@nextsparkjs/core 0.1.0-beta.196 → 0.1.0-beta.197

package/scripts/build/registry/host/__tests__/facade-emitter.test.mjs

@@ -124,11 +124,12 @@ test("page and layout exports include Next.js's TS-plugin ALLOWED_EXPORTS (excep
   }
 })
 
-test('metadata route loader still filters dynamicParams/generateSitemaps out of its re-exports', async () => {
-  // The table forbids dynamicParams and generateStaticParams on metadata routes because the
-  // loader either drops them or declares its own; detect a Next.js change to that code.
+test('metadata route loader still filters generateSitemaps out of its re-exports', async () => {
+  // The table forbids dynamicParams and generateStaticParams on metadata routes: the loader
+  // declares its own generateStaticParams, and up to 16.3.7 it dropped dynamicParams (16.3.8
+  // re-exports it; the table keeps refusing it). Detect a Next.js change to that code.
   const loader = await readFile(requireFromCore.resolve('next/dist/build/webpack/loaders/next-metadata-route-loader'), 'utf8')
-  assert.match(loader, /name !== 'default' && name !== 'generateSitemaps' && name !== 'dynamicParams'/)
+  assert.match(loader, /exportNames\.filter\(\(name\)=>name !== 'default' && name !== 'generateSitemaps'\);/)
   assert.match(loader, /export async function generateStaticParams/)
 })
 
@@ -595,14 +596,14 @@ test('an aliased magic export is forwarded under its source local name', async (
   assert.match(content, /^export \{ listSlugs as generateStaticParams \}$/m)
 })
 
-// --- fix round 3: ~baseline version range (baseline 16.3.6 since 0.1.0-beta.194) ---
+// --- fix round 3: ~baseline version range (baseline 16.3.8 since 0.1.0-beta.197) ---
 
 test('isSupportedNextVersion accepts ~baseline: same minor, stable patch >= baseline', () => {
-  assert.equal(ROUTE_EXPORT_TABLE.next, '16.3.6')
-  for (const version of ['16.3.6', '16.3.7', '16.3.9', '16.3.10', '16.3.123', '16.3.6+build.1', '16.3.7+sha.abc-1']) assert.equal(isSupportedNextVersion(version), true, version)
+  assert.equal(ROUTE_EXPORT_TABLE.next, '16.3.8')
+  for (const version of ['16.3.8', '16.3.9', '16.3.10', '16.3.123', '16.3.8+build.1', '16.3.9+sha.abc-1']) assert.equal(isSupportedNextVersion(version), true, version)
   for (const version of [
-    '16.3.5', '16.3.4', '16.3.0', '16.4.0', '16.2.9', '17.0.0', '15.3.6', '16.3.7-canary.0', '16.3.6-rc.1', '16.3.7-canary.0+build.1',
-    '16.3.5+build.1', '16.3.6+', '16.3.6+bad..meta', '16.3', 'latest', '', undefined,
+    '16.3.7', '16.3.6', '16.3.5', '16.3.4', '16.3.0', '16.4.0', '16.2.9', '17.0.0', '15.3.6', '16.3.7-canary.0', '16.3.8-rc.1', '16.3.7-canary.0+build.1',
+    '16.3.5+build.1', '16.3.8+', '16.3.8+bad..meta', '16.3', 'latest', '', undefined,
   ]) {
     assert.equal(isSupportedNextVersion(version), false, String(version))
   }
@@ -625,7 +626,7 @@ test('a later 16.3 patch is accepted and its own schema internal is used', async
   }
 })
 
-for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
+for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.8-canary.0']) {
   test(`${DIAGNOSTICS.UNSUPPORTED_NEXT_VERSION}: next@${version} is refused`, async () => {
     const dir = await fakeNextProject(version, "exports.AppSegmentConfigSchemaKeys = []\nexports.parseAppSegmentConfig = () => ({})\n")
     try {
@@ -634,7 +635,7 @@ for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
         error => {
           assert.deepEqual(error.diagnostics.map(d => d.code), [DIAGNOSTICS.UNSUPPORTED_NEXT_VERSION])
           assert.match(error.message, new RegExp(`next@${version.replace(/\./g, '\\.')}`))
-          assert.match(error.message, /next@~16\.3\.6/)
+          assert.match(error.message, /next@~16\.3\.8/)
           return true
         }
       )
@@ -646,9 +647,9 @@ for (const version of ['16.3.5', '16.4.0', '17.0.0', '16.3.6-canary.0']) {
 
 // --- fix round 4: build metadata ----------------------------------------------
 
-test('a Next.js version with build metadata (16.3.6+build.1) is accepted end to end', async () => {
+test('a Next.js version with build metadata (16.3.8+build.1) is accepted end to end', async () => {
   const marker = "exports.AppSegmentConfigSchemaKeys = []\nexports.parseAppSegmentConfig = () => ({})\n"
-  const dir = await fakeNextProject('16.3.6+build.1', marker)
+  const dir = await fakeNextProject('16.3.8+build.1', marker)
   try {
     assert.equal(loadNextSegmentConfig(dir).error, undefined)
     const { content } = await emitFacade({ kind: 'page', target: 'a/page.tsx', specifier: '@/a', file: FILE, source: PAGE_WITH_CONFIG, projectRoot: dir })

package/scripts/build/registry/host/__tests__/host-mode.test.mjs

@@ -17,7 +17,7 @@ const PREPARE_CLI = join(CORE_ROOT, 'scripts/build/registry/host/prepare-cli.mjs
 function project({ legacyApp = false } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-mode-'))
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'host-mode', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'host-mode', dependencies: { next: '16.3.8' } }))
   write(root, 'templates/pricing/page.tsx', PAGE('Pricing'))
   if (legacyApp) write(root, 'src/app/layout.tsx', 'export default function Layout({ children }) { return children }\n')
   return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) }

package/scripts/build/registry/host/__tests__/host-project-composition.test.mjs

@@ -36,7 +36,7 @@ const LAYOUT = 'export default function Layout({ children }: { children: React.R
 function project(extra = {}) {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-composition-'))
   write(root, 'nextspark.config.ts', "export default { plugins: [], billing: { webhookExtensions: { stripe: './lib/billing/stripe-webhook-extensions' } } }\n")
-  write(root, 'package.json', JSON.stringify({ name: 'composition', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'composition', dependencies: { next: '16.3.8' } }))
   write(root, 'config/theme.config.ts', "export const compositionThemeConfig = { name: 'composition' }\n")
   write(root, 'styles/globals.css', '@import "tailwindcss";\n')
   write(root, 'lib/billing/stripe-webhook-extensions.ts', 'export const stripeWebhookExtensions = {}\n')

package/scripts/build/registry/host/__tests__/host-project.test.mjs

@@ -16,7 +16,7 @@ const PREPARE_CLI = join(CORE_ROOT, 'scripts/build/registry/host/prepare-cli.mjs
 function project() {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-project-'))
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'host-project', dependencies: { next: '16.3.6' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'host-project', dependencies: { next: '16.3.8' } }))
   write(root, 'templates/pricing/page.tsx', PAGE('Pricing'))
   write(root, 'api/ping/route.ts', ROUTE)
   return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) }
@@ -41,7 +41,7 @@ test('a real project: the registry build is staged and published with the host,
 
     const record = readGeneration(root)
     assert.equal(Object.keys(record.files).length, first.files.length)
-    assert.ok(record.versions.core && record.versions.next === '16.3.6')
+    assert.ok(record.versions.core && record.versions.next === '16.3.8')
     assert.ok(record.inputs.files['nextspark.config.ts'] && record.inputs.files['templates/pricing/page.tsx'])
     assert.deepEqual(await checkHost(config), { ok: true, problems: [] })
 

package/scripts/build/registry/host/__tests__/host-proxy-areas.test.mjs

@@ -12,7 +12,7 @@ import { mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
-import { PROXY_AREA_WARNING, PROXY_SESSION_WARNING, missingProxyAreas, withoutComments, proxyAreaNotice, proxyAreaNotices, proxySessionNotice } from '../proxy-areas.mjs'
+import { PROXY_AREA_WARNING, PROXY_SESSION_WARNING, PROXY_SESSION_CACHED_WARNING, missingProxyAreas, withoutComments, proxyAreaNotice, proxyAreaNotices, proxySessionNotice, proxySessionCachedNotice } from '../proxy-areas.mjs'
 import { predictHost } from '../prepare.mjs'
 import { PAGE, tempHost, write } from './host-helpers.mjs'
 
@@ -83,7 +83,7 @@ test('a proxy that asks its own /api/auth/get-session over HTTP is warned about,
   assert.equal(notice.code, PROXY_SESSION_WARNING)
   assert.match(notice.message, /^src\/proxy\.ts checks the session by fetching \/api\/auth\/get-session/)
   assert.match(notice.message, /X-Forwarded-Proto: https/)
-  assert.match(notice.message, /auth\.api\.getSession\(\{ headers: new Headers\(\{ cookie: request\.headers\.get\('cookie'\) \|\| '' \}\), query: \{ disableRefresh: true \} \}\)/)
+  assert.match(notice.message, /auth\.api\.getSession\(\{ headers: new Headers\(\{ cookie: request\.headers\.get\('cookie'\) \|\| '' \}\), query: \{ disableRefresh: true, disableCookieCache: true \} \}\)/)
   assert.equal(proxySessionNotice('src/proxy.ts', readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8')), null)
   assert.equal(proxySessionNotice('src/proxy.ts', "// was: betterFetch('/api/auth/get-session')\nexport function proxy() {}"), null)
   assert.equal(proxySessionNotice('src/proxy.ts', "export { proxy } from '@nextsparkjs/core/templates/proxy'"), null)
@@ -138,3 +138,30 @@ test("prepare's prediction carries the warning among its notices", async () => {
     rmSync(project, { recursive: true, force: true })
   }
 })
+
+// The in-process session read of the 0.1.0-beta.196 template, without disableCookieCache.
+const BETA_196_SESSION_READ = `async function getSession(request: NextRequest): Promise<Session | null> {
+  const session = await auth.api.getSession({
+    headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
+    query: { disableRefresh: true },
+  })
+  return session as Session | null
+}
+`
+
+test('a proxy that reads the session in process from the cookie cache is warned about, with the option to add', () => {
+  const notice = proxySessionCachedNotice('src/proxy.ts', BETA_196_SESSION_READ)
+  assert.equal(notice.code, PROXY_SESSION_CACHED_WARNING)
+  assert.match(notice.message, /^src\/proxy\.ts reads the session with auth\.api\.getSession from Better Auth's cookie cache/)
+  assert.match(notice.message, /query: \{ disableRefresh: true, disableCookieCache: true \}/)
+  assert.equal(proxySessionCachedNotice('src/proxy.ts', readFileSync(join(CORE_ROOT, 'templates/proxy.ts'), 'utf8')), null)
+  assert.match(notice.message, /role !== 'suspended'/)
+  // the cache option alone is not enough: the proxy must also refuse a suspended account's session
+  const cacheOnly = BETA_196_SESSION_READ.replace('disableRefresh: true', 'disableRefresh: true, disableCookieCache: true')
+  assert.notEqual(proxySessionCachedNotice('src/proxy.ts', cacheOnly), null)
+  assert.equal(proxySessionCachedNotice('src/proxy.ts', cacheOnly.replace('return session as Session | null', "return session && (session.user as { role?: unknown }).role !== 'suspended' ? (session as Session) : null")), null)
+  // a comment that names the option does not count
+  assert.notEqual(proxySessionCachedNotice('src/proxy.ts', `// disableCookieCache\n${BETA_196_SESSION_READ}`), null)
+  // no in-process read (the HTTP check has its own warning), no notice
+  assert.equal(proxySessionCachedNotice('src/proxy.ts', HTTP_SESSION_CHECK), null)
+})

package/scripts/build/registry/host/__tests__/host-robustness.test.mjs

@@ -314,7 +314,7 @@ test('an npm-installed core ships only dist/: the manifest, variants and route m
 test('the project config is read again for every generation: enabling a plugin in nextspark.config.ts adds its routes', async () => {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-config-reload-'))
   try {
-    write(root, 'package.json', JSON.stringify({ name: 'reload', dependencies: { next: '16.3.6' } }))
+    write(root, 'package.json', JSON.stringify({ name: 'reload', dependencies: { next: '16.3.8' } }))
     write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
     write(root, 'plugins/search/plugin.config.ts', 'export const searchPluginConfig = {}\n')
     write(root, 'plugins/search/templates/search/page.tsx', PAGE('Search'))

package/scripts/build/registry/host/facade-emitter.mjs

@@ -284,7 +284,7 @@ export function resolveNextPackage(projectRoot = process.cwd()) {
 /**
  * Whether `version` is a Next.js the table applies to: the table's `next` is the verified
  * baseline, and core pins `next` to `~<baseline>`, so any stable patch of the same minor at or
- * above the baseline is accepted (16.3.6, 16.3.9, 16.3.6+build.1), while other minors/majors, lower
+ * above the baseline is accepted (16.3.8, 16.3.9, 16.3.8+build.1), while other minors/majors, lower
  * patches and prereleases (16.3.7-canary.0) are refused.
  */
 export function isSupportedNextVersion(version, baseline = ROUTE_EXPORT_TABLE.next) {

package/scripts/build/registry/host/next-route-exports.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Route file kinds x exports x emitted facade form, for the generated host (#203). Source of truth for host/facade-emitter.mjs; README.md renders it. Verified against the installed Next.js source listed in verifiedAgainst and by the probe builds recorded in README.md. Re-verify and bump `next` when upgrading Next.js: host/__tests__/facade-emitter.test.mjs fails when the installed version differs.",
-  "next": "16.3.6",
-  "supportedNext": "~16.3.6 (same major.minor, stable patch >= the verified baseline in \"next\"; enforced by isSupportedNextVersion)",
+  "next": "16.3.8",
+  "supportedNext": "~16.3.8 (same major.minor, stable patch >= the verified baseline in \"next\"; enforced by isSupportedNextVersion)",
   "verifiedAgainst": [
     "next/dist/build/segment-config/app/app-segment-config.js (AppSegmentConfigSchemaKeys, parseAppSegmentConfig)",
     "next/dist/build/analysis/get-page-static-info.js (checkExports, getAppPageStaticInfo)",

package/scripts/build/registry/host/proxy-areas.mjs

@@ -92,7 +92,7 @@ export const PROXY_SESSION_WARNING = 'NS_PROXY_SESSION_OVER_HTTP'
 /** What to write instead of the HTTP session check; migrate in the CLI says the same. */
 export const PROXY_SESSION_FIX =
   "import { auth } from '@nextsparkjs/core/lib/auth' and replace the betterFetch('/api/auth/get-session', ...) call with " +
-  "auth.api.getSession({ headers: new Headers({ cookie: request.headers.get('cookie') || '' }), query: { disableRefresh: true } }), " +
+  "auth.api.getSession({ headers: new Headers({ cookie: request.headers.get('cookie') || '' }), query: { disableRefresh: true, disableCookieCache: true } }), " +
   'which returns the session itself (or null), not { data }'
 
 /** The warning for a proxy whose code (not a comment) asks /api/auth/get-session over HTTP, or null. */
@@ -109,11 +109,38 @@ export function proxySessionNotice(file, source) {
   }
 }
 
+export const PROXY_SESSION_CACHED_WARNING = 'NS_PROXY_SESSION_CACHED'
+
+/** What to add to an in-process session read (the 0.1.0-beta.196 template); migrate in the CLI says the same. */
+export const PROXY_SESSION_CACHED_FIX =
+  "add disableCookieCache: true to the query of its auth.api.getSession call: query: { disableRefresh: true, disableCookieCache: true }, " +
+  "and refuse a suspended account's session at the end of getSession: return session && (session.user as { role?: unknown }).role !== 'suspended' ? (session as Session) : null"
+
+/**
+ * The warning for a proxy whose code (not a comment) reads the session in process (auth.api.getSession, as the
+ * 0.1.0-beta.196 template) without disableCookieCache, or without refusing a suspended account, or null: Better Auth
+ * then answers from the cached session_data cookie, so a signed-out cookie pair or an old role passes the proxy for up
+ * to 5 minutes, and a suspended account's session passes it.
+ */
+export function proxySessionCachedNotice(file, source) {
+  const code = withoutComments(source)
+  if (!code.includes('auth.api.getSession(') || (code.includes('disableCookieCache') && code.includes("'suspended'"))) return null
+  return {
+    code: PROXY_SESSION_CACHED_WARNING,
+    target: file,
+    message:
+      `${file} reads the session with auth.api.getSession from Better Auth's cookie cache: after a sign-out, the copied cookie ` +
+      `pair, or a role changed since sign-in, still passes the proxy until the cached cookie expires (5 minutes by default), ` +
+      `and a suspended account's session passes it. ` +
+      `As node_modules/@nextsparkjs/core/templates/proxy.ts does, ${PROXY_SESSION_CACHED_FIX}`,
+  }
+}
+
 /** The warnings for the proxy Next would load in `projectRoot` (the first of PROXY_FILES that exists). */
 export function proxyAreaNotices(projectRoot) {
   if (!projectRoot) return []
   const file = PROXY_FILES.find(candidate => existsSync(join(projectRoot, candidate)))
   if (!file) return []
   const source = readFileSync(join(projectRoot, file), 'utf8')
-  return [proxyAreaNotice(file, source), proxySessionNotice(file, source)].filter(Boolean)
+  return [proxyAreaNotice(file, source), proxySessionNotice(file, source), proxySessionCachedNotice(file, source)].filter(Boolean)
 }

package/scripts/db/verify-theme-migrations.mjs

@@ -157,7 +157,7 @@ async function main() {
     extracted = fs.mkdtempSync(path.join(os.tmpdir(), `nextspark-template-${theme}-`));
     fs.cpSync(located.sourceDir, extracted, { recursive: true });
     fs.writeFileSync(path.join(extracted, 'nextspark.config.ts'), `export default { plugins: [], template: { name: ${JSON.stringify(theme)}, version: 'test' } }\n`);
-    fs.writeFileSync(path.join(extracted, 'package.json'), JSON.stringify({ name: `nextspark-template-${theme}`, private: true, dependencies: { next: '16.3.6' } }, null, 2));
+    fs.writeFileSync(path.join(extracted, 'package.json'), JSON.stringify({ name: `nextspark-template-${theme}`, private: true, dependencies: { next: '16.3.8' } }, null, 2));
     runDir = extracted;
   }
 

package/templates/next.config.mjs

@@ -109,42 +109,21 @@ const nextConfig = {
     formats: ['image/avif', 'image/webp'],
     deviceSizes: [640, 750, 828, 1080, 1200, 1920],
     imageSizes: [16, 32, 48, 64, 96, 128, 256, 384],
+    // Hosts the server may fetch and resize through /_next/image.
+    // Keep this list to the exact hosts you use.
     remotePatterns: [
+      // Google profile pictures shown for accounts that sign in with Google.
       {
         protocol: 'https',
         hostname: 'lh3.googleusercontent.com',
         pathname: '/**',
       },
-      {
-        protocol: 'https',
-        hostname: '*.public.blob.vercel-storage.com',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'images.unsplash.com',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'upload.wikimedia.org',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: 'i.pravatar.cc',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: '*.supabase.co',
-        pathname: '/**',
-      },
-      {
-        protocol: 'https',
-        hostname: '*.cloudinary.com',
-        pathname: '/**',
-      },
+      // Examples: add the exact host of your own store, e.g. your Vercel Blob store
+      // (`<store-id>.public.blob.vercel-storage.com`) once uploads use it.
+      // { protocol: 'https', hostname: '<store-id>.public.blob.vercel-storage.com', pathname: '/**' },
+      // { protocol: 'https', hostname: '<project-ref>.supabase.co', pathname: '/**' },
+      // { protocol: 'https', hostname: 'res.cloudinary.com', pathname: '/<cloud-name>/**' },
+      // { protocol: 'https', hostname: 'images.unsplash.com', pathname: '/**' },
     ],
   },
   // Next.js sets TURBOPACK before it loads this file whenever Turbopack builds
@@ -158,7 +137,8 @@ const nextConfig = {
   async headers() {
     const isProduction = process.env.NODE_ENV === 'production';
 
-    // Allowed image domains (must match remotePatterns above)
+    // Image hosts the browser may load directly (CSP img-src). The server only fetches the hosts in
+    // images.remotePatterns above; add a host there too when next/image should serve it.
     // NOTE: Wildcard patterns (*.public.blob.vercel-storage.com, *.supabase.co, *.cloudinary.com)
     // allow images from any account on these services for development flexibility.
     // For production with stricter security, consider restricting to specific account subdomains.

package/templates/projects/blog/package.json

@@ -14,7 +14,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "next-intl": "^4.0.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

package/templates/projects/crm/package.json

@@ -13,7 +13,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "next-intl": "^4.0.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",

package/templates/projects/productivity/package.json

@@ -17,7 +17,7 @@
     "@nextsparkjs/core": ">=0.1.0-0",
     "@nextsparkjs/testing": ">=0.1.0-0",
     "lucide-react": "^0.539.0",
-    "next": "~16.3.6",
+    "next": "~16.3.8",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "zod": "^4.0.0"

package/templates/projects/starter/config/app.config.ts

@@ -126,6 +126,14 @@ export const APP_CONFIG_OVERRIDES = {
     // methods: ['email-password', 'google'],
     // methods: ['email-otp', 'email-password', 'google'],
 
+    /**
+     * Password endpoints (sign-in/email, sign-up/email, reset). Left undeclared
+     * they follow `methods` in production (off under the passwordless preset) and
+     * stay on in development (dev keyring, `pnpm db:seed` users, Cypress).
+     * Uncomment to keep password logins in production (API clients, test users):
+     */
+    // emailAndPassword: { enabled: true },
+
     /**
      * Session duration / renewal in seconds (defaults: 7 days, renewed daily).
      * Long-lived sessions for an installed PWA, for example:

package/templates/proxy.ts

@@ -189,14 +189,17 @@ function redirectAccessDenied(request: NextRequest): NextResponse {
  * Nothing here leaves the process, so no forwarded scheme or host can point
  * the check anywhere. `disableRefresh`: this response cannot carry the renewed
  * session cookie, so the rolling renewal is left to the auth route
- * (lib/auth/session-refresh).
+ * (lib/auth/session-refresh). `disableCookieCache`: the session comes from the
+ * database, not the signed session_data cookie, so a sign-out, a revoked
+ * session or a role change counts at once (lib/auth/authorization-session).
+ * A suspended account's session is no session (lib/auth/suspension).
  */
 async function getSession(request: NextRequest): Promise<Session | null> {
   const session = await auth.api.getSession({
     headers: new Headers({ cookie: request.headers.get('cookie') || '' }),
-    query: { disableRefresh: true },
+    query: { disableRefresh: true, disableCookieCache: true },
   })
-  return session as Session | null
+  return session && (session.user as { role?: unknown }).role !== 'suspended' ? (session as Session) : null
 }
 
 /**

package/tests/jest/__mocks__/@nextsparkjs/registries/permissions-registry.ts

@@ -37,12 +37,13 @@ export const TEAM_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
   viewer: ['team.view'],
 }
 
-// Entity permissions used by service tests (mirrors the default theme's customers entity)
+// Entity permissions used by service tests (mirrors the default theme's customers entity, and the starter's
+// posts entity, whose `publish` action is owner/admin only)
 const ENTITY_PERMISSIONS_BY_ROLE: Record<string, string[]> = {
-  owner: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'customers.delete'],
-  admin: ['customers.create', 'customers.read', 'customers.list', 'customers.update'],
+  owner: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'customers.delete', 'posts.create', 'posts.update', 'posts.publish'],
+  admin: ['customers.create', 'customers.read', 'customers.list', 'customers.update', 'posts.create', 'posts.update', 'posts.publish'],
   editor: ['customers.read', 'customers.list'],
-  member: ['customers.read', 'customers.list'],
+  member: ['customers.read', 'customers.list', 'posts.create', 'posts.update'],
   viewer: [],
 }