@stacksjs/defaults 0.70.293 → 0.70.295

package/app/Models/Content/Author.ts

@@ -32,6 +32,11 @@ export default defineModel({
     // (content/blog/*.md); this model backs the CMS dashboard only.
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'authors',
 
       routes: ['index', 'store', 'show', 'update', 'destroy'],

package/app/Models/Content/Page.ts

@@ -17,6 +17,11 @@ export default defineModel({
       filterable: ['template'],
     },
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'pages',
       routes: ['index', 'store', 'show', 'update', 'destroy'],
     },

package/app/Models/Content/Post.ts

@@ -24,6 +24,11 @@ export default defineModel({
     // trait targets the real `commentables` table, activating it is correct.
     commentable: true,
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'posts',
       routes: ['index', 'store', 'show', 'update', 'destroy'],
     },

package/app/Models/Release.ts

@@ -18,6 +18,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'releases',
       routes: ['index', 'show'],
     },

package/app/Models/Tag.ts

@@ -33,6 +33,11 @@ export default defineModel({
       fixtures: tagNames.map(name => ({ name, slug: name })),
     },
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'tags',
       routes: ['index', 'store', 'show', 'update', 'destroy'],
     },

package/app/Models/commerce/Category.ts

@@ -23,6 +23,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'product-categories',
     },
 

package/app/Models/commerce/LoyaltyReward.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'loyalty-rewards',
     },
 

package/app/Models/commerce/Manufacturer.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'product-manufacturers',
     },
 

package/app/Models/commerce/Product.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'products',
     },
 

package/app/Models/commerce/ProductUnit.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'product-units',
     },
 

package/app/Models/commerce/ProductVariant.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'product-variants',
     },
 

package/app/Models/commerce/ShippingMethod.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'shipping-methods',
     },
 

package/app/Models/commerce/ShippingRate.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'shipping-rates',
     },
 

package/app/Models/commerce/ShippingZone.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'shipping-zones',
     },
 

package/app/Models/commerce/TaxRate.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'tax-rates',
     },
 

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.293",
+  "version": "0.70.295",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.293",
+  "version": "0.70.295",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",