From 45e686259a540231af1ffef1f1df6b66abe782bd Mon Sep 17 00:00:00 2001
From: SupunKavinda <supunkavinda1125@gmail.com>
Date: Wed, 23 Oct 2024 15:51:27 +0530
Subject: [PATCH] wip

---
 src/Embed/Iframe/PrivacyIframe.php |  8 ++++++++
 src/Unfold.php                     |  2 +-
 src/UnfoldConfig.php               | 25 +++++++++++++++++++------
 3 files changed, 28 insertions(+), 7 deletions(-)
 create mode 100644 src/Embed/Iframe/PrivacyIframe.php

diff --git a/src/Embed/Iframe/PrivacyIframe.php b/src/Embed/Iframe/PrivacyIframe.php
new file mode 100644
index 0000000..907c834
--- /dev/null
+++ b/src/Embed/Iframe/PrivacyIframe.php
@@ -0,0 +1,8 @@
+<?php
+
+namespace Hyvor\Unfold\Embed\Iframe;
+
+class PrivacyIframe
+{
+
+}
\ No newline at end of file
diff --git a/src/Unfold.php b/src/Unfold.php
index e9cf45e..2939a6b 100644
--- a/src/Unfold.php
+++ b/src/Unfold.php
@@ -30,7 +30,7 @@ public static function unfold(
         } else {
             // both
             // TODO:
-            throw new \Exception('Not implemented yet');
+            throw new \Exception('Not implemented yet'); // @codeCoverageIgnore
         }
     }
 }
diff --git a/src/UnfoldConfig.php b/src/UnfoldConfig.php
index 2c36853..3c4cc42 100644
--- a/src/UnfoldConfig.php
+++ b/src/UnfoldConfig.php
@@ -34,12 +34,24 @@ public function __construct(
         public UnfoldMethod $method = UnfoldMethod::LINK,
 
         /**
-         * Whether to wrap the embed HTML in an iframe with `srcdoc`
-         * This is useful for security and privacy reasons.
-         * If set to false, the embed HTML will be directly used, which would give Javascript access to
-         * the parent page.
+         * Adding embed codes directly to the page can be a privacy concern since
+         * it gives third-party platforms full access to the page via Javascript.
+         * The best solution is to wrap the embed code in an iframe.
+         *
+         * We tried using iframe `srcdoc` directly, but it resulted in many inconsistencies and issues
+         * with different platforms (ex: Reddit does not support about: scheme in srcdoc).
+         *
+         * So, the best solution is to use an iframe endpoint that wraps the embed code.
+         * This requires you to add an endpoint to your app to serve the iframe.
+         * Then, set that endpoint's absolute URL in this config.
+         * See https://unfold.hyvor.com/iframe for more details.
+         *
+         * Ex: 'https://yourapp.com/unfold-iframe'
+         *
+         * If this option is set to a string, the embed code will be wrapped in an iframe.
+         * It also comes with JS code to handle iframe resizing.
          */
-        public bool $embedWrapInIframe = true,
+        public ?string $embedIframeEndpoint = null,
 
         /**
          * If the $method is UnfoldMethod::EMBED or UnfoldMethod::EMBED_LINK,
@@ -81,7 +93,8 @@ public function __construct(
         public ?string $facebookAccessToken = null,
 
         // CACHE
-    ) {
+    )
+    {
         $this->setHttpClient($httpClient);
     }