npm - @getstrata/core - Versions diffs - 0.5.100 → 0.7.3 - Mend

@getstrata/core 0.5.100 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (65) hide show

package/CHANGELOG.md +67 -32
package/README.md +16 -35
package/dist/core/auth/abilityCatalog.d.ts +2 -2
package/dist/core/auth/basicAuthGuard.d.ts +9 -0
package/dist/core/auth/guard.d.ts +6 -0
package/dist/core/auth/jwt.d.ts +19 -0
package/dist/core/auth/jwtGuard.d.ts +14 -0
package/dist/core/auth/tokenAbilityChecker.d.ts +5 -0
package/dist/core/cache/tags.d.ts +6 -0
package/dist/core/contracts/authUserDirectory.d.ts +4 -0
package/dist/core/database/baseRepository.d.ts +5 -1
package/dist/core/database/dialect.d.ts +18 -0
package/dist/core/database/factory.d.ts +1 -0
package/dist/core/database/index.d.ts +11 -3
package/dist/core/database/model.d.ts +21 -2
package/dist/core/database/mysqlConnection.d.ts +12 -0
package/dist/core/database/namedConnections.d.ts +15 -0
package/dist/core/database/relationQuery.d.ts +22 -3
package/dist/core/database/relationships.d.ts +22 -2
package/dist/core/database/repositoryQuery.d.ts +5 -1
package/dist/core/database/sqliteConnection.d.ts +7 -0
package/dist/core/http/loginThrottleMiddleware.d.ts +5 -2
package/dist/core/http/resources.d.ts +2 -2
package/dist/core/http/response.d.ts +2 -1
package/dist/core/http/statelessAuth.d.ts +8 -0
package/dist/core/http/throttleResponse.d.ts +2 -0
package/dist/core/runtime/frontendMode.d.ts +10 -2
package/dist/entries/auth/basicAuthGuard.js +137 -0
package/dist/entries/auth/jwt.js +135 -0
package/dist/entries/auth/jwtGuard.js +203 -0
package/dist/entries/auth/sessionGuard.js +3 -21
package/dist/entries/auth/tokenAbilityChecker.js +24 -0
package/dist/entries/cache/tags.js +7 -1
package/dist/entries/database/connectionContext.js +1 -0
package/dist/entries/database/dialect.js +1 -0
package/dist/entries/database/factory.js +5 -4
package/dist/entries/database/model.js +189 -33
package/dist/entries/database/mysqlConnection.js +35 -0
package/dist/entries/database/namedConnections.js +1 -0
package/dist/entries/database/query.js +28 -15
package/dist/entries/database/relationships.js +43 -6
package/dist/entries/database/repositoryQuery.js +142 -73
package/dist/entries/database/schema.js +28 -15
package/dist/entries/database/sqliteConnection.js +34 -0
package/dist/entries/facades.js +1 -1
package/dist/entries/http/contentNegotiation.js +5 -2
package/dist/entries/http/csrfMiddleware.js +45 -0
package/dist/entries/http/loginThrottleMiddleware.js +246 -7
package/dist/entries/http/memoryThrottleMiddleware.js +208 -6
package/dist/entries/http/requireAbilityMiddleware.js +35 -11
package/dist/entries/http/requirePasswordConfirmMiddleware.js +5 -2
package/dist/entries/http/requireVerifiedMiddleware.js +5 -2
package/dist/entries/http/requireWebAuthMiddleware.js +12 -3
package/dist/entries/http/resources.js +4 -1
package/dist/entries/http/response.js +46 -12
package/dist/entries/http/statelessAuth.js +48 -0
package/dist/entries/http/throttleMiddleware.js +208 -6
package/dist/entries/http/webErrorResponse.js +35 -11
package/dist/entries/http/webFormRequest.js +5 -2
package/dist/entries/mail/mailer.js +1 -1
package/dist/entries/openapi/generator.js +48 -5
package/dist/entries/runtime/frontendMode.js +39 -10
package/dist/framework/public-api.d.ts +11 -1
package/dist/index.js +1068 -250
package/package.json +56 -5

package/dist/entries/http/loginThrottleMiddleware.js CHANGED Viewed

@@ -71,7 +71,215 @@ function readClientIp(request, env = process.env) {
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+// ../../src/core/runtime/frontendMode.ts
+var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
+var DEFAULT_SPA_PREFIX = "/app";
+var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
+function parseFrontendMode(value) {
+  const mode = (value ?? "api").trim();
+  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
+    return mode;
+  }
+  return "api";
+}
+function readFrontendMode() {
+  return parseFrontendMode(process.env.FRONTEND_MODE);
+}
+function isViewsMode(mode) {
+  return mode === "server-htmx" || mode === "hybrid";
+}
+function isSpaMode(mode) {
+  return mode === "spa-react" || mode === "hybrid";
+}
+function isViewsEnabled() {
+  return isViewsMode(readFrontendMode());
+}
+function isSpaEnabled() {
+  return isSpaMode(readFrontendMode());
+}
+function normalizeSpaPrefix(value) {
+  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  if (trimmed.length === 0 || trimmed === "/") {
+    return DEFAULT_SPA_PREFIX;
+  }
+  return trimmed;
+}
+function readSpaPrefix() {
+  return normalizeSpaPrefix(process.env.SPA_PREFIX);
+}
+// ../../src/core/view/webErrorView.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+// ../../src/core/view/htmlResponse.ts
+function withCharset(contentType) {
+  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
+}
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
+}
+function redirectResponse(location, status = 302) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location
+    }
+  });
+}
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
+}
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": withCharset(init.contentType ?? "application/xml")
+    }
+  });
+}
+function rssResponse(body, init = {}) {
+  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
+}
+// ../../src/core/view/webErrorView.ts
+var configuredErrorView = {};
+function configureWebErrorView(options) {
+  configuredErrorView = { ...options };
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderKernelErrorChrome(input) {
+  const title = escapeHtml(input.title);
+  const message = escapeHtml(input.message);
+  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
+  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${title}</title>
+    <link rel="stylesheet" href="/assets/app.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">Home</a>
+    </header>
+    <main class="site-main">
+      <section class="page-header">
+        <h1>${title}</h1>
+        <p>${message}</p>
+        ${details}
+        ${goBack}
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+function errorTemplateName(status) {
+  if (status === 404) {
+    return "errors/not-found";
+  }
+  if (status === 403) {
+    return "errors/forbidden";
+  }
+  return "errors/error";
+}
+async function renderWebErrorHtml(input) {
+  const render = configuredErrorView.render;
+  if (!render) {
+    return renderKernelErrorChrome(input);
+  }
+  try {
+    return await render({
+      ...input,
+      request: input.request ?? currentRequestMeta().request
+    });
+  } catch {
+    return renderKernelErrorChrome(input);
+  }
+}
+async function htmlErrorResponse(input) {
+  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+}
+async function notFoundHtmlResponse(body) {
+  if (body !== undefined) {
+    return htmlResponse(body, { status: 404 });
+  }
+  return htmlErrorResponse({
+    status: 404,
+    title: "Not Found",
+    message: "The page you requested was not found."
+  });
+}
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  return false;
+}
+// ../../src/core/http/throttleResponse.ts
+async function tooManyRequestsResponse(request, message, decaySeconds) {
+  const retryAfter = { "retry-after": String(decaySeconds) };
+  if (requestPrefersJson(request) || !isViewsEnabled()) {
+    return Response.json({ error: message }, {
+      status: 429,
+      headers: retryAfter
+    });
+  }
+  const html = await htmlErrorResponse({
+    status: 429,
+    title: "Too Many Requests",
+    message,
+    request
+  });
+  const headers = new Headers(html.headers);
+  headers.set("retry-after", String(decaySeconds));
+  return new Response(html.body, { status: 429, headers });
+}
 // ../../src/core/http/loginThrottleMiddleware.ts
+var memoryLoginBuckets = new Map;
 function resolveLoginIdentity(request) {
   return readClientIp(request) ?? "unknown";
 }
@@ -89,7 +297,30 @@ async function resolveLoginEmail(request) {
     return "unknown";
   }
 }
-function createLoginThrottleMiddleware(options) {
+function consumeMemoryAttempt(key, decaySeconds) {
+  const now = Date.now();
+  const existing = memoryLoginBuckets.get(key);
+  if (!existing || existing.resetAt <= now) {
+    memoryLoginBuckets.set(key, { count: 1, resetAt: now + decaySeconds * 1000 });
+    return 1;
+  }
+  existing.count += 1;
+  return existing.count;
+}
+function createMemoryLoginThrottleMiddleware(options) {
+  const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
+  return async (request, next) => {
+    const identity = resolveLoginIdentity(request);
+    const email = await resolveLoginEmail(request);
+    const throttleKey = `${prefix}${identity}:${email}`;
+    const attempts = consumeMemoryAttempt(throttleKey, options.decaySeconds);
+    if (attempts > options.maxAttempts) {
+      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
+    }
+    return await next();
+  };
+}
+function createRedisLoginThrottleMiddleware(options) {
   const client = new RedisClient(options.redisUrl);
   const prefix = options.keyPrefix ?? namespacedRedisKey("login-throttle:");
   return async (request, next) => {
@@ -101,17 +332,25 @@ function createLoginThrottleMiddleware(options) {
       await client.expire(throttleKey, options.decaySeconds);
     }
     if (attempts > options.maxAttempts) {
-      return Response.json({ error: "Too many login attempts. Try again later." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
+      return await tooManyRequestsResponse(request, "Too many login attempts. Try again later.", options.decaySeconds);
     }
     return await next();
   };
 }
+function createLoginThrottleMiddleware(options) {
+  const redisUrl = options.redisUrl?.trim() ?? "";
+  if (redisUrl) {
+    return createRedisLoginThrottleMiddleware({ ...options, redisUrl });
+  }
+  return createMemoryLoginThrottleMiddleware(options);
+}
+function resetMemoryLoginThrottleForTests() {
+  memoryLoginBuckets.clear();
+}
 export {
   createLoginThrottleMiddleware,
+  createMemoryLoginThrottleMiddleware,
+  resetMemoryLoginThrottleForTests,
+  resolveLoginEmail,
   resolveLoginIdentity
 };

package/dist/entries/http/memoryThrottleMiddleware.js CHANGED Viewed

@@ -68,6 +68,213 @@ function readClientIp(request, env = process.env) {
   return request.headers.get("x-real-ip")?.trim() || undefined;
 }
+// ../../src/core/runtime/frontendMode.ts
+var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
+var DEFAULT_SPA_PREFIX = "/app";
+var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
+function parseFrontendMode(value) {
+  const mode = (value ?? "api").trim();
+  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
+    return mode;
+  }
+  return "api";
+}
+function readFrontendMode() {
+  return parseFrontendMode(process.env.FRONTEND_MODE);
+}
+function isViewsMode(mode) {
+  return mode === "server-htmx" || mode === "hybrid";
+}
+function isSpaMode(mode) {
+  return mode === "spa-react" || mode === "hybrid";
+}
+function isViewsEnabled() {
+  return isViewsMode(readFrontendMode());
+}
+function isSpaEnabled() {
+  return isSpaMode(readFrontendMode());
+}
+function normalizeSpaPrefix(value) {
+  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  if (trimmed.length === 0 || trimmed === "/") {
+    return DEFAULT_SPA_PREFIX;
+  }
+  return trimmed;
+}
+function readSpaPrefix() {
+  return normalizeSpaPrefix(process.env.SPA_PREFIX);
+}
+// ../../src/core/view/webErrorView.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+// ../../src/core/view/htmlResponse.ts
+function withCharset(contentType) {
+  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
+}
+function htmlResponse(html, init = {}) {
+  return new Response(html, {
+    status: init.status ?? 200,
+    statusText: init.statusText,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8"
+    }
+  });
+}
+function isHtmxRequest(request) {
+  return request.headers.get("HX-Request") === "true";
+}
+function redirectResponse(location, status = 302) {
+  return new Response(null, {
+    status,
+    headers: {
+      Location: location
+    }
+  });
+}
+function textResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8"
+    }
+  });
+}
+function xmlResponse(body, init = {}) {
+  return new Response(body, {
+    status: init.status ?? 200,
+    headers: {
+      "Content-Type": withCharset(init.contentType ?? "application/xml")
+    }
+  });
+}
+function rssResponse(body, init = {}) {
+  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
+}
+// ../../src/core/view/webErrorView.ts
+var configuredErrorView = {};
+function configureWebErrorView(options) {
+  configuredErrorView = { ...options };
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderKernelErrorChrome(input) {
+  const title = escapeHtml(input.title);
+  const message = escapeHtml(input.message);
+  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
+  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${title}</title>
+    <link rel="stylesheet" href="/assets/app.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">Home</a>
+    </header>
+    <main class="site-main">
+      <section class="page-header">
+        <h1>${title}</h1>
+        <p>${message}</p>
+        ${details}
+        ${goBack}
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+function errorTemplateName(status) {
+  if (status === 404) {
+    return "errors/not-found";
+  }
+  if (status === 403) {
+    return "errors/forbidden";
+  }
+  return "errors/error";
+}
+async function renderWebErrorHtml(input) {
+  const render = configuredErrorView.render;
+  if (!render) {
+    return renderKernelErrorChrome(input);
+  }
+  try {
+    return await render({
+      ...input,
+      request: input.request ?? currentRequestMeta().request
+    });
+  } catch {
+    return renderKernelErrorChrome(input);
+  }
+}
+async function htmlErrorResponse(input) {
+  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+}
+async function notFoundHtmlResponse(body) {
+  if (body !== undefined) {
+    return htmlResponse(body, { status: 404 });
+  }
+  return htmlErrorResponse({
+    status: 404,
+    title: "Not Found",
+    message: "The page you requested was not found."
+  });
+}
+// ../../src/core/http/contentNegotiation.ts
+function requestPrefersJson(request) {
+  if (!request) {
+    return true;
+  }
+  if (request.headers.get("HX-Request") === "true") {
+    return false;
+  }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
+  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
+  if (accept.includes("text/html")) {
+    return false;
+  }
+  if (accept.includes("application/json")) {
+    return true;
+  }
+  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
+    return false;
+  }
+  return false;
+}
+// ../../src/core/http/throttleResponse.ts
+async function tooManyRequestsResponse(request, message, decaySeconds) {
+  const retryAfter = { "retry-after": String(decaySeconds) };
+  if (requestPrefersJson(request) || !isViewsEnabled()) {
+    return Response.json({ error: message }, {
+      status: 429,
+      headers: retryAfter
+    });
+  }
+  const html = await htmlErrorResponse({
+    status: 429,
+    title: "Too Many Requests",
+    message,
+    request
+  });
+  const headers = new Headers(html.headers);
+  headers.set("retry-after", String(decaySeconds));
+  return new Response(html.body, { status: 429, headers });
+}
 // ../../src/core/http/memoryThrottleMiddleware.ts
 var throttleBucketRegistries = new Set;
 function createMemoryThrottleMiddleware(options) {
@@ -86,12 +293,7 @@ function createMemoryThrottleMiddleware(options) {
     }
     existing.count += 1;
     if (existing.count > options.maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
+      return await tooManyRequestsResponse(request, "Too many requests.", options.decaySeconds);
     }
     return await next();
   };

package/dist/entries/http/requireAbilityMiddleware.js CHANGED Viewed

@@ -4,21 +4,42 @@ import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { ForbiddenError } from "@getstrata/core/errors/http";
 // ../../src/core/runtime/frontendMode.ts
-function readFrontendMode() {
-  const mode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (mode === "server-htmx") {
-    return "server-htmx";
-  }
-  if (mode === "spa-react") {
-    return "spa-react";
+var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
+var DEFAULT_SPA_PREFIX = "/app";
+var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
+function parseFrontendMode(value) {
+  const mode = (value ?? "api").trim();
+  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
+    return mode;
   }
   return "api";
 }
+function readFrontendMode() {
+  return parseFrontendMode(process.env.FRONTEND_MODE);
+}
+function isViewsMode(mode) {
+  return mode === "server-htmx" || mode === "hybrid";
+}
+function isSpaMode(mode) {
+  return mode === "spa-react" || mode === "hybrid";
+}
 function isViewsEnabled() {
-  return readFrontendMode() === "server-htmx";
+  return isViewsMode(readFrontendMode());
 }
 function isSpaEnabled() {
-  return readFrontendMode() === "spa-react";
+  return isSpaMode(readFrontendMode());
+}
+function normalizeSpaPrefix(value) {
+  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
+  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
+  const trimmed = withSlash.replace(/\/+$/, "");
+  if (trimmed.length === 0 || trimmed === "/") {
+    return DEFAULT_SPA_PREFIX;
+  }
+  return trimmed;
+}
+function readSpaPrefix() {
+  return normalizeSpaPrefix(process.env.SPA_PREFIX);
 }
 // ../../src/core/http/contentNegotiation.ts
@@ -29,6 +50,10 @@ function requestPrefersJson(request) {
   if (request.headers.get("HX-Request") === "true") {
     return false;
   }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
   const accept = request.headers.get("accept")?.toLowerCase() ?? "";
   if (accept.includes("text/html")) {
     return false;
@@ -40,8 +65,7 @@ function requestPrefersJson(request) {
   if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
     return false;
   }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
+  return false;
 }
 // ../../src/core/http/requireAbilityMiddleware.ts

package/dist/entries/http/requirePasswordConfirmMiddleware.js CHANGED Viewed

@@ -12,6 +12,10 @@ function requestPrefersJson(request) {
   if (request.headers.get("HX-Request") === "true") {
     return false;
   }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
   const accept = request.headers.get("accept")?.toLowerCase() ?? "";
   if (accept.includes("text/html")) {
     return false;
@@ -23,8 +27,7 @@ function requestPrefersJson(request) {
   if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
     return false;
   }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
+  return false;
 }
 // ../../src/core/http/safeInternalPath.ts

package/dist/entries/http/requireVerifiedMiddleware.js CHANGED Viewed

@@ -15,6 +15,10 @@ function requestPrefersJson(request) {
   if (request.headers.get("HX-Request") === "true") {
     return false;
   }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
   const accept = request.headers.get("accept")?.toLowerCase() ?? "";
   if (accept.includes("text/html")) {
     return false;
@@ -26,8 +30,7 @@ function requestPrefersJson(request) {
   if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
     return false;
   }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
+  return false;
 }
 // ../../src/core/http/requireVerifiedMiddleware.ts

package/dist/entries/http/requireWebAuthMiddleware.js CHANGED Viewed

@@ -1,6 +1,7 @@
 // @bun
 // ../../src/core/http/requireWebAuthMiddleware.ts
 import { runWithAuthUser } from "@getstrata/core/auth/authContext";
+import { createIntendedUrlCookieFromRequest } from "@getstrata/core/auth/intendedUrlCookie";
 import { UnauthorizedError } from "@getstrata/core/errors/http";
 // ../../src/core/http/contentNegotiation.ts
@@ -11,6 +12,10 @@ function requestPrefersJson(request) {
   if (request.headers.get("HX-Request") === "true") {
     return false;
   }
+  const pathname = new URL(request.url).pathname;
+  if (pathname.startsWith("/api/")) {
+    return true;
+  }
   const accept = request.headers.get("accept")?.toLowerCase() ?? "";
   if (accept.includes("text/html")) {
     return false;
@@ -22,8 +27,7 @@ function requestPrefersJson(request) {
   if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
     return false;
   }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
+  return false;
 }
 // ../../src/core/http/safeInternalPath.ts
@@ -69,7 +73,12 @@ function createRequireWebAuthMiddleware(auth) {
     if (requestPrefersJson(request)) {
       throw new UnauthorizedError;
     }
-    return Response.redirect(loginRedirectLocation(request), 302);
+    const intended = createIntendedUrlCookieFromRequest(request);
+    const headers = new Headers({ Location: loginRedirectLocation(request) });
+    if (intended) {
+      headers.append("Set-Cookie", intended);
+    }
+    return new Response(null, { status: 302, headers });
   };
 }
 export {

package/dist/entries/http/resources.js CHANGED Viewed

@@ -8,6 +8,9 @@ function whenLoaded(model, relation, transform) {
   if (value === undefined) {
     return;
   }
+  if (value === null) {
+    return null;
+  }
   return transform ? transform(value) : value;
 }
@@ -33,7 +36,7 @@ class JsonResource {
   }
   whenLoaded(relation, transform) {
     const model = this.resource;
-    if (typeof model.loaded !== "function") {
+    if (this.resource == null || typeof model.loaded !== "function") {
       return;
     }
     return whenLoaded(model, relation, transform);