@byline/host-tanstack-start 5.0.0 → 5.1.1

package/dist/integrations/session-middleware.js

@@ -0,0 +1,94 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { getRequest, setResponseHeader } from "@tanstack/react-start/server";
+import { AuthError, ERR_ACCESS_EXPIRED, ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED } from "@byline/auth";
+import { getAdminRequestContext } from "@byline/client/server";
+import { renewAdminSession } from "../server-fns/auth/renew.js";
+import { coordinateAuthAction, flagSessionChanged, observeSession, renewSingleFlight, requireUnchanged, sessionSnapshot } from "./session-coordination.js";
+import { sessionRequestKind } from "./session-request-kind.js";
+const outcomeHeader = 'x-byline-auth-boundary';
+const adminSessionMiddleware = createMiddleware({
+    type: 'function'
+}).client(async ({ next })=>{
+    if ("u" < typeof window) return next({
+        sendContext: {
+            bylineExpectedSessionId: null
+        }
+    });
+    const snapshot = sessionSnapshot();
+    requireUnchanged(snapshot);
+    return next({
+        sendContext: {
+            bylineExpectedSessionId: snapshot.sessionId
+        },
+        fetch: async (input, init)=>{
+            const reusable = !(input instanceof Request) && !(init?.body instanceof ReadableStream);
+            let response = await fetch(input, init);
+            if ('changed' === response.headers.get(outcomeHeader)) {
+                flagSessionChanged();
+                throw ERR_SESSION_CHANGED({
+                    message: 'session changed'
+                });
+            }
+            if ('renew' === response.headers.get(outcomeHeader)) {
+                requireUnchanged(snapshot);
+                await renewSingleFlight(()=>coordinateAuthAction(async ()=>{
+                        const result = await renewAdminSession({
+                            data: {
+                                expectedSessionId: snapshot.sessionId ?? void 0
+                            }
+                        }).catch((error)=>{
+                            if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
+                            throw error;
+                        });
+                        if (snapshot.sessionId && result.sessionId !== snapshot.sessionId) {
+                            flagSessionChanged();
+                            throw ERR_SESSION_CHANGED({
+                                message: 'session changed during renewal'
+                            });
+                        }
+                        observeSession(result.sessionId);
+                    }));
+                requireUnchanged(snapshot);
+                if (!reusable) throw ERR_ACCESS_EXPIRED({
+                    message: 'Session renewed. Please retry the operation.'
+                });
+                response = await fetch(input, init);
+                if ('changed' === response.headers.get(outcomeHeader)) flagSessionChanged();
+            }
+            requireUnchanged(snapshot);
+            return response;
+        }
+    });
+}).server(async ({ next, context, method })=>{
+    const kind = sessionRequestKind(getRequest());
+    if (!kind) throw new Error('sessionRequestMiddleware is not configured');
+    let auth;
+    try {
+        auth = await getAdminRequestContext();
+    } catch (error) {
+        if (error instanceof AuthError && 'ERR_ACCESS_EXPIRED' === error.code) setResponseHeader(outcomeHeader, 'renew');
+        throw error;
+    }
+    const expected = context.bylineExpectedSessionId;
+    if (('serverFn' === kind || 'GET' !== method) && (!expected || expected !== auth.sessionId)) {
+        setResponseHeader(outcomeHeader, 'changed');
+        throw ERR_SESSION_CHANGED({
+            message: 'session changed before operation'
+        });
+    }
+    if (!auth.sessionId) throw ERR_UNAUTHENTICATED({
+        message: 'provider omitted login identity'
+    });
+    try {
+        const result = await next();
+        const response = result.result;
+        if (response instanceof Response) response.headers.delete(outcomeHeader);
+        return result;
+    } catch (error) {
+        if (error instanceof Response) error.headers.delete(outcomeHeader);
+        throw error;
+    } finally{
+        setResponseHeader(outcomeHeader, 'handled');
+    }
+});
+export { adminSessionMiddleware };

package/dist/integrations/session-request-kind.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export declare function recordSessionRequestKind(request: object, kind: string): void;
+export declare function sessionRequestKind(request: object): string | undefined;

package/dist/integrations/session-request-kind.js

@@ -0,0 +1,10 @@
+const key = Symbol.for('byline.sessionRequestKinds');
+const kinds = globalThis[key] ?? new WeakMap();
+globalThis[key] = kinds;
+function recordSessionRequestKind(request, kind) {
+    kinds.set(request, kind);
+}
+function sessionRequestKind(request) {
+    return kinds.get(request);
+}
+export { recordSessionRequestKind, sessionRequestKind };

package/dist/integrations/session-request-middleware.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Register after CSRF. Classifies SSR separately from remotely invoked business functions. */
+export declare const sessionRequestMiddleware: import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, undefined>;

package/dist/integrations/session-request-middleware.js

@@ -0,0 +1,7 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { recordSessionRequestKind } from "./session-request-kind.js";
+const sessionRequestMiddleware = createMiddleware().server(async (ctx)=>{
+    recordSessionRequestKind(ctx.request, ctx.handlerType);
+    return ctx.next();
+});
+export { sessionRequestMiddleware };

package/dist/integrations/sign-in-body.d.ts

@@ -0,0 +1,12 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Limit the serialized RPC envelope, not just its eventual credential fields. */
+export declare const SIGN_IN_MAX_BODY_BYTES: number;
+export declare function wasSignInBodyChecked(request: Request): boolean;
+/** Read a bounded clone before Start parses the original. Never await tee cancellation. */
+export declare function checkSignInBody(request: Request): Promise<Response | undefined>;

package/dist/integrations/sign-in-body.js

@@ -0,0 +1,52 @@
+const SIGN_IN_MAX_BODY_BYTES = 16384;
+const checked = new WeakSet();
+function wasSignInBodyChecked(request) {
+    return checked.has(request);
+}
+async function checkSignInBody(request) {
+    if ('POST' !== request.method) return new Response('Method not allowed', {
+        status: 405,
+        headers: {
+            Allow: 'POST'
+        }
+    });
+    if (!request.headers.get('content-type')?.toLowerCase().startsWith('application/json')) return new Response('Expected JSON', {
+        status: 415
+    });
+    const declared = request.headers.get('content-length');
+    if (null !== declared && (!/^\d+$/.test(declared) || Number(declared) > SIGN_IN_MAX_BODY_BYTES)) return new Response('Payload too large', {
+        status: 413
+    });
+    const reader = request.clone().body?.getReader();
+    if (!reader) return new Response('Missing body', {
+        status: 400
+    });
+    let timer;
+    const deadline = new Promise((_, reject)=>{
+        timer = setTimeout(()=>reject(new Error('Body timeout')), 5000);
+    });
+    try {
+        let size = 0;
+        while(true){
+            const { value, done } = await Promise.race([
+                reader.read(),
+                deadline
+            ]);
+            if (done) break;
+            size += value.byteLength;
+            if (size > SIGN_IN_MAX_BODY_BYTES) return new Response('Payload too large', {
+                status: 413
+            });
+        }
+        checked.add(request);
+        return;
+    } catch  {
+        return new Response('Incomplete request body', {
+            status: 408
+        });
+    } finally{
+        clearTimeout(timer);
+        reader.cancel().catch(()=>{});
+    }
+}
+export { SIGN_IN_MAX_BODY_BYTES, checkSignInBody, wasSignInBodyChecked };

package/dist/integrations/sign-in-middleware.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Register after CSRF in Start's global requestMiddleware, before RPC deserialization. */
+export declare const passwordSignInMiddleware: import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, undefined>;

package/dist/integrations/sign-in-middleware.js

@@ -0,0 +1,10 @@
+import { createMiddleware } from "@tanstack/react-start";
+import { adminSignIn } from "../server-fns/auth/sign-in.js";
+import { checkSignInBody } from "./sign-in-body.js";
+const passwordSignInMiddleware = createMiddleware().server(async (ctx)=>{
+    const endpoint = new URL(adminSignIn.url, ctx.request.url).pathname.replace(/\/$/, '');
+    if ('serverFn' !== ctx.handlerType || ctx.pathname !== endpoint && !ctx.pathname.startsWith(`${endpoint}/`)) return ctx.next();
+    const rejected = await checkSignInBody(ctx.request);
+    return rejected ?? ctx.next();
+});
+export { passwordSignInMiddleware };

package/dist/routes/create-admin-layout-route.js

@@ -14,10 +14,12 @@ import { AdminMenuProvider } from "../admin-shell/chrome/admin-menu-provider.js"
 import { Content } from "../admin-shell/chrome/content.js";
 import { RouteError, RouteNotFound } from "../admin-shell/chrome/route-error.js";
 import { RouteProgressBar } from "../admin-shell/chrome/route-progress-bar.js";
+import { SessionChangeBoundary } from "../admin-shell/chrome/session-change-boundary.js";
 import { buildLocaleDefinitions } from "../i18n/locale-definitions.js";
 import { bylineAdminServices } from "../integrations/byline-admin-services.js";
 import { BylineAiAdminProvider } from "../integrations/byline-ai.js";
 import { bylineFieldServices } from "../integrations/byline-field-services.js";
+import { observeSession, sessionIsChanged } from "../integrations/session-coordination.js";
 import { getAnalyticsRuntime } from "../server-fns/analytics/index.js";
 import { getCurrentAdminUser } from "../server-fns/auth/index.js";
 import { getScheduledPublicationRuntime } from "../server-fns/collections/index.js";
@@ -29,6 +31,7 @@ function createAdminLayoutRoute(path) {
             const signInPath = getSignInRoutePath();
             try {
                 const user = await getCurrentAdminUser();
+                if ("u" > typeof window) observeSession(user.sessionId);
                 const [activeLocale, scheduledPublicationRuntime, analyticsRuntime] = await Promise.all([
                     getActiveLocaleFn(),
                     getScheduledPublicationRuntime(),
@@ -40,7 +43,16 @@ function createAdminLayoutRoute(path) {
                     scheduledPublicationRuntime,
                     analyticsRuntime
                 };
-            } catch  {
+            } catch (error) {
+                const code = error?.code;
+                if (!("u" > typeof window && sessionIsChanged()) && ![
+                    'ERR_UNAUTHENTICATED',
+                    'ERR_ACCESS_EXPIRED',
+                    'ERR_INVALID_TOKEN',
+                    'ERR_REVOKED_TOKEN',
+                    'ERR_ACCOUNT_DISABLED',
+                    'ERR_SESSION_CHANGED'
+                ].includes(code ?? '')) throw error;
                 throw redirect({
                     to: signInPath,
                     search: {
@@ -64,36 +76,39 @@ function createAdminLayoutRoute(path) {
                 });
                 window.location.reload();
             };
-            return /*#__PURE__*/ jsx(I18nProvider, {
-                bundle: i18n.translations ?? {},
-                activeLocale: activeLocale,
-                defaultLocale: i18n.admin.defaultLocale,
-                localeDefinitions: localeDefinitions,
-                setLocale: handleSetLocale,
-                children: /*#__PURE__*/ jsx(BylineAdminServicesProvider, {
-                    services: bylineAdminServices,
-                    children: /*#__PURE__*/ jsx(BylineFieldServicesProvider, {
-                        services: bylineFieldServices,
-                        children: /*#__PURE__*/ jsx(BylineAiAdminProvider, {
-                            children: /*#__PURE__*/ jsxs(AdminMenuProvider, {
-                                children: [
-                                    /*#__PURE__*/ jsx(RouteProgressBar, {}),
-                                    /*#__PURE__*/ jsx(AdminAppBar, {
-                                        user: user
-                                    }),
-                                    /*#__PURE__*/ jsxs("main", {
-                                        className: clsx('byline-admin-layout-main', admin_layout_module.main),
-                                        children: [
-                                            /*#__PURE__*/ jsx(AdminMenuDrawer, {
-                                                analyticsEnabled: analyticsRuntime.enabled,
-                                                scheduledPublicationEnabled: scheduledPublicationRuntime.enabled
-                                            }),
-                                            /*#__PURE__*/ jsx(Content, {
-                                                children: /*#__PURE__*/ jsx(Outlet, {})
-                                            })
-                                        ]
-                                    })
-                                ]
+            return /*#__PURE__*/ jsx(SessionChangeBoundary, {
+                user: user,
+                children: /*#__PURE__*/ jsx(I18nProvider, {
+                    bundle: i18n.translations ?? {},
+                    activeLocale: activeLocale,
+                    defaultLocale: i18n.admin.defaultLocale,
+                    localeDefinitions: localeDefinitions,
+                    setLocale: handleSetLocale,
+                    children: /*#__PURE__*/ jsx(BylineAdminServicesProvider, {
+                        services: bylineAdminServices,
+                        children: /*#__PURE__*/ jsx(BylineFieldServicesProvider, {
+                            services: bylineFieldServices,
+                            children: /*#__PURE__*/ jsx(BylineAiAdminProvider, {
+                                children: /*#__PURE__*/ jsxs(AdminMenuProvider, {
+                                    children: [
+                                        /*#__PURE__*/ jsx(RouteProgressBar, {}),
+                                        /*#__PURE__*/ jsx(AdminAppBar, {
+                                            user: user
+                                        }),
+                                        /*#__PURE__*/ jsxs("main", {
+                                            className: clsx('byline-admin-layout-main', admin_layout_module.main),
+                                            children: [
+                                                /*#__PURE__*/ jsx(AdminMenuDrawer, {
+                                                    analyticsEnabled: analyticsRuntime.enabled,
+                                                    scheduledPublicationEnabled: scheduledPublicationRuntime.enabled
+                                                }),
+                                                /*#__PURE__*/ jsx(Content, {
+                                                    children: /*#__PURE__*/ jsx(Outlet, {})
+                                                })
+                                            ]
+                                        })
+                                    ]
+                                })
                             })
                         })
                     })

package/dist/routes/create-sign-in-route.js

@@ -10,7 +10,8 @@ function createSignInRoute(path, { homeUrl } = {}) {
         validateSearch: (search)=>{
             const callbackUrl = resolveAdminCallbackPath(search.callbackUrl);
             return {
-                callbackUrl
+                callbackUrl,
+                reauthenticate: '1' === search.reauthenticate || 1 === search.reauthenticate || true === search.reauthenticate
             };
         },
         beforeLoad: async ()=>{
@@ -20,10 +21,11 @@ function createSignInRoute(path, { homeUrl } = {}) {
             };
         },
         component: function() {
-            const { callbackUrl } = Route.useSearch();
+            const { callbackUrl, reauthenticate } = Route.useSearch();
             const { activeLocale } = Route.useRouteContext();
             return /*#__PURE__*/ jsx(SignInPage, {
                 redirectTo: resolveAdminSignInRedirect(callbackUrl),
+                reauthenticate: reauthenticate,
                 activeLocale: activeLocale,
                 homeUrl: resolvedHomeUrl
             });

package/dist/server-fns/admin-account/change-password.d.ts

@@ -10,7 +10,9 @@ export interface ChangeAccountPasswordInput {
     currentPassword: string;
     newPassword: string;
 }
-export declare const changeAccountPassword: import("@tanstack/react-start").RequiredFetcher<undefined, (input: ChangeAccountPasswordInput) => ChangeAccountPasswordInput, Promise<{
+export declare const changeAccountPassword: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: ChangeAccountPasswordInput) => ChangeAccountPasswordInput, Promise<{
     id: string;
     vid: number;
     email: string;

package/dist/server-fns/admin-account/change-password.js

@@ -1,13 +1,19 @@
 import { createServerFn } from "@tanstack/react-start";
 import { changeAccountPasswordCommand } from "@byline/admin/admin-account";
-import { getAdminRequestContext } from "@byline/client/server";
+import { clearPreviewCookie, clearSessionCookies, getAdminRequestContext } from "@byline/client/server";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const changeAccountPassword = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const context = await getAdminRequestContext();
-    return changeAccountPasswordCommand(context, data, {
+    const account = await changeAccountPasswordCommand(context, data, {
         store: bylineCore().adminStore
     });
+    clearSessionCookies();
+    clearPreviewCookie();
+    return account;
 });
 export { changeAccountPassword };

package/dist/server-fns/admin-account/get.d.ts

@@ -11,7 +11,9 @@
  * status fields that the slim `CurrentAdminUser` on route context
  * doesn't carry.
  */
-export declare const getAccount: import("@tanstack/react-start").OptionalFetcher<undefined, (input?: Record<string, never>) => Record<string, never>, Promise<{
+export declare const getAccount: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input?: Record<string, never>) => Record<string, never>, Promise<{
     id: string;
     vid: number;
     email: string;

package/dist/server-fns/admin-account/get.js

@@ -2,9 +2,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { getAccountCommand } from "@byline/admin/admin-account";
 import { getAdminRequestContext } from "@byline/client/server";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const getAccount = createServerFn({
     method: 'GET'
-}).validator((input)=>input ?? {}).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input ?? {}).handler(async ({ data })=>{
     const context = await getAdminRequestContext();
     return getAccountCommand(context, data, {
         store: bylineCore().adminStore

package/dist/server-fns/admin-account/index.d.ts

@@ -14,8 +14,8 @@
  * actor is the target — none of these accept an `id`.
  */
 export type { AccountResponse } from '@byline/admin/admin-account';
-export { changeAccountPassword } from './change-password';
-export { getAccount } from './get';
-export { updateAccount } from './update';
-export type { ChangeAccountPasswordInput } from './change-password';
-export type { UpdateAccountInput } from './update';
+export { changeAccountPassword } from './change-password.js';
+export { getAccount } from './get.js';
+export { updateAccount } from './update.js';
+export type { ChangeAccountPasswordInput } from './change-password.js';
+export type { UpdateAccountInput } from './update.js';

package/dist/server-fns/admin-account/update.d.ts

@@ -14,7 +14,9 @@ export interface UpdateAccountInput {
         username?: string | null;
     };
 }
-export declare const updateAccount: import("@tanstack/react-start").RequiredFetcher<undefined, (input: UpdateAccountInput) => UpdateAccountInput, Promise<{
+export declare const updateAccount: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: UpdateAccountInput) => UpdateAccountInput, Promise<{
     id: string;
     vid: number;
     email: string;

package/dist/server-fns/admin-account/update.js

@@ -2,9 +2,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { updateAccountCommand } from "@byline/admin/admin-account";
 import { getAdminRequestContext } from "@byline/client/server";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const updateAccount = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const context = await getAdminRequestContext();
     return updateAccountCommand(context, data, {
         store: bylineCore().adminStore

package/dist/server-fns/admin-activity/get.d.ts

@@ -47,4 +47,6 @@ export interface SystemActivityResponse {
  * queries directly and is gated system-wide by `admin.activity.read` rather
  * than by any document's own read gate.
  */
-export declare const getSystemActivityLog: import("@tanstack/react-start").RequiredFetcher<undefined, (input: SystemActivitySearchParams) => SystemActivitySearchParams, Promise<SystemActivityResponse>>;
+export declare const getSystemActivityLog: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: SystemActivitySearchParams) => SystemActivitySearchParams, Promise<SystemActivityResponse>>;

package/dist/server-fns/admin-activity/get.js

@@ -3,10 +3,13 @@ import { assertAdminActor } from "@byline/admin";
 import { ADMIN_ACTIVITY_ABILITIES } from "@byline/admin/admin-activity";
 import { getAdminRequestContext } from "@byline/client/server";
 import { ERR_AUDIT_UNSUPPORTED, getLogger, getServerConfig } from "@byline/core";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 import { resolveActorLabels } from "../collections/actors.js";
 const getSystemActivityLog = createServerFn({
     method: 'GET'
-}).validator((input)=>input ?? {}).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input ?? {}).handler(async ({ data })=>{
     const context = await getAdminRequestContext();
     assertAdminActor(context, ADMIN_ACTIVITY_ABILITIES.read);
     const queries = getServerConfig().db.queries;

package/dist/server-fns/admin-permissions/get-role-abilities.d.ts

@@ -5,7 +5,9 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-export declare const getRoleAbilities: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const getRoleAbilities: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     id: string;
 }) => {
     id: string;

package/dist/server-fns/admin-permissions/get-role-abilities.js

@@ -2,9 +2,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { getRoleAbilitiesCommand } from "@byline/admin/admin-permissions";
 import { getAdminRequestContext } from "@byline/client/server";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const getRoleAbilities = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const context = await getAdminRequestContext();
     return getRoleAbilitiesCommand(context, data, {
         store: bylineCore().adminStore,

package/dist/server-fns/admin-permissions/index.d.ts

@@ -18,7 +18,7 @@
  * mounts on the admin-roles role detail page.
  */
 export type { AbilityDescriptorResponse, AbilityGroupResponse, AbilityHolderRole, AbilityHolderUser, GetRoleAbilitiesResponse, ListRegisteredAbilitiesResponse, SetRoleAbilitiesResponse, WhoHasAbilityResponse, } from '@byline/admin/admin-permissions';
-export { getRoleAbilities } from './get-role-abilities';
-export { listRegisteredAbilities } from './list-registered';
-export { type SetRoleAbilitiesInput, setRoleAbilities } from './set-role-abilities';
-export { whoHasAbility } from './who-has';
+export { getRoleAbilities } from './get-role-abilities.js';
+export { listRegisteredAbilities } from './list-registered.js';
+export { type SetRoleAbilitiesInput, setRoleAbilities } from './set-role-abilities.js';
+export { whoHasAbility } from './who-has.js';

package/dist/server-fns/admin-permissions/list-registered.d.ts

@@ -10,7 +10,9 @@
  * populated at init time by collection auto-registration plus
  * `registerAdminAbilities`. No DB read.
  */
-export declare const listRegisteredAbilities: import("@tanstack/react-start").OptionalFetcher<undefined, undefined, Promise<{
+export declare const listRegisteredAbilities: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], undefined, Promise<{
     abilities: {
         key: string;
         label: string;

package/dist/server-fns/admin-permissions/list-registered.js

@@ -2,9 +2,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { listRegisteredAbilitiesCommand } from "@byline/admin/admin-permissions";
 import { getAdminRequestContext } from "@byline/client/server";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const listRegisteredAbilities = createServerFn({
     method: 'GET'
-}).handler(async ()=>{
+}).middleware([
+    adminSessionMiddleware
+]).handler(async ()=>{
     const context = await getAdminRequestContext();
     return listRegisteredAbilitiesCommand(context, {}, {
         store: bylineCore().adminStore,

package/dist/server-fns/admin-permissions/set-role-abilities.d.ts

@@ -9,7 +9,9 @@ export interface SetRoleAbilitiesInput {
     id: string;
     abilities: string[];
 }
-export declare const setRoleAbilities: import("@tanstack/react-start").RequiredFetcher<undefined, (input: SetRoleAbilitiesInput) => SetRoleAbilitiesInput, Promise<{
+export declare const setRoleAbilities: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: SetRoleAbilitiesInput) => SetRoleAbilitiesInput, Promise<{
     roleId: string;
     abilities: string[];
 }>>;

package/dist/server-fns/admin-permissions/set-role-abilities.js

@@ -2,9 +2,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { setRoleAbilitiesCommand } from "@byline/admin/admin-permissions";
 import { getAdminRequestContext } from "@byline/client/server";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const setRoleAbilities = createServerFn({
     method: 'POST'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const context = await getAdminRequestContext();
     return setRoleAbilitiesCommand(context, data, {
         store: bylineCore().adminStore,

package/dist/server-fns/admin-permissions/who-has.d.ts

@@ -5,7 +5,9 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
-export declare const whoHasAbility: import("@tanstack/react-start").RequiredFetcher<undefined, (input: {
+export declare const whoHasAbility: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: {
     ability: string;
 }) => {
     ability: string;

package/dist/server-fns/admin-permissions/who-has.js

@@ -2,9 +2,12 @@ import { createServerFn } from "@tanstack/react-start";
 import { whoHasAbilityCommand } from "@byline/admin/admin-permissions";
 import { getAdminRequestContext } from "@byline/client/server";
 import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware } from "../../integrations/session-middleware.js";
 const whoHasAbility = createServerFn({
     method: 'GET'
-}).validator((input)=>input).handler(async ({ data })=>{
+}).middleware([
+    adminSessionMiddleware
+]).validator((input)=>input).handler(async ({ data })=>{
     const context = await getAdminRequestContext();
     return whoHasAbilityCommand(context, data, {
         store: bylineCore().adminStore,

package/dist/server-fns/admin-roles/create.d.ts

@@ -11,7 +11,9 @@ export interface CreateAdminRoleInput {
     description?: string | null;
     order?: number;
 }
-export declare const createAdminRole: import("@tanstack/react-start").RequiredFetcher<undefined, (input: CreateAdminRoleInput) => CreateAdminRoleInput, Promise<{
+export declare const createAdminRole: import("@tanstack/react-start").RequiredFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: CreateAdminRoleInput) => CreateAdminRoleInput, Promise<{
     id: string;
     vid: number;
     name: string;