@plitzi/sdk-server 0.35.7 → 0.35.8

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @plitzi/sdk-server
 
+## 0.35.8
+
+### Patch Changes
+
+- A space can switch the dev tools on for its own published site.
+
+  - **`settings.devTools`** in the space schema, set from the builder's Settings panel ("Dev tools on the published SSR
+    site (*.plitzi.app)"). It applies to sites served with SSR — usually a space's `*.plitzi.app` address, or a custom
+    domain pointed at it. A page server that left `debugMode` unset now authorizes debugging for a space that asked for it, as it
+    already did in `devMode`. A server that sets `debugMode` still decides for every space, and `false` cannot be
+    turned around by a space. Preview renders stay undebuggable either way.
+  - The space is read from the schema the server loaded, never from the request, and the visitor's cookie can still
+    only hide the panel.
+  - **The HTML cache keys whether a visitor hid the dev tools.** A cached page on a published environment used to be
+    keyed on the theme alone, so on a page authorizing dev tools the first visitor's choice — panel or no panel — was
+    served to everybody after them.
+
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.35.8
+  - @plitzi/sdk-shared@0.35.8
+
 ## 0.35.7
 
 ### Patch Changes

package/dist/helpers/cache/keys.d.ts

@@ -5,8 +5,13 @@
  * writes it onto `<html>` and into the props the SDK hydrates with. Keyed without it, the first visitor's choice was
  * served to everybody behind them — a dark page for a visitor who chose light, then corrected on hydration.
  *
- * Read from the request here rather than handed in, so a call site cannot key the page without it. Only the theme
- * cookie is read: keying the whole header would split the cache on every analytics cookie a visitor carries.
+ * So is whether the visitor hid the dev tools, on a page that authorizes them: the render leaves the panel out for
+ * them and in for everybody else. It is the only value of that cookie that changes what is drawn, so it is the only
+ * one keyed — a space that switched dev tools on for its published site would otherwise hand the first visitor's
+ * choice to the rest.
+ *
+ * Read from the request here rather than handed in, so a call site cannot key the page without it. Only those two
+ * cookies are read: keying the whole header would split the cache on every analytics cookie a visitor carries.
  */
 export declare const buildHtmlCacheKey: (accessToken: string | undefined, spaceId: number | string | null, environment: string, revision: number, req: {
     hostname: string;
@@ -14,6 +19,7 @@ export declare const buildHtmlCacheKey: (accessToken: string | undefined, spaceI
     search: string;
     headers: {
         cookie?: string;
+        host?: string;
     };
 }) => string;
 export declare const buildOfflineDataCacheKey: (spaceId: number, environment: string, revision: number) => string;

package/dist/helpers/cache/keys.js

@@ -1,3 +1,5 @@
+import { readCookie } from "../readCookie.js";
+import { debugCookieName } from "@plitzi/sdk-shared/devTools";
 import { themeFromCookies } from "@plitzi/sdk-shared/theme";
 //#region src/helpers/cache/keys.ts
 /**
@@ -7,10 +9,19 @@ import { themeFromCookies } from "@plitzi/sdk-shared/theme";
 * writes it onto `<html>` and into the props the SDK hydrates with. Keyed without it, the first visitor's choice was
 * served to everybody behind them — a dark page for a visitor who chose light, then corrected on hydration.
 *
-* Read from the request here rather than handed in, so a call site cannot key the page without it. Only the theme
-* cookie is read: keying the whole header would split the cache on every analytics cookie a visitor carries.
+* So is whether the visitor hid the dev tools, on a page that authorizes them: the render leaves the panel out for
+* them and in for everybody else. It is the only value of that cookie that changes what is drawn, so it is the only
+* one keyed — a space that switched dev tools on for its published site would otherwise hand the first visitor's
+* choice to the rest.
+*
+* Read from the request here rather than handed in, so a call site cannot key the page without it. Only those two
+* cookies are read: keying the whole header would split the cache on every analytics cookie a visitor carries.
 */
-var buildHtmlCacheKey = (accessToken = "anonymous", spaceId, environment, revision, req) => `${accessToken}\0${spaceId ?? 1}\0${environment}\0${revision}\0${themeFromCookies(req.headers.cookie) ?? ""}\0${req.hostname}\0${req.path}\0${req.search}`;
+var buildHtmlCacheKey = (accessToken = "anonymous", spaceId, environment, revision, req) => {
+	const theme = themeFromCookies(req.headers.cookie) ?? "";
+	const debugHidden = readCookie(req.headers.cookie, debugCookieName(req.headers.host)) === "false" ? "debug-off" : "";
+	return `${accessToken}\0${spaceId ?? 1}\0${environment}\0${revision}\0${theme}\0${debugHidden}\0${req.hostname}\0${req.path}\0${req.search}`;
+};
 var buildOfflineDataCacheKey = (spaceId, environment, revision) => `${spaceId}|${environment}|${revision}`;
 var buildRscCacheKey = (spaceId, environment, revision, userId, idsParam, req) => `${spaceId}\0${environment}\0${revision}\0${userId ?? "anon"}\0${idsParam ?? ""}\0${req.hostname}\0${req.path}\0${req.search}`;
 //#endregion

package/dist/modules/ssr/prepareRender.js

@@ -1,4 +1,5 @@
 import { matchRscPage } from "../rsc/matchRscPage.js";
+import { readCookie } from "../../helpers/readCookie.js";
 import { buildOfflineDataCacheKey } from "../../helpers/cache/keys.js";
 import { loadPluginComponents } from "./loadPluginComponents.js";
 import "../../core/previewToken.js";
@@ -9,11 +10,10 @@ import { resolvePageSeo } from "./resolvePageSeo.js";
 import { sdkAssetVersion } from "../../core/sdkAssets.js";
 import { buildServerInfo } from "../../helpers/buildServerInfo.js";
 import { escapeJson } from "../../helpers/escapeJson.js";
-import { readCookie } from "../../helpers/readCookie.js";
 import { resolveDebugMode } from "../../helpers/resolveDebugMode.js";
 import { hasServerElements } from "@plitzi/sdk-shared/schema/serverElements";
-import { themeFromCookies } from "@plitzi/sdk-shared/theme";
 import { debugCookieName } from "@plitzi/sdk-shared/devTools";
+import { themeFromCookies } from "@plitzi/sdk-shared/theme";
 import { fontUrlResolver, fontsToHead } from "@plitzi/sdk-shared/style";
 //#region src/modules/ssr/prepareRender.tsx
 /** Last resort only: used for a page that declares no SEO title and a deployment that supplies none either. */
@@ -59,8 +59,12 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 	*
 	* `debugRendered` is what this particular render draws, preference included. The client derives the same
 	* product from the same cookie on its first pass, so the markup it hydrates matches.
+	*
+	* Who may authorize it: the server first, through `debugMode`. When it said nothing, a development server does, and
+	* so does the space itself (`settings.devTools`) — an owner inspecting their own published site. The space is read
+	* from what this server loaded, never from the request, so a visitor has no say in it.
 	*/
-	const debugAuthorized = !Boolean(req.query["__pt"]) && Boolean(config.debugMode ?? config.devMode);
+	const debugAuthorized = !Boolean(req.query["__pt"]) && (config.debugMode ?? (config.devMode === true || schema?.settings.devTools === true));
 	const debugRendered = resolveDebugMode(debugAuthorized, readCookie(req.headers.cookie, debugCookieName(req.headers.host)));
 	const { degrade, analytics } = req.ctx.meter ?? {};
 	const clientAnalytics = analytics ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.35.7",
+  "version": "0.35.8",
   "license": "AGPL-3.0",
   "files": [
     "dist",
@@ -58,8 +58,8 @@
   "type": "module",
   "sideEffects": false,
   "dependencies": {
-    "@plitzi/plitzi-sdk": "0.35.7",
-    "@plitzi/sdk-shared": "0.35.7",
+    "@plitzi/plitzi-sdk": "0.35.8",
+    "@plitzi/sdk-shared": "0.35.8",
     "ejs": "^6.0.1",
     "esbuild": "^0.28.2",
     "jsonwebtoken": "^9.0.3",