widget improvement + install for customer sites guideline

src/widget/widget.controller.ts

@@ -1,59 +1,54 @@
-import { Controller, Get, Query, Header, BadRequestException, Req, Res } from '@nestjs/common';
+import { Controller, Get, Query, BadRequestException, Req, Res } from '@nestjs/common';
+import { Request, Response } from 'express';
 import { Public } from 'src/auth/auth.decorator';
 import { WidgetService } from './widget.service';
 
 @Controller('widget')
 @Public()
 export class WidgetController {
-  constructor(private readonly widgetService: WidgetService) { }
+  constructor(private readonly widgetService: WidgetService) {}
 
   @Get('script')
-  @Header('Content-Type', 'application/javascript')
-  @Header('Access-Control-Allow-Origin', 'https://staging.hdmplus.ir/, https://si24.ir')
-  @Header('X-Frame-Options', 'ALLOW-FROM https://staging.hdmplus.ir/ https://si24.ir')
-  @Header(
-    'Content-Security-Policy',
-    "frame-ancestors 'self' https://staging.hdmplus.ir/ https://si24.ir",
-  )
-  @Header('X-Content-Type-Options', 'nosniff')
   getWidgetScript(
     @Query('apiKey') apiKey: string,
     @Req() req: Request,
-  ): string {
-    if (!apiKey) {
-      throw new BadRequestException('API key is required');
+    @Res() res: Response,
+  ) {
+    if (!this.widgetService.isValidApiKey(apiKey)) {
+      throw new BadRequestException(
+        apiKey ? 'Invalid API key' : 'API key is required',
+      );
     }
 
-    const isValidApiKey =
-      Buffer.from(apiKey).length === Buffer.from('si24samanwebsite').length &&
-      Buffer.from(apiKey).compare(Buffer.from('si24samanwebsite')) === 0;
-
-    if (!isValidApiKey) {
-      throw new BadRequestException('Invalid API key');
-    }
-
-    return this.widgetService.generateWidgetScript();
+    this.widgetService.applyScriptHeaders(req, res);
+    return res.send(this.widgetService.generateWidgetScript());
   }
 
   @Get('iframe')
-  async getIframeScript(
+  getIframeScript(
     @Query('apiKey') apiKey: string,
     @Req() req: Request,
-    @Res() res,
+    @Res() res: Response,
   ) {
-    if (!apiKey || apiKey !== 'si24samanwebsite') {
+    if (!this.widgetService.isValidApiKey(apiKey)) {
       throw new BadRequestException('API key is invalid or missing');
     }
 
-    res.set({
-      'Content-Type': 'application/javascript',
-      'Access-Control-Allow-Origin': 'https://staging.hdmplus.ir/, https://si24.ir',
-      'X-Frame-Options': 'ALLOW-FROM https://staging.hdmplus.ir/ https://si24.ir',
-      'Content-Security-Policy': "frame-ancestors 'self' https://staging.hdmplus.ir/ https://si24.ir",
-      'X-Content-Type-Options': 'nosniff',
-    });
-
-    const script = this.widgetService.generateWidgetScriptWithoutStyle();
-    return res.send(script);
+    this.widgetService.applyScriptHeaders(req, res);
+    return res.send(this.widgetService.generateWidgetScriptWithoutStyle());
   }
-} 
+
+  @Get('demo')
+  getWidgetDemo(@Res() res: Response) {
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Cache-Control', 'no-store');
+    return res.send(this.widgetService.generateDemoHtml());
+  }
+
+  @Get('frame')
+  getWidgetFrame(@Res() res: Response) {
+    this.widgetService.applyFrameHeaders(res);
+    return res.send(this.widgetService.generateFrameHtml());
+  }
+}