orionplace-nuxt 0.6.0 → 0.6.2

package/README.md

@@ -1021,6 +1021,19 @@ replace options, colors, counts or price bounds with narrowed responses. New
 queries, categories and AppLoad refreshes reset that scope; Clear keeps
 its original selectors. Superseded requests are cancelled and ignored.
 
+Category, search, featured and seller lists keep their result page and
+filters in the URL as `?page=2&filters={...}` (JSON of the filter selection).
+The composable replaces the current history entry on each change, so the
+browser's Back button from a product, and a reload, open the same list, while
+Back from the list still leaves it in one step. Page loads read the same
+query through `productListLocationFromQuery()` in
+`app/utils/orionplace/productListLocation.ts`, which accepts only plain filter
+values within fixed limits. A list opened this way on a later page or with
+filters also requests the unfiltered first page once, so the filter panel
+keeps every choice. Pass `rememberInAddress: false` to keep a list out of the
+URL. The React and Svelte packages do the same in `useProductSearch()` and
+`useOrionplaceProductSearch()`.
+
 `SearchFilters` supplies cumulative ID arrays and scalar price, discount and
 rating fields. Currency-keyed `selects.measures.min_price` and `max_price` supply
 the price range; Apply or a committed slider change emits `price_from`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionplace-nuxt",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Nuxt 4 storefront for your Orionplace marketplace: setup CLI, server API gateway, typed store and ready-made catalog, cart, checkout and account components in English and Russian, plus an Android app build.",
   "type": "module",
   "license": "MIT",

package/runtime/domain.mjs

@@ -1,11 +1,15 @@
 // Other server code can read event.context.marketplaceDomain for canonical URLs.
-import { defineEventHandler, toWebRequest } from 'h3';
+// Pages under ORIONPLACE_NOINDEX_PATHS answer with `X-Robots-Tag: noindex, follow`.
+import { defineEventHandler, getRequestURL, setResponseHeader, toWebRequest } from 'h3';
 import { useRuntimeConfig } from '#imports';
-import { resolveFrontDomain } from './marketplace.mjs';
+import { marketplaceNoindexPath, resolveFrontDomain } from './marketplace.mjs';
 
 export default defineEventHandler((event) => {
   event.context.marketplaceDomain = resolveFrontDomain(
     toWebRequest(event),
     process.env.MIMIC_FRONT_DOMAIN ?? useRuntimeConfig(event).mimicFrontDomain,
   );
+  if (marketplaceNoindexPath(getRequestURL(event).pathname)) {
+    setResponseHeader(event, 'X-Robots-Tag', 'noindex, follow');
+  }
 });

package/runtime/marketplace.mjs

@@ -329,6 +329,7 @@ export async function forwardMarketplace(request, configuration = {}) {
 // node_modules/.cache/orionplace/sitemaps/<domain>.json (ORIONPLACE_CACHE_DIR
 // moves it). "orionplace-<framework> sitemap rebuild" rebuilds that file at
 // once; the running storefront serves the new file without a restart.
+// Paths in ORIONPLACE_NOINDEX_PATHS are left out when the sitemap is served.
 
 export const SITEMAP_LIFETIME = 60 * 60 * 1000;
 const sitemapPageSize = 100;
@@ -353,6 +354,34 @@ export function marketplacePublicOrigin(request, tenantDomain = '') {
   return local || !tenantDomain ? url.origin : `https://${tenantDomain}`;
 }
 
+/**
+ * Pages kept out of search engines: ORIONPLACE_NOINDEX_PATHS lists path
+ * prefixes separated by spaces or commas, for example "/catalog /category
+ * /product" on a demo or staging storefront. Those pages answer with
+ * `X-Robots-Tag: noindex, follow` and the sitemap leaves them out. Empty
+ * (the default) keeps every public page indexable.
+ */
+export function noindexPathPrefixes(value = environment.ORIONPLACE_NOINDEX_PATHS) {
+  return String(value ?? '')
+    .split(/[\s,]+/)
+    .map((item) => item.trim().replace(/\/+$/, ''))
+    .filter((item) => /^\/[A-Za-z0-9._~\/-]+$/.test(item));
+}
+
+/** Whether a page path is kept out of search engines (see noindexPathPrefixes). */
+export function marketplaceNoindexPath(pathname, value = environment.ORIONPLACE_NOINDEX_PATHS) {
+  const path = String(pathname ?? '');
+  return noindexPathPrefixes(value)
+    .some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+
+/** The sitemap pages search engines may index. */
+export function sitemapIndexedPages(pages, value = environment.ORIONPLACE_NOINDEX_PATHS) {
+  return noindexPathPrefixes(value).length
+    ? pages.filter((page) => !marketplaceNoindexPath(page.path, value))
+    : pages;
+}
+
 /** @param {string} origin */
 export function marketplaceRobots(origin) {
   return `User-agent: *\nDisallow: /api/\nAllow: /\n\nSitemap: ${origin}/sitemap.xml\n`;
@@ -618,7 +647,7 @@ async function buildMarketplaceSitemap(tenant) {
 /** How many <url> entries a built sitemap has. */
 export function sitemapUrlCount(sitemap) {
   let count = 0;
-  for (const page of sitemap.pages) {
+  for (const page of sitemapIndexedPages(sitemap.pages)) {
     const own = page.locales
       ? sitemap.locales.filter((code) => page.locales.includes(code))
       : sitemap.locales;
@@ -776,7 +805,7 @@ export async function marketplaceSitemapResponse(request, configuration = {}) {
     }
   }
   const origin  = marketplacePublicOrigin(request, tenant.domain);
-  return new Response(marketplaceSitemapXml(origin, sitemap.pages, sitemap.locales), {
+  return new Response(marketplaceSitemapXml(origin, sitemapIndexedPages(sitemap.pages), sitemap.locales), {
     headers: {
       'Content-Type': 'application/xml; charset=utf-8',
       'Cache-Control': 'public, max-age=3600',

package/src/project-readme.mjs

@@ -571,6 +571,12 @@ npx orionplace-nuxt sitemap rebuild shop.example.com  # one domain
 npx orionplace-nuxt sitemap status                  # when each was built
 \`\`\`
 
+To keep a demo or staging storefront's shop pages out of search engines, set
+\`ORIONPLACE_NOINDEX_PATHS\` in \`.env\` to path prefixes separated by spaces,
+for example \`ORIONPLACE_NOINDEX_PATHS="/catalog /category /product"\`. Those
+pages answer with \`X-Robots-Tag: noindex, follow\` and the sitemap leaves them
+out; the journal and other pages stay indexable. Leave it empty on a live shop.
+
 This setup does not add analytics.
 
 ## Android app

package/templates/app/components/orionplace/blog/BlogArticle.README.md

@@ -8,7 +8,7 @@ The supplied storefront uses this component at `/journal`.
 
 ## Contract and dependencies
 
-The supplied `app/pages/journal/[id].vue` loads the article during the server render with `blog_posts_get` and `filters.id = postId`, using the visitor's cookies, and passes it in `initialPost`; the browser shows it without another request. Without `initialPost` (after client-side navigation) the component sends the same request itself. Full text appears only when both `is_full` and `has_full_access` are true; otherwise the preview and the access panel remain. Article HTML is sanitized with DOMPurify in `app/utils/orionplace/blogArticleHtml.ts` and keeps what the marketplace blog editor writes: headings, paragraphs and line breaks, bold, italic, underline, strikethrough, subscript and superscript, links, bullet, numbered and task lists, quotes, dividers, inline code and code blocks, tables with merged cells, images and galleries, video and audio with controls, collapsible sections, alignment, text color, highlight, font and size. External links open in a new tab with `rel="noopener noreferrer"`; editor links to other articles open `/journal/<id>`. Formulas are shown as their LaTeX source. Wide tables and code blocks scroll inside the article, and floated images stack on narrow screens. Product placements from the editor are not shown inside the text. Frames, scripts, forms, event attributes and other styles are removed. The server render shows the text as plain paragraphs, which search engines can read; the formatted HTML replaces them in the browser.
+The supplied `app/pages/journal/[id].vue` loads the article during the server render with `blog_posts_get` and `filters.id = postId`, using the visitor's cookies, and passes it in `initialPost`; the browser shows it without another request. Without `initialPost` (after client-side navigation) the component sends the same request itself. Full text appears only when both `is_full` and `has_full_access` are true; otherwise the preview and the access panel remain. Article HTML is sanitized with DOMPurify in `app/utils/orionplace/blogArticleHtml.ts` and keeps what the marketplace blog editor writes: headings, paragraphs and line breaks, bold, italic, underline, strikethrough, subscript and superscript, links, bullet, numbered and task lists, quotes, dividers, inline code and code blocks, tables with merged cells, images and galleries, video and audio with controls, collapsible sections, alignment, text color, highlight, font and size. External links open in a new tab with `rel="noopener noreferrer"`; editor links to other articles open `/journal/<id>`. Formulas are shown as their LaTeX source. Wide tables and code blocks scroll inside the article, and floated images stack on narrow screens. Products the author places in the text appear at those positions: an empty block with `data-product-id="12"` shows one product card, `data-product-ids="12,15,9"` a row of up to 24 cards. The block keeps the editor's float or centred style, and `data-product-hidden-badges` (`new`, `popular`, `good-deal`) turns card badges off. Products missing from `related_products` are loaded with `products_search` and `filters.id_in`, up to 35 IDs per request, and stored with `store.setProduct()`; a block whose products are not found stays hidden. Article text styles do not reach the cards, and in a narrow article a floated card stands alone in the middle. The helper is `app/utils/orionplace/blogProductPlacements.ts`. Frames, scripts, forms, event attributes and other styles are removed. The server render shows the text as plain paragraphs, which search engines can read; the formatted HTML replaces them in the browser.
 
 Reading accounting for an accessible paid article starts after interaction with its visible text. `blog_reading_start` starts a session; `blog_reading_heartbeat` follows the returned interval. Leaving, losing focus, hiding the text or 60 seconds without interaction stops requests. Resuming and delayed timers start a fresh baseline. Confirmed loss of access removes full text and offers a refresh.
 
@@ -41,4 +41,4 @@ pages supplied by the full starter.
 - `blog_posts_get`
 - `blog_reading_start`
 - `blog_reading_heartbeat`
-- `products_search` (variant targets, through the host's variant controller)
+- `products_search` (products placed in the text by `filters.id_in`; variant targets, through the host's variant controller)