@sitecore-jss/sitecore-jss-nextjs 22.1.0-canary.4 → 22.1.0-canary.41

package/dist/cjs/utils/utils.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getJssEditingSecret = exports.handleEditorFastRefresh = exports.getPublicUrl = void 0;
-const utils_1 = require("@sitecore-jss/sitecore-jss/utils");
+const editing_1 = require("@sitecore-jss/sitecore-jss/editing");
 /**
  * Get the publicUrl.
  * This is used primarily to enable compatibility with Sitecore editors.
@@ -32,7 +32,7 @@ exports.getPublicUrl = getPublicUrl;
  * @default forceReload false
  */
 const handleEditorFastRefresh = (forceReload = false) => {
-    if (process.env.NODE_ENV !== 'development' || !(0, utils_1.isEditorActive)()) {
+    if (process.env.NODE_ENV !== 'development' || !(0, editing_1.isEditorActive)()) {
         // Only run if development mode and editor is active
         return;
     }
@@ -50,7 +50,7 @@ const handleEditorFastRefresh = (forceReload = false) => {
             return window.location.reload();
         setTimeout(() => {
             console.log('[Sitecore Editor HMR Listener] Sitecore editor does not support Fast Refresh, reloading chromes...');
-            (0, utils_1.resetEditorChromes)();
+            (0, editing_1.resetEditorChromes)();
         }, 500);
     };
 };

package/dist/esm/components/Link.js

@@ -23,7 +23,7 @@ export const Link = forwardRef((props, ref) => {
         ? field
         : field.value);
     const { href, querystring, anchor } = value;
-    const isEditing = editable && field.editable;
+    const isEditing = editable && (field.editable || field.metadata);
     if (href && !isEditing) {
         const text = showLinkTextWithChildrenPresent || !children ? value.text || value.href : null;
         // determine if a link is a route or not.

package/dist/esm/components/NextImage.js

@@ -12,9 +12,9 @@ var __rest = (this && this.__rest) || function (s, e) {
 import { mediaApi } from '@sitecore-jss/sitecore-jss/media';
 import PropTypes from 'prop-types';
 import React from 'react';
-import { getEEMarkup, } from '@sitecore-jss/sitecore-jss-react';
+import { getEEMarkup, withFieldMetadata, } from '@sitecore-jss/sitecore-jss-react';
 import Image from 'next/image';
-export const NextImage = (_a) => {
+export const NextImage = withFieldMetadata((_a) => {
     var { editable = true, imageParams, field, mediaUrlPrefix, fill, priority } = _a, otherProps = __rest(_a, ["editable", "imageParams", "field", "mediaUrlPrefix", "fill", "priority"]);
     // next handles src and we use a custom loader,
     // throw error if these are present
@@ -53,7 +53,7 @@ export const NextImage = (_a) => {
         return React.createElement(Image, Object.assign({ alt: "" }, imageProps));
     }
     return null; // we can't handle the truth
-};
+});
 NextImage.propTypes = {
     field: PropTypes.oneOfType([
         PropTypes.shape({

package/dist/esm/editing/constants.js

@@ -1,3 +1,12 @@
 export const QUERY_PARAM_EDITING_SECRET = 'secret';
-export const QUERY_PARAM_PROTECTION_BYPASS_SITECORE = 'x-sitecore-protection-bypass';
-export const QUERY_PARAM_PROTECTION_BYPASS_VERCEL = 'x-vercel-protection-bypass';
+export const QUERY_PARAM_VERCEL_PROTECTION_BYPASS = 'x-vercel-protection-bypass';
+export const QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE = 'x-vercel-set-bypass-cookie';
+/**
+ * Headers that should be passed along to (Editing Chromes handler) SSR request.
+ * Note these are in lowercase format to match expected `IncomingHttpHeaders`.
+ */
+export const EDITING_PASS_THROUGH_HEADERS = ['authorization', 'cookie'];
+/**
+ * Default allowed origins for editing requests. This is used to enforce CORS, CSP headers.
+ */
+export const EDITING_ALLOWED_ORIGINS = ['https://pages*.cloud', 'https://pages.sitecorecloud.io'];

package/dist/esm/editing/editing-config-middleware.js

@@ -7,9 +7,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
 import { debug } from '@sitecore-jss/sitecore-jss';
+import { EditMode } from '@sitecore-jss/sitecore-jss/layout';
+import { enforceCors } from '@sitecore-jss/sitecore-jss/utils';
 /**
  * Middleware / handler used in the editing config API route in xmcloud add on (e.g. '/api/editing/config')
  * provides configuration information to determine feature compatibility on Pages side.
@@ -22,6 +24,10 @@ export class EditingConfigMiddleware {
         this.config = config;
         this.handler = (_req, res) => __awaiter(this, void 0, void 0, function* () {
             const secret = _req.query[QUERY_PARAM_EDITING_SECRET];
+            if (!enforceCors(_req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             if (secret !== getJssEditingSecret()) {
                 debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, getJssEditingSecret());
                 return res.status(401).json({ message: 'Missing or invalid editing secret' });
@@ -29,9 +35,11 @@ export class EditingConfigMiddleware {
             const components = Array.isArray(this.config.components)
                 ? this.config.components
                 : Array.from(this.config.components.keys());
+            const editMode = this.config.pagesEditMode || EditMode.Metadata;
             return res.status(200).json({
                 components,
                 packages: this.config.metadata.packages,
+                editMode,
             });
         });
     }

package/dist/esm/editing/editing-data-middleware.js

@@ -9,8 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { editingDataDiskCache } from './editing-data-cache';
 import { isEditingData } from './editing-data';
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
+import { enforceCors } from '@sitecore-jss/sitecore-jss/utils';
+import { debug } from '@sitecore-jss/sitecore-jss';
 /**
  * Middleware / handler for use in the editing data Next.js API dynamic route (e.g. '/api/editing/data/[key]')
  * which is required for Sitecore editing support.
@@ -25,6 +27,10 @@ export class EditingDataMiddleware {
             const { method, query, body } = req;
             const secret = query[QUERY_PARAM_EDITING_SECRET];
             const key = query[this.queryParamKey];
+            if (!enforceCors(req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             // Validate secret
             if (secret !== getJssEditingSecret()) {
                 res.status(401).end('Missing or invalid secret');

package/dist/esm/editing/editing-render-middleware.js

@@ -9,55 +9,63 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { STATIC_PROPS_ID, SERVER_PROPS_ID } from 'next/constants';
 import { AxiosDataFetcher, debug } from '@sitecore-jss/sitecore-jss';
-import { EDITING_COMPONENT_ID, RenderingType } from '@sitecore-jss/sitecore-jss/layout';
-import { parse } from 'node-html-parser';
+import { EditMode } from '@sitecore-jss/sitecore-jss/layout';
 import { editingDataService } from './editing-data-service';
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
 import { RenderMiddlewareBase } from './render-middleware';
+import { enforceCors, getAllowedOriginsFromEnv } from '@sitecore-jss/sitecore-jss/utils';
+import { DEFAULT_VARIANT } from '@sitecore-jss/sitecore-jss/personalize';
 /**
- * Middleware / handler for use in the editing render Next.js API route (e.g. '/api/editing/render')
- * which is required for Sitecore editing support.
+ * Handler for the Editing Chromes POST requests.
+ * This handler is responsible for rendering the page and returning the HTML content that is provided via request.
  */
-export class EditingRenderMiddleware extends RenderMiddlewareBase {
-    /**
-     * @param {EditingRenderMiddlewareConfig} [config] Editing render middleware config
-     */
+export class ChromesHandler extends RenderMiddlewareBase {
     constructor(config) {
         var _a, _b, _c, _d;
         super();
-        this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
-            var _e, _f;
-            const { method, query, body, headers } = req;
+        this.config = config;
+        /**
+         * Default page URL resolution.
+         * @param {Object} args Arguments for resolving the page URL
+         * @param {string} args.serverUrl The root server URL e.g. 'http://localhost:3000'
+         * @param {string} args.itemPath The Sitecore relative item path e.g. '/styleguide'
+         * @returns {string} The URL to render
+         */
+        this.defaultResolvePageUrl = ({ serverUrl, itemPath, }) => {
+            return `${serverUrl}${itemPath}`;
+        };
+        /**
+         * Default server URL resolution.
+         * Note we use https protocol on Vercel due to serverless function architecture.
+         * In all other scenarios, including localhost (with or without a proxy e.g. ngrok)
+         * and within a nodejs container, http protocol should be used.
+         *
+         * For information about the VERCEL environment variable, see
+         * https://vercel.com/docs/environment-variables#system-environment-variables
+         * @param {NextApiRequest} req
+         */
+        this.defaultResolveServerUrl = (req) => {
+            return `${process.env.VERCEL ? 'https' : 'http'}://${req.headers.host}`;
+        };
+        this.editingDataService = (_a = config === null || config === void 0 ? void 0 : config.editingDataService) !== null && _a !== void 0 ? _a : editingDataService;
+        this.dataFetcher = (_b = config === null || config === void 0 ? void 0 : config.dataFetcher) !== null && _b !== void 0 ? _b : new AxiosDataFetcher({ debugger: debug.editing });
+        this.resolvePageUrl = (_c = config === null || config === void 0 ? void 0 : config.resolvePageUrl) !== null && _c !== void 0 ? _c : this.defaultResolvePageUrl;
+        this.resolveServerUrl = (_d = config === null || config === void 0 ? void 0 : config.resolveServerUrl) !== null && _d !== void 0 ? _d : this.defaultResolveServerUrl;
+    }
+    render(req, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { query, headers: incomingHeaders } = req;
             const startTimestamp = Date.now();
-            debug.editing('editing render middleware start: %o', {
-                method,
-                query,
-                headers,
-                body,
-            });
-            if (method !== 'POST') {
-                debug.editing('invalid method - sent %s expected POST', method);
-                res.setHeader('Allow', 'POST');
-                return res.status(405).json({
-                    html: `<html><body>Invalid request method '${method}'</body></html>`,
-                });
-            }
-            // Validate secret
-            const secret = (_e = query[QUERY_PARAM_EDITING_SECRET]) !== null && _e !== void 0 ? _e : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
-            if (secret !== getJssEditingSecret()) {
-                debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, getJssEditingSecret());
-                return res.status(401).json({
-                    html: '<html><body>Missing or invalid secret</body></html>',
-                });
-            }
             try {
                 // Extract data from EE payload
-                const editingData = extractEditingData(req);
+                const editingData = this.extractEditingData(req);
                 // Resolve server URL
                 const serverUrl = this.resolveServerUrl(req);
                 // Get query string parameters to propagate on subsequent requests (e.g. for deployment protection bypass)
                 const params = this.getQueryParamsForPropagation(query);
+                // Get headers to propagate on subsequent requests
+                const headers = this.getHeadersForPropagation(incomingHeaders);
                 // Stash for use later on (i.e. within getStatic/ServerSideProps).
                 // Note we can't set this directly in setPreviewData since it's stored as a cookie (2KB limit)
                 // https://nextjs.org/docs/advanced-features/preview-mode#previewdata-size-limits)
@@ -66,10 +74,11 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
                 res.setPreviewData(previewData);
                 // Grab the Next.js preview cookies to send on to the render request
                 const cookies = res.getHeader('Set-Cookie');
+                headers.cookie = `${headers.cookie ? headers.cookie + ';' : ''}${cookies.join(';')}`;
                 // Make actual render request for page route, passing on preview cookies as well as any approved query string parameters.
                 // Note timestamp effectively disables caching the request in Axios (no amount of cache headers seemed to do it)
                 debug.editing('fetching page route for %s', editingData.path);
-                const requestUrl = new URL(this.resolvePageUrl(serverUrl, editingData.path));
+                const requestUrl = new URL(this.resolvePageUrl({ serverUrl, itemPath: editingData.path }));
                 for (const key in params) {
                     if ({}.hasOwnProperty.call(params, key)) {
                         requestUrl.searchParams.append(key, params[key]);
@@ -78,9 +87,7 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
                 requestUrl.searchParams.append('timestamp', Date.now().toString());
                 const pageRes = yield this.dataFetcher
                     .get(requestUrl.toString(), {
-                    headers: {
-                        Cookie: cookies.join(';'),
-                    },
+                    headers,
                 })
                     .catch((err) => {
                     // We need to handle not found error provided by Vercel
@@ -104,12 +111,6 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
                 // certain route configurations (e.g. multiple catch-all routes).
                 // The following line will trick it into thinking we're SSR, thus avoiding any router.replace.
                 html = html.replace(STATIC_PROPS_ID, SERVER_PROPS_ID);
-                if (editingData.layoutData.sitecore.context.renderingType === RenderingType.Component) {
-                    // Handle component rendering. Extract component markup only
-                    html = (_f = parse(html).getElementById(EDITING_COMPONENT_ID)) === null || _f === void 0 ? void 0 : _f.innerHTML;
-                    if (!html)
-                        throw new Error(`Failed to render component for ${editingData.path}`);
-                }
                 const body = { html };
                 // Return expected JSON result
                 debug.editing('editing render middleware end in %dms: %o', Date.now() - startTimestamp, {
@@ -132,72 +133,173 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
                 });
             }
         });
-        /**
-         * Default page URL resolution.
-         * @param {string} serverUrl
-         * @param {string} itemPath
-         */
-        this.defaultResolvePageUrl = (serverUrl, itemPath) => {
-            return `${serverUrl}${itemPath}`;
-        };
-        /**
-         * Default server URL resolution.
-         * Note we use https protocol on Vercel due to serverless function architecture.
-         * In all other scenarios, including localhost (with or without a proxy e.g. ngrok)
-         * and within a nodejs container, http protocol should be used.
-         *
-         * For information about the VERCEL environment variable, see
-         * https://vercel.com/docs/environment-variables#system-environment-variables
-         * @param {NextApiRequest} req
-         */
-        this.defaultResolveServerUrl = (req) => {
-            return `${process.env.VERCEL ? 'https' : 'http'}://${req.headers.host}`;
+    }
+    extractEditingData(req) {
+        // Sitecore editors will send the following body data structure,
+        // though we're only concerned with the "args".
+        // {
+        //   id: 'JSS app name',
+        //   args: ['path', 'serialized layout data object', 'serialized viewbag object'],
+        //   functionName: 'renderView',
+        //   moduleName: 'server.bundle'
+        // }
+        // The 'serialized viewbag object' structure:
+        // {
+        //   language: 'language',
+        //   dictionary: 'key-value representation of tokens and their corresponding translations',
+        //   httpContext: 'serialized request data'
+        // }
+        var _a;
+        // Note req.body _should_ have already been parsed as JSON at this point (via Next.js `bodyParser` API middleware)
+        const payload = req.body;
+        if (!payload || !payload.args || !Array.isArray(payload.args) || payload.args.length < 3) {
+            throw new Error('Unable to extract editing data from request. Ensure `bodyParser` middleware is enabled on your Next.js API route.');
+        }
+        const layoutData = JSON.parse(payload.args[1]);
+        const viewBag = JSON.parse(payload.args[2]);
+        // Keep backwards compatibility in case people use an older JSS version that doesn't send the path in the context
+        const path = (_a = layoutData.sitecore.context.itemPath) !== null && _a !== void 0 ? _a : viewBag.httpContext.request.path;
+        return {
+            path,
+            layoutData,
+            language: viewBag.language,
+            dictionary: viewBag.dictionary,
         };
-        this.editingDataService = (_a = config === null || config === void 0 ? void 0 : config.editingDataService) !== null && _a !== void 0 ? _a : editingDataService;
-        this.dataFetcher = (_b = config === null || config === void 0 ? void 0 : config.dataFetcher) !== null && _b !== void 0 ? _b : new AxiosDataFetcher({ debugger: debug.editing });
-        this.resolvePageUrl = (_c = config === null || config === void 0 ? void 0 : config.resolvePageUrl) !== null && _c !== void 0 ? _c : this.defaultResolvePageUrl;
-        this.resolveServerUrl = (_d = config === null || config === void 0 ? void 0 : config.resolveServerUrl) !== null && _d !== void 0 ? _d : this.defaultResolveServerUrl;
+    }
+}
+/**
+ * Type guard for EditingMetadataPreviewData
+ * @param {Object} data preview data to check
+ * @returns true if the data is EditingMetadataPreviewData
+ * @see EditingMetadataPreviewData
+ */
+export const isEditingMetadataPreviewData = (data) => {
+    return (typeof data === 'object' &&
+        data !== null &&
+        'editMode' in data &&
+        data.editMode === EditMode.Metadata);
+};
+/**
+ * Handler for the Editing Metadata GET requests.
+ * This handler is responsible for redirecting the request to the page route.
+ * The page fetches the layout, dictionary and renders the page.
+ */
+export class MetadataHandler {
+    constructor(config) {
+        this.config = config;
+    }
+    render(req, res) {
+        var _a, _b, _c;
+        const { query } = req;
+        const startTimestamp = Date.now();
+        const requiredQueryParams = [
+            'sc_site',
+            'sc_itemid',
+            'sc_lang',
+            'route',
+            'mode',
+        ];
+        const missingQueryParams = requiredQueryParams.filter((param) => !query[param]);
+        // Validate query parameters
+        if (missingQueryParams.length) {
+            debug.editing('missing required query parameters: %o', missingQueryParams);
+            return res.status(400).json({
+                html: `<html><body>Missing required query parameters: ${missingQueryParams.join(', ')}</body></html>`,
+            });
+        }
+        res.setPreviewData({
+            site: query.sc_site,
+            itemId: query.sc_itemid,
+            language: query.sc_lang,
+            // sc_variant is an array in the query params, but we only need the first value
+            variantId: ((_a = query.sc_variant) === null || _a === void 0 ? void 0 : _a.split(',')[0]) || DEFAULT_VARIANT,
+            version: query.sc_version,
+            editMode: EditMode.Metadata,
+            pageState: query.mode,
+        }, 
+        // Cache the preview data for 3 seconds to ensure the page is rendered with the correct preview data not the cached one
+        {
+            path: query.route,
+            maxAge: 3,
+        });
+        const route = ((_c = (_b = this.config).resolvePageUrl) === null || _c === void 0 ? void 0 : _c.call(_b, {
+            itemPath: query.route,
+        })) || query.route;
+        debug.editing('editing render middleware end in %dms: redirect %o', Date.now() - startTimestamp, {
+            status: 307,
+            route,
+        });
+        // Restrict the page to be rendered only within the allowed origins
+        res.setHeader('Content-Security-Policy', this.getSCPHeader());
+        res.redirect(route);
     }
     /**
-     * Gets the Next.js API route handler
-     * @returns route handler
+     * Gets the Content-Security-Policy header value
+     * @returns Content-Security-Policy header value
      */
-    getHandler() {
-        return this.handler;
+    getSCPHeader() {
+        return `frame-ancestors 'self' ${[getAllowedOriginsFromEnv(), ...EDITING_ALLOWED_ORIGINS].join(' ')}`;
     }
 }
 /**
- * @param {NextApiRequest} req
+ * Middleware / handler for use in the editing render Next.js API route (e.g. '/api/editing/render')
+ * which is required for Sitecore editing support.
  */
-export function extractEditingData(req) {
-    // Sitecore editors will send the following body data structure,
-    // though we're only concerned with the "args".
-    // {
-    //   id: 'JSS app name',
-    //   args: ['path', 'serialized layout data object', 'serialized viewbag object'],
-    //   functionName: 'renderView',
-    //   moduleName: 'server.bundle'
-    // }
-    // The 'serialized viewbag object' structure:
-    // {
-    //   language: 'language',
-    //   dictionary: 'key-value representation of tokens and their corresponding translations',
-    //   httpContext: 'serialized request data'
-    // }
-    var _a;
-    // Note req.body _should_ have already been parsed as JSON at this point (via Next.js `bodyParser` API middleware)
-    const payload = req.body;
-    if (!payload || !payload.args || !Array.isArray(payload.args) || payload.args.length < 3) {
-        throw new Error('Unable to extract editing data from request. Ensure `bodyParser` middleware is enabled on your Next.js API route.');
+export class EditingRenderMiddleware extends RenderMiddlewareBase {
+    /**
+     * @param {EditingRenderMiddlewareConfig} [config] Editing render middleware config
+     */
+    constructor(config) {
+        super();
+        this.config = config;
+        this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const { query, body, method, headers } = req;
+            debug.editing('editing render middleware start: %o', {
+                method,
+                query,
+                headers,
+                body,
+            });
+            if (!enforceCors(req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({
+                    html: `<html><body>Requests from origin ${(_a = req.headers) === null || _a === void 0 ? void 0 : _a.origin} not allowed</body></html>`,
+                });
+            }
+            // Validate secret
+            const secret = (_b = query[QUERY_PARAM_EDITING_SECRET]) !== null && _b !== void 0 ? _b : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
+            if (secret !== getJssEditingSecret()) {
+                debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, getJssEditingSecret());
+                return res.status(401).json({
+                    html: '<html><body>Missing or invalid secret</body></html>',
+                });
+            }
+            switch (req.method) {
+                case 'GET': {
+                    const handler = new MetadataHandler({ resolvePageUrl: (_c = this.config) === null || _c === void 0 ? void 0 : _c.resolvePageUrl });
+                    yield handler.render(req, res);
+                    break;
+                }
+                case 'POST': {
+                    const handler = new ChromesHandler(this.config);
+                    yield handler.render(req, res);
+                    break;
+                }
+                default:
+                    debug.editing('invalid method - sent %s expected GET/POST', req.method);
+                    res.setHeader('Allow', 'GET, POST');
+                    return res.status(405).json({
+                        html: `<html><body>Invalid request method '${req.method}'</body></html>`,
+                    });
+            }
+        });
+    }
+    /**
+     * Gets the Next.js API route handler
+     * @returns route handler
+     */
+    getHandler() {
+        return this.handler;
     }
-    const layoutData = JSON.parse(payload.args[1]);
-    const viewBag = JSON.parse(payload.args[2]);
-    // Keep backwards compatibility in case people use an older JSS version that doesn't send the path in the context
-    const path = (_a = layoutData.sitecore.context.itemPath) !== null && _a !== void 0 ? _a : viewBag.httpContext.request.path;
-    return {
-        path,
-        layoutData,
-        language: viewBag.language,
-        dictionary: viewBag.dictionary,
-    };
 }

package/dist/esm/editing/feaas-render-middleware.js

@@ -8,9 +8,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { debug } from '@sitecore-jss/sitecore-jss';
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
 import { RenderMiddlewareBase } from './render-middleware';
+import { enforceCors } from '@sitecore-jss/sitecore-jss/utils';
 /**
  * Middleware / handler for use in the feaas render Next.js API route (e.g. '/api/editing/feaas/render')
  * which is required for Sitecore editing support.
@@ -25,6 +26,7 @@ export class FEAASRenderMiddleware extends RenderMiddlewareBase {
         this.config = config;
         this.defaultPageUrl = '/feaas/render';
         this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _b;
             const { method, query, headers } = req;
             const startTimestamp = Date.now();
             debug.editing('feaas render middleware start: %o', {
@@ -32,6 +34,12 @@ export class FEAASRenderMiddleware extends RenderMiddlewareBase {
                 query,
                 headers,
             });
+            if (!enforceCors(req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res
+                    .status(401)
+                    .send(`<html><body>Requests from origin ${(_b = req.headers) === null || _b === void 0 ? void 0 : _b.origin} are not allowed</body></html>`);
+            }
             if (method !== 'GET') {
                 debug.editing('invalid method - sent %s expected GET', method);
                 res.setHeader('Allow', 'GET');

package/dist/esm/editing/index.js

@@ -1,6 +1,7 @@
+export { GraphQLEditingService } from '@sitecore-jss/sitecore-jss/editing';
 export { EditingDataDiskCache } from './editing-data-cache';
 export { EditingDataMiddleware } from './editing-data-middleware';
-export { EditingRenderMiddleware, } from './editing-render-middleware';
+export { EditingRenderMiddleware, isEditingMetadataPreviewData, } from './editing-render-middleware';
 export { BasicEditingDataService, ServerlessEditingDataService, editingDataService, } from './editing-data-service';
 export { VercelEditingDataCache } from './vercel-editing-data-cache';
 export { FEAASRenderMiddleware } from './feaas-render-middleware';

package/dist/esm/editing/render-middleware.js

@@ -1,4 +1,4 @@
-import { QUERY_PARAM_PROTECTION_BYPASS_SITECORE, QUERY_PARAM_PROTECTION_BYPASS_VERCEL, } from './constants';
+import { QUERY_PARAM_VERCEL_PROTECTION_BYPASS, QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE, EDITING_PASS_THROUGH_HEADERS, } from './constants';
 /**
  * Base class for middleware that handles pages and components rendering in Sitecore Editors.
  */
@@ -11,13 +11,27 @@ export class RenderMiddlewareBase {
          */
         this.getQueryParamsForPropagation = (query) => {
             const params = {};
-            if (query[QUERY_PARAM_PROTECTION_BYPASS_SITECORE]) {
-                params[QUERY_PARAM_PROTECTION_BYPASS_SITECORE] = query[QUERY_PARAM_PROTECTION_BYPASS_SITECORE];
+            if (query[QUERY_PARAM_VERCEL_PROTECTION_BYPASS]) {
+                params[QUERY_PARAM_VERCEL_PROTECTION_BYPASS] = query[QUERY_PARAM_VERCEL_PROTECTION_BYPASS];
             }
-            if (query[QUERY_PARAM_PROTECTION_BYPASS_VERCEL]) {
-                params[QUERY_PARAM_PROTECTION_BYPASS_VERCEL] = query[QUERY_PARAM_PROTECTION_BYPASS_VERCEL];
+            if (query[QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE]) {
+                params[QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE] = query[QUERY_PARAM_VERCEL_SET_BYPASS_COOKIE];
             }
             return params;
         };
+        /**
+         * Get headers that should be passed along to subsequent requests
+         * @param {IncomingHttpHeaders} headers Incoming HTTP Headers
+         * @returns Object of approved headers
+         */
+        this.getHeadersForPropagation = (headers) => {
+            const result = {};
+            EDITING_PASS_THROUGH_HEADERS.forEach((header) => {
+                if (headers[header]) {
+                    result[header] = headers[header];
+                }
+            });
+            return result;
+        };
     }
 }

package/dist/esm/index.js

@@ -1,5 +1,5 @@
 export { constants, AxiosDataFetcher, NativeDataFetcher, enableDebug, debug, } from '@sitecore-jss/sitecore-jss';
-export { LayoutServicePageState, GraphQLLayoutService, RestLayoutService, getChildPlaceholder, getFieldValue, RenderingType, EDITING_COMPONENT_PLACEHOLDER, EDITING_COMPONENT_ID, getContentStylesheetLink, } from '@sitecore-jss/sitecore-jss/layout';
+export { LayoutServicePageState, GraphQLLayoutService, RestLayoutService, getChildPlaceholder, getFieldValue, getContentStylesheetLink, EditMode, } from '@sitecore-jss/sitecore-jss/layout';
 export { mediaApi } from '@sitecore-jss/sitecore-jss/media';
 export { trackingApi, } from '@sitecore-jss/sitecore-jss/tracking';
 export { GraphQLDictionaryService, RestDictionaryService, } from '@sitecore-jss/sitecore-jss/i18n';
@@ -13,7 +13,6 @@ export { ComponentPropsReactContext, ComponentPropsContext, useComponentProps, }
 export { Link } from './components/Link';
 export { RichText } from './components/RichText';
 export { Placeholder } from './components/Placeholder';
-export { EditingComponentPlaceholder } from './components/EditingComponentPlaceholder';
 export { NextImage } from './components/NextImage';
 import * as FEaaSWrapper from './components/FEaaSWrapper';
 import * as BYOCWrapper from './components/BYOCWrapper';
@@ -21,4 +20,4 @@ export { FEaaSWrapper };
 export { BYOCWrapper };
 export { ComponentBuilder } from './ComponentBuilder';
 export { Context } from './context';
-export { Image, Text, DateField, EditFrame, FEaaSComponent, fetchFEaaSComponentServerProps, BYOCComponent, getComponentLibraryStylesheetLinks, File, VisitorIdentification, SitecoreContext, SitecoreContextReactContext, withSitecoreContext, useSitecoreContext, withEditorChromes, withPlaceholder, withDatasourceCheck, } from '@sitecore-jss/sitecore-jss-react';
+export { Image, Text, DateField, EditFrame, FEaaSComponent, fetchFEaaSComponentServerProps, BYOCComponent, getComponentLibraryStylesheetLinks, File, VisitorIdentification, SitecoreContext, SitecoreContextReactContext, withSitecoreContext, useSitecoreContext, withEditorChromes, withPlaceholder, withDatasourceCheck, withFieldMetadata, EditingScripts, } from '@sitecore-jss/sitecore-jss-react';

package/dist/esm/utils/index.js

@@ -1,2 +1,3 @@
 export { getPublicUrl, handleEditorFastRefresh } from './utils';
-export { tryParseEnvValue, isEditorActive, resetEditorChromes, resolveUrl, } from '@sitecore-jss/sitecore-jss/utils';
+export { tryParseEnvValue, resolveUrl } from '@sitecore-jss/sitecore-jss/utils';
+export { isEditorActive, resetEditorChromes } from '@sitecore-jss/sitecore-jss/editing';

package/dist/esm/utils/utils.js

@@ -1,4 +1,4 @@
-import { isEditorActive, resetEditorChromes } from '@sitecore-jss/sitecore-jss/utils';
+import { isEditorActive, resetEditorChromes } from '@sitecore-jss/sitecore-jss/editing';
 /**
  * Get the publicUrl.
  * This is used primarily to enable compatibility with Sitecore editors.