Merge branch 'fix-embeddable-cors' of https://github.com/GitbookIO/gitbook into fix-embeddable-cors

Co-authored-by: conico974 <nicodorseuil@yahoo.fr>

.changeset/some-bats-admire.md

@@ -0,0 +1,5 @@
+---
+"gitbook": patch
+---
+
+Fix CORS error when using embed script.js directly

packages/gitbook/src/app/sites/static/[mode]/[siteURL]/[siteData]/~gitbook/embed/script.js/route.ts

@@ -7,6 +7,14 @@ import type { NextRequest } from 'next/server';
 
 export const dynamic = 'force-static';
 
+const EMBEDDABLE_RESPONSE_HEADERS = {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Methods': 'GET, OPTIONS',
+    'Access-Control-Allow-Headers': '*',
+    'Cross-Origin-Resource-Policy': 'cross-origin',
+    'Cache-Control': 'public, s-maxage=86400, stale-while-revalidate=604800',
+};
+
 /**
  * This route is used to serve the assistant.js script.
  */
@@ -69,8 +77,8 @@ export async function GET(
         `,
         {
             headers: {
+                ...EMBEDDABLE_RESPONSE_HEADERS,
                 'Content-Type': 'application/javascript',
-                'Cache-Control': 'public, max-age=86400, stale-while-revalidate=604800',
             },
         }
     );

packages/gitbook/tests/embed.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'bun:test';
+import { getContentTestURL } from './utils';
+
+const EMBED_SCRIPT_URL = getContentTestURL(
+    'https://gitbook.gitbook.io/test-gitbook-open/~gitbook/embed/script.js'
+);
+
+describe('embed script', () => {
+    it('serves the embeddable script with permissive headers', async () => {
+        const response = await fetch(EMBED_SCRIPT_URL, {
+            headers: {
+                Origin: 'https://example.com',
+            },
+        });
+
+        expect(response.status).toBe(200);
+        expect(response.headers.get('content-type')).toContain('application/javascript');
+        expect(response.headers.get('access-control-allow-origin')).toBe('*');
+        expect(response.headers.get('cross-origin-resource-policy')).toBe('cross-origin');
+
+        const body = await response.text();
+        expect(body).toContain('w.GitBook');
+    });
+});