@sanity/preview-url-secret - npm Package Compare versions

Comparing version 1.6.22-canary.74 to 1.6.22-canary.75

dist/create-secret.d.ts

@@ -1,2 +0,2 @@
-import type {SanityClient} from '@sanity/client'
+import type {ClientPerspective, SanityClient} from '@sanity/client'
 
@@ -28,3 +28,3 @@ /** @internal */
     useCdn?: boolean
-    perspective?: 'published'
+    perspective?: ClientPerspective
     resultSourceMap?: boolean
@@ -31,0 +31,0 @@ }): SanityClientLike

dist/create-secret.js

 import { uuid } from '@sanity/uuid';
-import { apiVersion, SECRET_TTL, schemaIdPrefix, schemaType, tag, deleteExpiredSecretsQuery } from './constants.js';
+import { apiVersion, SECRET_TTL, schemaType, tag, deleteExpiredSecretsQuery } from './constants.js';
 import { generateUrlSecret } from './_chunks-es/generateSecret.js';
@@ -9,3 +9,3 @@
     const expiresAt = new Date(Date.now() + 1e3 * SECRET_TTL);
-    const _id = `${schemaIdPrefix}.${id}`;
+    const _id = `drafts.${id}`;
     const newSecret = generateUrlSecret();
@@ -12,0 +12,0 @@ const patch = client.patch(_id).set({ secret: newSecret, source, studioUrl, userId });

dist/define-preview-url.d.ts

@@ -90,4 +90,2 @@ /**
      * Share URLs to previews will append this secret and give access to anyone who is given the URL, they don't need to be logged into the Studio or to Vercel.
-     * Enabling sharing also has the effect of granting access to Presentation Tool in the Studio to Sanity users that otherwise don't have access to creating documents in the Studio,
-     * and thus can't generate short-lived URL preview secrets.
      */
@@ -94,0 +92,0 @@ shareAccess?: boolean

dist/index.d.ts

@@ -0,1 +1,3 @@
+import type {ClientPerspective} from '@sanity/client'
+
 /**
@@ -29,3 +31,3 @@ * @alpha
     useCdn?: boolean
-    perspective?: 'published'
+    perspective?: ClientPerspective
     resultSourceMap?: boolean
@@ -32,0 +34,0 @@ }): SanityClientLike

dist/index.js

@@ -11,2 +11,3 @@ import { apiVersion, urlSearchParamPreviewSecret, urlSearchParamPreviewPathname, fetchSecretQuery, fetchSharedAccessSecretQuery, tag, isDev } from './constants.js';
   return client.withConfig({
+    perspective: "raw",
     // Userland might be using an API version that's too old to use perspectives
@@ -16,4 +17,2 @@ apiVersion,
     useCdn: false,
-    // The documents that hold secrets are never drafts
-    perspective: "published",
     // Don't waste time returning a source map, we don't need it
@@ -20,0 +19,0 @@ resultSourceMap: false,

dist/toggle-preview-access-sharing.d.ts

@@ -1,2 +0,2 @@
-import type {SanityClient} from '@sanity/client'
+import type {ClientPerspective, SanityClient} from '@sanity/client'
 
@@ -34,3 +34,3 @@ /** @internal */
     useCdn?: boolean
-    perspective?: 'published'
+    perspective?: ClientPerspective
     resultSourceMap?: boolean
@@ -37,0 +37,0 @@ }): SanityClientLike

package.json

 {
   "name": "@sanity/preview-url-secret",
-  "version": "1.6.22-canary.74",
+  "version": "1.6.22-canary.75",
   "homepage": "https://github.com/sanity-io/visual-editing/tree/main/packages/preview-url-secret#readme",
@@ -123,4 +123,4 @@ "bugs": {
     "@repo/eslint-config": "0.0.0",
-    "@repo/prettier-config": "0.0.0",
-    "@repo/package.config": "0.0.0"
+    "@repo/package.config": "0.0.0",
+    "@repo/prettier-config": "0.0.0"
   },
@@ -127,0 +127,0 @@ "peerDependencies": {

README.md

@@ -36,2 +36,82 @@ # @sanity/preview-url-secret
 
+# Permissions model
+
+> [!NOTE]
+> v1 used to require Editor or above to create the secret.
+> v2 lowers the requirement to Contributor.
+
+In order to create an URL Preview Secret, the user needs to have the rights to create draft documents in the schema.
+By default that means Contributor or above.
+For Enterprise customers with custom roles, it's possible to grant Viewer roles access to create preview secrets.
+
+## Granting access to Viewer roles and below
+
+In your proiect access settings:
+
+1. Create a new Content Resource.
+2. Title it "Preview URL Secrets for Presentation Tool".
+3. Set the filter to: `_type == "sanity.previewUrlSecret" && _id in path("drafts.**")`.
+4. Click "Create content resource".
+5. Create new role.
+6. Title it "Viewer with Presentation Tool access".
+7. Create the role.
+8. Edit the "Content permissions".
+9. For the "Preview URL Secrets for Presentation Tool" and set it to "+ Update and create". The "All documents", "Image assets" and "File assets" should be set to "Read".
+10. Save changes.
+
+To grant a user access to Presentation Tool you simply assign them the new "Viewer with Presentation Tool access" role, instead of "Viewer".
+
+## Restricting access to who can enable/disable preview sharing
+
+In Tools like Presentation, it's possible to share access to a preview link by generating a long lived secret.
+By default you need to be an Editor or above to enable or disable preview sharing.
+If preview sharing is enabled, then you need to be Viewer or above to read the secret.
+
+When preview sharing is enabled, Presentation Tool will show a "Share" menu:
+<img width="688" alt="image" src="https://github.com/user-attachments/assets/186bdd20-cad3-44c7-948a-f23aabf7ef6a">
+
+### Control who has access to a shared preview
+
+By default everyone who's Viewer or above can see a shared preview, once someone who's Editor or above has enabled it for the dataset.
+
+Enterprise customers can restrict this in the following way:
+
+1. Create a new Content Resource.
+2. Title it "Everything except preview sharing".
+3. In the description, write "Access to all document types except for shared preview links"
+4. Set the filter to: `_type != "sanity.previewUrlShareAccess"`.
+5. Create new role.
+6. Title it "Viewer without preview sharing".
+7. Create the role.
+8. Edit the "Content permissions".
+9. For the "Everything except preview sharing" and set it to "Read". The "All documents" must be "No access", "Image assets" and "File assets" should be set to "Read".
+10. If you followed the steps in the previous section, you should set "Preview URL Secrets for Presentation Tool" to "+ Update and create".
+11. Save changes.
+
+With everything setup correctly, users assigned to this role should see the following when attempting to use the "Share" menu:
+<img width="418" alt="image" src="https://github.com/user-attachments/assets/9e748f49-4f82-453c-bd83-cae6e86302f2">
+
+If you're still able to see the QR code with the new role assigned, make sure you're not assigned to "Viewer" or other roles that may be granting access to "All documents: Read".
+
+### Control who can toggle shared preview
+
+By default anyone who's Editor or above can toggle sharing.
+If anyone without permission attempts to toggle it they'll see a message like this:
+<img width="399" alt="image" src="https://github.com/user-attachments/assets/798c9c32-88ac-40ba-9111-2ef4e8fc9a2b">
+
+Enterprise customers can customize this in the following way:
+
+1. Create a new Content Resource.
+2. Title it "Preview URL Share Access".
+3. In the description, write "Controls who can enable or disable preview sharing in Presentation Tool"
+4. Set the filter to: `_type == "sanity.previewUrlShareAccess"`.
+5. Create new role.
+6. Title it "Can toggle preview sharing".
+7. Create the role.
+8. Edit the "Content permissions".
+9. For the "Preview URL Share Access" set it to "Publish".
+10. Save changes.
+
+# Usage
+
 ## Next.js App Router
@@ -38,0 +118,0 @@

src/createClientWithConfig.ts

@@ -19,2 +19,3 @@ import {apiVersion} from './constants'
   return client.withConfig({
+    perspective: 'raw',
     // Userland might be using an API version that's too old to use perspectives
@@ -24,4 +25,2 @@ apiVersion,
     useCdn: false,
-    // The documents that hold secrets are never drafts
-    perspective: 'published',
     // Don't waste time returning a source map, we don't need it
@@ -28,0 +27,0 @@ resultSourceMap: false,

src/createPreviewSecret.ts

 import type {SanityClient} from '@sanity/client'
 import {uuid} from '@sanity/uuid'
-import {
-  apiVersion,
-  deleteExpiredSecretsQuery,
-  schemaIdPrefix,
-  schemaType,
-  SECRET_TTL,
-  tag,
-} from './constants'
+import {apiVersion, deleteExpiredSecretsQuery, schemaType, SECRET_TTL, tag} from './constants'
 import {generateUrlSecret} from './generateSecret'
@@ -26,3 +19,3 @@ import type {SanityClientLike} from './types'
     const expiresAt = new Date(Date.now() + 1000 * SECRET_TTL)
-    const _id = `${schemaIdPrefix}.${id}`
+    const _id = `drafts.${id}`
     const newSecret = generateUrlSecret()
@@ -29,0 +22,0 @@ const patch = client.patch(_id).set({secret: newSecret, source, studioUrl, userId})

src/types.ts

@@ -0,1 +1,3 @@
+import type {ClientPerspective} from '@sanity/client'
+
 /** @internal */
@@ -5,9 +7,2 @@ export type PreviewUrlSecretSchemaIdPrefix = `sanity-preview-url-secret`
 /** @internal */
-export type PreviewUrlSecretSchemaIdToolName = 'presentation' | 'desk' | 'production-url' | string
-
-/** @internal */
-export type PreviewUrlSecretSchemaIdType =
-  `${PreviewUrlSecretSchemaIdPrefix}.${PreviewUrlSecretSchemaIdToolName}`
-
-/** @internal */
 export type PreviewUrlSecretSchemaType = `sanity.previewUrlSecret`
@@ -29,3 +24,3 @@
     useCdn?: boolean
-    perspective?: 'published'
+    perspective?: ClientPerspective
     resultSourceMap?: boolean
@@ -117,4 +112,2 @@ }): SanityClientLike
      * Share URLs to previews will append this secret and give access to anyone who is given the URL, they don't need to be logged into the Studio or to Vercel.
-     * Enabling sharing also has the effect of granting access to Presentation Tool in the Studio to Sanity users that otherwise don't have access to creating documents in the Studio,
-     * and thus can't generate short-lived URL preview secrets.
      */
@@ -121,0 +114,0 @@ shareAccess?: boolean

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

168091

increased by1.56%

Number of lines in readme file

346

increased by30.08%

Worsened metrics

Lines of code

1700

decreased by-0.99%

No dependency changes