fontdue-js 3.2.0 → 3.2.2

package/dist/next/unlock.js

@@ -22,16 +22,44 @@
 // forged POST reveals nothing and buys the caller only their own dynamic
 // renders, exactly like a forged preview POST.
 //
+// The bypass is scoped to the unlocked page's path, not the whole site.
+// draftMode().enable() sets the cookie with Path=/, which would take EVERY
+// page this visitor touches off the full-route cache — and because a render
+// carrying a node-access token also opts all of its GraphQL fetches out of the
+// shared data cache, one unlock made the visitor's whole browsing session
+// dynamically rendered and measurably slow (seconds per page on heavy pages).
+// Draft mode is decided per-request by whether the browser SENDS the bypass
+// cookie, and the browser decides that by cookie Path — so the form posts the
+// pathname it unlocked on and we narrow the cookie to it. Public pages stay on
+// the static cache; only the unlocked collection's pages render dynamically
+// for this visitor. Unlocking several collections yields several same-name
+// cookies with different paths, which browsers store and send independently.
+// (Admin preview keeps its site-wide Path=/ bypass — previewing the whole site
+// dynamically is the point there.)
+//
 // The bypass cookie is a session cookie, while the node-access cookie lasts ~30
 // days. A returning visitor whose bypass lapsed sees the static form again and
 // re-enters the password; re-unlocking re-enables the bypass. There is no
 // DELETE: draft mode is shared with admin preview, so an unlock exit must not
 // tear down an active preview — the bypass simply expires with the session.
 
-import { draftMode } from 'next/headers';
+import { cookies, draftMode } from 'next/headers';
 
 /** Default path the templates mount the handler at. */
 export const UNLOCK_ENDPOINT = '/api/unlock';
+
+// Next's draft-mode bypass cookie. The name is Next's stable, documented
+// public contract (the same one draftMode().enable() sets), but it isn't
+// exported from a public entry point, so it's spelled out here.
+const PRERENDER_BYPASS_COOKIE = '__prerender_bypass';
+
+// A client-sent pathname we are willing to put in a Set-Cookie Path attribute:
+// absolute, bounded, visible ASCII with no ';' — i.e. what
+// window.location.pathname (always percent-encoded) actually produces, and
+// nothing that could terminate or escape the attribute (Next serializes the
+// path verbatim). Anything else falls back to the site-wide default.
+const SCOPE_PATH_MAX_LENGTH = 512;
+const SCOPE_PATH_RE = /^\/[\x21-\x3a\x3c-\x7e]*$/;
 export async function POST(request) {
   const body = await request.json().catch(() => ({}));
   if (typeof body.token !== 'string' || body.token === '') {
@@ -43,7 +71,42 @@ export async function POST(request) {
     });
   }
   (await draftMode()).enable();
+  await scopeBypassCookie(scopePath(body.path));
   return Response.json({
     ok: true
   });
+}
+
+// The cookie Path to narrow the bypass to, or undefined to leave it site-wide
+// (path missing — an older form — or unusable). Trailing slashes are stripped
+// because cookie path-matching treats "/fonts/x" as covering both the page
+// itself and everything under it, while "/fonts/x/" would miss the page.
+function scopePath(path) {
+  if (typeof path !== 'string' || path.length > SCOPE_PATH_MAX_LENGTH || !SCOPE_PATH_RE.test(path)) {
+    return undefined;
+  }
+  const trimmed = path.replace(/\/+$/, '');
+  return trimmed === '' ? undefined : trimmed;
+}
+
+// Replace the pending site-wide bypass cookie enable() just queued with one
+// scoped to `path`. cookies() in a route handler exposes the same mutable
+// store enable() wrote to, and setting the same cookie name again replaces the
+// queued Set-Cookie rather than adding a second one — so exactly one bypass
+// cookie leaves this response, and no Path=/ variant that could clobber an
+// admin's site-wide preview bypass. The explicit attributes mirror enable()'s
+// as a fallback; the spread keeps whatever enable() actually set (bar the
+// path) if Next ever changes them.
+async function scopeBypassCookie(path) {
+  if (!path) return;
+  const jar = await cookies();
+  const bypass = jar.get(PRERENDER_BYPASS_COOKIE);
+  if (!(bypass !== null && bypass !== void 0 && bypass.value)) return;
+  jar.set({
+    httpOnly: true,
+    sameSite: process.env.NODE_ENV !== 'development' ? 'none' : 'lax',
+    secure: process.env.NODE_ENV !== 'development',
+    ...bypass,
+    path
+  });
 }

package/dist/relay/environment.js

@@ -8,7 +8,7 @@ import { NODE_ACCESS_HEADER } from '../nodeAccess.js';
 // (defineVersionPlugin in .babelrc.cjs) with the literal package.json#version.
 // Exported so UI (the admin toolbar) can surface it without re-reading the
 // build-time global in a 'use client' module.
-export const version = "3.2.0";
+export const version = "3.2.2";
 const IS_SERVER = typeof window === typeof undefined;
 
 // Opt server fetches into Next's data cache only in production; dev stays

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fontdue-js",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "type": "module",
   "scripts": {
     "build": "npm run relay && run-p build-js build-css build-ts",

package/types/next-headers.d.ts

@@ -1,13 +1,33 @@
 // Minimal declaration so src/next/tenant.ts type-checks without `next`
 // installed (it's the host app's dependency; this package only ever runs the
 // import inside a Next.js server).
+//
+// The cookie shape mirrors Next's route-handler cookie store: get() also
+// carries the queued cookie's attributes (the store is ResponseCookies-backed,
+// so a cookie draftMode().enable() just set comes back with its path/flags),
+// and set() with an existing name replaces the queued Set-Cookie. The unlock
+// route (src/next/unlock.ts) relies on both to narrow the bypass cookie's
+// path.
 declare module 'next/headers' {
+  interface CookieAttributes {
+    path?: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    expires?: Date | number;
+    maxAge?: number;
+    domain?: string;
+  }
+
   export function draftMode(): Promise<{
     isEnabled: boolean;
     enable(): void;
     disable(): void;
   }>;
   export function cookies(): Promise<{
-    get(name: string): { value: string } | undefined;
+    get(
+      name: string,
+    ): ({ name: string; value: string } & CookieAttributes) | undefined;
+    set(cookie: { name: string; value: string } & CookieAttributes): void;
   }>;
 }