@prismicio/next 2.3.4-pr.175.4cb686a → 2.3.4-pr.175.88bf097

package/dist/lib/getSafePath.cjs

@@ -1,10 +1,19 @@
 //#region src/lib/getSafePath.ts
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+* Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+* `location`, so it already includes `basePath`.
+*/
 function getSafePath(path) {
 	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) return;
 	const origin = "https://placeholder.invalid";
-	const url = new URL(path, origin);
-	if (url.origin === origin) return url.href.slice(27);
+	let url;
+	try {
+		url = new URL(path, origin);
+	} catch {
+		return;
+	}
+	const safePath = url.href.slice(27);
+	if (url.origin === origin && !safePath.startsWith("//")) return safePath;
 }
 //#endregion
 exports.getSafePath = getSafePath;

package/dist/lib/getSafePath.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"getSafePath.cjs","names":[],"sources":["../../src/lib/getSafePath.ts"],"sourcesContent":["/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */\nexport function getSafePath(path: string | null | undefined): string | undefined {\n\tif (!path?.startsWith(\"/\") || path.startsWith(\"//\") || path.startsWith(\"/\\\\\")) {\n\t\treturn\n\t}\n\n\tconst origin = \"https://placeholder.invalid\"\n\tconst url = new URL(path, origin)\n\tif (url.origin === origin) {\n\t\treturn url.href.slice(origin.length)\n\t}\n}\n"],"mappings":";;AACA,SAAgB,YAAY,MAAqD;CAChF,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,KAAK,GAC3E;CAGD,MAAM,SAAS;CACf,MAAM,MAAM,IAAI,IAAI,MAAM,MAAM;CAChC,IAAI,IAAI,WAAW,QAClB,OAAO,IAAI,KAAK,MAAM,EAAa;AAErC"}
+{"version":3,"file":"getSafePath.cjs","names":[],"sources":["../../src/lib/getSafePath.ts"],"sourcesContent":["/**\n * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from\n * `location`, so it already includes `basePath`.\n */\nexport function getSafePath(path: string | null | undefined): string | undefined {\n\tif (!path?.startsWith(\"/\") || path.startsWith(\"//\") || path.startsWith(\"/\\\\\")) {\n\t\treturn\n\t}\n\n\tconst origin = \"https://placeholder.invalid\"\n\tlet url: URL\n\ttry {\n\t\turl = new URL(path, origin)\n\t} catch {\n\t\treturn\n\t}\n\tconst safePath = url.href.slice(origin.length)\n\t// Normalizing can create `//`, like with `/.//example.com`.\n\tif (url.origin === origin && !safePath.startsWith(\"//\")) {\n\t\treturn safePath\n\t}\n}\n"],"mappings":";;;;;AAIA,SAAgB,YAAY,MAAqD;CAChF,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,KAAK,GAC3E;CAGD,MAAM,SAAS;CACf,IAAI;CACJ,IAAI;EACH,MAAM,IAAI,IAAI,MAAM,MAAM;CAC3B,QAAQ;EACP;CACD;CACA,MAAM,WAAW,IAAI,KAAK,MAAM,EAAa;CAE7C,IAAI,IAAI,WAAW,UAAU,CAAC,SAAS,WAAW,IAAI,GACrD,OAAO;AAET"}

package/dist/lib/getSafePath.js

@@ -1,10 +1,19 @@
 //#region src/lib/getSafePath.ts
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+* Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+* `location`, so it already includes `basePath`.
+*/
 function getSafePath(path) {
 	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) return;
 	const origin = "https://placeholder.invalid";
-	const url = new URL(path, origin);
-	if (url.origin === origin) return url.href.slice(27);
+	let url;
+	try {
+		url = new URL(path, origin);
+	} catch {
+		return;
+	}
+	const safePath = url.href.slice(27);
+	if (url.origin === origin && !safePath.startsWith("//")) return safePath;
 }
 //#endregion
 export { getSafePath };

package/dist/lib/getSafePath.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSafePath.js","names":[],"sources":["../../src/lib/getSafePath.ts"],"sourcesContent":["/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */\nexport function getSafePath(path: string | null | undefined): string | undefined {\n\tif (!path?.startsWith(\"/\") || path.startsWith(\"//\") || path.startsWith(\"/\\\\\")) {\n\t\treturn\n\t}\n\n\tconst origin = \"https://placeholder.invalid\"\n\tconst url = new URL(path, origin)\n\tif (url.origin === origin) {\n\t\treturn url.href.slice(origin.length)\n\t}\n}\n"],"mappings":";;AACA,SAAgB,YAAY,MAAqD;CAChF,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,KAAK,GAC3E;CAGD,MAAM,SAAS;CACf,MAAM,MAAM,IAAI,IAAI,MAAM,MAAM;CAChC,IAAI,IAAI,WAAW,QAClB,OAAO,IAAI,KAAK,MAAM,EAAa;AAErC"}
+{"version":3,"file":"getSafePath.js","names":[],"sources":["../../src/lib/getSafePath.ts"],"sourcesContent":["/**\n * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from\n * `location`, so it already includes `basePath`.\n */\nexport function getSafePath(path: string | null | undefined): string | undefined {\n\tif (!path?.startsWith(\"/\") || path.startsWith(\"//\") || path.startsWith(\"/\\\\\")) {\n\t\treturn\n\t}\n\n\tconst origin = \"https://placeholder.invalid\"\n\tlet url: URL\n\ttry {\n\t\turl = new URL(path, origin)\n\t} catch {\n\t\treturn\n\t}\n\tconst safePath = url.href.slice(origin.length)\n\t// Normalizing can create `//`, like with `/.//example.com`.\n\tif (url.origin === origin && !safePath.startsWith(\"//\")) {\n\t\treturn safePath\n\t}\n}\n"],"mappings":";;;;;AAIA,SAAgB,YAAY,MAAqD;CAChF,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,KAAK,GAC3E;CAGD,MAAM,SAAS;CACf,IAAI;CACJ,IAAI;EACH,MAAM,IAAI,IAAI,MAAM,MAAM;CAC3B,QAAQ;EACP;CACD;CACA,MAAM,WAAW,IAAI,KAAK,MAAM,EAAa;CAE7C,IAAI,IAAI,WAAW,UAAU,CAAC,SAAS,WAAW,IAAI,GACrD,OAAO;AAET"}

package/dist/package.cjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.3.4-pr.175.4cb686a";
+var version = "2.3.4-pr.175.88bf097";
 //#endregion
 Object.defineProperty(exports, "version", {
 	enumerable: true,

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.3.4-pr.175.4cb686a";
+var version = "2.3.4-pr.175.88bf097";
 //#endregion
 export { version };
 

package/dist/pages/redirectToPreviewURL.cjs

@@ -6,7 +6,10 @@ async function redirectToPreviewURL(config) {
 	const { client, req, res, linkResolver, defaultURL = "/", basePath = "" } = config;
 	const previewToken = req.query.token?.toString();
 	const session = req.query.session?.toString();
-	if (session) require_appendCookie.appendCookie(res, `${_prismicio_client.cookie.previewSession}=${encodeURIComponent(session)}`);
+	if (session) {
+		require_appendCookie.appendCookie(res, `${_prismicio_client.cookie.previewSession}=${encodeURIComponent(session)}`);
+		if (previewToken) require_appendCookie.appendCookie(res, `${_prismicio_client.cookie.preview}=${encodeURIComponent(previewToken)}`);
+	}
 	const path = require_getSafePath.getSafePath(req.query.path?.toString());
 	if (path) {
 		res.redirect(path);

package/dist/pages/redirectToPreviewURL.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"redirectToPreviewURL.cjs","names":["prismicCookie","getSafePath"],"sources":["../../src/pages/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type LinkResolverFunction, type Client } from \"@prismicio/client\"\n\nimport { getSafePath } from \"../lib/getSafePath\"\nimport { appendCookie } from \"./appendCookie\"\nimport type { NextApiRequestLike, NextApiResponseLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `req` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\treq: NextApiRequestLike\n\n\t/**\n\t * The `res` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\tres: NextApiResponseLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n\n\t/**\n\t * The `basePath` for the Next.js app as it is defined in `next.config.js`. This option can be\n\t * omitted if the app does not have a `basePath`.\n\t *\n\t * @remarks\n\t *   The Router Handler or API route is unable to detect the app's `basePath` automatically. It\n\t *   must be provided to `redirectToPreviewURL()` manually.\n\t */\n\tbasePath?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<void> {\n\tconst { client, req, res, linkResolver, defaultURL = \"/\", basePath = \"\" } = config\n\n\tconst previewToken = req.query.token?.toString()\n\n\t// The toolbar's v5 flow follows this session.\n\tconst session = req.query.session?.toString()\n\tif (session) {\n\t\tappendCookie(res, `${prismicCookie.previewSession}=${encodeURIComponent(session)}`)\n\t}\n\n\t// Share links return to the page they were opened from. Its path includes `basePath`.\n\tconst path = getSafePath(req.query.path?.toString())\n\tif (path) {\n\t\tres.redirect(path)\n\n\t\treturn\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tlinkResolver,\n\t\tdefaultURL,\n\t\tpreviewToken,\n\t})\n\n\tres.redirect(basePath + previewURL)\n\n\treturn\n}\n"],"mappings":";;;;AAqDA,eAAsB,qBAAqB,QAAmD;CAC7F,MAAM,EAAE,QAAQ,KAAK,KAAK,cAAc,aAAa,KAAK,WAAW,OAAO;CAE5E,MAAM,eAAe,IAAI,MAAM,OAAO,SAAS;CAG/C,MAAM,UAAU,IAAI,MAAM,SAAS,SAAS;CAC5C,IAAI,SACH,qBAAA,aAAa,KAAK,GAAGA,kBAAAA,OAAc,eAAe,GAAG,mBAAmB,OAAO,GAAG;CAInF,MAAM,OAAOC,oBAAAA,YAAY,IAAI,MAAM,MAAM,SAAS,CAAC;CACnD,IAAI,MAAM;EACT,IAAI,SAAS,IAAI;EAEjB;CACD;CAEA,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;CACD,CAAC;CAED,IAAI,SAAS,WAAW,UAAU;AAGnC"}
+{"version":3,"file":"redirectToPreviewURL.cjs","names":["prismicCookie","getSafePath"],"sources":["../../src/pages/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type LinkResolverFunction, type Client } from \"@prismicio/client\"\n\nimport { getSafePath } from \"../lib/getSafePath\"\nimport { appendCookie } from \"./appendCookie\"\nimport type { NextApiRequestLike, NextApiResponseLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `req` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\treq: NextApiRequestLike\n\n\t/**\n\t * The `res` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\tres: NextApiResponseLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n\n\t/**\n\t * The `basePath` for the Next.js app as it is defined in `next.config.js`. This option can be\n\t * omitted if the app does not have a `basePath`.\n\t *\n\t * @remarks\n\t *   The Router Handler or API route is unable to detect the app's `basePath` automatically. It\n\t *   must be provided to `redirectToPreviewURL()` manually.\n\t */\n\tbasePath?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<void> {\n\tconst { client, req, res, linkResolver, defaultURL = \"/\", basePath = \"\" } = config\n\n\tconst previewToken = req.query.token?.toString()\n\n\t// The toolbar's v5 flow follows this session from the ref the page shows. Without that ref, its\n\t// first ping would start the preview again, racing an early exit.\n\tconst session = req.query.session?.toString()\n\tif (session) {\n\t\tappendCookie(res, `${prismicCookie.previewSession}=${encodeURIComponent(session)}`)\n\t\tif (previewToken) {\n\t\t\tappendCookie(res, `${prismicCookie.preview}=${encodeURIComponent(previewToken)}`)\n\t\t}\n\t}\n\n\t// Share links return to the page they were opened from.\n\tconst path = getSafePath(req.query.path?.toString())\n\tif (path) {\n\t\tres.redirect(path)\n\n\t\treturn\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tlinkResolver,\n\t\tdefaultURL,\n\t\tpreviewToken,\n\t})\n\n\tres.redirect(basePath + previewURL)\n\n\treturn\n}\n"],"mappings":";;;;AAqDA,eAAsB,qBAAqB,QAAmD;CAC7F,MAAM,EAAE,QAAQ,KAAK,KAAK,cAAc,aAAa,KAAK,WAAW,OAAO;CAE5E,MAAM,eAAe,IAAI,MAAM,OAAO,SAAS;CAI/C,MAAM,UAAU,IAAI,MAAM,SAAS,SAAS;CAC5C,IAAI,SAAS;EACZ,qBAAA,aAAa,KAAK,GAAGA,kBAAAA,OAAc,eAAe,GAAG,mBAAmB,OAAO,GAAG;EAClF,IAAI,cACH,qBAAA,aAAa,KAAK,GAAGA,kBAAAA,OAAc,QAAQ,GAAG,mBAAmB,YAAY,GAAG;CAElF;CAGA,MAAM,OAAOC,oBAAAA,YAAY,IAAI,MAAM,MAAM,SAAS,CAAC;CACnD,IAAI,MAAM;EACT,IAAI,SAAS,IAAI;EAEjB;CACD;CAEA,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;CACD,CAAC;CAED,IAAI,SAAS,WAAW,UAAU;AAGnC"}

package/dist/pages/redirectToPreviewURL.js

@@ -6,7 +6,10 @@ async function redirectToPreviewURL(config) {
 	const { client, req, res, linkResolver, defaultURL = "/", basePath = "" } = config;
 	const previewToken = req.query.token?.toString();
 	const session = req.query.session?.toString();
-	if (session) appendCookie(res, `${cookie.previewSession}=${encodeURIComponent(session)}`);
+	if (session) {
+		appendCookie(res, `${cookie.previewSession}=${encodeURIComponent(session)}`);
+		if (previewToken) appendCookie(res, `${cookie.preview}=${encodeURIComponent(previewToken)}`);
+	}
 	const path = getSafePath(req.query.path?.toString());
 	if (path) {
 		res.redirect(path);

package/dist/pages/redirectToPreviewURL.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirectToPreviewURL.js","names":["prismicCookie"],"sources":["../../src/pages/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type LinkResolverFunction, type Client } from \"@prismicio/client\"\n\nimport { getSafePath } from \"../lib/getSafePath\"\nimport { appendCookie } from \"./appendCookie\"\nimport type { NextApiRequestLike, NextApiResponseLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `req` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\treq: NextApiRequestLike\n\n\t/**\n\t * The `res` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\tres: NextApiResponseLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n\n\t/**\n\t * The `basePath` for the Next.js app as it is defined in `next.config.js`. This option can be\n\t * omitted if the app does not have a `basePath`.\n\t *\n\t * @remarks\n\t *   The Router Handler or API route is unable to detect the app's `basePath` automatically. It\n\t *   must be provided to `redirectToPreviewURL()` manually.\n\t */\n\tbasePath?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<void> {\n\tconst { client, req, res, linkResolver, defaultURL = \"/\", basePath = \"\" } = config\n\n\tconst previewToken = req.query.token?.toString()\n\n\t// The toolbar's v5 flow follows this session.\n\tconst session = req.query.session?.toString()\n\tif (session) {\n\t\tappendCookie(res, `${prismicCookie.previewSession}=${encodeURIComponent(session)}`)\n\t}\n\n\t// Share links return to the page they were opened from. Its path includes `basePath`.\n\tconst path = getSafePath(req.query.path?.toString())\n\tif (path) {\n\t\tres.redirect(path)\n\n\t\treturn\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tlinkResolver,\n\t\tdefaultURL,\n\t\tpreviewToken,\n\t})\n\n\tres.redirect(basePath + previewURL)\n\n\treturn\n}\n"],"mappings":";;;;AAqDA,eAAsB,qBAAqB,QAAmD;CAC7F,MAAM,EAAE,QAAQ,KAAK,KAAK,cAAc,aAAa,KAAK,WAAW,OAAO;CAE5E,MAAM,eAAe,IAAI,MAAM,OAAO,SAAS;CAG/C,MAAM,UAAU,IAAI,MAAM,SAAS,SAAS;CAC5C,IAAI,SACH,aAAa,KAAK,GAAGA,OAAc,eAAe,GAAG,mBAAmB,OAAO,GAAG;CAInF,MAAM,OAAO,YAAY,IAAI,MAAM,MAAM,SAAS,CAAC;CACnD,IAAI,MAAM;EACT,IAAI,SAAS,IAAI;EAEjB;CACD;CAEA,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;CACD,CAAC;CAED,IAAI,SAAS,WAAW,UAAU;AAGnC"}
+{"version":3,"file":"redirectToPreviewURL.js","names":["prismicCookie"],"sources":["../../src/pages/redirectToPreviewURL.ts"],"sourcesContent":["import { cookie as prismicCookie, type LinkResolverFunction, type Client } from \"@prismicio/client\"\n\nimport { getSafePath } from \"../lib/getSafePath\"\nimport { appendCookie } from \"./appendCookie\"\nimport type { NextApiRequestLike, NextApiResponseLike } from \"./types\"\n\nexport type RedirectToPreviewURLConfig = {\n\t/** The Prismic client configured for the preview session's repository. */\n\t// `Pick` is used to use the smallest possible subset of\n\t// `prismic.Client`. Doing this reduces the surface area for breaking\n\t// type changes.\n\tclient: Pick<Client, \"resolvePreviewURL\">\n\n\t/**\n\t * The `req` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\treq: NextApiRequestLike\n\n\t/**\n\t * The `res` object from a Next.js API route.\n\t *\n\t * @see Next.js API route docs: \\<https://nextjs.org/docs/pages/building-your-application/routing/api-routes\\>\n\t */\n\tres: NextApiResponseLike\n\n\t/**\n\t * A Link Resolver used to resolve the previewed document's URL.\n\t *\n\t * @see To learn more about Link Resolver: {@link https://prismic.io/docs/core-concepts/link-resolver-route-resolver}\n\t */\n\tlinkResolver?: LinkResolverFunction\n\n\t/**\n\t * The default redirect URL if a URL cannot be determined for the previewed document.\n\t *\n\t * **Note**: If you `next.config.js` file contains a `basePath`, the `defaultURL` option must\n\t * _not_ include it. Instead, provide the `basePath` property using the `basePath` option.\n\t */\n\tdefaultURL?: string\n\n\t/**\n\t * The `basePath` for the Next.js app as it is defined in `next.config.js`. This option can be\n\t * omitted if the app does not have a `basePath`.\n\t *\n\t * @remarks\n\t *   The Router Handler or API route is unable to detect the app's `basePath` automatically. It\n\t *   must be provided to `redirectToPreviewURL()` manually.\n\t */\n\tbasePath?: string\n}\n\nexport async function redirectToPreviewURL(config: RedirectToPreviewURLConfig): Promise<void> {\n\tconst { client, req, res, linkResolver, defaultURL = \"/\", basePath = \"\" } = config\n\n\tconst previewToken = req.query.token?.toString()\n\n\t// The toolbar's v5 flow follows this session from the ref the page shows. Without that ref, its\n\t// first ping would start the preview again, racing an early exit.\n\tconst session = req.query.session?.toString()\n\tif (session) {\n\t\tappendCookie(res, `${prismicCookie.previewSession}=${encodeURIComponent(session)}`)\n\t\tif (previewToken) {\n\t\t\tappendCookie(res, `${prismicCookie.preview}=${encodeURIComponent(previewToken)}`)\n\t\t}\n\t}\n\n\t// Share links return to the page they were opened from.\n\tconst path = getSafePath(req.query.path?.toString())\n\tif (path) {\n\t\tres.redirect(path)\n\n\t\treturn\n\t}\n\n\tconst previewURL = await client.resolvePreviewURL({\n\t\tlinkResolver,\n\t\tdefaultURL,\n\t\tpreviewToken,\n\t})\n\n\tres.redirect(basePath + previewURL)\n\n\treturn\n}\n"],"mappings":";;;;AAqDA,eAAsB,qBAAqB,QAAmD;CAC7F,MAAM,EAAE,QAAQ,KAAK,KAAK,cAAc,aAAa,KAAK,WAAW,OAAO;CAE5E,MAAM,eAAe,IAAI,MAAM,OAAO,SAAS;CAI/C,MAAM,UAAU,IAAI,MAAM,SAAS,SAAS;CAC5C,IAAI,SAAS;EACZ,aAAa,KAAK,GAAGA,OAAc,eAAe,GAAG,mBAAmB,OAAO,GAAG;EAClF,IAAI,cACH,aAAa,KAAK,GAAGA,OAAc,QAAQ,GAAG,mBAAmB,YAAY,GAAG;CAElF;CAGA,MAAM,OAAO,YAAY,IAAI,MAAM,MAAM,SAAS,CAAC;CACnD,IAAI,MAAM;EACT,IAAI,SAAS,IAAI;EAEjB;CACD;CAEA,MAAM,aAAa,MAAM,OAAO,kBAAkB;EACjD;EACA;EACA;CACD,CAAC;CAED,IAAI,SAAS,WAAW,UAAU;AAGnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/next",
-	"version": "2.3.4-pr.175.4cb686a",
+	"version": "2.3.4-pr.175.88bf097",
 	"description": "Helpers to integrate Prismic into Next.js apps",
 	"keywords": [
 		"next",

package/src/lib/getSafePath.ts

@@ -1,12 +1,22 @@
-/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `basePath`.
+ */
 export function getSafePath(path: string | null | undefined): string | undefined {
 	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
 		return
 	}
 
 	const origin = "https://placeholder.invalid"
-	const url = new URL(path, origin)
-	if (url.origin === origin) {
-		return url.href.slice(origin.length)
+	let url: URL
+	try {
+		url = new URL(path, origin)
+	} catch {
+		return
+	}
+	const safePath = url.href.slice(origin.length)
+	// Normalizing can create `//`, like with `/.//example.com`.
+	if (url.origin === origin && !safePath.startsWith("//")) {
+		return safePath
 	}
 }

package/src/pages/redirectToPreviewURL.ts

@@ -56,13 +56,17 @@ export async function redirectToPreviewURL(config: RedirectToPreviewURLConfig):
 
 	const previewToken = req.query.token?.toString()
 
-	// The toolbar's v5 flow follows this session.
+	// The toolbar's v5 flow follows this session from the ref the page shows. Without that ref, its
+	// first ping would start the preview again, racing an early exit.
 	const session = req.query.session?.toString()
 	if (session) {
 		appendCookie(res, `${prismicCookie.previewSession}=${encodeURIComponent(session)}`)
+		if (previewToken) {
+			appendCookie(res, `${prismicCookie.preview}=${encodeURIComponent(previewToken)}`)
+		}
 	}
 
-	// Share links return to the page they were opened from. Its path includes `basePath`.
+	// Share links return to the page they were opened from.
 	const path = getSafePath(req.query.path?.toString())
 	if (path) {
 		res.redirect(path)