@byline/host-tanstack-start 5.0.0 → 5.1.0

package/src/server-fns/collections/restore-version.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +14,8 @@ import type { DocumentLifecycleContext } from '@byline/core/services'
 import { restoreDocumentVersion as restoreDocumentVersionService } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 
 // ---------------------------------------------------------------------------
@@ -22,6 +23,7 @@ import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 // ---------------------------------------------------------------------------
 
 export const restoreDocumentVersion = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: { expectedRevision: number; collection: string; id: string; versionId: string }) =>
       input

package/src/server-fns/collections/revision-input.test.node.ts

@@ -1,3 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+// Handler-level tests isolate transport; session-middleware tests exercise the real pre-handler boundary.
+vi.mock('../../integrations/session-middleware.js', () => ({ adminSessionMiddleware: {} }))
+
 import { createSuperAdminContext } from '@byline/auth'
 import {
   defineCollection,
@@ -16,6 +27,9 @@ vi.mock('@tanstack/react-start', () => ({
   createServerFn: () => {
     let validate = (value: unknown) => value
     const chain = {
+      middleware() {
+        return chain
+      },
       validator(fn: (value: unknown) => unknown) {
         validate = fn
         return chain

package/src/server-fns/collections/scheduled-publication.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -22,6 +21,8 @@ import {
 import { listDocumentPublishSchedules } from '@byline/core/services'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { omitScheduleExecutionState } from './scheduled-publication-response.js'
 import { serialise } from './utils.js'
 
@@ -138,14 +139,17 @@ async function scheduledPublicationRuntime(): Promise<ScheduledPublicationRuntim
 }
 
 /** Authenticated feature discovery for the admin shell and health warning. */
-export const getScheduledPublicationRuntime = createServerFn({ method: 'GET' }).handler(
-  withDocumentMutationErrors(async () => {
-    await getAdminRequestContext()
-    return scheduledPublicationRuntime()
-  })
-)
+export const getScheduledPublicationRuntime = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(
+    withDocumentMutationErrors(async () => {
+      await getAdminRequestContext()
+      return scheduledPublicationRuntime()
+    })
+  )
 
 export const scheduleCollectionDocumentPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -170,6 +174,7 @@ export const scheduleCollectionDocumentPublish = createServerFn({ method: 'POST'
   )
 
 export const confirmCollectionDocumentScheduledPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -192,6 +197,7 @@ export const confirmCollectionDocumentScheduledPublish = createServerFn({ method
   )
 
 export const cancelCollectionDocumentScheduledPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; collection: string; id: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {
@@ -210,6 +216,7 @@ export const cancelCollectionDocumentScheduledPublish = createServerFn({ method:
   )
 
 export const listScheduledPublications = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       states?: readonly DocumentPublishScheduleState[]

package/src/server-fns/collections/set-list-view-preference.ts

@@ -27,6 +27,7 @@ import { ERR_NOT_FOUND, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetListViewPreferenceInput {
   collection: string
@@ -38,6 +39,7 @@ export interface SetListViewPreferenceInput {
 }
 
 export const setListViewPreference = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetListViewPreferenceInput) => input)
   .handler(async ({ data }) => {
     // Scopes are keyed by collection path — refuse to mint rows for

package/src/server-fns/collections/stats.ts

@@ -11,6 +11,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getAdminBylineClient } from '@byline/client/server'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // ---------------------------------------------------------------------------
 // Shared types
@@ -26,6 +27,7 @@ export interface CollectionStatusCount {
 // ---------------------------------------------------------------------------
 
 const getCollectionStatsFn = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string }) => input)
   .handler(async ({ data }) => {
     const config = await ensureCollection(data.collection)

package/src/server-fns/collections/status.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -18,12 +17,15 @@ import {
 } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 
 // ---------------------------------------------------------------------------
 // Change document workflow status
 // ---------------------------------------------------------------------------
 
 export const updateDocumentStatus = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: { expectedRevision: number; collection: string; id: string; status: string }) => input
   )
@@ -72,6 +74,7 @@ export const updateDocumentStatus = createServerFn({ method: 'POST' })
 // ---------------------------------------------------------------------------
 
 export const unpublishDocument = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; collection: string; id: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data: input }) => {

package/src/server-fns/collections/tree.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -21,6 +20,8 @@ import { getAdminBylineClient } from '@byline/client/server'
 import { createReadContext, ERR_NOT_FOUND, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { placeAdminTreeNode, removeAdminTreeNode } from './tree-mutation.js'
 import { getAdminTreeParent } from './tree-read.js'
 
@@ -29,6 +30,7 @@ import { getAdminTreeParent } from './tree-read.js'
 // ---------------------------------------------------------------------------
 
 export const placeTreeNode = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -67,6 +69,7 @@ export const placeTreeNode = createServerFn({ method: 'POST' })
 // ---------------------------------------------------------------------------
 
 export const removeFromTree = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -102,6 +105,7 @@ export const removeFromTree = createServerFn({ method: 'POST' })
 // ---------------------------------------------------------------------------
 
 export const getTreeAncestors = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; documentId: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {
@@ -135,6 +139,7 @@ export const getTreeAncestors = createServerFn({ method: 'GET' })
 // ---------------------------------------------------------------------------
 
 export const getTreeParent = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; documentId: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {
@@ -173,6 +178,7 @@ export interface CollectionTreeRow {
 }
 
 export const getCollectionTree = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; locale?: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {

package/src/server-fns/collections/update.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -16,6 +15,8 @@ import type { DocumentLifecycleContext } from '@byline/core/services'
 import { saveDocument, updateDocumentSystemFields } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 
 // ---------------------------------------------------------------------------
@@ -24,6 +25,7 @@ import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 // ---------------------------------------------------------------------------
 
 export const updateCollectionDocumentWithPatches = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       collection: string
@@ -102,6 +104,7 @@ export const updateCollectionDocumentWithPatches = createServerFn({ method: 'POS
 // ---------------------------------------------------------------------------
 
 export const updateCollectionDocumentSystemFields = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       collection: string

package/src/server-fns/collections/upload-singleton.test.node.ts

@@ -1,4 +1,3 @@
-import { testAdapter } from '../../../../core/src/storage/db-adapter.test-helper.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -21,6 +20,9 @@ vi.mock('@tanstack/react-start', () => ({
   createServerFn: () => {
     let validate = (input: unknown) => input
     const chain = {
+      middleware() {
+        return chain
+      },
       validator(validator: (input: unknown) => unknown) {
         validate = validator
         return chain
@@ -50,6 +52,11 @@ vi.mock('../../integrations/byline-core.js', () => ({
 import { ensureCollection, ensureDocumentResource } from '../../integrations/api-utils.js'
 import { uploadField } from './upload.js'
 
+// Handler-level tests isolate transport; session-middleware tests exercise the real pre-handler boundary.
+vi.mock('../../integrations/session-middleware.js', () => ({ adminSessionMiddleware: {} }))
+
+import { testAdapter } from '../../../../core/src/storage/db-adapter.test-helper.js'
+
 const SERVER_CONFIG = Symbol.for('__byline_server_config__')
 const BYLINE_LOGGER = Symbol.for('__byline_logger__')
 const previousServer = (globalThis as Record<PropertyKey, unknown>)[SERVER_CONFIG]

package/src/server-fns/collections/upload.ts

@@ -1,3 +1,11 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
 import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminRequestContext } from '@byline/client/server'
@@ -14,6 +22,7 @@ import { getLogger, withLogContext } from '@byline/core/logger'
 import { uploadField as coreUploadField } from '@byline/core/services'
 
 import { ensureDocumentResource } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 
 /**
@@ -150,6 +159,7 @@ function resolveUploadField(
  * without depending on TanStack Start server-function transport details.
  */
 export const uploadCollectionField = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(parseUploadFormData)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {

package/src/server-fns/i18n/set-locale.ts

@@ -25,7 +25,7 @@
  * switcher works on the sign-in surface — the DB write simply skips.
  */
 
-import { createServerFn } from '@tanstack/react-start'
+import { createMiddleware, createServerFn } from '@tanstack/react-start'
 
 import type { AccountResponse } from '@byline/admin/admin-account'
 import { setPreferredLocaleCommand } from '@byline/admin/admin-account'
@@ -34,6 +34,7 @@ import { getAdminRequestContext } from '@byline/client/server'
 
 import { clearAdminLocaleCookie, setAdminLocaleCookie } from '../../i18n/locale-cookie.js'
 import { bylineCore } from '../../integrations/byline-core.js'
+import { expectedSession } from '../../integrations/session-coordination.js'
 
 export interface SetAdminLocaleInput {
   /** BCP 47 tag, or `null` to clear the preference. */
@@ -53,9 +54,18 @@ export interface SetAdminLocaleResult {
   account: AccountResponse | null
 }
 
+const localeSession = createMiddleware({ type: 'function' }).client(({ next }) =>
+  next({
+    sendContext: {
+      expectedSessionId: expectedSession(),
+    },
+  })
+)
+
 export const setAdminLocaleFn = createServerFn({ method: 'POST' })
+  .middleware([localeSession])
   .validator((input: SetAdminLocaleInput) => input)
-  .handler(async ({ data }): Promise<SetAdminLocaleResult> => {
+  .handler(async ({ data, context: caller }): Promise<SetAdminLocaleResult> => {
     const core = bylineCore()
     const locales = core.config.i18n.admin.locales
 
@@ -87,6 +97,9 @@ export const setAdminLocaleFn = createServerFn({ method: 'POST' })
 
     try {
       const context = await getAdminRequestContext()
+      if (!caller.expectedSessionId || caller.expectedSessionId !== context.sessionId) {
+        return { ok: true as const, locale: data.locale, account: null }
+      }
       const account = await setPreferredLocaleCommand(
         context,
         { locale: data.locale },
@@ -94,7 +107,10 @@ export const setAdminLocaleFn = createServerFn({ method: 'POST' })
       )
       return { ok: true as const, locale: data.locale, account }
     } catch (err) {
-      if (err instanceof AuthError && err.code === AuthErrorCodes.UNAUTHENTICATED) {
+      if (
+        err instanceof AuthError &&
+        (err.code === AuthErrorCodes.UNAUTHENTICATED || err.code === AuthErrorCodes.ACCESS_EXPIRED)
+      ) {
         // Expected on the pre-auth path. Cookie already written.
         return { ok: true as const, locale: data.locale, account: null }
       }

package/src/server-fns/preview/disable.ts

@@ -18,7 +18,11 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { clearPreviewCookie } from '@byline/client/server'
 
-export const disablePreviewModeFn = createServerFn({ method: 'POST' }).handler(async () => {
-  clearPreviewCookie()
-  return { status: 'ok' as const, preview: false as const }
-})
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
+export const disablePreviewModeFn = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
+  .handler(async () => {
+    clearPreviewCookie()
+    return { status: 'ok' as const, preview: false as const }
+  })

package/src/server-fns/preview/enable.ts

@@ -19,8 +19,12 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminRequestContext, setPreviewCookie } from '@byline/client/server'
 
-export const enablePreviewModeFn = createServerFn({ method: 'POST' }).handler(async () => {
-  await getAdminRequestContext()
-  setPreviewCookie()
-  return { status: 'ok' as const, preview: true as const }
-})
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+
+export const enablePreviewModeFn = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
+  .handler(async () => {
+    await getAdminRequestContext()
+    setPreviewCookie()
+    return { status: 'ok' as const, preview: true as const }
+  })

package/src/server-fns/singletons/cancel-scheduled-publish.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,9 +10,12 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export const cancelSingletonScheduledPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; singleton: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) =>

package/src/server-fns/singletons/change-status.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,9 +10,12 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export const changeSingletonStatus = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; singleton: string; status: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) =>

package/src/server-fns/singletons/confirm-scheduled-publish.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,9 +10,12 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export const confirmSingletonScheduledPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: { expectedRevision: number; singleton: string; expectedVersionId: string }) => input
   )

package/src/server-fns/singletons/copy-to-locale.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,10 +10,13 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { toCommittedDocumentHookFailureResponse } from '../collections/save-outcome.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export const copySingletonToLocale = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number

package/src/server-fns/singletons/find-by-version.ts

@@ -10,9 +10,11 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { serialise } from '../serialise.js'
 
 export const findSingletonByVersion = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { singleton: string; versionId: string; locale?: string }) => input)
   .handler(async ({ data }) =>
     serialise(

package/src/server-fns/singletons/get-scheduled-publish.ts

@@ -10,9 +10,11 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { serialise } from '../serialise.js'
 
 export const getSingletonScheduledPublish = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { singleton: string }) => input)
   .handler(async ({ data }) =>
     serialise(await getAdminBylineClient().singleton(data.singleton).getScheduledPublish())

package/src/server-fns/singletons/get.ts

@@ -8,6 +8,7 @@
 
 import { createServerFn } from '@tanstack/react-start'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { readSingletonDocument } from '../singleton-document-read.js'
 
 export interface GetSingletonInput {
@@ -28,5 +29,6 @@ export interface GetSingletonInput {
  *   from the same editable snapshot as the source document.
  */
 export const getSingleton = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: GetSingletonInput) => input)
   .handler(async ({ data }) => readSingletonDocument(data))

package/src/server-fns/singletons/history.ts

@@ -10,6 +10,7 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { type ActorLabelMap, resolveActorLabels } from '../actors.js'
 import { serialise } from '../serialise.js'
 
@@ -22,6 +23,7 @@ export interface SingletonHistorySearchParams {
 }
 
 export const getSingletonHistory = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { singleton: string; params?: SingletonHistorySearchParams }) => input)
   .handler(async ({ data }) => {
     const params = data.params ?? {}

package/src/server-fns/singletons/restore-version.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,10 +10,13 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { toCommittedDocumentHookFailureResponse } from '../collections/save-outcome.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export const restoreSingletonVersion = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; singleton: string; versionId: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {

package/src/server-fns/singletons/schedule-publish.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,9 +10,12 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export const scheduleSingletonPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number

package/src/server-fns/singletons/singletons.test.node.ts

@@ -23,6 +23,9 @@ vi.mock('@tanstack/react-start', () => ({
   createServerFn: () => {
     let validate = (input: unknown) => input
     const chain = {
+      middleware() {
+        return chain
+      },
       validator(validator: (input: unknown) => unknown) {
         validate = validator
         return chain
@@ -56,6 +59,9 @@ import { scheduleSingletonPublish } from './schedule-publish.js'
 import { unpublishSingleton } from './unpublish.js'
 import { updateSingleton } from './update.js'
 
+// Handler-level tests isolate transport; session-middleware tests exercise the real pre-handler boundary.
+vi.mock('../../integrations/session-middleware.js', () => ({ adminSessionMiddleware: {} }))
+
 type ServerFunction = (options: { data: any }) => Promise<any>
 
 const invoke = (serverFunction: unknown, data: Record<string, any>) =>

package/src/server-fns/singletons/unpublish.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -11,9 +10,12 @@ import { createServerFn } from '@tanstack/react-start'
 
 import { getAdminBylineClient } from '@byline/client/server'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export const unpublishSingleton = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; singleton: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) =>

package/src/server-fns/singletons/update.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -12,7 +11,9 @@ import { createServerFn } from '@tanstack/react-start'
 import { getAdminBylineClient } from '@byline/client/server'
 import type { SingletonSavePrecondition } from '@byline/core'
 
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { toCommittedDocumentHookFailureResponse } from '../collections/save-outcome.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { serialise } from '../serialise.js'
 
 export type UpdateSingletonInput = SingletonSavePrecondition & {
@@ -22,6 +23,7 @@ export type UpdateSingletonInput = SingletonSavePrecondition & {
 }
 
 export const updateSingleton = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: UpdateSingletonInput) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {