From 1b8c7dfd52def57c85545fa5f0fb121d974513cd Mon Sep 17 00:00:00 2001
From: Alex Patterson <alex@flipfeeds.com>
Date: Fri, 16 Oct 2026 22:59:29 -0400
Subject: [PATCH] fix(site): allow sanity.io in CSP frame-ancestors and
 resilient iframe visual editing

---
 apps/site/src/components/DraftModeToggle.astro | 15 +--------------
 apps/site/src/layouts/BaseLayout.astro         | 18 ++++++++++++++++++
 apps/site/src/lib/sanity/preview.ts            |  2 +-
 apps/site/src/middleware.ts                    |  2 +-
 4 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/apps/site/src/components/DraftModeToggle.astro b/apps/site/src/components/DraftModeToggle.astro
index 17bf0a03d..21cd74c48 100644
--- a/apps/site/src/components/DraftModeToggle.astro
+++ b/apps/site/src/components/DraftModeToggle.astro
@@ -10,6 +10,7 @@ const returnTo = Astro.url.pathname + Astro.url.search;
 <form
 	method="POST"
 	action="/api/draft-mode/disable"
+	data-sanity-preview
 	class="fixed bottom-4 right-4 z-50"
 >
 	<input type="hidden" name="returnTo" value={returnTo} />
@@ -20,17 +21,3 @@ const returnTo = Astro.url.pathname + Astro.url.search;
 		Exit draft mode
 	</button>
 </form>
-
-<script>
-	import { enableVisualEditing } from "@sanity/visual-editing-standalone";
-
-	enableVisualEditing({
-		refresh: (payload) => {
-			if (payload.source === "mutation" || payload.source === "manual") {
-				window.location.reload();
-				return Promise.resolve();
-			}
-			return false;
-		},
-	});
-</script>
diff --git a/apps/site/src/layouts/BaseLayout.astro b/apps/site/src/layouts/BaseLayout.astro
index e42e0594e..b31b40cb0 100644
--- a/apps/site/src/layouts/BaseLayout.astro
+++ b/apps/site/src/layouts/BaseLayout.astro
@@ -193,6 +193,24 @@ const graph = buildGraph([
 			<Footer />
 		</div>
 		{preview && <DraftModeToggle />}
+		<script>
+			import { enableVisualEditing } from "@sanity/visual-editing-standalone";
+
+			if (
+				window.self !== window.top ||
+				document.querySelector("[data-sanity-preview]")
+			) {
+				enableVisualEditing({
+					refresh: (payload) => {
+						if (payload.source === "mutation" || payload.source === "manual") {
+							window.location.reload();
+							return Promise.resolve();
+						}
+						return false;
+					},
+				});
+			}
+		</script>
 		<ChatModal />
 		<AnalyticsBeacon />
 	</body>
diff --git a/apps/site/src/lib/sanity/preview.ts b/apps/site/src/lib/sanity/preview.ts
index 8ae4f301a..7e74f2400 100644
--- a/apps/site/src/lib/sanity/preview.ts
+++ b/apps/site/src/lib/sanity/preview.ts
@@ -46,7 +46,7 @@ export function resolvePreview({
 	perspectiveParam,
 }: ResolvePreviewInput): PreviewContext {
 	const siteWide = env?.PUBLIC_SANITY_VISUAL_EDITING_ENABLED === "true";
-	if (!siteWide && !hasPreviewCookie) {
+	if (!siteWide && !hasPreviewCookie && !perspectiveParam) {
 		return { enabled: false };
 	}
 
diff --git a/apps/site/src/middleware.ts b/apps/site/src/middleware.ts
index 0f7d25edb..53ab04140 100644
--- a/apps/site/src/middleware.ts
+++ b/apps/site/src/middleware.ts
@@ -93,7 +93,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
 	response.headers.set(
 		"Content-Security-Policy",
-		"frame-ancestors 'self' https://*.sanity.studio http://localhost:3333",
+		"frame-ancestors 'self' https://*.sanity.studio https://*.sanity.io https://sanity.io http://localhost:3333",
 	);
 
 	// AIPREF / AI Preference Headers