import { useState } from 'react'; import { FontAwesomeIcon } from '@fortawesome/react-fontawesome'; import { faPlus, faTrash } from '@fortawesome/pro-duotone-svg-icons'; import { Input } from '@/components/base/input/input'; import { Toggle } from '@/components/base/toggle/toggle'; import { Button } from '@/components/base/buttons/button'; // Widget form — mirrors WidgetConfig from // helix-engage-server/src/config/widget.defaults.ts. The site key and site ID // are read-only (generated / rotated by the backend), the rest are editable. // // allowedOrigins is an origin allowlist — an empty list means "any origin" // which is useful for testing but should be tightened in production. export type WidgetFormValues = { enabled: boolean; url: string; allowedOrigins: string[]; embed: { loginPage: boolean; }; }; export const emptyWidgetFormValues = (): WidgetFormValues => ({ enabled: true, url: '', allowedOrigins: [], embed: { loginPage: false, }, }); type WidgetFormProps = { value: WidgetFormValues; onChange: (value: WidgetFormValues) => void; }; export const WidgetForm = ({ value, onChange }: WidgetFormProps) => { const [originDraft, setOriginDraft] = useState(''); const addOrigin = () => { const trimmed = originDraft.trim(); if (!trimmed) return; if (value.allowedOrigins.includes(trimmed)) { setOriginDraft(''); return; } onChange({ ...value, allowedOrigins: [...value.allowedOrigins, trimmed] }); setOriginDraft(''); }; const removeOrigin = (origin: string) => { onChange({ ...value, allowedOrigins: value.allowedOrigins.filter((o) => o !== origin) }); }; return (

Activation

When disabled, widget.js returns an empty response and the script no-ops on the embedding page. Use this as a kill switch if something goes wrong in production.

onChange({ ...value, enabled: checked })} />

Hosting

Public base URL where widget.js is served from. Leave blank to use the same origin as this sidecar (the common case).

onChange({ ...value, url: v })} />

Allowed origins

Origins where the widget may be embedded. An empty list means any origin is accepted (test mode). In production, list every hospital website + staging environment explicitly.

{value.allowedOrigins.length === 0 ? (

Any origin allowed — widget runs in test mode.

) : ( )}

Embed surfaces

Where inside this application the widget should auto-render. Keep these off if you only plan to embed it on your public hospital website.

onChange({ ...value, embed: { ...value.embed, loginPage: checked } }) } />
); };