create-brainerce-store 1.28.8 → 1.28.10

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "create-brainerce-store",
-      version: "1.28.8",
+      version: "1.28.10",
       description: "Scaffold a production-ready e-commerce storefront connected to Brainerce",
       bin: {
         "create-brainerce-store": "dist/index.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-brainerce-store",
-  "version": "1.28.8",
+  "version": "1.28.10",
   "description": "Scaffold a production-ready e-commerce storefront connected to Brainerce",
   "bin": {
     "create-brainerce-store": "dist/index.js"

package/templates/nextjs/base/next.config.ts

@@ -24,7 +24,11 @@ const nextConfig: NextConfig = {
             value: 'max-age=63072000; includeSubDomains; preload',
           },
           { key: 'X-Content-Type-Options', value: 'nosniff' },
-          { key: 'X-Frame-Options', value: 'DENY' },
+          // SAMEORIGIN (not DENY) so iframe-based payment providers (e.g. Cardcom)
+          // can redirect the iframe back to /payment-complete on the storefront
+          // itself after a successful charge — the postMessage relay needs the
+          // parent frame to be able to render our own same-origin page.
+          { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
           { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
           {
             key: 'Permissions-Policy',

package/templates/nextjs/base/src/app/products/[slug]/page.tsx

@@ -1,4 +1,5 @@
 import type { Metadata } from 'next';
+import { headers } from 'next/headers';
 import { notFound } from 'next/navigation';
 import { getServerClient } from '@/lib/brainerce';
 import { ProductJsonLd } from '@/components/seo/product-json-ld';
@@ -8,12 +9,19 @@ type Props = {
   params: Promise<{ slug: string }>;
 };
 
+// Read the locale the middleware set on this request so the SDK can resolve
+// translated slugs (translations[locale].slug) in addition to the base slug.
+async function getRequestLocale(): Promise<string | undefined> {
+  return (await headers()).get('x-locale') ?? undefined;
+}
+
 export async function generateMetadata({ params }: Props): Promise<Metadata> {
   const { slug } = await params;
+  const locale = await getRequestLocale();
 
   try {
     const client = getServerClient();
-    const product = await client.getProductBySlug(slug);
+    const product = await client.getProductBySlug(slug, { locale });
     const imageUrl = product.images?.[0]?.url;
     const description = product.description?.substring(0, 160) || product.name;
 
@@ -45,11 +53,12 @@ export async function generateMetadata({ params }: Props): Promise<Metadata> {
 
 export default async function ProductDetailPage({ params }: Props) {
   const { slug } = await params;
+  const locale = await getRequestLocale();
 
   let product;
   try {
     const client = getServerClient();
-    product = await client.getProductBySlug(slug);
+    product = await client.getProductBySlug(slug, { locale });
   } catch {
     notFound();
   }

package/templates/nextjs/base/src/middleware.ts.ejs

@@ -35,7 +35,10 @@ function buildCsp(nonce: string): string {
     "frame-src 'self' https://meshulam.co.il https://*.meshulam.co.il https://grow.link https://*.grow.link https://grow.security https://*.grow.security https://creditguard.co.il https://*.creditguard.co.il https://js.stripe.com https://hooks.stripe.com https://pay.google.com https://secure.cardcom.solutions https://checkout.stripe.com https://www.paypal.com https://www.sandbox.paypal.com",
     "connect-src 'self' https://*.meshulam.co.il https://grow.link https://*.grow.link https://*.grow.security https://pay.google.com https://*.stripe.com https://*.creditguard.co.il",
     "worker-src 'self' blob:",
-    "frame-ancestors 'none'",
+    // 'self' (not 'none') so iframe-based payment providers (e.g. Cardcom)
+    // can redirect the iframe back to /payment-complete on the storefront
+    // itself after a successful charge.
+    "frame-ancestors 'self'",
     "base-uri 'self'",
     "form-action 'self'",
     "object-src 'none'",
@@ -149,7 +152,10 @@ function buildCsp(nonce: string): string {
     "frame-src 'self' https://meshulam.co.il https://*.meshulam.co.il https://grow.link https://*.grow.link https://grow.security https://*.grow.security https://creditguard.co.il https://*.creditguard.co.il https://js.stripe.com https://hooks.stripe.com https://pay.google.com https://secure.cardcom.solutions https://checkout.stripe.com https://www.paypal.com https://www.sandbox.paypal.com",
     "connect-src 'self' https://*.meshulam.co.il https://grow.link https://*.grow.link https://*.grow.security https://pay.google.com https://*.stripe.com https://*.creditguard.co.il",
     "worker-src 'self' blob:",
-    "frame-ancestors 'none'",
+    // 'self' (not 'none') so iframe-based payment providers (e.g. Cardcom)
+    // can redirect the iframe back to /payment-complete on the storefront
+    // itself after a successful charge.
+    "frame-ancestors 'self'",
     "base-uri 'self'",
     "form-action 'self'",
     "object-src 'none'",