@wix/origami-site 0.1.21 → 0.1.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/origami-site",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Runs an exported Wix origami site: file-based routing, Wix dynamic pages, popups and build checks. Use with @wix/origami-site-astro or @wix/origami-site-express.",
   "type": "module",
   "files": [
@@ -93,5 +93,5 @@
       "optional": true
     }
   },
-  "falconPackageHash": "e514bdb7045f0acc5bb6538bca6aa81fdd740d9a7d70429ebf1309b5"
+  "falconPackageHash": "1930df8fc74e8e5420dac341ec1276d9ee8314849dccf88de790697c"
 }

package/src/server/embeds/embedsForPage.js

@@ -0,0 +1,12 @@
+/** The three HTML strings for one page. An embed with a page filter is left out of a page with no id.
+ * The custom embeds API sends no pageFilter today (only app site embeds have one), so every embed shows on every
+ * page; the filter is kept for parity with wix-next's site-express-export scriptsEmbeds.js.
+ * @param {import('./protocol.js').CustomEmbed[]} embeds @param {string | undefined} pageId @returns {import('../index.js').PageEmbeds} */
+export function embedsForPage(embeds, pageId) {
+    const shown = embeds.filter(embed => {
+        const pageIds = embed.pageFilter?.pageIds
+        return !pageIds || (pageId !== undefined && pageIds.includes(pageId))
+    })
+    const join = position => shown.filter(embed => embed.position === position).map(embed => embed.embedData?.html ?? '').join('\n')
+    return { head: join('HEAD'), bodyStart: join('BODY_START'), bodyEnd: join('BODY_END') }
+}

package/src/server/embeds/index.js

@@ -0,0 +1,61 @@
+import { fetchAnonymousToken } from '../tokens/builderAuthTokenProvider.js'
+import { EmbedsHttpError, fetchEssentialEmbeds } from './protocol.js'
+import { embedsForPage } from './embedsForPage.js'
+
+export const noEmbeds = Object.freeze({ head: '', bodyStart: '', bodyEnd: '' })
+
+/** Site embeds, kept in memory. Embeds are site data, not visitor data, so one site token and one list serve
+ * every visitor. A stale list is served while a background refresh runs; a failure never blocks or breaks a
+ * page: it is logged and the last list (or none) is served until the next attempt.
+ * @param {{ clientId: string, wixApiBaseUrl: string, fetch: typeof fetch, logger: import('../index.js').Logger, ttlMs?: number, timeoutMs?: number }} options */
+export function createEmbeds({ clientId, wixApiBaseUrl, fetch, logger, ttlMs = 60_000, timeoutMs = 2_000 }) {
+    /** @type {import('./protocol.js').CustomEmbed[]} */
+    let embeds = []
+    let checkedAt = -Infinity
+    /** @type {Promise<void> | undefined} */
+    let refreshing
+    /** @type {{ accessToken: string, expiresAt: number } | undefined} */
+    let token
+    let warned = false
+    /** @param {AbortSignal} signal */
+    async function siteToken(signal) {
+        if (token && token.expiresAt > Date.now()) return token.accessToken
+        const fresh = await fetchAnonymousToken({ clientId, wixApiBaseUrl, fetch, signal })
+        // A minute early, so a token never expires between this check and the call.
+        token = { accessToken: fresh.accessToken, expiresAt: Date.now() + fresh.expiresInMs - 60_000 }
+        return token.accessToken
+    }
+    function refresh() {
+        refreshing ??= (async () => {
+            // One budget for the token and the list together: the first page waits at most timeoutMs.
+            const signal = AbortSignal.timeout(timeoutMs)
+            try {
+                embeds = await fetchEssentialEmbeds({ token: await siteToken(signal), wixApiBaseUrl, fetch, signal })
+            } catch (error) {
+                // Only a rejected token is dropped; an outage of the embeds service keeps it until it expires.
+                if (error instanceof EmbedsHttpError && (error.status === 401 || error.status === 403)) token = undefined
+                logger.error(`Wix custom embeds are unavailable; serving ${embeds.length ? 'the last list' : 'pages without them'}. ${error instanceof Error ? error.message : error}`)
+            } finally {
+                checkedAt = Date.now()
+                refreshing = undefined
+            }
+        })()
+        return refreshing
+    }
+    return {
+        /** @param {string | undefined} pageId @returns {Promise<import('../index.js').PageEmbeds>} */
+        async forPage(pageId) {
+            if (!clientId) {
+                if (!warned) logger.warn('VITE_WIX_CLIENT_ID is not set, so pages are served without Wix custom embeds.')
+                warned = true
+                return noEmbeds
+            }
+            if (Date.now() - checkedAt >= ttlMs) {
+                const pending = refresh()
+                // Only the very first list is waited for; later ones refresh in the background.
+                if (checkedAt === -Infinity) await pending
+            }
+            return embedsForPage(embeds, pageId)
+        },
+    }
+}

package/src/server/embeds/protocol.js

@@ -0,0 +1,26 @@
+// The Wix custom embeds API, in one file. Piler parity (wix-next builder-site-embeds api.ts): only enabled
+// ESSENTIAL embeds go into the server HTML. The others need the visitor's consent first.
+
+/** @typedef {{ id?: string, enabled?: boolean, position?: 'HEAD' | 'BODY_START' | 'BODY_END', pageFilter?: { pageIds?: string[] }, embedData?: { category?: string, html?: string } }} CustomEmbed */
+
+const isStringList = value => Array.isArray(value) && value.every(item => typeof item === 'string')
+/** One malformed embed is dropped, so it can never break the pages the others are planted in. */
+const isWellFormed = embed => typeof embed?.embedData?.html === 'string' &&
+    (embed.pageFilter?.pageIds === undefined || isStringList(embed.pageFilter.pageIds))
+
+export class EmbedsHttpError extends Error {
+    /** @param {number} status */
+    constructor(status) { super(`The custom embeds request answered HTTP ${status}.`); this.status = status }
+}
+
+/** @param {{ token: string, wixApiBaseUrl: string, fetch: typeof fetch, signal: AbortSignal }} options @returns {Promise<CustomEmbed[]>} */
+export async function fetchEssentialEmbeds({ token, wixApiBaseUrl, fetch, signal }) {
+    const response = await fetch(new URL('/embeds/v1/custom-embeds', wixApiBaseUrl), { headers: { authorization: `Bearer ${token}` }, signal })
+    if (!response.ok) throw new EmbedsHttpError(response.status)
+    const body = await response.json()
+    // A bad body throws, so the last good list is kept; an empty list may come back as {}, with no customEmbeds.
+    if (typeof body !== 'object' || body === null || Array.isArray(body)) throw new Error('The custom embeds response is not an object.')
+    const { customEmbeds } = body
+    if (customEmbeds !== undefined && !Array.isArray(customEmbeds)) throw new Error('The custom embeds response has no customEmbeds list.')
+    return (customEmbeds ?? []).filter(embed => embed?.enabled !== false && embed?.embedData?.category === 'ESSENTIAL' && isWellFormed(embed))
+}

package/src/server/index.d.ts

@@ -15,6 +15,7 @@ export type SiteOptions = {
   fetch?: typeof fetch               // tests inject a fake
   wixApiBaseUrl?: string             // default 'https://www.wixapis.com'; the conformance suite points it at the fake
   routerTimeoutMs?: number           // default 5000
+  embeds?: false | { ttlMs?: number; timeoutMs?: number }   // Wix custom embeds; default { ttlMs: 60000, timeoutMs: 2000 }; false: none
   logger?: Logger                    // default: console with an [origami] prefix
 }
 
@@ -39,9 +40,12 @@ export type RouteMatch =
   | { kind: 'notFound' }
 
 export type Resolution =
-  | { kind: 'page'; status: 200 | 404; page: PageRef; data: PageData; headers: Headers }
+  | { kind: 'page'; status: 200 | 404; page: PageRef; data: PageData; headers: Headers; embeds: PageEmbeds }
   | { kind: 'response'; response: Response }   // redirects, reserved endpoints, 405, 503
 
+/** The page's essential Wix custom embeds, as HTML for the end of <head>, the start of <body> and the end of <body>. */
+export type PageEmbeds = { head: string; bodyStart: string; bodyEnd: string }
+
 export type PageRef = { key: string; itemPath?: string; title: string }
 
 export type PageData = {

package/src/server/requests/createSite.js

@@ -3,6 +3,7 @@ import { readSiteTree } from '../site-tree/readSiteTree.js'
 import { callRouter } from '../router/index.js'
 import { pickRolePage } from '../router/pickRolePage.js'
 import { builderAuthTokenProvider } from '../tokens/builderAuthTokenProvider.js'
+import { createEmbeds, noEmbeds } from '../embeds/index.js'
 import { RouterServiceError, SiteTreeError } from './errors.js'
 import { normalizeRequestPath } from './urlPath.js'
 import { canBePagePath } from './canBePagePath.js'
@@ -25,6 +26,7 @@ export async function createSite(options) {
         wixApiBaseUrl = 'https://www.wixapis.com', routerTimeoutMs = 5000,
     } = options
     const tokens = options.tokens ?? builderAuthTokenProvider({ clientId: wix.clientId, siteId: wix.siteId, wixApiBaseUrl, fetch })
+    const embeds = options.embeds === false ? null : createEmbeds({ clientId: wix.clientId, wixApiBaseUrl, fetch, logger, ...options.embeds })
     /** Fail closed: a rule with no handler stops the site instead of serving the page open.
      * @param {{ itemPath: string, access: import('@wix/origami-types').AccessRule[] }} route */
     const handlerFor = (route, rule) => {
@@ -75,13 +77,16 @@ export async function createSite(options) {
             if (response) return { kind: /** @type {const} */ ('response'), response }
         }
     }
-    /** @param {{ key: string, title: string, itemPath?: string }} route @param {200 | 404} status
+    /** @param {{ key: string, title: string, itemPath?: string, pageId?: string }} route @param {200 | 404} status
      * @param {import('../index.js').PageData['route']} routeData @param {Record<string, unknown>} services @param {HeadersInit} [headers] */
-    function pageResolution(route, status, routeData, services = {}, headers = {}) {
+    async function pageResolution(route, status, routeData, services = {}, headers = {}) {
         const page = { key: route.key, title: route.title, ...(route.itemPath === undefined ? {} : { itemPath: route.itemPath }) }
         // Identity and dynamic-route configs use different services; merge per service if server layers ever overlap.
         const identity = wix.siteId ? { '@wix/viewer-service-environment': { metaSiteId: wix.siteId } } : {}
-        return { kind: /** @type {const} */ ('page'), status, page, data: { page: page.key, route: routeData, services: { ...identity, ...services } }, headers: new Headers(headers) }
+        return {
+            kind: /** @type {const} */ ('page'), status, page, data: { page: page.key, route: routeData, services: { ...identity, ...services } }, headers: new Headers(headers),
+            embeds: embeds ? await embeds.forPage(route.pageId) : noEmbeds,
+        }
     }
     /** @param {Extract<import('../index.js').RouteMatch, { kind: 'router' }>} match @param {URL} url @param {string} path */
     async function resolveRouter(match, url, path, current, request, context) {
@@ -133,6 +138,8 @@ export async function createSite(options) {
                     if (path === '/_origami' || path?.startsWith('/_origami/')) {
                         return { kind: 'response', response: new Response(null, { status: 404 }) }
                     }
+                    // Starts the first embeds fetch now, so it runs alongside the router call.
+                    embeds?.forPage(undefined)
                     let current = await table()
                     let match = matchPath(path, current)
                     if (match.kind === 'notFound' && path !== undefined && tree && canBePagePath(path)) {

package/src/server/site-tree/readSiteTree.js

@@ -145,7 +145,7 @@ export const readSiteTree = async root => {
         if (routers.some(router => Object.values(router.rolePages).some(page => page.itemPath === itemPath))) continue
         const path = `src/${itemPath}`
         const metadata = pageMetadata(resolve(src, itemPath))
-        if (itemPath === 'pages/error404') notFound = { key: itemPath, itemPath, title: metadata.title }
+        if (itemPath === 'pages/error404') notFound = { key: itemPath, itemPath, ...metadata }
         else {
             const url = pageUrl(itemPath)
             const previous = pathsByUrl.get(url)

package/src/server/tokens/builderAuthTokenProvider.js

@@ -8,6 +8,22 @@ const cookie = (header, name) => {
     }
 }
 
+/** A new anonymous visitor token for the site's OAuth app.
+ * @param {{ clientId: string, wixApiBaseUrl: string, fetch: typeof fetch, signal: AbortSignal }} options
+ * @returns {Promise<{ accessToken: string, expiresInMs: number }>} */
+export async function fetchAnonymousToken({ clientId, wixApiBaseUrl, fetch, signal }) {
+    if (!clientId) throw new Error('VITE_WIX_CLIENT_ID is not set, so there is no Wix visitor token.')
+    const response = await fetch(new URL('/oauth2/token', wixApiBaseUrl), {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ client_id: clientId, grant_type: 'anonymous' }),
+        signal,
+    })
+    if (!response.ok) throw new Error(`The anonymous token request answered HTTP ${response.status}.`)
+    const { access_token: accessToken, expires_in: expiresIn } = await response.json()
+    if (typeof accessToken !== 'string' || !accessToken) throw new Error('The anonymous token response has no access_token.')
+    return { accessToken, expiresInMs: (Number(expiresIn) || 0) * 1000 }
+}
+
 /** The visitor's own builder-auth token when the cookie is there and fresh; otherwise a one-off anonymous token.
  * Stores nothing and sets no cookie: builder-auth in the browser keeps owning the visitor's tokens.
  * @param {{ clientId: string, siteId: string, wixApiBaseUrl?: string, fetch?: typeof fetch, timeoutMs?: number }} options
@@ -19,16 +35,7 @@ export function builderAuthTokenProvider({ clientId, siteId, wixApiBaseUrl = 'ht
             const token = cookie(header, `wix_access_token_${siteId}`)
             const expiresAt = Number(cookie(header, `wix_token_expires_at_${siteId}`))
             if (token && expiresAt > Date.now()) return token
-            if (!clientId) throw new Error('VITE_WIX_CLIENT_ID is not set, so there is no visitor token for the Wix router.')
-            const response = await fetch(new URL('/oauth2/token', wixApiBaseUrl), {
-                method: 'POST', headers: { 'content-type': 'application/json' },
-                body: JSON.stringify({ client_id: clientId, grant_type: 'anonymous' }),
-                signal: AbortSignal.timeout(timeoutMs),
-            })
-            if (!response.ok) throw new Error(`The anonymous token request answered HTTP ${response.status}.`)
-            const { access_token: accessToken } = await response.json()
-            if (typeof accessToken !== 'string' || !accessToken) throw new Error('The anonymous token response has no access_token.')
-            return accessToken
+            return (await fetchAnonymousToken({ clientId, wixApiBaseUrl, fetch, signal: AbortSignal.timeout(timeoutMs) })).accessToken
         },
     }
 }

package/src/types/index.d.ts

@@ -42,7 +42,7 @@ export type BuildResult = { ok: true; output: string } | { ok: false; output: st
 
 /** Core contracts only; runtime APIs belong to @wix/origami-site/server. */
 export type {
-  SiteOptions, OrigamiSite, RouteMatch, Resolution, PageRef, PageData,
+  SiteOptions, OrigamiSite, RouteMatch, Resolution, PageRef, PageData, PageEmbeds,
   RequestContext, TokenProvider, AccessRule, AccessSource, AccessHandler,
   Logger, SiteTreeError, RouterServiceError,
 } from '../server/index.js'