@softr/sdk 0.0.83 → 0.0.85-alpha.0

package/dist/auth/isomorphic.d.ts

@@ -14,14 +14,15 @@ import * as _tanstack_react_start0 from "@tanstack/react-start";
  * to read.
  *
  * Register it once, as a global request middleware in the app's `src/start.ts`.
- * It writes nothing but the session cookie.
+ * It writes the session cookie, and in production a header that stops other
+ * sites from embedding the app.
  *
  * @example
  * export const startInstance = createStart(() => ({
  *   requestMiddleware: [softrAuthMiddleware()],
  * }))
  */
-declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
+declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
   user: User | null;
   permissions: Permissions;
   formatting: Formatting;

package/dist/auth/isomorphic.js

@@ -9,6 +9,7 @@ import { settings } from "./methods/settings.js";
 import { bootErrorMiddleware } from "../boot-error.js";
 import { pwaMiddleware } from "../pwa.js";
 import { faviconMiddleware } from "../favicon.js";
+import { embeddingMiddleware } from "../embedding.js";
 import { createContext, useContext } from "react";
 import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
 import { getRequestHeader } from "@tanstack/react-start/server";
@@ -22,7 +23,8 @@ import { jsx } from "react/jsx-runtime";
 * to read.
 *
 * Register it once, as a global request middleware in the app's `src/start.ts`.
-* It writes nothing but the session cookie.
+* It writes the session cookie, and in production a header that stops other
+* sites from embedding the app.
 *
 * @example
 * export const startInstance = createStart(() => ({
@@ -31,6 +33,7 @@ import { jsx } from "react/jsx-runtime";
 */
 function softrAuthMiddleware() {
 	return createMiddleware({ type: "request" }).middleware([
+		embeddingMiddleware(),
 		bootErrorMiddleware(),
 		pwaMiddleware(),
 		faviconMiddleware()

package/dist/auth/platform.js

@@ -1,8 +1,8 @@
 import { assert, panic } from "../assertions.js";
 import { fetch } from "../fetch.js";
+import { softrConfig } from "../softr-config.js";
 import { permissionsSchema } from "./permissions.js";
 import { softrApiUrl } from "../softr-api.js";
-import { softrConfig } from "../softr-config.js";
 import { z } from "zod";
 
 //#region src/auth/platform.ts

package/dist/cookies.js

@@ -1,4 +1,5 @@
 import { softAssert } from "./assertions.js";
+import { softrConfig } from "./softr-config.js";
 import { getRequestHeader, getResponseHeaders, setResponseHeader } from "@tanstack/react-start/server";
 
 //#region src/cookies.ts
@@ -36,7 +37,7 @@ function serializeCookie(name, value, { maxAge, secure }) {
 	return parts.join("; ");
 }
 function sameSiteAttributes(secure) {
-	if (secure && process.env.NODE_ENV !== "production") return ["SameSite=None", "Partitioned"];
+	if (secure && (process.env.NODE_ENV !== "production" || softrConfig().allowEmbedding === true)) return ["SameSite=None", "Partitioned"];
 	return ["SameSite=Lax"];
 }
 const USER_TIMEZONE_COOKIE = "user-timezone";

package/dist/default-error-overlay.d.ts

@@ -1,4 +1,4 @@
-import * as react6 from "react";
+import * as react4 from "react";
 
 //#region src/default-error-overlay.d.ts
 type Props = {
@@ -8,6 +8,6 @@ type Props = {
 declare function DefaultErrorOverlay({
   error,
   reset
-}: Props): react6.JSX.Element;
+}: Props): react4.JSX.Element;
 //#endregion
 export { DefaultErrorOverlay };

package/dist/embedding.js

@@ -0,0 +1,24 @@
+import { softrConfig } from "./softr-config.js";
+import { createMiddleware } from "@tanstack/react-start";
+
+//#region src/embedding.ts
+/**
+* Stops other sites from showing the published app in an iframe, unless
+* softr.json sets `allowEmbedding`.
+*
+* Production only. The dev server runs in the preview pod, and Studio shows
+* that preview in an iframe on another site.
+*/
+function embeddingMiddleware() {
+	return createMiddleware({ type: "request" }).server(async ({ next }) => {
+		const result = await next();
+		if (process.env.NODE_ENV !== "production") return result;
+		if (softrConfig().allowEmbedding === true) return result;
+		const response = new Response(result.response.body, result.response);
+		response.headers.set("content-security-policy", "frame-ancestors 'self'");
+		return response;
+	});
+}
+
+//#endregion
+export { embeddingMiddleware };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start5 from "@tanstack/react-start";
+import * as _tanstack_react_start6 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -31,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start5.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start6.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -1,10 +1,10 @@
 import { assert } from "./assertions.js";
 import { fetch } from "./fetch.js";
+import { softrConfig } from "./softr-config.js";
 import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
 import { softrApiUrl } from "./softr-api.js";
 import { isDatasourceAction } from "./action.js";
-import { softrConfig } from "./softr-config.js";
 import { makePlatform } from "./auth/platform.js";
 import { ds } from "./datasource/datasource.js";
 import { z } from "zod";

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.83";
+var version = "0.0.85-alpha.0";
 
 //#endregion
 export { version };

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
-import * as react4 from "react";
+import * as react5 from "react";
 import "@tanstack/react-start";
 
 //#region src/pwa.d.ts
@@ -23,7 +23,7 @@ import "@tanstack/react-start";
  *   )
  * }
  */
-declare function SoftrPwaHead(): react4.FunctionComponentElement<react4.FragmentProps>;
+declare function SoftrPwaHead(): react5.FunctionComponentElement<react5.FragmentProps>;
 type PwaPlatform = "ios" | "android" | "desktop";
 type PwaInstall = {
   available: false;

package/dist/route/page.d.ts

@@ -14,6 +14,8 @@ type HeadContext = {
 };
 type HeadSetting<T> = T | ((ctx: HeadContext) => T | undefined);
 type PageSettings = {
+  /** Studio's label for the page, separate from its title. */
+  name?: string;
   visibility?: VisibilityRule;
   title?: HeadSetting<string>;
   description?: HeadSetting<string>;
@@ -29,7 +31,7 @@ type Page<S extends PageSettings = PageSettings> = S & {
   readonly [pageBrand]: "page";
 };
 /**
- * Declares a route's settings: who may open it, its title and its SEO tags.
+ * Declares a route's settings: its name in Studio, who may open it, its title and its SEO tags.
  *
  * One call per route file, at module scope, with an object literal. Studio
  * reads and rewrites each setting written out as a literal; a computed one is

package/dist/route/page.js

@@ -1,6 +1,6 @@
 //#region src/route/page.ts
 /**
-* Declares a route's settings: who may open it, its title and its SEO tags.
+* Declares a route's settings: its name in Studio, who may open it, its title and its SEO tags.
 *
 * One call per route file, at module scope, with an object literal. Studio
 * reads and rewrites each setting written out as a literal; a computed one is

package/dist/route/route.js

@@ -1,6 +1,6 @@
 import { panic } from "../assertions.js";
-import { ACCESS_REASONS, checkRule } from "./visibility.js";
 import { softrConfig } from "../softr-config.js";
+import { ACCESS_REASONS, checkRule } from "./visibility.js";
 import { redirect } from "@tanstack/react-router";
 
 //#region src/route/route.ts

package/dist/softr-config.schema.js

@@ -47,7 +47,8 @@ const SoftrConfigSchema = z.object({
 			alreadyAuthenticated: AccessBehaviour
 		})
 	}),
-	user: z.strictObject({ properties: z.record(z.string(), z.string()) }).optional()
+	user: z.strictObject({ properties: z.record(z.string(), z.string()) }).optional(),
+	allowEmbedding: z.boolean().optional()
 });
 function loadSoftrConfig(root) {
 	const file = path.join(root, SOFTR_CONFIG_FILE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.83",
+  "version": "0.0.85-alpha.0",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/schema/softr.schema.json

@@ -67,6 +67,10 @@
       },
       "required": ["properties"],
       "additionalProperties": false
+    },
+    "allowEmbedding": {
+      "type": "boolean",
+      "description": "Lets other sites show the published app in an iframe, signed-in pages included. Off by default."
     }
   },
   "required": ["auth"],

package/skills/softr-sdk/SKILL.md

@@ -145,3 +145,7 @@ type User = {
   userGroupIds: Array<SoftrUserGroupId>   // the app's own group ids
 }
 ```
+
+## Embedding the app in another site
+
+The published app refuses to load inside another site's iframe. The Studio preview is not affected. When the user asks to embed the app on their site, set `"allowEmbedding": true` in `softr.json`. Remove it to block embedding again. Sign-in then works inside the embed, with two limits to tell the user: Safari may not keep the visitor signed in, and links from emails (magic link, password reset) open the app in a new tab, not in the embed.