@webx-ui/module-admin 0.27.0 → 0.28.0

package/README.md

@@ -132,6 +132,34 @@ try {
 }
 ```
 
+### A host that refuses PUT
+
+Some shared hosting lets nothing but GET and POST past the web server: the panel opens and
+reads, and every save or delete gets a 403 or 405 before PHP is reached. `methodOverride` sends
+PUT, PATCH and DELETE as POST and says what they really are:
+
+```ts
+createAdmin({
+  modules: [pages],
+  plugins: [auth()],
+  methodOverride: true, // or 'header', or 'field'
+}).mount()
+```
+
+| Value                | On the wire                                                                                                                         |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| `false` (default)    | Every method as it is                                                                                                               |
+| `true` or `'header'` | `POST` with `X-HTTP-Method-Override: PUT`                                                                                           |
+| `'field'`            | `POST` with `_method: "PUT"` in the JSON body, in a form, or in the query for raw bytes — for a firewall that strips the header too |
+
+GET and POST are never touched, and the CSRF token goes with every overridden request as it
+did before. Laravel reads both forms on its own; the server needs nothing. The option belongs
+to the panel's own client — a project that passes its own `http` passes `methodOverride` to
+`createHttp()` instead.
+
+`php artisan webx:doctor` says whether the site's host is one of them: it sends a PUT and a
+DELETE to its own `APP_URL` and warns when the web server, not Laravel, refuses them.
+
 `can('pages.manage')` answers from the signed-in session — a super administrator passes
 everything, the same rule the server applies.
 

package/dist/createAdmin.d.ts

@@ -1,7 +1,7 @@
 import { App, Component } from 'vue';
 import { Router, RouteRecordRaw } from 'vue-router';
 import { AdminContext } from './admin';
-import { Http } from './http';
+import { Http, MethodOverride } from './http';
 import { I18n } from './i18n';
 import { ThemeController } from './theme';
 import { Patch, TypeRegistry } from '@webx-ui/schema';
@@ -52,6 +52,12 @@ export interface CreateAdminOptions {
      * key for writing: the server decides what is saved.
      */
     screens?: Record<string, Patch>;
+    /**
+     * Send PUT, PATCH and DELETE as POST, for a host whose web server refuses them before PHP is
+     * reached: `true` or `'header'` names the method in `X-HTTP-Method-Override`, `'field'` in
+     * a `_method` field of the body. Off by default; ignored when `http` is given.
+     */
+    methodOverride?: MethodOverride;
     /** Swappable for tests. */
     http?: Http;
 }

package/dist/http.d.ts

@@ -22,7 +22,16 @@ export interface HttpOptions {
     headers?: () => Record<string, string>;
     /** Swappable for tests. */
     fetch?: typeof globalThis.fetch;
+    /**
+     * For a host whose web server lets through nothing but GET and POST, as some shared hosting
+     * does before PHP is even reached: PUT, PATCH and DELETE go out as POST and say what they
+     * really are. `'header'` (or `true`) says it in `X-HTTP-Method-Override`; `'field'` in a
+     * `_method` field, for a firewall that strips the header too. Laravel understands both.
+     */
+    methodOverride?: MethodOverride;
 }
+/** How a method a web server refuses travels inside a POST; `true` is `'header'`. */
+export type MethodOverride = boolean | 'header' | 'field';
 export interface RequestOptions {
     /** Query parameters; `undefined` and `null` are left out rather than sent empty. */
     query?: Record<string, string | number | boolean | null | undefined>;

package/dist/index.d.ts

@@ -15,7 +15,7 @@ export { createNotesApi, type EntityNote, type NoteAuthor, type NotesApi } from
 export { createHistoryApi, historySubjectKey, historyValue, provideHistorySubject, useHistorySubject, type HistoryApi, type HistoryChange, type HistoryEntry, type HistoryEvent, type HistoryPage, type HistoryRun, type HistorySource, type HistorySubject, } from './history';
 export { createLinksApi, emptyLink, type LinkCandidate, type LinkRel, type LinkSourceInfo, type LinkTarget, type LinkValue, type LinksApi, type ResolvedLink, } from './links';
 export { forgetShortcodes, loadShortcodes, shortcodeToken, useShortcodes, type Shortcode, type ShortcodeToken, } from './shortcodes';
-export { createHttp, readCookie, HttpError, type Http, type HttpOptions, type RequestOptions, type SendOptions, } from './http';
+export { createHttp, readCookie, HttpError, type Http, type HttpOptions, type MethodOverride, type RequestOptions, type SendOptions, } from './http';
 export { forgetUnfinishedUpload, MIN_CHUNK, unfinishedUploads, uploadFingerprint, useChunkedUpload, type ChunkedUpload, type ChunkedUploadOptions, type ChunkedUploadState, type UnfinishedUpload, } from './uploads';
 export { adminTypes } from './screenTypes';
 export { categoryRoutes, categoryEditorKey, createCategoriesApi, itemOrderMode, provideCategoryEditor, reorderItems, useCategoryEditor, useCategoryWords, useItemOrder, type CategoriesApi, type CategoriesOptions, type CategoriesPayload, type CategoryDetail, type CategoryEditorContext, type CategoryRow, type CategoryWord, type ItemOrder, type ItemOrderMode, type ItemOrderState, } from './categories';