@softr/sdk 0.0.84 → 0.0.85-alpha.1

package/dist/auth/isomorphic.d.ts

@@ -14,14 +14,15 @@ import * as _tanstack_react_start0 from "@tanstack/react-start";
  * to read.
  *
  * Register it once, as a global request middleware in the app's `src/start.ts`.
- * It writes nothing but the session cookie.
+ * It writes the session cookie, and in production a header that stops other
+ * sites from embedding the app.
  *
  * @example
  * export const startInstance = createStart(() => ({
  *   requestMiddleware: [softrAuthMiddleware()],
  * }))
  */
-declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
+declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
   user: User | null;
   permissions: Permissions;
   formatting: Formatting;

package/dist/auth/isomorphic.js

@@ -9,6 +9,7 @@ import { settings } from "./methods/settings.js";
 import { bootErrorMiddleware } from "../boot-error.js";
 import { pwaMiddleware } from "../pwa.js";
 import { faviconMiddleware } from "../favicon.js";
+import { embeddingMiddleware } from "../embedding.js";
 import { createContext, useContext } from "react";
 import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
 import { getRequestHeader } from "@tanstack/react-start/server";
@@ -22,7 +23,8 @@ import { jsx } from "react/jsx-runtime";
 * to read.
 *
 * Register it once, as a global request middleware in the app's `src/start.ts`.
-* It writes nothing but the session cookie.
+* It writes the session cookie, and in production a header that stops other
+* sites from embedding the app.
 *
 * @example
 * export const startInstance = createStart(() => ({
@@ -31,6 +33,7 @@ import { jsx } from "react/jsx-runtime";
 */
 function softrAuthMiddleware() {
 	return createMiddleware({ type: "request" }).middleware([
+		embeddingMiddleware(),
 		bootErrorMiddleware(),
 		pwaMiddleware(),
 		faviconMiddleware()

package/dist/auth/platform.js

@@ -1,8 +1,8 @@
 import { assert, panic } from "../assertions.js";
 import { fetch } from "../fetch.js";
+import { softrConfig } from "../softr-config.js";
 import { permissionsSchema } from "./permissions.js";
 import { softrApiUrl } from "../softr-api.js";
-import { softrConfig } from "../softr-config.js";
 import { z } from "zod";
 
 //#region src/auth/platform.ts

package/dist/cookies.js

@@ -1,4 +1,5 @@
 import { softAssert } from "./assertions.js";
+import { softrConfig } from "./softr-config.js";
 import { getRequestHeader, getResponseHeaders, setResponseHeader } from "@tanstack/react-start/server";
 
 //#region src/cookies.ts
@@ -36,7 +37,7 @@ function serializeCookie(name, value, { maxAge, secure }) {
 	return parts.join("; ");
 }
 function sameSiteAttributes(secure) {
-	if (secure && process.env.NODE_ENV !== "production") return ["SameSite=None", "Partitioned"];
+	if (secure && (process.env.NODE_ENV !== "production" || softrConfig().allowEmbedding === true)) return ["SameSite=None", "Partitioned"];
 	return ["SameSite=Lax"];
 }
 const USER_TIMEZONE_COOKIE = "user-timezone";

package/dist/embedding.js

@@ -0,0 +1,24 @@
+import { softrConfig } from "./softr-config.js";
+import { createMiddleware } from "@tanstack/react-start";
+
+//#region src/embedding.ts
+/**
+* Stops other sites from showing the published app in an iframe, unless
+* softr.json sets `allowEmbedding`.
+*
+* Production only. The dev server runs in the preview pod, and Studio shows
+* that preview in an iframe on another site.
+*/
+function embeddingMiddleware() {
+	return createMiddleware({ type: "request" }).server(async ({ next }) => {
+		const result = await next();
+		if (process.env.NODE_ENV !== "production") return result;
+		if (softrConfig().allowEmbedding === true) return result;
+		const response = new Response(result.response.body, result.response);
+		response.headers.set("content-security-policy", "frame-ancestors 'self'");
+		return response;
+	});
+}
+
+//#endregion
+export { embeddingMiddleware };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start5 from "@tanstack/react-start";
+import * as _tanstack_react_start6 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -31,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start5.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start6.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -1,10 +1,10 @@
 import { assert } from "./assertions.js";
 import { fetch } from "./fetch.js";
+import { softrConfig } from "./softr-config.js";
 import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
 import { softrApiUrl } from "./softr-api.js";
 import { isDatasourceAction } from "./action.js";
-import { softrConfig } from "./softr-config.js";
 import { makePlatform } from "./auth/platform.js";
 import { ds } from "./datasource/datasource.js";
 import { z } from "zod";

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.84";
+var version = "0.0.85-alpha.1";
 
 //#endregion
 export { version };

package/dist/route/route.js

@@ -1,6 +1,6 @@
 import { panic } from "../assertions.js";
-import { ACCESS_REASONS, checkRule } from "./visibility.js";
 import { softrConfig } from "../softr-config.js";
+import { ACCESS_REASONS, checkRule } from "./visibility.js";
 import { redirect } from "@tanstack/react-router";
 
 //#region src/route/route.ts

package/dist/softr-config.schema.js

@@ -47,7 +47,8 @@ const SoftrConfigSchema = z.object({
 			alreadyAuthenticated: AccessBehaviour
 		})
 	}),
-	user: z.strictObject({ properties: z.record(z.string(), z.string()) }).optional()
+	user: z.strictObject({ properties: z.record(z.string(), z.string()) }).optional(),
+	allowEmbedding: z.boolean().optional()
 });
 function loadSoftrConfig(root) {
 	const file = path.join(root, SOFTR_CONFIG_FILE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.84",
+  "version": "0.0.85-alpha.1",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },

package/schema/softr.schema.json

@@ -67,6 +67,10 @@
       },
       "required": ["properties"],
       "additionalProperties": false
+    },
+    "allowEmbedding": {
+      "type": "boolean",
+      "description": "Lets other sites show the published app in an iframe, signed-in pages included. Off by default."
     }
   },
   "required": ["auth"],

package/skills/softr-sdk/SKILL.md

@@ -3,12 +3,13 @@ name: softr-sdk
 description: >-
   Entry point for @softr/sdk: its four entrypoints (@softr/sdk, /server,
   /client, /vite) and their client-server boundary, softrAuthMiddleware and the
-  Softr context, and which sub-skill covers each task. Load it when unsure which
-  sub-skill applies, or when touching the wiring.
+  Softr context, embedding the app in another site's iframe, and which sub-skill
+  covers each task. Load it when unsure which sub-skill applies, when touching
+  the wiring, or when the user wants the app embedded elsewhere.
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 # Softr SDK core
@@ -145,3 +146,7 @@ type User = {
   userGroupIds: Array<SoftrUserGroupId>   // the app's own group ids
 }
 ```
+
+## Embedding the app in another site
+
+The published app refuses to load inside another site's iframe. The Studio preview is not affected. When the user asks to embed the app on their site, set `"allowEmbedding": true` in `softr.json`. Remove it to block embedding again. Sign-in then works inside the embed, with two limits to tell the user: Safari may not keep the visitor signed in, and links from emails (magic link, password reset) open the app in a new tab, not in the embed.

package/skills/softr-sdk/auth/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `auth` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build.

package/skills/softr-sdk/charts-and-metrics/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/current-user/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 # The current user

package/skills/softr-sdk/file-uploads/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `upload` lives on `@softr/sdk/server` and runs inside server functions. `useFileUpload` and `FileItem` live on `@softr/sdk` and run in components. `FileAttachment` comes from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/formatting/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 # Dates, times and numbers

package/skills/softr-sdk/integrations/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `integration` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineIntegration` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/mcp/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `softrMcpMiddleware` lives on `@softr/sdk` and is registered once, in `src/start.ts`. The actions you hand it are the same `defineQuery` / `defineMutation` values the app's own pages use — declared wherever they already live, not duplicated for MCP.

package/skills/softr-sdk/pwa/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 # Installing the app

package/skills/softr-sdk/record-mutations/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineMutation` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/record-queries/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `ds` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler or a server-side route hook — importing it into a component fails the build. The same holds for any helper that calls `ds`: declare it inside the handler. A function at module level that calls `ds` keeps the server-only import in the browser bundle, and every page stops loading until it moves. `defineQuery` and every type come from `@softr/sdk` and can be imported anywhere.

package/skills/softr-sdk/region-visibility/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `Audience` and `defineVisibility` come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/routes-and-visibility/SKILL.md

@@ -8,7 +8,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `defineVisibility`, the access functions and the error predicates come from `@softr/sdk` and work anywhere.

package/skills/softr-sdk/workflows/SKILL.md

@@ -9,7 +9,7 @@ description: >-
 metadata:
   type: sub-skill
   library: softr-sdk
-  library_version: 0.0.84
+  library_version: 0.0.85-alpha.1
 ---
 
 **Boundary.** `workflow` lives on `@softr/sdk/server` and runs only inside a `createServerFn` handler — importing it into a component fails the build. `defineWorkflow` and every type come from `@softr/sdk` and can be imported anywhere.