rimecms 0.31.4 → 0.31.5

package/dist/panel/pages/dashboard/load.server.js

@@ -1,7 +1,8 @@
-import { panelUrl } from '../../util/url.js';
+import { panelUrlFor } from '../../util/url.js';
 import { capitalize } from '../../../util/string.js';
 export const dashboardLoad = async (event) => {
     const { locale, user, rime } = event.locals;
+    const panelSegment = event.params.panel;
     const entries = [];
     const normalizedPanelConfig = (c) => {
         const incomingConfig = c.panel || {};
@@ -21,7 +22,7 @@ export const dashboardLoad = async (event) => {
             description: panelConfig.description || null,
             slug: c.slug,
             canCreate: user && c.access.create(user, {}),
-            link: panelUrl(c.kebab),
+            link: panelUrlFor(panelSegment, c.kebab),
             titleSingular: c.label.singular,
             title: c.label.plural,
             layout: panelConfig.dashboard.layout
@@ -72,11 +73,11 @@ export const dashboardLoad = async (event) => {
                 prototype: 'area',
                 description: (area.panel && area.panel?.description) || null,
                 slug: area.slug,
-                link: panelUrl(area.kebab),
+                link: panelUrlFor(panelSegment, area.kebab),
                 title: area.label || capitalize(area.slug)
             });
         }
     }
-    const aria = [{ title: 'Dashboard', icon: 'dashboard', url: panelUrl() }];
+    const aria = [{ title: 'Dashboard', icon: 'dashboard', url: panelUrlFor(panelSegment) }];
     return { entries, aria };
 };

package/dist/panel/pages/live/Live.svelte

@@ -14,6 +14,7 @@
   import { setLocaleContext } from '../../context/locale.svelte';
   import { setTitleContext } from '../../context/title';
   import { setUserContext } from '../../context/user.svelte';
+  import { panelPath } from '../../util/url.js';
   import type { GenericDoc, User } from '../../../types';
   import { trycatchFetch } from '../../../util/function';
   import { snapshot } from '../../../util/state';
@@ -240,13 +241,8 @@
     const slug = data.slug;
     const id = data.doc.id;
 
-    // Start with the base URI for the panel
-    let panelUri = `/panel/${toKebabCase(slug)}`;
-
-    // Add the item ID to the URI if we're updating a collection doc
-    if (id) {
-      panelUri += `/${id}`;
-    }
+    // Start with the base URI for the panel, adding the item ID if present
+    const panelUri = id ? panelPath(toKebabCase(slug), id) : panelPath(toKebabCase(slug));
     return goto(panelUri);
   }
 

package/dist/panel/util/url.d.ts

@@ -1,6 +1,35 @@
 /**
- * Build a panel url for given segments
+ * Build a panel url for given segments. Reads the current panel segment off
+ * the live matched route (page.params.panel, resolved by the [panel=panel]
+ * matcher) rather than from a public env var — the segment can be configured
+ * via RIME_PANEL_ROUTE to hide the panel from admin-path scanners, and that
+ * would be defeated by shipping it into every page's public env bundle.
+ *
+ * Only call this from actual component rendering (.svelte files, or a
+ * .svelte.ts context set up during component init) — page.params is bound to
+ * the current request via component context and SvelteKit throws if it's read
+ * anywhere else, including a +page.server.ts/+layout.server.ts load function
+ * or a form action, even though those also run server-side. Every load/action
+ * function in this codebase already receives an `event` with `event.params.panel`
+ * populated the same way — use panelUrlFor(event.params.panel, ...) there instead.
  * @example
  * panelUrl('some-collection') // -> http://localhost:5713/panel/some-collection
  */
 export declare function panelUrl(...args: string[]): string;
+/**
+ * Same as panelUrl(), but takes the panel segment explicitly instead of
+ * reading it off page.params — for any caller that isn't component rendering:
+ * every +page.server.ts/+layout.server.ts load function and form action
+ * (pass event.params.panel), plus the one hook-level caller that runs before
+ * resolve() (buildNavigation(), which gets it forwarded from routes.server.ts).
+ */
+export declare function panelUrlFor(panelSegment: string | undefined, ...args: string[]): string;
+/**
+ * Same as panelUrl(), but returns a same-origin-relative path instead of an
+ * absolute URL — for goto()/form-action targets where PUBLIC_RIME_URL isn't
+ * guaranteed to match the actual origin the page was served from (a reverse
+ * proxy, differing dev host, etc). Everywhere else (real cross-page <a href>
+ * links, window.location.href, emailed reset links) stays absolute, matching
+ * apiUrl()'s existing convention.
+ */
+export declare function panelPath(...args: string[]): string;

package/dist/panel/util/url.js

@@ -1,9 +1,43 @@
+import { page } from '$app/state';
 import { env } from '$env/dynamic/public';
 /**
- * Build a panel url for given segments
+ * Build a panel url for given segments. Reads the current panel segment off
+ * the live matched route (page.params.panel, resolved by the [panel=panel]
+ * matcher) rather than from a public env var — the segment can be configured
+ * via RIME_PANEL_ROUTE to hide the panel from admin-path scanners, and that
+ * would be defeated by shipping it into every page's public env bundle.
+ *
+ * Only call this from actual component rendering (.svelte files, or a
+ * .svelte.ts context set up during component init) — page.params is bound to
+ * the current request via component context and SvelteKit throws if it's read
+ * anywhere else, including a +page.server.ts/+layout.server.ts load function
+ * or a form action, even though those also run server-side. Every load/action
+ * function in this codebase already receives an `event` with `event.params.panel`
+ * populated the same way — use panelUrlFor(event.params.panel, ...) there instead.
  * @example
  * panelUrl('some-collection') // -> http://localhost:5713/panel/some-collection
  */
 export function panelUrl(...args) {
-    return `${env.PUBLIC_RIME_URL}/panel/${args.join('/')}`;
+    return panelUrlFor(page.params.panel, ...args);
+}
+/**
+ * Same as panelUrl(), but takes the panel segment explicitly instead of
+ * reading it off page.params — for any caller that isn't component rendering:
+ * every +page.server.ts/+layout.server.ts load function and form action
+ * (pass event.params.panel), plus the one hook-level caller that runs before
+ * resolve() (buildNavigation(), which gets it forwarded from routes.server.ts).
+ */
+export function panelUrlFor(panelSegment, ...args) {
+    return `${env.PUBLIC_RIME_URL}/${panelSegment}/${args.join('/')}`;
+}
+/**
+ * Same as panelUrl(), but returns a same-origin-relative path instead of an
+ * absolute URL — for goto()/form-action targets where PUBLIC_RIME_URL isn't
+ * guaranteed to match the actual origin the page was served from (a reverse
+ * proxy, differing dev host, etc). Everywhere else (real cross-page <a href>
+ * links, window.location.href, emailed reset links) stays absolute, matching
+ * apiUrl()'s existing convention.
+ */
+export function panelPath(...args) {
+    return `/${page.params.panel}/${args.join('/')}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rimecms",
-  "version": "0.31.4",
+  "version": "0.31.5",
   "homepage": "https://github.com/bienbiendev/rime",
   "packageManager": "bun@1.3.0",
   "scripts": {