@stacksjs/defaults 0.74.53 → 0.74.56

package/ai/skills/stacks-auth/SKILL.md

@@ -258,7 +258,7 @@ interface RbacStore { findRoleByName, createRole, deleteRole, getAllRoles, findP
 - `SessionAuth.logout(sessionId): void`
 - `SessionAuth.user(sessionId): Promise<UserModel | undefined>`
 - `SessionAuth.check(sessionId): boolean`
-- `SessionAuth.refresh(sessionId, ttlMs?): boolean`
+- `SessionAuth.refresh(sessionId, ttlMs?): boolean`, rejects non-positive or non-finite TTLs without changing the session
 
 Internal: in-memory Map with 10k session limit, 5-minute eviction interval, timing-safe password comparison with dummy bcrypt hash.
 

package/ai/skills/stacks-database/SKILL.md

@@ -86,6 +86,12 @@ const users = await db.selectFrom('users').where('active', '=', true).get()
 
 `initializeDbConfig(config)` can be called to update the backing config at runtime.
 
+For reads which cannot tolerate replication lag, use `db.primary.selectFrom(...)`.
+It stays on the primary when automatic replica routing is enabled, and uses the
+active transaction connection inside a transaction. It does not mark the request
+as a writer or change routing for unrelated reads. Session authentication uses
+this handle so a revoked session cannot authenticate from a stale replica.
+
 ## SQL Template Tag (types.ts)
 
 ```typescript

package/app/Actions/Auth/DisableTwoFactorAction.ts

@@ -26,12 +26,17 @@ export default new Action({
     // rather than trusting the bearer token alone (a stolen/leaked
     // token shouldn't be enough to turn off the second factor it's
     // meant to help guard against).
-    const confirmed = await Auth.validate({ email: user.email, password })
+    // Bind reconfirmation to the same account and password version while
+    // disabling. A concurrent password reset must invalidate this request.
+    const confirmed = await Auth.withVerifiedCredentials({ email: user.email, password }, async (verifiedUser) => {
+      if (String(verifiedUser.id) !== String(user.id))
+        return false
+      await disableTwoFactor(user.id as number)
+      return true
+    })
     if (!confirmed)
       return response.unauthorized('Incorrect password')
 
-    await disableTwoFactor(user.id as number)
-
     return response.json({ enabled: false })
   },
 })

package/app/Actions/Auth/LoginAction.ts

@@ -1,6 +1,5 @@
 import { Action } from '@stacksjs/actions'
 import { Auth, authCookie, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/auth'
-import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 import { PASSWORD_MAX_LENGTH, PASSWORD_PRESENCE_MESSAGE } from '../../password-policy'
@@ -30,28 +29,27 @@ export default new Action({
     const email = request.get('email')
     const password = request.get('password')
 
-    // Verify credentials WITHOUT minting tokens yet — if the account
-    // has TOTP 2FA enabled, no token pack should exist until the code
-    // is also verified (VerifyTwoFactorLoginAction mints the real
-    // pack via Auth.loginUsingId, same as the non-2FA path below).
-    const isValid = await Auth.attempt({ email, password })
-    if (!isValid)
+    // Verify once, then keep the observed password version locked while
+    // choosing and issuing the challenge or token. A completed password reset
+    // cannot be followed by this old in-flight login minting fresh access.
+    const decision = await Auth.withVerifiedCredentials({ email, password }, async (authedUser) => {
+      const { enabled: twoFactorEnabled } = await getTwoFactorState(authedUser.id as number)
+      if (twoFactorEnabled) {
+        return { kind: 'challenge' as const, token: await createTwoFactorChallenge(authedUser.id as number) }
+      }
+      return { kind: 'login' as const, result: await Auth.loginUsingId(authedUser.id as number) }
+    })
+    if (!decision)
       return response.unauthorized('Incorrect email or password')
 
-    const authedUser = await User.where('email', '=', email).first()
-    if (!authedUser)
-      return response.unauthorized('Incorrect email or password')
-
-    const { enabled: twoFactorEnabled } = await getTwoFactorState(authedUser.id as number)
-    if (twoFactorEnabled) {
-      const challengeToken = await createTwoFactorChallenge(authedUser.id as number)
+    if (decision.kind === 'challenge') {
       return response.json({
         requires_two_factor: true,
-        challenge_token: challengeToken,
+        challenge_token: decision.token,
       })
     }
 
-    const result = await Auth.loginUsingId(authedUser.id as number)
+    const result = decision.result
     if (!result)
       return response.unauthorized('Incorrect email or password')
 

package/app/Middleware/Csrf.ts

@@ -1,7 +1,7 @@
 import { timingSafeEqual } from 'node:crypto'
-import { HttpError } from '@stacksjs/error-handling'
+import { HttpError } from '@stacksjs/error-handling/http-error'
 import type { EnhancedRequest } from '@stacksjs/router'
-import { Middleware } from '@stacksjs/router'
+import { Middleware } from '@stacksjs/router/middleware'
 
 /**
  * CSRF Protection Middleware (default-on for unsafe methods)
@@ -144,7 +144,34 @@ export function createCsrfCookie(req: Request, minted?: string): string {
   return `${CSRF_COOKIE_PREFIX}${token}${suffix}`
 }
 
+/**
+ * Whether a browser could go on to use a CSRF token from this response.
+ *
+ * A page carries the forms that submit it, and an API answer is what an SPA
+ * reads before its next request. A stylesheet, script, font or image is
+ * neither, and a cookie on one is worse than useless: a response that sets a
+ * cookie is one no shared cache will store, so seeding every static file kept
+ * the site's whole asset set out of the CDN (every file came back
+ * `cf-cache-status: BYPASS`). A cacheable file carrying a per-visitor token is
+ * also the shape of a leak, should any cache in the path store it anyway.
+ *
+ * No content type at all (a redirect, an empty answer) keeps the old
+ * behaviour: it says nothing about what the browser is looking at.
+ */
+export function responseMayUseCsrfToken(response: Response): boolean {
+  const type = (response.headers.get('content-type') || '').split(';')[0].trim().toLowerCase()
+  if (!type)
+    return true
+  return type === 'text/html'
+    || type === 'application/xhtml+xml'
+    || type === 'application/json'
+    || type.endsWith('+json')
+}
+
 export function seedCsrfCookieIfMissing(req: Request, response: Response, minted?: string, responseHasNoCookies = false): Response {
+  if (!responseMayUseCsrfToken(response))
+    return response
+
   // A token the router minted before rendering wins over "the header already
   // has one", because it put that value in the header itself - and the page
   // has already embedded it in every form it drew. Generating a second token

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.53",
+  "version": "0.74.56",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.53",
+  "version": "0.74.56",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.53",
+    "@stacksjs/mobile": "^0.74.56",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }