-
Notifications
You must be signed in to change notification settings - Fork 26k
/
preview.js
40 lines (35 loc) · 1.4 KB
/
preview.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
import { postBySlugQuery } from '../../lib/queries'
import { previewClient } from '../../lib/sanity.server'
function redirectToPreview(res, Location) {
// Enable Preview Mode by setting the cookies
res.setPreviewData({})
// Redirect to a preview capable route
res.writeHead(307, { Location })
res.end()
}
export default async function preview(req, res) {
const secret = process.env.SANITY_STUDIO_PREVIEW_SECRET
// Only require a secret when in production
if (!secret && process.env.NODE_ENV === 'production') {
throw new TypeError(`Missing SANITY_STUDIO_PREVIEW_SECRET`)
}
// Check the secret if it's provided, enables running preview mode locally before the env var is setup
if (secret && req.query.secret !== secret) {
return res.status(401).json({ message: 'Invalid secret' })
}
// If no slug is provided open preview mode on the frontpage
if (!req.query.slug) {
return redirectToPreview(res, '/')
}
// Check if the post with the given `slug` exists
const post = await previewClient.fetch(postBySlugQuery, {
slug: req.query.slug,
})
// If the slug doesn't exist prevent preview mode from being enabled
if (!post) {
return res.status(401).json({ message: 'Invalid slug' })
}
// Redirect to the path from the fetched post
// We don't redirect to req.query.slug as that might lead to open redirect vulnerabilities
redirectToPreview(res, `/posts/${post.slug}`)
}