@tideworthy/tidysites-platform 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.3.0
+
+- `tidyPlatform()` registers a middleware: with a `TIDY_FRAME_ANCESTORS` variable on the site (space-separated https origins), responses carry `Content-Security-Policy: frame-ancestors 'self' <origins>` in place of EmDash's `X-Frame-Options: SAMEORIGIN`, so the platform can embed the staging preview. Inert without the variable. New export `@tideworthy/tidysites-platform/middleware`.
+
 ## 0.2.1
 
 - Fix: `POST /_tidy/fill` failed every upsert with "internal error" because the content-only seed document carried a numeric version; the seed format's version is the string "1". The document is now validated before it is applied, so a shape problem answers 400 with the validator's paths. 0.2.0's fill route is unusable for writes; removals worked.

package/README.md

@@ -39,6 +39,10 @@ The worker entry stays EmDash's own:
 export { default, PluginBridge } from "@emdash-cms/cloudflare/worker";
 ```
 
+## Framing the staging preview
+
+EmDash answers every page with `X-Frame-Options: SAMEORIGIN` unless a Content-Security-Policy is present. `tidyPlatform()` registers a middleware that, when the site carries a `TIDY_FRAME_ANCESTORS` variable (space-separated https origins), replaces that header with `Content-Security-Policy: frame-ancestors 'self' <origins>` so the platform's website page can embed the site. Without the variable nothing changes.
+
 ## Bindings the routes read
 
 | Binding | Type | Purpose |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tideworthy/tidysites-platform",
-	"version": "0.2.1",
+	"version": "0.3.0",
 	"description": "The Tidysites platform integration for EmDash sites: bootstrap, sessions, maintenance, health, and publish hooks under /_tidy/*.",
 	"license": "MIT",
 	"type": "module",
@@ -18,6 +18,7 @@
 	"exports": {
 		".": "./src/index.ts",
 		"./plugin": "./src/plugin.ts",
+		"./middleware": "./src/middleware.ts",
 		"./client": "./src/client.ts",
 		"./routes/bootstrap": "./src/routes/bootstrap.ts",
 		"./routes/session": "./src/routes/session.ts",

package/src/index.ts

@@ -31,13 +31,18 @@ export const PLATFORM_ROUTES = [
 	{ pattern: "/_tidy/maintenance", entrypoint: `${PACKAGE}/routes/maintenance` }
 ] as const;
 
-/** Astro integration: registers every platform route as a server route. */
+/**
+ * Astro integration: registers every platform route as a server route and the
+ * framing middleware (a `frame-ancestors` policy from TIDY_FRAME_ANCESTORS so
+ * the platform can embed the staging preview; inert without the variable).
+ */
 export function tidyPlatform(): AstroIntegration {
 	return {
 		name: PACKAGE,
 		hooks: {
-			"astro:config:setup": ({ injectRoute }) => {
+			"astro:config:setup": ({ injectRoute, addMiddleware }) => {
 				for (const route of PLATFORM_ROUTES) injectRoute({ pattern: route.pattern, entrypoint: route.entrypoint, prerender: false });
+				addMiddleware({ entrypoint: `${PACKAGE}/middleware`, order: "pre" });
 			}
 		}
 	};

package/src/lib/frame.ts

@@ -0,0 +1,26 @@
+/**
+ * Framing policy. EmDash's middleware sets `X-Frame-Options: SAMEORIGIN` on
+ * every response that has no Content-Security-Policy, which keeps the
+ * platform's website page from embedding the staging preview. When the site
+ * carries a TIDY_FRAME_ANCESTORS variable (space-separated origins), responses
+ * get a `frame-ancestors` policy naming them instead. Nothing changes without
+ * the variable.
+ */
+const ORIGIN = /^https:\/\/[a-z0-9.-]+(?::\d+)?$/i;
+
+/** The origins allowed to frame the site, from the variable's value; invalid entries are dropped. */
+export function frameAncestors(value: unknown): string[] {
+	if (typeof value !== "string") return [];
+	return [...new Set(value.split(/[\s,]+/).map((s) => s.trim()).filter((s) => ORIGIN.test(s)))];
+}
+
+/** Apply the policy to a response's headers. Returns true when something changed. */
+export function applyFramePolicy(headers: Headers, ancestors: string[]): boolean {
+	if (ancestors.length === 0) return false;
+	const existing = headers.get("Content-Security-Policy");
+	if (existing && /frame-ancestors/i.test(existing)) return false;
+	const directive = `frame-ancestors 'self' ${ancestors.join(" ")}`;
+	headers.set("Content-Security-Policy", existing ? `${existing.replace(/;?\s*$/, "")}; ${directive}` : directive);
+	headers.delete("X-Frame-Options");
+	return true;
+}

package/src/middleware.ts

@@ -0,0 +1,20 @@
+/** Astro middleware registered by tidyPlatform(): the framing policy from TIDY_FRAME_ANCESTORS. */
+import type { MiddlewareHandler } from "astro";
+import { workerEnv } from "./lib/env";
+import { applyFramePolicy, frameAncestors } from "./lib/frame";
+
+export const onRequest: MiddlewareHandler = async (_context, next) => {
+	const response = await next();
+	const env = await workerEnv();
+	const ancestors = frameAncestors(env?.TIDY_FRAME_ANCESTORS);
+	if (ancestors.length === 0) return response;
+	// Response headers can be immutable (static assets, redirects); rebuild when so.
+	try {
+		applyFramePolicy(response.headers, ancestors);
+		return response;
+	} catch {
+		const copy = new Response(response.body, response);
+		applyFramePolicy(copy.headers, ancestors);
+		return copy;
+	}
+};

package/src/version.ts

@@ -1,3 +1,3 @@
 /** Kept in step with package.json by the release checklist in MAINTAINING.md. */
-export const VERSION = "0.2.1";
+export const VERSION = "0.3.0";
 export const PLUGIN_ID = "tidy-platform";