@svadmin/lite 0.3.12 → 0.3.13

package/dist/server-adapter.js

@@ -1,40 +1,59 @@
 import { redirect, isRedirect } from '@sveltejs/kit';
 import { resourceToZodSchema } from './schema-generator';
+import { parseExplicitBoolean } from './value-normalization';
+function listRequestState(url, resource) {
+    const requestedPage = Number(url.searchParams.get('page'));
+    const page = Number.isSafeInteger(requestedPage) && requestedPage > 0 ? requestedPage : 1;
+    const configuredPageSize = resource.pageSize ?? 10;
+    const pageSize = Number.isSafeInteger(configuredPageSize) && configuredPageSize > 0
+        ? configuredPageSize
+        : 10;
+    const requestedSort = url.searchParams.get('sort') ?? undefined;
+    const sortableField = requestedSort
+        ? resource.fields.find((field) => field.key === requestedSort && field.sortable !== false)
+        : undefined;
+    const sort = sortableField?.key ?? resource.defaultSort?.field;
+    const requestedOrder = url.searchParams.get('order');
+    const order = sortableField
+        ? requestedOrder === 'asc' || requestedOrder === 'desc' ? requestedOrder : 'asc'
+        : resource.defaultSort?.order ?? 'asc';
+    return { page, pageSize, sort, order, search: url.searchParams.get('q') ?? undefined };
+}
+function listSearchFilters(resource, search) {
+    if (!search)
+        return [];
+    const searchableField = resource.fields.find((field) => field.searchable);
+    return searchableField
+        ? [{ field: searchableField.key, operator: 'contains', value: search }]
+        : [];
+}
 /**
  * Creates a SvelteKit `load` function that fetches a resource list
  * via the DataProvider. All state is driven by URL search params.
  */
 export function createListLoader(dp, resource) {
     return async ({ url }) => {
-        const page = Math.max(1, Number(url.searchParams.get('page')) || 1);
-        const pageSize = resource.pageSize ?? 20;
-        const sort = url.searchParams.get('sort') ?? undefined;
-        const order = url.searchParams.get('order') ?? 'asc';
-        const search = url.searchParams.get('q') ?? undefined;
-        const sorters = sort ? [{ field: sort, order }] :
-            resource.defaultSort ? [resource.defaultSort] : [];
-        const filters = [];
-        if (search) {
-            const searchable = resource.fields.find((f) => f.searchable);
-            if (searchable) {
-                filters.push({ field: searchable.key, operator: 'contains', value: search });
-            }
-        }
-        const result = await dp.getList({
+        const { page, pageSize, sort, order, search } = listRequestState(url, resource);
+        const sorters = sort ? [{ field: sort, order }] : [];
+        const listResponse = await dp.getList({
             resource: resource.name,
             pagination: { current: page, pageSize },
             sorters,
-            filters,
+            filters: listSearchFilters(resource, search),
         });
         return {
-            records: result.data,
-            total: result.total,
+            records: listResponse.data,
+            total: listResponse.total,
             page,
             pageSize,
-            totalPages: Math.ceil(result.total / pageSize),
+            totalPages: Math.ceil(listResponse.total / pageSize),
             sort,
             order,
             search,
+            pagination: { page, perPage: pageSize },
+            currentSort: sort,
+            currentOrder: order,
+            currentSearch: search,
             resource,
         };
     };
@@ -58,6 +77,9 @@ export function createCrudActions(dp, resource) {
     const pk = resource.primaryKey ?? 'id';
     return {
         create: async ({ request }) => {
+            if (resource.canCreate === false) {
+                return { success: false, error: 'Create is disabled for this resource' };
+            }
             const formData = await request.formData();
             const submittedValues = formDataToObject(formData, resource.fields);
             const validation = validateFormVariables(resource, 'create', submittedValues);
@@ -68,15 +90,24 @@ export function createCrudActions(dp, resource) {
                 const result = await dp.create({ resource: resource.name, variables });
                 return { success: true, id: result.data[pk] };
             }
-            catch (e) {
-                if (isRedirect(e))
-                    throw e;
-                return { success: false, error: e.message, values: variables };
+            catch (caughtError) {
+                if (isRedirect(caughtError))
+                    throw caughtError;
+                return {
+                    success: false,
+                    error: 'Create failed',
+                    values: formValuesForResponse(resource.fields, variables),
+                };
             }
         },
         update: async ({ request }) => {
+            if (resource.canEdit === false) {
+                return { success: false, error: 'Edit is disabled for this resource' };
+            }
             const formData = await request.formData();
-            const id = formData.get('_id');
+            const id = readRecordId(formData.get('_id'));
+            if (!id)
+                return { success: false, error: 'Missing record id' };
             formData.delete('_id');
             const submittedValues = formDataToObject(formData, resource.fields);
             const validation = validateFormVariables(resource, 'edit', submittedValues);
@@ -87,26 +118,35 @@ export function createCrudActions(dp, resource) {
                 await dp.update({ resource: resource.name, id, variables });
                 return { success: true };
             }
-            catch (e) {
-                if (isRedirect(e))
-                    throw e;
-                return { success: false, error: e.message, values: variables };
+            catch (caughtError) {
+                if (isRedirect(caughtError))
+                    throw caughtError;
+                return {
+                    success: false,
+                    error: 'Update failed',
+                    values: formValuesForResponse(resource.fields, variables),
+                };
             }
         },
         delete: async ({ request }) => {
+            if (resource.canDelete === false) {
+                return { success: false, error: 'Delete is disabled for this resource' };
+            }
             const formData = await request.formData();
-            const id = formData.get('id');
-            const redirectTo = formData.get('redirect');
+            const id = readRecordId(formData.get('id'));
+            if (!id)
+                return { success: false, error: 'Missing record id' };
+            const redirectTo = toSafeLocalRedirect(formData.get('redirect'));
             try {
                 await dp.deleteOne({ resource: resource.name, id });
                 if (redirectTo)
                     throw redirect(303, redirectTo);
                 return { success: true };
             }
-            catch (e) {
-                if (isRedirect(e))
-                    throw e;
-                return { success: false, error: e.message };
+            catch (caughtError) {
+                if (isRedirect(caughtError))
+                    throw caughtError;
+                return { success: false, error: 'Delete failed' };
             }
         },
     };
@@ -117,30 +157,32 @@ export function createCrudActions(dp, resource) {
  * and redirects unauthenticated users to a login page.
  */
 export function createAuthGuard(authProvider, loginPath = '/lite/login') {
+    const loginSegmentStart = loginPath.lastIndexOf('/');
+    const authBasePath = loginSegmentStart > 0
+        ? loginPath.slice(0, loginSegmentStart)
+        : '';
+    const allowedPublicPaths = new Set([
+        loginPath,
+        `${authBasePath}/register`,
+        `${authBasePath}/forgot-password`,
+        `${authBasePath}/update-password`,
+    ]);
     return async ({ event, resolve }) => {
-        // Skip auth check for the login page itself
-        if (event.url.pathname === loginPath) {
+        if (allowedPublicPaths.has(event.url.pathname)) {
             return resolve(event);
         }
-        // Local Lite Session Verify 
-        const session = event.cookies.get('svadmin-session');
-        if (!session) {
-            return new Response(null, {
-                status: 302,
-                headers: { Location: loginPath },
-            });
-        }
         try {
             const check = await authProvider.check();
             if (!check.authenticated) {
                 event.cookies.delete('svadmin-session', { path: '/' });
                 return new Response(null, {
                     status: 302,
-                    headers: { Location: loginPath },
+                    headers: { Location: toSafeLocalRedirect(check.redirectTo) ?? loginPath },
                 });
             }
         }
         catch {
+            // Authentication checks fail closed so provider errors never expose a protected page.
             event.cookies.delete('svadmin-session', { path: '/' });
             return new Response(null, {
                 status: 302,
@@ -151,41 +193,98 @@ export function createAuthGuard(authProvider, loginPath = '/lite/login') {
     };
 }
 /**
- * Creates login/logout form actions using AuthProvider.
+ * Creates the form actions used by all exported Lite authentication pages.
  */
 export function createAuthActions(authProvider) {
+    async function readAuthParams(request) {
+        return Object.fromEntries(await request.formData());
+    }
+    function validatePasswordConfirmation(authParams) {
+        const { confirmPassword, ...providerParams } = authParams;
+        const password = authParams.password;
+        if (typeof password !== 'string'
+            || password.length === 0
+            || typeof confirmPassword !== 'string'
+            || confirmPassword.length === 0) {
+            return { valid: false, error: 'Password and confirmation are required' };
+        }
+        if (password !== confirmPassword) {
+            return { valid: false, error: 'Passwords do not match' };
+        }
+        return { valid: true, providerParams };
+    }
+    async function runAuthFormAction(providerMethod, authParams, unsupportedMessage, failureMessage) {
+        if (!providerMethod)
+            return { success: false, error: unsupportedMessage };
+        try {
+            const authResult = await providerMethod.call(authProvider, authParams);
+            if (!authResult.success) {
+                return { success: false, error: authResult.error?.message ?? 'Authentication action failed' };
+            }
+            if (authResult.redirectTo)
+                throw redirect(303, authResult.redirectTo);
+            return { success: true };
+        }
+        catch (caughtError) {
+            if (isRedirect(caughtError))
+                throw caughtError;
+            return { success: false, error: failureMessage };
+        }
+    }
     return {
-        login: async ({ request, cookies }) => {
-            const formData = await request.formData();
-            const params = Object.fromEntries(formData);
+        login: async ({ request, cookies, url }) => {
+            const authParams = await readAuthParams(request);
             try {
-                const result = await authProvider.login(params);
-                if (result.success) {
-                    // Store a session indicator in a cookie
+                const loginResult = await authProvider.login(authParams);
+                if (loginResult.success) {
                     cookies.set('svadmin-session', 'active', {
                         path: '/',
                         httpOnly: true,
                         sameSite: 'lax',
+                        secure: url.protocol === 'https:',
                         maxAge: 60 * 60 * 24 * 7, // 7 days
                     });
-                    throw redirect(303, result.redirectTo ?? '/lite');
+                    throw redirect(303, loginResult.redirectTo ?? '/lite');
                 }
-                return { success: false, error: result.error?.message ?? 'Login failed' };
+                return { success: false, error: loginResult.error?.message ?? 'Login failed' };
             }
-            catch (e) {
-                if (isRedirect(e))
-                    throw e;
-                return { success: false, error: e.message };
+            catch (caughtError) {
+                if (isRedirect(caughtError))
+                    throw caughtError;
+                return { success: false, error: 'Login failed' };
             }
         },
         logout: async ({ cookies }) => {
+            let logoutResult;
             try {
-                await authProvider.logout();
+                logoutResult = await authProvider.logout();
+            }
+            catch {
+                cookies.delete('svadmin-session', { path: '/' });
+                return { success: false, error: 'Logout failed' };
             }
-            catch { /* ignore */ }
             cookies.delete('svadmin-session', { path: '/' });
+            if (!logoutResult.success) {
+                return { success: false, error: logoutResult.error?.message ?? 'Logout failed' };
+            }
+            if (logoutResult.redirectTo)
+                throw redirect(303, logoutResult.redirectTo);
             return { success: true };
         },
+        register: async ({ request }) => {
+            const confirmation = validatePasswordConfirmation(await readAuthParams(request));
+            if (!confirmation.valid)
+                return { success: false, error: confirmation.error };
+            return runAuthFormAction(authProvider.register, confirmation.providerParams, 'Registration is not supported by this AuthProvider', 'Registration failed');
+        },
+        forgot_password: async ({ request }) => runAuthFormAction(authProvider.forgotPassword, await readAuthParams(request), 'Password recovery is not supported by this AuthProvider', 'Password recovery failed'),
+        update_password: async ({ request }) => {
+            const confirmation = validatePasswordConfirmation(await readAuthParams(request));
+            if (!confirmation.valid)
+                return { success: false, error: confirmation.error };
+            return runAuthFormAction(authProvider.updatePassword, confirmation.providerParams, 'Password updates are not supported by this AuthProvider', 'Password update failed');
+        },
+        update_profile: async ({ request }) => runAuthFormAction((authProvider.updateProfile ?? authProvider.updateIdentity), await readAuthParams(request), 'Profile updates are not supported by this AuthProvider', 'Profile update failed'),
     };
 }
 // ─── UA Detection ─────────────────────────────────────────────
@@ -201,17 +300,61 @@ export function isLegacyBrowser(userAgent) {
  * Consumers remain responsible for their own transpilation and browser support.
  */
 export function createLegacyRedirectHook(litePrefix = '/lite') {
+    const prefixSegments = litePrefix.split('/').filter(Boolean);
+    const normalizedPrefix = prefixSegments.length > 0 ? `/${prefixSegments.join('/')}` : '/';
     return async ({ event, resolve }) => {
         const ua = event.request.headers.get('user-agent') ?? '';
-        if (isLegacyBrowser(ua) && !event.url.pathname.startsWith(litePrefix)) {
+        const acceptsHtml = event.request.headers.get('accept')?.includes('text/html') === true;
+        const isDocumentRequest = (event.request.method === 'GET' || event.request.method === 'HEAD')
+            && acceptsHtml;
+        const isWithinLite = normalizedPrefix === '/'
+            || event.url.pathname === normalizedPrefix
+            || event.url.pathname.startsWith(`${normalizedPrefix}/`);
+        if (isLegacyBrowser(ua) && isDocumentRequest && !isWithinLite) {
+            const targetPath = normalizedPrefix === '/'
+                ? event.url.pathname
+                : `${normalizedPrefix}${event.url.pathname}`;
             return new Response(null, {
                 status: 302,
-                headers: { Location: `${litePrefix}${event.url.pathname}` },
+                headers: { Location: `${targetPath}${event.url.search}` },
             });
         }
         return resolve(event);
     };
 }
+// ─── Utilities ────────────────────────────────────────────────
+function readRecordId(submittedId) {
+    if (typeof submittedId !== 'string' || submittedId.trim().length === 0)
+        return undefined;
+    return submittedId.trim();
+}
+function containsControlCharacter(untrustedRedirect) {
+    return Array.from(untrustedRedirect).some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 31 || (codePoint >= 127 && codePoint <= 159);
+    });
+}
+function toSafeLocalRedirect(submittedRedirect) {
+    if (typeof submittedRedirect !== 'string'
+        || !submittedRedirect.startsWith('/')
+        || submittedRedirect.startsWith('//')) {
+        return undefined;
+    }
+    if (submittedRedirect.includes('\\') || containsControlCharacter(submittedRedirect)) {
+        return undefined;
+    }
+    const base = new URL('https://svadmin.local');
+    try {
+        const target = new URL(submittedRedirect, base);
+        if (target.origin !== base.origin)
+            return undefined;
+        return `${target.pathname}${target.search}${target.hash}`;
+    }
+    catch {
+        // Malformed untrusted redirect input is intentionally treated as no redirect.
+        return undefined;
+    }
+}
 function formatValidationErrors(issues) {
     const errors = {};
     for (const issue of issues) {
@@ -233,7 +376,7 @@ function validateFormVariables(resource, mode, values) {
         failure: {
             success: false,
             error: 'Validation failed',
-            values,
+            values: formValuesForResponse(resource.fields, values),
             errors: formatValidationErrors(result.error.issues),
         },
     };
@@ -241,6 +384,28 @@ function validateFormVariables(resource, mode, values) {
 function isNativeFile(value) {
     return typeof File !== 'undefined' && value instanceof File;
 }
+function formValuesForResponse(fields, values) {
+    const responseValues = {};
+    for (const field of fields) {
+        if (field.type === 'password' || !(field.key in values))
+            continue;
+        const value = values[field.key];
+        if (field.type === 'array' && Array.isArray(value)) {
+            responseValues[field.key] = value.map((row) => {
+                if (typeof row !== 'object' || row === null || Array.isArray(row))
+                    return row;
+                return formValuesForResponse(field.subFields ?? [], row);
+            });
+            continue;
+        }
+        if (isNativeFile(value))
+            continue;
+        responseValues[field.key] = Array.isArray(value)
+            ? value.filter((entry) => !isNativeFile(entry))
+            : value;
+    }
+    return responseValues;
+}
 function isNonEmptyNativeFile(value) {
     return isNativeFile(value) && value.size > 0 && value.name !== '';
 }
@@ -290,7 +455,7 @@ function formDataToObject(formData, fields) {
                 }
                 break;
             case 'boolean':
-                obj[field.key] = strRaw === 'on' || strRaw === 'true' || strRaw === '1';
+                obj[field.key] = parseExplicitBoolean(strRaw) ?? strRaw;
                 break;
             case 'tags':
                 obj[field.key] = strRaw ? strRaw.split(',').map(s => s.trim()).filter(Boolean) : [];
@@ -336,9 +501,12 @@ function parseArrayField(formData, field) {
         for (const subField of field.subFields ?? []) {
             const rawValues = entries.get(subField.key) ?? [];
             if (subField.type === 'boolean') {
-                const value = isChecked(rawValues);
+                const rawValue = rawValues.at(-1);
+                const value = rawValue === undefined
+                    ? false
+                    : parseExplicitBoolean(rawValue) ?? rawValue;
                 item[subField.key] = value;
-                hasMeaningfulValue ||= value;
+                hasMeaningfulValue ||= value !== false;
                 continue;
             }
             if (rawValues.length === 0)
@@ -406,7 +574,7 @@ function coerceFieldValues(field, rawValues) {
                 return undefined;
             return Number.isNaN(Number(raw)) ? raw : Number(raw);
         case 'boolean':
-            return raw === 'on' || raw === 'true' || raw === '1';
+            return parseExplicitBoolean(raw) ?? raw;
         case 'tags':
             return raw ? raw.split(',').map((value) => value.trim()).filter(Boolean) : [];
         case 'json':

package/dist/value-normalization.d.ts

@@ -0,0 +1,2 @@
+export declare function parseExplicitBoolean(rawBoolean: unknown): boolean | undefined;
+export declare function isExplicitBooleanTrue(rawBoolean: unknown): boolean;

package/dist/value-normalization.js

@@ -0,0 +1,21 @@
+const TRUE_BOOLEAN_STRINGS = new Set(['1', 'true', 'on']);
+const FALSE_BOOLEAN_STRINGS = new Set(['0', 'false', 'off']);
+export function parseExplicitBoolean(rawBoolean) {
+    if (typeof rawBoolean === 'boolean')
+        return rawBoolean;
+    if (rawBoolean === 1)
+        return true;
+    if (rawBoolean === 0)
+        return false;
+    if (typeof rawBoolean !== 'string')
+        return undefined;
+    const normalizedBoolean = rawBoolean.trim().toLowerCase();
+    if (TRUE_BOOLEAN_STRINGS.has(normalizedBoolean))
+        return true;
+    if (FALSE_BOOLEAN_STRINGS.has(normalizedBoolean))
+        return false;
+    return undefined;
+}
+export function isExplicitBooleanTrue(rawBoolean) {
+    return parseExplicitBoolean(rawBoolean) === true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/lite",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "description": "SSR-first lightweight admin UI for @svadmin with optional progressive enhancement",
   "type": "module",
   "sideEffects": [
@@ -54,10 +54,10 @@
   },
   "dependencies": {
     "@lucide/svelte": "^1.30.0",
-    "sveltekit-superforms": "^2.30.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@types/bun": "^1.3.14",
     "@happy-dom/global-registrator": "^20.11.2",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@testing-library/dom": "^10.4.1",
@@ -67,7 +67,10 @@
   },
   "scripts": {
     "build": "node ../../node_modules/@sveltejs/package/svelte-package.js -i src -o dist && bun ../../scripts/copy-package-assets.ts static/enhance.js dist/enhance.js",
-    "test": "vitest run --config ./vitest.config.ts"
+    "test": "bun run test:components && bun run test:server && bun run test:security",
+    "test:components": "vitest run --config ./vitest.config.ts",
+    "test:server": "bun test ./src/schema-generator.test.ts ./src/server-adapter.test.ts",
+    "test:security": "vitest run --config ./src/security.test.config.ts"
   },
   "license": "MIT",
   "publishConfig": {
@@ -79,16 +82,5 @@
     "type": "git",
     "url": "https://github.com/zuohuadong/svadmin.git",
     "directory": "packages/lite"
-  },
-  "peerDependenciesMeta": {
-    "svelte": {
-      "optional": true
-    },
-    "@svadmin/core": {
-      "optional": true
-    },
-    "@sveltejs/kit": {
-      "optional": true
-    }
   }
 }