import AppKit
import SwiftUI
import WebKit
/// Host HTML/SVG stay on fetch → `loadHTMLString` + CSP.
/// WKWebView must not URL-load `/files/raw`.
enum MacHTMLPreviewLoadMode: Equatable, Sendable {
case htmlString
case none
}
enum MacHTMLPreviewSecurity {
static let contentSecurityPolicy = "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src data: blob:; media-src data: blob:; font-src data: blob:; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'none'; child-src 'none'; frame-src 'none'; object-src 'none'; worker-src 'none'"
@MainActor
static func makeConfiguration() -> WKWebViewConfiguration {
let configuration = WKWebViewConfiguration()
configuration.websiteDataStore = .nonPersistent()
configuration.mediaTypesRequiringUserActionForPlayback = .all
configuration.preferences.javaScriptCanOpenWindowsAutomatically = false
return configuration
}
static func injectContentSecurityPolicy(into html: String) -> String {
let metaTag = ""
if let headRange = html.range(of: "]*>", options: [.regularExpression, .caseInsensitive]) {
var secured = html
secured.insert(contentsOf: metaTag, at: headRange.upperBound)
return secured
}
if let htmlRange = html.range(of: "]*>", options: [.regularExpression, .caseInsensitive]) {
var secured = html
secured.insert(contentsOf: "\(metaTag)", at: htmlRange.upperBound)
return secured
}
return "\(metaTag)\(html)"
}
static func allowsEmbeddedNavigation(to url: URL?) -> Bool {
guard let scheme = url?.scheme?.lowercased() else { return true }
return scheme == "about" || scheme == "data" || scheme == "blob"
}
static func isHTTPURL(_ url: URL?) -> Bool {
guard let scheme = url?.scheme?.lowercased() else { return false }
return scheme == "http" || scheme == "https"
}
static func isHostRawFileURL(_ url: URL?) -> Bool {
guard let url, isHTTPURL(url) else { return false }
return url.path == "/files/raw" || url.path.hasSuffix("/files/raw")
}
static func webViewLoadMode(for path: String) -> MacHTMLPreviewLoadMode {
switch FileType.detect(from: path) {
case .html:
return .htmlString
case .image where (path as NSString).pathExtension.lowercased() == "svg":
return .htmlString
default:
return .none
}
}
static func usesMarkupPreview(path: String) -> Bool {
webViewLoadMode(for: path) == .htmlString
}
}
enum MacMarkupPreviewKind: Equatable, Hashable, Sendable {
case html
case svg
var sourceLanguage: String {
switch self {
case .html: "html"
case .svg: "xml"
}
}
var label: String {
switch self {
case .html: "HTML"
case .svg: "SVG"
}
}
static func from(htmlBlock: String) -> MacMarkupPreviewKind {
isSVGMarkup(htmlBlock) ? .svg : .html
}
static func from(file: ToolContentDescriptor.File) -> MacMarkupPreviewKind? {
if file.fileType == .html {
return .html
}
if let path = file.filePath, MacHTMLPreviewSecurity.usesMarkupPreview(path: path) {
return .svg
}
return nil
}
static func isSVGMarkup(_ text: String) -> Bool {
let trimmed = text.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
if trimmed.hasPrefix("` data URI.
enum MacSVGPreviewSecurity {
static let contentSecurityPolicy = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; media-src data:"
@MainActor
static func makeConfiguration() -> WKWebViewConfiguration {
let configuration = WKWebViewConfiguration()
configuration.websiteDataStore = .nonPersistent()
configuration.mediaTypesRequiringUserActionForPlayback = .all
configuration.preferences.javaScriptCanOpenWindowsAutomatically = false
configuration.defaultWebpagePreferences.allowsContentJavaScript = false
return configuration
}
static func htmlDocumentEmbedding(svg: String) -> String {
let base64 = Data(svg.utf8).base64EncodedString()
return """
)
"""
}
}
/// WKWebView adapter: `loadHTMLString` only, CSP injected, no `/files/raw` URL loads.
/// HTML keeps inline script. SVG uses `MacSVGPreviewSecurity` instead of the HTML CSP.
struct MacHTMLWebView: NSViewRepresentable {
let html: String
var kind: MacMarkupPreviewKind = .html
func makeCoordinator() -> Coordinator {
Coordinator(kind: kind)
}
func makeNSView(context: Context) -> WKWebView {
let configuration = kind == .svg
? MacSVGPreviewSecurity.makeConfiguration()
: MacHTMLPreviewSecurity.makeConfiguration()
let webView = WKWebView(frame: .zero, configuration: configuration)
webView.navigationDelegate = context.coordinator
webView.uiDelegate = context.coordinator
webView.allowsBackForwardNavigationGestures = false
webView.underPageBackgroundColor = .clear
context.coordinator.load(html, in: webView)
return webView
}
func updateNSView(_ webView: WKWebView, context: Context) {
context.coordinator.kind = kind
context.coordinator.load(html, in: webView)
}
@MainActor
final class Coordinator: NSObject, WKNavigationDelegate, WKUIDelegate {
var kind: MacMarkupPreviewKind
private var loadedHTML: String?
init(kind: MacMarkupPreviewKind) {
self.kind = kind
}
func load(_ html: String, in webView: WKWebView) {
let secured = kind == .svg
? MacSVGPreviewSecurity.htmlDocumentEmbedding(svg: html)
: MacHTMLPreviewSecurity.injectContentSecurityPolicy(into: html)
guard loadedHTML != secured else { return }
loadedHTML = secured
webView.loadHTMLString(secured, baseURL: nil)
}
func webView(
_ webView: WKWebView,
decidePolicyFor navigationAction: WKNavigationAction,
decisionHandler: @escaping (WKNavigationActionPolicy) -> Void
) {
if MacHTMLPreviewSecurity.isHostRawFileURL(navigationAction.request.url) {
decisionHandler(.cancel)
return
}
if MacHTMLPreviewSecurity.allowsEmbeddedNavigation(to: navigationAction.request.url) {
decisionHandler(.allow)
return
}
if MacHTMLPreviewSecurity.isHTTPURL(navigationAction.request.url),
navigationAction.navigationType != .other,
let url = navigationAction.request.url {
NSWorkspace.shared.open(url)
}
decisionHandler(.cancel)
}
func webView(
_ webView: WKWebView,
createWebViewWith configuration: WKWebViewConfiguration,
for navigationAction: WKNavigationAction,
windowFeatures: WKWindowFeatures
) -> WKWebView? {
if MacHTMLPreviewSecurity.isHostRawFileURL(navigationAction.request.url) {
return nil
}
if MacHTMLPreviewSecurity.isHTTPURL(navigationAction.request.url),
let url = navigationAction.request.url {
NSWorkspace.shared.open(url)
}
return nil
}
func webViewWebContentProcessDidTerminate(_ webView: WKWebView) {
guard let html = loadedHTML else { return }
loadedHTML = nil
webView.loadHTMLString(html, baseURL: nil)
loadedHTML = html
}
}
}