@sitecore-jss/sitecore-jss-nextjs 22.1.0-canary.2 → 22.1.0-canary.23

package/dist/cjs/components/Link.js

@@ -43,7 +43,7 @@ const prop_types_1 = __importDefault(require("prop-types"));
 const link_1 = __importDefault(require("next/link"));
 const sitecore_jss_react_1 = require("@sitecore-jss/sitecore-jss-react");
 exports.Link = (0, react_1.forwardRef)((props, ref) => {
-    const { field, editable, children, internalLinkMatcher = /^\//g, showLinkTextWithChildrenPresent } = props, htmlLinkProps = __rest(props, ["field", "editable", "children", "internalLinkMatcher", "showLinkTextWithChildrenPresent"]);
+    const { field, editable = true, children, internalLinkMatcher = /^\//g, showLinkTextWithChildrenPresent } = props, htmlLinkProps = __rest(props, ["field", "editable", "children", "internalLinkMatcher", "showLinkTextWithChildrenPresent"]);
     if (!field ||
         (!field.editable && !field.value && !field.href)) {
         return null;
@@ -52,7 +52,7 @@ exports.Link = (0, react_1.forwardRef)((props, ref) => {
         ? field
         : field.value);
     const { href, querystring, anchor } = value;
-    const isEditing = editable && field.editable;
+    const isEditing = editable && (field.editable || field.metadata);
     if (href && !isEditing) {
         const text = showLinkTextWithChildrenPresent || !children ? value.text || value.href : null;
         // determine if a link is a route or not.
@@ -67,8 +67,5 @@ exports.Link = (0, react_1.forwardRef)((props, ref) => {
     delete reactLinkProps.internalLinkMatcher;
     return react_1.default.createElement(sitecore_jss_react_1.Link, Object.assign({}, reactLinkProps, { ref: ref }));
 });
-exports.Link.defaultProps = {
-    editable: true,
-};
 exports.Link.displayName = 'NextLink';
 exports.Link.propTypes = Object.assign({ internalLinkMatcher: prop_types_1.default.instanceOf(RegExp) }, sitecore_jss_react_1.LinkPropTypes);

package/dist/cjs/components/NextImage.js

@@ -20,8 +20,8 @@ const prop_types_1 = __importDefault(require("prop-types"));
 const react_1 = __importDefault(require("react"));
 const sitecore_jss_react_1 = require("@sitecore-jss/sitecore-jss-react");
 const image_1 = __importDefault(require("next/image"));
-const NextImage = (_a) => {
-    var { editable, imageParams, field, mediaUrlPrefix, fill, priority } = _a, otherProps = __rest(_a, ["editable", "imageParams", "field", "mediaUrlPrefix", "fill", "priority"]);
+exports.NextImage = (0, sitecore_jss_react_1.withFieldMetadata)((_a) => {
+    var { editable = true, imageParams, field, mediaUrlPrefix, fill, priority } = _a, otherProps = __rest(_a, ["editable", "imageParams", "field", "mediaUrlPrefix", "fill", "priority"]);
     // next handles src and we use a custom loader,
     // throw error if these are present
     if (otherProps.src) {
@@ -59,8 +59,7 @@ const NextImage = (_a) => {
         return react_1.default.createElement(image_1.default, Object.assign({ alt: "" }, imageProps));
     }
     return null; // we can't handle the truth
-};
-exports.NextImage = NextImage;
+});
 exports.NextImage.propTypes = {
     field: prop_types_1.default.oneOfType([
         prop_types_1.default.shape({
@@ -75,7 +74,4 @@ exports.NextImage.propTypes = {
     mediaUrlPrefix: prop_types_1.default.instanceOf(RegExp),
     imageParams: prop_types_1.default.objectOf(prop_types_1.default.oneOfType([prop_types_1.default.number.isRequired, prop_types_1.default.string.isRequired]).isRequired),
 };
-exports.NextImage.defaultProps = {
-    editable: true,
-};
 exports.NextImage.displayName = 'NextImage';

package/dist/cjs/components/RichText.js

@@ -44,9 +44,9 @@ const router_1 = require("next/router");
 const sitecore_jss_react_1 = require("@sitecore-jss/sitecore-jss-react");
 const prefetched = {};
 const RichText = (props) => {
-    const { internalLinksSelector = 'a[href^="/"]', prefetchLinks = true } = props, rest = __rest(props, ["internalLinksSelector", "prefetchLinks"]);
+    const { internalLinksSelector = 'a[href^="/"]', prefetchLinks = true, editable = true } = props, rest = __rest(props, ["internalLinksSelector", "prefetchLinks", "editable"]);
     const hasText = props.field && props.field.value;
-    const isEditing = props.editable && props.field && props.field.editable;
+    const isEditing = editable && props.field && props.field.editable;
     const router = (0, router_1.useRouter)();
     const richTextRef = (0, react_1.useRef)(null);
     (0, react_1.useEffect)(() => {
@@ -82,8 +82,4 @@ const RichText = (props) => {
 };
 exports.RichText = RichText;
 exports.RichText.propTypes = Object.assign({ internalLinksSelector: prop_types_1.default.string }, sitecore_jss_react_1.RichTextPropTypes);
-exports.RichText.defaultProps = {
-    tag: 'div',
-    editable: true,
-};
 exports.RichText.displayName = 'NextRichText';

package/dist/cjs/editing/constants.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.QUERY_PARAM_PROTECTION_BYPASS_VERCEL = exports.QUERY_PARAM_PROTECTION_BYPASS_SITECORE = exports.QUERY_PARAM_EDITING_SECRET = void 0;
+exports.EDITING_ALLOWED_ORIGINS = exports.QUERY_PARAM_PROTECTION_BYPASS_VERCEL = exports.QUERY_PARAM_PROTECTION_BYPASS_SITECORE = exports.QUERY_PARAM_EDITING_SECRET = void 0;
 exports.QUERY_PARAM_EDITING_SECRET = 'secret';
 exports.QUERY_PARAM_PROTECTION_BYPASS_SITECORE = 'x-sitecore-protection-bypass';
 exports.QUERY_PARAM_PROTECTION_BYPASS_VERCEL = 'x-vercel-protection-bypass';
+/**
+ * Default allowed origins for editing requests. This is used to enforce CORS, CSP headers.
+ */
+exports.EDITING_ALLOWED_ORIGINS = ['https://pages*.cloud', 'https://pages.sitecorecloud.io'];

package/dist/cjs/editing/editing-config-middleware.js

@@ -13,6 +13,8 @@ exports.EditingConfigMiddleware = void 0;
 const constants_1 = require("./constants");
 const utils_1 = require("../utils/utils");
 const sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
+const layout_1 = require("@sitecore-jss/sitecore-jss/layout");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
 /**
  * Middleware / handler used in the editing config API route in xmcloud add on (e.g. '/api/editing/config')
  * provides configuration information to determine feature compatibility on Pages side.
@@ -25,6 +27,10 @@ class EditingConfigMiddleware {
         this.config = config;
         this.handler = (_req, res) => __awaiter(this, void 0, void 0, function* () {
             const secret = _req.query[constants_1.QUERY_PARAM_EDITING_SECRET];
+            if (!(0, utils_2.enforceCors)(_req, res, constants_1.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             if (secret !== (0, utils_1.getJssEditingSecret)()) {
                 sitecore_jss_1.debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, (0, utils_1.getJssEditingSecret)());
                 return res.status(401).json({ message: 'Missing or invalid editing secret' });
@@ -32,9 +38,11 @@ class EditingConfigMiddleware {
             const components = Array.isArray(this.config.components)
                 ? this.config.components
                 : Array.from(this.config.components.keys());
+            const editMode = this.config.pagesEditMode || layout_1.EditMode.Metadata;
             return res.status(200).json({
                 components,
                 packages: this.config.metadata.packages,
+                editMode,
             });
         });
     }

package/dist/cjs/editing/editing-data-middleware.js

@@ -14,6 +14,8 @@ const editing_data_cache_1 = require("./editing-data-cache");
 const editing_data_1 = require("./editing-data");
 const constants_1 = require("./constants");
 const utils_1 = require("../utils/utils");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
+const sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
 /**
  * Middleware / handler for use in the editing data Next.js API dynamic route (e.g. '/api/editing/data/[key]')
  * which is required for Sitecore editing support.
@@ -28,6 +30,10 @@ class EditingDataMiddleware {
             const { method, query, body } = req;
             const secret = query[constants_1.QUERY_PARAM_EDITING_SECRET];
             const key = query[this.queryParamKey];
+            if (!(0, utils_2.enforceCors)(req, res, constants_1.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             // Validate secret
             if (secret !== (0, utils_1.getJssEditingSecret)()) {
                 res.status(401).end('Missing or invalid secret');

package/dist/cjs/editing/editing-render-middleware.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractEditingData = exports.EditingRenderMiddleware = void 0;
+exports.EditingRenderMiddleware = exports.MetadataHandler = exports.isEditingMetadataPreviewData = exports.ChromesHandler = void 0;
 const constants_1 = require("next/constants");
 const sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
 const layout_1 = require("@sitecore-jss/sitecore-jss/layout");
@@ -18,45 +18,52 @@ const editing_data_service_1 = require("./editing-data-service");
 const constants_2 = require("./constants");
 const utils_1 = require("../utils/utils");
 const render_middleware_1 = require("./render-middleware");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
 /**
- * Middleware / handler for use in the editing render Next.js API route (e.g. '/api/editing/render')
- * which is required for Sitecore editing support.
+ * Handler for the Editing Chromes POST requests.
+ * This handler is responsible for rendering the page and returning the HTML content that is provided via request.
  */
-class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
-    /**
-     * @param {EditingRenderMiddlewareConfig} [config] Editing render middleware config
-     */
+class ChromesHandler extends render_middleware_1.RenderMiddlewareBase {
     constructor(config) {
         var _a, _b, _c, _d;
         super();
-        this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
-            var _e, _f;
-            const { method, query, body, headers } = req;
+        this.config = config;
+        /**
+         * Default page URL resolution.
+         * @param {Object} args Arguments for resolving the page URL
+         * @param {string} args.serverUrl The root server URL e.g. 'http://localhost:3000'
+         * @param {string} args.itemPath The Sitecore relative item path e.g. '/styleguide'
+         * @returns {string} The URL to render
+         */
+        this.defaultResolvePageUrl = ({ serverUrl, itemPath, }) => {
+            return `${serverUrl}${itemPath}`;
+        };
+        /**
+         * Default server URL resolution.
+         * Note we use https protocol on Vercel due to serverless function architecture.
+         * In all other scenarios, including localhost (with or without a proxy e.g. ngrok)
+         * and within a nodejs container, http protocol should be used.
+         *
+         * For information about the VERCEL environment variable, see
+         * https://vercel.com/docs/environment-variables#system-environment-variables
+         * @param {NextApiRequest} req
+         */
+        this.defaultResolveServerUrl = (req) => {
+            return `${process.env.VERCEL ? 'https' : 'http'}://${req.headers.host}`;
+        };
+        this.editingDataService = (_a = config === null || config === void 0 ? void 0 : config.editingDataService) !== null && _a !== void 0 ? _a : editing_data_service_1.editingDataService;
+        this.dataFetcher = (_b = config === null || config === void 0 ? void 0 : config.dataFetcher) !== null && _b !== void 0 ? _b : new sitecore_jss_1.AxiosDataFetcher({ debugger: sitecore_jss_1.debug.editing });
+        this.resolvePageUrl = (_c = config === null || config === void 0 ? void 0 : config.resolvePageUrl) !== null && _c !== void 0 ? _c : this.defaultResolvePageUrl;
+        this.resolveServerUrl = (_d = config === null || config === void 0 ? void 0 : config.resolveServerUrl) !== null && _d !== void 0 ? _d : this.defaultResolveServerUrl;
+    }
+    render(req, res) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const { query } = req;
             const startTimestamp = Date.now();
-            sitecore_jss_1.debug.editing('editing render middleware start: %o', {
-                method,
-                query,
-                headers,
-                body,
-            });
-            if (method !== 'POST') {
-                sitecore_jss_1.debug.editing('invalid method - sent %s expected POST', method);
-                res.setHeader('Allow', 'POST');
-                return res.status(405).json({
-                    html: `<html><body>Invalid request method '${method}'</body></html>`,
-                });
-            }
-            // Validate secret
-            const secret = (_e = query[constants_2.QUERY_PARAM_EDITING_SECRET]) !== null && _e !== void 0 ? _e : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
-            if (secret !== (0, utils_1.getJssEditingSecret)()) {
-                sitecore_jss_1.debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, (0, utils_1.getJssEditingSecret)());
-                return res.status(401).json({
-                    html: '<html><body>Missing or invalid secret</body></html>',
-                });
-            }
             try {
                 // Extract data from EE payload
-                const editingData = extractEditingData(req);
+                const editingData = this.extractEditingData(req);
                 // Resolve server URL
                 const serverUrl = this.resolveServerUrl(req);
                 // Get query string parameters to propagate on subsequent requests (e.g. for deployment protection bypass)
@@ -72,7 +79,7 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 // Make actual render request for page route, passing on preview cookies as well as any approved query string parameters.
                 // Note timestamp effectively disables caching the request in Axios (no amount of cache headers seemed to do it)
                 sitecore_jss_1.debug.editing('fetching page route for %s', editingData.path);
-                const requestUrl = new URL(this.resolvePageUrl(serverUrl, editingData.path));
+                const requestUrl = new URL(this.resolvePageUrl({ serverUrl, itemPath: editingData.path }));
                 for (const key in params) {
                     if ({}.hasOwnProperty.call(params, key)) {
                         requestUrl.searchParams.append(key, params[key]);
@@ -109,7 +116,7 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 html = html.replace(constants_1.STATIC_PROPS_ID, constants_1.SERVER_PROPS_ID);
                 if (editingData.layoutData.sitecore.context.renderingType === layout_1.RenderingType.Component) {
                     // Handle component rendering. Extract component markup only
-                    html = (_f = (0, node_html_parser_1.parse)(html).getElementById(layout_1.EDITING_COMPONENT_ID)) === null || _f === void 0 ? void 0 : _f.innerHTML;
+                    html = (_a = (0, node_html_parser_1.parse)(html).getElementById(layout_1.EDITING_COMPONENT_ID)) === null || _a === void 0 ? void 0 : _a.innerHTML;
                     if (!html)
                         throw new Error(`Failed to render component for ${editingData.path}`);
                 }
@@ -135,31 +142,171 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 });
             }
         });
-        /**
-         * Default page URL resolution.
-         * @param {string} serverUrl
-         * @param {string} itemPath
-         */
-        this.defaultResolvePageUrl = (serverUrl, itemPath) => {
-            return `${serverUrl}${itemPath}`;
-        };
-        /**
-         * Default server URL resolution.
-         * Note we use https protocol on Vercel due to serverless function architecture.
-         * In all other scenarios, including localhost (with or without a proxy e.g. ngrok)
-         * and within a nodejs container, http protocol should be used.
-         *
-         * For information about the VERCEL environment variable, see
-         * https://vercel.com/docs/environment-variables#system-environment-variables
-         * @param {NextApiRequest} req
-         */
-        this.defaultResolveServerUrl = (req) => {
-            return `${process.env.VERCEL ? 'https' : 'http'}://${req.headers.host}`;
+    }
+    extractEditingData(req) {
+        // Sitecore editors will send the following body data structure,
+        // though we're only concerned with the "args".
+        // {
+        //   id: 'JSS app name',
+        //   args: ['path', 'serialized layout data object', 'serialized viewbag object'],
+        //   functionName: 'renderView',
+        //   moduleName: 'server.bundle'
+        // }
+        // The 'serialized viewbag object' structure:
+        // {
+        //   language: 'language',
+        //   dictionary: 'key-value representation of tokens and their corresponding translations',
+        //   httpContext: 'serialized request data'
+        // }
+        var _a;
+        // Note req.body _should_ have already been parsed as JSON at this point (via Next.js `bodyParser` API middleware)
+        const payload = req.body;
+        if (!payload || !payload.args || !Array.isArray(payload.args) || payload.args.length < 3) {
+            throw new Error('Unable to extract editing data from request. Ensure `bodyParser` middleware is enabled on your Next.js API route.');
+        }
+        const layoutData = JSON.parse(payload.args[1]);
+        const viewBag = JSON.parse(payload.args[2]);
+        // Keep backwards compatibility in case people use an older JSS version that doesn't send the path in the context
+        const path = (_a = layoutData.sitecore.context.itemPath) !== null && _a !== void 0 ? _a : viewBag.httpContext.request.path;
+        return {
+            path,
+            layoutData,
+            language: viewBag.language,
+            dictionary: viewBag.dictionary,
         };
-        this.editingDataService = (_a = config === null || config === void 0 ? void 0 : config.editingDataService) !== null && _a !== void 0 ? _a : editing_data_service_1.editingDataService;
-        this.dataFetcher = (_b = config === null || config === void 0 ? void 0 : config.dataFetcher) !== null && _b !== void 0 ? _b : new sitecore_jss_1.AxiosDataFetcher({ debugger: sitecore_jss_1.debug.editing });
-        this.resolvePageUrl = (_c = config === null || config === void 0 ? void 0 : config.resolvePageUrl) !== null && _c !== void 0 ? _c : this.defaultResolvePageUrl;
-        this.resolveServerUrl = (_d = config === null || config === void 0 ? void 0 : config.resolveServerUrl) !== null && _d !== void 0 ? _d : this.defaultResolveServerUrl;
+    }
+}
+exports.ChromesHandler = ChromesHandler;
+/**
+ * Type guard for EditingMetadataPreviewData
+ * @param {Object} data preview data to check
+ * @returns true if the data is EditingMetadataPreviewData
+ * @see EditingMetadataPreviewData
+ */
+const isEditingMetadataPreviewData = (data) => {
+    return (typeof data === 'object' &&
+        data !== null &&
+        'editMode' in data &&
+        data.editMode === layout_1.EditMode.Metadata);
+};
+exports.isEditingMetadataPreviewData = isEditingMetadataPreviewData;
+/**
+ * Handler for the Editing Metadata GET requests.
+ * This handler is responsible for redirecting the request to the page route.
+ * The page fetches the layout, dictionary and renders the page.
+ */
+class MetadataHandler {
+    constructor(config) {
+        this.config = config;
+    }
+    render(req, res) {
+        var _a, _b;
+        const { query } = req;
+        const startTimestamp = Date.now();
+        const requiredQueryParams = [
+            'sc_site',
+            'sc_itemid',
+            'sc_lang',
+            'sc_variant',
+            'sc_version',
+            'mode',
+        ];
+        const missingQueryParams = requiredQueryParams.filter((param) => !query[param]);
+        // Validate query parameters
+        if (missingQueryParams.length) {
+            sitecore_jss_1.debug.editing('missing required query parameters: %o', missingQueryParams);
+            return res.status(400).json({
+                html: `<html><body>Missing required query parameters: ${missingQueryParams.join(', ')}</body></html>`,
+            });
+        }
+        res.setPreviewData({
+            site: query.sc_site,
+            itemId: query.sc_itemid,
+            language: query.sc_lang,
+            // sc_variant is an array in the query params, but we only need the first value
+            variantId: query.sc_variant.split(',')[0],
+            version: query.sc_version,
+            editMode: layout_1.EditMode.Metadata,
+            pageState: query.mode,
+        }, 
+        // Cache the preview data for 3 seconds to ensure the page is rendered with the correct preview data not the cached one
+        {
+            path: query.route,
+            maxAge: 3,
+        });
+        const route = ((_b = (_a = this.config).resolvePageUrl) === null || _b === void 0 ? void 0 : _b.call(_a, {
+            itemPath: query.route,
+        })) || query.route;
+        sitecore_jss_1.debug.editing('editing render middleware end in %dms: redirect %o', Date.now() - startTimestamp, {
+            status: 307,
+            route,
+        });
+        // Restrict the page to be rendered only within the allowed origins
+        res.setHeader('Content-Security-Policy', this.getSCPHeader());
+        res.redirect(route);
+    }
+    /**
+     * Gets the Content-Security-Policy header value
+     * @returns Content-Security-Policy header value
+     */
+    getSCPHeader() {
+        return `frame-ancestors 'self' ${[(0, utils_2.getAllowedOriginsFromEnv)(), ...constants_2.EDITING_ALLOWED_ORIGINS].join(' ')}`;
+    }
+}
+exports.MetadataHandler = MetadataHandler;
+/**
+ * Middleware / handler for use in the editing render Next.js API route (e.g. '/api/editing/render')
+ * which is required for Sitecore editing support.
+ */
+class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
+    /**
+     * @param {EditingRenderMiddlewareConfig} [config] Editing render middleware config
+     */
+    constructor(config) {
+        super();
+        this.config = config;
+        this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const { query, body, method, headers } = req;
+            sitecore_jss_1.debug.editing('editing render middleware start: %o', {
+                method,
+                query,
+                headers,
+                body,
+            });
+            if (!(0, utils_2.enforceCors)(req, res, constants_2.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({
+                    html: `<html><body>Requests from origin ${(_a = req.headers) === null || _a === void 0 ? void 0 : _a.origin} not allowed</body></html>`,
+                });
+            }
+            // Validate secret
+            const secret = (_b = query[constants_2.QUERY_PARAM_EDITING_SECRET]) !== null && _b !== void 0 ? _b : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
+            if (secret !== (0, utils_1.getJssEditingSecret)()) {
+                sitecore_jss_1.debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, (0, utils_1.getJssEditingSecret)());
+                return res.status(401).json({
+                    html: '<html><body>Missing or invalid secret</body></html>',
+                });
+            }
+            switch (req.method) {
+                case 'GET': {
+                    const handler = new MetadataHandler({ resolvePageUrl: (_c = this.config) === null || _c === void 0 ? void 0 : _c.resolvePageUrl });
+                    yield handler.render(req, res);
+                    break;
+                }
+                case 'POST': {
+                    const handler = new ChromesHandler(this.config);
+                    yield handler.render(req, res);
+                    break;
+                }
+                default:
+                    sitecore_jss_1.debug.editing('invalid method - sent %s expected GET/POST', req.method);
+                    res.setHeader('Allow', 'GET, POST');
+                    return res.status(405).json({
+                        html: `<html><body>Invalid request method '${req.method}'</body></html>`,
+                    });
+            }
+        });
     }
     /**
      * Gets the Next.js API route handler
@@ -170,39 +317,3 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
     }
 }
 exports.EditingRenderMiddleware = EditingRenderMiddleware;
-/**
- * @param {NextApiRequest} req
- */
-function extractEditingData(req) {
-    // Sitecore editors will send the following body data structure,
-    // though we're only concerned with the "args".
-    // {
-    //   id: 'JSS app name',
-    //   args: ['path', 'serialized layout data object', 'serialized viewbag object'],
-    //   functionName: 'renderView',
-    //   moduleName: 'server.bundle'
-    // }
-    // The 'serialized viewbag object' structure:
-    // {
-    //   language: 'language',
-    //   dictionary: 'key-value representation of tokens and their corresponding translations',
-    //   httpContext: 'serialized request data'
-    // }
-    var _a;
-    // Note req.body _should_ have already been parsed as JSON at this point (via Next.js `bodyParser` API middleware)
-    const payload = req.body;
-    if (!payload || !payload.args || !Array.isArray(payload.args) || payload.args.length < 3) {
-        throw new Error('Unable to extract editing data from request. Ensure `bodyParser` middleware is enabled on your Next.js API route.');
-    }
-    const layoutData = JSON.parse(payload.args[1]);
-    const viewBag = JSON.parse(payload.args[2]);
-    // Keep backwards compatibility in case people use an older JSS version that doesn't send the path in the context
-    const path = (_a = layoutData.sitecore.context.itemPath) !== null && _a !== void 0 ? _a : viewBag.httpContext.request.path;
-    return {
-        path,
-        layoutData,
-        language: viewBag.language,
-        dictionary: viewBag.dictionary,
-    };
-}
-exports.extractEditingData = extractEditingData;

package/dist/cjs/editing/feaas-render-middleware.js

@@ -14,6 +14,7 @@ const sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
 const constants_1 = require("./constants");
 const utils_1 = require("../utils/utils");
 const render_middleware_1 = require("./render-middleware");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
 /**
  * Middleware / handler for use in the feaas render Next.js API route (e.g. '/api/editing/feaas/render')
  * which is required for Sitecore editing support.
@@ -28,6 +29,7 @@ class FEAASRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
         this.config = config;
         this.defaultPageUrl = '/feaas/render';
         this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _b;
             const { method, query, headers } = req;
             const startTimestamp = Date.now();
             sitecore_jss_1.debug.editing('feaas render middleware start: %o', {
@@ -35,6 +37,12 @@ class FEAASRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 query,
                 headers,
             });
+            if (!(0, utils_2.enforceCors)(req, res, constants_1.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res
+                    .status(401)
+                    .send(`<html><body>Requests from origin ${(_b = req.headers) === null || _b === void 0 ? void 0 : _b.origin} are not allowed</body></html>`);
+            }
             if (method !== 'GET') {
                 sitecore_jss_1.debug.editing('invalid method - sent %s expected GET', method);
                 res.setHeader('Allow', 'GET');

package/dist/cjs/editing/index.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EditingConfigMiddleware = exports.FEAASRenderMiddleware = exports.VercelEditingDataCache = exports.editingDataService = exports.ServerlessEditingDataService = exports.BasicEditingDataService = exports.EditingRenderMiddleware = exports.EditingDataMiddleware = exports.EditingDataDiskCache = void 0;
+exports.EditingConfigMiddleware = exports.FEAASRenderMiddleware = exports.VercelEditingDataCache = exports.editingDataService = exports.ServerlessEditingDataService = exports.BasicEditingDataService = exports.isEditingMetadataPreviewData = exports.EditingRenderMiddleware = exports.EditingDataMiddleware = exports.EditingDataDiskCache = exports.GraphQLEditingService = void 0;
+var editing_1 = require("@sitecore-jss/sitecore-jss/editing");
+Object.defineProperty(exports, "GraphQLEditingService", { enumerable: true, get: function () { return editing_1.GraphQLEditingService; } });
 var editing_data_cache_1 = require("./editing-data-cache");
 Object.defineProperty(exports, "EditingDataDiskCache", { enumerable: true, get: function () { return editing_data_cache_1.EditingDataDiskCache; } });
 var editing_data_middleware_1 = require("./editing-data-middleware");
 Object.defineProperty(exports, "EditingDataMiddleware", { enumerable: true, get: function () { return editing_data_middleware_1.EditingDataMiddleware; } });
 var editing_render_middleware_1 = require("./editing-render-middleware");
 Object.defineProperty(exports, "EditingRenderMiddleware", { enumerable: true, get: function () { return editing_render_middleware_1.EditingRenderMiddleware; } });
+Object.defineProperty(exports, "isEditingMetadataPreviewData", { enumerable: true, get: function () { return editing_render_middleware_1.isEditingMetadataPreviewData; } });
 var editing_data_service_1 = require("./editing-data-service");
 Object.defineProperty(exports, "BasicEditingDataService", { enumerable: true, get: function () { return editing_data_service_1.BasicEditingDataService; } });
 Object.defineProperty(exports, "ServerlessEditingDataService", { enumerable: true, get: function () { return editing_data_service_1.ServerlessEditingDataService; } });

package/dist/cjs/index.js

@@ -23,8 +23,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DateField = exports.Text = exports.Image = exports.Context = exports.ComponentBuilder = exports.BYOCWrapper = exports.FEaaSWrapper = exports.NextImage = exports.EditingComponentPlaceholder = exports.Placeholder = exports.RichText = exports.Link = exports.useComponentProps = exports.ComponentPropsContext = exports.ComponentPropsReactContext = exports.normalizeSiteRewrite = exports.getSiteRewriteData = exports.getSiteRewrite = exports.GraphQLSiteInfoService = exports.SiteResolver = exports.GraphQLRobotsService = exports.GraphQLErrorPagesService = exports.GraphQLSitemapXmlService = exports.MultisiteGraphQLSitemapService = exports.GraphQLSitemapService = exports.DisconnectedSitemapService = exports.ComponentPropsService = exports.CdpHelper = exports.normalizePersonalizedRewrite = exports.getPersonalizedRewriteData = exports.getPersonalizedRewrite = exports.personalizeLayout = exports.RestDictionaryService = exports.GraphQLDictionaryService = exports.trackingApi = exports.mediaApi = exports.getContentStylesheetLink = exports.EDITING_COMPONENT_ID = exports.EDITING_COMPONENT_PLACEHOLDER = exports.RenderingType = exports.getFieldValue = exports.getChildPlaceholder = exports.RestLayoutService = exports.GraphQLLayoutService = exports.LayoutServicePageState = exports.debug = exports.enableDebug = exports.NativeDataFetcher = exports.AxiosDataFetcher = exports.constants = void 0;
-exports.withDatasourceCheck = exports.withPlaceholder = exports.withEditorChromes = exports.useSitecoreContext = exports.withSitecoreContext = exports.SitecoreContextReactContext = exports.SitecoreContext = exports.VisitorIdentification = exports.File = exports.getComponentLibraryStylesheetLinks = exports.BYOCComponent = exports.fetchFEaaSComponentServerProps = exports.FEaaSComponent = exports.EditFrame = void 0;
+exports.Text = exports.Image = exports.Context = exports.ComponentBuilder = exports.BYOCWrapper = exports.FEaaSWrapper = exports.NextImage = exports.EditingComponentPlaceholder = exports.Placeholder = exports.RichText = exports.Link = exports.useComponentProps = exports.ComponentPropsContext = exports.ComponentPropsReactContext = exports.normalizeSiteRewrite = exports.getSiteRewriteData = exports.getSiteRewrite = exports.GraphQLSiteInfoService = exports.SiteResolver = exports.GraphQLRobotsService = exports.GraphQLErrorPagesService = exports.GraphQLSitemapXmlService = exports.MultisiteGraphQLSitemapService = exports.GraphQLSitemapService = exports.DisconnectedSitemapService = exports.ComponentPropsService = exports.CdpHelper = exports.normalizePersonalizedRewrite = exports.getPersonalizedRewriteData = exports.getPersonalizedRewrite = exports.personalizeLayout = exports.RestDictionaryService = exports.GraphQLDictionaryService = exports.trackingApi = exports.mediaApi = exports.EditMode = exports.getContentStylesheetLink = exports.EDITING_COMPONENT_ID = exports.EDITING_COMPONENT_PLACEHOLDER = exports.RenderingType = exports.getFieldValue = exports.getChildPlaceholder = exports.RestLayoutService = exports.GraphQLLayoutService = exports.LayoutServicePageState = exports.debug = exports.enableDebug = exports.NativeDataFetcher = exports.AxiosDataFetcher = exports.constants = void 0;
+exports.EditingScripts = exports.withFieldMetadata = exports.withDatasourceCheck = exports.withPlaceholder = exports.withEditorChromes = exports.useSitecoreContext = exports.withSitecoreContext = exports.SitecoreContextReactContext = exports.SitecoreContext = exports.VisitorIdentification = exports.File = exports.getComponentLibraryStylesheetLinks = exports.BYOCComponent = exports.fetchFEaaSComponentServerProps = exports.FEaaSComponent = exports.EditFrame = exports.DateField = void 0;
 var sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
 Object.defineProperty(exports, "constants", { enumerable: true, get: function () { return sitecore_jss_1.constants; } });
 Object.defineProperty(exports, "AxiosDataFetcher", { enumerable: true, get: function () { return sitecore_jss_1.AxiosDataFetcher; } });
@@ -41,6 +41,7 @@ Object.defineProperty(exports, "RenderingType", { enumerable: true, get: functio
 Object.defineProperty(exports, "EDITING_COMPONENT_PLACEHOLDER", { enumerable: true, get: function () { return layout_1.EDITING_COMPONENT_PLACEHOLDER; } });
 Object.defineProperty(exports, "EDITING_COMPONENT_ID", { enumerable: true, get: function () { return layout_1.EDITING_COMPONENT_ID; } });
 Object.defineProperty(exports, "getContentStylesheetLink", { enumerable: true, get: function () { return layout_1.getContentStylesheetLink; } });
+Object.defineProperty(exports, "EditMode", { enumerable: true, get: function () { return layout_1.EditMode; } });
 var media_1 = require("@sitecore-jss/sitecore-jss/media");
 Object.defineProperty(exports, "mediaApi", { enumerable: true, get: function () { return media_1.mediaApi; } });
 var tracking_1 = require("@sitecore-jss/sitecore-jss/tracking");
@@ -111,3 +112,5 @@ Object.defineProperty(exports, "useSitecoreContext", { enumerable: true, get: fu
 Object.defineProperty(exports, "withEditorChromes", { enumerable: true, get: function () { return sitecore_jss_react_1.withEditorChromes; } });
 Object.defineProperty(exports, "withPlaceholder", { enumerable: true, get: function () { return sitecore_jss_react_1.withPlaceholder; } });
 Object.defineProperty(exports, "withDatasourceCheck", { enumerable: true, get: function () { return sitecore_jss_react_1.withDatasourceCheck; } });
+Object.defineProperty(exports, "withFieldMetadata", { enumerable: true, get: function () { return sitecore_jss_react_1.withFieldMetadata; } });
+Object.defineProperty(exports, "EditingScripts", { enumerable: true, get: function () { return sitecore_jss_react_1.EditingScripts; } });

package/dist/cjs/utils/index.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveUrl = exports.resetEditorChromes = exports.isEditorActive = exports.tryParseEnvValue = exports.handleEditorFastRefresh = exports.getPublicUrl = void 0;
+exports.resetEditorChromes = exports.isEditorActive = exports.resolveUrl = exports.tryParseEnvValue = exports.handleEditorFastRefresh = exports.getPublicUrl = void 0;
 var utils_1 = require("./utils");
 Object.defineProperty(exports, "getPublicUrl", { enumerable: true, get: function () { return utils_1.getPublicUrl; } });
 Object.defineProperty(exports, "handleEditorFastRefresh", { enumerable: true, get: function () { return utils_1.handleEditorFastRefresh; } });
 var utils_2 = require("@sitecore-jss/sitecore-jss/utils");
 Object.defineProperty(exports, "tryParseEnvValue", { enumerable: true, get: function () { return utils_2.tryParseEnvValue; } });
-Object.defineProperty(exports, "isEditorActive", { enumerable: true, get: function () { return utils_2.isEditorActive; } });
-Object.defineProperty(exports, "resetEditorChromes", { enumerable: true, get: function () { return utils_2.resetEditorChromes; } });
 Object.defineProperty(exports, "resolveUrl", { enumerable: true, get: function () { return utils_2.resolveUrl; } });
+var editing_1 = require("@sitecore-jss/sitecore-jss/editing");
+Object.defineProperty(exports, "isEditorActive", { enumerable: true, get: function () { return editing_1.isEditorActive; } });
+Object.defineProperty(exports, "resetEditorChromes", { enumerable: true, get: function () { return editing_1.resetEditorChromes; } });

package/dist/cjs/utils/utils.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getJssEditingSecret = exports.handleEditorFastRefresh = exports.getPublicUrl = void 0;
-const utils_1 = require("@sitecore-jss/sitecore-jss/utils");
+const editing_1 = require("@sitecore-jss/sitecore-jss/editing");
 /**
  * Get the publicUrl.
  * This is used primarily to enable compatibility with Sitecore editors.
@@ -32,7 +32,7 @@ exports.getPublicUrl = getPublicUrl;
  * @default forceReload false
  */
 const handleEditorFastRefresh = (forceReload = false) => {
-    if (process.env.NODE_ENV !== 'development' || !(0, utils_1.isEditorActive)()) {
+    if (process.env.NODE_ENV !== 'development' || !(0, editing_1.isEditorActive)()) {
         // Only run if development mode and editor is active
         return;
     }
@@ -50,7 +50,7 @@ const handleEditorFastRefresh = (forceReload = false) => {
             return window.location.reload();
         setTimeout(() => {
             console.log('[Sitecore Editor HMR Listener] Sitecore editor does not support Fast Refresh, reloading chromes...');
-            (0, utils_1.resetEditorChromes)();
+            (0, editing_1.resetEditorChromes)();
         }, 500);
     };
 };