把 JitWord 编辑器嵌进你的业务系统

const JITWORD = {
  api: 'https://inner.jitword.com/api/v1',
  tenantKey: 'your-tenant',        // 我们发给你的
  providerKey: 'your-app',         // 我们发给你的
  clientSecret: process.env.JITWORD_CLIENT_SECRET,
  origin: 'https://your-portal.example.com'   // 你页面的来源，必须与浏览器地址栏一致
}

app.post('/api/jitword-ticket', async (req, res) => {
  // 1) 用你自己的登录态和权限逻辑判断，这一步我们不干预
  const me = req.user
  if (!me) return res.status(401).json({ error: 'not logged in' })

  const { docId } = req.body
  const canEdit = await yourAcl.canEdit(me.id, docId)

  // 2) 换票
  const r = await fetch(`${JITWORD.api}/embed/tickets`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Embed-Client-Secret': JITWORD.clientSecret
    },
    body: JSON.stringify({
      tenantKey: JITWORD.tenantKey,
      providerKey: JITWORD.providerKey,
      externalSubject: String(me.id),        // 你系统里的用户 ID
      user: { displayName: me.name, email: me.email },
      document: { docId },
      permission: {
        role: canEdit ? 'editor' : 'viewer',
        scopes: canEdit
          ? ['document:read', 'document:edit', 'comment:write']
          : ['document:read']
      },
      origin: JITWORD.origin,
      expiresIn: 300
    })
  })

  const { data } = await r.json()
  res.json({ ticket: data.ticket })          // 只把 ticket 交出去
})

<div id="jitwordEditor" style="height:720px"></div>

<script src="https://inner.jitword.com/px-editor/iframe-sdk/v1/loader.js"></script>
<script>
  const docId = 'your-demo-doc-id'        // 我们发给你的演示文档 ID

  const editor = JitWord.createEditor({
    container: '#jitwordEditor',
    editorUrl: 'https://inner.jitword.com/px-editor',
    apiBase:   'https://inner.jitword.com/api/v1',
    docId,
    documentType: 'document',
    tenantKey: 'your-tenant',
    providerKey: 'your-app',
    auth: {
      mode: 'embed-ticket',
      getEmbedTicket: () =>
        fetch('/api/jitword-ticket', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ docId })
        })
          .then(r => r.json())
          .then(p => p.ticket)         // 必须返回 ticket 字符串
    },
    ui: { theme: 'auto', chrome: 'toolbar' },   // 显示编辑器自带工具条；默认 'host' 只渲染内容
    debug: { enabled: true }             // 联调期打开，上线前关掉
  })

  editor.on('ready', s => console.log('编辑器就绪', s))
  editor.on('error', e => console.error('出错', e.code, e.message))
</script>

// 1) 只有内容（默认，宿主自绘 UI 时用）
const editor = JitWord.createEditor({ ...baseConfig, ui: { chrome: 'host' } })

// 2) 显示编辑器自带编辑工具条（嵌入业务页面最常用）
const editor = JitWord.createEditor({ ...baseConfig, ui: { chrome: 'toolbar' } })

// 3) 完整编辑器外壳（顶栏 + 工具条 + 右侧工具条）
const editor = JitWord.createEditor({ ...baseConfig, ui: { chrome: 'full' } })

// 运行中切换工具条档位：full（分类面板）/ simple（单行极简）/ none（整体隐藏）
editor.setToolbar('full')

// content 支持 ArrayBuffer / Uint8Array / Blob / base64 字符串
const file = input.files[0]                      // <input type="file" accept=".docx">
const result = await editor.importDocx({
  content: file,                // 也可传 await file.arrayBuffer()
  fileName: file.name,
  mode: 'replace',            // 默认整体替换；'insert' 追加到文末或 nodeId 锚点之后
  timeout: 60000                // 可选；默认 60s（大文件解析可能超过常规 10s）
})
// result: { mode, applied, importedComments, headerFooter, warnings }
if (result.importedComments || result.headerFooter) {
  console.warn('批注/页眉页脚未写入文档，需要走服务端通道')
}

// 不可见时零开销，可见时轻量只读渲染，用户点击后自动升级为完整协同
const editor = JitWord.createEditor({
  ...baseConfig,
  mode: 'preview',        // 不建 WebSocket，REST 拉快照后只读渲染
  lazy: true,             // 进入视口才实例化
  destroyOnLeave: true,   // 离开视口释放，再进入自动重建（内容无损）
  placeholderText: '滚动到此处自动加载'
})

editor.on('upgraded', () => console.log('已升级为完整协同'))

{
  "code": 200,
  "message": "ok",
  "data": {
    "ticket": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",   // 交给前端的就是这个
    "expiresAt": "2026-09-21T15:32:10.000Z",
    "expiresIn": 300,
    "sessionExpiresAt": null,
    "docId": "demo-001",
    "origin": "https://your-portal.example.com",
    "scopes": ["document:read", "document:edit", "comment:write"],
    "behavior": { "copy": true, "print": true, "export": true },
    "ui": { "readonly": false, "theme": "auto", "toolbar": "compact" },
    "mapping": {
      "internalUserId": "u_9f2c...",      // 映射出的内部用户
      "externalSubject": "user-123",
      "status": "active"
    }
  }
}

curl -X POST https://inner.jitword.com/api/v1/embed/tickets \
  -H 'Content-Type: application/json' \
  -H "X-Embed-Client-Secret: $JITWORD_CLIENT_SECRET" \
  -d '{
    "tenantKey": "your-tenant",
    "providerKey": "your-app",
    "externalSubject": "user-123",
    "user": { "displayName": "张三", "email": "zhangsan@example.com" },
    "document": { "docId": "demo-001" },
    "permission": { "role": "editor",
                    "scopes": ["document:read","document:edit","comment:write"] },
    "origin": "https://your-portal.example.com",
    "expiresIn": 300
  }'

var payload = """
  {
    "tenantKey": "your-tenant",
    "providerKey": "your-app",
    "externalSubject": "%s",
    "user": { "displayName": "%s" },
    "document": { "docId": "%s" },
    "permission": { "scopes": ["document:read","document:edit"] },
    "origin": "https://your-portal.example.com",
    "expiresIn": 300
  }""".formatted(userId, displayName, docId);

var request = HttpRequest.newBuilder()
    .uri(URI.create("https://inner.jitword.com/api/v1/embed/tickets"))
    .header("Content-Type", "application/json")
    .header("X-Embed-Client-Secret", System.getenv("JITWORD_CLIENT_SECRET"))
    .POST(HttpRequest.BodyPublishers.ofString(payload))
    .build();

var response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());

import os, requests

resp = requests.post(
    "https://inner.jitword.com/api/v1/embed/tickets",
    headers={"X-Embed-Client-Secret": os.environ["JITWORD_CLIENT_SECRET"]},
    json={
        "tenantKey": "your-tenant",
        "providerKey": "your-app",
        "externalSubject": str(user.id),
        "user": {"displayName": user.name, "email": user.email},
        "document": {"docId": doc_id},
        "permission": {"scopes": ["document:read", "document:edit"]},
        "origin": "https://your-portal.example.com",
        "expiresIn": 300,
    },
    timeout=10,
)
resp.raise_for_status()
ticket = resp.json()["data"]["ticket"]

{
  "allowedOrigins": ["https://your-portal.example.com", "https://*.example.com"],
  "defaultUi": { "theme": "auto", "toolbar": "compact", "readonly": false },
  "roleScopesMap": {
    "viewer": ["document:read"],
    "editor": ["document:read", "document:edit", "comment:write"]
  },
  "features": { "document.exportDocx": true, "document.setMetadata": false },
  "behavior": { "copy": true, "print": false, "export": true },
  "loaderChannels": { "default": "v1", "allowed": ["v1", "latest"] },
  "watermarkDefault": "示例公司 · 内部文档",
  "watermarkLock": true,
  "exportReview": { "enabled": false },
  "diagnostics": { "enabled": true, "level": "info" }
}

// 收到的请求体（不含正文）
{
  "eventType": "exportReviewRequest",
  "tenantKey": "your-tenant",  "providerKey": "your-app",
  "externalSubject": "user-123", "internalUserId": "u_9f2c...",
  "docId": "demo-001", "format": "docx", "jti": "jti_..."
}

// 请求头带 HMAC-SHA256 签名，密钥就是你的 clientSecret，请务必验签
// X-Webhook-Signature: t=<timestamp>,v1=<hex>

// 你必须返回 200 且 decision 显式为 approve，否则一律拒绝
{ "decision": "approve" }
{ "decision": "deny", "reason": "密级文档不允许外发" }

Content-Security-Policy: frame-src https://inner.jitword.com; script-src 'self' https://inner.jitword.com;