[codex] Secure Open Graph image endpoint (#1296)

* fix: secure open graph image endpoint

Build generated Open Graph image URLs from the current page URL instead of raw title and description text. Validate same-origin document URLs in the Cloudflare image function and extract preview text from fetched HTML metadata.

* refactor: simplify og metadata extraction

Parse the fetched HTML response directly when extracting Open Graph preview text instead of using callback state from HTMLRewriter.

* fix: fetch og page through assets binding

Use the Cloudflare Pages ASSETS binding to read same-origin page HTML for OG image rendering instead of issuing a public same-origin fetch from the function.

Author: jderochervlk

apps/docs/__tests__/Meta_.test.res

@@ -11,9 +11,43 @@ let getMetaContent = name => {
   }
 }
 
+let getMetaPropertyContent = property => {
+  switch document->WebAPI.Document.querySelector(`meta[property='${property}']`) {
+  | Value(element) =>
+    switch element->WebAPI.Element.getAttribute("content") {
+    | Value(content) => content
+    | Null => failwith(`expected ${property} meta tag to have content`)
+    }
+  | Null => failwith(`expected ${property} meta tag`)
+  }
+}
+
 test("renders DocSearch crawler meta tags", async () => {
-  let _screen = await render(<Meta />)
+  let _screen = await render(
+    <ReactRouter.MemoryRouter initialEntries=["/docs/manual/introduction"]>
+      <Meta />
+    </ReactRouter.MemoryRouter>,
+  )
 
   expect(getMetaContent("docsearch:language"))->toBe("en")
   expect(getMetaContent("docsearch:version"))->toBe("v12,latest")
 })
+
+test("generates Open Graph image URLs from the current page URL", async () => {
+  let pagePath = "/docs/manual/introduction?preview=true"
+  let rootUrl = Env.root_url->Stdlib.String.endsWith("/") ? Env.root_url : Env.root_url ++ "/"
+  let pageUrl = rootUrl ++ "docs/manual/introduction?preview=true"
+
+  let _screen = await render(
+    <ReactRouter.MemoryRouter initialEntries=[pagePath]>
+      <Meta
+        title=?{Some("Raw title should not be in the image URL")}
+        description="Raw description should not be in the image URL"
+      />
+    </ReactRouter.MemoryRouter>,
+  )
+
+  expect(getMetaPropertyContent("og:image"))->toBe(
+    `${rootUrl}ogimage/index.png?url=${encodeURIComponent(pageUrl)}`,
+  )
+})

apps/docs/app/routes/BlogArticle.res

@@ -127,7 +127,6 @@ let make = (props: props) => {
         siteName="ReScript Blog"
         title={title ++ " | ReScript Blog"}
         description=?{description->Nullable.toOption}
-        ogImage={Util.Url.makeOpenGraphImageUrl(title, description->Nullable.getOr(""))}
       />
       <div className="mb-10 md:mb-20">
         <BlogHeader