shopify-nuxt 0.0.6 → 0.0.8

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "shopify-nuxt",
   "configKey": "shopify",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/module.mjs

@@ -35,14 +35,7 @@ const module$1 = defineNuxtModule({
     };
     nuxt.options.vite = nuxt.options.vite || {};
     nuxt.options.vite.server = nuxt.options.vite.server || {};
-    const existing = nuxt.options.vite.server.allowedHosts;
-    if (existing === true) ; else if (Array.isArray(existing)) {
-      if (!existing.includes(".trycloudflare.com")) {
-        existing.push(".trycloudflare.com");
-      }
-    } else {
-      nuxt.options.vite.server.allowedHosts = [".trycloudflare.com"];
-    }
+    nuxt.options.vite.server.allowedHosts = true;
     nuxt.options.alias["#shopify/server"] = resolver.resolve("./runtime/server");
     addServerImportsDir(resolver.resolve("./runtime/server/utils"));
     addImportsDir(resolver.resolve("./runtime/composables"));
@@ -52,13 +45,7 @@ const module$1 = defineNuxtModule({
     });
     nuxt.hook("app:resolve", () => {
       nuxt.options.app.head = nuxt.options.app.head || {};
-      nuxt.options.app.head.meta = [
-        {
-          name: "content-security-policy",
-          content: "frame-ancestors 'self' *.myshopify.com *.shopify.com *.trycloudflare.com"
-        },
-        ...nuxt.options.app.head.meta || []
-      ];
+      nuxt.options.app.head.meta = [...nuxt.options.app.head.meta || []];
       nuxt.options.app.head.script = [
         // 1. Inline script to create the meta tag imperatively — guarantees it
         //    exists in the DOM before the CDN script executes.
@@ -141,6 +128,9 @@ export {}
       nitroConfig.plugins.push(
         resolver.resolve("./runtime/server/plugins/shopify-defaults")
       );
+      nitroConfig.plugins.push(
+        resolver.resolve("./runtime/server/plugins/add-response-headers")
+      );
     });
     nuxt.options.build.transpile.push(resolver.resolve("./runtime"));
     nuxt.hook("nitro:config", (nitroConfig) => {

package/dist/runtime/server/plugins/add-response-headers.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Nitro plugin that adds Shopify-required response headers to every document request.
+ *
+ * Mirrors the behaviour of Shopify's official `addDocumentResponseHeaders`:
+ * - `Content-Security-Policy`: frame-ancestors scoped to the requesting shop
+ * - `Link`: preconnect / preload hints for App Bridge + Polaris CDN assets
+ *
+ * @see https://github.com/Shopify/shopify-app-js/blob/main/packages/apps/shopify-app-react-router/src/server/authenticate/helpers/add-response-headers.ts
+ */
+declare const _default: import("nitropack/types").NitroAppPlugin;
+export default _default;

package/dist/runtime/server/plugins/add-response-headers.js

@@ -0,0 +1,31 @@
+import { defineNitroPlugin } from "nitropack/runtime";
+import { getQuery, setResponseHeader } from "h3";
+const APP_BRIDGE_URL = "https://cdn.shopify.com/shopifycloud/app-bridge.js";
+const POLARIS_URL = "https://cdn.shopify.com/shopifycloud/polaris.js";
+const CDN_URL = "https://cdn.shopify.com";
+export default defineNitroPlugin((nitroApp) => {
+  nitroApp.hooks.hook("request", (event) => {
+    const query = getQuery(event);
+    const shop = typeof query.shop === "string" ? query.shop : void 0;
+    if (shop) {
+      setResponseHeader(
+        event,
+        "Link",
+        `<${CDN_URL}>; rel="preconnect", <${APP_BRIDGE_URL}>; rel="preload"; as="script", <${POLARIS_URL}>; rel="preload"; as="script"`
+      );
+    }
+    if (shop) {
+      setResponseHeader(
+        event,
+        "Content-Security-Policy",
+        `frame-ancestors https://${shop} https://admin.shopify.com https://*.spin.dev https://admin.myshopify.io https://admin.shop.dev;`
+      );
+    } else {
+      setResponseHeader(
+        event,
+        "Content-Security-Policy",
+        `frame-ancestors https://*.myshopify.com https://admin.shopify.com https://*.spin.dev https://admin.myshopify.io https://admin.shop.dev;`
+      );
+    }
+  });
+});

package/dist/runtime/server/plugins/shopify-defaults.d.ts

@@ -4,5 +4,5 @@
  * If the user calls `configureShopify()` in their own server plugin,
  * it will override these defaults (configureShopify resets cached singletons).
  */
-declare const _default: any;
+declare const _default: import("nitropack/types").NitroAppPlugin;
 export default _default;

package/dist/runtime/server/plugins/shopify-defaults.js

@@ -1,3 +1,4 @@
+import { defineNitroPlugin } from "nitropack/runtime";
 import { MemorySessionStorage } from "@shopify/shopify-app-session-storage-memory";
 import { configureShopify, getResolvedConfig } from "../services/shopify.js";
 export default defineNitroPlugin(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify-nuxt",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Shopify app integration for Nuxt - authentication, webhooks, billing, and App Bridge",
   "repository": "kiriminaja/shopify-nuxt",
   "license": "MIT",