.get(name)?.value);
+    if (mode?.bound)
+        return true; // an editor, still signed in as the session that entered
+    try {
+        return await opts.allowDraft(request);
+    }
+    catch {
+        return false; // fail closed: published content, never someone else's drafts
+    }
+}
 export function createOnPageProxy(opts) {
     if (!opts.secret)
         console.warn('payload-onpage: createOnPageProxy() has no secret; preview links will show published content.');

package/dist/proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,MAAM,GACP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAyC,MAAM,gBAAgB,CAAA;AAOpF,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAE,KAAe,EAAE,EAAE,CAChE,CAAC,MAAM,IAAI,EAAE,CAAC;KACX,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAElE,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,IAAwB,EACxB,UAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAA;IACrC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,CAAC,iCAAiC;IAC/D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAA;IACzD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAA;IAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC,CAAA;IAC3E,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAA;IAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACrF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAA;IACxE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACxC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,CAAC,MAAM;QACd,OAAO,CAAC,IAAI,CACV,+FAA+F,CAChG,CAAA;IACH,OAAO,KAAK,UAAU,KAAK,CAAC,OAAoB;QAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,MAAM,GACP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAyC,MAAM,gBAAgB,CAAA;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAkB7C,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAE,KAAe,EAAE,EAAE,CAChE,CAAC,MAAM,IAAI,EAAE,CAAC;KACX,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAElE,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,IAAwB,EACxB,UAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAA;IACrC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,CAAC,iCAAiC;IAC/D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAA;IACzD,MAAM,KAAK,GACT,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9F,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACrF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,OAAO,CAAC,CAAA;QACxE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACxC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5F,OAAO,CAAC,GAAG,CACT,QAAQ,EACR,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClF,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,YAAY,CACzB,OAAoB,EACpB,IAAwB,EACxB,gBAAyB;IAEzB,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,gBAAgB,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EACvC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAC3C,CAAA;IACD,IAAI,IAAI,EAAE,KAAK;QAAE,OAAO,IAAI,CAAA,CAAC,yDAAyD;IACtF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,8DAA8D;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,CAAC,MAAM;QACd,OAAO,CAAC,IAAI,CACV,+FAA+F,CAChG,CAAA;IACH,OAAO,KAAK,UAAU,KAAK,CAAC,OAAoB;QAC9C,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACrF,CAAC,CAAA;AACH,CAAC"}

package/dist/session.d.ts

@@ -4,9 +4,12 @@
  * Editors: Next draft mode plus an `onpage` cookie saying which mode, bound to
  * a hash of their auth cookie, so signing out (or in as someone else) ends it.
  *
- * Preview links: the browser gets only a sealed grant (`onpage_preview`). The
- * proxy (./proxy) unseals it and injects draft mode into the request for the
- * shared page only. The raw Next.js draft secret never reaches the browser.
+ * Preview links: the browser gets a sealed grant (`onpage_preview`). The proxy
+ * (./proxy) unseals it and injects draft mode into the request for the shared
+ * page only. With `cdnBypass` (default on Vercel), the browser also gets Next's
+ * draft cookie scoped to that page's path and the link's expiry: Vercel's cache
+ * decides bypass from the browser's own cookies, before any proxy runs. The
+ * proxy refuses that cookie everywhere the grant doesn't cover.
  *
  * All helpers read `draftMode().isEnabled` first and touch cookies only when
  * draft mode is on. Next exempts that read from prerender bailout, so pages
@@ -16,6 +19,14 @@ import { CONTEXT_KEY, type OnPageMode, type SessionAdapter } from '@payload-onpa
 export interface NextSessionOptions {
     /** How long an editor's edit/preview mode lasts, in seconds. Default 12 hours. */
     maxAge?: number;
+    /**
+     * Give preview-link viewers Next's draft cookie, scoped to the shared page's
+     * path and expiring with the link, so a CDN that serves cached pages unless
+     * the browser itself sends the draft cookie (Vercel) shows them the draft.
+     * Requires the proxy (`withOnPage`), which strips it on every other page.
+     * Default: on when deployed on Vercel (`process.env.VERCEL`).
+     */
+    cdnBypass?: boolean;
 }
 export declare function nextSession(opts?: NextSessionOptions): SessionAdapter;
 /** "edit", "view" or null for this request. Safe to call anywhere (returns null outside a request). */

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,WAAW,EAKX,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAA;AAG7B,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AA0CD,wBAAgB,WAAW,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,CA2BzE;AAED,uGAAuG;AACvG,eAAO,MAAM,aAAa,QAAO,OAAO,CAAC,UAAU,GAAG,IAAI,CAIhD,CAAA;AAEV;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,OAAO,CAAC,OAAO,CAKtC,CAAA;AAEX,8DAA8D;AAC9D,eAAO,MAAM,eAAe,QAAO,OAAO,CAAC,OAAO,CACwB,CAAA;AAE1E,kEAAkE;AAClE,MAAM,MAAM,iBAAiB,GAAG;IAAE,OAAO,CAAC,EAAE;QAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,CAAA;AAErE;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAEhE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,WAAW,EAGX,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAA;AAI7B,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AA+BD,wBAAgB,WAAW,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,CAsCzE;AAED,uGAAuG;AACvG,eAAO,MAAM,aAAa,QAAO,OAAO,CAAC,UAAU,GAAG,IAAI,CAIhD,CAAA;AAEV;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,OAAO,CAAC,OAAO,CAKtC,CAAA;AAEX,8DAA8D;AAC9D,eAAO,MAAM,eAAe,QAAO,OAAO,CAAC,OAAO,CACwB,CAAA;AAE1E,kEAAkE;AAClE,MAAM,MAAM,iBAAiB,GAAG;IAAE,OAAO,CAAC,EAAE;QAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,CAAA;AAErE;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAEhE"}

package/dist/session.js

@@ -4,16 +4,20 @@
  * Editors: Next draft mode plus an `onpage` cookie saying which mode, bound to
  * a hash of their auth cookie, so signing out (or in as someone else) ends it.
  *
- * Preview links: the browser gets only a sealed grant (`onpage_preview`). The
- * proxy (./proxy) unseals it and injects draft mode into the request for the
- * shared page only. The raw Next.js draft secret never reaches the browser.
+ * Preview links: the browser gets a sealed grant (`onpage_preview`). The proxy
+ * (./proxy) unseals it and injects draft mode into the request for the shared
+ * page only. With `cdnBypass` (default on Vercel), the browser also gets Next's
+ * draft cookie scoped to that page's path and the link's expiry: Vercel's cache
+ * decides bypass from the browser's own cookies, before any proxy runs. The
+ * proxy refuses that cookie everywhere the grant doesn't cover.
  *
  * All helpers read `draftMode().isEnabled` first and touch cookies only when
  * draft mode is on. Next exempts that read from prerender bailout, so pages
  * stay static for visitors.
  */
-import { CONTEXT_KEY, COOKIE, HEADER, isOnPageMode, sha256, } from '@payload-onpage/core';
+import { CONTEXT_KEY, COOKIE, HEADER, } from '@payload-onpage/core';
 import { cookies, draftMode, headers } from 'next/headers.js';
+import { fingerprint, readModeCookie } from "./binding.js";
 /** Our cookies: server-only, same-site, whole site. */
 const cookieBase = (secure) => ({ httpOnly: true, sameSite: 'lax', secure, path: '/' });
 /**
@@ -28,29 +32,17 @@ async function inDraft(read, fallback) {
         return fallback;
     }
 }
-const HASH_LENGTH = 32;
-const fingerprint = async (token) => (await sha256(token)).slice(0, HASH_LENGTH);
 /** `edit` | `view`, or `<mode>:<authCookie>:<hash>` when bound to a session. */
 async function modeValue(mode, jar, bindTo) {
     const token = bindTo ? jar.get(bindTo)?.value : undefined;
     return token ? `${mode}:${bindTo}:${await fingerprint(token)}` : mode;
 }
-/** The mode a cookie value grants in this request, or null (unknown, or the bound session is gone). */
 async function readMode(raw, jar) {
-    if (!raw)
-        return null;
-    const [mode, bound, hash] = raw.split(':');
-    if (!isOnPageMode(mode))
-        return null;
-    if (bound) {
-        const token = jar.get(bound)?.value;
-        if (!token || (await fingerprint(token)) !== hash)
-            return null;
-    }
-    return mode;
+    return (await readModeCookie(raw, (name) => jar.get(name)?.value))?.mode ?? null;
 }
 export function nextSession(opts = {}) {
     const maxAge = opts.maxAge ?? 12 * 3600;
+    const cdnBypass = opts.cdnBypass ?? (typeof process !== 'undefined' && !!process.env.VERCEL);
     return {
         async enable(mode, { secure, bindTo }) {
             ;
@@ -59,22 +51,34 @@ export function nextSession(opts = {}) {
             jar.set(COOKIE.mode, await modeValue(mode, jar, bindTo), { ...cookieBase(secure), maxAge });
             jar.delete(COOKIE.preview);
         },
-        async enableLink({ secure, path: _path, expiresAt, seal }) {
+        async enableLink({ secure, path, expiresAt, seal }) {
             ;
             (await draftMode()).enable();
             const jar = await cookies();
             const draft = jar.get(COOKIE.nextDraft)?.value;
             if (!draft)
                 throw new Error('payload-onpage: Next.js did not set its draft-mode cookie');
-            // Keep the draft secret server-side: the browser only gets the sealed grant.
-            jar.delete(COOKIE.nextDraft);
+            if (cdnBypass) {
+                // Replaces the site-wide cookie draftMode() just set: this page, this link's lifetime.
+                jar.set(COOKIE.nextDraft, draft, { ...cookieBase(secure), path, expires: expiresAt });
+            }
+            else {
+                // Keep the draft secret server-side: the browser only gets the sealed grant.
+                jar.delete(COOKIE.nextDraft);
+            }
             jar.delete(COOKIE.mode);
             jar.set(COOKIE.preview, await seal(draft), { ...cookieBase(secure), expires: expiresAt });
         },
-        async disable() {
-            ;
-            (await draftMode()).disable();
+        async disable({ path } = {}) {
             const jar = await cookies();
+            if (path && jar.get(COOKIE.preview)) {
+                // A preview-link viewer: their draft cookie, if any, is scoped to the shared page.
+                jar.set(COOKIE.nextDraft, '', { ...cookieBase(false), path, maxAge: 0 });
+            }
+            else {
+                ;
+                (await draftMode()).disable();
+            }
             jar.delete(COOKIE.mode);
             jar.delete(COOKIE.preview);
         },

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,WAAW,EACX,MAAM,EACN,MAAM,EACN,YAAY,EACZ,MAAM,GAGP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAU7D,uDAAuD;AACvD,MAAM,UAAU,GAAG,CAAC,MAAe,EAAE,EAAE,CACrC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAyB,CAAA;AAElF;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAI,IAAsB,EAAE,QAAW;IAC3D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,WAAW,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAExF,gFAAgF;AAChF,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,GAAQ,EAAE,MAAe;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,QAAQ,CAAC,GAAuB,EAAE,GAAQ;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;QACnC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IAChE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,IAAI,CAAA;IACvC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;YACnC,CAAC;YAAA,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE;YACvD,CAAC;YAAA,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;YAC9C,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;YACxF,6EAA6E;YAC7E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC5B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,KAAK,CAAC,OAAO;YACX,CAAC;YAAA,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QACD,OAAO,EAAE,aAAa;KACvB,CAAA;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,aAAa,GAAG,GAA+B,EAAE,CAC5D,OAAO,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;IAC3B,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;AACnD,CAAC,EAAE,IAAI,CAAC,CAAA;AAEV;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAqB,EAAE,CACnD,OAAO,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;IACvC,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAA;AACjE,CAAC,EAAE,KAAK,CAAC,CAAA;AAEX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,GAAqB,EAAE,CACpD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,KAAK,CAAC,CAAA;AAK1E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,OAAO,CAAC,MAAM,aAAa,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACvF,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,WAAW,EACX,MAAM,EACN,MAAM,GAGP,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAkB1D,uDAAuD;AACvD,MAAM,UAAU,GAAG,CAAC,MAAe,EAAE,EAAE,CACrC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAyB,CAAA;AAElF;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAI,IAAsB,EAAE,QAAW;IAC3D,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,GAAQ,EAAE,MAAe;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACvE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAuB,EAAE,GAAQ;IACvD,OAAO,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,IAAI,CAAA;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5F,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;YACnC,CAAC;YAAA,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;YAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAChD,CAAC;YAAA,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;YAC9C,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;YACxF,IAAI,SAAS,EAAE,CAAC;gBACd,uFAAuF;gBACvF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;YACvF,CAAC;iBAAM,CAAC;gBACN,6EAA6E;gBAC7E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC9B,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YACzB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,mFAAmF;gBACnF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1E,CAAC;iBAAM,CAAC;gBACN,CAAC;gBAAA,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;YAChC,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACvB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QACD,OAAO,EAAE,aAAa;KACvB,CAAA;AACH,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,aAAa,GAAG,GAA+B,EAAE,CAC5D,OAAO,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;IAC3B,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;AACnD,CAAC,EAAE,IAAI,CAAC,CAAA;AAEV;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAqB,EAAE,CACnD,OAAO,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;IACvC,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAA;AACjE,CAAC,EAAE,KAAK,CAAC,CAAA;AAEX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,GAAqB,EAAE,CACpD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,KAAK,CAAC,CAAA;AAK1E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,OAAO,CAAC,MAAM,aAAa,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACvF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payload-onpage/next",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "description": "payload-onpage for Next.js App Router: draft-mode session adapter, <OnPage />, onpageContext() and refresh rendering.",
   "license": "MIT",
   "type": "module",
@@ -20,6 +20,7 @@
     "nextjs",
     "next.js",
     "app-router",
+    "typescript",
     "visual-editing",
     "visual-editor",
     "inline-editing",
@@ -72,9 +73,9 @@
     "provenance": true
   },
   "dependencies": {
-    "@payload-onpage/core": "0.3.2",
-    "@payload-onpage/react": "0.3.2",
-    "@payload-onpage/lexical": "0.3.2"
+    "@payload-onpage/core": "0.4.1",
+    "@payload-onpage/react": "0.4.1",
+    "@payload-onpage/lexical": "0.4.1"
   },
   "peerDependencies": {
     "next": "^15.4.11 || ^16.3.8",

package/src/binding.ts

@@ -0,0 +1,29 @@
+/**
+ * The editor's `onpage` mode cookie: `<mode>`, or `<mode>:<authCookie>:<hash>`
+ * when bound to a session. Shared by the session helpers (server components)
+ * and the proxy, so both read a binding the same way.
+ */
+import { isOnPageMode, sha256, type OnPageMode } from '@payload-onpage/core'
+
+const HASH_LENGTH = 32
+export const fingerprint = async (token: string) => (await sha256(token)).slice(0, HASH_LENGTH)
+
+export interface ModeCookie {
+  mode: OnPageMode
+  /** True when bound to an auth cookie that is present and matches. */
+  bound: boolean
+}
+
+/** Parse the mode cookie; null when unknown or bound to a session that ended. */
+export async function readModeCookie(
+  raw: string | undefined,
+  cookie: (name: string) => string | undefined,
+): Promise<ModeCookie | null> {
+  if (!raw) return null
+  const [mode, bound, hash] = raw.split(':')
+  if (!isOnPageMode(mode)) return null
+  if (!bound) return { mode, bound: false }
+  const token = cookie(bound)
+  if (!token || (await fingerprint(token)) !== hash) return null
+  return { mode, bound: true }
+}

package/src/proxy.ts

@@ -2,9 +2,11 @@
  * The payload-onpage proxy (Next.js middleware). Required for preview links:
  * it unseals the `onpage_preview` grant and, only on the shared page and
  * before the grant expires, injects Next's draft-mode cookie into the request.
- * Static pages then render the draft for the viewer, while the browser never
- * holds a usable draft credential. It also passes the request path to server
- * components.
+ * Static pages then render the draft for the viewer. It also guards Next's
+ * draft cookie itself: on a CDN like Vercel's the viewer's browser holds it,
+ * scoped to the shared page (nextSession `cdnBypass`), and the proxy strips it
+ * from any request the grant doesn't cover, so a copied cookie unlocks nothing.
+ * It also passes the request path to server components.
  *
  *   // proxy.ts (Next 16; middleware.ts on Next 15)
  *   import { createOnPageProxy } from '@payload-onpage/next/proxy'
@@ -22,10 +24,22 @@ import {
   unseal,
 } from '@payload-onpage/core'
 import { NextResponse, type NextMiddleware, type NextRequest } from 'next/server.js'
+import { readModeCookie } from './binding.ts'
 
 export interface OnPageProxyOptions {
   /** Same secret as the plugin (default: Payload's `secret`, i.e. PAYLOAD_SECRET). */
   secret: string | undefined
+  /**
+   * Strict draft guard. Next's draft cookie is one site-wide key, so once a
+   * preview-link viewer's browser holds it (`cdnBypass`), anyone who copies it
+   * could read every draft. With `allowDraft`, a request keeps the draft cookie
+   * only on the page its preview link covers, for an editor whose bound
+   * session is still signed in, or when `allowDraft` says so (e.g. your own
+   * preview route's users: check the session is an admin). Otherwise it's
+   * stripped before rendering. Without it, the cookie is stripped only when it
+   * arrives with a preview link for another page.
+   */
+  allowDraft?: (request: NextRequest) => boolean | Promise<boolean>
 }
 
 const withoutCookies = (header: string | null, names: string[]) =>
@@ -44,16 +58,43 @@ export async function withOnPage(
   headers.delete(HEADER.shared) // never trust it from the client
   headers.set(HEADER.path, path)
   const sealed = request.cookies.get(COOKIE.preview)?.value
-  if (!sealed || !opts.secret) return headers
-  const grant = await unseal(sealed, opts.secret, SEAL_PURPOSE.previewCookie)
-  if (!isLivePreviewGrant(grant) || !samePath(path, grant.path)) return headers
-  const cookie = withoutCookies(headers.get('cookie'), [COOKIE.nextDraft, COOKIE.mode])
-  cookie.push(`${COOKIE.nextDraft}=${grant.draft}`, `${COOKIE.mode}=view`)
-  headers.set('cookie', cookie.join('; '))
-  headers.set(HEADER.shared, '1')
+  const grant =
+    sealed && opts.secret ? await unseal(sealed, opts.secret, SEAL_PURPOSE.previewCookie) : null
+  if (isLivePreviewGrant(grant) && samePath(path, grant.path)) {
+    const cookie = withoutCookies(headers.get('cookie'), [COOKIE.nextDraft, COOKIE.mode])
+    cookie.push(`${COOKIE.nextDraft}=${grant.draft}`, `${COOKIE.mode}=view`)
+    headers.set('cookie', cookie.join('; '))
+    headers.set(HEADER.shared, '1')
+    return headers
+  }
+  if (request.cookies.has(COOKIE.nextDraft) && !(await mayKeepDraft(request, opts, !!sealed))) {
+    headers.set(
+      'cookie',
+      withoutCookies(headers.get('cookie'), [COOKIE.nextDraft, COOKIE.mode]).join('; '),
+    )
+  }
   return headers
 }
 
+/** No preview grant covers this page: may the request keep its own draft cookie? */
+async function mayKeepDraft(
+  request: NextRequest,
+  opts: OnPageProxyOptions,
+  hasPreviewCookie: boolean,
+): Promise<boolean> {
+  if (!opts.allowDraft) return !hasPreviewCookie
+  const mode = await readModeCookie(
+    request.cookies.get(COOKIE.mode)?.value,
+    (name) => request.cookies.get(name)?.value,
+  )
+  if (mode?.bound) return true // an editor, still signed in as the session that entered
+  try {
+    return await opts.allowDraft(request)
+  } catch {
+    return false // fail closed: published content, never someone else's drafts
+  }
+}
+
 export function createOnPageProxy(opts: OnPageProxyOptions): NextMiddleware {
   if (!opts.secret)
     console.warn(

package/src/session.ts

@@ -4,9 +4,12 @@
  * Editors: Next draft mode plus an `onpage` cookie saying which mode, bound to
  * a hash of their auth cookie, so signing out (or in as someone else) ends it.
  *
- * Preview links: the browser gets only a sealed grant (`onpage_preview`). The
- * proxy (./proxy) unseals it and injects draft mode into the request for the
- * shared page only. The raw Next.js draft secret never reaches the browser.
+ * Preview links: the browser gets a sealed grant (`onpage_preview`). The proxy
+ * (./proxy) unseals it and injects draft mode into the request for the shared
+ * page only. With `cdnBypass` (default on Vercel), the browser also gets Next's
+ * draft cookie scoped to that page's path and the link's expiry: Vercel's cache
+ * decides bypass from the browser's own cookies, before any proxy runs. The
+ * proxy refuses that cookie everywhere the grant doesn't cover.
  *
  * All helpers read `draftMode().isEnabled` first and touch cookies only when
  * draft mode is on. Next exempts that read from prerender bailout, so pages
@@ -16,16 +19,23 @@ import {
   CONTEXT_KEY,
   COOKIE,
   HEADER,
-  isOnPageMode,
-  sha256,
   type OnPageMode,
   type SessionAdapter,
 } from '@payload-onpage/core'
 import { cookies, draftMode, headers } from 'next/headers.js'
+import { fingerprint, readModeCookie } from './binding.ts'
 
 export interface NextSessionOptions {
   /** How long an editor's edit/preview mode lasts, in seconds. Default 12 hours. */
   maxAge?: number
+  /**
+   * Give preview-link viewers Next's draft cookie, scoped to the shared page's
+   * path and expiring with the link, so a CDN that serves cached pages unless
+   * the browser itself sends the draft cookie (Vercel) shows them the draft.
+   * Requires the proxy (`withOnPage`), which strips it on every other page.
+   * Default: on when deployed on Vercel (`process.env.VERCEL`).
+   */
+  cdnBypass?: boolean
 }
 
 type Jar = Awaited<ReturnType<typeof cookies>>
@@ -47,29 +57,19 @@ async function inDraft<T>(read: () => Promise<T>, fallback: T): Promise<T> {
   }
 }
 
-const HASH_LENGTH = 32
-const fingerprint = async (token: string) => (await sha256(token)).slice(0, HASH_LENGTH)
-
 /** `edit` | `view`, or `<mode>:<authCookie>:<hash>` when bound to a session. */
 async function modeValue(mode: OnPageMode, jar: Jar, bindTo?: string): Promise<string> {
   const token = bindTo ? jar.get(bindTo)?.value : undefined
   return token ? `${mode}:${bindTo}:${await fingerprint(token)}` : mode
 }
 
-/** The mode a cookie value grants in this request, or null (unknown, or the bound session is gone). */
 async function readMode(raw: string | undefined, jar: Jar): Promise<OnPageMode | null> {
-  if (!raw) return null
-  const [mode, bound, hash] = raw.split(':')
-  if (!isOnPageMode(mode)) return null
-  if (bound) {
-    const token = jar.get(bound)?.value
-    if (!token || (await fingerprint(token)) !== hash) return null
-  }
-  return mode
+  return (await readModeCookie(raw, (name) => jar.get(name)?.value))?.mode ?? null
 }
 
 export function nextSession(opts: NextSessionOptions = {}): SessionAdapter {
   const maxAge = opts.maxAge ?? 12 * 3600
+  const cdnBypass = opts.cdnBypass ?? (typeof process !== 'undefined' && !!process.env.VERCEL)
   return {
     async enable(mode, { secure, bindTo }) {
       ;(await draftMode()).enable()
@@ -77,19 +77,29 @@ export function nextSession(opts: NextSessionOptions = {}): SessionAdapter {
       jar.set(COOKIE.mode, await modeValue(mode, jar, bindTo), { ...cookieBase(secure), maxAge })
       jar.delete(COOKIE.preview)
     },
-    async enableLink({ secure, path: _path, expiresAt, seal }) {
+    async enableLink({ secure, path, expiresAt, seal }) {
       ;(await draftMode()).enable()
       const jar = await cookies()
       const draft = jar.get(COOKIE.nextDraft)?.value
       if (!draft) throw new Error('payload-onpage: Next.js did not set its draft-mode cookie')
-      // Keep the draft secret server-side: the browser only gets the sealed grant.
-      jar.delete(COOKIE.nextDraft)
+      if (cdnBypass) {
+        // Replaces the site-wide cookie draftMode() just set: this page, this link's lifetime.
+        jar.set(COOKIE.nextDraft, draft, { ...cookieBase(secure), path, expires: expiresAt })
+      } else {
+        // Keep the draft secret server-side: the browser only gets the sealed grant.
+        jar.delete(COOKIE.nextDraft)
+      }
       jar.delete(COOKIE.mode)
       jar.set(COOKIE.preview, await seal(draft), { ...cookieBase(secure), expires: expiresAt })
     },
-    async disable() {
-      ;(await draftMode()).disable()
+    async disable({ path } = {}) {
       const jar = await cookies()
+      if (path && jar.get(COOKIE.preview)) {
+        // A preview-link viewer: their draft cookie, if any, is scoped to the shared page.
+        jar.set(COOKIE.nextDraft, '', { ...cookieBase(false), path, maxAge: 0 })
+      } else {
+        ;(await draftMode()).disable()
+      }
       jar.delete(COOKIE.mode)
       jar.delete(COOKIE.preview)
     },