@stacksjs/actions 0.72.18 → 0.72.19

package/dist/dev/defaults-resources.d.ts

@@ -21,4 +21,5 @@
  * Returns the vendored path if neither resolves, letting the caller (stx serve)
  * surface a clear missing-directory error rather than a silent empty glob.
  */
+export declare function resolveDefaultsRoot(): string;
 export declare function resolveDefaultsResources(): string;

package/dist/dev/defaults-resources.js

@@ -1 +1 @@
-import{existsSync}from"node:fs";import{dirname,join,resolve}from"node:path";export function resolveDefaultsResources(){const projectRoot=resolve(import.meta.dir,"../../../../../.."),vendored=join(projectRoot,"storage/framework/defaults/resources");if(existsSync(vendored))return vendored;try{const pkgJson=Bun.resolveSync("@stacksjs/defaults/package.json",process.cwd());return join(dirname(pkgJson),"resources")}catch{return vendored}}
+import{existsSync}from"node:fs";import{dirname,join,resolve}from"node:path";export function resolveDefaultsRoot(){const projectRoot=resolve(import.meta.dir,"../../../../../.."),vendored=join(projectRoot,"storage/framework/defaults");if(existsSync(vendored))return vendored;try{const pkgJson=Bun.resolveSync("@stacksjs/defaults/package.json",process.cwd());return dirname(pkgJson)}catch{return vendored}}export function resolveDefaultsResources(){const projectRoot=resolve(import.meta.dir,"../../../../../.."),vendored=join(projectRoot,"storage/framework/defaults/resources");if(existsSync(vendored))return vendored;try{const pkgJson=Bun.resolveSync("@stacksjs/defaults/package.json",process.cwd());return join(dirname(pkgJson),"resources")}catch{return vendored}}

package/dist/serve/dashboard-gate.d.ts

@@ -0,0 +1,56 @@
+/**
+ * A request for a file rather than a page.
+ *
+ * Assets are allowed through unauthenticated because the sign-in page needs
+ * its stylesheet and scripts to render at all, and because a filename is not
+ * the data being protected. The test is deliberately narrow: a trailing
+ * extension, or one of the runtime's own prefixes. Every extensionless path -
+ * which is what a dashboard page looks like - falls through to the gate.
+ */
+export declare function isAssetPath(pathname: string): boolean;
+/**
+ * Whether this request even reaches the page layer.
+ *
+ * Anything under `/api/` and every mutating verb belongs to the router, which
+ * authenticates on its own terms - a POST to `/login` has to arrive
+ * unauthenticated, by definition. Gating those here would either break sign-in
+ * or double-gate an endpoint that already returns 401.
+ */
+export declare function isDelegatedRequest(method: string, pathname: string): boolean;
+/**
+ * Decide whether a dashboard request may be rendered.
+ *
+ * `validate` resolves a token to its user, or to anything falsy for a token
+ * that is forged, expired or revoked - the same check a bearer token gets. It
+ * throwing counts as invalid: a malformed token that breaks the lookup is not
+ * an authenticated visitor.
+ */
+export declare function decideDashboardAccess(request: { method: string, pathname: string, token: string | undefined }, validate: (token: string) => Promise<unknown>, options?: GateOptions): Promise<GateDecision>;
+export declare interface GateOptions {
+  publicPaths?: readonly string[]
+}
+/**
+ * Who may see a dashboard page in production.
+ *
+ * The dev dashboard runs with `auth: false` on purpose - it serves one
+ * developer on localhost. Deploying that same server unchanged publishes every
+ * staff page to the internet, so this is the piece that has to exist before a
+ * dashboard can be exposed at all.
+ *
+ * DENY BY DEFAULT is the whole design. stx's page middleware
+ * (`definePageMeta({ middleware: ['auth'] })`) is opt-in per page, which means
+ * a page that forgets the declaration is public - and in the app this was
+ * built for, ZERO of eleven dashboard pages declared it. An allowlist of the
+ * few pages that must render signed-out is the only shape where forgetting
+ * something fails closed.
+ *
+ * The decision is pure and lives here alone so it can be tested without a
+ * server, a database or a browser. `serve/dashboard.ts` only supplies the
+ * request and a token validator.
+ */
+/** What the gate decided, and why. */
+export type GateDecision = | { allow: true, reason: 'public-page' | 'asset' | 'delegated' }
+  /** Render it: a valid session was presented. */
+  | { allow: true, reason: 'authenticated' }
+  /** Send them to sign in. */
+  | { allow: false, reason: 'no-session' | 'invalid-session' }

package/dist/serve/dashboard-gate.js

@@ -0,0 +1 @@
+const DEFAULT_PUBLIC_PATHS=["/login","/health"];export function isAssetPath(pathname){if(pathname.startsWith("/_stx/")||pathname.startsWith("/@"))return!0;return pathname.slice(pathname.lastIndexOf("/")+1).includes(".")}export function isDelegatedRequest(method,pathname){if(pathname==="/api"||pathname.startsWith("/api/"))return!0;return method!=="GET"&&method!=="HEAD"}export async function decideDashboardAccess(request,validate,options={}){const publicPaths=options.publicPaths??DEFAULT_PUBLIC_PATHS;if(isDelegatedRequest(request.method,request.pathname))return{allow:!0,reason:"delegated"};if(isAssetPath(request.pathname))return{allow:!0,reason:"asset"};const pathname=request.pathname.length>1?request.pathname.replace(/\/+$/,""):request.pathname;if(publicPaths.includes(pathname))return{allow:!0,reason:"public-page"};if(!request.token)return{allow:!1,reason:"no-session"};try{if(await validate(request.token))return{allow:!0,reason:"authenticated"}}catch{}return{allow:!1,reason:"invalid-session"}}

package/dist/serve/dashboard.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/serve/dashboard.js

@@ -0,0 +1 @@
+import{existsSync}from"node:fs";import{join}from"node:path";import process from"node:process";import{projectPath,publicPath}from"@stacksjs/path";import{resolveDefaultsRoot}from"../dev/defaults-resources";import{decideDashboardAccess}from"./dashboard-gate";process.env.APP_ENV||="production";process.env.NODE_ENV||="production";const port=Number(process.env.PORT_DASHBOARD||process.env.PORT)||3002,defaultsRoot=resolveDefaultsRoot(),frameworkDashboard=join(defaultsRoot,"views/dashboard"),appDashboard=projectPath("resources/views/dashboard"),{authCookieName}=await import("@stacksjs/auth"),authCookie=authCookieName();function readCookie(header,name){if(!header)return;for(const part of header.split(";")){const raw=part.trim(),eq=raw.indexOf("=");if(eq<1)continue;if(raw.slice(0,eq)===name)return decodeURIComponent(raw.slice(eq+1))}return}const router=await import("@stacksjs/router"),routeRegistry=(await import(projectPath("app/Routes.ts"))).default;await router.loadRoutes(routeRegistry);const{Auth}=await import("@stacksjs/auth"),{serve}=await import("bun-plugin-stx/serve");await serve({patterns:[appDashboard,frameworkDashboard].filter((dir)=>existsSync(dir)),port,layoutsDir:frameworkDashboard,partialsDir:frameworkDashboard,componentsDir:join(defaultsRoot,"resources/components/Dashboard"),publicDir:publicPath(),quiet:!0,onRequest:async(req)=>{const url=new URL(req.url);if((await decideDashboardAccess({method:req.method,pathname:url.pathname,token:readCookie(req.headers.get("cookie"),authCookie)},(token)=>Auth.getUserFromToken(token))).allow)return null;const next=encodeURIComponent(url.pathname+url.search);return new Response(null,{status:302,headers:{location:`/login?next=${next}`,"cache-control":"no-store, private"}})}});console.log(`Dashboard server listening on port ${port}`);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/actions",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.18",
+  "version": "0.72.19",
   "description": "The Stacks actions.",
   "author": "Chris Breuer",
   "contributors": [
@@ -59,35 +59,35 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/config": "0.72.18",
+    "@stacksjs/config": "0.72.19",
     "@stacksjs/bumpx": "^0.2.6",
     "@stacksjs/bunpress": "^0.2.6",
     "@stacksjs/logsmith": "^0.2.3",
-    "@stacksjs/registry": "0.72.18",
+    "@stacksjs/registry": "0.72.19",
     "@stacksjs/stx": "^0.2.184",
     "@stacksjs/ts-cloud": "^0.8.3",
     "@stacksjs/ts-md": "^0.1.1"
   },
   "devDependencies": {
-    "@stacksjs/api": "0.72.18",
-    "@stacksjs/cli": "0.72.18",
-    "@stacksjs/database": "0.72.18",
+    "@stacksjs/api": "0.72.19",
+    "@stacksjs/cli": "0.72.19",
+    "@stacksjs/database": "0.72.19",
     "@stacksjs/tlsx": "^0.13.2",
     "better-dx": "^0.2.23",
-    "@stacksjs/dns": "0.72.18",
-    "@stacksjs/enums": "0.72.18",
-    "@stacksjs/env": "0.72.18",
-    "@stacksjs/error-handling": "0.72.18",
-    "@stacksjs/image": "0.72.18",
-    "@stacksjs/logging": "0.72.18",
-    "@stacksjs/path": "0.72.18",
-    "@stacksjs/security": "0.72.18",
-    "@stacksjs/cms": "0.72.18",
-    "@stacksjs/sites": "0.72.18",
-    "@stacksjs/storage": "0.72.18",
-    "@stacksjs/strings": "0.72.18",
-    "@stacksjs/utils": "0.72.18",
-    "@stacksjs/validation": "0.72.18"
+    "@stacksjs/dns": "0.72.19",
+    "@stacksjs/enums": "0.72.19",
+    "@stacksjs/env": "0.72.19",
+    "@stacksjs/error-handling": "0.72.19",
+    "@stacksjs/image": "0.72.19",
+    "@stacksjs/logging": "0.72.19",
+    "@stacksjs/path": "0.72.19",
+    "@stacksjs/security": "0.72.19",
+    "@stacksjs/cms": "0.72.19",
+    "@stacksjs/sites": "0.72.19",
+    "@stacksjs/storage": "0.72.19",
+    "@stacksjs/strings": "0.72.19",
+    "@stacksjs/utils": "0.72.19",
+    "@stacksjs/validation": "0.72.19"
   },
   "peerDependencies": {
     "pickier": "^0.1.35",