firstly 0.7.1 → 0.7.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # firstly
 
+## 0.7.2
+
+### Patch Changes
+
+- [#313](https://github.com/jycouet/firstly/pull/313) [`501d922`](https://github.com/jycouet/firstly/commit/501d92220ec32a19622eed403c85f445c3ccc68e) Thanks [@jycouet](https://github.com/jycouet)! - `remultApiServerLoad` reads through `event.fetch` instead of `TestApiDataProvider`: concurrency-safe on released remult (no process-global static swap), and the API side runs the app's real auth/hooks.
+
 ## 0.7.1
 
 ### Patch Changes

package/esm/svelte/remultApiLoad.d.ts

@@ -1,19 +1,25 @@
 import type { LoadEvent } from '@sveltejs/kit';
+/**
+ * Run `body` in a scoped `withRemult` whose reads go through the API via `fetch`
+ * (`allowApiRead` / `apiPrefilter` apply); a concurrent load keeps its own
+ * provider. `remult.user` is carried in so the body can read it.
+ *
+ * TODO(remult): framework-agnostic (only needs a fetch) - candidate to live in
+ * remult directly.
+ */
+export declare function withRemultFetch<T>(fetch: typeof globalThis.fetch, body: () => Promise<T>): Promise<T>;
 /**
  * Wrap a SvelteKit UNIVERSAL load (`+page.ts` / `+layout.ts`) so plain global
  * `repo()` / `ff()` reads through the API (so `allowApiRead` / `apiPrefilter`
  * apply), on both SSR and CSR.
  *
- * - SSR: runs the body in a nested `withRemult` bound to `event.fetch` - gated, and
- *   scoped so a concurrent `+page.server.ts` keeps its own provider. SvelteKit
- *   inlines the response. `remult.user` is carried in so the body can read it.
+ * - SSR: runs the body in a scoped `withRemult` bound to `event.fetch` - gated,
+ *   and a concurrent `+page.server.ts` keeps its own provider. SvelteKit inlines
+ *   the response.
  * - CSR / hydration: points the client `remult` at this page's `event.fetch` so the
  *   inlined SSR response is reused, then runs the body.
  *
  * (A universal load runs on the client too, so it must use `event.fetch`. For a
  * server-only load see `remultApiServerLoad` from `firstly/svelte/server`.)
- *
- * TODO(remult): the SSR branch is framework-agnostic (only needs `event.fetch`) -
- * candidate to live in remult (e.g. `withRemultFetch(fetch, body)`).
  */
 export declare function remultApiUniversalLoad<T>(body: (event: LoadEvent) => Promise<T>): (event: LoadEvent) => Promise<T>;

package/esm/svelte/remultApiLoad.js

@@ -1,20 +1,32 @@
 import { isBackend, remult, RestDataProvider, withRemult } from 'remult';
+/**
+ * Run `body` in a scoped `withRemult` whose reads go through the API via `fetch`
+ * (`allowApiRead` / `apiPrefilter` apply); a concurrent load keeps its own
+ * provider. `remult.user` is carried in so the body can read it.
+ *
+ * TODO(remult): framework-agnostic (only needs a fetch) - candidate to live in
+ * remult directly.
+ */
+export function withRemultFetch(fetch, body) {
+    const user = remult.user;
+    return withRemult(async () => {
+        remult.user = user;
+        return body();
+    }, { dataProvider: new RestDataProvider(() => ({ httpClient: fetch })) });
+}
 /**
  * Wrap a SvelteKit UNIVERSAL load (`+page.ts` / `+layout.ts`) so plain global
  * `repo()` / `ff()` reads through the API (so `allowApiRead` / `apiPrefilter`
  * apply), on both SSR and CSR.
  *
- * - SSR: runs the body in a nested `withRemult` bound to `event.fetch` - gated, and
- *   scoped so a concurrent `+page.server.ts` keeps its own provider. SvelteKit
- *   inlines the response. `remult.user` is carried in so the body can read it.
+ * - SSR: runs the body in a scoped `withRemult` bound to `event.fetch` - gated,
+ *   and a concurrent `+page.server.ts` keeps its own provider. SvelteKit inlines
+ *   the response.
  * - CSR / hydration: points the client `remult` at this page's `event.fetch` so the
  *   inlined SSR response is reused, then runs the body.
  *
  * (A universal load runs on the client too, so it must use `event.fetch`. For a
  * server-only load see `remultApiServerLoad` from `firstly/svelte/server`.)
- *
- * TODO(remult): the SSR branch is framework-agnostic (only needs `event.fetch`) -
- * candidate to live in remult (e.g. `withRemultFetch(fetch, body)`).
  */
 export function remultApiUniversalLoad(body) {
     return (event) => {
@@ -22,10 +34,6 @@ export function remultApiUniversalLoad(body) {
             remult.apiClient.httpClient = event.fetch;
             return body(event);
         }
-        const user = remult.user;
-        return withRemult(async () => {
-            remult.user = user;
-            return body(event);
-        }, { dataProvider: new RestDataProvider(() => ({ httpClient: event.fetch })) });
+        return withRemultFetch(event.fetch, () => body(event));
     };
 }

package/esm/svelte/server/index.d.ts

@@ -1,12 +1,13 @@
 import type { ServerLoadEvent } from '@sveltejs/kit';
 /**
  * Wrap a SvelteKit SERVER load (`+page.server.ts`) so plain global `repo()` reads
- * apply the API gate (as the current user) instead of the privileged in-process
- * provider. Use it only when a server load should see exactly what the API exposes;
- * otherwise a server load keeps the DB provider (gate rows with `backendPrefilter`).
- * Gates direct `repo()` reads; BackendMethods keep their own `allowed` gate.
+ * apply the API gate (as the current user) instead of the privileged DB provider.
  *
- * TODO(remult): framework-agnostic (event passed through; provider read from
- * `remult`) - candidate to live in remult directly.
+ * Reads go through `event.fetch`: SvelteKit dispatches same-origin server fetch
+ * in-process (no network) and forwards cookies, so the app's real auth/hooks run
+ * for each read. Use it only when a server load should see exactly what the API
+ * exposes; otherwise a server load keeps the DB provider (gate rows with
+ * `backendPrefilter`). Gates direct `repo()` reads; BackendMethods keep their own
+ * `allowed` gate.
  */
 export declare function remultApiServerLoad<T>(body: (event: ServerLoadEvent) => Promise<T>): (event: ServerLoadEvent) => Promise<T>;

package/esm/svelte/server/index.js

@@ -1,27 +1,15 @@
-import { remult, withRemult } from 'remult';
-import { TestApiDataProvider } from 'remult/server';
-// SERVER-ONLY (imports `remult/server`). Never import from client-reachable code.
-// Lazily wrap the app's dataProvider once. TestApiDataProvider dispatches repo()
-// through the API pipeline in-process (so allowApiRead / apiPrefilter apply) and
-// carries the current user - no event.fetch, no `/api` round-trip.
-let apiDataProvider;
+import { withRemultFetch } from '../remultApiLoad.js';
 /**
  * Wrap a SvelteKit SERVER load (`+page.server.ts`) so plain global `repo()` reads
- * apply the API gate (as the current user) instead of the privileged in-process
- * provider. Use it only when a server load should see exactly what the API exposes;
- * otherwise a server load keeps the DB provider (gate rows with `backendPrefilter`).
- * Gates direct `repo()` reads; BackendMethods keep their own `allowed` gate.
+ * apply the API gate (as the current user) instead of the privileged DB provider.
  *
- * TODO(remult): framework-agnostic (event passed through; provider read from
- * `remult`) - candidate to live in remult directly.
+ * Reads go through `event.fetch`: SvelteKit dispatches same-origin server fetch
+ * in-process (no network) and forwards cookies, so the app's real auth/hooks run
+ * for each read. Use it only when a server load should see exactly what the API
+ * exposes; otherwise a server load keeps the DB provider (gate rows with
+ * `backendPrefilter`). Gates direct `repo()` reads; BackendMethods keep their own
+ * `allowed` gate.
  */
 export function remultApiServerLoad(body) {
-    return (event) => {
-        apiDataProvider ??= TestApiDataProvider({ dataProvider: remult.dataProvider });
-        const user = remult.user;
-        return withRemult(async () => {
-            remult.user = user;
-            return body(event);
-        }, { dataProvider: apiDataProvider });
-    };
+    return (event) => withRemultFetch(event.fetch, () => body(event));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firstly",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "description": "Firstly, an opinionated Remult setup!",
   "funding": "https://github.com/sponsors/jycouet",