@sonicjs-cms/core 2.8.1 → 2.8.3

package/dist/{chunk-VCH6HXVP.js → chunk-JJS7JZCH.js}

@@ -1,3 +1,4 @@
+import { escapeHtml } from './chunk-TQABQWOP.js';
 import { __esm, __export, __toCommonJS } from './chunk-V4OQ3NZ2.js';
 
 // src/templates/components/logo.template.ts
@@ -225,6 +226,58 @@ function renderAdminLayoutCatalyst(data) {
   <script src="https://unpkg.com/alpinejs@3.x.x/dist/cdn.min.js" defer></script>
   <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js"></script>
 
+  <!-- CSRF: Auto-attach token to all HTMX and fetch requests -->
+  <script>
+    function getCsrfToken() {
+      var cookie = document.cookie.split('; ')
+        .find(function(row) { return row.startsWith('csrf_token='); });
+      return cookie ? cookie.substring(cookie.indexOf('=') + 1) : '';
+    }
+
+    document.addEventListener('htmx:configRequest', function(event) {
+      var token = getCsrfToken();
+      if (token) {
+        event.detail.headers['X-CSRF-Token'] = token;
+      }
+    });
+
+    (function() {
+      var originalFetch = window.fetch;
+      window.fetch = function(url, options) {
+        options = options || {};
+        var method = (options.method || 'GET').toUpperCase();
+        if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {
+          options.headers = options.headers || {};
+          if (options.headers instanceof Headers) {
+            if (!options.headers.has('X-CSRF-Token')) {
+              options.headers.set('X-CSRF-Token', getCsrfToken());
+            }
+          } else if (!Array.isArray(options.headers) && !options.headers['X-CSRF-Token']) {
+            options.headers['X-CSRF-Token'] = getCsrfToken();
+          }
+        }
+        return originalFetch.call(this, url, options);
+      };
+    })();
+
+    // Inject _csrf hidden field into regular form submissions (non-HTMX)
+    document.addEventListener('submit', function(event) {
+      var form = event.target;
+      if (!form || !form.tagName || form.tagName !== 'FORM') return;
+      var method = (form.method || 'GET').toUpperCase();
+      if (method === 'GET') return;
+      if (form.hasAttribute('hx-post') || form.hasAttribute('hx-put') ||
+          form.hasAttribute('hx-delete') || form.hasAttribute('hx-patch')) return;
+      if (!form.querySelector('input[name="_csrf"]')) {
+        var input = document.createElement('input');
+        input.type = 'hidden';
+        input.name = '_csrf';
+        input.value = getCsrfToken();
+        form.appendChild(input);
+      }
+    });
+  </script>
+
   ${data.styles ? data.styles.map((style) => `<link rel="stylesheet" href="${style}">`).join("\n  ") : ""}
   ${data.scripts ? data.scripts.map((script) => `<script src="${script}"></script>`).join("\n  ") : ""}
 </head>
@@ -666,11 +719,11 @@ function renderAlert(data) {
         <div class="${data.icon !== false ? "ml-3" : ""}">
           ${data.title ? `
             <h3 class="text-sm font-semibold ${textClasses[data.type]}">
-              ${data.title}
+              ${escapeHtml(data.title)}
             </h3>
           ` : ""}
           <div class="${data.title ? "mt-1 text-sm" : "text-sm"} ${messageTextClasses[data.type]}">
-            <p>${data.message}</p>
+            <p>${escapeHtml(data.message)}</p>
           </div>
         </div>
         ${data.dismissible ? `
@@ -3365,6 +3418,7 @@ function renderForm(data) {
       class="${data.className || "space-y-6"}"
       ${data.fields.some((f) => f.type === "file") ? 'enctype="multipart/form-data"' : ""}
     >
+      ${data.csrfToken ? `<input type="hidden" name="_csrf" value="${data.csrfToken}">` : ""}
       ${data.title ? `
         <div class="mb-6">
           <h2 class="text-lg font-medium text-gray-1">${data.title}</h2>
@@ -3543,5 +3597,5 @@ function renderFormField(field) {
 }
 
 export { adminLayoutV2, getConfirmationDialogScript, init_admin_layout_catalyst_template, init_logo_template, renderAdminLayout, renderAdminLayoutCatalyst, renderAlert, renderCheckboxPage, renderCodeExamplesList, renderConfirmationDialog, renderDesignPage, renderForm, renderFormField, renderLogo, renderPagination, renderTable, renderTestimonialsList };
-//# sourceMappingURL=chunk-VCH6HXVP.js.map
-//# sourceMappingURL=chunk-VCH6HXVP.js.map
+//# sourceMappingURL=chunk-JJS7JZCH.js.map
+//# sourceMappingURL=chunk-JJS7JZCH.js.map