Managing Loader/Action Access

By default, all loaders and actions in deco.cx are publicly accessible. However, you may need to restrict access to certain loaders/actions that handle sensitive operations or private APIs. This guide explains how to control loader/action visibility.

Visibility Options

There are two visibility levels available:

private : Can only be invoked server-side through ctx.invoke
public : Can be called from both server and client through:
- Runtime invoke calls
- Direct path access via /live/invoke/{path/to/block.ts}

Setting Default Visibility

To set the visibility level for a loader/action, export a defaultVisibility variable:

 // Make the loader publicly accessible
export const defaultVisibility = 'public'

// Make the loader private (server-side only)
export const defaultVisibility = 'private'

Overriding Visibility

You can override the default visibility settings in your fresh.config.ts file using the visibilityOverrides option:

 import { defineConfig } from "$fresh/server.ts";
import { plugins } from "deco/plugins/deco.ts";
import manifest from "./manifest.gen.ts";

export default defineConfig({
  plugins: plugins<typeof manifest>({
    manifest,
    htmx: true,
    visibilityOverrides: {
      "site/loaders/minicart.ts": "public",
      "vtex/loaders/cart.ts": "private"
    },
  }),
});

Security Best Practices

When deciding visibility levels:

Use `private` for

Accessing private/internal APIs
Operations involving credentials or secrets
Processing sensitive user/business data
Backend integrations requiring authentication

Use `public` for

Reading public product data
Fetching public content
Client-side data loading
User-facing operations that don’t expose sensitive data

Manage block access