@byline/host-tanstack-start 6.7.2 → 6.9.0

package/dist/server-fns/auth/passkeys.js

@@ -0,0 +1,238 @@
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest, setResponseHeader } from "@tanstack/react-start/server";
+import { ERR_SESSION_CHANGED, ERR_UNAUTHENTICATED, isAdminAuth } from "@byline/auth";
+import { clearPreviewCookie, clearSessionCookies, getAdminRequestContext, readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
+import { getServerConfig } from "@byline/core";
+import { z } from "zod";
+import { bylineCore } from "../../integrations/byline-core.js";
+import { adminSessionMiddleware, adminSessionMutationMiddleware } from "../../integrations/session-middleware.js";
+import { wasPasskeyBodyChecked } from "../../integrations/sign-in-body.js";
+import { withPasskeyAdmission } from "./passkey-admission.js";
+import { reconcileLocaleAfterSignIn } from "./reconcile-locale.js";
+const session = z.object({
+    expectedSessionId: z.uuid()
+});
+const bearer = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+const action = z.discriminatedUnion('purpose', [
+    z.object({
+        purpose: z.literal('enroll')
+    }).strict(),
+    z.object({
+        purpose: z.literal('remove'),
+        targetUserId: z.uuid(),
+        credentialRecordId: z.uuid()
+    }).strict()
+]);
+const passkeys_name = z.string().trim().min(1).max(80);
+function validate(schema) {
+    return (input)=>{
+        const parsed = schema.safeParse(input);
+        if (!parsed.success) throw new Response('Invalid passkey input', {
+            status: 400,
+            headers: {
+                'Cache-Control': 'no-store'
+            }
+        });
+        return parsed.data;
+    };
+}
+function configuredProvider() {
+    setResponseHeader('Cache-Control', 'no-store');
+    const config = getServerConfig();
+    const provider = config.sessionProvider;
+    if (!config.passkeys || provider?.capabilities?.passkeys !== true || !provider.passkeys) throw new Response('Passkeys are not enabled', {
+        status: 404,
+        headers: {
+            'Cache-Control': 'no-store'
+        }
+    });
+    return provider.passkeys;
+}
+async function currentSession(expectedSessionId) {
+    const auth = await getAdminRequestContext();
+    if (auth.sessionId !== expectedSessionId) throw ERR_SESSION_CHANGED({
+        message: 'session changed before passkey operation'
+    });
+    const accessToken = readAccessTokenCookie();
+    if (!accessToken) throw ERR_UNAUTHENTICATED({
+        message: 'access credential missing'
+    });
+    return {
+        accessToken,
+        expectedSessionId
+    };
+}
+function admitted(purpose, work, expectedSessionId) {
+    const provider = configuredProvider();
+    const config = getServerConfig();
+    const request = getRequest();
+    return withPasskeyAdmission({
+        provider,
+        purpose,
+        request,
+        bodyChecked: wasPasskeyBodyChecked(request, 'password-proof' === purpose),
+        protection: config.passkeyRequests,
+        ...'password-proof' === purpose ? {
+            password: {
+                protection: config.passwordSignIn,
+                resolveActorEmail: async ()=>{
+                    const auth = await getAdminRequestContext();
+                    if (!auth.actor || !expectedSessionId || auth.sessionId !== expectedSessionId) throw ERR_SESSION_CHANGED({
+                        message: 'session changed before password proof'
+                    });
+                    const user = await bylineCore().adminStore?.adminUsers.getById(auth.actor.id);
+                    if (!user) throw ERR_UNAUTHENTICATED({
+                        message: 'account unavailable'
+                    });
+                    return user.email;
+                }
+            }
+        } : {},
+        work: ({ ip })=>work(provider, {
+                ip,
+                userAgent: request.headers.get('user-agent')?.slice(0, 512)
+            })
+    });
+}
+const getPasskeyCapability = createServerFn({
+    method: 'GET'
+}).handler(async ()=>{
+    setResponseHeader('Cache-Control', 'no-store');
+    const config = getServerConfig();
+    return {
+        enabled: !!(config.passkeys && config.sessionProvider?.capabilities?.passkeys && config.sessionProvider.passkeys)
+    };
+});
+const passkeySignInOptions = createServerFn({
+    method: 'POST'
+}).validator(validate(z.object({}).strict())).handler(async ()=>admitted('sign-in-options', (provider, metadata)=>provider.signInOptions(metadata)));
+const passkeySignIn = createServerFn({
+    method: 'POST'
+}).validator(validate(z.object({
+    ceremonyId: bearer,
+    response: z.unknown()
+}).strict())).handler(async ({ data })=>admitted('sign-in', async (provider, metadata)=>{
+        const result = await provider.verifySignIn({
+            ...data,
+            ...metadata,
+            previousAccessToken: readAccessTokenCookie(),
+            previousRefreshToken: readRefreshTokenCookie()
+        });
+        setSessionCookies(result);
+        try {
+            await reconcileLocaleAfterSignIn(result.actor.id);
+        } catch  {}
+        return {
+            userId: result.actor.id,
+            sessionId: result.sessionId
+        };
+    }));
+const passkeyPasswordProof = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    password: z.string().min(1).max(128),
+    action: action
+}).strict())).handler(async ({ data })=>admitted('password-proof', async (provider)=>provider.passwordProof({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        }), data.expectedSessionId));
+const passkeyProofOptions = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    action: action
+}).strict())).handler(async ({ data })=>admitted('proof-options', async (provider)=>provider.proofOptions({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyProof = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    ceremonyId: bearer,
+    response: z.unknown()
+}).strict())).handler(async ({ data })=>admitted('proof', async (provider)=>provider.verifyProof({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyEnrollmentOptions = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    grantId: bearer
+}).strict())).handler(async ({ data })=>admitted('enrollment-options', async (provider)=>provider.enrollmentOptions({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyEnrollment = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    ceremonyId: bearer,
+    response: z.unknown(),
+    name: passkeys_name
+}).strict())).handler(async ({ data })=>admitted('enrollment', async (provider)=>provider.verifyEnrollment({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyList = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    targetUserId: z.uuid().optional()
+}).strict())).handler(async ({ data })=>admitted('list', async (provider)=>provider.listCredentials({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyRename = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.extend({
+    credentialRecordId: z.uuid(),
+    name: passkeys_name
+}).strict())).handler(async ({ data })=>admitted('rename', async (provider)=>provider.renameCredential({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        })));
+const passkeyRemove = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMutationMiddleware
+]).validator(validate(session.extend({
+    grantId: bearer
+}).strict())).handler(async ({ data })=>admitted('remove', async (provider)=>{
+        const result = await provider.removeCredential({
+            ...data,
+            ...await currentSession(data.expectedSessionId)
+        });
+        if (result.signedOut) {
+            clearSessionCookies();
+            clearPreviewCookie();
+        }
+        return result;
+    }));
+const passkeyManagementContext = createServerFn({
+    method: 'POST'
+}).middleware([
+    adminSessionMiddleware
+]).validator(validate(session.strict())).handler(async ({ data })=>admitted('list', async ()=>{
+        await currentSession(data.expectedSessionId);
+        const { actor } = await getAdminRequestContext();
+        if (!isAdminAuth(actor)) throw ERR_UNAUTHENTICATED({
+            message: 'admin login required'
+        });
+        return {
+            id: actor.id,
+            isSuperAdmin: actor.isSuperAdmin,
+            canManagePasskeys: actor.hasAbility('admin.users.managePasskeys')
+        };
+    }));
+export { getPasskeyCapability, passkeyEnrollment, passkeyEnrollmentOptions, passkeyList, passkeyManagementContext, passkeyPasswordProof, passkeyProof, passkeyProofOptions, passkeyRemove, passkeyRename, passkeySignIn, passkeySignInOptions };

package/dist/server-fns/auth/reconcile-locale.d.ts

@@ -0,0 +1,20 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Apply the `byline_admin_lng` cookie to `admin_users.preferred_locale`
+ * when the two diverge after sign-in. No-op when:
+ *
+ *   - The cookie is unset (the cascade falls through to the existing
+ *     column / Accept-Language / default anyway).
+ *   - The cookie carries a locale outside `i18n.admin.locales`
+ *     (stale value pointing at a removed locale — let the resolver
+ *     fall through cleanly).
+ *   - No admin store is configured (headless tooling paths).
+ *   - The stored value already matches the cookie.
+ */
+export declare function reconcileLocaleAfterSignIn(adminUserId: string): Promise<void>;

package/dist/server-fns/auth/reconcile-locale.js

@@ -0,0 +1,16 @@
+import { readAdminLocaleCookie } from "../../i18n/locale-cookie.js";
+import { bylineCore } from "../../integrations/byline-core.js";
+async function reconcileLocaleAfterSignIn(adminUserId) {
+    const cookieLocale = readAdminLocaleCookie();
+    if (null == cookieLocale) return;
+    const core = bylineCore();
+    const locales = core.config.i18n.admin.locales;
+    if (!locales.includes(cookieLocale)) return;
+    const adminStore = core.adminStore;
+    if (null == adminStore) return;
+    const row = await adminStore.adminUsers.getById(adminUserId);
+    if (!row) return;
+    if (row.preferred_locale === cookieLocale) return;
+    await adminStore.adminUsers.setPreferredLocale(adminUserId, cookieLocale);
+}
+export { reconcileLocaleAfterSignIn };

package/dist/server-fns/auth/sign-in.js

@@ -3,10 +3,9 @@ import { getRequest, getRequestHeader } from "@tanstack/react-start/server";
 import { readAccessTokenCookie, readRefreshTokenCookie, setSessionCookies } from "@byline/client/server";
 import { getServerConfig } from "@byline/core";
 import { passwordSignInSchema } from "@byline/core/validation";
-import { readAdminLocaleCookie } from "../../i18n/locale-cookie.js";
-import { bylineCore } from "../../integrations/byline-core.js";
 import { normalizeClientIp } from "../../integrations/client-ip.js";
 import { wasSignInBodyChecked } from "../../integrations/sign-in-body.js";
+import { reconcileLocaleAfterSignIn } from "./reconcile-locale.js";
 const adminSignIn = createServerFn({
     method: 'POST'
 }).validator((input)=>{
@@ -104,17 +103,4 @@ const adminSignIn = createServerFn({
         sessionId: result.sessionId
     };
 });
-async function reconcileLocaleAfterSignIn(adminUserId) {
-    const cookieLocale = readAdminLocaleCookie();
-    if (null == cookieLocale) return;
-    const core = bylineCore();
-    const locales = core.config.i18n.admin.locales;
-    if (!locales.includes(cookieLocale)) return;
-    const adminStore = core.adminStore;
-    if (null == adminStore) return;
-    const row = await adminStore.adminUsers.getById(adminUserId);
-    if (!row) return;
-    if (row.preferred_locale === cookieLocale) return;
-    await adminStore.adminUsers.setPreferredLocale(adminUserId, cookieLocale);
-}
 export { adminSignIn };

package/dist/server-fns/collections/get.d.ts

@@ -18,6 +18,7 @@
 export declare function getCollectionDocument(collection: string, id: string, locale?: string, depth?: number, populateRelations?: boolean): Promise<{
     revision: number;
     _publishedVersion: Record<string, any> | null;
+    _unavailableBlocks?: import("@byline/core").UnavailableBlock[] | undefined;
     _restoreWarnings?: string[] | undefined;
     availableLocales?: string[] | undefined;
     _availableVersionLocales?: string[] | undefined;

package/dist/server-fns/collections/get.js

@@ -57,6 +57,7 @@ const getDocumentFn = createServerFn({
         }) : null;
     }
     const restoreWarnings = serialised._restoreWarnings;
+    const unavailableBlocks = document._unavailableBlocks;
     const availableLocales = serialised.availableLocales;
     const availableVersionLocales = serialised._availableVersionLocales;
     const scheduledPublicationEnabled = getServerConfig().scheduledPublication?.enabled === true;
@@ -71,6 +72,9 @@ const getDocumentFn = createServerFn({
     return {
         ...withEditableRevision(parsed, document),
         _publishedVersion: publishedVersion,
+        ...unavailableBlocks?.length ? {
+            _unavailableBlocks: unavailableBlocks
+        } : {},
         ...restoreWarnings && restoreWarnings.length > 0 ? {
             _restoreWarnings: restoreWarnings
         } : {},

package/package.json

@@ -3,9 +3,9 @@
   "private": false,
   "type": "module",
   "license": "MPL-2.0",
-  "version": "6.7.2",
+  "version": "6.9.0",
   "engines": {
-    "node": ">=20.9.0"
+    "node": ">=22.22.2"
   },
   "description": "TanStack Start host adapter for Byline CMS — server fns, auth context, integration glue, admin shell, and route factories",
   "keywords": [
@@ -119,15 +119,15 @@
     }
   },
   "dependencies": {
-    "@byline/admin": "6.7.2",
-    "@byline/ai": "6.7.2",
-    "@byline/analytics": "6.7.2",
-    "@byline/analytics-agent": "6.7.2",
-    "@byline/auth": "6.7.2",
-    "@byline/client": "6.7.2",
-    "@byline/core": "6.7.2",
-    "@byline/i18n": "6.7.2",
-    "@byline/ui": "6.7.2",
+    "@byline/admin": "6.9.0",
+    "@byline/ai": "6.9.0",
+    "@byline/analytics": "6.9.0",
+    "@byline/analytics-agent": "6.9.0",
+    "@byline/auth": "6.9.0",
+    "@byline/client": "6.9.0",
+    "@byline/core": "6.9.0",
+    "@byline/i18n": "6.9.0",
+    "@byline/ui": "6.9.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "clsx": "^2.1.1",

package/src/admin-shell/admin-roles/container.module.css

@@ -17,7 +17,7 @@
 :global(.byline-role-detail-card) {
   margin-bottom: 1.5rem;
   border: var(--border-width-thin) var(--border-style-solid) var(--gray-100);
-  border-radius: 0.125rem;
+  border-radius: var(--border-radius-sm);
   background-color: var(--canvas-25);
   padding: 1rem;
 }

package/src/admin-shell/admin-roles/delete.tsx

@@ -88,7 +88,7 @@ export function DeleteRole({ role, onClose }: DeleteRoleProps) {
       <div className={cx('byline-role-delete-actions', styles.actions)}>
         <Button
           type="button"
-          intent="secondary"
+          intent="noeffect"
           size="sm"
           onClick={onClose}
           disabled={pending}

package/src/admin-shell/admin-users/container.module.css

@@ -18,6 +18,7 @@
  *   .byline-admin-user-drawer-body    — drawer content container
  *   .byline-admin-user-drawer-scroll  — drawer scrollable inner viewport
  *   .byline-admin-user-modal          — modal container sizing
+ *   .byline-admin-user-account-link   — own-account link in the Passkeys card
  *   .byline-admin-user-modal-head     — modal header row
  */
 
@@ -50,7 +51,7 @@
   border: var(--border-width-thin) var(--border-style-solid) var(--gray-100);
   background-color: var(--canvas-25);
   padding: 1rem;
-  border-radius: 0.125rem;
+  border-radius: var(--border-radius-sm);
 }
 
 :is([data-theme="dark"], :global(.dark)) .section,
@@ -197,3 +198,8 @@
   justify-content: space-between;
   margin-bottom: 1rem;
 }
+
+.accountLink,
+:global(.byline-admin-user-account-link) {
+  text-decoration: underline;
+}

package/src/admin-shell/admin-users/container.tsx

@@ -15,6 +15,7 @@ import { useRouter } from '@tanstack/react-router'
 import { UserRoles } from '@byline/admin/admin-users/components/roles'
 import { SetPassword } from '@byline/admin/admin-users/components/set-password'
 import { UpdateUser } from '@byline/admin/admin-users/components/update'
+import { PasskeyManager } from '@byline/admin/auth/components/passkey-manager'
 import { LocalDateTime } from '@byline/admin/react'
 import { useTranslation } from '@byline/i18n/react'
 import {
@@ -28,6 +29,8 @@ import {
 } from '@byline/ui/react'
 import cx from 'clsx'
 
+import { getAdminRoutePath } from '../../routes/admin-path.js'
+import { Link } from '../chrome/loose-router.js'
 import styles from './container.module.css'
 import { DeleteUser } from './delete.js'
 import type { AdminRoleResponse } from '../../server-fns/admin-roles/index.js'
@@ -266,9 +269,7 @@ export function AccountContainer({ user, allRoles, initialUserRoles }: AccountCo
               </p>
             </div>
           </ContainerSection>
-        </div>
 
-        <div className={cx('byline-admin-user-column', styles.column)}>
           <ContainerSection
             title={t('adminUsers.detail.sections.roles')}
             onEdit={openDrawer('roles')}
@@ -289,7 +290,9 @@ export function AccountContainer({ user, allRoles, initialUserRoles }: AccountCo
               {t('adminUsers.detail.editRolesButton')}
             </Button>
           </ContainerSection>
+        </div>
 
+        <div className={cx('byline-admin-user-column', styles.column)}>
           <ContainerSection
             title={t('adminUsers.detail.sections.password')}
             onEdit={openDrawer('set_password')}
@@ -303,6 +306,23 @@ export function AccountContainer({ user, allRoles, initialUserRoles }: AccountCo
             </Button>
           </ContainerSection>
 
+          <PasskeyManager
+            targetUserId={currentUser.id}
+            targetIsSuperAdmin={currentUser.is_super_admin}
+            section={ContainerSection}
+            ownAccountNotice={
+              <p className={cx('byline-admin-user-line-spaced', styles.lineSpaced)}>
+                {t('adminUsers.detail.passkeys.ownAccount')}{' '}
+                <Link
+                  to={getAdminRoutePath('account')}
+                  className={cx('byline-admin-user-account-link', styles.accountLink)}
+                >
+                  {t('adminUsers.detail.passkeys.openAccount')}
+                </Link>
+              </p>
+            }
+          />
+
           <ContainerSection title={t('adminUsers.detail.sections.delete')}>
             <p className={cx('byline-admin-user-line-spaced', styles.lineSpaced)}>
               {t('adminUsers.detail.delete.intro')}

package/src/admin-shell/admin-users/delete.tsx

@@ -100,7 +100,7 @@ export function DeleteUser({ user, onClose }: DeleteUserProps) {
       <div className={cx('byline-admin-user-delete-actions', styles.actions)}>
         <Button
           type="button"
-          intent="secondary"
+          intent="noeffect"
           size="sm"
           onClick={onClose}
           disabled={pending}

package/src/admin-shell/chrome/admin-app-bar.tsx

@@ -1,3 +1,5 @@
+'use client'
+
 /**
  * This Source Code is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -20,8 +22,6 @@ import { Branding } from './branding.js'
 import { Breadcrumbs } from './breadcrumbs/breadcrumbs.js'
 import { useBreadcrumbs } from './breadcrumbs/breadcrumbs-provider.js'
 
-;('use client')
-
 interface AdminAppBarProps {
   user: CurrentAdminUser
 }

package/src/admin-shell/chrome/dashboard.test.tsx

@@ -129,8 +129,8 @@ describe('AdminDashboard document resources', () => {
       routes: { admin: '/internal/cms' },
       collections: [articles, settings],
       admin: [
-        { slug: articles.path, group: 'content' },
-        { singleton: true, slug: settings.path, group: 'content' },
+        { path: articles.path, group: 'content' },
+        { singleton: true, path: settings.path, group: 'content' },
       ],
       collectionGroups: [{ name: 'content', label: 'Content' }],
       i18n: {