@prismicio/svelte 3.1.0-canary.dc5542e → 3.1.0-pr.71.2f3ecf2

package/dist/kit/PrismicPreview.svelte

@@ -23,7 +23,7 @@
 
 	const { repositoryName, routePrefix = "preview", routePrefixName = routePrefix }: Props = $props()
 
-	const toolbarSrc = $derived(getToolbarSrc(repositoryName))
+	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
 
 	/** Set to `true` when the next `beforeNavigate()` call should not prefix the route. */
 	let endingPreview = $state(false)

package/dist/kit/redirectToPreviewURL.js

@@ -1,4 +1,5 @@
 import * as prismic from "@prismicio/client";
+import { getSafePath } from "../lib/getSafePath";
 /**
  * Redirects a visitor to the URL of a previewed Prismic document from within a SvelteKit `+server`
  * file.
@@ -21,11 +22,15 @@ export const redirectToPreviewURL = async (config) => {
     const previewToken = new URL(config.request.url).searchParams.get("token") ?? undefined;
     const documentID = new URL(config.request.url).searchParams.get("documentId") ?? undefined;
     const routePrefix = config.routePrefix ?? "preview";
-    const previewURL = await config.client.resolvePreviewURL({
-        previewToken,
-        documentID,
-        defaultURL: config.defaultURL || "/",
-    });
+    // Toolbar share links carry the shared page's `path`.
+    const location = getSafePath(new URL(config.request.url).searchParams.get("path")) ??
+        "/" +
+            routePrefix +
+            (await config.client.resolvePreviewURL({
+                previewToken,
+                documentID,
+                defaultURL: config.defaultURL || "/",
+            }));
     // Prevent a flash of non-preview content by setting the preview token
     // on the initial page load.
     if (previewToken) {
@@ -34,10 +39,18 @@ export const redirectToPreviewURL = async (config) => {
             httpOnly: false,
         });
     }
+    // The toolbar's `v=5` flow follows the preview session with this cookie.
+    const session = new URL(config.request.url).searchParams.get("session");
+    if (session) {
+        config.cookies.set(prismic.cookie.previewSession, session, {
+            path: "/",
+            httpOnly: false,
+        });
+    }
     return new Response(undefined, {
         status: 307,
         headers: {
-            Location: "/" + routePrefix + previewURL,
+            Location: location,
         },
     });
 };

package/dist/lib/getSafePath.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
+export declare function getSafePath(path: string | null | undefined): string | undefined;

package/dist/lib/getSafePath.js

@@ -0,0 +1,22 @@
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
+export function getSafePath(path) {
+    if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+        return;
+    }
+    const origin = "https://placeholder.invalid";
+    let url;
+    try {
+        url = new URL(path, origin);
+    }
+    catch {
+        return;
+    }
+    const safePath = url.href.slice(origin.length);
+    // Normalizing can create `//`, like with `/.//example.com`.
+    if (url.origin === origin && !safePath.startsWith("//")) {
+        return safePath;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prismicio/svelte",
-	"version": "3.1.0-canary.dc5542e",
+	"version": "3.1.0-pr.71.2f3ecf2",
 	"description": "Svelte components to present Prismic content.",
 	"keywords": [
 		"prismic",
@@ -62,7 +62,7 @@
 		"esm-env": "^1.2.2"
 	},
 	"devDependencies": {
-		"@prismicio/client": "^7.22.3",
+		"@prismicio/client": "^7.23.0",
 		"@prismicio/mock": "^0.7.2",
 		"@sveltejs/kit": "^3.1.0",
 		"@sveltejs/package": "^3.0.1",
@@ -80,7 +80,7 @@
 		"vitest": "^5.0.5"
 	},
 	"peerDependencies": {
-		"@prismicio/client": ">=7",
+		"@prismicio/client": "^7.23.0",
 		"@sveltejs/kit": "^3.0.0",
 		"svelte": "^5.16.0"
 	},

package/src/kit/PrismicPreview.svelte

@@ -23,7 +23,7 @@
 
 	const { repositoryName, routePrefix = "preview", routePrefixName = routePrefix }: Props = $props()
 
-	const toolbarSrc = $derived(getToolbarSrc(repositoryName))
+	const toolbarSrc = $derived(getToolbarSrc(repositoryName, { version: 5 }))
 
 	/** Set to `true` when the next `beforeNavigate()` call should not prefix the route. */
 	let endingPreview = $state(false)

package/src/kit/redirectToPreviewURL.ts

@@ -1,6 +1,8 @@
 import * as prismic from "@prismicio/client"
 import type { Cookies } from "@sveltejs/kit"
 
+import { getSafePath } from "../lib/getSafePath"
+
 export type RedirectToPreviewURLConfig = {
 	/** The Prismic client configured for the preview session's repository. */
 	// `Pick` is used to use the smallest possible subset of
@@ -54,11 +56,16 @@ export const redirectToPreviewURL = async (
 	const documentID = new URL(config.request.url).searchParams.get("documentId") ?? undefined
 	const routePrefix = config.routePrefix ?? "preview"
 
-	const previewURL = await config.client.resolvePreviewURL({
-		previewToken,
-		documentID,
-		defaultURL: config.defaultURL || "/",
-	})
+	// Toolbar share links carry the shared page's `path`.
+	const location =
+		getSafePath(new URL(config.request.url).searchParams.get("path")) ??
+		"/" +
+			routePrefix +
+			(await config.client.resolvePreviewURL({
+				previewToken,
+				documentID,
+				defaultURL: config.defaultURL || "/",
+			}))
 
 	// Prevent a flash of non-preview content by setting the preview token
 	// on the initial page load.
@@ -69,10 +76,19 @@ export const redirectToPreviewURL = async (
 		})
 	}
 
+	// The toolbar's `v=5` flow follows the preview session with this cookie.
+	const session = new URL(config.request.url).searchParams.get("session")
+	if (session) {
+		config.cookies.set(prismic.cookie.previewSession, session, {
+			path: "/",
+			httpOnly: false,
+		})
+	}
+
 	return new Response(undefined, {
 		status: 307,
 		headers: {
-			Location: "/" + routePrefix + previewURL,
+			Location: location,
 		},
 	})
 }

package/src/lib/getSafePath.ts

@@ -0,0 +1,22 @@
+/**
+ * Returns `path` if it stays on the current origin, like `/blog?page=2#top`. It comes from
+ * `location`, so it already includes `paths.base`.
+ */
+export function getSafePath(path: string | null | undefined): string | undefined {
+	if (!path?.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) {
+		return
+	}
+
+	const origin = "https://placeholder.invalid"
+	let url: URL
+	try {
+		url = new URL(path, origin)
+	} catch {
+		return
+	}
+	const safePath = url.href.slice(origin.length)
+	// Normalizing can create `//`, like with `/.//example.com`.
+	if (url.origin === origin && !safePath.startsWith("//")) {
+		return safePath
+	}
+}