@getstrata/core 0.5.59 → 0.5.61

package/dist/entries/http/response.js

@@ -83,220 +83,13 @@ function isViewsEnabled() {
   return readFrontendMode() === "server-htmx";
 }
 
-// ../../src/core/view/etaViewEngine.ts
-import { join, relative } from "path";
-import { Eta } from "eta";
+// ../../src/core/view/webErrorView.ts
+import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
 
-// ../../src/core/view/assertEtaHtmlSource.ts
-var HTML_TAGS = new Set([
-  "a",
-  "abbr",
-  "address",
-  "article",
-  "aside",
-  "audio",
-  "b",
-  "blockquote",
-  "body",
-  "button",
-  "canvas",
-  "caption",
-  "cite",
-  "code",
-  "col",
-  "colgroup",
-  "data",
-  "datalist",
-  "dd",
-  "del",
-  "details",
-  "dfn",
-  "dialog",
-  "div",
-  "dl",
-  "dt",
-  "em",
-  "fieldset",
-  "figcaption",
-  "figure",
-  "footer",
-  "form",
-  "h1",
-  "h2",
-  "h3",
-  "h4",
-  "h5",
-  "h6",
-  "header",
-  "hgroup",
-  "hr",
-  "html",
-  "i",
-  "iframe",
-  "img",
-  "input",
-  "ins",
-  "kbd",
-  "label",
-  "legend",
-  "li",
-  "main",
-  "map",
-  "mark",
-  "menu",
-  "meter",
-  "nav",
-  "object",
-  "ol",
-  "optgroup",
-  "option",
-  "output",
-  "p",
-  "picture",
-  "pre",
-  "progress",
-  "q",
-  "rp",
-  "rt",
-  "ruby",
-  "s",
-  "samp",
-  "script",
-  "search",
-  "section",
-  "select",
-  "slot",
-  "small",
-  "source",
-  "span",
-  "strong",
-  "style",
-  "sub",
-  "summary",
-  "sup",
-  "table",
-  "tbody",
-  "td",
-  "template",
-  "textarea",
-  "tfoot",
-  "th",
-  "thead",
-  "time",
-  "title",
-  "tr",
-  "track",
-  "u",
-  "ul",
-  "var",
-  "video",
-  "wbr"
-]);
-var TAG_PATTERN = "([a-z][a-z0-9]*)";
-var CLASS_OR_ID_PATTERN = "[.#][\\w-]+";
-var CLASS_ID_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})+`);
-var ATTRIBUTE_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:${CLASS_OR_ID_PATTERN})*\\s+[\\w:-]+=`);
-var TAG_SHORTHAND = new RegExp(`^${TAG_PATTERN}(?:>|\\s+\\S|$)`);
-function htmlTagName(match) {
-  const tag = match?.[1];
-  return tag && HTML_TAGS.has(tag) ? tag : undefined;
-}
-function describePugLikeLine(line) {
-  if (/^\|(?:\s|$)/.test(line)) {
-    return "piped text";
-  }
-  if (htmlTagName(line.match(CLASS_ID_SHORTHAND))) {
-    return "class/id shorthand";
-  }
-  if (htmlTagName(line.match(ATTRIBUTE_SHORTHAND))) {
-    return "attribute shorthand";
-  }
-  if (htmlTagName(line.match(TAG_SHORTHAND))) {
-    return "tag shorthand";
-  }
-  return;
-}
-function updateSkipBlock(lower, skipBlock) {
-  if (skipBlock) {
-    if (skipBlock === "comment" && lower.includes("-->")) {
-      return null;
-    }
-    if (skipBlock !== "comment" && lower.includes(`</${skipBlock}`)) {
-      return null;
-    }
-    return skipBlock;
-  }
-  if (lower.startsWith("<!--") && !lower.includes("-->")) {
-    return "comment";
-  }
-  if (lower.startsWith("<script") && !lower.includes("</script")) {
-    return "script";
-  }
-  if (lower.startsWith("<style") && !lower.includes("</style")) {
-    return "style";
-  }
-  return null;
-}
-function assertEtaHtmlSource(templateName, source) {
-  let skipBlock = null;
-  for (const rawLine of source.split(/\r?\n/)) {
-    const trimmed = rawLine.trim();
-    if (!trimmed) {
-      continue;
-    }
-    const lower = trimmed.toLowerCase();
-    const nextSkipBlock = updateSkipBlock(lower, skipBlock);
-    if (skipBlock || nextSkipBlock) {
-      skipBlock = nextSkipBlock;
-      continue;
-    }
-    if (trimmed.startsWith("<") || trimmed.startsWith("<%")) {
-      continue;
-    }
-    const kind = describePugLikeLine(trimmed);
-    if (kind) {
-      throw new Error(`Eta view "${templateName}" contains Pug-like markup (${kind}: ${trimmed}). Eta views must be HTML + <% %> tags, not Pug.`);
-    }
-  }
-}
-
-// ../../src/core/view/etaViewEngine.ts
-var DEFAULT_VIEWS_DIRECTORY = join(process.cwd(), "resources/views");
-var DEFAULT_LAYOUT = "layouts/app.eta";
-
-class EtaViewEngine {
-  eta;
-  resolveLayoutData;
-  constructor(viewsDirectory = DEFAULT_VIEWS_DIRECTORY, resolveLayoutData) {
-    this.eta = new Eta({
-      views: viewsDirectory,
-      autoTrim: false
-    });
-    this.resolveLayoutData = resolveLayoutData;
-    const readFile = this.eta.readFile?.bind(this.eta);
-    this.eta.readFile = (path) => {
-      const source = readFile ? readFile(path) : "";
-      assertEtaHtmlSource(relative(viewsDirectory, path) || path, source);
-      return source;
-    };
-  }
-  async render(name, data = {}, options = {}) {
-    const template = name.endsWith(".eta") ? name : `${name}.eta`;
-    const layoutData = this.resolveLayoutData ? await this.resolveLayoutData() : {};
-    const mergedData = { ...layoutData, ...data };
-    const body = await this.eta.renderAsync(template, mergedData);
-    const layout = options.layout ?? DEFAULT_LAYOUT;
-    if (layout === false) {
-      return body;
-    }
-    const layoutTemplate = layout.endsWith(".eta") ? layout : `${layout}.eta`;
-    return await this.eta.renderAsync(layoutTemplate, {
-      ...mergedData,
-      body
-    });
-  }
-}
 // ../../src/core/view/htmlResponse.ts
+function withCharset(contentType) {
+  return contentType.includes("charset=") ? contentType : `${contentType}; charset=utf-8`;
+}
 function htmlResponse(html, init = {}) {
   return new Response(html, {
     status: init.status ?? 200,
@@ -317,9 +110,6 @@ function redirectResponse(location, status = 302) {
     }
   });
 }
-function notFoundHtmlResponse(body = "Not Found") {
-  return htmlResponse(body, { status: 404 });
-}
 function textResponse(body, init = {}) {
   return new Response(body, {
     status: init.status ?? 200,
@@ -332,348 +122,89 @@ function xmlResponse(body, init = {}) {
   return new Response(body, {
     status: init.status ?? 200,
     headers: {
-      "Content-Type": "application/xml; charset=utf-8"
+      "Content-Type": withCharset(init.contentType ?? "application/xml")
     }
   });
 }
-// ../../src/core/view/webLayoutData.ts
-import { currentAuthUser } from "@getstrata/core/auth/authContext";
-import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
-
-// ../../src/core/contracts/serviceTokens.ts
-var CORE_CONFIG_TOKEN = "core.config";
-var CORE_CACHE_TOKEN = "core.cache";
-var CORE_QUEUE_TOKEN = "core.queue";
-var CORE_EVENT_BUS_TOKEN = "core.eventBus";
-var CORE_POLICY_GATE_TOKEN = "core.policyGate";
-var CORE_AUTH_TOKEN = "core.auth";
-var CORE_TOKEN_SERVICE_TOKEN = "core.tokenService";
-var CORE_ABILITY_CHECKER_TOKEN = "core.abilityChecker";
-var CORE_AUTH_USER_DIRECTORY_TOKEN = "core.authUserDirectory";
-function isAbilityChecker(value) {
-  if (!value || typeof value !== "object") {
-    return false;
-  }
-  const candidate = value;
-  return typeof candidate.tokenCan === "function" && typeof candidate.requireAbility === "function";
-}
-function isAuthUserDirectory(value) {
-  if (!value || typeof value !== "object") {
-    return false;
-  }
-  return typeof value.findByIdOrThrow === "function";
-}
-function resolveAbilityChecker(container) {
-  if (container.has(CORE_ABILITY_CHECKER_TOKEN)) {
-    return container.resolve(CORE_ABILITY_CHECKER_TOKEN);
-  }
-  return container.resolve(CORE_TOKEN_SERVICE_TOKEN);
-}
-function resolveAuthUserDirectory(container) {
-  if (container.has(CORE_AUTH_USER_DIRECTORY_TOKEN)) {
-    const directory = container.resolve(CORE_AUTH_USER_DIRECTORY_TOKEN);
-    if (isAuthUserDirectory(directory)) {
-      return directory;
-    }
-  }
-  if (container.has(CORE_TOKEN_SERVICE_TOKEN)) {
-    const tokenService = container.resolve(CORE_TOKEN_SERVICE_TOKEN);
-    if (isAuthUserDirectory(tokenService)) {
-      return tokenService;
-    }
-  }
-  return null;
-}
-
-// ../../src/core/http/csrfToken.ts
-import { timingSafeEqual } from "crypto";
-
-// ../../src/core/http/cookies.ts
-function readRequestCookie(request, name) {
-  const cookies = request.cookies;
-  if (cookies && typeof cookies.get === "function") {
-    const value = cookies.get(name);
-    if (value) {
-      return value;
-    }
-  }
-  const header = request.headers.get("cookie");
-  if (!header) {
-    return null;
-  }
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1)
-      continue;
-    const cookieName = part.slice(0, idx).trim();
-    if (cookieName !== name)
-      continue;
-    return decodeURIComponent(part.slice(idx + 1).trim());
-  }
-  return null;
-}
-function readBunRequestCookie(request, name) {
-  return request.cookies.get(name) ?? readRequestCookie(request, name);
+function rssResponse(body, init = {}) {
+  return xmlResponse(body, { ...init, contentType: "application/rss+xml" });
 }
 
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/http/requestMetaContext.ts
-var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
-function currentRequestMeta() {
-  return requestMetaContext.getStore() ?? {
-    ipAddress: null,
-    userAgent: null
-  };
-}
-
-// ../../src/core/http/csrfToken.ts
-var CSRF_COOKIE = "workhub_csrf";
-var CSRF_TTL_MS = 60 * 60 * 1000;
-function csrfCookieName() {
-  return process.env.CSRF_COOKIE_NAME?.trim() || CSRF_COOKIE;
-}
-function resolveCsrfSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || process.env.ADMIN_API_TOKEN?.trim() || "workhub-dev-csrf-secret";
-}
-function csrfVerifyOptions() {
-  return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
-}
-function tokensMatch(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual(leftBuffer, rightBuffer);
-}
-function createCsrfTokenCookie() {
-  const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
-  const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return {
-    token,
-    cookie: `${csrfCookieName()}=${encodeURIComponent(token)}; Path=/; SameSite=Lax; Max-Age=${Math.floor(CSRF_TTL_MS / 1000)}${secure}`
-  };
-}
-function resolveCsrfToken(request) {
-  const cookieValue = readRequestCookie(request, csrfCookieName());
-  if (cookieValue && Bun.CSRF.verify(cookieValue, csrfVerifyOptions())) {
-    return { token: cookieValue };
-  }
-  return createCsrfTokenCookie();
-}
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
-  }
-  return null;
-}
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
-    }
-    const legacyField = formData.get("_csrf");
-    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
-      return legacyField.trim();
-    }
-  }
-  return null;
-}
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
-    return false;
-  }
-  const cookieValue = readRequestCookie(request, csrfCookieName());
-  if (!cookieValue) {
-    return false;
-  }
-  if (!tokensMatch(submittedToken, cookieValue)) {
-    return false;
-  }
-  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
-}
-function resolveCsrfTokenForRequest(request) {
-  const metaToken = currentRequestMeta().csrfToken;
-  if (metaToken) {
-    return metaToken;
-  }
-  return resolveCsrfToken(request).token;
-}
-
-// ../../src/core/http/flashSession.ts
-import { createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FLASH_COOKIE = "workhub_flash";
-var FLASH_TTL_MS = 60 * 1000;
-function resolveFlashSecret() {
-  return process.env.SESSION_SECRET?.trim() || process.env.OAUTH_STATE_SECRET?.trim() || "workhub-dev-flash-secret";
-}
-function signFlashPayload(payload, issuedAt) {
-  const signature = createHmac("sha256", resolveFlashSecret()).update(`${payload}.${issuedAt}`).digest("hex");
-  return `${payload}.${issuedAt}.${signature}`;
-}
-function readFlashCookie(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return null;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const [name, ...rest] = part.trim().split("=");
-    if (name === FLASH_COOKIE) {
-      return decodeURIComponent(rest.join("="));
-    }
-  }
-  return null;
-}
-function parseFlashCookie(cookieValue) {
-  const parts = cookieValue.split(".");
-  if (parts.length < 3) {
-    return null;
-  }
-  const signature = parts.pop();
-  const issuedAtRaw = parts.pop();
-  const payload = parts.join(".");
-  if (!signature || !issuedAtRaw || !payload) {
-    return null;
-  }
-  const issuedAt = Number.parseInt(issuedAtRaw, 10);
-  if (!Number.isFinite(issuedAt) || Date.now() - issuedAt > FLASH_TTL_MS) {
-    return null;
-  }
-  const expectedSignature = signFlashPayload(payload, issuedAt).split(".").pop();
-  if (!expectedSignature) {
-    return null;
-  }
-  const expectedBuffer = Buffer.from(expectedSignature);
-  const actualBuffer = Buffer.from(signature);
-  if (expectedBuffer.length !== actualBuffer.length) {
-    return null;
-  }
-  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
-    return null;
+// ../../src/core/view/webErrorView.ts
+var configuredErrorView = {};
+function configureWebErrorView(options) {
+  configuredErrorView = { ...options };
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function renderKernelErrorChrome(input) {
+  const title = escapeHtml(input.title);
+  const message = escapeHtml(input.message);
+  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
+  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
+  const goBack = input.status === 422 ? `<p><a href="javascript:history.back()">Go back</a></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${title}</title>
+    <link rel="stylesheet" href="/assets/app.css" />
+  </head>
+  <body>
+    <header class="site-header">
+      <a class="brand" href="/">Home</a>
+    </header>
+    <main class="site-main">
+      <section class="page-header">
+        <h1>${title}</h1>
+        <p>${message}</p>
+        ${details}
+        ${goBack}
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+function errorTemplateName(status) {
+  if (status === 404) {
+    return "errors/not-found";
+  }
+  if (status === 403) {
+    return "errors/forbidden";
+  }
+  return "errors/error";
+}
+async function renderWebErrorHtml(input) {
+  const render = configuredErrorView.render;
+  if (!render) {
+    return renderKernelErrorChrome(input);
   }
   try {
-    const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (!parsed?.message || typeof parsed.message !== "string") {
-      return null;
-    }
-    if (parsed.level !== "success" && parsed.level !== "error" && parsed.level !== "info") {
-      return null;
-    }
-    return parsed;
+    return await render({
+      ...input,
+      request: input.request ?? currentRequestMeta().request
+    });
   } catch {
-    return null;
+    return renderKernelErrorChrome(input);
   }
 }
-function createFlashCookie(message) {
-  const payload = Buffer.from(JSON.stringify(message), "utf8").toString("base64url");
-  const issuedAt = Date.now();
-  const value = signFlashPayload(payload, issuedAt);
-  return `${FLASH_COOKIE}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60`;
+async function htmlErrorResponse(input) {
+  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
 }
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
-function pullFlash(request) {
-  const cookieValue = readFlashCookie(request);
-  if (!cookieValue) {
-    return null;
+async function notFoundHtmlResponse(body) {
+  if (body !== undefined) {
+    return htmlResponse(body, { status: 404 });
   }
-  return parseFlashCookie(cookieValue);
-}
-function flashResponse(response, message) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", createFlashCookie(message));
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
+  return htmlErrorResponse({
+    status: 404,
+    title: "Not Found",
+    message: "The page you requested was not found."
   });
 }
 
-// ../../src/core/view/webLayoutData.ts
-var configuredLayoutOptions = {};
-function configureWebLayoutData(options) {
-  configuredLayoutOptions = { ...options };
-}
-function layoutUserKey(options) {
-  return options.userKey ?? "authUser";
-}
-async function defaultLoadLayoutUser(container, _request) {
-  const authUser = currentAuthUser();
-  if (!authUser) {
-    return null;
-  }
-  const userId = Number(authUser.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    return null;
-  }
-  const directory = resolveAuthUserDirectory(container);
-  if (!directory) {
-    return {
-      id: userId,
-      email: "",
-      role: authUser.role ?? "member"
-    };
-  }
-  try {
-    const user = await directory.findByIdOrThrow(userId);
-    return {
-      id: userId,
-      email: user.email ?? "",
-      role: authUser.role ?? user.role ?? "member"
-    };
-  } catch {
-    return null;
-  }
-}
-async function resolveWebLayoutData(container, request, options = {}) {
-  const resolved = { ...configuredLayoutOptions, ...options };
-  const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
-  const flash = request ? currentRequestMeta2().flash ?? pullFlash(request) : null;
-  const userKey = layoutUserKey(resolved);
-  const loadUser = resolved.loadUser ?? defaultLoadLayoutUser;
-  const user = await loadUser(container, request);
-  const extra = typeof resolved.extra === "function" ? await resolved.extra(user) : resolved.extra ?? {};
-  return {
-    [userKey]: user,
-    csrfToken,
-    flash,
-    ...extra
-  };
-}
 // ../../src/core/http/contentNegotiation.ts
 function requestPrefersJson(request) {
   if (!request) {
@@ -697,6 +228,39 @@ function requestPrefersJson(request) {
   return pathname.startsWith("/api/");
 }
 
+// ../../src/core/http/safeInternalPath.ts
+function looksLikeExternalTarget(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
+    return true;
+  }
+  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
+    return true;
+  }
+  try {
+    const decoded = decodeURIComponent(trimmed);
+    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
+      return true;
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
+function sanitizeInternalPath(raw, fallback = "/") {
+  if (looksLikeExternalTarget(raw)) {
+    return fallback;
+  }
+  return raw;
+}
+function safeInternalRedirectPath(request, fallback = "/") {
+  const url = new URL(request.url);
+  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
+}
+function loginRedirectLocation(request) {
+  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
+}
+
 // ../../src/core/http/webErrorResponse.ts
 function normalizeFieldErrors(details) {
   if (!details || typeof details !== "object" || Array.isArray(details)) {
@@ -714,23 +278,37 @@ function normalizeFieldErrors(details) {
   }
   return errors;
 }
-function webErrorResponse(error, request) {
+function errorPageTitle(status, message) {
+  if (status === 404) {
+    return "Not Found";
+  }
+  if (status === 403) {
+    return "Forbidden";
+  }
+  if (status >= 500) {
+    return "Server Error";
+  }
+  return message;
+}
+function publicErrorMessage(status, message) {
+  if (status >= 500 && false) {}
+  return message;
+}
+async function webErrorResponse(error, request) {
   if (!request || !isViewsEnabled() || requestPrefersJson(request)) {
     return null;
   }
   const mappedError = error instanceof HttpError2 ? error : mapDatabaseError(error);
   if (mappedError instanceof UnauthorizedError) {
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  }
-  if (mappedError instanceof ValidationError) {
-    const errors = normalizeFieldErrors(mappedError.details);
-    const fieldSummary = Object.entries(errors).flatMap(([field, messages]) => messages.map((message) => `${field}: ${message}`)).join(`
-`);
-    return htmlResponse(`<section class="page-header"><h1>Validation failed</h1><pre>${fieldSummary || mappedError.message}</pre><p><a href="javascript:history.back()">Go back</a></p></section>`, { status: mappedError.status });
-  }
-  return htmlResponse(`<section class="page-header"><h1>${mappedError.message}</h1></section>`, {
-    status: mappedError.status
+    return Response.redirect(loginRedirectLocation(request), 302);
+  }
+  const errors = mappedError instanceof ValidationError ? normalizeFieldErrors(mappedError.details) : undefined;
+  return htmlErrorResponse({
+    status: mappedError.status,
+    title: errorPageTitle(mappedError.status, mappedError.message),
+    message: publicErrorMessage(mappedError.status, mappedError.message),
+    errors,
+    request
   });
 }
 
@@ -760,7 +338,7 @@ function withErrorHandling(handler) {
       return await handler(...args);
     } catch (error) {
       const request = args.find((arg) => arg instanceof Request);
-      const webResponse = webErrorResponse(error, request);
+      const webResponse = await webErrorResponse(error, request);
       if (webResponse) {
         return webResponse;
       }