Answers /_preview/doc-example/:kind/:id/:index with MishkaDocumentWeb.Live.ExamplePreview: one example of a page of a document, or of one of its notes, drawn alone and live, for the frame of the kit's doc-example Preview dialog.

kind is section or note, id a UUID and index a whole number; anything else is the 404 every missing page is. The LiveView is handed, signed into the page, the example's source, the visitor's session as the CMS's runtime pages are handed it and the response's CSP nonce (MishkaCmsCore.Runtime.CspNonce).

Headers

The response is never indexed: x-robots-tag: noindex, nofollow, beside the robots tag the page carries and the Disallow: /_preview/ of the site's robots.txt.

It is served its own Content-Security-Policy, enforced whatever the site's own mode is, and no report-only one:

• default-src 'self', base-uri 'none', object-src 'none', form-action 'self';
• frame-ancestors 'self' — only a page of the site itself may frame it — beside the x-frame-options: SAMEORIGIN the site's pipeline already sends;
• script-src 'self' and this response's nonce, and no host;
• connect-src 'self' and the LiveView socket of the address asked, ws:// and wss://;
• img-src, media-src, font-src, frame-src, style-src, style-src-elem and style-src-attr as the site's own policy for this response says, so the example draws what it draws on the page and nothing more; when the site sends none, 'self' — with data: for an image and a font, the nonce for a style element, and a style attribute as MishkaCmsWeb.Runtime.Plugs.SecurityHeaders.inline_style_allowed?/0 answers.