feat(preview): infer <site>.deco.site as an allowed draft preview host (#1224)

* feat(preview): infer <site>.deco.site as an allowed draft preview host

The draft-preview allowlist (DECO_ALLOWED_PREVIEW_HOSTS / site-block
previewHosts) required per-site opt-in, but DECO_SITE_NAME isn't always
in the env. Derive the deco-hosted preview domain from the site name the
runtime already resolves (opts.site ?? DECO_SITE_NAME ?? …) and register
it via setDecoSiteHost at Deco.init.

<site>.deco.site is merged ON TOP of the env/site-block list (never
replacing it) so a signed draft grant can preview on deco-operated infra
out of the box. The random dev fallback registers nothing, and a custom
production domain is never inferred — it stays inert.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(preview): add kill switch and document threat model for inferred host

Address review of the `<site>.deco.site` inference:

- `DECO_ALLOWED_PREVIEW_HOSTS=none` is now a kill switch that disables
  preview entirely (inferred host + site block included), restoring the
  env var's "stop a bad rollout without a deploy" escape hatch — which the
  merge-on-top had removed for the inferred host.
- Document the post-change threat model: a named site is no longer inert
  by default, the request host is spoofable, so the signed `?__draft=`
  grant is the sole remaining gate; host-scoping only bounds blast radius.
- Fix the now-stale `isDraftPreviewEnabled` docstring.
- Tests: kill switch, and undefined (random dev fallback) registering no host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: guitavano

engine/decofile/draft.test.ts

@@ -10,6 +10,7 @@ import {
   previewApiOriginForHost,
   resolveDraftDecofile,
   resolveDraftForRequest,
+  setDecoSiteHost,
   setDraftPreviewHosts,
 } from "./draft.ts";
 
@@ -352,6 +353,80 @@ Deno.test("site-block preview hosts", async (t) => {
   });
 });
 
+Deno.test("deco-hosted preview domain (setDecoSiteHost)", async (t) => {
+  await t.step("infers <site>.deco.site and enables the feature", () => {
+    setDecoSiteHost("als-storefront");
+    try {
+      assertEquals(isDraftPreviewEnabled({}), true);
+      assertEquals(isDraftHostAllowed("als-storefront.deco.site", {}), true);
+      assertEquals(isDraftHostAllowed("other.deco.site", {}), false);
+      // A custom production domain is never inferred.
+      assertEquals(isDraftHostAllowed("www.als-storefront.com", {}), false);
+    } finally {
+      setDecoSiteHost(null);
+    }
+  });
+
+  await t.step("is merged ON TOP of the site block, not replacing it", () => {
+    setDraftPreviewHosts(["fila.vtex.app"]);
+    setDecoSiteHost("als-storefront");
+    try {
+      assertEquals(isDraftHostAllowed("fila.vtex.app", {}), true);
+      assertEquals(isDraftHostAllowed("als-storefront.deco.site", {}), true);
+    } finally {
+      setDraftPreviewHosts([]);
+      setDecoSiteHost(null);
+    }
+  });
+
+  await t.step("is merged ON TOP of the env escape hatch too", () => {
+    setDecoSiteHost("als-storefront");
+    try {
+      const env = { DECO_ALLOWED_PREVIEW_HOSTS: "other.example" };
+      assertEquals(isDraftHostAllowed("other.example", env), true);
+      assertEquals(isDraftHostAllowed("als-storefront.deco.site", env), true);
+    } finally {
+      setDecoSiteHost(null);
+    }
+  });
+
+  await t.step("a blank/null site name registers no host", () => {
+    setDecoSiteHost("   ");
+    try {
+      assertEquals(isDraftPreviewEnabled({}), false);
+    } finally {
+      setDecoSiteHost(null);
+    }
+  });
+
+  await t.step("undefined (the random dev fallback) registers no host", () => {
+    // runtime/mod.ts passes `resolvedSite` (undefined when the site name falls
+    // back to randomSiteName) straight through — an unnamed site is not armed.
+    setDecoSiteHost(undefined);
+    try {
+      assertEquals(isDraftPreviewEnabled({}), false);
+    } finally {
+      setDecoSiteHost(null);
+    }
+  });
+
+  await t.step("DECO_ALLOWED_PREVIEW_HOSTS=none kills the inferred host", () => {
+    setDraftPreviewHosts(["fila.vtex.app"]);
+    setDecoSiteHost("als-storefront");
+    try {
+      // The kill switch wins over the inferred host AND the site block, so a
+      // bad rollout can be stopped without a deploy.
+      const env = { DECO_ALLOWED_PREVIEW_HOSTS: "none" };
+      assertEquals(isDraftPreviewEnabled(env), false);
+      assertEquals(isDraftHostAllowed("als-storefront.deco.site", env), false);
+      assertEquals(isDraftHostAllowed("fila.vtex.app", env), false);
+    } finally {
+      setDraftPreviewHosts([]);
+      setDecoSiteHost(null);
+    }
+  });
+});
+
 Deno.test("draftPointerFromRequest", async (t) => {
   await t.step("reads the __deco_draft cookie", () => {
     const req = new Request(

engine/decofile/draft.ts

@@ -182,7 +182,7 @@ export function previewApiOriginForHost(
  * (possibly drafted) release: an allowlist readable through the draft could be
  * rewritten by the very draft it gates.
  */
-const G = globalThis as { __decoDraftHosts?: string[] };
+const G = globalThis as { __decoDraftHosts?: string[]; __decoSiteHost?: string };
 
 /** Install the site-declared preview hosts. Called at setup by the site app. */
 export function setDraftPreviewHosts(hosts: readonly unknown[]): void {
@@ -192,20 +192,54 @@ export function setDraftPreviewHosts(hosts: readonly unknown[]): void {
     .filter(Boolean);
 }
 
+/**
+ * Register the deco-hosted preview domain, derived from the resolved site name
+ * (`opts.site ?? DECO_SITE_NAME ?? …`, resolved by the runtime at setup).
+ *
+ * MERGED with the site-block/env list rather than replacing it: `<site>.deco.site`
+ * is deco-operated infra, so a signed draft grant can preview there out of the
+ * box, while a custom production domain — never inferred here — stays inert.
+ * Fed from the trusted setup-time site name, never from the request or a draft.
+ *
+ * Threat model, now that a named site is no longer inert by default: the
+ * request host is spoofable on a direct-to-origin request (the edge is trusted
+ * to set `x-forwarded-host`), so for a named site the SIGNED `?__draft=` grant
+ * is the sole remaining gate — host-scoping only bounds blast radius. Set
+ * `DECO_ALLOWED_PREVIEW_HOSTS=none` to kill preview entirely, including this
+ * inferred host, without a deploy.
+ */
+export function setDecoSiteHost(site: string | null | undefined): void {
+  const s = (site ?? "").trim().toLowerCase();
+  G.__decoSiteHost = s ? `${s}.deco.site` : undefined;
+}
+
 /**
  * Hosts allowed to render drafts.
  *
  * The site block is the expected source — the opt-in lives in the repo,
  * reviewed in a PR, versioned with branches. `DECO_ALLOWED_PREVIEW_HOSTS`
  * REPLACES it when set: an operational escape hatch (kill a bad value without
  * a deploy, add a machine-specific port) — not the primary configuration.
+ *
+ * The deco-hosted preview domain (`<site>.deco.site`, via `setDecoSiteHost`)
+ * is always ADDED on top, so a signed draft grant can preview on deco-operated
+ * infra without any per-site config.
+ *
+ * The sentinel `DECO_ALLOWED_PREVIEW_HOSTS=none` is a KILL SWITCH: it disables
+ * preview entirely — including the inferred host and the site block — so a bad
+ * rollout can be stopped without a deploy. It must win over every other source.
  */
 function readAllowedHosts(env: EnvLike): string[] {
   const fromEnv = (env.DECO_ALLOWED_PREVIEW_HOSTS ?? "")
     .split(",")
     .map((s) => s.trim().toLowerCase())
     .filter(Boolean);
-  return fromEnv.length > 0 ? fromEnv : (G.__decoDraftHosts ?? []);
+  if (fromEnv.includes("none")) return [];
+  const configured = fromEnv.length > 0 ? fromEnv : (G.__decoDraftHosts ?? []);
+  const siteHost = G.__decoSiteHost;
+  return siteHost && !configured.includes(siteHost)
+    ? [...configured, siteHost]
+    : configured;
 }
 
 /**
@@ -226,8 +260,10 @@ export function isDraftHostAllowed(
 
 /**
  * True when any host is allowed to preview. A cheap read callers use to gate
- * BEFORE touching the network, so an unconfigured site is fully inert. The
- * per-request host match happens later, in `isDraftHostAllowed`.
+ * BEFORE touching the network. A site with no config but a resolved name is now
+ * enabled here (its inferred `<site>.deco.site` host); `DECO_ALLOWED_PREVIEW_HOSTS=none`
+ * forces it back to fully inert. The per-request host match happens later, in
+ * `isDraftHostAllowed`.
  */
 export function isDraftPreviewEnabled(env?: EnvLike): boolean {
   return readAllowedHosts(envOrDeno(env)).length > 0;

engine/mod.ts

@@ -22,5 +22,6 @@ export {
   previewApiOriginForHost,
   resolveDraftDecofile,
   resolveDraftForRequest,
+  setDecoSiteHost,
   setDraftPreviewHosts,
 } from "./decofile/draft.ts";

runtime/mod.ts

@@ -16,6 +16,7 @@ import {
   DRAFT_QUERY_PARAM,
   draftPointerFromRequest,
   resolveDraftForRequest,
+  setDecoSiteHost,
 } from "../engine/decofile/draft.ts";
 import { fromJSON } from "../engine/decofile/fetcher.ts";
 import { DRAFT_PREVIEW_KEY } from "./draftBadge.ts";
@@ -86,7 +87,12 @@ export class Deco<TAppManifest extends AppManifest = AppManifest> {
   static async init<TAppManifest extends AppManifest = AppManifest>(
     opts?: DecoOptions<TAppManifest>,
   ): Promise<Deco<TAppManifest>> {
-    const site = opts?.site ?? siteNameFromEnv() ?? randomSiteName();
+    const resolvedSite = opts?.site ?? siteNameFromEnv();
+    const site = resolvedSite ?? randomSiteName();
+    // Allow drafts to preview on the deco-hosted `<site>.deco.site` domain out
+    // of the box. Skipped for the random dev fallback (an unnamed site is not a
+    // preview host); a custom production domain is never inferred.
+    setDecoSiteHost(resolvedSite);
     const decofile = opts?.decofile ?? (await getProvider());
     const manifest = opts?.manifest ??
       (await import(toFileUrl(join(Deno.cwd(), "manifest.gen.ts")).href).then(