@antelopejs/dms-frontend 0.2.0 → 0.2.1

package/README.md

@@ -163,11 +163,13 @@ started by `dev`, and the production server started by `start`, because those
 child processes inherit the environment. A missing file is not an error; an
 unreadable one is reported and skipped.
 
-`DMS_SESSION_SECRET` is mandatory for anything that touches a session. The
-generated server encrypts its session cookie with it, and with no value — or
-one shorter than 32 characters — the login page at `/auth` fails the first
-sign-in attempt rather than starting degraded. Generate one with
-`openssl rand -hex 32`.
+`ajs dms dev` generates a fresh ephemeral 32-byte secret when
+`DMS_SESSION_SECRET` is absent; all sessions are invalidated when that dev
+server restarts. An explicit value is preserved, but empty or shorter than 32
+characters is rejected. `build` and `start` require a configured secret and
+never generate one, which is required for production so sessions survive
+restarts. The generated server also validates the value as a safety net.
+Generate one with `openssl rand -hex 32`.
 
 ### Opening a session from a module flow
 

package/dist/commands/build.js

@@ -21,6 +21,7 @@ function cmdBuild() {
             (0, cli_ui_1.error)("Backend URL is required. Use -b <url> or set DMS_API_BASE_URL.");
             process.exit(1);
         }
+        const sessionSecret = (0, common_1.resolveSessionSecret)("build");
         const spinner = new cli_ui_1.Spinner("Setting up workspace...");
         await spinner.start();
         try {
@@ -44,6 +45,7 @@ function cmdBuild() {
                 cwd: workspaceDir,
                 env: {
                     ...process.env,
+                    DMS_SESSION_SECRET: sessionSecret,
                     NODE_OPTIONS: "--max-old-space-size=4096",
                     NODE_PATH: nodeModulesDir,
                 },

package/dist/commands/dev.js

@@ -44,6 +44,7 @@ function cmdDev() {
         .action(async (options) => {
         const { backendUrl, workspaceKey } = resolveBackend(options);
         const bootstrapSecret = (0, common_1.resolveBootstrapSecret)(options.bootstrapSecret, backendUrl);
+        const sessionSecret = (0, common_1.resolveSessionSecret)("dev");
         const requestedPort = Number.parseInt(options.port, 10);
         if (Number.isNaN(requestedPort)) {
             (0, cli_ui_1.error)(`Invalid port: ${options.port}`);
@@ -101,6 +102,7 @@ function cmdDev() {
                     DMS_COOKIE_SECURE: process.env.DMS_COOKIE_SECURE ?? "false",
                     DMS_API_BASE_URL: backendUrl,
                     DMS_BOOTSTRAP_SECRET: bootstrapSecret,
+                    DMS_SESSION_SECRET: sessionSecret,
                     NODE_OPTIONS: "--max-old-space-size=4096",
                     NODE_PATH: nodeModulesDir,
                 },

package/dist/commands/start.js

@@ -20,6 +20,7 @@ function cmdStart() {
             (0, cli_ui_1.error)("Backend URL is required. Use -b <url> or set DMS_API_BASE_URL.");
             process.exit(1);
         }
+        const sessionSecret = (0, common_1.resolveSessionSecret)("start");
         const workspaceDir = (0, common_1.getWorkspaceDir)(options.backendUrl);
         const serverPath = (0, node_path_1.join)(workspaceDir, "server.mjs");
         const clientPath = (0, node_path_1.join)(workspaceDir, "dist", "client", "index.html");
@@ -41,6 +42,7 @@ function cmdStart() {
                 ...process.env,
                 PORT: options.port,
                 DMS_API_BASE_URL: options.backendUrl,
+                DMS_SESSION_SECRET: sessionSecret,
                 DMS_COOKIE_SECURE: process.env.DMS_COOKIE_SECURE ?? "true",
             },
         });

package/dist/config.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Options = exports.TAILWIND_SOURCE_GLOB = exports.PNPM_LIFECYCLE_SCRIPTS = exports.layerCopyIgnore = exports.LAYER_COPY_BLOCKLIST = exports.AUTH_ESTABLISH_FILE = exports.FRONTEND_MODULE_ENTRY = exports.LAYERS_SUBDIR = exports.TEMPLATE_FILES = exports.WORKSPACE_DIR_MODE = exports.DEPS_HASH_FILE = exports.DMS_FRONTEND_HOME = void 0;
 exports.writeSecretBearingFile = writeSecretBearingFile;
 exports.normalizeBootstrapSecret = normalizeBootstrapSecret;
+exports.resolveSessionSecret = resolveSessionSecret;
 exports.resolveBootstrapSecret = resolveBootstrapSecret;
 exports.sha256Hex = sha256Hex;
 exports.canonicalizeBackendUrl = canonicalizeBackendUrl;
@@ -109,6 +110,18 @@ function normalizeBootstrapSecret(value, source = DEFAULT_CREDENTIAL_SOURCE) {
     }
     return trimmed;
 }
+function resolveSessionSecret(mode, value = process.env.DMS_SESSION_SECRET) {
+    if (value === undefined && mode === "dev") {
+        return (0, node_crypto_1.randomBytes)(32).toString("hex");
+    }
+    if (value === undefined || value.length < 32) {
+        throw new Error("DMS_SESSION_SECRET must contain at least 32 characters; " +
+            (mode === "dev"
+                ? "set it explicitly or omit it to generate an ephemeral dev secret"
+                : "set it explicitly for build and start"));
+    }
+    return value;
+}
 function resolveBootstrapSecret(explicit, backendUrl, options = {}) {
     const normalized = normalizeBootstrapSecret(explicit);
     if (normalized)

package/dist/index.js

@@ -38,6 +38,9 @@ Environment:
   the other variables below can live in the project's .env. A variable already
   set in the environment always wins over a file, and .env.local wins over .env.
   The generated workspace never loads a .env of its own.
+  'dev' generates an ephemeral 32-byte DMS_SESSION_SECRET when it is absent;
+  restarting dev invalidates its sessions. 'build' and 'start' require a
+  configured secret of at least 32 characters.
 
 Workspaces:
   Each canonical backend URL gets its own workspace under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antelopejs/dms-frontend",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Frontend-agnostic loader for AntelopeJS DMS, shipping the Vue 3 renderer (Vite, Inertia, SSR)",
   "keywords": [
     "antelope",