@stacksjs/defaults 0.74.61 → 0.74.63

package/ai/skills/stacks-dashboard/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stacks-dashboard
-description: Use when building or customizing the Stacks admin dashboard, including dashboard pages, model management views, analytics widgets, commerce dashboards, content management, settings panels, deployment monitoring, job/queue management, or the 400 built-in dashboard components. Covers the dashboard system at storage/framework/defaults/.
+description: Use when building or customizing the Stacks admin dashboard, including dashboard pages, model management views, analytics widgets, commerce dashboards, content management, settings panels, deployment monitoring, job/queue management, or the 401 built-in dashboard components. Covers the dashboard system at storage/framework/defaults/.
 license: MIT
 compatibility: Bun >= 1.3.0, TypeScript
 allowed-tools: Read Edit Write Bash Grep Glob
@@ -8,7 +8,7 @@ allowed-tools: Read Edit Write Bash Grep Glob
 
 # Stacks Dashboard
 
-The Stacks admin dashboard provides a full-featured admin panel with 100+ route views, 400 components, and a multi-section layout.
+The Stacks admin dashboard provides a full-featured admin panel with 100+ route views, 401 components, and a multi-section layout.
 
 ## Key Paths
 - Dashboard components: `storage/framework/defaults/resources/components/Dashboard/`

package/app/Actions/Auth/MagicLinkConsumeAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, withMagicLink } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, resolveBrowserSessionPolicy, withMagicLink } from '@stacksjs/auth'
 import { config } from '@stacksjs/config'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
@@ -20,9 +20,13 @@ export default new Action({
     if (!config.auth.magicLink?.enabled)
       return response.notFound('Magic-link sign-in is not enabled')
 
+    const policy = resolveBrowserSessionPolicy(false)
     const consumed = await withMagicLink(String(request.get('token')), async grant => ({
       grant,
-      result: await Auth.loginUsingId(grant.userId),
+      result: await Auth.loginUsingId(grant.userId, {
+        expiresInMinutes: policy.expiresInMinutes,
+        withRefreshToken: policy.withRefreshToken,
+      }),
     }))
     if (!consumed.ok) {
       const messages: Record<string, string> = {
@@ -51,6 +55,6 @@ export default new Action({
         email: result.user?.email,
         name: result.user?.name,
       },
-    }, { headers: { 'Set-Cookie': authCookie(result.token) } })
+    }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.token, result.expiresIn) } })
   },
 })

package/app/Actions/Auth/RefreshTokenAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { authCookie, refreshToken } from '@stacksjs/auth'
+import { authCookieForBrowserSession, refreshToken } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
@@ -34,7 +34,7 @@ export default new Action({
         refresh_token: result.refreshToken,
         token_type: 'Bearer',
         expires_in: result.expiresIn,
-      }, { headers: { 'Set-Cookie': authCookie(result.plainTextToken) } })
+      }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.plainTextToken, result.expiresIn) } })
     }
     catch (error: any) {
       return response.unauthorized(error.message || 'Invalid or expired refresh token')

package/app/Actions/Auth/SocialCallbackAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, resolveSocialSignIn, SocialSignInRefusedError } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, resolveBrowserSessionPolicy, resolveSocialSignIn, SocialSignInRefusedError } from '@stacksjs/auth'
 import { log } from '@stacksjs/logging'
 import { response } from '@stacksjs/router'
 import { isSocialProviderConfigured, socialHandoffFailureRedirect, socialHandoffRedirect, socialProvider } from '@stacksjs/socials'
@@ -45,7 +45,11 @@ export default new Action({
 
       const { userId } = await resolveSocialSignIn(provider, identity)
 
-      const session = await Auth.loginUsingId(userId)
+      const policy = resolveBrowserSessionPolicy(false)
+      const session = await Auth.loginUsingId(userId, {
+        expiresInMinutes: policy.expiresInMinutes,
+        withRefreshToken: policy.withRefreshToken,
+      })
       if (!session?.token)
         return socialHandoffFailureRedirect('Sign-in could not be completed. Please try again.')
 
@@ -61,7 +65,7 @@ export default new Action({
       })
 
       // The cookie signs server-rendered pages in; the fragment pack the SPA.
-      redirect.headers.append('Set-Cookie', authCookie(session.token))
+      redirect.headers.append('Set-Cookie', authCookieForBrowserSession(session.token, session.expiresIn))
       return redirect
     }
     catch (error) {

package/app/Actions/Auth/VerifyAuthenticationAction.ts

@@ -1,8 +1,11 @@
 import type { AuthenticationCredential } from '@stacksjs/auth'
 import { Action } from '@stacksjs/actions'
 import {
+  Auth,
+  authCookieForBrowserSession,
   consumeWebAuthnChallenge,
   getUserPasskey,
+  resolveBrowserSessionPolicy,
   updatePasskeyCounter,
   verifyAuthenticationResponse,
 } from '@stacksjs/auth'
@@ -86,7 +89,27 @@ export default new Action({
         }
       }
 
-      return response.json(verification)
+      const policy = resolveBrowserSessionPolicy(false)
+      const session = await Auth.loginUsingId(user.id as number, {
+        expiresInMinutes: policy.expiresInMinutes,
+        withRefreshToken: policy.withRefreshToken,
+      })
+      if (!session)
+        return response.serverError('Authentication session could not be created')
+
+      return response.json({
+        ...verification,
+        access_token: session.token,
+        refresh_token: session.refreshToken,
+        token_type: 'Bearer',
+        expires_in: session.expiresIn,
+        token: session.token,
+        user: {
+          id: session.user?.id,
+          email: session.user?.email,
+          name: session.user?.name,
+        },
+      }, { headers: { 'Set-Cookie': authCookieForBrowserSession(session.token, session.expiresIn) } })
     }
     catch (error) {
       console.error('Authentication verification failed:', error)

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.61",
+  "version": "0.74.63",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.61",
+  "version": "0.74.63",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.61",
+    "@stacksjs/mobile": "^0.74.63",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/routes/auth.ts

@@ -53,7 +53,7 @@ route.post('/verify-registration', 'Actions/Auth/VerifyRegistrationAction').midd
 // Passkey AUTHENTICATION (logging in) is correctly unauthenticated —
 // the caller doesn't have a session yet, that's the point.
 route.get('/generate-authentication-options', 'Actions/Auth/GenerateAuthenticationAction').rateLimit(10, 'minute')
-route.get('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
+route.post('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
 
 // TOTP 2FA. Setup/enable/disable act on the caller's own authenticated
 // account (auth-gated, same identity rule as passkey enrollment above).