Marco/einfach-produktiv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gate the company-settings preview page behind Draft Mode

Browse Source 
Unlike the email-templates preview (marketing copy), this page shows
real bank/address details once filled in — it must not render for an
unauthenticated visitor who finds the URL.
This commit is contained in:
Marco
2026-07-22 11:14:26 +00:00
parent e50d43ea44
commit d249614027
2 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/company-settings-preview/page.tsx
+12 -6
View File
@@ -1,5 +1,6 @@
import type { Metadata } from "next";
import { draftMode } from "next/headers";
import { notFound } from "next/navigation";
import { getCompanySettings, type CompanySettings } from "../lib/payload";
import { LiveCompanySettingsPreviewClient } from "./components/LiveCompanySettingsPreviewClient";
@@ -22,13 +23,18 @@ const FALLBACK: CompanySettings = {
// Entered exclusively via CompanySettings.ts's admin.livePreview.url (a
// Payload-admin-only iframe target, see buildPreviewUrl()/api/preview) —
// not a page a real visitor would ever land on. Unlike email-templates
// there's no draft/published distinction here (company-settings has no
// content-versioning concept, it's just the current row) — the initial
// fetch is the same live data getCompanySettings() always returns,
// useLivePreview() takes over from there as the admin edits fields.
// gated on Draft Mode actually being enabled, unlike email-templates'
// preview: this data includes a real bank IBAN/address once filled in,
// not just marketing email copy, so this page must not render for an
// unauthenticated visitor who happens to find the URL. Unlike
// email-templates there's no draft/published distinction in the data
// itself (company-settings has no content-versioning concept, it's just
// the current row) — the initial fetch is the same live data
// getCompanySettings() always returns, useLivePreview() takes over from
// there as the admin edits fields.
export default async function CompanySettingsPreviewPage() {
await draftMode();
const draft = await draftMode();
if (!draft.isEnabled) notFound();
const initialSettings = (await getCompanySettings()) ?? FALLBACK;
return <LiveCompanySettingsPreviewClient initialSettings={initialSettings} />;
}