@stacksjs/defaults 0.75.133 → 0.75.135
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -114,6 +114,13 @@ Every API action still authorizes its own request; hiding a dashboard is not
|
|
|
114
114
|
authorization. Preserve independent profile and roster data when correcting a
|
|
115
115
|
mistaken membership, and protect tenant ownership in the same transaction.
|
|
116
116
|
|
|
117
|
+
The same freshness rule applies to settings profiles and tenant configuration
|
|
118
|
+
that include roles, capabilities or edit permissions. Use `cache: 'no-store'`
|
|
119
|
+
for these reads and `Cache-Control: private, no-store` for their responses.
|
|
120
|
+
Otherwise a corrected account can show the right navigation while a saved
|
|
121
|
+
profile still labels it Admin or enables tenant settings. Gate tenant editors
|
|
122
|
+
on the freshly resolved profile as well as the configuration's edit flag.
|
|
123
|
+
|
|
117
124
|
Source: `src/rbac.ts`, `rbac-store-bqb.ts`, `rbac-seed.ts` and `team.ts`.
|
|
118
125
|
Evidence: `tests/rbac-default-store.test.ts`, `rbac-guard-sync.test.ts`,
|
|
119
126
|
`rbac-seed.test.ts` and `active-team.test.ts`.
|
|
@@ -8,6 +8,8 @@ export default new Action({
|
|
|
8
8
|
async handle(request: RequestInstance) {
|
|
9
9
|
const user = await request.user()
|
|
10
10
|
|
|
11
|
-
|
|
11
|
+
const result = response.json(user)
|
|
12
|
+
result.headers.set('Cache-Control', 'private, no-store')
|
|
13
|
+
return result
|
|
12
14
|
},
|
|
13
15
|
})
|
package/functions/auth.ts
CHANGED
|
@@ -91,6 +91,7 @@ export function useAuth(): AuthComposable {
|
|
|
91
91
|
async function fetchAuthUser(): Promise<UserData | null> {
|
|
92
92
|
try {
|
|
93
93
|
const response = await fetch(`${baseUrl}/me`, {
|
|
94
|
+
cache: 'no-store',
|
|
94
95
|
credentials: 'same-origin',
|
|
95
96
|
headers: {
|
|
96
97
|
...(token.value ? { Authorization: `Bearer ${token.value}` } : {}),
|
package/ide/vscode/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"publisher": "Stacks",
|
|
3
3
|
"name": "vscode-stacks",
|
|
4
4
|
"displayName": "Stacks",
|
|
5
|
-
"version": "0.75.
|
|
5
|
+
"version": "0.75.135",
|
|
6
6
|
"description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
|
|
7
7
|
"license": "MIT",
|
|
8
8
|
"funding": "https://github.com/sponsors/chrisbbreuer",
|
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"name": "@stacksjs/defaults",
|
|
3
3
|
"type": "module",
|
|
4
4
|
"sideEffects": false,
|
|
5
|
-
"version": "0.75.
|
|
5
|
+
"version": "0.75.135",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
8
8
|
"url": "git+https://github.com/stacksjs/stacks.git",
|
|
@@ -55,7 +55,7 @@
|
|
|
55
55
|
"dependencies": {
|
|
56
56
|
"@iconify-json/f7": "^1.2.2",
|
|
57
57
|
"@iconify-json/hugeicons": "^1.2.35",
|
|
58
|
-
"@stacksjs/mobile": "0.75.
|
|
58
|
+
"@stacksjs/mobile": "0.75.135",
|
|
59
59
|
"@stacksjs/sanitizer": "^0.2.422",
|
|
60
60
|
"@xterm/addon-fit": "^0.11.0",
|
|
61
61
|
"@xterm/xterm": "^6.0.0",
|