adminizer 4.3.0-build.137 → 4.3.0-build.139

package/lib/inertia/inertiaAdapter.js

@@ -17,13 +17,19 @@ const inertiaExpressAdapter = function ({ version, html, flashMessages, enableRe
                 secure: process.env.NODE_ENV === 'production' && process.env.CSRF_COOKIE_INSECURE !== '1',
                 sameSite: 'lax',
             });
-            // Check CSRF token for non-GET requests
+            // Проверяем CSRF только для не-GET запросов И не-API routes
             if (!['GET', 'HEAD', 'OPTIONS'].includes(req.method)) {
-                const csrfCookie = req.cookies['XSRF-TOKEN'];
-                const csrfHeader = req.headers[csrf.headerName || 'x-xsrf-token'];
-                if (!csrfCookie || !csrfHeader || csrfCookie !== csrfHeader) {
-                    res.status(403).send({ message: 'Invalid CSRF token' });
-                    return;
+                // Определяем API route через adminizer config
+                const isApiRoute = isApiRequest(req);
+                if (!isApiRoute) {
+                    const csrfCookie = req.cookies['XSRF-TOKEN'];
+                    const csrfHeader = req.headers[csrf.headerName || 'x-xsrf-token'];
+                    if (!csrfCookie || !csrfHeader || csrfCookie !== csrfHeader) {
+                        return res.status(403).json({
+                            message: 'Invalid CSRF token',
+                            type: 'csrf_error'
+                        });
+                    }
                 }
             }
         }
@@ -129,4 +135,17 @@ const inertiaExpressAdapter = function ({ version, html, flashMessages, enableRe
         return next();
     };
 };
+// Вспомогательная функция для определения API routes
+function isApiRequest(req) {
+    const adminizer = req.adminizer;
+    if (!adminizer?.config?.cors?.enabled) {
+        return false;
+    }
+    const corsConfig = adminizer.config.cors;
+    const routePrefix = adminizer.config.routePrefix || '';
+    // Создаем базовый путь для API
+    const apiBasePath = `${routePrefix}/${corsConfig.path?.replace('*', '')}`;
+    // Проверяем начинается ли путь с API base path
+    return req.path.startsWith(apiBasePath);
+}
 export default inertiaExpressAdapter;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "adminizer",
   "type": "module",
-  "version": "4.3.0-build.137",
+  "version": "4.3.0-build.139",
   "main": "index.js",
   "exports": {
     ".": "./index.js",