@stacksjs/defaults 0.74.24 → 0.74.25

package/ai/skills/stacks-api/SKILL.md

@@ -80,7 +80,9 @@ The dev server watches these directories for changes and auto-reloads:
 - `app/Actions/` -- invalidates module cache, hot-reloads actions
 - `app/Controllers/` -- invalidates module cache, hot-reloads controllers
 - `app/Middleware/` -- invalidates module cache, hot-reloads middleware
-- `app/Models/` (user models) -- triggers `buddy generate:model-files`
+- `app/Models/` (user models) -- regenerates the model artifacts (there is no
+  `generate:model-files` command; the dev server does this itself, and
+  `buddy generate:types` is the manual equivalent)
 
 Production build: `bun build.ts` bundles `dev.ts` to `dist/dev.js`.
 
@@ -805,7 +807,9 @@ the foreign-key attributes derived from `belongsTo`. For example,
 ## CLI Commands
 
 - `buddy dev` -- starts the API server with hot-reload
-- `buddy generate:api-types` -- regenerates API TypeScript types from OpenAPI spec
+- `buddy generate:types` -- regenerates the API TypeScript types and server
+  declarations (there is no `generate:api-types`)
+- `buddy generate:openapi-spec` -- regenerates the OpenAPI spec those types come from
 
 ## Gotchas
 

package/ai/skills/stacks-investigate/SKILL.md

@@ -45,7 +45,7 @@ up.
    fixture payload.
 3. **CLI invocation**, for instance `buddy <command>` with a fixture input,
    diffing stdout against a known-good snapshot.
-4. **REPL probe**. `buddy repl` reaches models, config and the query builder
+4. **REPL probe**. `buddy tinker` reaches models, config and the query builder
    directly, which is the fastest loop for an ORM or relationship bug.
 5. **Headless browser script**. `/stacks-browse` drives a real browser over CDP
    and asserts on DOM, console and network with nothing to install.
@@ -177,7 +177,7 @@ time.**
 Tool preference:
 
 1. **REPL or debugger inspection** where the environment supports it. One
-   breakpoint beats ten logs, and `buddy repl` is usually reachable.
+   breakpoint beats ten logs, and `buddy tinker` is usually reachable.
 2. **Targeted logs** at the boundaries that distinguish the hypotheses, via
    `log.debug()` from `@stacksjs/logging`.
 3. Never "log everything and grep".

package/app/Middleware/Csrf.ts

@@ -1,5 +1,4 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto'
-import { Buffer } from 'node:buffer'
 import { HttpError } from '@stacksjs/error-handling'
 import type { EnhancedRequest } from '@stacksjs/bun-router'
 import { Middleware } from '@stacksjs/router'
@@ -62,6 +61,7 @@ import { Middleware } from '@stacksjs/router'
 export const CSRF_COOKIE_NAME = 'X-CSRF-Token'
 const CSRF_HEADER_NAME = 'x-csrf-token'
 const TOKEN_BYTES = 32
+const TOKEN_ENCODER = new TextEncoder()
 
 /**
  * Generate a fresh CSRF token (hex-encoded, 32 random bytes → 64 chars).
@@ -168,21 +168,25 @@ export function seedCsrfCookieIfMissing(req: Request, response: Response, minted
 }
 
 /**
- * Parse the Cookie header into a key→value map.
- * Lenient: malformed pairs are skipped, not thrown.
+ * Read just the CSRF cookies without building a map of unrelated cookies.
+ * Last duplicate wins; the canonical name takes precedence over the legacy
+ * name unless its final value is empty. Malformed pairs are skipped.
  */
-function parseCookies(req: Request): Record<string, string> {
+function csrfCookieToken(req: Request): string {
   const header = req.headers.get('cookie')
-  if (!header) return {}
-  const out: Record<string, string> = {}
+  if (!header) return ''
+  let canonical = ''
+  let legacy = ''
   for (const part of header.split(';')) {
     const idx = part.indexOf('=')
     if (idx === -1) continue
-    const k = part.slice(0, idx).trim()
-    const v = part.slice(idx + 1).trim()
-    if (k) out[k] = v
+    const name = part.slice(0, idx).trim()
+    if (name === CSRF_COOKIE_NAME)
+      canonical = part.slice(idx + 1).trim()
+    else if (name === 'csrf-token')
+      legacy = part.slice(idx + 1).trim()
   }
-  return out
+  return canonical || legacy
 }
 
 /**
@@ -193,7 +197,7 @@ function safeEqual(a: string, b: string): boolean {
   if (typeof a !== 'string' || typeof b !== 'string') return false
   if (a.length !== b.length) return false
   try {
-    return timingSafeEqual(Buffer.from(a), Buffer.from(b))
+    return timingSafeEqual(TOKEN_ENCODER.encode(a), TOKEN_ENCODER.encode(b))
   }
   catch {
     return false
@@ -256,8 +260,7 @@ export async function validateCsrfRequest(request: Request | EnhancedRequest): P
     || (typeof bodyToken === 'string' && bodyToken)
     || ''
 
-  const cookies = parseCookies(request)
-  const cookieToken = cookies[CSRF_COOKIE_NAME] || cookies['csrf-token'] || ''
+  const cookieToken = csrfCookieToken(request)
 
   if (!submitted || !cookieToken || !safeEqual(submitted, cookieToken)) {
     // 419 is the convention Laravel popularized for "CSRF token

package/app/Models/Board.ts

@@ -33,10 +33,23 @@ export default defineModel({
     useApi: {
       uri: 'boards',
       routes: ['index', 'store', 'show', 'update', 'destroy'],
-      middleware: ['auth'],
+      // Team-owned since #2412, so the active-team guard applies - the
+      // contract in tests/unit/default-team-api-scope-contract.test.ts.
+      middleware: ['auth', 'team'],
     },
   },
 
+  /*
+   * A board belongs to a team, which is what makes it - and everything on it -
+   * scopable. Without this, `Board` had no foreign key at all, so row scoping
+   * had nothing to resolve and withheld `store`/`update`/`destroy`: a kanban
+   * board with no create endpoint (stacksjs/stacks#2412).
+   *
+   * `BoardColumn` and `Label` chain to here, so this one column scopes all
+   * three.
+   */
+  belongsTo: ['Team'],
+
   hasMany: ['BoardColumn', 'Label'],
 
   attributes: {

package/app/Models/BoardColumn.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -40,6 +40,9 @@ export default defineModel({
   },
 
   belongsTo: ['Board'],
+
+  // Owned by whoever owns the board it sits on (stacksjs/stacks#2412).
+  ownership: parentOwnership('Board', 'board_id'),
   hasMany: ['Card'],
 
   attributes: {

package/app/Models/Label.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -39,6 +39,9 @@ export default defineModel({
 
   belongsTo: ['Board'],
 
+  // Owned by whoever owns the board it sits on (stacksjs/stacks#2412).
+  ownership: parentOwnership('Board', 'board_id'),
+
   attributes: {
     boardId: {
       order: 1,

package/app/Models/commerce/DigitalDelivery.ts

@@ -7,6 +7,17 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+
+  /*
+   * A delivery policy, not a delivery. Its columns are `name`,
+   * `downloadLimit`, `expiryDays`, `requiresLogin` and `automaticDelivery` -
+   * a reusable configuration attached to what is sold, with no customer, order
+   * or file on it. #2412 guessed this "almost certainly belongs to an order or
+   * a customer"; the attributes say otherwise, so it is declared a catalog
+   * record and its writes want an admin gate rather than row scoping.
+   */
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/LoyaltyPoint.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,18 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+
+  /*
+   * Points belong to a customer. The model carried `walletId`, pointing at a
+   * `LoyaltyWallet` that was never built, so nothing resolved an owner and the
+   * writes stayed denied (stacksjs/stacks#2412). Scoping by customer is the
+   * additive half of that issue's second option; `walletId` is left alone
+   * because repointing an existing column is a data decision of its own.
+   */
+  belongsTo: ['Customer'],
+
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Pledge.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -34,7 +34,14 @@ export default defineModel({
     observe: true,
   },
 
-  belongsTo: ['Auction'],
+  /*
+   * A pledge is made BY someone. It chained only to `Auction`, an unscoped
+   * catalog, so there was no owner to resolve and its writes stayed denied
+   * (stacksjs/stacks#2412).
+   */
+  belongsTo: ['Auction', 'Customer'],
+
+  ownership: customerOwnership(),
 
   indexes: [
     { name: 'pledges_auction_id_index', columns: ['auction_id'] },

package/app/Models/commerce/Receipt.ts

@@ -18,6 +18,14 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   belongsTo: ['PrintDevice'],
+
+  /*
+   * A receipt is a record OF a device, not of a customer - it chains to
+   * `PrintDevice`, an unscoped catalog. Saying so explicitly is the honest
+   * declaration; its writes want an admin gate rather than row scoping
+   * (stacksjs/stacks#2412).
+   */
+  ownership: false,
   traits: {
     useUuid: true,
     useTimestamps: true,

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.24",
+  "version": "0.74.25",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.24",
+  "version": "0.74.25",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.24",
+    "@stacksjs/mobile": "^0.74.25",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }