@stacksjs/defaults 0.74.56 → 0.74.58

package/app/Actions/Auth/LoginAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, createTwoFactorChallenge, getTwoFactorState, resolveBrowserSessionPolicy } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 import { PASSWORD_MAX_LENGTH, PASSWORD_PRESENCE_MESSAGE } from '../../password-policy'
@@ -28,6 +28,7 @@ export default new Action({
   async handle(request: RequestInstance) {
     const email = request.get('email')
     const password = request.get('password')
+    const remember = request.get('remember')
 
     // Verify once, then keep the observed password version locked while
     // choosing and issuing the challenge or token. A completed password reset
@@ -37,7 +38,14 @@ export default new Action({
       if (twoFactorEnabled) {
         return { kind: 'challenge' as const, token: await createTwoFactorChallenge(authedUser.id as number) }
       }
-      return { kind: 'login' as const, result: await Auth.loginUsingId(authedUser.id as number) }
+      const policy = resolveBrowserSessionPolicy(remember)
+      return {
+        kind: 'login' as const,
+        result: await Auth.loginUsingId(authedUser.id as number, {
+          expiresInMinutes: policy.expiresInMinutes,
+          withRefreshToken: policy.withRefreshToken,
+        }),
+      }
     })
     if (!decision)
       return response.unauthorized('Incorrect email or password')
@@ -84,6 +92,6 @@ export default new Action({
         email: user?.email,
         name: user?.name,
       },
-    }, { headers: { 'Set-Cookie': authCookie(result.token) } })
+    }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.token, result.expiresIn) } })
   },
 })

package/app/Actions/Auth/MagicLinkConsumeAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, consumeMagicLink } from '@stacksjs/auth'
+import { Auth, authCookie, withMagicLink } from '@stacksjs/auth'
 import { config } from '@stacksjs/config'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
@@ -20,7 +20,10 @@ export default new Action({
     if (!config.auth.magicLink?.enabled)
       return response.notFound('Magic-link sign-in is not enabled')
 
-    const consumed = await consumeMagicLink(String(request.get('token')))
+    const consumed = await withMagicLink(String(request.get('token')), async grant => ({
+      grant,
+      result: await Auth.loginUsingId(grant.userId),
+    }))
     if (!consumed.ok) {
       const messages: Record<string, string> = {
         invalid: 'That sign-in link is not valid.',
@@ -33,7 +36,7 @@ export default new Action({
 
     // The same token pack + httpOnly cookie a password login issues, so
     // stxPageAuthMiddleware-gated pages treat passwordless users identically.
-    const result = await Auth.loginUsingId(consumed.userId)
+    const { grant, result } = consumed.value
     if (!result)
       return response.unauthorized('That sign-in link is not valid.')
 
@@ -42,7 +45,7 @@ export default new Action({
       refresh_token: result.refreshToken,
       token_type: 'Bearer',
       expires_in: result.expiresIn,
-      redirect_to: consumed.redirectTo,
+      redirect_to: grant.redirectTo,
       user: {
         id: result.user?.id,
         email: result.user?.email,

package/app/Actions/Auth/VerifyTwoFactorLoginAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, consumeTwoFactorChallenge, verifyTwoFactorLoginCode } from '@stacksjs/auth'
+import { Auth, authCookie, verifyTwoFactorLoginCode, withTwoFactorChallenge } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
@@ -27,17 +27,12 @@ export default new Action({
     // (whether the code was right or wrong) must start over from
     // LoginAction, not retry — mirrors the WebAuthn challenge
     // delete-on-read semantics in passkey.ts (stacksjs/stacks#1866).
-    const userId = await consumeTwoFactorChallenge(challengeToken)
-    if (!userId)
-      return response.unauthorized('This login attempt has expired — please sign in again.')
-
-    const valid = await verifyTwoFactorLoginCode(userId, code)
-    if (!valid)
-      return response.unauthorized('Invalid code — please sign in again.')
-
-    const result = await Auth.loginUsingId(userId)
+    const result = await withTwoFactorChallenge(challengeToken, async (userId) => {
+      if (!await verifyTwoFactorLoginCode(userId, code)) return null
+      return Auth.loginUsingId(userId)
+    })
     if (!result)
-      return response.unauthorized('Invalid code — please sign in again.')
+      return response.unauthorized('Invalid or expired login attempt. Please sign in again.')
 
     const user = result.user
 

package/app/Middleware/Csrf.ts

@@ -159,7 +159,7 @@ export function createCsrfCookie(req: Request, minted?: string): string {
  * behaviour: it says nothing about what the browser is looking at.
  */
 export function responseMayUseCsrfToken(response: Response): boolean {
-  const type = (response.headers.get('content-type') || '').split(';')[0].trim().toLowerCase()
+  const type = ((response.headers.get('content-type') || '').split(';')[0] ?? '').trim().toLowerCase()
   if (!type)
     return true
   return type === 'text/html'

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.56",
+  "version": "0.74.58",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.56",
+  "version": "0.74.58",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.56",
+    "@stacksjs/mobile": "^0.74.58",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/vcs/github/workflows/deploy.yml

@@ -28,10 +28,53 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # Is the commit CI passed still the tip of main?
+  #
+  # Deploys queue one at a time, and each checks out the commit its CI run
+  # was for. CI runs are not ordered: when two pushes land close together the
+  # older one can finish CI last, and its deploy then replaces the newer
+  # release with both deploys green. Checked here, when the deploy's turn
+  # comes: if main has moved on, the newer commit's own CI run deploys it.
+  current:
+    if: github.event_name == 'workflow_run'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      latest: ${{ steps.tip.outputs.latest }}
+    steps:
+      - id: tip
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          tip=$(gh api "repos/${{ github.repository }}/commits/main" --jq .sha)
+          if [ "$tip" = "$SHA" ]; then
+            echo "latest=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "latest=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Skipping ${SHA:0:8}: main is at ${tip:0:8}, whose CI run deploys it."
+          fi
+
   deploy:
+    needs: current
     # `workflow_run` fires for failed runs too — that is the point of the
     # gate, so check the conclusion.
-    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    #
+    # And check what CI ran on. CI also runs for pull requests, and
+    # `branches: [main]` matches the head branch name, so a fork's PR from a
+    # branch called `main` that passed CI would deploy the fork's commit with
+    # the production secrets. Only a push to this repository ships.
+    #
+    # `always()` because `current` is skipped for a manual dispatch, which
+    # ships whatever it was pointed at.
+    if: >-
+      always() && (
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      needs.current.outputs.latest == 'true'))
     runs-on: ubuntu-latest
     # Attach a GitHub Environment to get required reviewers and to scope these
     # secrets to it.