diff --git a/docs/features/publisher.md b/docs/features/publisher.md index 5084289de..bb771b3b0 100644 --- a/docs/features/publisher.md +++ b/docs/features/publisher.md @@ -327,8 +327,8 @@ The publisher emits `` in this order: 1. `` 2. `` -3. `` — the entry's `seoTitle` (post-type entries only) → `settings.metaTitle` → `page.title` → site name -4. `<meta name="description">` — the entry's `seoDescription` (post-type entries only) → `settings.metaDescription`; omitted when neither is set +3. `<title>` — the entry's `seoTitle` (post-type entries only) → `settings.metaTitle` → `page.title` → site name, then token-interpolated against the render context before escaping, so `{currentEntry.*}` resolves per-entry on entry routes (e.g. `{currentEntry.name} | Acme`) and `{page.*}` / `{site.*}` / `{route.*}` work everywhere +4. `<meta name="description">` — the entry's `seoDescription` (post-type entries only) → `settings.metaDescription`; omitted when neither is set, and token-interpolated the same way 5. `<link rel="icon">` if a favicon is configured 6. `<script type="importmap">` mapping bare specifiers (e.g. `three`) to `/_instatic/runtime/cache/<hash>/...` URLs 7. Runtime asset `<script>` tags (`scriptTagsForRuntimeAssets`) diff --git a/docs/features/templates.md b/docs/features/templates.md index ad4816d90..f89741345 100644 --- a/docs/features/templates.md +++ b/docs/features/templates.md @@ -230,6 +230,8 @@ Text props mix literal text + tokens: `parseTokenString(input)` returns `TokenSegmentNode[]`; `interpolateTokens(input, ctx)` evaluates and concatenates. Tokens that resolve to `undefined` render as the empty string. +Interpolation applies to string-typed props during the tree walk **and** to the document `<title>` + `<meta name="description">` (`buildDocumentMetaTags` in `src/core/publisher/render.ts`), so a site-wide `metaTitle` like `{currentEntry.name} | Acme` publishes per-entry SEO titles on entry routes. + Source: `src/core/templates/tokenInterpolation.ts`. --- diff --git a/src/__tests__/publisher/render.test.ts b/src/__tests__/publisher/render.test.ts index b01c86c01..7f7fddf3d 100644 --- a/src/__tests__/publisher/render.test.ts +++ b/src/__tests__/publisher/render.test.ts @@ -1030,4 +1030,74 @@ describe('publishPage', () => { expect(html).not.toContain('<script>') expect(html).toContain('<script>') }) + + // Token interpolation in <head> meta — entry routes carry the published row + // on the context's entryStack (seeded by renderPublishedDataRowTemplate), so + // `{currentEntry.*}` resolves to per-entry SEO titles/descriptions through + // the same engine dynamic text bindings use. + it('interpolates {currentEntry.*} tokens in metaTitle on an entry route', () => { + const proj = makeSite({ + settings: { ...makeSite().settings, metaTitle: '{currentEntry.name} | Acme Agency' }, + }) + const page = makePage({ root: { moduleId: 'base.text', props: { text: 'Hi' } } }) + const { html } = publishPage(page, proj, registry, { + templateContext: { + entryStack: [{ id: 'row-1', fields: { name: 'Our Discovery Process' } }], + }, + }) + expect(html).toContain('<title>Our Discovery Process | Acme Agency') + }) + + it('interpolates {currentEntry.*} tokens in the meta description', () => { + const proj = makeSite({ + settings: { ...makeSite().settings, metaDescription: '{currentEntry.summary}' }, + }) + const page = makePage({ root: { moduleId: 'base.text', props: { text: 'Hi' } } }) + const { html } = publishPage(page, proj, registry, { + templateContext: { + entryStack: [{ id: 'row-1', fields: { summary: 'How we run discovery.' } }], + }, + }) + expect(html).toContain('') + }) + + it('entry tokens in metaTitle degrade gracefully on a plain page (no leaked placeholders)', () => { + const proj = makeSite({ + settings: { ...makeSite().settings, metaTitle: '{currentEntry.name|Home} | Acme Agency' }, + }) + const page = makePage({ root: { moduleId: 'base.text', props: { text: 'Hi' } } }) + // No templateContext → empty entry stack → the token's own |fallback applies. + const { html } = publishPage(page, proj, registry) + expect(html).toContain('Home | Acme Agency') + expect(html).not.toContain('{currentEntry') + }) + + it('interpolates tokens in the page.title fallback of the chain', () => { + // No metaTitle set → the chain picks page.title, which may itself carry + // tokens (entry templates title themselves per-entry this way). + const page = makePage({ root: { moduleId: 'base.text', props: { text: 'Hi' } } }) + page.title = '{currentEntry.name} — {site.name}' + const { html } = publishPage(page, makeSite(), registry, { + templateContext: { entryStack: [{ id: 'row-1', fields: { name: 'Launch Week' } }] }, + }) + expect(html).toContain('<title>Launch Week — Test SiteDocument') + }) + + it('XSS: interpolated token values are escaped in and description', () => { + const proj = makeSite({ + settings: { + ...makeSite().settings, + metaTitle: '{currentEntry.name}', + metaDescription: '{currentEntry.name}', + }, + }) + const page = makePage({ root: { moduleId: 'base.text', props: { text: 'Hi' } } }) + const { html } = publishPage(page, proj, registry, { + templateContext: { + entryStack: [{ id: 'row-1', fields: { name: '<script>alert(1)</script>"' } }], + }, + }) + expect(html).not.toContain('<script>alert(1)') + expect(html).toContain('<title><script>alert(1)</script>"') + }) }) diff --git a/src/core/publisher/render.ts b/src/core/publisher/render.ts index ced8e5874..0c4e22627 100644 --- a/src/core/publisher/render.ts +++ b/src/core/publisher/render.ts @@ -24,6 +24,7 @@ import type { Page, SiteDocument } from '@core/page-tree' import type { IModuleRegistry } from '@core/module-engine' import type { TemplateRenderDataContext } from '@core/templates/dynamicBindings' import { buildPageFrame, buildSiteFrame, buildRouteFrame } from '@core/templates/contextFrames' +import { interpolateTokens } from '@core/templates/tokenInterpolation' import { classNamesForClassIds } from '@core/page-tree' import { normalizeHtmlAttributeName, @@ -325,6 +326,14 @@ function bodyHtmlAttributes(value: unknown): string { * site.name. * - `description` falls back through `documentMeta.description` → the * site-level metaDescription. + * - Whichever value wins is then token-interpolated against the render + * context before escaping, so `{currentEntry.*}` / `{page.*}` / + * `{site.*}` resolve per-entry on entry routes. That serves both ways + * of authoring a title: fill each row's SEO field by hand, or write one + * pattern like `{currentEntry.name} | Acme` on the template page. The + * fallback chain picks the raw value first; a token that resolves empty + * does NOT re-trigger the fallback — authors opt into fallbacks with the + * token's own `{...|fallback}` syntax. * - URL-typed settings (faviconUrl) are validated by * isSafeUrl() (blocks `javascript:` / `vbscript:` schemes) and then * escapeHtml()'d for safe attribute interpolation. @@ -341,19 +350,23 @@ interface DocumentMetaTags { function buildDocumentMetaTags( site: SiteDocument, page: Page, + context: TemplateRenderDataContext, override: DocumentMetaOverride = {}, ): DocumentMetaTags { const { settings } = site const description = override.description || settings.metaDescription const metaDesc = description - ? `\n ` + ? ` + ` : '' const favicon = settings.faviconUrl && isSafeUrl(settings.faviconUrl) ? `\n ` : '' return { - pageTitle: escapeHtml(override.title || (settings.metaTitle ?? page.title ?? site.name)), + pageTitle: escapeHtml( + interpolateTokens(override.title || (settings.metaTitle ?? page.title ?? site.name), context), + ), metaDesc, favicon, langAttr: escapeHtml(settings.language ?? 'en'), @@ -529,6 +542,11 @@ export function publishPage( // emit placeholders instead of recursing. const dynamicNodeIds = findDynamicNodeIds(page, site, registry) + // Composed once per page render: the walker reads it through the config, + // and the builder interpolates {source.field} tokens in the + // title/description against the same frames. + const templateContext = composeTemplateContext(page, site, options.templateContext) + // Read-only inputs of this render pass. A renderer that needs a different // page (VC ref) or template frame (loop iteration) derives a child config — // it never mutates this one. @@ -537,7 +555,7 @@ export function publishPage( site, registry, breakpointId: options.breakpointId, - templateContext: composeTemplateContext(page, site, options.templateContext), + templateContext, loopData: options.loopData, mediaAssets: options.mediaAssets, dynamicNodeIds: dynamicNodeIds.size > 0 ? dynamicNodeIds : undefined, @@ -585,7 +603,7 @@ export function publishPage( acc.cssMap, ) - const meta = buildDocumentMetaTags(site, page, options.documentMeta) + const meta = buildDocumentMetaTags(site, page, templateContext, options.documentMeta) const runtime = buildRuntimeAssetsBlock(options, acc) const csp = buildContentSecurityPolicy(runtime.anyScriptTag, runtime.importmap, acc.cspSources)