@bakery-framework/plugin-vue 2.0.0-rc.4 → 2.0.0-rc.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/plugin-vue",
-  "version": "2.0.0-rc.4",
+  "version": "2.0.0-rc.5",
   "description": "Bakery vue plugin.",
   "keywords": [
     "bakery",
@@ -43,7 +43,7 @@
     "vue": "^3.5.38"
   },
   "dependencies": {
-    "@bakery-framework/core": "^2.0.0-rc.4"
+    "@bakery-framework/core": "^2.0.0-rc.5"
   },
   "engines": {
     "bun": ">=1.4.0"

package/src/utils.ts

@@ -593,6 +593,33 @@ export async function getServerResponse(options: ServerResponseOptions) {
       `Server script error in ${id}: ${err?.message || err} at ${req.url}`,
       'error',
     )
+
+    // **A block that declares a guard fails closed.**
+    //
+    // The generated wrapper runs the block's top-level statements and *then*
+    // calls `middleware`, so a throw anywhere above skips the guard
+    // completely. Returning `{}` here then served the route: a `/admin/*`
+    // page answering 200 to an anonymous caller because a query threw. Not
+    // hypothetical, and not only the obvious causes: the block only has to
+    // throw, so a database being down, a null deref or a typo all reach it.
+    //
+    // Convention 2 names this shape exactly: a guard "returns the rejection,
+    // not `null`, on any indeterminate state". A guard that ceased to exist
+    // is the most indeterminate state there is.
+    //
+    // Only when a guard is declared. A data-only block that throws still
+    // renders the page with no data, which is the documented behavior and is
+    // a visible failure rather than a silent one: the page is obviously
+    // broken, and nothing was protecting it.
+    //
+    // The declaration is read from the source, not from the result, because
+    // there is no result: the module threw before its exports existed. That
+    // is the same static list `compileServerBlock` already builds to decide
+    // which exports are callable as actions.
+    if (collectExportedFunctionNames(script).includes('middleware')) {
+      return new Response('Internal Server Error', { status: 500 })
+    }
+
     return {}
   } finally {
     clearTimeout(timer)