@jskit-ai/http-web 0.1.80 → 0.1.81

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/http-web",
-  "version": "0.1.80",
+  "version": "0.1.81",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"
@@ -44,14 +44,14 @@
     "./client/support/contractGuards": "./src/client/support/contractGuards.js"
   },
   "dependencies": {
-    "@jskit-ai/resource-crud-core": "0.1.177",
+    "@jskit-ai/resource-crud-core": "0.1.178",
     "@mdi/js": "^7.4.47"
   },
   "peerDependencies": {
-    "@jskit-ai/http-runtime": "0.1.233",
-    "@jskit-ai/kernel": "0.1.235",
-    "@jskit-ai/realtime": "0.1.232",
-    "@jskit-ai/shell-web": "0.1.239",
+    "@jskit-ai/http-runtime": "0.1.234",
+    "@jskit-ai/kernel": "0.1.236",
+    "@jskit-ai/realtime": "0.1.233",
+    "@jskit-ai/shell-web": "0.1.240",
     "@tanstack/vue-query": "^5.90.5",
     "vue": "^3.5.13",
     "vue-router": "^5.0.4",

package/src/client/composables/useCrudDeleteAction.js

@@ -2,6 +2,7 @@ import { computed, proxyRefs, ref, unref } from "vue";
 import { useRouter } from "vue-router";
 import { normalizeText } from "@jskit-ai/kernel/shared/support/normalize";
 import { resolveCrudJsonApiTransport } from "./crud/crudJsonApiTransportSupport.js";
+import { resolveCrudHttpClient } from "./crud/crudHttpClientSupport.js";
 import { toQueryErrorMessage } from "./support/errorMessageHelpers.js";
 import { useCommand } from "./useCommand.js";
 
@@ -86,7 +87,7 @@ function useCrudDeleteAction({
     access,
     apiSuffix: deleteApiSuffix,
     writeMethod: deleteOperation.method,
-    client,
+    client: resolveCrudHttpClient(resource, { client }),
     transport: resolveCrudJsonApiTransport(undefined, resource, {
       mode: "delete"
     }),

package/test/useCrudDeleteAction.test.js

@@ -4,6 +4,7 @@ import { QueryClient, VueQueryPlugin } from "@tanstack/vue-query";
 import { createSSRApp, h, nextTick, ref } from "vue";
 import { renderToString } from "vue/server-renderer";
 import { createMemoryHistory, createRouter } from "vue-router";
+import { configureHttpWebClient, resetHttpWebClientForTests } from "../src/client/lib/httpClient.js";
 import {
   requireCrudDeleteOperation,
   useCrudDeleteAction
@@ -43,7 +44,7 @@ function createScreen() {
   });
 }
 
-async function renderDeleteAction({ client, queryClient = new QueryClient() } = {}) {
+async function renderDeleteAction({ client, resource = deleteResource, queryClient = new QueryClient() } = {}) {
   const router = createTestRouter();
   await router.push("/notes/42");
   await router.isReady();
@@ -53,7 +54,7 @@ async function renderDeleteAction({ client, queryClient = new QueryClient() } =
     setup() {
       deleteAction = useCrudDeleteAction({
         screen: createScreen(),
-        resource: deleteResource,
+        resource,
         resourceNamespace: "notes",
         apiUrlTemplate: "/notes/:noteId",
         client
@@ -127,6 +128,74 @@ test("useCrudDeleteAction keeps the record dialog open with useful error feedbac
   assert.equal(router.currentRoute.value.path, "/notes/42");
 });
 
+test("public deletion resolves the configured client without session CSRF", async (t) => {
+  t.after(resetHttpWebClientForTests);
+  const requests = [];
+  configureHttpWebClient({
+    async request(path, options) {
+      requests.push({ path, options });
+      return null;
+    }
+  });
+  const { deleteAction, router } = await renderDeleteAction({
+    resource: { ...deleteResource, apiAccess: "public" }
+  });
+
+  deleteAction.request();
+  await deleteAction.confirm();
+
+  assert.equal(requests.length, 1);
+  assert.match(requests[0].path, /\/notes\/42$/);
+  assert.equal(requests[0].options.method, "DELETE");
+  assert.equal(requests[0].options.csrf, false);
+  assert.equal(router.currentRoute.value.path, "/notes");
+});
+
+test("authenticated deletion retains configured-client CSRF behavior", async (t) => {
+  t.after(resetHttpWebClientForTests);
+  const requests = [];
+  configureHttpWebClient({
+    async request(path, options) {
+      requests.push({ path, options });
+      return null;
+    }
+  });
+  const { deleteAction } = await renderDeleteAction();
+
+  deleteAction.request();
+  await deleteAction.confirm();
+
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].options.method, "DELETE");
+  assert.equal(Object.hasOwn(requests[0].options, "csrf"), false);
+});
+
+test("public deletion honors an explicit client override", async (t) => {
+  t.after(resetHttpWebClientForTests);
+  configureHttpWebClient({
+    request() {
+      assert.fail("The configured client must not replace the explicit override.");
+    }
+  });
+  const requests = [];
+  const { deleteAction } = await renderDeleteAction({
+    resource: { ...deleteResource, apiAccess: "public" },
+    client: {
+      async request(path, options) {
+        requests.push({ path, options });
+        return null;
+      }
+    }
+  });
+
+  deleteAction.request();
+  await deleteAction.confirm();
+
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].options.method, "DELETE");
+  assert.equal(requests[0].options.csrf, false);
+});
+
 test("useCrudDeleteAction rejects resources without the canonical DELETE operation", () => {
   assert.throws(
     () => requireCrudDeleteOperation({ operations: {} }),