// Nash Review Portal — page-level access gate // // Why this exists: the wrapper at /review/view.html only enforces access on // pages it iframes. If a reviewer types a restricted URL directly into the // browser, or follows a deep link outside the portal, the wrapper isn't // involved and there's nothing stopping them. // // This script runs on every marketing page (auto-injected by serve.py as the // first thing in ). It: // 1. Reads the reviewer set in localStorage (if any). // 2. Checks the current path against the same access list view.html uses. // 3. If the reviewer isn't allowed, hides the document immediately and // replaces it with the "Still cooking." card so they never see the // restricted content flash through. // // Public visitors (no reviewer set) skip the gate entirely — the marketing // site stays public for anyone who hasn't picked a character. // // Honor-system only: anyone who clears localStorage or types a different // reviewer in DevTools can bypass it. That's fine for an internal review // portal; the goal is to keep work-in-progress out of casual sight, not // to lock it behind real auth. (function () { 'use strict'; // ─── Cross-origin handoff (platform demo) ──────────────────────────────── // The marketing-site wrapper iframes the platform demo on a different // origin. localStorage is per-origin, so the reviewer identity doesn't // carry over automatically. To bridge it, the wrapper appends ?nashRev= // (URI-encoded JSON of the reviewer object) when navigating to a // platform-demo URL. We capture it here, save to this origin's // localStorage, then strip it from the URL so the param doesn't leak // into bookmarks / shares. try { var qs = new URLSearchParams(location.search); var token = qs.get('nashRev'); if (token) { try { var parsed = JSON.parse(decodeURIComponent(token)); if (parsed && parsed.id) { localStorage.setItem('nash-reviewer', JSON.stringify(parsed)); } } catch (e) { /* malformed token, ignore */ } // Strip nashRev (and the cache-buster _rv) from the URL bar so the // identity isn't visible after the handoff. qs.delete('nashRev'); qs.delete('_rv'); var rest = qs.toString(); var newUrl = location.pathname + (rest ? '?' + rest : '') + location.hash; try { window.history.replaceState(null, '', newUrl); } catch (e) {} } } catch (e) { /* URL parse failed, ignore */ } // Honor-system page gate. Only the marketing site uses it — the platform // demo treats every page as open to any reviewer who made it through the // marketing-side gate, so we bail out early there. try { if (/nash-platform-demo/.test(location.hostname)) return; // Don't run inside the review portal frame (view.html does its own check) // or on /review/* pages themselves. if (location.pathname.indexOf('/review/') === 0) return; var raw = localStorage.getItem('nash-reviewer'); if (!raw) return; // public visitor — no gate var reviewer = null; try { reviewer = JSON.parse(raw); } catch (e) { return; } if (!reviewer || !reviewer.id) return; // Gates lifted — every reviewer can access every page. Short-circuit // before any OPEN_PAGES lookup. The wrapper at /review/view.html does // the same. To re-enable per-page gating, drop this return and let // the OPEN_PAGES table below take over again. return; // OPEN_PAGES = visible to anyone who picked a character. Everything else // is default-deny. We accept both the canonical /webflow-playground/* form // and the flat-slug form serve.py rewrites (e.g. /one-platform). var OPEN_PAGES = { // Same-as-everything-else open list — keep in sync with view.html. '/webflow-playground/index.html': 1, '/webflow-playground/agent.html': 1, '/webflow-playground/demo.html': 1, '/webflow-playground/one-platform.html': 1, '/webflow-playground/first-meter.html': 1, '/webflow-playground/middle-mile.html': 1, '/webflow-playground/last-mile.html': 1, '/one-platform.html': 1, '/demo.html': 1, '/first-meter.html': 1, '/middle-mile.html': 1, '/last-mile.html': 1, '/index.html': 1, '/': 1, '/agent': 1, '/demo': 1, '/one-platform': 1, '/first-meter': 1, '/middle-mile': 1, '/last-mile': 1, /* CMS-backed scaffolds (blog, changelog, events) */ '/webflow-playground/blog.html': 1, '/webflow-playground/blog-post.html': 1, '/webflow-playground/changelog.html': 1, '/webflow-playground/events.html': 1, '/blog': 1, '/blog-post': 1, '/changelog': 1, '/events': 1, /* Product pillar pages */ '/webflow-playground/orchestrate.html': 1, '/webflow-playground/planning.html': 1, '/webflow-playground/fleet.html': 1, '/webflow-playground/experience.html': 1, '/orchestrate.html': 1, '/planning.html': 1, '/fleet.html': 1, '/experience.html': 1, '/orchestrate': 1, '/planning': 1, '/fleet': 1, '/experience': 1, /* Industry / vertical / use-case pages — all open */ '/webflow-playground/grocery.html': 1, '/grocery.html': 1, '/grocery': 1, '/webflow-playground/restaurants.html': 1, '/restaurants.html': 1, '/restaurants': 1, '/webflow-playground/retail.html': 1, '/retail.html': 1, '/retail': 1, '/webflow-playground/distribution.html': 1, '/distribution.html': 1, '/distribution': 1, '/webflow-playground/field-services.html': 1, '/field-services.html': 1, '/field-services': 1, '/webflow-playground/healthcare.html': 1, '/healthcare.html': 1, '/healthcare': 1, '/webflow-playground/transportation-logistics.html': 1, '/transportation-logistics.html': 1, '/transportation-logistics': 1, '/webflow-playground/platforms.html': 1, '/platforms.html': 1, '/platforms': 1, /* Network + partner integrations + careers */ '/webflow-playground/network.html': 1, '/network.html': 1, '/network': 1, '/webflow-playground/shopify.html': 1, '/shopify.html': 1, '/shopify': 1, '/webflow-playground/square.html': 1, '/square.html': 1, '/square': 1, '/webflow-playground/careers.html': 1, '/careers.html': 1, '/careers': 1, /* Contact + Gartner LP + inbound thank-you pages */ '/webflow-playground/contact.html': 1, '/contact.html': 1, '/contact': 1, '/contact-us': 1, '/webflow-playground/gartner-lmd-2025.html': 1, '/resources/2025-gartner-market-guide-for-last-mile-delivery-technology-solutions': 1, '/webflow-playground/inbound-next-steps.html': 1, '/inbound-next-steps': 1, '/webflow-playground/inbound-success.html': 1, '/inbound-success': 1, /* Network & integration pages */ '/webflow-playground/network.html': 1, '/network.html': 1, '/network': 1, '/webflow-playground/shopify.html': 1, '/shopify.html': 1, '/shopify': 1, '/webflow-playground/square.html': 1, '/square.html': 1, '/square': 1, '/webflow-playground/platforms.html': 1, '/platforms.html': 1, '/platforms': 1, /* Brand guide + new component demos */ '/webflow-playground/brand.html': 1, '/brand.html': 1, '/provider-grid.html': 1, '/nash-aurora-export.html': 1, '/nash-aurora-export': 1, /* Legal hub — public-facing terms, privacy, security, AI policy */ '/legal': 1, '/legal.html': 1, '/webflow-playground/legal.html': 1, /* Press & News — coverage + recognition */ '/press': 1, '/press.html': 1, '/webflow-playground/press.html': 1 }; var path = location.pathname; if (OPEN_PAGES[path]) return; // Prefix-allowed paths — CMS-backed sub-routes. Each individual blog post // shouldn't need an explicit entry; allow the whole /blog/, /changelog/, /events/ namespaces. var OPEN_PREFIXES = ['/blog/', '/changelog/', '/events/', '/webflow-playground/blog/', '/webflow-playground/changelog/', '/webflow-playground/events/', '/legal/', '/webflow-playground/legal/']; for (var i = 0; i < OPEN_PREFIXES.length; i++) { if (path.indexOf(OPEN_PREFIXES[i]) === 0) return; } // Restricted page + non-privileged reviewer → block. // Hide the document immediately so no restricted content flashes through // before we swap in the still-cooking card. The script runs at the top of // , before the body is parsed, so this style applies to the empty // root element first and then to whatever the parser fills in below. var styleNode = document.createElement('style'); styleNode.id = 'nash-gate-hide'; styleNode.textContent = 'html{visibility:hidden!important;background:#01051E!important}'; (document.head || document.documentElement).appendChild(styleNode); // Wait until the body exists, then swap. We race a microtask + a // DOMContentLoaded listener — whichever fires first replaces the doc. if (document.body) { showStillCooking(); } else { document.addEventListener('DOMContentLoaded', showStillCooking, { once: true }); // Backup: if DOMContentLoaded somehow doesn't fire (rare), swap as // soon as the parser hits the body element. var poll = setInterval(function () { if (document.body) { clearInterval(poll); showStillCooking(); } }, 16); } } catch (e) { // If anything throws, fail open — better to surface the page than to // brick a public visitor with a broken gate. console.warn('[nash-gate] error, failing open:', e); var hide = document.getElementById('nash-gate-hide'); if (hide) hide.remove(); } function goBack(e) { if (e) e.preventDefault(); // Try history.back() first so reviewers return to whatever they were // looking at before clicking the dead link. If back() silently fails // (fresh tab from a Slack link can report history.length === 2 with no // real previous entry), bounce to the review portal homepage so the // button always does something visible. var fallback = '/review/view.html?page=index'; if (window.history.length <= 1) { window.location.href = fallback; return false; } var startUrl = location.href; window.history.back(); setTimeout(function () { if (location.href === startUrl) window.location.href = fallback; }, 150); return false; } function showStillCooking() { // Replace the document with the still-cooking card. Inline everything so // we don't depend on any external CSS/JS — this still works even if the // network drops between gate.js and the rest of the page. document.documentElement.innerHTML = '' + '' + '' + 'Still cooking · Nash' + '' + '' + '' + '' + '' + '' + '' + '

' + '

' + '' + '

Still cooking.

' + '

We’re hard at work in the kitchen. When it’s plated, it’s going to have taste.

' + '' + '

' + '

' + ''; // Wire up the back button. We use a real button + JS instead of an // so CSP-strict pages can still render us. var btn = document.getElementById('nash-gate-back'); if (btn) btn.addEventListener('click', goBack); } })();

Still cooking.

Holiday surge stress test