@velastack/cms 0.3.0 → 0.3.1

package/README.md

@@ -161,7 +161,7 @@ That's it — the plugin handles scope and the loader handles data fetching.
 
 ## Production builds: prerender + media download
 
-`loadCms` is **server-only** — call it from `+layout.server.ts` (or `+page.server.ts`), never from a `+page.svelte` or universal `+page.ts`. Calling it in the browser throws. Editing/preview happens through `cmsStore` from `@velastack/cms`, which is gated by your `cms_session` cookie and opaque preview/version keys.
+`loadCms` is **server-only** — call it from `+layout.server.ts` (or `+page.server.ts`), never from a `+page.svelte` or universal `+page.ts`. Calling it in the browser throws. Editing/preview happens through `cmsStore` from `@velastack/cms`, which is gated by your `cms_session` cookie (scoped to the CMS mount path, so sites sharing an origin hold independent sessions) and opaque preview/version keys.
 
 The recommended production shape is **prerender by default**:
 

package/dist/backend/auth/local-editors.js

@@ -1,4 +1,27 @@
 import { createEditorStore } from './editors.js';
+/**
+ * Every value sent under `name` in a `Cookie` header, in the order the browser
+ * listed them. SvelteKit's `cookies.get` collapses duplicates to the first,
+ * which is right for resolving a session and wrong for ending them all.
+ */
+const cookieValues = (header, name) => {
+    if (!header)
+        return [];
+    const out = [];
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1 || part.slice(0, eq).trim() !== name)
+            continue;
+        const raw = part.slice(eq + 1).trim();
+        try {
+            out.push(decodeURIComponent(raw));
+        }
+        catch {
+            out.push(raw);
+        }
+    }
+    return out;
+};
 /**
  * The adapter caches one editor store per database. `resolve` runs on every
  * request, and re-preparing a dozen statements each time would be wasteful; the
@@ -36,9 +59,15 @@ export const localEditors = (options = {}) => {
             return { user, token, expiresAt };
         },
         async logout(event, ctx) {
-            const token = event.cookies.get(ctx.cookieName);
-            if (token)
-                storeFor(ctx).destroySession(token);
+            // A browser can hold a root-scoped cookie from before 0.3.1 next to
+            // the mount-scoped one; logging out ends both sessions.
+            const store = storeFor(ctx);
+            for (const token of cookieValues(event.request.headers.get('cookie'), ctx.cookieName)) {
+                store.destroySession(token);
+            }
+        },
+        async discard(grant, ctx) {
+            storeFor(ctx).destroySession(grant.token);
         }
     };
 };

package/dist/backend/factory.js

@@ -79,13 +79,14 @@ export const createCmsBackend = (options = {}) => {
      * Cookie attributes. `sameSite: 'none'` is required for the cross-origin
      * iframe login and wrong for a same-origin mount on plain http, so the
      * default follows whether CORS is configured rather than being hardcoded
-     * one way.
+     * one way. `path` is decided per request in `handle`: the mount path unless
+     * the host set one, so projects sharing an origin hold independent sessions.
      */
-    const cookieOptionsFor = (event) => {
+    const cookieOptionsFor = (event, path) => {
         const crossOrigin = cors !== false;
         const isHttps = event.url.protocol === 'https:';
         return {
-            path: options.cookie?.path ?? '/',
+            path,
             httpOnly: true,
             sameSite: options.cookie?.sameSite ?? (crossOrigin ? 'none' : 'lax'),
             secure: options.cookie?.secure ?? (crossOrigin ? true : isHttps),
@@ -140,28 +141,37 @@ export const createCmsBackend = (options = {}) => {
         const projectId = resolveProject(event);
         if (projectId === null)
             return applyCors(event, notFound());
+        // Pure string work, so it can precede auth. A root mount yields ''.
+        const mountPath = mountPathFor(event, restPath);
+        const cookiePath = options.cookie?.path ?? (mountPath || '/');
+        // Versions before 0.3.1 set the cookie at '/'. While the default is in
+        // use, login and logout expire that one too — otherwise a stale root
+        // cookie keeps answering for this mount alongside the scoped one.
+        const legacyPath = options.cookie?.path === undefined && cookiePath !== '/' ? '/' : null;
         const authCtx = { db, projectId, cookieName };
-        // Resolve, then authorize, then dispatch. Both checks happen before any
-        // handler body runs, which is what keeps a cross-project write from
-        // touching the database at all.
-        let user = null;
+        // Resolve, then authorize, on every route class, before any handler body
+        // runs. A session with no grant on this project is anonymous on this
+        // project: `required` is a 403, `public` serves published content, and
+        // only the login page is told the session exists so it can explain the
+        // form. That is what keeps a cross-project write from touching the
+        // database at all, and what lets one browser edit several sites.
+        let sessionUser = null;
         try {
-            user = await auth.resolve(event, authCtx);
+            sessionUser = await auth.resolve(event, authCtx);
         }
         catch {
-            user = null;
-        }
-        if (user && route.auth !== 'exempt' && !(await auth.authorize(user, projectId, authCtx))) {
-            return applyCors(event, new Response(null, { status: 403 }));
+            sessionUser = null;
         }
+        const user = sessionUser && (await auth.authorize(sessionUser, projectId, authCtx)) ? sessionUser : null;
         if (route.auth === 'required' && !user) {
             return applyCors(event, new Response(null, { status: 403 }));
         }
-        const mountPath = mountPathFor(event, restPath);
+        const expire = (path) => event.cookies.set(cookieName, '', { ...cookieOptionsFor(event, path), maxAge: 0 });
         const ctx = {
             event,
             projectId,
             user,
+            sessionUser,
             params,
             store,
             cache,
@@ -174,14 +184,17 @@ export const createCmsBackend = (options = {}) => {
             mountPath,
             frameAncestors,
             setSessionCookie: (token, expiresAt) => {
-                const opts = cookieOptionsFor(event);
                 event.cookies.set(cookieName, token, {
-                    ...opts,
+                    ...cookieOptionsFor(event, cookiePath),
                     maxAge: Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000))
                 });
+                if (legacyPath)
+                    expire(legacyPath);
             },
             clearSessionCookie: () => {
-                event.cookies.set(cookieName, '', { ...cookieOptionsFor(event), maxAge: 0 });
+                expire(cookiePath);
+                if (legacyPath)
+                    expire(legacyPath);
             }
         };
         return applyCors(event, await route.handler(ctx));

package/dist/backend/index.d.ts

@@ -29,13 +29,20 @@
  * so a cross-origin `POST /media` needs the site's origin in
  * `kit.csrf.trustedOrigins` — that check is production-only, so it will not
  * show up in `vela dev`.
+ *
+ * The session cookie is scoped to the mount path (`/cms`, or
+ * `/v1/projects/<id>/cms`), so several projects on one origin hold independent
+ * sessions and one browser can edit them all; `cookie.path` overrides it. The
+ * cookie only ever travels to the mount: the site's server-side reads
+ * (`loadCms`, prerender) carry preview and version keys instead, in a
+ * same-origin single-tenant mount as much as a cross-origin one.
  */
 export { createCmsBackend, type CmsBackend } from './factory.js';
 export { CmsDeployError } from './routes/deploy.js';
 export { localEditors, type LocalEditorsOptions } from './auth/local-editors.js';
 export { createEditorStore, type CmsEditorStore, type CreateEditorInput, type CmsSessionToken } from './auth/editors.js';
 export { hashPassword, verifyPassword, type ScryptParams } from './auth/scrypt.js';
-export { createCmsTestClient, type CmsTestClient, type TestResponse } from './testing/harness.js';
+export { createCmsTestClient, type CmsCookieJar, type CmsTestClient, type JarEntry, type TestResponse } from './testing/harness.js';
 export { createTestFixture, TEST_SCRYPT, type TestFixture, type TestFixtureOptions } from './testing/fixtures.js';
 export type { CmsAuthAdapter, CmsAuthContext, CmsBackendOptions, CmsCookieOptions, CmsCorsOptions, CmsDeployAdapter, CmsDeployContext, CmsDeployRun, CmsDeployState, CmsEditor, CmsSessionGrant } from './types.js';
 export type { CmsStore } from './store/queries.js';

package/dist/backend/index.js

@@ -29,6 +29,13 @@
  * so a cross-origin `POST /media` needs the site's origin in
  * `kit.csrf.trustedOrigins` — that check is production-only, so it will not
  * show up in `vela dev`.
+ *
+ * The session cookie is scoped to the mount path (`/cms`, or
+ * `/v1/projects/<id>/cms`), so several projects on one origin hold independent
+ * sessions and one browser can edit them all; `cookie.path` overrides it. The
+ * cookie only ever travels to the mount: the site's server-side reads
+ * (`loadCms`, prerender) carry preview and version keys instead, in a
+ * same-origin single-tenant mount as much as a cross-origin one.
  */
 export { createCmsBackend } from './factory.js';
 export { CmsDeployError } from './routes/deploy.js';

package/dist/backend/router.d.ts

@@ -9,11 +9,16 @@
 import type { RequestEvent } from '@sveltejs/kit';
 import type { RouteCtx, RouteHandler } from './routes/context.js';
 /**
- * `public`   — anonymous callers are served (published content only).
- * `required` — no editor is a 403.
- * `exempt`   — skips the cross-project check, so an editor holding a session
- *              for one project can still reach another's login form and log
- *              out. Reproduces `isAuthEndpoint` from the hook this replaces.
+ * A session with no grant on this project is anonymous on this project, on
+ * every class:
+ *
+ * `public`   — served to anyone; anonymous callers and foreign sessions get
+ *              published content only.
+ * `required` — no editor authorized for this project is a 403.
+ * `exempt`   — served regardless, so an editor holding a session for one
+ *              project can reach another's login form and log out. The
+ *              handler also sees `sessionUser`, so the login page can say why
+ *              it is showing a form. Login and logout only.
  */
 export type RouteAuth = 'public' | 'required' | 'exempt';
 export type Route = {

package/dist/backend/routes/context.d.ts

@@ -16,8 +16,13 @@ export type RouteCtx = {
     event: RequestEvent;
     /** The tenant this request is for. `'default'` in a single-tenant mount. */
     projectId: string;
-    /** The signed-in editor, or `null`. Routes declared `required` never see null. */
+    /** The editor whose session is authorized for this project, or `null` — on
+     * every route class. Routes declared `required` never see null. */
     user: CmsEditor | null;
+    /** The editor the session resolved to, whether or not they hold a grant
+     * here. Only the login page has a use for it: to say why the form is being
+     * shown instead of the signed-in screen. */
+    sessionUser: CmsEditor | null;
     /** Captured `:name` segments from the route pattern. */
     params: Record<string, string>;
     store: CmsStore;

package/dist/backend/routes/login.d.ts

@@ -10,10 +10,20 @@
  * The flow: the admin bar opens `<endpoint>/iframe/login` in an iframe, the
  * form posts back to the same URL, and on success the page tells the parent
  * window so the bar can re-fetch `/user` without a reload.
+ *
+ * Two identities matter here. `ctx.user` is an editor authorized for this
+ * project; `ctx.sessionUser` is whoever the cookie resolved to, grant or not.
+ * The signed-in screen may only render for `ctx.user`: the bar answers it by
+ * fetching `/user`, which is a 403 for anyone else, and a bar told "signed in"
+ * and then refused would reopen this page forever. A session that cannot edit
+ * this site gets the form instead, with a line saying why, so the editor can
+ * sign in as someone who can — without disturbing that other site's session,
+ * since the cookie is scoped to this mount.
  */
 import type { RouteCtx } from './context.js';
 export declare const getLogin: (ctx: RouteCtx) => Response;
 export declare const postLogin: (ctx: RouteCtx) => Promise<Response>;
 /** Kept so the admin bar's historical `/iframe/login/success` URL still
- * resolves; the POST above renders the same screen inline. */
+ * resolves; the POST above renders the same screen inline. `ctx.user` is only
+ * set for a session authorized here, so a foreign one is sent to the form. */
 export declare const getLoginSuccess: (ctx: RouteCtx) => Response;

package/dist/backend/routes/login.js

@@ -53,6 +53,13 @@ button:hover { background: #262626; }
 	background: #fef2f2;
 	color: #b91c1c;
 }
+.hint {
+	margin: 0 0 1rem;
+	padding: 0.5rem 0.75rem;
+	border-radius: 0.5rem;
+	background: #f5f5f5;
+	color: #525252;
+}
 @media (prefers-color-scheme: dark) {
 	body { background: #0a0a0a; color: #fafafa; }
 	.card { background: #0a0a0a; border-color: #262626; }
@@ -62,6 +69,7 @@ button:hover { background: #262626; }
 	button:hover { background: #e5e5e5; }
 	p.sub { color: #a3a3a3; }
 	.error { background: #2a1215; color: #fca5a5; }
+	.hint { background: #171717; color: #a3a3a3; }
 }
 `;
 const page = (title, body) => `<!doctype html>
@@ -79,8 +87,9 @@ ${body}
 </main>
 </body>
 </html>`;
-const loginForm = (error) => page('Sign in to edit', `<h1>Sign in to edit</h1>
+const loginForm = (error, hint) => page('Sign in to edit', `<h1>Sign in to edit</h1>
 <p class="sub">Use your email and password</p>
+${hint ? `<p class="hint">${escapeHtml(hint)}</p>` : ''}
 ${error ? `<p class="error" role="alert">${escapeHtml(error)}</p>` : ''}
 <form method="POST">
 	<div class="field">
@@ -110,15 +119,20 @@ const html = (body, ctx, status = 200) => new Response(body, {
         'cache-control': 'no-store'
     }
 });
+/** Why a signed-in browser is looking at a form: its session cannot edit
+ * this site. Nothing when there is no session at all. */
+const foreignSessionHint = (ctx) => ctx.sessionUser
+    ? `Signed in as ${ctx.sessionUser.email}, but that account can't edit this site. Sign in with one that can.`
+    : undefined;
 export const getLogin = (ctx) => {
     if (!ctx.auth.login)
         return new Response(null, { status: 404 });
-    // Already signed in and authorized for this project — skip straight to the
-    // success screen. A session bound to a project the caller can't reach leaves
-    // `user` null, so they land on the form and can sign in as someone else.
+    // Authorized for this project already — straight to the signed-in screen.
     if (ctx.user)
         return html(successPage(), ctx);
-    return html(loginForm(), ctx);
+    // Anonymous, or a session with no grant here: the form, never the
+    // signed-in screen (see the file header).
+    return html(loginForm(undefined, foreignSessionHint(ctx)), ctx);
 };
 export const postLogin = async (ctx) => {
     if (!ctx.auth.login)
@@ -139,11 +153,18 @@ export const postLogin = async (ctx) => {
     // One message either way — which half was wrong is not the caller's business.
     if (!grant)
         return html(loginForm('Invalid email or password.'), ctx, 400);
+    // Right password, wrong site. The session must not reach the browser: the
+    // bar would be told "signed in" and then refused by `/user`.
+    if (!(await ctx.auth.authorize(grant.user, ctx.projectId, ctx.authCtx))) {
+        await ctx.auth.discard?.(grant, ctx.authCtx);
+        return html(loginForm(`${grant.user.email} can't edit this site. Sign in with an account that can.`), ctx, 403);
+    }
     ctx.setSessionCookie(grant.token, grant.expiresAt);
     return html(successPage(), ctx);
 };
 /** Kept so the admin bar's historical `/iframe/login/success` URL still
- * resolves; the POST above renders the same screen inline. */
+ * resolves; the POST above renders the same screen inline. `ctx.user` is only
+ * set for a session authorized here, so a foreign one is sent to the form. */
 export const getLoginSuccess = (ctx) => {
     if (!ctx.user) {
         return new Response(null, {

package/dist/backend/routes/pages.js

@@ -63,6 +63,7 @@ const buildRoutes = (ctx, userId, locale) => {
 export const getPages = (ctx) => {
     const { event, projectId, store, respond } = ctx;
     const locale = event.url.searchParams.get('locale') ?? DEFAULT_LOCALE;
+    const previewKey = event.url.searchParams.get('preview');
     const versionKey = event.url.searchParams.get('version');
     if (versionKey) {
         const release = store.findPublishedReleaseByPreviewKey(projectId, versionKey);
@@ -102,6 +103,16 @@ export const getPages = (ctx) => {
         });
         return respond.serveImmutableJson(event, { routes });
     }
+    // Preview path: the key names an open release, overlaid exactly as its
+    // owner sees it, cache bypassed. `loadCms` asks this way on the editor's
+    // behalf because the server-side fetch carries no cookie — in a
+    // single-tenant mount as much as a cross-origin one, now that the cookie
+    // lives under the mount path. An unknown key falls through, as for /docs.
+    if (previewKey) {
+        const release = store.findOpenReleaseByPreviewKey(projectId, previewKey);
+        if (release)
+            return Response.json({ routes: buildRoutes(ctx, release.userId, locale) });
+    }
     const userId = ctx.user?.id ?? '';
     if (!userId) {
         const cacheCheck = respond.tryPublicCache(event, projectId, `pages:${locale}`);

package/dist/backend/routes/table.d.ts

@@ -1,11 +1,11 @@
 /**
  * The route table.
  *
- * `auth` semantics:
- * - `public`   anonymous callers are served published content
- * - `required` no editor is a 403
- * - `exempt`   skips the cross-project check, so an editor holding a session for
- *              one project can still reach another's login form and log out
+ * `auth` semantics (a session with no grant here counts as anonymous):
+ * - `public`   anyone is served published content
+ * - `required` no editor authorized for this project is a 403
+ * - `exempt`   served regardless, so an editor holding a session for one
+ *              project can still reach another's login form and log out
  */
 import type { Route } from '../router.js';
 export declare const ROUTES: Route[];

package/dist/backend/routes/user.d.ts

@@ -8,7 +8,9 @@ import { type RouteCtx } from './context.js';
 export declare const getUser: (ctx: RouteCtx) => Response;
 /**
  * Idempotent — safe to call without being signed in. Clears the cookie with
- * the same attributes it was set with, so the browser accepts the expiry, and
- * lets the adapter drop server-side session state.
+ * the same attributes it was set with, so the browser accepts the expiry — and,
+ * while the default path is in use, the root-scoped cookie versions before
+ * 0.3.1 set — and lets the adapter drop server-side state for every session
+ * the request presented.
  */
 export declare const postLogout: (ctx: RouteCtx) => Promise<Response>;

package/dist/backend/routes/user.js

@@ -11,8 +11,10 @@ export const getUser = (ctx) => {
 };
 /**
  * Idempotent — safe to call without being signed in. Clears the cookie with
- * the same attributes it was set with, so the browser accepts the expiry, and
- * lets the adapter drop server-side session state.
+ * the same attributes it was set with, so the browser accepts the expiry — and,
+ * while the default path is in use, the root-scoped cookie versions before
+ * 0.3.1 set — and lets the adapter drop server-side state for every session
+ * the request presented.
  */
 export const postLogout = async (ctx) => {
     await ctx.auth.logout?.(ctx.event, ctx.authCtx);

package/dist/backend/testing/fixtures.d.ts

@@ -12,9 +12,11 @@ export type TestFixture = {
     backend: CmsBackend;
     /** Unauthenticated client for the default project. */
     anon: CmsTestClient;
-    /** Signed in as alice, who can reach `p1` and `p_alice`. */
+    /** Signed in as alice, who can reach `p1` and `p_alice`. Holds a root-scoped
+     * cookie, so `at()` carries it to any mount and cross-project tests
+     * exercise `authorize`. */
     alice: CmsTestClient;
-    /** Signed in as bob, who can reach `p1` and `p_bob`. */
+    /** Signed in as bob, who can reach `p1` and `p_bob`. Root-scoped like alice. */
     bob: CmsTestClient;
     users: {
         alice: CmsEditor;

package/dist/backend/testing/harness.d.ts

@@ -11,17 +11,36 @@ export type RequestInitLike = {
     headers?: Record<string, string>;
     cookie?: string;
 };
+export type JarEntry = {
+    name: string;
+    value: string;
+    path: string;
+};
+/** The client's cookies, kept by name and path the way a browser keeps them. */
+export type CmsCookieJar = {
+    /** The value the client would send to its own mount, or `undefined`. */
+    get(name: string): string | undefined;
+    set(name: string, value: string, path: string): void;
+    delete(name: string, path: string): void;
+    /** Every stored cookie with its path, for asserting on scoping. */
+    all(): readonly JarEntry[];
+    /** The `cookie` header a request to `pathname` would carry. */
+    headerFor(pathname: string): string | undefined;
+};
 export type CmsTestClient = {
     get(path: string, init?: RequestInitLike): Promise<TestResponse>;
     post(path: string, init?: RequestInitLike): Promise<TestResponse>;
     del(path: string, init?: RequestInitLike): Promise<TestResponse>;
     request(method: string, path: string, init?: RequestInitLike): Promise<TestResponse>;
-    /** A client that sends this cookie on every request. */
-    as(cookie: string): CmsTestClient;
+    /** A client that sends this cookie on every request. Root-scoped by
+     * default — what a login from before 0.3.1 left behind, and what lets
+     * `at()` carry it to another mount so cross-project authorization is
+     * exercised. Pass a path to model a mount-scoped cookie. */
+    as(cookie: string, path?: string): CmsTestClient;
     /** A client mounted at a different base path / route params. */
     at(basePath: string, params?: Record<string, string>): CmsTestClient;
     /** The cookie jar accumulated from `set-cookie` responses. */
-    cookies: Map<string, string>;
+    cookies: CmsCookieJar;
 };
 export type TestClientOptions = {
     /** Where the backend is mounted, e.g. `/v1/projects/p1/cms`. */

package/dist/backend/testing/harness.js

@@ -1,3 +1,31 @@
+/** RFC 6265 §5.1.4. */
+const pathMatches = (requestPath, cookiePath) => requestPath === cookiePath ||
+    (requestPath.startsWith(cookiePath) &&
+        (cookiePath.endsWith('/') || requestPath[cookiePath.length] === '/'));
+/** Longest path first, as RFC 6265 §5.4 asks of browsers; the sort is stable,
+ * so equal paths keep their order of arrival. */
+const byPathLength = (list) => list.sort((a, b) => b.path.length - a.path.length);
+const createJar = (basePath) => {
+    // Keyed the way SvelteKit keys cookies it sets: by path and name.
+    const entries = new Map();
+    const key = (name, path) => `${path}?${name}`;
+    const matching = (pathname) => byPathLength([...entries.values()].filter((e) => pathMatches(pathname, e.path)));
+    return {
+        get: (name) => matching(basePath).find((e) => e.name === name)?.value,
+        set: (name, value, path) => {
+            entries.set(key(name, path), { name, value, path });
+        },
+        delete: (name, path) => {
+            entries.delete(key(name, path));
+        },
+        all: () => [...entries.values()],
+        headerFor: (pathname) => {
+            const list = matching(pathname);
+            return list.length > 0 ? list.map((e) => `${e.name}=${e.value}`).join('; ') : undefined;
+        }
+    };
+};
+/** Like `cookie.parse`: the first of a duplicate name wins. */
 const parseCookieHeader = (header) => {
     const out = new Map();
     if (!header)
@@ -6,7 +34,9 @@ const parseCookieHeader = (header) => {
         const eq = part.indexOf('=');
         if (eq === -1)
             continue;
-        out.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+        const name = part.slice(0, eq).trim();
+        if (!out.has(name))
+            out.set(name, part.slice(eq + 1).trim());
     }
     return out;
 };
@@ -32,12 +62,12 @@ export const createCmsTestClient = (backend, options) => {
     const restParam = options.restParam ?? 'path';
     const origin = options.origin ?? 'http://localhost';
     const basePath = options.basePath.replace(/\/$/, '');
-    const jar = new Map();
+    const jar = createJar(basePath);
     const run = async (method, path, init = {}) => {
         const url = new URL(`${basePath}${path.startsWith('/') ? path : `/${path}`}`, origin);
         const rest = url.pathname.slice(basePath.length).replace(/^\//, '');
         const headers = new Headers(init.headers ?? {});
-        const cookieHeader = init.cookie ?? (jar.size > 0 ? [...jar].map(([k, v]) => `${k}=${v}`).join('; ') : undefined);
+        const cookieHeader = init.cookie ?? jar.headerFor(url.pathname);
         if (cookieHeader)
             headers.set('cookie', cookieHeader);
         let body;
@@ -65,18 +95,30 @@ export const createCmsTestClient = (backend, options) => {
                 accumulated[lower] = newHeaders[key];
             }
         };
+        // Mirrors SvelteKit: `set` insists on a path; a cookie set during this
+        // request shadows the one it carried, longest path first; one expired
+        // here reads as absent.
+        const newCookies = new Map();
         const pending = [];
+        const fresh = (name) => byPathLength([...newCookies.values()].filter((c) => c.name === name && pathMatches(url.pathname, c.path)))[0];
+        const set = (name, value, opts) => {
+            if (typeof opts.path !== 'string') {
+                throw new Error('You must specify a `path` when setting, deleting or serializing cookies');
+            }
+            const maxAge = typeof opts.maxAge === 'number' ? opts.maxAge : undefined;
+            newCookies.set(`${opts.path}?${name}`, { name, value, path: opts.path, maxAge });
+            pending.push(serializeCookie(name, value, opts));
+        };
         const cookies = {
-            get: (name) => requestCookies.get(name),
-            getAll: () => [...requestCookies].map(([name, value]) => ({ name, value })),
-            set: (name, value, opts) => {
-                requestCookies.set(name, value);
-                pending.push(serializeCookie(name, value, opts));
-            },
-            delete: (name, opts) => {
-                requestCookies.delete(name);
-                pending.push(serializeCookie(name, '', { ...opts, maxAge: 0 }));
+            get: (name) => {
+                const c = fresh(name);
+                if (c)
+                    return c.maxAge === 0 ? undefined : c.value;
+                return requestCookies.get(name);
             },
+            getAll: () => [...requestCookies].map(([name, value]) => ({ name, value })),
+            set,
+            delete: (name, opts) => set(name, '', { ...opts, maxAge: 0 }),
             serialize: serializeCookie
         };
         const event = {
@@ -101,15 +143,11 @@ export const createCmsTestClient = (backend, options) => {
             response.headers.set(k, v);
         for (const c of pending)
             response.headers.append('set-cookie', c);
-        for (const c of pending) {
-            const [pair] = c.split(';');
-            const eq = pair.indexOf('=');
-            const name = pair.slice(0, eq);
-            const value = decodeURIComponent(pair.slice(eq + 1));
-            if (/Max-Age=0/.test(c))
-                jar.delete(name);
+        for (const c of newCookies.values()) {
+            if (c.maxAge === 0)
+                jar.delete(c.name, c.path);
             else
-                jar.set(name, value);
+                jar.set(c.name, c.value, c.path);
         }
         const text = await response.text();
         return {
@@ -124,23 +162,25 @@ export const createCmsTestClient = (backend, options) => {
         get: (path, init) => run('GET', path, init),
         post: (path, init) => run('POST', path, init),
         del: (path, init) => run('DELETE', path, init),
-        as: (cookie) => {
+        as: (cookie, path = '/') => {
             const scoped = createCmsTestClient(backend, options);
             const [name, ...rest] = cookie.split('=');
-            scoped.cookies.set(name.trim(), rest.join('='));
+            scoped.cookies.set(name.trim(), rest.join('='), path);
             return scoped;
         },
-        // Carries the cookie jar across, so `client.as(session).at(otherProject)`
-        // is the same browser visiting a different mount — which is exactly the
-        // cross-project authorization case.
+        // Carries the cookie jar across, paths included, so
+        // `client.as(session).at(otherProject)` is the same browser visiting a
+        // different mount — which is exactly the cross-project authorization
+        // case — and a mount-scoped cookie stays behind the way it would in a
+        // browser.
         at: (nextBasePath, params) => {
             const scoped = createCmsTestClient(backend, {
                 ...options,
                 basePath: nextBasePath,
                 params
             });
-            for (const [k, v] of jar)
-                scoped.cookies.set(k, v);
+            for (const e of jar.all())
+                scoped.cookies.set(e.name, e.value, e.path);
             return scoped;
         },
         cookies: jar

package/dist/backend/types.d.ts

@@ -34,14 +34,22 @@ export type CmsAuthAdapter = {
     /** Resolve the request's editor, or `null` for anonymous. Must not throw on
      * a malformed or stale cookie: anonymous is a valid outcome, not an error. */
     resolve(event: RequestEvent, ctx: CmsAuthContext): Promise<CmsEditor | null>;
-    /** May this editor act on this project? A `false` here is a 403 before any
-     * handler runs. */
+    /** May this editor act on this project? A `false` makes the session
+     * anonymous on this project: `required` routes 403, `public` routes serve
+     * published content, and the login page shows its form. */
     authorize(user: CmsEditor, projectId: string, ctx: CmsAuthContext): Promise<boolean>;
     /** Backs the built-in login page. Omit it and `/iframe/login` 404s, leaving
-     * login entirely to the host. */
+     * login entirely to the host. The router runs `authorize` on the grant
+     * before issuing it, so an implementation need not check the project. */
     login?(email: string, password: string, ctx: CmsAuthContext): Promise<CmsSessionGrant | null>;
-    /** Invalidate server-side session state on logout. The cookie is cleared
-     * regardless. */
+    /** Throw away a grant `login` minted but the router refused to issue,
+     * because the account has no grant on this project. Optional: without it
+     * the session stays valid server-side, but its token never left the
+     * process. */
+    discard?(grant: CmsSessionGrant, ctx: CmsAuthContext): Promise<void>;
+    /** Invalidate server-side session state on logout — every session the
+     * request presented, not only the one `cookies.get` returns. The cookie is
+     * cleared regardless. */
     logout?(event: RequestEvent, ctx: CmsAuthContext): Promise<void>;
 };
 /** Handed to every deploy adapter method. `store` is the CMS store, so the
@@ -69,6 +77,14 @@ export type CmsDeployAdapter = {
 };
 export type CmsCookieOptions = {
     name?: string;
+    /**
+     * Defaults to the mount path (`/cms`, `/v1/projects/<id>/cms`), so projects
+     * sharing an origin hold independent sessions: signing in on one site never
+     * touches another's. While unset, login and logout also expire a
+     * root-scoped cookie left by versions before 0.3.1. Nothing outside the
+     * mount needs it: the site's own server reads through preview and version
+     * keys, never the cookie. Set `'/'` to put it back at the origin root.
+     */
     path?: string;
     sameSite?: 'lax' | 'strict' | 'none';
     secure?: boolean;

package/dist/server/api-adapter.js

@@ -129,7 +129,8 @@ export const apiAdapter = (options) => {
         },
         async fetchEntries(routeId, context) {
             // Without `previewKey`: `/pages` is read-public; the backend returns
-            // published entries only when no `cms_session` cookie is present.
+            // published entries only when the request carries no session
+            // authorized for this project.
             // For prerender we don't pass a cookie — we get published-only by
             // construction. We still filter `isDraft` / `isDeletePending` /
             // `gone` as a defensive belt-and-suspenders. Tombstoned entries

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@velastack/cms",
-	"version": "0.3.0",
+	"version": "0.3.1",
 	"description": "A scope-aware CMS for SvelteKit, for static or dynamic sites.",
 	"keywords": [
 		"svelte",