@getstrata/core 2.2.40 → 2.2.42

package/dist/entries/http/response.js

@@ -121,7 +121,8 @@ var init_transactionControl = __esm(() => {
 });
 
 // ../../src/core/http/response.ts
-import { toHttpError as toHttpError3 } from "@getstrata/core/errors/http";
+import { toHttpError as toHttpError2 } from "@getstrata/core/errors/http";
+import { logServerError, webErrorResponse } from "@getstrata/core/http/webErrorResponse";
 
 // ../../src/core/database/errors.ts
 import {
@@ -258,302 +259,6 @@ function currentRequestMeta() {
   };
 }
 
-// ../../src/core/http/webErrorResponse.ts
-import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
-import { appLogger } from "@getstrata/core/logging/logger";
-
-// ../../src/core/runtime/appEnv.ts
-var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
-function normalizeEnvValue(value) {
-  return (value ?? "").trim().toLowerCase();
-}
-function isProductionEnv(env = process.env) {
-  const appEnv = normalizeEnvValue(env.APP_ENV);
-  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
-  if (appEnv === "production" || nodeEnv === "production") {
-    return true;
-  }
-  if (appEnv === "") {
-    return false;
-  }
-  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
-}
-function envFlagEnabled(value) {
-  return value === "true";
-}
-
-// ../../src/core/runtime/frontendMode.ts
-var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
-var DEFAULT_SPA_PREFIX = "/app";
-var FRONTEND_MODE_PATTERN = new RegExp(`^(${FRONTEND_MODES.join("|")})$`);
-function parseFrontendMode(value) {
-  const mode = (value ?? "api").trim();
-  if (mode === "server-htmx" || mode === "spa-react" || mode === "hybrid") {
-    return mode;
-  }
-  return "api";
-}
-function readFrontendMode() {
-  return parseFrontendMode(process.env.FRONTEND_MODE);
-}
-function isViewsMode(mode) {
-  return mode === "server-htmx" || mode === "hybrid";
-}
-function isSpaMode(mode) {
-  return mode === "spa-react" || mode === "hybrid";
-}
-function isViewsEnabled() {
-  return isViewsMode(readFrontendMode());
-}
-function isSpaEnabled() {
-  return isSpaMode(readFrontendMode());
-}
-function normalizeSpaPrefix(value) {
-  const raw = (value ?? DEFAULT_SPA_PREFIX).trim() || DEFAULT_SPA_PREFIX;
-  const withSlash = raw.startsWith("/") ? raw : `/${raw}`;
-  const trimmed = withSlash.replace(/\/+$/, "");
-  if (trimmed.length === 0 || trimmed === "/") {
-    return DEFAULT_SPA_PREFIX;
-  }
-  return trimmed;
-}
-function readSpaPrefix() {
-  return normalizeSpaPrefix(process.env.SPA_PREFIX);
-}
-
-// ../../src/core/view/webErrorView.ts
-import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
-
-// ../../src/core/http/safeInternalPath.ts
-var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
-function looksLikeExternalTarget(value) {
-  const trimmed = value.trim();
-  if (!trimmed.startsWith("/") || trimmed.startsWith("//") || trimmed.includes("\\")) {
-    return true;
-  }
-  if (trimmed.includes("://") || trimmed.includes(":/") || trimmed.includes(":\\")) {
-    return true;
-  }
-  try {
-    const decoded = decodeURIComponent(trimmed);
-    if (decoded.startsWith("//") || decoded.includes("\\") || /https?:/i.test(decoded)) {
-      return true;
-    }
-  } catch {
-    return true;
-  }
-  return false;
-}
-function sanitizeNestedQuery(search) {
-  if (!search) {
-    return "";
-  }
-  const params = new URLSearchParams(search.startsWith("?") ? search.slice(1) : search);
-  const next = new URLSearchParams;
-  for (const [key, value] of params.entries()) {
-    if (NESTED_REDIRECT_KEYS.has(key)) {
-      const sanitized = sanitizeInternalPath(value, "/");
-      next.set(key, sanitized);
-      continue;
-    }
-    if (looksLikeExternalTarget(value) && value.includes("://")) {
-      continue;
-    }
-    next.set(key, value);
-  }
-  const serialized = next.toString();
-  return serialized ? `?${serialized}` : "";
-}
-function sanitizeInternalPath(raw, fallback = "/") {
-  const trimmed = raw.trim();
-  if (looksLikeExternalTarget(trimmed)) {
-    return fallback;
-  }
-  const queryIndex = trimmed.indexOf("?");
-  const hashIndex = trimmed.indexOf("#");
-  const end = [queryIndex, hashIndex].filter((index) => index >= 0).sort((a, b) => a - b)[0];
-  const pathname = end === undefined ? trimmed : trimmed.slice(0, end);
-  if (looksLikeExternalTarget(pathname)) {
-    return fallback;
-  }
-  const search = queryIndex >= 0 ? trimmed.slice(queryIndex, hashIndex >= 0 ? hashIndex : undefined) : "";
-  return `${pathname}${sanitizeNestedQuery(search)}`;
-}
-function safeInternalRedirectPath(request, fallback = "/") {
-  const url = new URL(request.url);
-  return sanitizeInternalPath(`${url.pathname}${url.search}`, fallback);
-}
-function loginRedirectLocation(request) {
-  return `/login?redirect=${encodeURIComponent(safeInternalRedirectPath(request))}`;
-}
-
-// ../../src/core/view/htmlResponse.ts
-function htmlResponse(html, init = {}) {
-  return new Response(html, {
-    status: init.status ?? 200,
-    statusText: init.statusText,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8"
-    }
-  });
-}
-
-// ../../src/core/view/webErrorView.ts
-var configuredErrorView = {};
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-}
-function errorReturnPath(request) {
-  if (!request)
-    return "/";
-  try {
-    const current = new URL(request.url);
-    const previous = new URL(request.headers.get("referer") ?? "");
-    if (previous.origin !== current.origin || (request.method === "GET" || request.method === "HEAD") && previous.pathname === current.pathname)
-      return "/";
-    return sanitizeInternalPath(previous.pathname, "/");
-  } catch {
-    return "/";
-  }
-}
-function renderKernelErrorChrome(input) {
-  const title = escapeHtml(input.title);
-  const message = escapeHtml(input.message);
-  const errorLines = Object.entries(input.errors ?? {}).flatMap(([field, messages]) => messages.map((item) => `${field}: ${item}`)).map((line) => `<li>${escapeHtml(line)}</li>`).join("");
-  const details = errorLines ? `<ul class="error-list">${errorLines}</ul>` : "";
-  const goBack = input.status === 422 ? `<p><a href="${escapeHtml(errorReturnPath(input.request ?? currentRequestMeta2().request))}">Go back</a></p>` : "";
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>${title}</title>
-    <link rel="stylesheet" href="/assets/app.css" />
-  </head>
-  <body>
-    <header class="site-header">
-      <a class="brand" href="/">Home</a>
-    </header>
-    <main class="site-main">
-      <section class="page-header">
-        <h1>${title}</h1>
-        <p>${message}</p>
-        ${details}
-        ${goBack}
-      </section>
-    </main>
-  </body>
-</html>
-`;
-}
-async function renderWebErrorHtml(input) {
-  const render = configuredErrorView.render;
-  if (!render) {
-    return renderKernelErrorChrome(input);
-  }
-  try {
-    return await render({
-      ...input,
-      request: input.request ?? currentRequestMeta2().request
-    });
-  } catch {
-    return renderKernelErrorChrome(input);
-  }
-}
-async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
-}
-
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  if (pathname.startsWith("/api/")) {
-    return true;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  return false;
-}
-
-// ../../src/core/http/webErrorResponse.ts
-function normalizeFieldErrors(details) {
-  if (!details || typeof details !== "object" || Array.isArray(details)) {
-    return {};
-  }
-  const errors = {};
-  for (const [field, messages] of Object.entries(details)) {
-    if (Array.isArray(messages)) {
-      errors[field] = messages.map(String);
-      continue;
-    }
-    if (typeof messages === "string") {
-      errors[field] = [messages];
-    }
-  }
-  return errors;
-}
-function errorPageTitle(status, message) {
-  if (status === 404) {
-    return "Not Found";
-  }
-  if (status === 403) {
-    return "Forbidden";
-  }
-  if (status >= 500) {
-    return "Server Error";
-  }
-  return message;
-}
-function publicErrorMessage(status, message) {
-  if (status >= 500 && isProductionEnv()) {
-    return "Something went wrong.";
-  }
-  return message;
-}
-function logServerError(error, mappedError) {
-  if (mappedError.status < 500) {
-    return;
-  }
-  appLogger.error("Unhandled request error", {
-    status: mappedError.status,
-    error: error instanceof Error ? error.message : String(error),
-    stack: error instanceof Error ? error.stack : undefined
-  });
-}
-async function webErrorResponse(error, request) {
-  if (currentRequestMeta().errorFormat === "json" || !request || !isViewsEnabled() || requestPrefersJson(request)) {
-    return null;
-  }
-  const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
-  logServerError(error, mappedError);
-  if (mappedError.status === 401) {
-    return Response.redirect(loginRedirectLocation(request), 302);
-  }
-  const errors = mappedError instanceof ValidationError || mappedError.name === "ValidationError" ? normalizeFieldErrors(mappedError.details) : undefined;
-  return htmlErrorResponse({
-    status: mappedError.status,
-    title: errorPageTitle(mappedError.status, mappedError.message),
-    message: publicErrorMessage(mappedError.status, mappedError.message),
-    errors,
-    request
-  });
-}
-
 // ../../src/core/http/response.ts
 function jsonResponse(data, init = {}) {
   return Response.json(data, {
@@ -561,6 +266,11 @@ function jsonResponse(data, init = {}) {
     headers: init.headers
   });
 }
+function privateJsonResponse(data, init = {}) {
+  const response = jsonResponse(data, init);
+  response.headers.set("Cache-Control", "private, no-store");
+  return response;
+}
 function createdResponse(data, init = {}) {
   return jsonResponse(data, { ...init, status: init.status ?? 201 });
 }
@@ -568,12 +278,12 @@ function noContentResponse() {
   return new Response(null, { status: 204 });
 }
 function errorResponse(error) {
-  const mappedError = toHttpError3(error) ?? mapDatabaseError(error);
+  const mappedError = toHttpError2(error) ?? mapDatabaseError(error);
   logServerError(error, mappedError);
   return Response.json({
     error: mappedError.message,
     ...mappedError.details === undefined ? {} : { details: mappedError.details }
-  }, { status: mappedError.status });
+  }, { status: mappedError.status, headers: { "Cache-Control": "no-store" } });
 }
 function withErrorHandling(handler) {
   return async (...args) => {
@@ -620,6 +330,7 @@ export {
   errorResponse,
   jsonResponse,
   noContentResponse,
+  privateJsonResponse,
   withErrorHandling,
   withJsonErrorHandling
 };

package/dist/entries/http/scimThrottleMiddleware.js

@@ -457,7 +457,9 @@ async function renderWebErrorHtml(input) {
   }
 }
 async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
 }
 
 // ../../src/core/http/contentNegotiation.ts

package/dist/entries/http/throttleMiddleware.js

@@ -342,7 +342,9 @@ async function renderWebErrorHtml(input) {
   }
 }
 async function htmlErrorResponse(input) {
-  return htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  const response = htmlResponse(await renderWebErrorHtml(input), { status: input.status });
+  response.headers.set("Cache-Control", "no-store");
+  return response;
 }
 
 // ../../src/core/http/contentNegotiation.ts

package/dist/framework/public-api.d.ts

@@ -106,7 +106,7 @@ export { createRequireAbilityMiddleware } from "../core/http/requireAbilityMiddl
 export { createRequireGlobalAdminMiddleware } from "../core/http/requireGlobalAdminMiddleware.ts";
 export { createRequireWebAuthMiddleware } from "../core/http/requireWebAuthMiddleware.ts";
 export { JsonResource, ResourceCollection, serializeDate, toPaginatedResourceCollection, toResourceCollection, whenLoaded, } from "../core/http/resources.ts";
-export { createdResponse, errorResponse, jsonResponse, noContentResponse, withErrorHandling, } from "../core/http/response.ts";
+export { createdResponse, errorResponse, jsonResponse, noContentResponse, privateJsonResponse, withErrorHandling, } from "../core/http/response.ts";
 export type { ResourceActions, ResourceMemberHandler, ResourceRouteMap, RouteRequest, } from "../core/http/route.ts";
 export { getRouteParams, mergeRouteMaps, resourceRoutes } from "../core/http/route.ts";
 export { loginRedirectLocation, safeInternalRedirectPath, sanitizeInternalPath, } from "../core/http/safeInternalPath.ts";
@@ -171,5 +171,5 @@ export type { ValidationRule, ValidationSchema } from "../core/validation/rules.
 export { emailRule, maxLength, minLength, required, stringRule, validateObject, } from "../core/validation/rules.ts";
 export { CORE_VIEW_RENDERER_TOKEN, configureWebErrorView, configureWebLayoutData, createWebLayoutDataResolver, DEFAULT_VIEWS_DIRECTORY, EtaViewEngine, errorTemplateName, htmlErrorResponse, htmlResponse, isHtmxRequest, notFoundHtmlResponse, redirectResponse, renderKernelErrorChrome, renderWebErrorHtml, resolveWebLayoutData, rssResponse, textResponse, ViewRenderer, xmlResponse, } from "../core/view/index.ts";
 export type { ViewEngine } from "../core/view/viewEngine.ts";
-export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewResponseOptions, } from "../core/view/viewRenderer.ts";
+export type { HtmxViewResponseOptions, NamespacedViewRenderer, ViewNamespaceOptions, ViewResponseOptions, } from "../core/view/viewRenderer.ts";
 export type { WebLayoutAuthUser, WebLayoutData, WebLayoutDataOptions, WebLayoutUserKey, } from "../core/view/webLayoutData.ts";