canopycms-next 0.0.68-int.97 → 0.0.68-int.98

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -64,8 +64,9 @@ export interface CreatePreviewPageOptions {
64
64
  */
65
65
  views: Record<string, PreviewView | ErasedPreviewViewWithLoader>;
66
66
  /**
67
- * Editor origin to trust, for an editor on another origin. Defaults to the page's own. The
68
- * viewer must still be signed in on this page's origin: an anonymous request is a 404.
67
+ * Editor origin to trust, for an editor on another origin. Defaults to the page's own. A
68
+ * request without the viewer's session is a 404, and a `SameSite=Lax` session cookie reaches a
69
+ * framed page only from an editor on the same site, so a cross-site editor previews nothing.
69
70
  */
70
71
  editorOrigin?: string;
71
72
  }
@@ -35,8 +35,8 @@ export function createPreviewPageFor(getCanopy, options, deployedAs = 'server')
35
35
  if (Array.isArray(branch))
36
36
  notFound();
37
37
  const canopy = await getCanopy();
38
- // ACLs alone would let an anonymous user read the base branch, and this route sits under the
39
- // editor's paths, which a site-wide gate exempts because the editor's sign-in guards them.
38
+ // Branch ACLs can grant an anonymous user the base branch, and this route is deployed like the
39
+ // editor's routes (canopycms-cdk's `attachTo` `previewPrefix`), outside any site-wide gate.
40
40
  if (canopy.user.type === 'anonymous')
41
41
  notFound();
42
42
  const result = await canopy.readByUrlPath(`/${path.join('/')}`, { branch });
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "canopycms-next",
3
- "version": "0.0.68-int.97",
3
+ "version": "0.0.68-int.98",
4
4
  "description": "Next.js adapter for CanopyCMS",
5
5
  "license": "MIT",
6
6
  "repository": {
@@ -38,7 +38,7 @@
38
38
  "peerDependencies": {
39
39
  "next": "^13.5.7 || ^14.2.25 || ^15.5.21 || >=16.0.0 <16.2.0 || >=16.3.0 <17.0.0",
40
40
  "react": "^18.0.0 || ^19.0.0",
41
- "canopycms": "0.0.68-int.97"
41
+ "canopycms": "0.0.68-int.98"
42
42
  },
43
43
  "devDependencies": {
44
44
  "@types/node": "^22.9.0",
@@ -48,7 +48,7 @@
48
48
  "react": "^18.3.1",
49
49
  "typescript": "^5.6.3",
50
50
  "vitest": "^4.1.0",
51
- "canopycms": "0.0.68-int.97"
51
+ "canopycms": "0.0.68-int.98"
52
52
  },
53
53
  "scripts": {
54
54
  "build": "rm -rf dist && tsc -p tsconfig.build.json && node ../../scripts/add-js-extensions.mjs dist && esbuild src/config.ts --bundle --platform=node --packages=external --external:next --format=cjs --outfile=dist/config.cjs && esbuild src/config.ts --bundle --platform=node --packages=external --external:next --format=esm --outfile=dist/config.mjs",