From 87fdf27bd667919b4d0a356f3718eebcbe87d8b9 Mon Sep 17 00:00:00 2001 From: Kevin Stubbs Date: Tue, 2 Jul 2024 22:21:32 +0700 Subject: [PATCH 1/4] Set PCC-GRANT cookie very permissively --- .changeset/young-maps-fly.md | 5 +++++ .github/workflows/changeset.yml | 2 +- packages/core/src/core/pantheon-api.ts | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 .changeset/young-maps-fly.md diff --git a/.changeset/young-maps-fly.md b/.changeset/young-maps-fly.md new file mode 100644 index 00000000..e0265aee --- /dev/null +++ b/.changeset/young-maps-fly.md @@ -0,0 +1,5 @@ +--- +"@pantheon-systems/pcc-sdk-core": patch +--- + +PCC-GRANT (preview token) cookie now set with most relaxed security so that preview-pages can be shown in iframes. diff --git a/.github/workflows/changeset.yml b/.github/workflows/changeset.yml index ba426802..e3aaddea 100644 --- a/.github/workflows/changeset.yml +++ b/.github/workflows/changeset.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: checkout code repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: setup node.js diff --git a/packages/core/src/core/pantheon-api.ts b/packages/core/src/core/pantheon-api.ts index ed5734b6..fc7728d7 100644 --- a/packages/core/src/core/pantheon-api.ts +++ b/packages/core/src/core/pantheon-api.ts @@ -127,7 +127,7 @@ export const PantheonAPI = (givenOptions?: PantheonAPIOptions) => { // Set or delete the PCC-GRANT cookie. if (pccGrant) { - await setCookie(res, `PCC-GRANT=${pccGrant}; Path=/; SameSite=Lax`); + await setCookie(res, `PCC-GRANT=${pccGrant}; Path=/; SameSite=None;Secure;`); } else if ( options?.getSiteId != null && req.cookies?.["PCC-GRANT"] != null From f85ec5313d6196778cbc32adec32324cebebfe6e Mon Sep 17 00:00:00 2001 From: Kevin Stubbs Date: Tue, 2 Jul 2024 22:28:26 +0700 Subject: [PATCH 2/4] Fix test --- packages/core/__tests__/core/pantheon-api.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/core/__tests__/core/pantheon-api.test.ts b/packages/core/__tests__/core/pantheon-api.test.ts index 4c0a2188..78440672 100644 --- a/packages/core/__tests__/core/pantheon-api.test.ts +++ b/packages/core/__tests__/core/pantheon-api.test.ts @@ -110,7 +110,7 @@ describe("Request Handling", () => { ); expect(mockResponse.setHeader).toHaveBeenCalledWith("Set-Cookie", [ - "PCC-GRANT=test-grant; Path=/; SameSite=Lax", + "PCC-GRANT=test-grant; Path=/; SameSite=None;Secure;", ]); }); From 0efe30b400ad3908cc639cffa151cf7e72535677 Mon Sep 17 00:00:00 2001 From: Kevin Stubbs Date: Mon, 8 Jul 2024 19:42:57 +0700 Subject: [PATCH 3/4] Fix lint --- packages/core/src/core/pantheon-api.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/core/src/core/pantheon-api.ts b/packages/core/src/core/pantheon-api.ts index fc7728d7..6cb64cd5 100644 --- a/packages/core/src/core/pantheon-api.ts +++ b/packages/core/src/core/pantheon-api.ts @@ -127,7 +127,10 @@ export const PantheonAPI = (givenOptions?: PantheonAPIOptions) => { // Set or delete the PCC-GRANT cookie. if (pccGrant) { - await setCookie(res, `PCC-GRANT=${pccGrant}; Path=/; SameSite=None;Secure;`); + await setCookie( + res, + `PCC-GRANT=${pccGrant}; Path=/; SameSite=None;Secure;`, + ); } else if ( options?.getSiteId != null && req.cookies?.["PCC-GRANT"] != null From 7f6066bc971abd6c89226ef8bfe30540a445cca5 Mon Sep 17 00:00:00 2001 From: Kevin Stubbs Date: Tue, 9 Jul 2024 00:23:46 +0700 Subject: [PATCH 4/4] Fix lint --- packages/cli/CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 15e4f208..969da6d0 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -5,7 +5,8 @@ ### Patch Changes - 0c75736: CLI replaces "--version" command with "version" -- 1fd7c4d: Added support for setting preferred webhook events. Webhook notifications will only be sent on events matching preferred events +- 1fd7c4d: Added support for setting preferred webhook events. Webhook + notifications will only be sent on events matching preferred events - Updated dependencies [183ad17] - @pantheon-systems/pcc-sdk-core@3.6.1