wip

src/Embed/Iframe/PrivacyIframe.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace Hyvor\Unfold\Embed\Iframe;
+
+class PrivacyIframe
+{
+
+}

src/Unfold.php

@@ -30,7 +30,7 @@ public static function unfold(
         } else {
             // both
             // TODO:
-            throw new \Exception('Not implemented yet');
+            throw new \Exception('Not implemented yet'); // @codeCoverageIgnore
         }
     }
 }

src/UnfoldConfig.php

@@ -34,12 +34,24 @@ public function __construct(
         public UnfoldMethod $method = UnfoldMethod::LINK,
 
         /**
-         * Whether to wrap the embed HTML in an iframe with `srcdoc`
-         * This is useful for security and privacy reasons.
-         * If set to false, the embed HTML will be directly used, which would give Javascript access to
-         * the parent page.
+         * Adding embed codes directly to the page can be a privacy concern since
+         * it gives third-party platforms full access to the page via Javascript.
+         * The best solution is to wrap the embed code in an iframe.
+         *
+         * We tried using iframe `srcdoc` directly, but it resulted in many inconsistencies and issues
+         * with different platforms (ex: Reddit does not support about: scheme in srcdoc).
+         *
+         * So, the best solution is to use an iframe endpoint that wraps the embed code.
+         * This requires you to add an endpoint to your app to serve the iframe.
+         * Then, set that endpoint's absolute URL in this config.
+         * See https://unfold.hyvor.com/iframe for more details.
+         *
+         * Ex: 'https://yourapp.com/unfold-iframe'
+         *
+         * If this option is set to a string, the embed code will be wrapped in an iframe.
+         * It also comes with JS code to handle iframe resizing.
          */
-        public bool $embedWrapInIframe = true,
+        public ?string $embedIframeEndpoint = null,
 
         /**
          * If the $method is UnfoldMethod::EMBED or UnfoldMethod::EMBED_LINK,
@@ -81,7 +93,8 @@ public function __construct(
         public ?string $facebookAccessToken = null,
 
         // CACHE
-    ) {
+    )
+    {
         $this->setHttpClient($httpClient);
     }