ClientUtils.PreviewFraming (client_utils v0.1.35)

Lets the CodeMySpec preview pane embed this application, and nothing else.

Phoenix's put_secure_browser_headers/1 sends content-security-policy: base-uri 'self'; frame-ancestors 'self';. That is the right default and it refuses the preview: a pane on codemyspec.com framing an app on its own preview host is a different origin, so the browser declines to render it.

The refusal is silent. No request fails, no log line appears, and the iframe element looks perfectly healthy while showing nothing — which reads to the person watching as their app being broken. That failure mode is the whole reason this exists rather than being left to whoever notices.

Why the application says this rather than a proxy

It used to be a proxy. Every preview request went through CodeMySpec, which rewrote the header on the way back. That works only while the app is somewhere CodeMySpec can dial, and the preview now reaches applications over a tunnel they open themselves — a laptop behind a router, a container, a machine on a network nobody here has heard of. Nothing sits in that path any more.

Which is the better arrangement anyway: the application knows whether it is meant to be embedded. A proxy could only assert it on the app's behalf.

Nothing is widened until there is a preview

With no preview configured this is a no-op and 'self' stands. An application that is not being previewed gains no new embedder, so adding the plug to a pipeline is not itself a loosening — the loosening happens when onboarding records a preview, and lasts only as long as one is configured.

Use

plug ClientUtils.PreviewFraming, otp_app: :my_app

In the :browser pipeline, after :put_secure_browser_headers — it replaces that header's value, so running first would have the default write over it.

otp_app: is how it finds the preview: the address lives in the consuming application's own :preview config, not in this library's. Without it the plug is a no-op, which is the right failure — a library that guessed would answer the same thing for every application in the release.