site-builder/craft/src/components/media/MapEmbed.tsx

import React, { CSSProperties } from 'react';
import { useNode, UserComponent } from '@craftjs/core';
import { cssPropsToString } from '../../utils/style-helpers';
import { escapeAttr, safeUrl } from '../../utils/escape';

interface MapEmbedProps {
  address?: string;
  zoom?: number;
  height?: string;
  style?: CSSProperties;
  animation?: string;
  animationDelay?: string;
  hideOnDesktop?: boolean;
  hideOnTablet?: boolean;
  hideOnMobile?: boolean;
}

function buildMapUrl(address: string, zoom: number): string {
  const encoded = encodeURIComponent(address);
  // `zoom` is declared as `number` but is not runtime-type-checked (AI
  // update_props / deserialized state can hand us anything). The final src
  // string is still run through escapeAttr(safeUrl(...)) at the toHtml call
  // site, which already blocks attribute-breakout -- but Number-coercing
  // here too keeps the emitted URL a well-formed `z=<digits>` query param
  // instead of smuggling arbitrary attacker text into it.
  const z = Number(zoom);
  const safeZoom = Number.isFinite(z) ? z : 14;
  return `https://maps.google.com/maps?q=${encoded}&z=${safeZoom}&output=embed`;
}

export const MapEmbed: UserComponent<MapEmbedProps> = ({
  address = 'New York, NY',
  zoom = 14,
  height = '400px',
  style = {},
}) => {
  const {
    connectors: { connect, drag },
    selected,
  } = useNode((node) => ({
    selected: node.events.selected,
  }));

  return (
    <div
      ref={(ref: HTMLDivElement | null): void => { if (ref) connect(drag(ref)); }}
      style={{
        width: '100%',
        outline: selected ? '2px solid #3b82f6' : 'none',
        ...style,
      }}
    >
      <iframe
        src={buildMapUrl(address, zoom)}
        style={{
          width: '100%',
          height,
          border: 'none',
          borderRadius: (style as any)?.borderRadius || '0px',
          display: 'block',
        }}
        loading="lazy"
        referrerPolicy="no-referrer-when-downgrade"
        allowFullScreen
      />
    </div>
  );
};

/* ---------- Craft config ---------- */

MapEmbed.craft = {
  displayName: 'Map',
  props: {
    address: 'New York, NY',
    zoom: 14,
    height: '400px',
    style: {
      marginTop: '', marginRight: '', marginBottom: '', marginLeft: '',
      paddingTop: '', paddingRight: '', paddingBottom: '', paddingLeft: '',
      border: 'none',
      boxShadow: 'none',
      opacity: '1',
    },
    animation: '',
    animationDelay: '0',
    hideOnDesktop: false,
    hideOnTablet: false,
    hideOnMobile: false,
  },
  rules: {
    canDrag: () => true,
    canMoveIn: () => false,
    canMoveOut: () => true,
  },
};

/* ---------- HTML export ---------- */

(MapEmbed as any).toHtml = (props: MapEmbedProps, _childrenHtml: string) => {
  const {
    address = 'New York, NY',
    zoom = 14,
    height = '400px',
    style = {},
  } = props;

  const wrapperStyle = cssPropsToString({ width: '100%', ...style });
  const iframeStyle = cssPropsToString({
    width: '100%',
    height,
    border: 'none',
    borderRadius: (style as any)?.borderRadius || undefined,
    display: 'block',
  });

  const src = buildMapUrl(address, zoom);

  return {
    html: `<div${wrapperStyle ? ` style="${wrapperStyle}"` : ''}><iframe src="${escapeAttr(safeUrl(src))}" title="${escapeAttr(`Map of ${address}`)}" loading="lazy" referrerpolicy="no-referrer-when-downgrade" allowfullscreen${iframeStyle ? ` style="${iframeStyle}"` : ''}></iframe></div>`,
  };
};