@stacksjs/defaults 0.75.59 → 0.75.61

package/app/Middleware/Csrf.ts

@@ -168,10 +168,36 @@ export function responseMayUseCsrfToken(response: Response): boolean {
     || type.endsWith('+json')
 }
 
+/**
+ * Whether a response told shared caches they may keep it: its `Cache-Control`
+ * says `public` or gives an `s-maxage`, and says neither `private` nor
+ * `no-store`.
+ *
+ * Such a response is, by its own account, the same for everyone, so it must
+ * not carry a per-visitor cookie. A CDN refuses to store a response that sets
+ * one (Cloudflare answers `cf-cache-status: BYPASS`), so seeding here kept
+ * every shareable API read out of the edge; and a cache that stored it anyway
+ * would hand one visitor's token to everybody behind it.
+ */
+export function responseDeclaresShared(response: Response): boolean {
+  const value = (response.headers.get('cache-control') || '').toLowerCase()
+  if (!value || /\b(?:private|no-store)\b/.test(value))
+    return false
+  return /\bpublic\b/.test(value) || /\bs-maxage\s*=/.test(value)
+}
+
 export function seedCsrfCookieIfMissing(req: Request, response: Response, minted?: string, responseHasNoCookies = false): Response {
   if (!responseMayUseCsrfToken(response))
     return response
 
+  // Nothing depends on a shareable response seeding the cookie: a page that
+  // carries forms is per-visitor and never says `public`, and a client about to
+  // submit without a cookie can ask for one from a response that is not shared.
+  // This holds for every layer that seeds - the API router, and the page server
+  // that proxies `/api` to it - because they all come through here.
+  if (responseDeclaresShared(response))
+    return response
+
   // A token the router minted before rendering wins over "the header already
   // has one", because it put that value in the header itself - and the page
   // has already embedded it in every form it drew. Generating a second token

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.59",
+  "version": "0.75.61",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.59",
+  "version": "0.75.61",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "^0.75.59",
+    "@stacksjs/mobile": "^0.75.61",
     "@stacksjs/sanitizer": "^0.2.348",
     "ts-qr-codes": "^0.1.8"
   }

package/vcs/github/workflows/deploy.yml

@@ -148,6 +148,7 @@ jobs:
           chmod 644 ~/.ssh/id_ed25519.pub
 
       - name: Deploy
+        id: deploy
         if: steps.check.outputs.configured == 'true'
         run: ./buddy deploy --${{ github.event.inputs.environment == 'staging' && 'staging' || github.event.inputs.environment == 'development' && 'dev' || 'prod' }} --yes
         env:
@@ -165,3 +166,23 @@ jobs:
           # macOS resource forks in a tarball built on a developer machine make
           # the extraction on the server noisy and occasionally fatal.
           COPYFILE_DISABLE: '1'
+
+      # A deploy that failed half way must not leave the half it finished live.
+      #
+      # Each site's own cutover already refuses a release that crashes, never
+      # takes its port or fails its health path, and puts the previous release
+      # back. What it cannot undo is the site deployed before the one that
+      # failed, left on a different commit from the rest. This rolls back every
+      # site whose live release is this commit, and only those, then fails the
+      # job. Add a smoke check after Deploy (give it `id: smoke`) and include it
+      # in the condition to roll back releases that are up but wrong as well.
+      #
+      # Needs @stacksjs/ts-cloud 0.16.34 or newer for --all and --only-if-live.
+      - name: Roll back what this deploy made live
+        if: failure() && steps.deploy.outcome == 'failure'
+        run: |
+          ./buddy deploy:rollback --env ${{ github.event.inputs.environment || 'production' }} --all --only-if-live "$GITHUB_SHA" || echo "::error::The rollback did not complete; check which release each site serves."
+          echo "::error::Deploy of ${GITHUB_SHA::7} failed; sites it had switched were rolled back."
+          exit 1
+        env:
+          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}