@stacksjs/defaults 0.74.52 → 0.74.55

package/ai/skills/stacks-auth/SKILL.md

@@ -258,7 +258,7 @@ interface RbacStore { findRoleByName, createRole, deleteRole, getAllRoles, findP
 - `SessionAuth.logout(sessionId): void`
 - `SessionAuth.user(sessionId): Promise<UserModel | undefined>`
 - `SessionAuth.check(sessionId): boolean`
-- `SessionAuth.refresh(sessionId, ttlMs?): boolean`
+- `SessionAuth.refresh(sessionId, ttlMs?): boolean`, rejects non-positive or non-finite TTLs without changing the session
 
 Internal: in-memory Map with 10k session limit, 5-minute eviction interval, timing-safe password comparison with dummy bcrypt hash.
 

package/ai/skills/stacks-database/SKILL.md

@@ -86,6 +86,12 @@ const users = await db.selectFrom('users').where('active', '=', true).get()
 
 `initializeDbConfig(config)` can be called to update the backing config at runtime.
 
+For reads which cannot tolerate replication lag, use `db.primary.selectFrom(...)`.
+It stays on the primary when automatic replica routing is enabled, and uses the
+active transaction connection inside a transaction. It does not mark the request
+as a writer or change routing for unrelated reads. Session authentication uses
+this handle so a revoked session cannot authenticate from a stale replica.
+
 ## SQL Template Tag (types.ts)
 
 ```typescript

package/app/Actions/Auth/LoginAction.ts

@@ -1,6 +1,5 @@
 import { Action } from '@stacksjs/actions'
 import { Auth, authCookie, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/auth'
-import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 import { PASSWORD_MAX_LENGTH, PASSWORD_PRESENCE_MESSAGE } from '../../password-policy'
@@ -30,28 +29,27 @@ export default new Action({
     const email = request.get('email')
     const password = request.get('password')
 
-    // Verify credentials WITHOUT minting tokens yet — if the account
-    // has TOTP 2FA enabled, no token pack should exist until the code
-    // is also verified (VerifyTwoFactorLoginAction mints the real
-    // pack via Auth.loginUsingId, same as the non-2FA path below).
-    const isValid = await Auth.attempt({ email, password })
-    if (!isValid)
+    // Verify once, then keep the observed password version locked while
+    // choosing and issuing the challenge or token. A completed password reset
+    // cannot be followed by this old in-flight login minting fresh access.
+    const decision = await Auth.withVerifiedCredentials({ email, password }, async (authedUser) => {
+      const { enabled: twoFactorEnabled } = await getTwoFactorState(authedUser.id as number)
+      if (twoFactorEnabled) {
+        return { kind: 'challenge' as const, token: await createTwoFactorChallenge(authedUser.id as number) }
+      }
+      return { kind: 'login' as const, result: await Auth.loginUsingId(authedUser.id as number) }
+    })
+    if (!decision)
       return response.unauthorized('Incorrect email or password')
 
-    const authedUser = await User.where('email', '=', email).first()
-    if (!authedUser)
-      return response.unauthorized('Incorrect email or password')
-
-    const { enabled: twoFactorEnabled } = await getTwoFactorState(authedUser.id as number)
-    if (twoFactorEnabled) {
-      const challengeToken = await createTwoFactorChallenge(authedUser.id as number)
+    if (decision.kind === 'challenge') {
       return response.json({
         requires_two_factor: true,
-        challenge_token: challengeToken,
+        challenge_token: decision.token,
       })
     }
 
-    const result = await Auth.loginUsingId(authedUser.id as number)
+    const result = decision.result
     if (!result)
       return response.unauthorized('Incorrect email or password')
 

package/app/Middleware/Csrf.ts

@@ -1,7 +1,7 @@
 import { timingSafeEqual } from 'node:crypto'
-import { HttpError } from '@stacksjs/error-handling'
+import { HttpError } from '@stacksjs/error-handling/http-error'
 import type { EnhancedRequest } from '@stacksjs/router'
-import { Middleware } from '@stacksjs/router'
+import { Middleware } from '@stacksjs/router/middleware'
 
 /**
  * CSRF Protection Middleware (default-on for unsafe methods)

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.52",
+  "version": "0.74.55",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.52",
+  "version": "0.74.55",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.52",
+    "@stacksjs/mobile": "^0.74.55",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }