@stacksjs/defaults 0.74.57 → 0.74.59

package/app/Actions/Auth/LoginAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, createTwoFactorChallenge, getTwoFactorState, resolveBrowserSessionPolicy } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 import { PASSWORD_MAX_LENGTH, PASSWORD_PRESENCE_MESSAGE } from '../../password-policy'
@@ -28,16 +28,27 @@ export default new Action({
   async handle(request: RequestInstance) {
     const email = request.get('email')
     const password = request.get('password')
+    const remember = request.get('remember')
 
     // Verify once, then keep the observed password version locked while
     // choosing and issuing the challenge or token. A completed password reset
     // cannot be followed by this old in-flight login minting fresh access.
     const decision = await Auth.withVerifiedCredentials({ email, password }, async (authedUser) => {
       const { enabled: twoFactorEnabled } = await getTwoFactorState(authedUser.id as number)
+      const policy = resolveBrowserSessionPolicy(remember)
       if (twoFactorEnabled) {
-        return { kind: 'challenge' as const, token: await createTwoFactorChallenge(authedUser.id as number) }
+        return {
+          kind: 'challenge' as const,
+          token: await createTwoFactorChallenge(authedUser.id as number, { remembered: policy.remembered }),
+        }
+      }
+      return {
+        kind: 'login' as const,
+        result: await Auth.loginUsingId(authedUser.id as number, {
+          expiresInMinutes: policy.expiresInMinutes,
+          withRefreshToken: policy.withRefreshToken,
+        }),
       }
-      return { kind: 'login' as const, result: await Auth.loginUsingId(authedUser.id as number) }
     })
     if (!decision)
       return response.unauthorized('Incorrect email or password')
@@ -84,6 +95,6 @@ export default new Action({
         email: user?.email,
         name: user?.name,
       },
-    }, { headers: { 'Set-Cookie': authCookie(result.token) } })
+    }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.token, result.expiresIn) } })
   },
 })

package/app/Actions/Auth/MagicLinkConsumeAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, consumeMagicLink } from '@stacksjs/auth'
+import { Auth, authCookie, withMagicLink } from '@stacksjs/auth'
 import { config } from '@stacksjs/config'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
@@ -20,7 +20,10 @@ export default new Action({
     if (!config.auth.magicLink?.enabled)
       return response.notFound('Magic-link sign-in is not enabled')
 
-    const consumed = await consumeMagicLink(String(request.get('token')))
+    const consumed = await withMagicLink(String(request.get('token')), async grant => ({
+      grant,
+      result: await Auth.loginUsingId(grant.userId),
+    }))
     if (!consumed.ok) {
       const messages: Record<string, string> = {
         invalid: 'That sign-in link is not valid.',
@@ -33,7 +36,7 @@ export default new Action({
 
     // The same token pack + httpOnly cookie a password login issues, so
     // stxPageAuthMiddleware-gated pages treat passwordless users identically.
-    const result = await Auth.loginUsingId(consumed.userId)
+    const { grant, result } = consumed.value
     if (!result)
       return response.unauthorized('That sign-in link is not valid.')
 
@@ -42,7 +45,7 @@ export default new Action({
       refresh_token: result.refreshToken,
       token_type: 'Bearer',
       expires_in: result.expiresIn,
-      redirect_to: consumed.redirectTo,
+      redirect_to: grant.redirectTo,
       user: {
         id: result.user?.id,
         email: result.user?.email,

package/app/Actions/Auth/RegisterAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, register } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, register, resolveBrowserSessionPolicy } from '@stacksjs/auth'
 import { dispatch } from '@stacksjs/events'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
@@ -29,9 +29,13 @@ export default new Action({
     const email = request.get('email')
     const password = request.get('password')
     const name = request.get('name')
+    const policy = resolveBrowserSessionPolicy(request.get('remember'))
 
     const referralCode = request.get('referralCode')
-    const result = await register({ email, password, name, referralCode: typeof referralCode === 'string' ? referralCode : undefined })
+    const result = await register(
+      { email, password, name, referralCode: typeof referralCode === 'string' ? referralCode : undefined },
+      { expiresInMinutes: policy.expiresInMinutes, withRefreshToken: policy.withRefreshToken },
+    )
 
     if (result) {
       const user = await Auth.getUserFromToken(result.token)
@@ -72,7 +76,7 @@ export default new Action({
           email: user?.email,
           name: user?.name,
         },
-      }, { headers: { 'Set-Cookie': authCookie(result.token) } })
+      }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.token, result.expiresIn) } })
     }
 
     return response.error('Registration failed')

package/app/Actions/Auth/VerifyTwoFactorLoginAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, consumeTwoFactorChallenge, verifyTwoFactorLoginCode } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, resolveBrowserSessionPolicy, verifyTwoFactorLoginCode, withTwoFactorChallenge } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
@@ -27,17 +27,16 @@ export default new Action({
     // (whether the code was right or wrong) must start over from
     // LoginAction, not retry — mirrors the WebAuthn challenge
     // delete-on-read semantics in passkey.ts (stacksjs/stacks#1866).
-    const userId = await consumeTwoFactorChallenge(challengeToken)
-    if (!userId)
-      return response.unauthorized('This login attempt has expired — please sign in again.')
-
-    const valid = await verifyTwoFactorLoginCode(userId, code)
-    if (!valid)
-      return response.unauthorized('Invalid code — please sign in again.')
-
-    const result = await Auth.loginUsingId(userId)
+    const result = await withTwoFactorChallenge(challengeToken, async (userId, challenge) => {
+      if (!await verifyTwoFactorLoginCode(userId, code)) return null
+      const policy = resolveBrowserSessionPolicy(challenge.remembered)
+      return Auth.loginUsingId(userId, {
+        expiresInMinutes: policy.expiresInMinutes,
+        withRefreshToken: policy.withRefreshToken,
+      })
+    })
     if (!result)
-      return response.unauthorized('Invalid code — please sign in again.')
+      return response.unauthorized('Invalid or expired login attempt. Please sign in again.')
 
     const user = result.user
 
@@ -56,6 +55,6 @@ export default new Action({
         email: user?.email,
         name: user?.name,
       },
-    }, { headers: { 'Set-Cookie': authCookie(result.token) } })
+    }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.token, result.expiresIn) } })
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.57",
+  "version": "0.74.59",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.57",
+  "version": "0.74.59",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.57",
+    "@stacksjs/mobile": "^0.74.59",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/vcs/github/workflows/deploy.yml

@@ -28,10 +28,53 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # Is the commit CI passed still the tip of main?
+  #
+  # Deploys queue one at a time, and each checks out the commit its CI run
+  # was for. CI runs are not ordered: when two pushes land close together the
+  # older one can finish CI last, and its deploy then replaces the newer
+  # release with both deploys green. Checked here, when the deploy's turn
+  # comes: if main has moved on, the newer commit's own CI run deploys it.
+  current:
+    if: github.event_name == 'workflow_run'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      latest: ${{ steps.tip.outputs.latest }}
+    steps:
+      - id: tip
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          tip=$(gh api "repos/${{ github.repository }}/commits/main" --jq .sha)
+          if [ "$tip" = "$SHA" ]; then
+            echo "latest=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "latest=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Skipping ${SHA:0:8}: main is at ${tip:0:8}, whose CI run deploys it."
+          fi
+
   deploy:
+    needs: current
     # `workflow_run` fires for failed runs too — that is the point of the
     # gate, so check the conclusion.
-    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    #
+    # And check what CI ran on. CI also runs for pull requests, and
+    # `branches: [main]` matches the head branch name, so a fork's PR from a
+    # branch called `main` that passed CI would deploy the fork's commit with
+    # the production secrets. Only a push to this repository ships.
+    #
+    # `always()` because `current` is skipped for a manual dispatch, which
+    # ships whatever it was pointed at.
+    if: >-
+      always() && (
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      needs.current.outputs.latest == 'true'))
     runs-on: ubuntu-latest
     # Attach a GitHub Environment to get required reviewers and to scope these
     # secrets to it.