@tuturuuu/utils 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.15.1](https://github.com/tutur3u/platform/compare/utils-v0.15.0...utils-v0.15.1) (2026-07-13)
+
+
+### Bug Fixes
+
+* **contacts:** restore group post mutations ([fe621e4](https://github.com/tutur3u/platform/commit/fe621e4d7e4126f705082cc3e815aafdeebe535a))
+* **security:** prevent clickjacking across apps ([c8ed36e](https://github.com/tutur3u/platform/commit/c8ed36e708c08ebe3b17ee7f6249513644108c48))
+
 ## [0.15.0](https://github.com/tutur3u/platform/compare/utils-v0.14.0...utils-v0.15.0) (2026-07-11)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.27.3",
     "@tuturuuu/google": "0.0.3",
     "@tuturuuu/icons": "0.0.6",
-    "@tuturuuu/internal-api": "0.17.0",
+    "@tuturuuu/internal-api": "0.18.0",
     "@tuturuuu/supabase": "0.4.0",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
@@ -45,7 +45,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.16.0",
+    "@tuturuuu/types": "0.17.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.1.1",

package/src/next-config.test.ts

@@ -1,3 +1,4 @@
+import { tryToParsePath } from 'next/dist/lib/try-to-parse-path';
 import { describe, expect, it } from 'vitest';
 import {
   createTuturuuuNextConfig,
@@ -40,6 +41,97 @@ describe('createTuturuuuNextConfig', () => {
     });
   });
 
+  it('protects responses from framing by default', async () => {
+    const config = createTuturuuuNextConfig();
+
+    await expect(config.headers?.()).resolves.toEqual([
+      {
+        source:
+          '/:path((?!api/v1/workspaces/[^/]+/external-projects/assets/[^/]+/webgl(?:/|$)).*)',
+        headers: [
+          {
+            key: 'Content-Security-Policy',
+            value: "frame-ancestors 'none'",
+          },
+          {
+            key: 'X-Frame-Options',
+            value: 'DENY',
+          },
+        ],
+      },
+    ]);
+  });
+
+  it('preserves app-specific response headers after shared security headers', async () => {
+    const config = createTuturuuuNextConfig({
+      async headers() {
+        return [
+          {
+            source: '/login',
+            headers: [
+              {
+                key: 'Cache-Control',
+                value: 'public, max-age=0, must-revalidate',
+              },
+              {
+                key: 'X-Robots-Tag',
+                value: 'noindex, nofollow',
+              },
+            ],
+          },
+        ];
+      },
+    });
+
+    const headers = await config.headers?.();
+
+    expect(headers).toHaveLength(2);
+    expect(headers?.[1]).toEqual({
+      source: '/login',
+      headers: [
+        {
+          key: 'Cache-Control',
+          value: 'public, max-age=0, must-revalidate',
+        },
+        {
+          key: 'X-Robots-Tag',
+          value: 'noindex, nofollow',
+        },
+      ],
+    });
+  });
+
+  it('exempts only the sandboxed CMS WebGL asset route from anti-framing headers', async () => {
+    const config = createTuturuuuNextConfig();
+    const [antiFramingRule] = (await config.headers?.()) ?? [];
+    const parsedPath = tryToParsePath(antiFramingRule?.source ?? '');
+
+    expect(parsedPath.error).toBeUndefined();
+    expect(parsedPath.regexStr).toBeDefined();
+
+    const routePattern = new RegExp(parsedPath.regexStr ?? '');
+
+    expect(routePattern.test('/')).toBe(true);
+    expect(routePattern.test('/login')).toBe(true);
+    expect(routePattern.test('/en/workspace')).toBe(true);
+    expect(routePattern.test('/api/billing/workspace/invoice')).toBe(true);
+    expect(
+      routePattern.test(
+        '/api/v1/workspaces/workspace-id/external-projects/assets/asset-id/webgl/index.html'
+      )
+    ).toBe(false);
+    expect(
+      routePattern.test(
+        '/api/v1/workspaces/workspace-id/external-projects/assets/asset-id/webgl'
+      )
+    ).toBe(false);
+    expect(
+      routePattern.test(
+        '/api/v1/workspaces/workspace-id/external-projects/assets/asset-id/webgl-preview'
+      )
+    ).toBe(true);
+  });
+
   it('allows the exact worktree-prefixed Portless host for Next dev assets', () => {
     const originalPortlessUrl = process.env.PORTLESS_URL;
 

package/src/next-config.ts

@@ -33,6 +33,20 @@ export const TUTURUUU_NEXT_IMAGE_REMOTE_PATTERNS = [
   },
 ] satisfies NextImageRemotePattern[];
 
+const TUTURUUU_ANTI_FRAMING_SOURCE =
+  '/:path((?!api/v1/workspaces/[^/]+/external-projects/assets/[^/]+/webgl(?:/|$)).*)';
+
+const TUTURUUU_ANTI_FRAMING_HEADERS = [
+  {
+    key: 'Content-Security-Policy',
+    value: "frame-ancestors 'none'",
+  },
+  {
+    key: 'X-Frame-Options',
+    value: 'DENY',
+  },
+];
+
 function mergeStringArrays(
   first: readonly string[] | undefined,
   second: readonly string[] | undefined
@@ -107,6 +121,15 @@ export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
         experimentalConfig.optimizePackageImports
       ),
     },
+    async headers() {
+      return [
+        {
+          source: TUTURUUU_ANTI_FRAMING_SOURCE,
+          headers: TUTURUUU_ANTI_FRAMING_HEADERS,
+        },
+        ...((await config.headers?.()) ?? []),
+      ];
+    },
   };
 }
 

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.21.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.22.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.21.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.22.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */