@btst/stack 3.0.0-rc.2 → 3.0.0-rc.3

package/dist/next/server.d.ts

@@ -0,0 +1,56 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import { ComponentType, ReactNode } from 'react';
+import { AnyAuthorizationContract, AuthorizationContractIdentity } from '../authorization/index.js';
+import { a as StackIdentity } from '../shared/stack.BYMentwB.js';
+import { M as MaybePromise } from '../shared/stack.CKXzdGiJ.js';
+import { H as HeadersFrameworkIdentitySource } from '../shared/stack.CxKc9evq.js';
+import 'zod';
+
+/** Props passed from a Next.js server layout to the generated client boundary. */
+interface NextClientLayoutProps<TIdentity extends StackIdentity> {
+    /** Validated request identity. `null` means the server resolved anonymous. */
+    initialIdentity: TIdentity | null;
+    /** Deployment-trusted API/site origins serialized for the client provider. */
+    clientOrigins?: {
+        /** Trusted destination for browser API requests. */
+        apiOrigin: string;
+        /** Trusted public origin used to build page and asset URLs. */
+        siteOrigin: string;
+    };
+    /** Nested route content rendered inside the client provider. */
+    children?: ReactNode;
+}
+/** Options for the request-aware Next.js identity layout factory. */
+interface CreateNextLayoutOptions<TContract extends AnyAuthorizationContract> {
+    /** Server-only identity adapter, normally returned by `createServerAuth`. */
+    auth: HeadersFrameworkIdentitySource<TContract>;
+    /** Client boundary that owns `StackProvider` for the complete route subtree. */
+    ClientLayout: ComponentType<NextClientLayoutProps<AuthorizationContractIdentity<TContract>>>;
+    /**
+     * Resolves deployment-trusted API/site origins from the original request
+     * headers. The returned browser-safe values are serialized with identity.
+     */
+    resolveClientOrigins?: (requestHeaders: Headers) => MaybePromise<{
+        apiOrigin: string;
+        siteOrigin: string;
+    }>;
+}
+/**
+ * Creates a Next.js App Router layout that resolves identity on the server and
+ * passes only the validated snapshot to a client-owned provider boundary.
+ *
+ * Import this helper from `@btst/stack/next/server` so `next/headers` and the
+ * application server auth module never enter the client graph.
+ * Because identity is resolved from request headers, the consuming layout must
+ * export `const dynamic = "force-dynamic"`. Keep SSG/ISR pages in a separate
+ * static route group with no server identity snapshot. This helper targets
+ * Next.js route-segment caching with Cache Components disabled.
+ */
+declare function createNextLayout<TContract extends AnyAuthorizationContract>(options: CreateNextLayoutOptions<TContract>): {
+    Layout: ({ children }: {
+        children?: ReactNode;
+    }) => Promise<react_jsx_runtime.JSX.Element>;
+};
+
+export { createNextLayout };
+export type { CreateNextLayoutOptions, NextClientLayoutProps };

package/dist/next/server.mjs

@@ -0,0 +1 @@
+export { createNextLayout } from '../packages/stack/src/next/layout.mjs';

package/dist/packages/stack/src/authorization/json.cjs

@@ -0,0 +1,57 @@
+'use strict';
+
+function assertJsonSafe(value, ancestors = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    if (Number.isFinite(value)) return;
+    throw new TypeError("Authorization values must be finite numbers.");
+  }
+  if (typeof value !== "object") {
+    throw new TypeError("Authorization values must be JSON-safe.");
+  }
+  if (ancestors.has(value)) {
+    throw new TypeError("Authorization values cannot contain cycles.");
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      for (let index = 0; index < value.length; index += 1) {
+        if (!(index in value)) {
+          throw new TypeError(
+            "Authorization arrays cannot contain empty slots."
+          );
+        }
+        assertJsonSafe(value[index], ancestors);
+      }
+      for (const key of Reflect.ownKeys(value)) {
+        if (key !== "length" && (typeof key !== "string" || !/^0$|^[1-9]\d*$/.test(key) || Number(key) >= value.length)) {
+          throw new TypeError(
+            "Authorization arrays cannot contain extra properties."
+          );
+        }
+      }
+      return;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError(
+        "Authorization values must contain only plain objects."
+      );
+    }
+    for (const key of Reflect.ownKeys(value)) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (typeof key !== "string" || !descriptor?.enumerable || !("value" in descriptor)) {
+        throw new TypeError(
+          "Authorization object properties must be JSON-safe."
+        );
+      }
+      assertJsonSafe(descriptor.value, ancestors);
+    }
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
+exports.assertJsonSafe = assertJsonSafe;

package/dist/packages/stack/src/authorization/json.mjs

@@ -0,0 +1,55 @@
+function assertJsonSafe(value, ancestors = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    if (Number.isFinite(value)) return;
+    throw new TypeError("Authorization values must be finite numbers.");
+  }
+  if (typeof value !== "object") {
+    throw new TypeError("Authorization values must be JSON-safe.");
+  }
+  if (ancestors.has(value)) {
+    throw new TypeError("Authorization values cannot contain cycles.");
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      for (let index = 0; index < value.length; index += 1) {
+        if (!(index in value)) {
+          throw new TypeError(
+            "Authorization arrays cannot contain empty slots."
+          );
+        }
+        assertJsonSafe(value[index], ancestors);
+      }
+      for (const key of Reflect.ownKeys(value)) {
+        if (key !== "length" && (typeof key !== "string" || !/^0$|^[1-9]\d*$/.test(key) || Number(key) >= value.length)) {
+          throw new TypeError(
+            "Authorization arrays cannot contain extra properties."
+          );
+        }
+      }
+      return;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError(
+        "Authorization values must contain only plain objects."
+      );
+    }
+    for (const key of Reflect.ownKeys(value)) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (typeof key !== "string" || !descriptor?.enumerable || !("value" in descriptor)) {
+        throw new TypeError(
+          "Authorization object properties must be JSON-safe."
+        );
+      }
+      assertJsonSafe(descriptor.value, ancestors);
+    }
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
+export { assertJsonSafe };

package/dist/packages/stack/src/client/components/compose.cjs

@@ -34,14 +34,88 @@ function RouteRenderer({
     }
   );
 }
-function RouteGuard({
+function PermissionRouteAccess({
   permission,
   LoadingComponent,
   children
+}) {
+  return /* @__PURE__ */ jsxRuntime.jsx(auth.PermissionCheck, { permission, children: (state) => /* @__PURE__ */ jsxRuntime.jsx(
+    ResolvedRouteAccess,
+    {
+      state,
+      permissionLabel: permission.id,
+      LoadingComponent,
+      children
+    }
+  ) });
+}
+function getErrorStatus(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const candidate = error;
+  if (typeof candidate.statusCode === "number") return candidate.statusCode;
+  return typeof candidate.status === "number" ? candidate.status : void 0;
+}
+function RouteErrorFallback({
+  error,
+  resetErrorBoundary,
+  ErrorComponent,
+  LoadingComponent
+}) {
+  const auth$1 = auth.useAuthContext();
+  const stack = provider.useStackOrNull();
+  const loginPath = auth$1?.provider.loginPath;
+  const navigate = stack?.router?.navigate;
+  const shouldRedirect = getErrorStatus(error) === 401 && !!auth$1 && !!loginPath;
+  React.useEffect(() => {
+    if (!shouldRedirect || !loginPath) return;
+    if (navigate) {
+      void navigate(loginPath);
+    } else if (typeof window !== "undefined") {
+      window.location.assign(loginPath);
+    }
+  }, [shouldRedirect, loginPath, navigate]);
+  if (shouldRedirect) {
+    return LoadingComponent ? /* @__PURE__ */ jsxRuntime.jsx(LoadingComponent, {}) : null;
+  }
+  return /* @__PURE__ */ jsxRuntime.jsx(ErrorComponent, { error, resetErrorBoundary });
+}
+function ComposedRouteErrorBoundary({
+  path,
+  ErrorComponent,
+  LoadingComponent,
+  onError,
+  children
+}) {
+  const FallbackComponent = React__default.useCallback(
+    (props) => /* @__PURE__ */ jsxRuntime.jsx(
+      RouteErrorFallback,
+      {
+        ...props,
+        ErrorComponent,
+        LoadingComponent
+      }
+    ),
+    [ErrorComponent, LoadingComponent]
+  );
+  return /* @__PURE__ */ jsxRuntime.jsx(
+    errorBoundary.ErrorBoundary,
+    {
+      FallbackComponent,
+      resetKeys: [path],
+      onError,
+      children
+    }
+  );
+}
+function ResolvedRouteAccess({
+  state,
+  permissionLabel,
+  LoadingComponent,
+  children
 }) {
   const auth$1 = auth.useAuthContext();
   const stack = provider.useStackOrNull();
-  const { can, isPending } = auth.useCan(permission);
+  const { can, isPending, error } = state;
   const identity = auth$1?.identity ?? null;
   const loginPath = auth$1?.provider.loginPath;
   const navigate = stack?.router?.navigate;
@@ -57,6 +131,7 @@ function RouteGuard({
   if (!auth$1) {
     return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children });
   }
+  if (error) throw error;
   if (isPending || shouldRedirect) {
     return LoadingComponent ? /* @__PURE__ */ jsxRuntime.jsx(LoadingComponent, {}) : null;
   }
@@ -64,9 +139,7 @@ function RouteGuard({
     return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children });
   }
   if (process.env.NODE_ENV !== "production") {
-    console.warn(
-      `[btst/auth] RouteGuard denied: cannot ${permission.action} ${permission.resource}`
-    );
+    console.warn(`[btst/auth] RouteGuard denied: ${permissionLabel}`);
   }
   throw new Error("Unauthorized");
 }
@@ -82,14 +155,22 @@ function ComposedRoute({
   permission
 }) {
   if (PageComponent) {
-    const content = permission ? /* @__PURE__ */ jsxRuntime.jsx(RouteGuard, { permission, LoadingComponent, children: /* @__PURE__ */ jsxRuntime.jsx(PageComponent, { ...props }) }) : /* @__PURE__ */ jsxRuntime.jsx(PageComponent, { ...props });
+    const content = permission ? /* @__PURE__ */ jsxRuntime.jsx(
+      PermissionRouteAccess,
+      {
+        permission,
+        LoadingComponent,
+        children: /* @__PURE__ */ jsxRuntime.jsx(PageComponent, { ...props })
+      }
+    ) : /* @__PURE__ */ jsxRuntime.jsx(PageComponent, { ...props });
     const suspenseFallback = LoadingComponent ? /* @__PURE__ */ jsxRuntime.jsx(LoadingComponent, {}) : null;
     if (ErrorComponent) {
       return /* @__PURE__ */ jsxRuntime.jsx(React.Suspense, { fallback: suspenseFallback, children: /* @__PURE__ */ jsxRuntime.jsx(
-        errorBoundary.ErrorBoundary,
+        ComposedRouteErrorBoundary,
         {
-          FallbackComponent: ErrorComponent,
-          resetKeys: [path],
+          path,
+          ErrorComponent,
+          LoadingComponent,
           onError,
           children: /* @__PURE__ */ jsxRuntime.jsx(React.Suspense, { fallback: suspenseFallback, children: content }, `inner-${path}`)
         }
@@ -107,4 +188,5 @@ function ComposedRoute({
 }
 
 exports.ComposedRoute = ComposedRoute;
+exports.PermissionRouteAccess = PermissionRouteAccess;
 exports.RouteRenderer = RouteRenderer;

package/dist/packages/stack/src/client/components/compose.mjs

@@ -1,7 +1,7 @@
 "use client";
 import { jsx, Fragment } from 'react/jsx-runtime';
 import React__default, { Suspense, useEffect } from 'react';
-import { useAuthContext, useCan } from '../../context/auth.mjs';
+import { PermissionCheck, useAuthContext } from '../../context/auth.mjs';
 import { useStackOrNull } from '../../context/provider.mjs';
 import { ErrorBoundary } from './error-boundary.mjs';
 
@@ -28,14 +28,88 @@ function RouteRenderer({
     }
   );
 }
-function RouteGuard({
+function PermissionRouteAccess({
   permission,
   LoadingComponent,
   children
+}) {
+  return /* @__PURE__ */ jsx(PermissionCheck, { permission, children: (state) => /* @__PURE__ */ jsx(
+    ResolvedRouteAccess,
+    {
+      state,
+      permissionLabel: permission.id,
+      LoadingComponent,
+      children
+    }
+  ) });
+}
+function getErrorStatus(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const candidate = error;
+  if (typeof candidate.statusCode === "number") return candidate.statusCode;
+  return typeof candidate.status === "number" ? candidate.status : void 0;
+}
+function RouteErrorFallback({
+  error,
+  resetErrorBoundary,
+  ErrorComponent,
+  LoadingComponent
+}) {
+  const auth = useAuthContext();
+  const stack = useStackOrNull();
+  const loginPath = auth?.provider.loginPath;
+  const navigate = stack?.router?.navigate;
+  const shouldRedirect = getErrorStatus(error) === 401 && !!auth && !!loginPath;
+  useEffect(() => {
+    if (!shouldRedirect || !loginPath) return;
+    if (navigate) {
+      void navigate(loginPath);
+    } else if (typeof window !== "undefined") {
+      window.location.assign(loginPath);
+    }
+  }, [shouldRedirect, loginPath, navigate]);
+  if (shouldRedirect) {
+    return LoadingComponent ? /* @__PURE__ */ jsx(LoadingComponent, {}) : null;
+  }
+  return /* @__PURE__ */ jsx(ErrorComponent, { error, resetErrorBoundary });
+}
+function ComposedRouteErrorBoundary({
+  path,
+  ErrorComponent,
+  LoadingComponent,
+  onError,
+  children
+}) {
+  const FallbackComponent = React__default.useCallback(
+    (props) => /* @__PURE__ */ jsx(
+      RouteErrorFallback,
+      {
+        ...props,
+        ErrorComponent,
+        LoadingComponent
+      }
+    ),
+    [ErrorComponent, LoadingComponent]
+  );
+  return /* @__PURE__ */ jsx(
+    ErrorBoundary,
+    {
+      FallbackComponent,
+      resetKeys: [path],
+      onError,
+      children
+    }
+  );
+}
+function ResolvedRouteAccess({
+  state,
+  permissionLabel,
+  LoadingComponent,
+  children
 }) {
   const auth = useAuthContext();
   const stack = useStackOrNull();
-  const { can, isPending } = useCan(permission);
+  const { can, isPending, error } = state;
   const identity = auth?.identity ?? null;
   const loginPath = auth?.provider.loginPath;
   const navigate = stack?.router?.navigate;
@@ -51,6 +125,7 @@ function RouteGuard({
   if (!auth) {
     return /* @__PURE__ */ jsx(Fragment, { children });
   }
+  if (error) throw error;
   if (isPending || shouldRedirect) {
     return LoadingComponent ? /* @__PURE__ */ jsx(LoadingComponent, {}) : null;
   }
@@ -58,9 +133,7 @@ function RouteGuard({
     return /* @__PURE__ */ jsx(Fragment, { children });
   }
   if (process.env.NODE_ENV !== "production") {
-    console.warn(
-      `[btst/auth] RouteGuard denied: cannot ${permission.action} ${permission.resource}`
-    );
+    console.warn(`[btst/auth] RouteGuard denied: ${permissionLabel}`);
   }
   throw new Error("Unauthorized");
 }
@@ -76,14 +149,22 @@ function ComposedRoute({
   permission
 }) {
   if (PageComponent) {
-    const content = permission ? /* @__PURE__ */ jsx(RouteGuard, { permission, LoadingComponent, children: /* @__PURE__ */ jsx(PageComponent, { ...props }) }) : /* @__PURE__ */ jsx(PageComponent, { ...props });
+    const content = permission ? /* @__PURE__ */ jsx(
+      PermissionRouteAccess,
+      {
+        permission,
+        LoadingComponent,
+        children: /* @__PURE__ */ jsx(PageComponent, { ...props })
+      }
+    ) : /* @__PURE__ */ jsx(PageComponent, { ...props });
     const suspenseFallback = LoadingComponent ? /* @__PURE__ */ jsx(LoadingComponent, {}) : null;
     if (ErrorComponent) {
       return /* @__PURE__ */ jsx(Suspense, { fallback: suspenseFallback, children: /* @__PURE__ */ jsx(
-        ErrorBoundary,
+        ComposedRouteErrorBoundary,
         {
-          FallbackComponent: ErrorComponent,
-          resetKeys: [path],
+          path,
+          ErrorComponent,
+          LoadingComponent,
           onError,
           children: /* @__PURE__ */ jsx(Suspense, { fallback: suspenseFallback, children: content }, `inner-${path}`)
         }
@@ -100,4 +181,4 @@ function ComposedRoute({
   }
 }
 
-export { ComposedRoute, RouteRenderer };
+export { ComposedRoute, PermissionRouteAccess, RouteRenderer };