
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@networkteam/zebra
Advanced tools
<!--lint disable awesome-heading awesome-github awesome-toc double-link -->
A package for Next.js to use Neos CMS as a headless CMS with full visual editing.
This package is used inside a Next.js project that fetches content from Neos CMS for rendering and offers editing with full preview capabilities. It provides components and helpers to handle the loading and rendering of nodes. It adds the necessary editing metadata for the Neos UI to work as in a traditional Neos setup.
Inside Neos CMS a few supporting packages are used to provide the content via an API for Next.js and adjust the behavior of the Neos UI:
Note: this readme focuses on using Zebra with the Next.js app router, as it is a more flexible approach for data-loading and supports React server components.
@networkteam/zebra
to your projectwithZebra
to your next.config.js
:
/** @type {import('next').NextConfig} */
const { withZebra } = require('@networkteam/zebra');
const nextConfig = {
reactStrictMode: true,
// ...
};
module.exports = withZebra(nextConfig);
NEOS_BASE_URL
to your Neos installation and PUBLIC_BASE_URL
to the public URL of your Next.js site.See the demo project for a working example:
And here's a list of articles with more background:
NEOS_BASE_URL
: The base URL of your Neos installation. This could be an internal URL that is not reachable from outside.PUBLIC_BASE_URL
: The base URL of your Next.js site. This is the URL where your website will be reachable from outside.REVALIDATE_TOKEN
: A secret token that will be used to validate calls to the revalidate API route.Zebra provides a NodeRenderer
component to render a node from Neos.
You provide a mapping from node types to React components via initNodeTypes
which should be imported in your root layout.
It is good practice to split components in presentational (no knowledge about Neos) and content components (adds Zebra components and helpers for editing capabilities on top of presentational components).
Note: as React server components do not support
useContext
, we explicitly pass thectx
object to all components that need to access content.
Define node type mappings (lib/config/nodeTypes.ts
):
import { initNodeTypes } from '@networkteam/zebra/server';
import DocumentPage from '../components/document/Page';
import ContentHeadline from '../components/content/Headline';
initNodeTypes({
// Documents
'MyProject.Site:Document.Page': DocumentPage,
// Content
'Neos.NodeTypes:Headline': ContentHeadline,
});
Create a dynamic route with optional catch-all (app/[[...slug]]/page.tsx
):
import { loadDocumentPropsCached, NodeRenderer } from '@networkteam/zebra/server';
import { DataLoaderOptions } from '@networkteam/zebra/types';
import { Metadata } from 'next';
import { notFound, redirect, permanentRedirect } from 'next/navigation';
const dataLoaderOptionsFor = (routePath: string): DataLoaderOptions => ({
cache: 'force-cache',
next: {
tags: ['document'],
},
});
// This is for generating metadata
export async function generateMetadata({
params,
}: {
params: Promise<{ slug?: string | string[]; }>
}): Promise<Metadata> {
const { slug } = await params;
const routePath = slug && Array.isArray(params.slug) ? params.slug.join('/') : '/';
const neosData = await loadDocumentPropsCached(routePath, dataLoaderOptionsFor(routePath));
if (!neosData) {
return {};
}
const { node, site, meta } = neosData;
const title = meta?.isRootPage ? site.properties.title : `${node.properties.title} – ${site.properties.title}`;
return {
title,
};
}
// And this will render the page output
const Page = async ({ params }: { params: Promise<{ slug: string[] }> }) => {
const { slug } = await params;
const routePath = slug && Array.isArray(slug) ? slug.join('/') : '/';
const dataLoaderOptions = dataLoaderOptionsFor(routePath);
const neosData = await loadDocumentPropsCached(routePath, dataLoaderOptions);
if (!neosData) {
return notFound();
}
// Check for possible redirects
if ('redirect' in neosData) {
if (neosData.redirect.statusCode === 308 || neosData.redirect.statusCode === 301) {
permanentRedirect(neosData.redirect.targetPath);
}
redirect(neosData.redirect.targetPath);
}
if (neosData?.node.nodeType === 'Neos.Neos:Shortcut') {
return redirect(neosData.node.properties.targetUri || '/');
}
return (
// Render the node data with NodeRenderer which uses the node type mappings
<NodeRenderer
ctx={{
routePath,
currentNodeIdentifier: neosData.node.identifier,
documentNodeIdentifier: neosData.node.identifier,
dataLoaderOptions,
}}
node={neosData.node}
/>
);
};
export default Page;
Add a component for a basic document page (lib/components/document/Page.tsx
):
import { ContextProps } from '@networkteam/zebra';
import { ContentCollection } from '@networkteam/zebra/server';
import Header from './partials/Header';
const DocumentPage = ({ ctx }: { ctx: ContextProps }) => {
const { mainNavigation } = await withMeta(ctx);
const inBackend = ctx.inBackend;
return (
<div className="flex min-h-screen flex-col">
<Header
ctx={ctx}
mainNavigation={mainNavigation}
inBackend={inBackend}
/>
<main className="flex grow flex-col justify-between">
<ContentCollection className="grow" nodeName="main" ctx={ctx} />
</main>
</div>
);
};
export default DocumentPage;
Add a presentational component for a headline:
import classNames from 'classnames';
type HeadlineProps = {
children: React.ReactNode;
as?: 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6';
size?: 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6';
className?: string;
};
const Headline = ({ children, as: Component = 'h1', size, className }: HeadlineProps) => {
return (
<Component
className={classNames(
{
'text-6xl': size === 'h1',
'text-5xl': size === 'h2',
'text-4xl': size === 'h3',
'text-3xl': size === 'h4',
'text-2xl': size === 'h5',
'text-xl': size === 'h6',
},
className
)}
>
{children}
</Component>
);
};
export default Headline;
Add a content component for a headline:
import { ContextProps } from '@networkteam/zebra';
import { ContentComponent, Editable, withNode } from '@networkteam/zebra/server';
import { baseClasses } from '@/lib/utils/baseClasses';
import Headline from '../ui/Headline';
const ContentHeadline = async ({ ctx }: { ctx: ContextProps }) => {
const node = await withNode(ctx);
return (
<ContentComponent ctx={ctx} className={baseClasses(node)}>
<Headline as={node.properties.hierarchy} size={node.properties.size}>
<Editable ctx={ctx} property="title" />
</Headline>
</ContentComponent>
);
};
export default ContentHeadline;
Your Next.js project defines a dynamic route with an optional catch-all segment that will render the page for a document node in Neos CMS. The route is defined in app/[[...slug]]/page.tsx
.
Next.js will fetch the node data for a document node from Neos via the Content API in loadDocumentPropsCached
. You can implement custom processing based on the loaded data, e.g. to fetch additional data, handle shortcuts and redirects or to handle errors.
Using the NodeRenderer
a new ctx
prop is passed with information about the current document / node identifier and route path as well as the data loader options for subsequent requests. This will be passed on to all React server components render content. The identifier will be changed while iterating over individual nodes (e.g. content collections).
This data is the input for rendering the page, so the response of the Content API needs to contain needed information like menu items, shared content in e.g. a footer and the content of the page itself. With React server components you could also fetch additional data in the component itself.
Next.js takes care of deduplicating identical fetch requests, so each component in the render tree can fetch data independently without causing additional requests.
For this to work, the Neos base URL has to be known to Next.js via the NEOS_BASE_URL
environment variable.
Now it get's a little trickier:
You always access Neos CMS via your Next.js site by appending /neos
, as usual.
The withZebra
config helper adds the necessary rewrites to the Next.js configuration in next.config.js
to make this work.
Next.js serves a custom /neos/preview
route that is used to render the preview of a document node in the user workspace.
It forwards your Neos session cookie to the Neos backend and fetches the content via the Content API - now with access to the user workspace and more metadata for use in Neos UI.
By using the Zebra components and helpers for rendering, all the metadata for the Neos UI is added to the page. Inline editing should just work.
All other requests to /neos/*
(except /neos/previewNode
) are proxied to the Neos backend.
Content can be cached by specifying the data loader options in loadPreviewDocumentProps
:
const dataLoaderOptionsFor = (routePath: string): DataLoaderOptions => ({
cache: 'force-cache',
next: {
tags: ['document'],
},
});
const neosData = await loadDocumentPropsCached(routePath, dataLoaderOptions);
It requires the Networkteam.Neos.Next package in Neos. It hooks into the publishing signals, collects changed nodes and their closest document nodes and triggers a revalidation of the routes via a Next.js route handler (defaults to /api/revalidate
). A revalidate token is used to prevent unauthorized revalidation requests.
Note: For this to work, the Next.js base URL has to be known inside Neos.
Since content often depends on other documents (e.g. document titles in navigation, teaser cards, etc.), it is advised to implement a full revalidation after every change. With the app router, this will only mark routes as invalidated and they will be freshly rendered on the next request.
Note: This approach works reasonably well and solves a lot of complexity with dependencies and figuring out an exact set of document to revalidate.
We use the Next.js frontend again for previewing the content of a single node. To override the default behavior which uses Fusion inside a controller in Neos, the Networkteam.Neos.Next package provides a Fusion prototype that renders the content of a node via the Next.js frontend. A single Fusion path is used by Zebra in the metadata for all nodes to use this special preview implementation.
For this to work, the Next.js base URL has to be known inside Neos.
Have a look at the Zebra Demo for a full setup of developing a Next.js project alongside Neos CMS in a monorepo.
Basically it boils down to:
NEOS_BASE_URL
to the URL of your local Neos/neos
Deploying a site where content comes from Neos CMS and the actual frontend is generated in Next.js is a little bit more involved, since both systems work together when generating content or using the backend.
There are multiple things to consider:
CI
to opt-out of caching (by calling a function like headers
). This can be used e.g. in not-found.tsx
which would cause build errors otherwise, see not-found.tsx
in Zebra demo.PUBLIC_BASE_URL
is provided to the Next.js frontend, which will set X-Forwarded-*
proxy headers for Neos.trustedProxies
configuration in Neos allows this./neos
, /_Resources
) and others to Next.js (/neos/preview
, /
). In Kubernetes this can be solved at the Ingress level.PUBLIC_BASE_URL
env var to make sure URIs are generated correctly for revalidate calls to the content API in Neos.Neos.Flow.http.trustedProxies
in Settings.yaml
.Please have a look at https://github.com/networkteam/zebra/blob/v0.9.0/README.md to see previous instructions for using the pages router.
We are happy to accept contributions. Just open an issue or pull request.
To create a pre-release you can push / merge changes to branch next
. This triggers actions to automatically create a pre-release.
Use @next
as version in your project package.json
to use the current pre-release.
main
branchpackage.json
with npm version [<newversion> | major | minor | patch
main
branch with git push --follow-tags
Special thanks to Philip Schmidt (@esdete2) for initiating and pushing the full-editing approach and implementing the first Zebra project in his spare-time.
FAQs
<!--lint disable awesome-heading awesome-github awesome-toc double-link -->
The npm package @networkteam/zebra receives a total of 80 weekly downloads. As such, @networkteam/zebra popularity was classified as not popular.
We found that @networkteam/zebra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.