@drawnagency/primitives 0.1.52 → 0.1.54

package/dist/auth/cookies.d.ts

@@ -2,7 +2,10 @@ import type { Session, CookieLike } from "./types";
 export declare const SESSION_COOKIE = "bp-session";
 export declare const AUDIENCE_COOKIE = "bp-audience";
 export declare const SESSION_MAX_AGE_SECONDS: number;
+export declare const AUDIENCE_MAX_AGE_SECONDS: number;
 export declare function signSessionToken(session: Session): Promise<string>;
 export declare function verifySessionToken(token: string): Promise<Session | null>;
+export declare function signAudienceToken(audience: string): Promise<string>;
+export declare function verifyAudienceToken(token: string): Promise<string | null>;
 export declare function setSessionCookie(cookies: CookieLike, token: string, isProduction: boolean): void;
 //# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGnD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAe,CAAC;AAEpD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAe/E;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,GACpB,IAAI,CAQN"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGnD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAe,CAAC;AACpD,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAe/E;AAMD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzE;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS/E;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,GACpB,IAAI,CAQN"}

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
 export type { Role, Session, SiteUser, Audience, SignInMethod, SignInResult, TokenExchangeType, TokenExchangeResult, AuthProvider, CookieLike, AuthContext, } from "./types";
 export { requireSessionSecret, isSameOriginRequest, safeNextPath } from "./security";
-export { signSessionToken, verifySessionToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS } from "./cookies";
+export { signSessionToken, verifySessionToken, signAudienceToken, verifyAudienceToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS, AUDIENCE_MAX_AGE_SECONDS } from "./cookies";
 export { LastOwnerError } from "./errors";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC7I,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAC/M,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}

package/dist/auth/index.js

@@ -1,12 +1,15 @@
 import {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   LastOwnerError,
   SESSION_COOKIE,
   SESSION_MAX_AGE_SECONDS,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
+  verifyAudienceToken,
   verifySessionToken
-} from "../chunk-YEOGH3QH.js";
+} from "../chunk-PIKI3HUP.js";
 import {
   isSameOriginRequest,
   requireSessionSecret,
@@ -15,6 +18,7 @@ import {
 import "../chunk-WKZ7OENC.js";
 export {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   LastOwnerError,
   SESSION_COOKIE,
   SESSION_MAX_AGE_SECONDS,
@@ -22,6 +26,8 @@ export {
   requireSessionSecret,
   safeNextPath,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
+  verifyAudienceToken,
   verifySessionToken
 };

package/dist/{chunk-YEOGH3QH.js → chunk-PIKI3HUP.js}

@@ -7,6 +7,7 @@ import * as jose from "jose";
 var SESSION_COOKIE = "bp-session";
 var AUDIENCE_COOKIE = "bp-audience";
 var SESSION_MAX_AGE_SECONDS = 60 * 60 * 24;
+var AUDIENCE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
 async function signSessionToken(session) {
   return new jose.SignJWT({
     userId: session.userId,
@@ -31,6 +32,19 @@ async function verifySessionToken(token) {
     return null;
   }
 }
+async function signAudienceToken(audience) {
+  return new jose.SignJWT({ audience }).setProtectedHeader({ alg: "HS256" }).setExpirationTime(`${AUDIENCE_MAX_AGE_SECONDS}s`).setIssuedAt().sign(requireSessionSecret());
+}
+async function verifyAudienceToken(token) {
+  const secret = requireSessionSecret();
+  try {
+    const { payload } = await jose.jwtVerify(token, secret);
+    const audience = payload.audience;
+    return typeof audience === "string" && audience !== "" ? audience : null;
+  } catch {
+    return null;
+  }
+}
 function setSessionCookie(cookies, token, isProduction) {
   cookies.set(SESSION_COOKIE, token, {
     httpOnly: true,
@@ -53,8 +67,11 @@ export {
   SESSION_COOKIE,
   AUDIENCE_COOKIE,
   SESSION_MAX_AGE_SECONDS,
+  AUDIENCE_MAX_AGE_SECONDS,
   signSessionToken,
   verifySessionToken,
+  signAudienceToken,
+  verifyAudienceToken,
   setSessionCookie,
   LastOwnerError
 };

package/dist/components/shell/EditorShell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EditorShell.d.ts","sourceRoot":"","sources":["../../../src/components/shell/EditorShell.tsx"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgEjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQxD,UAAU,KAAK;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,YAAY,EAAE;QACZ,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,EAAE,OAAO,CAAC;QACvB,YAAY,EAAE,OAAO,CAAC;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,EAClC,OAAO,EACP,MAAM,EACN,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EACZ,WAAW,GACZ,EAAE,KAAK,2CA22BP"}
+{"version":3,"file":"EditorShell.d.ts","sourceRoot":"","sources":["../../../src/components/shell/EditorShell.tsx"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAgEjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQxD,UAAU,KAAK;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,YAAY,EAAE;QACZ,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,EAAE,OAAO,CAAC;QACvB,YAAY,EAAE,OAAO,CAAC;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,EAClC,OAAO,EACP,MAAM,EACN,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EACZ,WAAW,GACZ,EAAE,KAAK,2CA22BP"}

package/dist/index.js

@@ -61,13 +61,16 @@ import {
 } from "./chunk-24SUF2BC.js";
 import {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   LastOwnerError,
   SESSION_COOKIE,
   SESSION_MAX_AGE_SECONDS,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
+  verifyAudienceToken,
   verifySessionToken
-} from "./chunk-YEOGH3QH.js";
+} from "./chunk-PIKI3HUP.js";
 import {
   isSameOriginRequest,
   requireSessionSecret,
@@ -100,6 +103,7 @@ import {
 } from "./chunk-DKOUFIP6.js";
 export {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   AudienceColorSchema,
   AudienceNameSchema,
   AudienceSchema,
@@ -177,8 +181,10 @@ export {
   sanitizeMediaName,
   setMediaProvider,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
   slugifyAudienceName,
   toSectionId,
+  verifyAudienceToken,
   verifySessionToken
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawnagency/primitives",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",
@@ -56,6 +56,7 @@
   },
   "dependencies": {
     "@atlaskit/pragmatic-drag-and-drop": "^1.7.10",
+    "@atlaskit/pragmatic-drag-and-drop-auto-scroll": "^2.1.5",
     "@atlaskit/pragmatic-drag-and-drop-hitbox": "^1.1.0",
     "@tiptap/core": "^3.20.4",
     "@tiptap/extension-link": "^3.20.4",

package/src/auth/cookies.ts

@@ -5,6 +5,7 @@ import { requireSessionSecret } from "./security";
 export const SESSION_COOKIE = "bp-session";
 export const AUDIENCE_COOKIE = "bp-audience";
 export const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24;
+export const AUDIENCE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
 
 export async function signSessionToken(session: Session): Promise<string> {
   return new jose.SignJWT({
@@ -36,6 +37,29 @@ export async function verifySessionToken(token: string): Promise<Session | null>
   }
 }
 
+// The audience cookie must be unforgeable: middleware trusts its value to gate
+// viewer content, so it carries a signed JWT, not a plaintext audience name.
+// SESSION_SECRET is generated per-site by the provisioner, so the signature
+// alone also prevents cross-site replay — no siteId claim needed.
+export async function signAudienceToken(audience: string): Promise<string> {
+  return new jose.SignJWT({ audience })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime(`${AUDIENCE_MAX_AGE_SECONDS}s`)
+    .setIssuedAt()
+    .sign(requireSessionSecret());
+}
+
+export async function verifyAudienceToken(token: string): Promise<string | null> {
+  const secret = requireSessionSecret(); // throws on misconfiguration, before try
+  try {
+    const { payload } = await jose.jwtVerify(token, secret);
+    const audience = payload.audience;
+    return typeof audience === "string" && audience !== "" ? audience : null;
+  } catch {
+    return null;
+  }
+}
+
 export function setSessionCookie(
   cookies: CookieLike,
   token: string,

package/src/auth/index.ts

@@ -13,5 +13,5 @@ export type {
 } from "./types";
 
 export { requireSessionSecret, isSameOriginRequest, safeNextPath } from "./security";
-export { signSessionToken, verifySessionToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS } from "./cookies";
+export { signSessionToken, verifySessionToken, signAudienceToken, verifyAudienceToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS, AUDIENCE_MAX_AGE_SECONDS } from "./cookies";
 export { LastOwnerError } from "./errors";

package/src/components/shell/EditorShell.tsx

@@ -1,6 +1,8 @@
 import { Fragment, useState, useCallback, useEffect, useRef, useMemo, type ReactNode } from "react";
 
 import { monitorForElements } from "@atlaskit/pragmatic-drag-and-drop/element/adapter";
+import { combine } from "@atlaskit/pragmatic-drag-and-drop/combine";
+import { autoScrollWindowForElements } from "@atlaskit/pragmatic-drag-and-drop-auto-scroll/element";
 import type { LoadedSection } from "../../lib/loader";
 import type { SectionContent } from "../../schemas/sections";
 import type { SiteIndex, SiteConfig, Page } from "../../schemas/site-config";
@@ -1151,13 +1153,20 @@ function EditorContent({
     : sections;
 
   useEffect(() => {
-    return monitorForElements({
-      onDragStart: ({ source }) => {
-        if (source.data.dragType === "section") {
-          setPendingInsertIndex(null);
-        }
-      },
-    });
+    return combine(
+      monitorForElements({
+        onDragStart: ({ source }) => {
+          if (source.data.dragType === "section") {
+            setPendingInsertIndex(null);
+          }
+        },
+      }),
+      // Gradually scroll the window when a section drag nears the viewport
+      // edge, so long reorders don't require repeated drag-and-release
+      autoScrollWindowForElements({
+        canScroll: ({ source }) => source.data.dragType === "section",
+      }),
+    );
   }, []);
 
   return (