@easy-cms/core 0.63.0 → 0.64.0

package/dist/{chunk-LN4M4BUP.js → chunk-JZW6G6XI.js}

@@ -33,8 +33,9 @@ import {
   typeFromName,
   uniqueWithinOf,
   warnDeprecated,
+  withCharset,
   withPrivacy
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
@@ -1015,6 +1016,21 @@ async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
 
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
+var hostCookie = (name) => `__Host-${name}`;
+function cookieValue(header, name) {
+  if (!header) return void 0;
+  let plain;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    const key = part.slice(0, eq).trim();
+    if (key !== name && key !== hostCookie(name)) continue;
+    const value = decodeURIComponent(part.slice(eq + 1).trim());
+    if (key !== name) return value;
+    plain ??= value;
+  }
+  return plain;
+}
 
 // src/auth/emails.ts
 var esc = (value) => value.replace(
@@ -1911,12 +1927,8 @@ var Auth = class {
   async userFromHeaders(headers) {
     const authorization = headers.get("authorization");
     if (authorization?.startsWith("Bearer ")) return this.verify(authorization.slice(7).trim());
-    for (const part of headers.get("cookie")?.split(";") ?? []) {
-      const eq = part.indexOf("=");
-      if (eq > 0 && part.slice(0, eq).trim() === SESSION_COOKIE)
-        return this.verify(decodeURIComponent(part.slice(eq + 1).trim()));
-    }
-    return null;
+    const cookie2 = cookieValue(headers.get("cookie"), SESSION_COOKIE);
+    return cookie2 ? this.verify(cookie2) : null;
   }
   /**
    * Returns the user for a signed session token, or for an API key (`ecms_…`, with `apiKey` set
@@ -6827,7 +6839,7 @@ var EasyCMS = class {
     const filename = withPrivacy(storageKey(file.name, mimeType, random2), isPrivate);
     const stored = [];
     try {
-      await storage.put(filename, file.data, { contentType: mimeType });
+      await storage.put(filename, file.data, { contentType: withCharset(mimeType) });
       stored.push(filename);
       const dimensions = imageDimensions(file.data, mimeType);
       const sizes = await this.resizeImage(
@@ -7173,7 +7185,7 @@ var EasyCMS = class {
     const old = [String(doc.filename)];
     const copy = async (source, target) => {
       const file = await from.get(source);
-      if (file) await to.put(target, file.body, { contentType });
+      if (file) await to.put(target, file.body, { contentType: withCharset(contentType) });
     };
     await copy(String(doc.filename), filename);
     const sizes = {};
@@ -9093,7 +9105,7 @@ async function readAdminModule(cms, index) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.63.0" : "0.0.0-dev";
+var VERSION = true ? "0.64.0" : "0.0.0-dev";
 
 // src/rest/admin-deliveries.ts
 var PER_PAGE = 50;
@@ -10029,7 +10041,8 @@ async function respond(cms, request, url, path, root, options, production) {
   const headers = new Headers({
     "content-type": "application/json; charset=utf-8",
     "cache-control": "no-store",
-    "x-content-type-options": "nosniff"
+    "x-content-type-options": "nosniff",
+    ...production ? { "strict-transport-security": "max-age=31536000" } : {}
   });
   try {
     if (path === null) throw new HttpError("Not found", 404);
@@ -10046,7 +10059,8 @@ async function respond(cms, request, url, path, root, options, production) {
       context,
       via: signedIn ? via : null,
       token,
-      headers
+      headers,
+      trustProxy: options.trustProxy === true
     };
     const method = request.method.toUpperCase();
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
@@ -10222,6 +10236,7 @@ async function route(cms, ctx, method, path, options) {
       case "POST logout": {
         if (ctx.token) await cms.auth.logout(ctx.token);
         clearSessionCookies(ctx);
+        ctx.headers.set("clear-site-data", '"cache"');
         return { body: { message: "Logged out" } };
       }
       case "GET me": {
@@ -10916,23 +10931,17 @@ function readToken(request) {
   return { token, via: token ? "cookie" : null };
 }
 function readCookie(request, name) {
-  const header = request.headers.get("cookie");
-  if (!header) return void 0;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq > 0 && part.slice(0, eq).trim() === name)
-      return decodeURIComponent(part.slice(eq + 1).trim());
-  }
-  return void 0;
+  return cookieValue(request.headers.get("cookie"), name);
 }
-function sameHost(origin, request) {
+function sameHost(origin, request, trustProxy) {
   let host;
   try {
     host = new URL(origin).host;
   } catch {
     return false;
   }
-  const forwarded = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const trusted = trustProxy || !!process.env.VERCEL || !!process.env.NETLIFY;
+  const forwarded = trusted ? request.headers.get("x-forwarded-host")?.split(",")[0]?.trim() : void 0;
   return host === (forwarded || request.headers.get("host"));
 }
 function checkCsrf(cms, ctx) {
@@ -10940,7 +10949,7 @@ function checkCsrf(cms, ctx) {
   const fetchSite = ctx.request.headers.get("sec-fetch-site");
   const cookie2 = ctx.via === "cookie" && ctx.token !== void 0;
   const { cors } = cms.config;
-  const trusted = origin !== null && (origin === ctx.url.origin || sameHost(origin, ctx.request) || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
+  const trusted = origin !== null && (origin === ctx.url.origin || sameHost(origin, ctx.request, ctx.trustProxy) || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
   if (origin !== null && !trusted) throw new ForbiddenError("CSRF check failed: untrusted origin");
   if (origin === null && fetchSite === "cross-site")
     throw new ForbiddenError("CSRF check failed: cross-site request");
@@ -10962,7 +10971,7 @@ async function serveFile(cms, key, head) {
   const file = await cms.storage.get(key);
   if (!file) throw new HttpError("Not found", 404);
   const extension = key.slice(key.lastIndexOf(".") + 1);
-  const type = TYPE_BY_EXTENSION[extension] ?? "application/octet-stream";
+  const type = withCharset(TYPE_BY_EXTENSION[extension] ?? "application/octet-stream");
   return new Response(
     head ? null : file.body,
     {
@@ -11005,7 +11014,9 @@ async function servePrivateFile(cms, ctx, key, head) {
   }
   const file = await cms.privateStorage.get(key);
   if (!file) throw new HttpError("Not found", 404);
-  const type = TYPE_BY_EXTENSION[key.slice(key.lastIndexOf(".") + 1)] ?? "application/octet-stream";
+  const type = withCharset(
+    TYPE_BY_EXTENSION[key.slice(key.lastIndexOf(".") + 1)] ?? "application/octet-stream"
+  );
   return new Response(
     head ? null : file.body,
     {
@@ -11116,9 +11127,14 @@ function isSecure(ctx) {
   return ctx.url.protocol === "https:" || process.env.NODE_ENV === "production";
 }
 function cookie(ctx, name, value, opts) {
-  const parts = [`${name}=${encodeURIComponent(value)}`, "Path=/", "SameSite=Lax"];
+  const secure = isSecure(ctx);
+  const parts = [
+    `${secure ? hostCookie(name) : name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    "SameSite=Lax"
+  ];
   if (opts.httpOnly) parts.push("HttpOnly");
-  if (isSecure(ctx)) parts.push("Secure");
+  if (secure) parts.push("Secure");
   if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
   return parts.join("; ");
 }
@@ -11197,6 +11213,9 @@ function setSessionCookies(cms, ctx, session) {
 function clearSessionCookies(ctx) {
   ctx.headers.append("set-cookie", cookie(ctx, SESSION_COOKIE, "", { httpOnly: true, maxAge: 0 }));
   ctx.headers.append("set-cookie", cookie(ctx, CSRF_COOKIE, "", { httpOnly: false, maxAge: 0 }));
+  if (isSecure(ctx))
+    for (const name of [SESSION_COOKIE, CSRF_COOKIE])
+      ctx.headers.append("set-cookie", `${name}=; Path=/; Max-Age=0; Secure; SameSite=Lax`);
 }
 function errorResponse(cms, error, headers, production) {
   if (error instanceof EasyCMSError) {
@@ -11262,6 +11281,7 @@ function createApiHandler(config, options = {}) {
     if (!handler) {
       handler = createRestHandler(cms, {
         getClientIp,
+        trustProxy: options.trustProxy === true,
         ...options.basePath ? { basePath: options.basePath } : {}
       });
       handlers.set(cms, handler);

package/dist/{chunk-FPFWLQB5.js → chunk-RTKWMVAC.js}

@@ -271,6 +271,12 @@ function sizeKey(filename, size) {
   return filename.replace(/\.([^.]+)$/, `-${size}.$1`);
 }
 var PRIVATE_KEY = /^[\p{L}\p{M}\p{N}-]+\.private(-[\p{L}\p{N}_-]+)?\.[a-z0-9]+$/u;
+function withCharset(type) {
+  if (/;\s*charset=/i.test(type)) return type;
+  const base = type.split(";")[0]?.trim().toLowerCase() ?? "";
+  const text = base.startsWith("text/") || /^application\/(json|xml|javascript|ecmascript)$/.test(base) || /\+(json|xml)$/.test(base);
+  return text ? `${type}; charset=utf-8` : type;
+}
 
 // src/fields.ts
 var uniqueWithinOf = (field) => field.uniqueWithin === void 0 ? [] : [field.uniqueWithin].flat();
@@ -534,6 +540,7 @@ export {
   withPrivacy,
   sizeKey,
   PRIVATE_KEY,
+  withCharset,
   uniqueWithinOf,
   isHasMany,
   mimeAllowedBy,

package/dist/{handler-CcQjkj5Q.d.ts → handler-CcmsrLs8.d.ts}

@@ -172,6 +172,11 @@ interface RestHandlerOptions {
     readonly basePath?: string;
     /** Client IP, used with the email to rate-limit logins. Adapters provide it. */
     readonly getClientIp?: (request: Request) => string | undefined;
+    /**
+     * Behind a reverse proxy you control: its `X-Forwarded-Host` names the public host (for the
+     * CSRF check of a request's Origin). Vercel and Netlify are recognized without it.
+     */
+    readonly trustProxy?: boolean;
 }
 type RestHandler = (request: Request) => Promise<Response>;
 /** Creates the REST API as a Web-standard `(Request) => Response` handler. */
@@ -183,6 +188,7 @@ declare function createRestHandler<C extends Config>(instance: EasyCMS<C>, optio
  * use it; the standalone server does.
  */
 declare function createRootEndpointHandler<C extends Config>(instance: EasyCMS<C>, options?: Pick<RestHandlerOptions, 'getClientIp'>): (request: Request) => Promise<Response | undefined>;
+/** A cookie of the request; the `__Host-` one (set over HTTPS) first. */
 declare function readCookie(request: Request, name: string): string | undefined;
 
 export { type AdminBackup as A, type BackupState as B, CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, validateFields as E, writeBackupFile as F, type LoadConfigOptions as L, type RestHandler as R, type AdminBackups as a, type ApiHandlerOptions as b, type RestHandlerOptions as c, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, fillMissing as p, findConfigFile as q, resolveConfig as r, sharedEasyCMS as s, forwardedClientIp as t, generateSlugs as u, importConfig as v, mergeForUpdate as w, parseId as x, platformClientIp as y, readCookie as z };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-Dgs6FE0S.js';
 export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
 export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CcQjkj5Q.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CcmsrLs8.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-LN4M4BUP.js";
+} from "./chunk-JZW6G6XI.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -48,7 +48,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 export {
   ADAPTER_API_VERSION,
   ADMIN_API_VERSION,

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-Dgs6FE0S.js';
 export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CcQjkj5Q.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CcmsrLs8.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -52,7 +52,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-LN4M4BUP.js";
+} from "./chunk-JZW6G6XI.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -70,7 +70,7 @@ import {
   rowFields,
   sniffMimeType,
   uniqueWithinOf
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 
 // src/typegen.ts
 var pascal = (name) => name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");

package/dist/plugin.js

@@ -16,7 +16,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 export {
   ADMIN_API_VERSION,
   ADMIN_ICONS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",