A draft isn’t finished until someone has seen it on the real site. RustyCMS has three stages for that, each building on the last: a link to share, a preview while typing, and a click on the rendered page that opens the right field in the editor.
The link to share
A preview token is a signed short-lived permission: “show drafts of this collection, for this entry, in this language, for 24 hours.” The admin UI has a preview button on every entry that mints the token and opens the frontend URL. Whoever gets the link doesn’t need an account.
POST /api/preview-tokens
{ "collection": "post", "slug": "hello-world", "ttl_seconds": 86400 }
# → the frontend appends the token to the content read
GET /api/content/post/hello-world?preview=<token>&_resolve=allThe token is HMAC-signed with the same secret as the sessions. Minting requires write permission, redeeming only the token. The frontend sets no-store and noindex — a draft never ends up in a cache or a search engine.
Preview while typing
The second stage doesn’t need a save. While an editor types in the form, the admin UI pushes the current state to an ephemeral store, and the frontend renders exactly that state next to it — every keystroke, not just the save. The read path bypasses the response cache and ETag so nothing gets stuck. After 30 minutes the session is gone; nothing touches the disk.
A session holds every entry currently being worked on. Change a block of a page in the flyout and you see it in the page immediately — even if the block is pulled in through a reference.
Click the page, field in the editor
The third stage: the frontend tags every rendered block with the entry and field it came from. In the preview iframe the cursor outlines the block underneath, and a click opens exactly that field in the admin UI.
This is deliberately not an in-page editor. No contenteditable, no second input path. The page says where, the typing happens in the form. What you see and what gets saved stay the same thing — and the overlay stays a few hundred lines instead of a second CMS.
Widget link
A single entry can be shared without the page around it: a chrome-less route renders one block on its own — for iframing into other sites or for a screenshot. For drafts the admin UI appends a preview token automatically.