@byline/host-tanstack-start 5.0.0 → 5.1.1

package/src/server-fns/auth/sign-out.test.node.ts

@@ -0,0 +1,85 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  access: 'access' as string | undefined,
+  refresh: 'refresh' as string | undefined,
+  revoke: vi.fn(),
+  clear: vi.fn(),
+  clearPreview: vi.fn(),
+}))
+vi.mock('@tanstack/react-start', () => ({
+  createMiddleware: () => ({ client: () => ({}) }),
+  createServerFn: () => ({ middleware: () => ({ handler: (handler: any) => handler }) }),
+}))
+vi.mock('@byline/core', () => ({
+  getServerConfig: () => ({ sessionProvider: { revokeSession: mocks.revoke } }),
+}))
+vi.mock('@byline/client/server', () => ({
+  readAccessTokenCookie: () => mocks.access,
+  readRefreshTokenCookie: () => mocks.refresh,
+  clearSessionCookies: mocks.clear,
+  clearPreviewCookie: mocks.clearPreview,
+}))
+
+import { adminSignOut } from './sign-out.js'
+
+const call = adminSignOut as unknown as (args: {
+  context: { expectedSessionId?: string }
+}) => Promise<unknown>
+beforeEach(() => {
+  vi.resetAllMocks()
+  mocks.access = 'access'
+  mocks.refresh = 'refresh'
+})
+
+describe('confirmed logout', () => {
+  it('revokes with both observed credentials before clearing cookies', async () => {
+    mocks.revoke.mockImplementation(async () => {
+      expect(mocks.clear).not.toHaveBeenCalled()
+    })
+    await expect(call({ context: { expectedSessionId: 'A' } })).resolves.toEqual({ status: 'ok' })
+    expect(mocks.revoke).toHaveBeenCalledWith({
+      accessToken: 'access',
+      refreshToken: 'refresh',
+      expectedSessionId: 'A',
+    })
+    expect(mocks.clear).toHaveBeenCalledOnce()
+  })
+  it('still requests revocation when only the access cookie remains', async () => {
+    mocks.refresh = undefined
+    await call({ context: { expectedSessionId: 'A' } })
+    expect(mocks.revoke).toHaveBeenCalledWith({
+      accessToken: 'access',
+      refreshToken: undefined,
+      expectedSessionId: 'A',
+    })
+  })
+  it('does not clear credentials or report success when revocation fails', async () => {
+    mocks.revoke.mockRejectedValue(new Error('database unavailable'))
+    await expect(call({ context: { expectedSessionId: 'A' } })).rejects.toThrow(
+      'database unavailable'
+    )
+    expect(mocks.clear).not.toHaveBeenCalled()
+    expect(mocks.clearPreview).not.toHaveBeenCalled()
+  })
+  it('requires the page identity before revoking any observed credential', async () => {
+    await expect(call({ context: {} })).rejects.toMatchObject({ code: 'ERR_SESSION_CHANGED' })
+    expect(mocks.revoke).not.toHaveBeenCalled()
+    expect(mocks.clear).not.toHaveBeenCalled()
+  })
+  it('is idempotent when neither credential is present', async () => {
+    mocks.access = undefined
+    mocks.refresh = undefined
+    await expect(call({ context: {} })).resolves.toEqual({ status: 'ok' })
+    expect(mocks.revoke).not.toHaveBeenCalled()
+    expect(mocks.clear).toHaveBeenCalledOnce()
+  })
+})

package/src/server-fns/auth/sign-out.ts

@@ -9,9 +9,9 @@
 /**
  * Admin sign-out server function.
  *
- * Revokes the current refresh token (so a stolen copy cannot be reused),
+ * Revokes the login identified by either credential (so a stolen copy cannot be reused),
  * clears both session cookies, and clears the preview-mode cookie.
- * Idempotent — if the caller already lacks a refresh cookie, we still
+ * Idempotent — if the caller already lacks both credential cookies, we still
  * clear whatever's there and return successfully.
  *
  * Note: clearing `byline_preview` here is hygiene, not a security
@@ -21,32 +21,57 @@
  * Clearing it simply means the next sign-in starts in non-preview mode.
  */
 
-import { createServerFn } from '@tanstack/react-start'
+import { createMiddleware, createServerFn } from '@tanstack/react-start'
 
+import { ERR_SESSION_CHANGED } from '@byline/auth'
 import {
   clearPreviewCookie,
   clearSessionCookies,
+  readAccessTokenCookie,
   readRefreshTokenCookie,
 } from '@byline/client/server'
 import { getServerConfig } from '@byline/core'
 
-export const adminSignOut = createServerFn({ method: 'POST' }).handler(async () => {
-  const provider = getServerConfig().sessionProvider
-  const refreshToken = readRefreshTokenCookie()
+import {
+  coordinateAuthAction,
+  flagSessionChanged,
+  notifySessionAction,
+  sessionSnapshot,
+} from '../../integrations/session-coordination.js'
 
-  if (provider && refreshToken) {
-    // Best-effort revoke — `revokeSession` itself is idempotent for
-    // unknown/already-revoked tokens, so failures here would almost
-    // certainly be transport-level. Swallow and continue: the cookies
-    // get cleared regardless, so the caller's session ends.
+const signOutBoundary = createMiddleware({ type: 'function' }).client(async ({ next }) => {
+  const snapshot = sessionSnapshot()
+  return coordinateAuthAction(async () => {
     try {
-      await provider.revokeSession(refreshToken)
-    } catch {
-      // no-op
+      const result = await next({ sendContext: { expectedSessionId: snapshot.sessionId } })
+      notifySessionAction()
+      return result
+    } catch (error) {
+      if ((error as { code?: string })?.code === 'ERR_SESSION_CHANGED') flagSessionChanged()
+      throw error
     }
-  }
-
-  clearSessionCookies()
-  clearPreviewCookie()
-  return { status: 'ok' as const }
+  })
 })
+
+export const adminSignOut = createServerFn({ method: 'POST' })
+  .middleware([signOutBoundary])
+  .handler(async ({ context }) => {
+    const provider = getServerConfig().sessionProvider
+    const refreshToken = readRefreshTokenCookie()
+    const accessToken = readAccessTokenCookie()
+
+    if (refreshToken || accessToken) {
+      if (!provider) throw new Error('no sessionProvider configured')
+      if (!context.expectedSessionId)
+        throw ERR_SESSION_CHANGED({ message: 'logout requires the page login identity' })
+      await provider.revokeSession({
+        refreshToken,
+        accessToken,
+        expectedSessionId: context.expectedSessionId,
+      })
+    }
+
+    clearSessionCookies()
+    clearPreviewCookie()
+    return { status: 'ok' as const }
+  })

package/src/server-fns/collections/audit.ts

@@ -12,6 +12,7 @@ import { getAdminBylineClient } from '@byline/client/server'
 import { ERR_NOT_FOUND, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { type ActorLabelMap, resolveActorLabels } from './actors.js'
 
 // ---------------------------------------------------------------------------
@@ -49,6 +50,7 @@ export interface AuditLogEntryDto {
 // ---------------------------------------------------------------------------
 
 export const getCollectionDocumentAuditLog = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; id: string; params?: AuditLogSearchParams }) => input)
   .handler(async ({ data }) => {
     const { collection: path, id, params } = data

package/src/server-fns/collections/copy-to-locale.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +14,8 @@ import type { CopyToLocaleResult, DocumentLifecycleContext } from '@byline/core/
 import { copyToLocale } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import {
   type CollectionDocumentCommittedHookFailureResponse,
   toCommittedDocumentHookFailureResponse,
@@ -34,6 +35,7 @@ import {
  * failures propagate to TanStack Start's transport layer.
  */
 export const copyDocumentToLocale = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number

package/src/server-fns/collections/create.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +14,8 @@ import type { CreateDocumentResult, DocumentLifecycleContext } from '@byline/cor
 import { createDocument } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 
 // ---------------------------------------------------------------------------
@@ -22,6 +23,7 @@ import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 // ---------------------------------------------------------------------------
 
 export const createCollectionDocument = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       collection: string

package/src/server-fns/collections/delete-locale.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +14,8 @@ import type { DeleteLocaleResult, DocumentLifecycleContext } from '@byline/core/
 import { deleteLocale } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import {
   type CollectionDocumentCommittedHookFailureResponse,
   toCommittedDocumentHookFailureResponse,
@@ -35,6 +36,7 @@ import {
  * transport layer.
  */
 export const deleteDocumentLocale = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: { expectedRevision: number; collection: string; id: string; locale: string }) => input
   )

package/src/server-fns/collections/delete.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +14,8 @@ import type { DocumentLifecycleContext } from '@byline/core/services'
 import { deleteDocument as deleteDocumentService } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { toDeleteDocumentResponse } from './delete-outcome.js'
 
 // ---------------------------------------------------------------------------
@@ -22,6 +23,7 @@ import { toDeleteDocumentResponse } from './delete-outcome.js'
 // ---------------------------------------------------------------------------
 
 export const deleteDocument = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; collection: string; id: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data: input }) => {

package/src/server-fns/collections/duplicate.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +14,8 @@ import type { DocumentLifecycleContext, DuplicateDocumentResult } from '@byline/
 import { duplicateDocument } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import {
   type CollectionDocumentCommittedHookFailureResponse,
   toCommittedDocumentHookFailureResponse,
@@ -36,6 +37,7 @@ import {
  * TanStack Start's transport layer for the client to branch on.
  */
 export const duplicateCollectionDocument = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; collection: string; id: string }) => input)
   .handler(
     withDocumentMutationErrors(

package/src/server-fns/collections/get.ts

@@ -1,4 +1,3 @@
-import { withEditableRevision } from '../editable-revision.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -21,7 +20,9 @@ import {
 } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { resolveAdminDocumentRead } from '../admin-document-presentation.js'
+import { withEditableRevision } from '../editable-revision.js'
 import { serialise } from './utils'
 
 // ---------------------------------------------------------------------------
@@ -29,6 +30,7 @@ import { serialise } from './utils'
 // ---------------------------------------------------------------------------
 
 const getDocumentFn = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       collection: string
@@ -177,6 +179,7 @@ const getDocumentFn = createServerFn({ method: 'GET' })
 // ---------------------------------------------------------------------------
 
 const getDocumentByVersionFn = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; versionId: string; locale?: string }) => input)
   .handler(async ({ data }) => {
     const { collection: path, versionId, locale } = data

package/src/server-fns/collections/history.ts

@@ -12,6 +12,7 @@ import { getAdminBylineClient } from '@byline/client/server'
 import { ERR_NOT_FOUND, getCollectionSchemasForPath, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 import { type ActorLabelMap, resolveActorLabels } from './actors.js'
 import { serialise } from './utils'
 
@@ -32,6 +33,7 @@ export interface HistorySearchParams {
 // ---------------------------------------------------------------------------
 
 export const getCollectionDocumentHistory = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; id: string; params: HistorySearchParams }) => input)
   .handler(async ({ data }) => {
     const { collection: path, id, params } = data

package/src/server-fns/collections/list.ts

@@ -1,4 +1,3 @@
-import { withEditableRevision } from '../editable-revision.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -25,6 +24,8 @@ import {
 
 import { ensureCollection } from '../../integrations/api-utils.js'
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withEditableRevision } from '../editable-revision.js'
 import { resolveListViewState, sortableFieldNames } from './list-view-state.js'
 import { serialise } from './utils'
 import type { ListViewPreferenceValue } from './list-view-state.js'
@@ -49,6 +50,7 @@ export interface CollectionSearchParams {
 // ---------------------------------------------------------------------------
 
 export const getCollectionDocuments = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; params: CollectionSearchParams }) => input)
   .handler(async ({ data }) => {
     const { collection: path, params } = data

package/src/server-fns/collections/reindex.ts

@@ -26,10 +26,12 @@ import { getAdminBylineClient } from '@byline/client/server'
 import { ERR_NOT_FOUND, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export type { ReindexResult }
 
 export const reindexCollection = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string }) => input)
   .handler(async ({ data }): Promise<ReindexResult> => {
     const { collection } = data

package/src/server-fns/collections/reorder.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -13,6 +12,8 @@ import { getAdminRequestContext } from '@byline/client/server'
 import { ERR_NOT_FOUND, getLogger, getServerConfig, reorderDocument } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 
 // ---------------------------------------------------------------------------
 // Reorder a single document within an `orderable: true` collection.
@@ -30,6 +31,7 @@ import { ensureCollection } from '../../integrations/api-utils.js'
 // ---------------------------------------------------------------------------
 
 export const reorderCollectionDocument = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number

package/src/server-fns/collections/restore-version.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -15,6 +14,8 @@ import type { DocumentLifecycleContext } from '@byline/core/services'
 import { restoreDocumentVersion as restoreDocumentVersionService } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 
 // ---------------------------------------------------------------------------
@@ -22,6 +23,7 @@ import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 // ---------------------------------------------------------------------------
 
 export const restoreDocumentVersion = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: { expectedRevision: number; collection: string; id: string; versionId: string }) =>
       input

package/src/server-fns/collections/revision-input.test.node.ts

@@ -1,3 +1,14 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+// Handler-level tests isolate transport; session-middleware tests exercise the real pre-handler boundary.
+vi.mock('../../integrations/session-middleware.js', () => ({ adminSessionMiddleware: {} }))
+
 import { createSuperAdminContext } from '@byline/auth'
 import {
   defineCollection,
@@ -16,6 +27,9 @@ vi.mock('@tanstack/react-start', () => ({
   createServerFn: () => {
     let validate = (value: unknown) => value
     const chain = {
+      middleware() {
+        return chain
+      },
       validator(fn: (value: unknown) => unknown) {
         validate = fn
         return chain

package/src/server-fns/collections/scheduled-publication.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -22,6 +21,8 @@ import {
 import { listDocumentPublishSchedules } from '@byline/core/services'
 
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { omitScheduleExecutionState } from './scheduled-publication-response.js'
 import { serialise } from './utils.js'
 
@@ -138,14 +139,17 @@ async function scheduledPublicationRuntime(): Promise<ScheduledPublicationRuntim
 }
 
 /** Authenticated feature discovery for the admin shell and health warning. */
-export const getScheduledPublicationRuntime = createServerFn({ method: 'GET' }).handler(
-  withDocumentMutationErrors(async () => {
-    await getAdminRequestContext()
-    return scheduledPublicationRuntime()
-  })
-)
+export const getScheduledPublicationRuntime = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
+  .handler(
+    withDocumentMutationErrors(async () => {
+      await getAdminRequestContext()
+      return scheduledPublicationRuntime()
+    })
+  )
 
 export const scheduleCollectionDocumentPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -170,6 +174,7 @@ export const scheduleCollectionDocumentPublish = createServerFn({ method: 'POST'
   )
 
 export const confirmCollectionDocumentScheduledPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -192,6 +197,7 @@ export const confirmCollectionDocumentScheduledPublish = createServerFn({ method
   )
 
 export const cancelCollectionDocumentScheduledPublish = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; collection: string; id: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {
@@ -210,6 +216,7 @@ export const cancelCollectionDocumentScheduledPublish = createServerFn({ method:
   )
 
 export const listScheduledPublications = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       states?: readonly DocumentPublishScheduleState[]

package/src/server-fns/collections/set-list-view-preference.ts

@@ -27,6 +27,7 @@ import { ERR_NOT_FOUND, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
 import { bylineCore } from '../../integrations/byline-core.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 export interface SetListViewPreferenceInput {
   collection: string
@@ -38,6 +39,7 @@ export interface SetListViewPreferenceInput {
 }
 
 export const setListViewPreference = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: SetListViewPreferenceInput) => input)
   .handler(async ({ data }) => {
     // Scopes are keyed by collection path — refuse to mint rows for

package/src/server-fns/collections/stats.ts

@@ -11,6 +11,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getAdminBylineClient } from '@byline/client/server'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
 
 // ---------------------------------------------------------------------------
 // Shared types
@@ -26,6 +27,7 @@ export interface CollectionStatusCount {
 // ---------------------------------------------------------------------------
 
 const getCollectionStatsFn = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string }) => input)
   .handler(async ({ data }) => {
     const config = await ensureCollection(data.collection)

package/src/server-fns/collections/status.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -18,12 +17,15 @@ import {
 } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 
 // ---------------------------------------------------------------------------
 // Change document workflow status
 // ---------------------------------------------------------------------------
 
 export const updateDocumentStatus = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: { expectedRevision: number; collection: string; id: string; status: string }) => input
   )
@@ -72,6 +74,7 @@ export const updateDocumentStatus = createServerFn({ method: 'POST' })
 // ---------------------------------------------------------------------------
 
 export const unpublishDocument = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { expectedRevision: number; collection: string; id: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data: input }) => {

package/src/server-fns/collections/tree.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -21,6 +20,8 @@ import { getAdminBylineClient } from '@byline/client/server'
 import { createReadContext, ERR_NOT_FOUND, getLogger } from '@byline/core'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { placeAdminTreeNode, removeAdminTreeNode } from './tree-mutation.js'
 import { getAdminTreeParent } from './tree-read.js'
 
@@ -29,6 +30,7 @@ import { getAdminTreeParent } from './tree-read.js'
 // ---------------------------------------------------------------------------
 
 export const placeTreeNode = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -67,6 +69,7 @@ export const placeTreeNode = createServerFn({ method: 'POST' })
 // ---------------------------------------------------------------------------
 
 export const removeFromTree = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       expectedRevision: number
@@ -102,6 +105,7 @@ export const removeFromTree = createServerFn({ method: 'POST' })
 // ---------------------------------------------------------------------------
 
 export const getTreeAncestors = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; documentId: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {
@@ -135,6 +139,7 @@ export const getTreeAncestors = createServerFn({ method: 'GET' })
 // ---------------------------------------------------------------------------
 
 export const getTreeParent = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; documentId: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {
@@ -173,6 +178,7 @@ export interface CollectionTreeRow {
 }
 
 export const getCollectionTree = createServerFn({ method: 'GET' })
+  .middleware([adminSessionMiddleware])
   .validator((input: { collection: string; locale?: string }) => input)
   .handler(
     withDocumentMutationErrors(async ({ data }) => {

package/src/server-fns/collections/update.ts

@@ -1,4 +1,3 @@
-import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -16,6 +15,8 @@ import type { DocumentLifecycleContext } from '@byline/core/services'
 import { saveDocument, updateDocumentSystemFields } from '@byline/core/services'
 
 import { ensureCollection } from '../../integrations/api-utils.js'
+import { adminSessionMiddleware } from '../../integrations/session-middleware.js'
+import { withDocumentMutationErrors } from '../document-mutation-errors.js'
 import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 
 // ---------------------------------------------------------------------------
@@ -24,6 +25,7 @@ import { toCommittedDocumentHookFailureResponse } from './save-outcome.js'
 // ---------------------------------------------------------------------------
 
 export const updateCollectionDocumentWithPatches = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       collection: string
@@ -102,6 +104,7 @@ export const updateCollectionDocumentWithPatches = createServerFn({ method: 'POS
 // ---------------------------------------------------------------------------
 
 export const updateCollectionDocumentSystemFields = createServerFn({ method: 'POST' })
+  .middleware([adminSessionMiddleware])
   .validator(
     (input: {
       collection: string