@autumnsgrove/groveengine 0.4.10 → 0.4.12

package/dist/components/admin/MarkdownEditor.svelte

@@ -40,6 +40,7 @@
   let cursorLine = $state(1);
   let cursorCol = $state(1);
   let isUpdating = $state(false);
+  let isProgrammaticUpdate = $state(false);  // Flag to skip oninput during toolbar operations
 
   // Image upload state
   let isDragging = $state(false);
@@ -185,7 +186,7 @@
 
   // Cursor position tracking
   function updateCursorPosition() {
-    if (!textareaRef) return;
+    if (!textareaRef || isProgrammaticUpdate) return;  // Skip during programmatic updates
     const pos = textareaRef.selectionStart;
     const textBefore = content.substring(0, pos);
     const lines = textBefore.split("\n");
@@ -326,31 +327,41 @@
   }
 
   // Text manipulation helpers
-  function wrapSelection(before, after) {
+  async function wrapSelection(before, after) {
     if (!textareaRef || isUpdating) return;
     isUpdating = true;
+    isProgrammaticUpdate = true;
+
     const start = textareaRef.selectionStart;
     const end = textareaRef.selectionEnd;
     const selectedText = content.substring(start, end);
     content = content.substring(0, start) + before + selectedText + after + content.substring(end);
-    setTimeout(() => {
-      textareaRef.selectionStart = start + before.length;
-      textareaRef.selectionEnd = end + before.length;
-      textareaRef.focus();
-      isUpdating = false;
-    }, 0);
+
+    await tick();  // Wait for Svelte to update DOM
+
+    textareaRef.selectionStart = start + before.length;
+    textareaRef.selectionEnd = end + before.length;
+    textareaRef.focus();
+
+    isProgrammaticUpdate = false;
+    isUpdating = false;
   }
 
-  function insertAtCursor(text) {
+  async function insertAtCursor(text) {
     if (!textareaRef || isUpdating) return;
     isUpdating = true;
+    isProgrammaticUpdate = true;
+
     const start = textareaRef.selectionStart;
     content = content.substring(0, start) + text + content.substring(start);
-    setTimeout(() => {
-      textareaRef.selectionStart = textareaRef.selectionEnd = start + text.length;
-      textareaRef.focus();
-      isUpdating = false;
-    }, 0);
+
+    await tick();  // Wait for Svelte to update DOM
+
+    textareaRef.selectionStart = textareaRef.selectionEnd = start + text.length;
+    textareaRef.focus();
+
+    isProgrammaticUpdate = false;
+    isUpdating = false;
   }
 
   // Toolbar actions
@@ -366,19 +377,24 @@
     insertAtCursor("![alt text](image-url)");
   }
 
-  function insertCodeBlock() {
+  async function insertCodeBlock() {
     if (!textareaRef || isUpdating) return;
     isUpdating = true;
+    isProgrammaticUpdate = true;
+
     const start = textareaRef.selectionStart;
     const end = textareaRef.selectionEnd;
     const selectedText = content.substring(start, end);
     const codeBlock = "```\n" + (selectedText || "code here") + "\n```";
     content = content.substring(0, start) + codeBlock + content.substring(end);
-    setTimeout(() => {
-      textareaRef.selectionStart = textareaRef.selectionEnd = start + codeBlock.length;
-      textareaRef.focus();
-      isUpdating = false;
-    }, 0);
+
+    await tick();  // Wait for Svelte to update DOM
+
+    textareaRef.selectionStart = textareaRef.selectionEnd = start + codeBlock.length;
+    textareaRef.focus();
+
+    isProgrammaticUpdate = false;
+    isUpdating = false;
   }
 
   function insertList() {

package/dist/utils/api.d.ts

@@ -2,6 +2,11 @@
  * Client-side API utility with automatic CSRF token injection
  * Provides fetch wrapper with security headers and error handling
  */
+/**
+ * Get CSRF token from cookie or meta tag
+ * @returns {string|null} CSRF token or null if not found
+ */
+export function getCSRFToken(): string | null;
 /**
  * Fetch wrapper with automatic CSRF token injection
  * @param {string} url - API endpoint URL

package/dist/utils/api.js

@@ -3,6 +3,26 @@
  * Provides fetch wrapper with security headers and error handling
  */
 
+/**
+ * Get CSRF token from cookie or meta tag
+ * @returns {string|null} CSRF token or null if not found
+ */
+export function getCSRFToken() {
+  if (typeof document === "undefined") return null; // SSR safety
+
+  // Try cookie first
+  const cookieToken = document.cookie
+    .split("; ")
+    .find((row) => row.startsWith("csrf_token="))
+    ?.split("=")[1];
+
+  if (cookieToken) return cookieToken;
+
+  // Fallback to meta tag
+  const metaTag = document.querySelector('meta[name="csrf-token"]');
+  return metaTag?.getAttribute("content") || null;
+}
+
 /**
  * Fetch wrapper with automatic CSRF token injection
  * @param {string} url - API endpoint URL
@@ -11,20 +31,22 @@
  * @throws {Error} If request fails
  */
 export async function apiRequest(url, options = {}) {
-  const csrfToken = document.querySelector('meta[name="csrf-token"]')?.content;
+  const csrfToken = getCSRFToken();
+  const method = options.method?.toUpperCase() || "GET";
+  const isStateMutating = ["POST", "PUT", "DELETE", "PATCH"].includes(method);
 
   // Debug logging
   if (typeof console !== "undefined" && process.env.NODE_ENV !== "production") {
     console.debug("[apiRequest]", {
       url,
+      method,
       csrfToken: csrfToken ? "present" : "missing",
+      isStateMutating,
     });
   }
 
   // Build headers - don't set Content-Type for FormData (browser sets it with boundary)
   const headers = {
-    ...(csrfToken && { "X-CSRF-Token": csrfToken }),
-    ...(csrfToken && { "csrf-token": csrfToken }), // fallback header
     ...options.headers,
   };
 
@@ -33,9 +55,16 @@ export async function apiRequest(url, options = {}) {
     headers["Content-Type"] = "application/json";
   }
 
+  // Add CSRF token for state-changing requests
+  if (isStateMutating && csrfToken) {
+    headers["X-CSRF-Token"] = csrfToken;
+    headers["csrf-token"] = csrfToken; // fallback header
+  }
+
   const response = await fetch(url, {
     ...options,
     headers,
+    credentials: "include", // Include cookies
   });
 
   if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autumnsgrove/groveengine",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "Multi-tenant blog engine for Grove Platform. Features gutter annotations, markdown editing, magic code auth, and Cloudflare Workers deployment.",
   "author": "AutumnsGrove",
   "license": "MIT",