@prismicio/svelte 3.0.0-pr.71.0f237fd → 3.0.0-pr.71.35fb12f

package/dist/kit/PrismicPreview.svelte

@@ -19,9 +19,20 @@
 		 * Only set this value if the route parameter's name differs from the parameter's value.
 		 */
 		routePrefixName?: string
+
+		/**
+		 * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
+		 * share links, and hides its Share button without it.
+		 */
+		previewURL?: string
 	}
 
-	const { repositoryName, routePrefix = "preview", routePrefixName = routePrefix }: Props = $props()
+	const {
+		repositoryName,
+		routePrefix = "preview",
+		routePrefixName = routePrefix,
+		previewURL,
+	}: Props = $props()
 
 	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
 
@@ -89,5 +100,5 @@
 </script>
 
 <svelte:head>
-	<script defer src={toolbarSrc}></script>
+	<script defer src={toolbarSrc} data-preview-url={previewURL}></script>
 </svelte:head>

package/dist/kit/PrismicPreview.svelte.d.ts

@@ -12,6 +12,11 @@ type Props = {
      * Only set this value if the route parameter's name differs from the parameter's value.
      */
     routePrefixName?: string;
+    /**
+     * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
+     * share links, and hides its Share button without it.
+     */
+    previewURL?: string;
 };
 declare const PrismicPreview: import("svelte").Component<Props, {}, "">;
 type PrismicPreview = ReturnType<typeof PrismicPreview>;

package/dist/kit/redirectToPreviewURL.js

@@ -1,4 +1,6 @@
+import { resolve } from "$app/paths";
 import * as prismic from "@prismicio/client";
+import { getSafePath } from "../lib/getSafePath";
 /**
  * Redirects a visitor to the URL of a previewed Prismic document from within a SvelteKit `+server`
  * file.
@@ -21,11 +23,14 @@ export const redirectToPreviewURL = async (config) => {
     const previewToken = new URL(config.request.url).searchParams.get("token") ?? undefined;
     const documentID = new URL(config.request.url).searchParams.get("documentId") ?? undefined;
     const routePrefix = config.routePrefix ?? "preview";
-    const previewURL = await config.client.resolvePreviewURL({
-        previewToken,
-        documentID,
-        defaultURL: config.defaultURL || "/",
-    });
+    const location = getSharedPath(config.request.url, routePrefix) ??
+        "/" +
+            routePrefix +
+            (await config.client.resolvePreviewURL({
+                previewToken,
+                documentID,
+                defaultURL: config.defaultURL || "/",
+            }));
     // Prevent a flash of non-preview content by setting the preview token
     // on the initial page load.
     if (previewToken) {
@@ -45,7 +50,22 @@ export const redirectToPreviewURL = async (config) => {
     return new Response(undefined, {
         status: 307,
         headers: {
-            Location: "/" + routePrefix + previewURL,
+            Location: location,
         },
     });
 };
+/**
+ * Returns the `path` param of toolbar share links inside the preview route prefix, or `undefined`
+ * if it is missing or not a path on this website.
+ */
+const getSharedPath = (requestURL, routePrefix) => {
+    const path = getSafePath(new URL(requestURL).searchParams.get("path"));
+    // `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
+    // either absolute or relative to the request.
+    const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1);
+    if (!path?.startsWith(`${base}/`)) {
+        return;
+    }
+    const pathname = path.slice(base.length);
+    return pathname.split(/[/?#]/)[1] === routePrefix ? path : `${base}/${routePrefix}${pathname}`;
+};

package/dist/lib/getSafePath.d.ts

@@ -0,0 +1,2 @@
+/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+export declare function getSafePath(path: string | null | undefined): string | undefined;

package/dist/lib/getSafePath.js

@@ -0,0 +1,11 @@
+/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+export function getSafePath(path) {
+    if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+        return;
+    }
+    const origin = "https://placeholder.invalid";
+    const url = new URL(path, origin);
+    if (url.origin === origin) {
+        return url.href.slice(origin.length);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/svelte",
-	"version": "3.0.0-pr.71.0f237fd",
+	"version": "3.0.0-pr.71.35fb12f",
 	"description": "Svelte components to present Prismic content.",
 	"keywords": [
 		"prismic",
@@ -72,8 +72,8 @@
 		"@vitest/coverage-v8": "^5.0.5",
 		"globals": "^17.13.0",
 		"happy-dom": "^21.0.3",
-		"oxfmt": "^0.73.0",
-		"oxlint": "^1.88.0",
+		"oxfmt": "^0.74.0",
+		"oxlint": "^1.89.0",
 		"standard-version": "^9.5.0",
 		"svelte": "^5.57.2",
 		"typescript": "^6.0.3",

package/src/kit/PrismicPreview.svelte

@@ -19,9 +19,20 @@
 		 * Only set this value if the route parameter's name differs from the parameter's value.
 		 */
 		routePrefixName?: string
+
+		/**
+		 * The URL of your preview route, such as `/api/preview`. The Prismic Toolbar uses it to create
+		 * share links, and hides its Share button without it.
+		 */
+		previewURL?: string
 	}
 
-	const { repositoryName, routePrefix = "preview", routePrefixName = routePrefix }: Props = $props()
+	const {
+		repositoryName,
+		routePrefix = "preview",
+		routePrefixName = routePrefix,
+		previewURL,
+	}: Props = $props()
 
 	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
 
@@ -89,5 +100,5 @@
 </script>
 
 <svelte:head>
-	<script defer src={toolbarSrc}></script>
+	<script defer src={toolbarSrc} data-preview-url={previewURL}></script>
 </svelte:head>

package/src/kit/redirectToPreviewURL.ts

@@ -1,6 +1,9 @@
+import { resolve } from "$app/paths"
 import * as prismic from "@prismicio/client"
 import type { Cookies } from "@sveltejs/kit"
 
+import { getSafePath } from "../lib/getSafePath"
+
 export type RedirectToPreviewURLConfig = {
 	/** The Prismic client configured for the preview session's repository. */
 	// `Pick` is used to use the smallest possible subset of
@@ -54,11 +57,15 @@ export const redirectToPreviewURL = async (
 	const documentID = new URL(config.request.url).searchParams.get("documentId") ?? undefined
 	const routePrefix = config.routePrefix ?? "preview"
 
-	const previewURL = await config.client.resolvePreviewURL({
-		previewToken,
-		documentID,
-		defaultURL: config.defaultURL || "/",
-	})
+	const location =
+		getSharedPath(config.request.url, routePrefix) ??
+		"/" +
+			routePrefix +
+			(await config.client.resolvePreviewURL({
+				previewToken,
+				documentID,
+				defaultURL: config.defaultURL || "/",
+			}))
 
 	// Prevent a flash of non-preview content by setting the preview token
 	// on the initial page load.
@@ -81,7 +88,25 @@ export const redirectToPreviewURL = async (
 	return new Response(undefined, {
 		status: 307,
 		headers: {
-			Location: "/" + routePrefix + previewURL,
+			Location: location,
 		},
 	})
 }
+
+/**
+ * Returns the `path` param of toolbar share links inside the preview route prefix, or `undefined`
+ * if it is missing or not a path on this website.
+ */
+const getSharedPath = (requestURL: string, routePrefix: string): string | undefined => {
+	const path = getSafePath(new URL(requestURL).searchParams.get("path"))
+	// `path` comes from the browser, so it already includes `paths.base`. `resolve()` returns `base`
+	// either absolute or relative to the request.
+	const base = new URL(resolve("/", {}), requestURL).pathname.slice(0, -1)
+	if (!path?.startsWith(`${base}/`)) {
+		return
+	}
+
+	const pathname = path.slice(base.length)
+
+	return pathname.split(/[/?#]/)[1] === routePrefix ? path : `${base}/${routePrefix}${pathname}`
+}

package/src/lib/getSafePath.ts

@@ -0,0 +1,12 @@
+/** Returns `path` if it stays on the current origin, like `/blog?page=2#top`. */
+export function getSafePath(path: string | null | undefined): string | undefined {
+	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+		return
+	}
+
+	const origin = "https://placeholder.invalid"
+	const url = new URL(path, origin)
+	if (url.origin === origin) {
+		return url.href.slice(origin.length)
+	}
+}