Add TeamPreference to prevent document embedding (#10192)

* Add TeamPreference to prevent document embedding

- Add PreventDocumentEmbedding enum value to TeamPreference
- Add default value (false) to maintain backward compatibility
- Update TeamPreferences interface with new boolean property
- Modify renderShare function to respect team preference
- When preference is true, X-Frame-Options header is kept to prevent iframe embedding
- When preference is false (default), X-Frame-Options is removed to allow embedding

* Add preventDocumentEmbedding to TeamsUpdateSchema

- Add preventDocumentEmbedding boolean field to the preferences object in TeamsUpdateSchema
- This allows the new TeamPreference to be modified through the API
- The existing teamUpdater function will automatically handle the new preference
- API responses will include the preference via the presentTeam function

---------

Co-authored-by: codegen-sh[bot] <131295404+codegen-sh[bot]@users.noreply.github.com>

server/routes/api/teams/schema.ts

@@ -58,6 +58,8 @@ export const TeamsUpdateSchema = BaseSchema.extend({
           .optional(),
         /** Side to display the document's table of contents in relation to the main content. */
         tocPosition: z.nativeEnum(TOCPosition).optional(),
+        /** Whether to prevent shared documents from being embedded in iframes on external websites. */
+        preventDocumentEmbedding: z.boolean().optional(),
       })
       .optional(),
   }),

server/routes/app.ts

@@ -194,8 +194,11 @@ export const renderShare = async (ctx: Context, next: Next) => {
     ctx.status = 404;
   }
 
-  // Allow shares to be embedded in iframes on other websites
-  ctx.remove("X-Frame-Options");
+  // Allow shares to be embedded in iframes on other websites unless prevented by team preference
+  const preventEmbedding = team?.getPreference(TeamPreference.PreventDocumentEmbedding) ?? false;
+  if (!preventEmbedding) {
+    ctx.remove("X-Frame-Options");
+  }
 
   const publicBranding =
     team?.getPreference(TeamPreference.PublicBranding) ?? false;

shared/constants.ts

@@ -32,6 +32,7 @@ export const TeamPreferenceDefaults: TeamPreferences = {
   [TeamPreference.Commenting]: true,
   [TeamPreference.CustomTheme]: undefined,
   [TeamPreference.TocPosition]: TOCPosition.Left,
+  [TeamPreference.PreventDocumentEmbedding]: false,
 };
 
 export const UserPreferenceDefaults: UserPreferences = {

shared/types.ts

@@ -297,6 +297,8 @@ export enum TeamPreference {
   CustomTheme = "customTheme",
   /** Side to display the document's table of contents in relation to the main content. */
   TocPosition = "tocPosition",
+  /** Whether to prevent shared documents from being embedded in iframes on external websites. */
+  PreventDocumentEmbedding = "preventDocumentEmbedding",
 }
 
 export type TeamPreferences = {
@@ -310,6 +312,7 @@ export type TeamPreferences = {
   [TeamPreference.Commenting]?: boolean;
   [TeamPreference.CustomTheme]?: Partial<CustomTheme>;
   [TeamPreference.TocPosition]?: TOCPosition;
+  [TeamPreference.PreventDocumentEmbedding]?: boolean;
 };
 
 export enum NavigationNodeType {