@stacksjs/defaults 0.70.276 → 0.70.278

package/app/Middleware/Csrf.ts

@@ -77,7 +77,9 @@ export function generateCsrfToken(): string {
 
 /**
  * Seed the CSRF cookie on the outgoing response if the incoming request
- * didn't already carry one. Used by the router as a post-response step
+ * didn't already carry one, or with the token the router minted before
+ * rendering (`minted`) so a server-rendered page's forms and the browser's
+ * cookie hold the same string. Used by the router as a post-response step
  * on safe-method (GET/HEAD/OPTIONS) responses so SPAs get a usable
  * cookie value before they ever submit an unsafe request.
  *
@@ -95,13 +97,19 @@ export function generateCsrfToken(): string {
  * - 2-hour `Max-Age` — short enough to limit replay if leaked, long
  *   enough that idle tabs don't constantly re-fetch tokens
  */
-export function seedCsrfCookieIfMissing(req: Request, response: Response): Response {
+export function seedCsrfCookieIfMissing(req: Request, response: Response, minted?: string): Response {
   const cookieHeader = req.headers.get('cookie') || ''
-  if (cookieHeader.includes(`${CSRF_COOKIE_NAME}=`) || cookieHeader.includes('csrf-token=')) {
+
+  // A token the router minted before rendering wins over "the header already
+  // has one", because it put that value in the header itself - and the page
+  // has already embedded it in every form it drew. Generating a second token
+  // here would store one string in the browser while the page carries another,
+  // which fails in a way indistinguishable from having no token at all.
+  if (!minted && (cookieHeader.includes(`${CSRF_COOKIE_NAME}=`) || cookieHeader.includes('csrf-token='))) {
     return response
   }
 
-  const token = generateCsrfToken()
+  const token = minted || generateCsrfToken()
   const isSecure = req.url.startsWith('https://')
   const cookie = [
     `${CSRF_COOKIE_NAME}=${token}`,

package/app/Models/Notification.ts

@@ -38,6 +38,7 @@ export default defineModel({
     },
 
     data: {
+      type: 'text',
       required: true,
       fillable: true,
       validation: {

package/app/Models/NotificationDelivery.ts

@@ -32,6 +32,7 @@ export default defineModel({
     },
 
     channel: {
+      type: 'string',
       required: true,
       fillable: true,
       validation: {
@@ -64,6 +65,7 @@ export default defineModel({
     },
 
     status: {
+      type: 'string',
       required: true,
       fillable: true,
       default: 'pending',
@@ -81,6 +83,7 @@ export default defineModel({
     },
 
     metadata: {
+      type: 'text',
       required: false,
       fillable: true,
       validation: {

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.276",
+  "version": "0.70.278",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.276",
+  "version": "0.70.278",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",