create-mantiq 0.5.9 → 0.5.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-mantiq",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "Scaffold a new MantiqJS application",
   "type": "module",
   "license": "MIT",

package/stubs/react/src/lib/api.ts.stub

@@ -3,13 +3,24 @@ function getCookie(name: string): string | null {
   return match ? decodeURIComponent(match[1]!) : null
 }
 
+/** Ensure a session + XSRF-TOKEN cookie exists before mutating requests. */
+let csrfReady: Promise<void> | null = null
+async function ensureCsrf(): Promise<void> {
+  if (getCookie('XSRF-TOKEN')) return
+  if (!csrfReady) {
+    csrfReady = fetch('/csrf-cookie', { credentials: 'same-origin' }).then(() => { csrfReady = null })
+  }
+  await csrfReady
+}
+
 export async function api<T = any>(url: string, opts: RequestInit = {}): Promise<{ ok: boolean; status: number; data: T }> {
   const headers: Record<string, string> = { Accept: 'application/json', ...(opts.headers as Record<string, string>) }
 
-  // Attach XSRF token for CSRF protection on mutating requests
-  const xsrf = getCookie('XSRF-TOKEN')
-  if (xsrf && opts.method && !['GET', 'HEAD', 'OPTIONS'].includes(opts.method)) {
-    headers['X-XSRF-TOKEN'] = xsrf
+  // For mutating requests, ensure CSRF cookie exists then attach it
+  if (opts.method && !['GET', 'HEAD', 'OPTIONS'].includes(opts.method)) {
+    await ensureCsrf()
+    const xsrf = getCookie('XSRF-TOKEN')
+    if (xsrf) headers['X-XSRF-TOKEN'] = xsrf
   }
 
   const res = await fetch(url, { ...opts, credentials: 'same-origin', headers })

package/stubs/shared/routes/web.ts.stub

@@ -18,6 +18,13 @@ export default function (router: Router) {
   router.get('/account/security', [PageController, 'security']).middleware('auth')
   router.get('/account/preferences', [PageController, 'preferences']).middleware('auth')
 
+  // CSRF cookie — SPA calls this on mount to establish session + XSRF token
+  router.get('/csrf-cookie', (request: any) => {
+    // Session middleware already started the session and CSRF middleware
+    // will attach the XSRF-TOKEN cookie on the response. Just return 204.
+    return new Response(null, { status: 204 })
+  })
+
   // Auth actions
   router.post('/login', [AuthController, 'login'])
   router.post('/register', [AuthController, 'register'])

package/stubs/svelte/src/lib/api.ts.stub

@@ -3,13 +3,24 @@ function getCookie(name: string): string | null {
   return match ? decodeURIComponent(match[1]!) : null
 }
 
+/** Ensure a session + XSRF-TOKEN cookie exists before mutating requests. */
+let csrfReady: Promise<void> | null = null
+async function ensureCsrf(): Promise<void> {
+  if (getCookie('XSRF-TOKEN')) return
+  if (!csrfReady) {
+    csrfReady = fetch('/csrf-cookie', { credentials: 'same-origin' }).then(() => { csrfReady = null })
+  }
+  await csrfReady
+}
+
 export async function api<T = any>(url: string, opts: RequestInit = {}): Promise<{ ok: boolean; status: number; data: T }> {
   const headers: Record<string, string> = { Accept: 'application/json', ...(opts.headers as Record<string, string>) }
 
-  // Attach XSRF token for CSRF protection on mutating requests
-  const xsrf = getCookie('XSRF-TOKEN')
-  if (xsrf && opts.method && !['GET', 'HEAD', 'OPTIONS'].includes(opts.method)) {
-    headers['X-XSRF-TOKEN'] = xsrf
+  // For mutating requests, ensure CSRF cookie exists then attach it
+  if (opts.method && !['GET', 'HEAD', 'OPTIONS'].includes(opts.method)) {
+    await ensureCsrf()
+    const xsrf = getCookie('XSRF-TOKEN')
+    if (xsrf) headers['X-XSRF-TOKEN'] = xsrf
   }
 
   const res = await fetch(url, { ...opts, credentials: 'same-origin', headers })

package/stubs/vue/src/lib/api.ts.stub

@@ -3,13 +3,24 @@ function getCookie(name: string): string | null {
   return match ? decodeURIComponent(match[1]!) : null
 }
 
+/** Ensure a session + XSRF-TOKEN cookie exists before mutating requests. */
+let csrfReady: Promise<void> | null = null
+async function ensureCsrf(): Promise<void> {
+  if (getCookie('XSRF-TOKEN')) return
+  if (!csrfReady) {
+    csrfReady = fetch('/csrf-cookie', { credentials: 'same-origin' }).then(() => { csrfReady = null })
+  }
+  await csrfReady
+}
+
 export async function api<T = any>(url: string, opts: RequestInit = {}): Promise<{ ok: boolean; status: number; data: T }> {
   const headers: Record<string, string> = { Accept: 'application/json', ...(opts.headers as Record<string, string>) }
 
-  // Attach XSRF token for CSRF protection on mutating requests
-  const xsrf = getCookie('XSRF-TOKEN')
-  if (xsrf && opts.method && !['GET', 'HEAD', 'OPTIONS'].includes(opts.method)) {
-    headers['X-XSRF-TOKEN'] = xsrf
+  // For mutating requests, ensure CSRF cookie exists then attach it
+  if (opts.method && !['GET', 'HEAD', 'OPTIONS'].includes(opts.method)) {
+    await ensureCsrf()
+    const xsrf = getCookie('XSRF-TOKEN')
+    if (xsrf) headers['X-XSRF-TOKEN'] = xsrf
   }
 
   const res = await fetch(url, { ...opts, credentials: 'same-origin', headers })